joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438120
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov eax, dword [esi]
cmp byte [eax + 8], bl
je 0x438143
mov al, 1
jmp 0x438267
mov byte [eax + 8], bl
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
jne 0x43816a
push str.Sig_test:_Invalid_PE_file_handle_n
push 2
call fcn.0059c991
pop ecx
push eax
call fcn.00417253
pop ecx
pop ecx
xor al, al
jmp 0x438267
push edi
push eax
push 1
push 2
pop edi
lea eax, [ebp - 8]
push edi
push eax
call fcn.005885cb
add esp, 0x10
test eax, eax
jne 0x43818c
push str.Sig_test:_Failed_to_read_MZ_signature_n
jmp 0x438241
mov eax, dword [ebp - 8]
mov ecx, 0x5a4d
cmp ax, cx
je 0x4381b8
push ecx
movzx eax, ax
push eax
push str.Sig_test:_Invaild_MZ_signature_n_Signature_is__x_and_should_be__x_n
push edi
call fcn.0059c991
pop ecx
push eax
call fcn.00417253
add esp, 0x10
jmp 0x438250
mov eax, dword [esi]
push ebx
push 0x3c
push dword [eax]
call fcn.00597a35
add esp, 0xc
test eax, eax
je 0x4381d2
push str.Sig_test:_Failed_to_seek_to_e_lfanew_position_n
jmp 0x438241
mov eax, dword [esi]
push dword [eax]
lea eax, [ebp - 4]
push 1
push 4
push eax
call fcn.005885cb
add esp, 0x10
test eax, eax
jne 0x4381f1
push str.Sig_test:_Failed_to_read_e_lfanew_value_n
jmp 0x438241
mov ecx, dword [esi]
mov eax, dword [ebp - 4]
push ebx
mov dword [ecx + 0x14], eax
mov eax, dword [esi]
push dword [ebp - 4]
push dword [eax]
call fcn.00597a35
add esp, 0xc
test eax, eax
je 0x438214
push str.Sig_test:_Failed_to_seek_to_optional_header_start_n
jmp 0x438241
mov eax, dword [esi]
push dword [eax]
lea eax, [ebp - 0xc]
push 1
push 4
push eax
call fcn.005885cb
add esp, 0x10
test eax, eax
jne 0x438233
push str.Sig_test:_Failed_to_read_PE_signature_n
jmp 0x438241
cmp dword [ebp - 0xc], 0x4550
je 0x438254
push str.Sig_test:_Invalid_PE_signature_n
push edi
call fcn.0059c991
pop ecx
push eax
call fcn.00417253
pop ecx
pop ecx
xor al, al
jmp 0x438266
mov ecx, dword [esi]
push dword [ecx]
call fcn.0059ea9a
pop ecx
mov ecx, dword [esi]
mov al, 1
mov byte [ecx + 8], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4382f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
mov dword [ebp - 0x18], eax
push 0
mov edx, dword [esi]
mov eax, dword [edx + 0x50]
add eax, dword [ebp + 8]
push eax
push dword [edx]
call fcn.00597a35
mov eax, dword [esi]
push dword [eax]
lea eax, [ebp - 0x14]
push 1
push 0x10
push eax
call fcn.005885cb
add esp, 0x1c
test eax, eax
jne 0x438351
push str.Failed_to_read_directory_n
push 2
call fcn.0059c991
pop ecx
push eax
call fcn.00417253
pop ecx
pop ecx
jmp 0x4383e3
movzx ecx, word [ebp - 6]
movzx eax, word [ebp - 8]
push edi
xor edi, edi
add eax, ecx
mov dword [ebp - 0x20], eax
je 0x4383e2
mov eax, dword [esi]
push dword [eax]
lea eax, [ebp - 0x28]
push 1
push 8
push eax
call fcn.005885cb
add esp, 0x10
test eax, eax
je 0x4383cd
mov eax, dword [esi]
push dword [eax]
call fcn.0059806b
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
pop ecx
test edx, edx
js 0x4383a1
mov ecx, dword [ebx]
and edx, 0x7fffffff
mov eax, dword [ebp - 0x18]
mov dword [eax + ecx*4], edx
inc dword [ebx]
jmp 0x4383b3
push ebx
push dword [ebp - 0x18]
and edx, 0x7fffffff
mov ecx, esi
push edx
call fcn.004382f0
mov eax, dword [ebp - 0x1c]
push 0
push eax
mov eax, dword [esi]
push dword [eax]
call fcn.00597a35
add esp, 0xc
inc edi
cmp edi, dword [ebp - 0x20]
jl 0x438363
jmp 0x4383e2
push str.Failed_to_read_directory_entry_n
push 2
call fcn.0059c991
pop ecx
push eax
call fcn.00417253
pop ecx
pop ecx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00506d7f
mov esp, ebp
pop ebp
ret 0xc

Function at 0x438771
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
push esi
push esi
mov eax, dword [ebx]
mov edi, 0x80
mov dword [ebp - 8], ebx
push dword [eax]
call fcn.00597a35
push edi
call fcn.0059b115
mov ecx, dword [ebx]
mov dword [ebp - 4], eax
push dword [ecx]
push 1
push edi
push eax
call fcn.005885cb
add esp, 0x20
test eax, eax
jne 0x4387c6
push str.Failed_to_read_DOS_header_data_to_validate_Rich_checksum_n
push 2
call fcn.0059c991
pop ecx
push eax
call fcn.00417253
pop ecx
pop ecx
xor al, al
jmp 0x438833
mov ebx, esi
mov esi, dword [ebp - 4]
cmp ebx, 0x3c
jb 0x4387d5
cmp ebx, 0x40
jb 0x4387f1
movzx edx, byte [ebx + esi]
mov al, bl
and al, 0x1f
push 0x20
pop ecx
sub cl, al
mov eax, edx
shr eax, cl
mov ecx, ebx
and ecx, 0x1f
shl edx, cl
or eax, edx
add edi, eax
inc ebx
cmp ebx, 0x80
jb 0x4387cb
push esi
call fcn.00576006
mov ebx, dword [ebp - 8]
pop ecx
push 0
pop esi
mov ebx, dword [ebx]
cmp dword [ebx + 0x44], 0
jbe 0x43882d
mov eax, dword [ebp + 8]
mov eax, dword [eax + esi*4]
mov edx, dword [eax]
mov ecx, dword [eax + 8]
shl edx, 0x10
and ecx, 0x1f
or edx, dword [eax + 4]
rol edx, cl
add edi, edx
inc esi
cmp esi, dword [ebx + 0x44]
jb 0x43880f
cmp edi, dword [ebx + 0x60]
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4393d5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
xor edi, edi
push 0x208
push edi
push eax
mov dword [ebp - 0x210], edi
call fcn.0056b050
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push 0x8019
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, esi
test eax, eax
js 0x43942e
lea eax, [ebp - 0x20c]
push eax
jmp 0x439433
push 0x5f1b30
call fcn.00413f09
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00506d7f
mov esp, ebp
pop ebp
ret 4

Function at 0x439473
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x439500
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4394ff
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push edi
push eax
call fcn.0056a550
add esp, 0xc
lea eax, [ebp - 4]
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
push ebx
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push ebx
push dword [ebp - 4]
call fcn.0043ac55
pop ecx
pop ecx
mov ecx, dword [ebp + 0x10]
push esi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x439b38
Capabilities:
Check if file exists

Disassembly:
push 0xc
mov eax, 0x5c5855
call fcn.00506dc7
mov dword [ebp - 0x14], ecx
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x439bce
push ecx
mov esi, esp
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
pop ecx
mov ecx, dword [ebp - 0x14]
mov dword [esi], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0042fedd
push dword [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x439bb2
mov eax, dword [ebp - 0x10]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
mov dword [ebp - 0x18], esi
call fcn.00412393
pop ecx
mov ecx, dword [ebp - 0x14]
add eax, 0x10
mov dword [esi], eax
call fcn.00439b38
test eax, eax
je 0x439bc3
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x439bc3
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, edi
call fcn.00506d90
ret 4
Function at 0x439d32
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0xb0], ecx
push 6
pop edx
mov byte [ebp - 0x3c], 0
lea edi, [ebp - 0x3b]
mov ecx, edx
mov byte [ebp - 0x74], 0
rep stosd dword es:[edi], eax
mov ecx, edx
mov byte [ebp - 0x20], 0
mov byte [ebp - 0x58], 0
mov esi, dword [ebp + 8]
stosw word es:[edi], ax
mov ebx, dword [ebp + 0xc]
push 0x1c
push esi
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x73]
rep stosd dword es:[edi], eax
mov ecx, edx
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x1f]
rep stosd dword es:[edi], eax
mov ecx, edx
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x57]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x3c]
push eax
call fcn.0056a550
push 0x1c
lea eax, [esi + 0x1c]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.0056a550
add esp, 0x18
imul edi, ebx, 0x300
xor esi, esi
push 0x1c
add edi, dword [ebp - 0xb0]
pop ebx
movsx ecx, byte [esi + 0x5fa8b8]
mov eax, ebx
sub eax, ecx
push eax
lea eax, [ebp - 0x3c]
add eax, ecx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0056a550
movsx ecx, byte [esi + 0x5fa8b8]
lea eax, [ebp - 0x3c]
push ecx
push eax
lea eax, [ebp - 4]
sub eax, ecx
push eax
call fcn.0056a550
movsx ecx, byte [esi + 0x5fa8b8]
mov eax, ebx
sub eax, ecx
push eax
lea eax, [ebp - 0x74]
add eax, ecx
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0056a550
movsx ecx, byte [esi + 0x5fa8b8]
lea eax, [ebp - 0x74]
push ecx
push eax
lea eax, [ebp - 0x3c]
sub eax, ecx
push eax
call fcn.0056a550
push 0x38
lea eax, [ebp - 0xac]
push 0
push eax
call fcn.0056b050
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.0056a550
add esp, 0x48
lea eax, [ebp - 0x58]
push ebx
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.0056a550
add esp, 0xc
xor ecx, ecx
movsx eax, byte [ecx + 0x5fa888]
mov al, byte [ebp + eax - 0xad]
mov byte [edi + ecx], al
inc ecx
cmp ecx, 0x30
jl 0x439e64
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0056a550
push ebx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.0056a550
add esp, 0x18
add edi, 0x30
inc esi
cmp esi, 0x10
jl 0x439dc6
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00506d7f
mov esp, ebp
pop ebp
ret 8

Function at 0x439eba
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
xor edi, edi
push 0x208
push edi
push eax
mov dword [ebp - 0x210], edi
call fcn.0056b050
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push 0x8000
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, esi
test eax, eax
js 0x439f13
lea eax, [ebp - 0x20c]
push eax
jmp 0x439f18
push 0x5f1b30
call fcn.00413f09
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00506d7f
mov esp, ebp
pop ebp
ret 4
Function at 0x43a802
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
pop esi
push esi
xor ebx, ebx
mov dword [ebp - 0x108], ecx
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.0056b050
push esi
lea eax, [ebp - 0x84]
push ebx
push eax
call fcn.0056b050
push 7
xor eax, eax
mov byte [ebp - 0x44], bl
pop ecx
lea edi, [ebp - 0x43]
mov byte [ebp - 0x24], bl
rep stosd dword es:[edi], eax
push 7
pop ecx
push esi
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x23]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc4]
push eax
call fcn.0056b050
mov edi, dword [ebp - 0x108]
lea eax, [ebp - 0x104]
add esp, 0x24
mov ecx, edi
push esi
push eax
push dword [ebp + 8]
call fcn.004395b8
mov ecx, ebx
movsx eax, byte [ecx + 0x5fa8c8]
mov al, byte [ebp + eax - 0x105]
mov byte [ebp + ecx - 0x84], al
inc ecx
cmp ecx, esi
jl 0x43a88a
push 0x20
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0056a550
push 0x20
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0056a550
add esp, 0x18
mov esi, ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x24]
mov ecx, edi
push esi
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0043aca3
inc esi
cmp esi, 0x10
jl 0x43a8ca
push 0x20
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0056a550
push 0x20
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.0056a550
add esp, 0x18
lea edx, [edi + 0x600]
movsx eax, byte [ebx + 0x5fab58]
mov al, byte [ebp + eax - 0xc5]
mov byte [edx + ebx], al
inc ebx
cmp ebx, 0x40
jl 0x43a910
push 0x40
push edx
lea eax, [edi + 0x680]
mov ecx, edi
push eax
call fcn.00439506
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00506d7f
mov esp, ebp
pop ebp
ret 8
Function at 0x43a94b
Capabilities:
Create process on windows

Disassembly:
push 0x58
mov eax, 0x5c58b0
call fcn.00506dc7
xor edi, edi
lea eax, [ebp - 0x60]
push 0x40
push edi
push eax
mov dword [ebp - 4], edi
call fcn.0056b050
add esp, 0xc
mov dword [ebp - 0x64], 0x44
lea eax, [ebp - 0x64]
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 5
pop eax
mov word [ebp - 0x34], ax
xor ebx, ebx
mov eax, dword [ebp + 8]
inc ebx
add eax, 0xfffffff0
mov dword [ebp - 0x38], ebx
push eax
call fcn.00412393
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], bl
cmp dword [esi - 4], ebx
jle 0x43a9b9
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00412624
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push edi
push edi
push ebx
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x43a9e7
push dword [ebp - 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x1c]
call edi
mov edi, ebx
lea ecx, [esi - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, edi
call fcn.00506d90
ret

Function at 0x43aa02
Capabilities:
Query environment variable

Disassembly:
push 0x80c
mov eax, 0x5c58f5
call fcn.00506dfb
mov esi, dword [ebp + 8]
and dword [ebp - 0x814], 0
mov dword [ebp - 0x818], esi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
add edi, 0xfffffff0
inc ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00412393
add eax, 0x10
mov dword [esi], eax
mov dword [esp], 0x800
lea eax, [ebp - 0x810]
push 0
push eax
mov dword [ebp - 0x814], ebx
call fcn.0056b050
add esp, 0xc
lea eax, [ebp - 0x810]
push 0x1f4
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x43aa92
lea eax, [ebp - 0x810]
push eax
push 0x5f9ae8
push esi
call fcn.00412690
add esp, 0xc
mov ecx, esi
call fcn.00435d4e
mov ecx, eax
call fcn.00435c76
mov ecx, edi
call fcn.00412ac4
mov eax, esi
call fcn.00506da5
ret

Function at 0x43aaa1
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, 0x5fa908
push esi
push edi
mov edi, dword [ebp + 8]
sub edx, ecx
push 0x30
pop esi
movsx eax, byte [edx + ecx]
mov al, byte [eax + edi - 1]
mov byte [ecx], al
inc ecx
sub esi, 1
jne 0x43aab6
pop edi
pop esi
pop ebp
ret 8

Function at 0x43aacc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x43aaf2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43aaf2
test al, 0x10
jne 0x43aaf2
mov al, 1
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x43aca3
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x100], eax
mov eax, dword [ebp + 0xc]
push 0x30
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0xc4]
push 0
push eax
mov dword [ebp - 0xf8], ecx
call fcn.0056b050
push 0x30
lea eax, [ebp - 0xf4]
push 0
push eax
call fcn.0056b050
push 7
xor eax, eax
lea edi, [ebp - 0x23]
pop ecx
xor edx, edx
mov byte [ebp - 0x24], dl
rep stosd dword es:[edi], eax
push 7
pop ecx
mov byte [ebp - 0x64], dl
stosw word es:[edi], ax
push 0x30
push edx
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x63]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x94]
push eax
call fcn.0056b050
push 7
xor eax, eax
mov byte [ebp - 0x44], 0
pop ecx
lea edi, [ebp - 0x43]
shl esi, 4
rep stosd dword es:[edi], eax
add esi, ebx
push 0x30
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [ebp - 0xf8]
imul eax, esi, 0x30
add eax, edi
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.0056a550
mov esi, dword [ebp - 0xfc]
lea eax, [ebp - 0xc4]
add esp, 0x30
mov ecx, edi
push eax
push esi
call fcn.0043aaa1
xor ebx, ebx
mov eax, ebx
movups xmm1, xmmword [ebp + eax - 0x94]
movups xmm0, xmmword [ebp + eax - 0xc4]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0xf4], xmm1
add eax, 0x10
cmp eax, 0x30
jb 0x43ad74
lea eax, [ebp - 0x44]
mov ecx, edi
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.004397e6
mov ecx, ebx
movsx eax, byte [ecx + 0x5fab38]
mov al, byte [ebp + eax - 0x45]
mov byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0x20
jl 0x43adac
mov edi, dword [ebp - 0x100]
lea eax, [ebp - 0x24]
mov edx, edi
sub edx, eax
lea eax, [ebp - 0x24]
add eax, ebx
mov cl, byte [edx + eax]
xor cl, byte [eax]
mov byte [ebp + ebx - 0x64], cl
inc ebx
cmp ebx, 0x20
jb 0x43adce
push 0x20
push esi
push edi
call fcn.0056a550
push 0x20
lea eax, [ebp - 0x64]
push eax
push esi
call fcn.0056a550
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00506d7f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43c390
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d0c
call fcn.00506f00
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
push edi
call fcn.004124d1
xor esi, esi
push esi
lea eax, [ebp - 0x204]
push 0x5f5c30
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x204]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x43c3f7
inc esi
cmp esi, 4
jl 0x43c3b6
jmp 0x43c49e
and dword [ebp - 0x2d0c], 0
lea eax, [ebp - 0x2cfc]
mov esi, 0x2710
push esi
push 0
push eax
call fcn.0056b050
push 0xc
lea eax, [ebp - 0x2d08]
push 0
push eax
call fcn.0056b050
xor eax, eax
push esi
push eax
mov dword [ebp - 0x2d08], eax
mov dword [ebp - 0x2d04], eax
lea eax, [ebp - 0x2cfc]
push eax
call fcn.0056b050
add esp, 0x24
lea eax, [ebp - 0x2d0c]
push 0
push eax
push esi
lea eax, [ebp - 0x2cfc]
push eax
push 0xc
lea eax, [ebp - 0x2d08]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x43c49e
lea eax, [ebp - 0x5ec]
push eax
push 1
push dword [ebp - 0x2ce4]
lea eax, [ebp - 0x2cfc]
push eax
call fcn.004401e7
add esp, 0x10
lea eax, [ebp - 0x5ec]
mov ecx, ebx
push eax
call fcn.00411f8a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00506d7f
mov esp, ebp
pop ebp
ret

Function at 0x43d5db
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x43d668
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x43d667
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push edi
push eax
call fcn.0056a550
add esp, 0xc
lea eax, [ebp - 4]
xor ebx, ebx
mov dword [ebp - 4], ebx
push eax
push ebx
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push ebx
push dword [ebp - 4]
call fcn.0043ac7c
pop ecx
pop ecx
mov ecx, dword [ebp + 0x10]
push esi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43d6dc
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
push 0x40
push esi
lea eax, [edi + 0x600]
push eax
call fcn.0056b050
push 0x40
lea eax, [edi + 0x640]
push esi
push eax
call fcn.0056b050
push 8
lea eax, [edi + 0x680]
push esi
push eax
call fcn.0056b050
push 8
lea eax, [edi + 0x688]
push esi
push eax
call fcn.0056b050
push 0x41
lea eax, [edi + 0x690]
push esi
push eax
call fcn.0056b050
push 0x11
lea eax, [edi + 0x6d1]
push esi
push eax
call fcn.0056b050
add esp, 0x48
lea eax, [edi + 0x6e2]
push 9
push esi
push eax
call fcn.0056b050
mov ebx, 0x1000
lea eax, [edi + 0x6eb]
push ebx
push esi
push eax
call fcn.0056b050
push ebx
lea eax, [edi + 0x16eb]
push esi
push eax
call fcn.0056b050
push 0x40
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.0056b050
add esp, 0x30
lea eax, [ebp - 0x7c]
mov ecx, edi
push 0x40
push eax
push dword [ebp + 8]
call fcn.004395b8
push 0x38
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.0056b050
add esp, 0xc
movsx eax, byte [esi + 0x5fa850]
mov al, byte [ebp + eax - 0x7d]
mov byte [ebp + esi - 0x3c], al
inc esi
cmp esi, 0x38
jl 0x43d7ae
push dword [ebp + 0xc]
lea eax, [ebp - 0x3c]
mov ecx, edi
push eax
call fcn.00439d32
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00506d7f
mov esp, ebp
pop ebp
ret 8

Function at 0x43d7e4
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x5c5f28
call fcn.00506dc7
mov esi, ecx
cmp dword [esi + 0x34], 0xffffffff
jne 0x43d866
lea ecx, [ebp - 0x30]
call fcn.0042ca82
and dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x5faba0
call fcn.00413f09
push ecx
push esp
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0043944c
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0
push eax
lea ecx, [ebp - 0x30]
call fcn.00434114
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb eax, eax
neg eax
mov dword [esi + 0x34], eax
mov eax, dword [ebp - 0x10]
lea ecx, [eax - 0x10]
call fcn.00412ac4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0042e60b
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00412ac4
cmp dword [esi + 0x34], 1
jne 0x43d870
mov al, 1
jmp 0x43d88e
cmp dword [ebp + 8], 0
je 0x43d88c
mov esi, str.pcmaster.dll_not_exist
push esi
call fcn.00588700
pop ecx
mov ecx, dword [ebp + 8]
push eax
push esi
call fcn.0041925b
xor al, al
call fcn.00506d90
ret 4

Function at 0x43d8da
Capabilities:
Check internet connectivity via wininet

Disassembly:
push 0
push 1
push 0x5f6850
call dword [sym.imp.WININET.dll_InternetCheckConnectionW]
test eax, eax
jne 0x43d8fb
push eax
push 1
push 0x5f6874
call dword [sym.imp.WININET.dll_InternetCheckConnectionW]
ret