joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bc4582
Capabilities:
Check if file exists

Disassembly:
push 0x8c
mov eax, 0x43c177c3
call fcn.43bfae59
mov esi, ecx
test esi, esi
je 0x43bc46fa
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43bc46fa
xor ebx, ebx
mov dword [ebp - 0x24], 0xaac56b
xor eax, eax
mov dword [ebp - 0x20], 0x11d0cd44
mov dword [ebp - 0x1c], 0xc000c28c
mov dword [ebp - 0x18], 0xee95c24f
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x2c], ebx
mov word [ebp - 0x3c], ax
push ecx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.43bc2b03
pop ecx
test al, al
jne 0x43bc45f0
xor edi, edi
jmp 0x43bc46eb
push str.Wintrust.dll
lea ecx, [ebp - 0x54]
call fcn.43bc35c0
lea edx, [ebp - 0x54]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
call fcn.43bc260e
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], bl
call fcn.43bc1f54
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
jne 0x43bc4641
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor edi, edi
jmp 0x43bc46e4
push str.WinVerifyTrust
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x58], eax
test eax, eax
jne 0x43bc465e
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
jmp 0x43bc46db
xor eax, eax
lea edi, [ebp - 0x68]
stosd dword es:[edi], eax
push 0x30
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0x64], esi
xor edi, edi
pop esi
push esi
push edi
push eax
mov dword [ebp - 0x68], 0x10
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edi
call fcn.43bfa2b0
add esp, 0xc
mov dword [ebp - 0x98], esi
lea eax, [ebp - 0x68]
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0x8c], 2
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x88], edi
push eax
push edi
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], 0x100
mov dword [ebp - 0x6c], edi
call dword [ebp - 0x58]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
test esi, esi
sete bl
push edi
push 1
lea ecx, [ebp - 0x3c]
call fcn.43bc1f54
mov eax, ebx
jmp 0x43bc46fc
xor eax, eax
call fcn.43bfae08
ret
Function at 0x43bc556e
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x43c3a250]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
push 0
push 1
lea edx, [edi + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
jne 0x43bc559e
mov al, al
jmp 0x43bc56ce
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.43bfa2b0
add esp, 0xc
lea eax, [ebp - 0x20c]
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.urlmon.dll
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.43bfe318
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x210], eax
test eax, eax
je 0x43bc56cb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CoInternetGetSession
push eax
call esi
push str.CoInternetIsFeatureEnabled
push dword [ebp - 0x210]
mov dword [edi + 4], eax
call esi
push str.CoInternetSetFeatureEnabled
push dword [ebp - 0x210]
mov dword [edi + 8], eax
call esi
push str.ObtainUserAgentString
push dword [ebp - 0x210]
mov dword [edi + 0xc], eax
call esi
push str.RegisterBindStatusCallback
push dword [ebp - 0x210]
mov dword [edi + 0x10], eax
call esi
push str.UrlMkGetSessionOption
push dword [ebp - 0x210]
mov dword [edi + 0x14], eax
call esi
push str.UrlMkSetSessionOption
push dword [ebp - 0x210]
mov dword [edi + 0x18], eax
call esi
push str.URLDownloadToCacheFileW
push dword [ebp - 0x210]
mov dword [edi + 0x1c], eax
call esi
push str.CreateAsyncBindCtx
push dword [ebp - 0x210]
mov dword [edi + 0x20], eax
call esi
push str.CreateURLMoniker
push dword [ebp - 0x210]
mov dword [edi + 0x24], eax
call esi
push str.CreateUri
push dword [ebp - 0x210]
mov dword [edi + 0x28], eax
call esi
mov dword [edi + 0x2c], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov al, 1
jmp 0x43bc56cd
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.43bfad82
mov esp, ebp
pop ebp
ret
Function at 0x43bc5f4f
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x43c3a250]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x43c3cfa8]
cmp eax, 0xffffffff
jne 0x43bc60d6
push 0x110
lea eax, [ebp - 0x114]
mov dword [0x43c3cfa8], 0xfffffc18
push 0
push eax
mov dword [ebp - 0x118], 0x114
call fcn.43bfa2b0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x43bc60d1
cmp dword [ebp - 0x108], 2
jne 0x43bc60d1
mov ecx, dword [ebp - 0x114]
cmp ecx, 5
jne 0x43bc6051
mov eax, dword [ebp - 0x110]
test eax, eax
jne 0x43bc5fdb
inc eax
jmp 0x43bc60b8
cmp eax, 1
jne 0x43bc6044
push 0x7f
lea eax, [ebp - 0x104]
push eax
push str.Service_Pack_1
call fcn.43bfe384
add esp, 0xc
test eax, eax
jne 0x43bc6001
push 3
jmp 0x43bc60b7
push 0x7f
lea eax, [ebp - 0x104]
push eax
push str.Service_Pack_2
call fcn.43bfe384
add esp, 0xc
test eax, eax
jne 0x43bc6022
push 4
jmp 0x43bc60b7
push 0x7f
lea eax, [ebp - 0x104]
push eax
push str.Service_Pack_3
call fcn.43bfe384
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 5
jmp 0x43bc60b8
cmp eax, 2
jne 0x43bc60d1
push 6
jmp 0x43bc60b7
cmp ecx, 6
jne 0x43bc60b0
cmp dword [ebp - 0x110], 0
jne 0x43bc609f
push 0x7f
lea eax, [ebp - 0x104]
push eax
push str.Service_Pack_1
call fcn.43bfe384
add esp, 0xc
test eax, eax
jne 0x43bc607d
push 8
jmp 0x43bc60b7
push 0x7f
lea eax, [ebp - 0x104]
push eax
push str.Service_Pack_2
call fcn.43bfe384
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 9
jmp 0x43bc60b8
xor eax, eax
cmp dword [ebp - 0x110], 1
setne al
add eax, 0xa
jmp 0x43bc60b8
cmp ecx, 0xa
jne 0x43bc60bf
push 0xd
pop eax
mov dword [0x43c3cfa8], eax
jmp 0x43bc60d6
mov eax, dword [0x43c3cfa8]
cmp ecx, 6
mov edx, 0x3e8
cmova eax, edx
jmp 0x43bc60b8
mov eax, dword [0x43c3cfa8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.43bfad82
mov esp, ebp
pop ebp
ret

Function at 0x43bc6b5a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x43c3a250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x5c
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call fcn.43bfa2b0
add esp, 0xc
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push esi
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
push pe_nt_image_headers32
lea eax, [ebp - 0x11c]
push ebx
push eax
call fcn.43bfa2b0
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x11c], 6
jne 0x43bc6bd0
cmp byte [ebp - 6], cl
jne 0x43bc6bdd
mov bl, cl
cmp dword [ebp - 0x11c], 6
movzx ebx, bl
cmova ebx, ecx
mov ecx, str.Tahoma
test bl, bl
mov eax, 0x43c29d7c
cmove eax, ecx
push eax
lea eax, [esi + 0x1c]
push 0x20
push eax
call fcn.43bfdd78
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop esi
pop ebx
call fcn.43bfad82
mov esp, ebp
pop ebp
ret
Function at 0x43bc8361
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x43c416b0], 2
push ebx
mov ebx, ecx
jne 0x43bc8408
mov eax, dword [0x43c416b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x43bc8407
mov eax, dword [edi + 4]
push esi
mov esi, dword [edi]
jmp 0x43bc8399
cmp dword [esi + 4], ebx
je 0x43bc839f
add esi, 8
cmp esi, eax
jne 0x43bc8391
mov esi, eax
cmp esi, eax
je 0x43bc8406
push dword [esi]
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [edi + 4]
jmp 0x43bc83be
mov eax, dword [esi]
mov dword [esi - 8], eax
mov eax, dword [esi + 4]
mov dword [esi - 4], eax
add esi, 8
cmp esi, ecx
jne 0x43bc83b3
add dword [edi + 4], 0xfffffff8
mov eax, dword [edi]
cmp eax, dword [edi + 4]
jne 0x43bc8406
test eax, eax
je 0x43bc83e3
push eax
call fcn.43bf9a5c
pop ecx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
push edi
call fcn.43bf9a5c
cmp dword [0x43c416b0], 2
pop ecx
je 0x43bc83f8
call fcn.43bca027
mov eax, dword [0x43c416b4]
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43bc840d
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
call fcn.43bc8361
push 0x43bc84f0
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x43c416b0], 2
mov ebx, eax
je 0x43bc843e
call fcn.43bca027
mov ecx, dword [0x43c416b4]
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x43bc848b
push 0xc
call fcn.43bc1420
mov esi, eax
pop ecx
test esi, esi
je 0x43bc846d
and dword [esi], 0
and dword [esi + 4], 0
and dword [esi + 8], 0
jmp 0x43bc846f
xor esi, esi
cmp dword [0x43c416b0], 2
je 0x43bc847d
call fcn.43bca027
mov eax, dword [0x43c416b4]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 4]
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
cmp ecx, eax
jae 0x43bc84ca
cmp dword [esi], ecx
ja 0x43bc84ca
mov edi, ecx
sub edi, dword [esi]
sar edi, 3
cmp eax, dword [esi + 8]
jne 0x43bc84b3
push ecx
mov ecx, esi
call fcn.43bca0cb
mov ecx, dword [esi + 4]
mov edx, dword [esi]
test ecx, ecx
je 0x43bc84e3
mov eax, dword [edx + edi*8]
mov dword [ecx], eax
mov eax, dword [edx + edi*8 + 4]
mov dword [ecx + 4], eax
jmp 0x43bc84e3
cmp eax, dword [esi + 8]
jne 0x43bc84d7
push ecx
mov ecx, esi
call fcn.43bca0cb
mov eax, dword [esi + 4]
test eax, eax
je 0x43bc84e3
mov dword [eax], ebx
mov dword [eax + 4], edi
add dword [esi + 4], 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43bc8821
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x43c416b8], 2
push edi
mov edi, ecx
je 0x43bc883a
xor al, al
jmp 0x43bc88cc
mov eax, dword [0x43c416bc]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x43bc8873
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov dword [ebp - 4], eax
mov ecx, esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.43bc9f94
mov eax, dword [ebp - 8]
cmp eax, dword [esi]
je 0x43bc8873
cmp dword [eax + 0x14], edi
je 0x43bc8877
xor al, al
jmp 0x43bc88cb
push eax
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.43bc9d4f
cmp dword [esi + 4], 0
jne 0x43bc88b4
mov ecx, esi
call fcn.43bc9d26
push esi
call fcn.43bf9a5c
cmp dword [0x43c416b8], 2
pop ecx
je 0x43bc88a5
call fcn.43bca079
mov eax, dword [0x43c416bc]
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp byte [ebp + 8], 0
je 0x43bc88bf
xor eax, eax
inc eax
jmp 0x43bc88cb
call dword [sym.imp.USER32.dll_ReleaseCapture]
neg eax
sbb eax, eax
neg eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x43bc88d3
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x43c416b8], 2
mov dword [ebp - 4], ecx
je 0x43bc88e8
xor eax, eax
jmp 0x43bc891a
mov eax, dword [0x43c416bc]
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x43bc8912
lea eax, [ebp - 4]
mov ecx, esi
push eax
lea eax, [ebp - 8]
push eax
call fcn.43bc9f94
mov eax, dword [ebp - 8]
cmp eax, dword [esi]
jne 0x43bc8916
xor eax, eax
jmp 0x43bc8919
mov eax, dword [eax + 0x14]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43bca027
Capabilities:
Allocate thread local storage

Disassembly:
push 0
push 1
push 0x43c416b0
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x43bca06f
push esi
push 4
call fcn.43bc1420
mov esi, eax
pop ecx
test esi, esi
je 0x43bca053
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
jmp 0x43bca055
xor esi, esi
mov dword [0x43c416b4], esi
mov dword [0x43c416b0], 2
pop esi
ret
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x43c416b0], 2
jne 0x43bca067
ret

Function at 0x43bca079
Capabilities:
Allocate thread local storage

Disassembly:
push 0
push 1
push 0x43c416b8
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x43bca0c1
push esi
push 4
call fcn.43bc1420
mov esi, eax
pop ecx
test esi, esi
je 0x43bca0a5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi], eax
jmp 0x43bca0a7
xor esi, esi
mov dword [0x43c416bc], esi
mov dword [0x43c416b8], 2
pop esi
ret
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x43c416b8], 2
jne 0x43bca0b9
ret
Function at 0x43bca4a7
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x43c3a250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x110
xor ebx, ebx
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.43bfa2b0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x43bca4f7
cmp dword [ebp - 0x114], 6
jb 0x43bca4f7
inc ebx
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.43bfad82
mov esp, ebp
pop ebp
ret
Function at 0x43bcacff
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 8
mov eax, 0x43c17c7b
call fcn.43bfae26
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0xc], 0
jne 0x43bcad1b
xor al, al
jmp 0x43bcae1e
mov eax, dword [ebp + 0x10]
xor ebx, ebx
cmp dword [eax + 0x10], ebx
jne 0x43bcadc0
push 0x18
call fcn.43bc1420
pop ecx
test eax, eax
je 0x43bcad40
mov ecx, eax
call fcn.43bca6f6
mov esi, eax
jmp 0x43bcad42
mov esi, ebx
mov dword [ebp - 0x14], esi
test esi, esi
je 0x43bcad4c
inc dword [esi + 4]
push 0x10
mov dword [ebp - 4], ebx
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov edi, eax
test edi, edi
je 0x43bcad81
lea eax, [ebp + 0x10]
mov dword [edi], vtable.Gdiplus::Bitmap.0
push eax
push dword [ebp + 0xc]
mov dword [ebp + 0x10], ebx
push dword [ebp + 8]
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromResource]
mov dword [edi + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 4], eax
jmp 0x43bcad83
mov edi, ebx
mov dword [esi + 0xc], edi
test edi, edi
je 0x43bcadb3
lea edx, [ebp - 0x14]
lea ecx, [ebp + 8]
call fcn.43bcb62e
mov ecx, dword [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.43bcb608
mov byte [ebp - 4], bl
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x43bcadb1
call fcn.43bca290
mov bl, 1
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.43bca290
jmp 0x43bcae1c
cmp dword [eax + 0x14], 8
jb 0x43bcadc8
mov eax, dword [eax]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x43bcad14
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x43bcad14
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x10]
push eax
push esi
call fcn.43bcac79
push dword [ebp + 0xc]
mov bl, al
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov al, bl
call fcn.43bfadf4
ret 0xc

Function at 0x43bcea29
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, edx
mov dword [ebp - 8], ecx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x43bceab9
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x43bceab9
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x43bceab2
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x43bceaab
push ebx
push edi
push eax
call fcn.43bf9be0
and dword [ebp - 4], 0
lea eax, [ebp - 4]
add esp, 0xc
push eax
push 0
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x43bceaa4
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.43bce2b1
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43bceac0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
mov edi, ecx
cmp dword [edi + 4], 0
je 0x43bceb4b
push ebx
xor ebx, ebx
cmp dword [edi + 0xc], ebx
jle 0x43bceb4a
mov eax, dword [edi + 0x10]
mov dword [ebp - 8], 0xff
push esi
and dword [ebp - 4], 0
test eax, eax
jle 0x43bceb43
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
imul ecx, dword [ebp - 4]
imul eax, ebx
cdq
and edx, 7
lea esi, [edx + eax]
sar esi, 3
add esi, ecx
add esi, dword [edi + 8]
movzx ecx, byte [esi + 3]
movzx eax, byte [esi]
imul eax, ecx
cdq
idiv dword [ebp - 8]
mov byte [esi], al
movzx eax, byte [esi + 1]
imul eax, ecx
cdq
idiv dword [ebp - 8]
mov byte [esi + 1], al
movzx eax, byte [esi + 2]
imul eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov ecx, dword [ebp - 4]
inc ecx
mov byte [esi + 2], al
mov eax, dword [edi + 0x10]
mov dword [ebp - 4], ecx
cmp ecx, eax
jl 0x43bceae9
inc ebx
cmp ebx, dword [edi + 0xc]
jl 0x43bceae1
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x43bcf46e
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 8]
push esi
movzx eax, dx
mov esi, ecx
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
shr edx, 0x10
mov dword [ebp - 4], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 8]
mov ecx, esi
push eax
call fcn.43bcf572
mov edi, eax
test edi, edi
jne 0x43bcf4b5
push esi
push 0x43bcf73d
call dword [sym.imp.USER32.dll_EnumWindows]
jmp case.default.0x43bcf4c6
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [edi - 1]
cmp eax, 7
ja case.default.0x43bcf4c6
jmp dword [eax*4 + 0x43bcf552]
push dword [esi + 0x98]
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
cmp edi, 2
setne al
add eax, 0xf001
jmp 0x43bcf534
push dword [esi + 0x9c]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 0xf006
cmp edi, 1
lea ecx, [eax - 3]
jmp 0x43bcf531
push dword [esi + 0xa0]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 0xf008
cmp edi, 5
lea ecx, [eax - 4]
jmp 0x43bcf531
push dword [esi + 0xa4]
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 0xf007
cmp edi, 6
lea ecx, [eax - 2]
cmove eax, ecx
push 0
push eax
push 0x112
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43bcfcc0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push 0x24
mov eax, 0x43c18081
call fcn.43bfae59
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0x20], edi
xor ebx, ebx
lea eax, [ebp + 8]
push ebx
push 0x80
push 3
push ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x1c], 8
push 1
cmovae eax, dword [ebp + 8]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 1
cmp esi, 0xffffffff
je 0x43bcfe72
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x43bcfe72
push ebx
push ebx
push ebx
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 4], 2
test ebx, ebx
je 0x43bcfe2f
xor eax, eax
push eax
push eax
push eax
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [edi], edx
test edx, edx
je 0x43bcfe2f
mov ecx, dword [edx + 0x3c]
movzx eax, word [ecx + edx + 6]
test ax, ax
jne 0x43bcfd69
or dword [ebp - 0x24], 0xffffffff
jmp 0x43bcfd84
imul eax, eax, 0x28
add eax, ecx
mov ecx, dword [eax + edx + 0xe4]
add ecx, dword [eax + edx + 0xe0]
mov dword [ebp - 0x24], ecx
cmp ecx, 0xffffffff
jne 0x43bcfd8e
cmp dword [ebp - 0x28], 0xffffffff
jle 0x43bcfe1f
mov eax, dword [0x43c2a1f4]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
lea edx, [ecx + 1]
mov al, byte [0x43c2a1f8]
mov byte [ebp - 0x14], al
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43bcfda4
sub ecx, edx
mov dword [ebp - 0x1c], ecx
lea eax, [ecx + 1]
push eax
call fcn.43bf8c5e
push dword [ebp - 0x1c]
mov edi, eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
add eax, dword [ebp - 0x24]
push eax
push edi
call fcn.43bf9be0
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.43bfb366
add esp, 0x1c
test eax, eax
je 0x43bcfe5e
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov eax, dword [ecx + 0x3c]
mov eax, dword [eax + ecx + 8]
mov dword [ebp - 0x24], eax
cmp eax, dword [ebp - 0x28]
jg 0x43bcfe15
push dword [ebp - 0x1c]
add eax, ecx
push eax
push edi
call fcn.43bf9be0
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.43bfb366
add esp, 0x18
test eax, eax
je 0x43bcfe5e
push edi
call fcn.43bf9a5c
mov edi, dword [ebp - 0x20]
pop ecx
cmp dword [edi], 0
je 0x43bcfe2f
push dword [edi]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
and dword [edi], 0
xor edi, edi
cmp ebx, 0xffffffff
je 0x43bcfe3d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp esi, 0xffffffff
je 0x43bcfe4b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.43bc1f54
mov eax, edi
call fcn.43bfae08
ret
push edi
call fcn.43bf9a5c
mov eax, dword [ebp - 0x20]
pop ecx
mov edi, dword [eax]
add edi, dword [ebp - 0x1c]
add edi, dword [ebp - 0x24]
jmp 0x43bcfe31
mov edi, ebx
jmp 0x43bcfe3f