joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423ba0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0
push 0
mov esi, ebp
push 1
mov edi, ecx
shl esi, 5
push 0
add esi, edi
call ebx
push 0
push 0
push 1
push 0
mov dword [esi + 8], eax
call ebx
mov dword [esi + 0xc], eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x421670
push 0x10000
push 0
mov dword [esi + 0x14], 0
mov byte [esi + 0x18], 0
mov byte [esi + 4], 1
mov dword [esi + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x423c28
push str.CreateThread_failed
mov ecx, 0x46260c
call fcn.00417100
mov ecx, 0x46260c
call fcn.00416dc0
push 2
mov ecx, 0x46260c
call fcn.004171c0
push 1
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov dword [esi], ebx
mov dword [esp + 0x1c], ebp
call fcn.004217d0
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4251c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, ecx
mov cl, byte [eax + 0xcc49]
mov byte [ebp + 0x14a5], cl
mov dl, byte [eax + 0xcc4a]
mov byte [ebp + 0x14a4], dl
mov ecx, dword [eax + 0xca94]
push esi
mov dword [ebp + 0x14a0], ecx
mov edx, dword [eax + 0x4c00]
push edi
add eax, 0xcaa0
push eax
lea ecx, [ebp + 0x63c8]
mov dword [ebp + 0x60a8], edx
call fcn.0040daa0
mov ecx, dword [ebp + 0x20]
cmp ecx, 0x400000
jae 0x425273
mov edx, dword [ebp + 0x14a0]
cmp edx, ecx
jae 0x425244
mov esi, 0x400000
mov eax, edx
sub esi, ecx
lea esp, [esp]
mov ecx, dword [ebp]
lea edx, [ecx + esi]
mov dl, byte [edx + eax]
mov byte [ecx + eax], dl
inc eax
cmp eax, dword [ebp + 0x20]
jb 0x425230
jmp 0x425273
sub edx, ecx
xor eax, eax
mov esi, edx
test ecx, ecx
jbe 0x425262
mov edi, edi
mov ecx, dword [ebp]
lea edx, [ecx + esi]
mov dl, byte [edx + eax]
mov byte [ecx + eax], dl
inc eax
cmp eax, dword [ebp + 0x20]
jb 0x425250
mov dword [ebp + 0x14a0], 0
mov byte [ebp + 0x14a5], 1
mov esi, dword [ebp]
mov edi, dword [ebp + 0x20]
add edi, esi
cmp dword [esp + 0x18], 0
mov ecx, 0x44
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, dword [ebp + 0x14a0]
lea eax, [ebx + 1]
jne 0x4252e9
mov esi, dword [ebp + 0x24]
and eax, esi
xor edx, edx
mov dword [ebp + 0x14a0], eax
cmp eax, ebx
je 0x425312
mov ecx, dword [ebp]
movzx ecx, byte [eax + ecx + 2]
shl edx, 5
xor ecx, edx
mov edx, dword [ebp + 0x10]
and ecx, 0x7fff
lea edi, [edx + ecx*4]
mov edx, dword [edi]
mov dword [edi], eax
mov eax, dword [ebp + 0x14a0]
and edx, esi
mov esi, dword [ebp + 0x14]
mov dword [esi + eax*4], edx
mov eax, dword [ebp + 0x14a0]
mov esi, dword [ebp + 0x24]
inc eax
and eax, esi
mov edx, ecx
mov dword [ebp + 0x14a0], eax
cmp eax, ebx
jne 0x4252a4
jmp 0x425312
and eax, dword [ebp + 0x24]
mov dword [ebp + 0x14a0], eax
cmp eax, ebx
je 0x425312
push eax
mov ecx, ebp
call fcn.00422710
mov eax, dword [ebp + 0x14a0]
inc eax
and eax, dword [ebp + 0x24]
mov dword [ebp + 0x14a0], eax
cmp eax, ebx
jne 0x4252f6
mov esi, dword [esp + 0x14]
push 0x4bf0
add esi, 0x10
lea ecx, [ebp + 0x14b4]
push esi
push ecx
mov byte [ebp + 0x60a4], 0
call fcn.00441d30
add esp, 0xc
mov ecx, esi
call fcn.00439f30
lea ecx, [ebp + 0xda8]
call fcn.004279b0
pop edi
xor eax, eax
pop esi
mov dword [ebp + 0x974], eax
mov dword [ebp + 0x978], eax
mov byte [ebp + 0x97c], 1
pop ebp
pop ebx
ret 8
Function at 0x429000
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
push 0x1a
push 0
mov byte [esi], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x429087
mov edx, dword [esp + 4]
push esi
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x429087
cmp byte [esi], 0
je 0x429087
push esi
call fcn.00428f40
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x429047
mov ecx, dword [0x450b4c]
mov dword [eax], ecx
mov dx, word [0x450b50]
mov word [eax + 4], dx
mov cl, byte [0x450b52]
push 0
push esi
mov byte [eax + 6], cl
call fcn.0041c3d0
test al, al
jne 0x4290b3
push 0
push 0
push 0
push esi
call fcn.0041cba0
test eax, eax
je 0x4290b3
push 0x400
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
call fcn.00428a40
lea edx, [esi + 2]
cmp eax, edx
jb 0x4290b0
cmp byte [esi + 1], 0x3a
jne 0x4290af
add esi, 4
cmp eax, esi
jb 0x4290b0
dec eax
mov byte [eax], 0
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
pop esi
add esp, 8
ret 4

Function at 0x4290d0
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov esi, dword [esp + 0x10]
lea edx, [esp + 4]
push edx
xor ecx, ecx
push 0x1a
push ecx
mov word [esi], cx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x42916d
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x42916d
cmp word [esi], 0
je 0x42916d
push esi
call fcn.00428630
mov eax, esi
add eax, 0xfffffffe
jmp 0x429120
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x429120
mov ecx, dword [0x450b54]
mov dword [eax], ecx
mov edx, dword [0x450b58]
mov dword [eax + 4], edx
mov ecx, dword [0x450b5c]
mov dword [eax + 8], ecx
mov dx, word [0x450b60]
push esi
push 0
mov word [eax + 0xc], dx
call fcn.0041c3d0
test al, al
jne 0x42919e
push 0
push 0
push esi
push 0
call fcn.0041cba0
test eax, eax
je 0x42919e
push 0x400
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call fcn.00428ac0
lea ecx, [esi + 4]
cmp eax, ecx
jb 0x429199
cmp word [esi + 2], 0x3a
jne 0x429196
add esi, 8
cmp eax, esi
jb 0x429199
sub eax, 2
xor edx, edx
mov word [eax], dx
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
pop esi
add esp, 8
ret 4
Function at 0x4291c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
push 1
push 0
push 0x450b6c
push 0x80000001
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x429217
lea ecx, [esp + 4]
push ecx
push esi
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [esp + 0x20]
push 0x450b64
push eax
mov dword [esp + 0x1c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esi], 0
je 0x429228
push 0
push esi
call fcn.0041c3d0
test al, al
jne 0x42922e
push esi
call fcn.00429000
pop esi
add esp, 8
ret 4

Function at 0x429240
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push 1
xor eax, eax
push eax
push str.SoftwareWinRARPaths
push 0x80000001
mov word [esi], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x429299
mov ecx, dword [esp + 0x10]
lea edx, [esp + 4]
push edx
push esi
lea eax, [esp + 0x10]
push eax
push 0
push str.AppData
push ecx
mov dword [esp + 0x1c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esi], 0
je 0x4292ab
push esi
push 0
call fcn.0041c3d0
test al, al
jne 0x4292b1
push esi
call fcn.004290d0
pop esi
add esp, 8
ret 4
Function at 0x432f70
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x1010
call fcn.00442500
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x100c], eax
push ebx
mov ebx, dword [esp + 0x101c]
push ebp
mov ebp, dword [esp + 0x1024]
push esi
mov esi, dword [esp + 0x1020]
cmp ebx, esi
je 0x432fac
push ebp
push esi
push ebx
call fcn.00437df0
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SoftwareWinRARGeneral
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4330a9
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432fd2
sub eax, edx
sar eax, 1
mov ecx, 0x3ff
sub ecx, eax
add ecx, ecx
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x81c]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0x450d98
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43309e
push 0x400
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x820]
push edx
mov word [esp + 0x24], ax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [esp + 0x18]
push eax
call fcn.00428630
push esi
call fcn.00428ac0
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x433050
push edi
lea edi, [esp + 0x1c]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x433065
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
push 0
call fcn.0041c3d0
pop edi
test al, al
je 0x43309e
push ebp
lea edx, [esp + 0x1c]
push edx
push ebx
call fcn.00437df0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1018]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00441b8e
add esp, 0x1010
ret 0xc
Function at 0x4331a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x918
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x914], eax
push edi
mov edi, ecx
cmp byte [edi], 0
je 0x4331d7
mov eax, dword [0x462608]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [0x462604]
mov dword [0x462608], ecx
mov byte [edi], 0
mov eax, dword [esp + 0x924]
lea edx, [esp + 0x118]
test eax, eax
je 0x433201
sub edx, eax
jmp 0x4331f0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4331f0
jmp 0x43320f
push 0x400
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [esp + 0x11c]
push eax
mov esi, str.rarlng.dll
call fcn.00428ac0
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x433222
push 0x400
lea ecx, [esp + 0x120]
push ecx
mov edx, ecx
push edx
call fcn.00432f70
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x18], 2
pop esi
jne 0x433289
mov eax, dword [esp + 8]
cmp eax, 5
ja 0x433275
jne 0x433289
cmp dword [esp + 0xc], 1
jbe 0x433289
push 2
push 0
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x433297
lea edx, [esp + 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x462608], eax
setne al
mov byte [edi], al
test al, al
mov eax, dword [esp + 0x920]
pop edi
mov dword [0x462604], eax
jne 0x4332b9
mov dword [0x462608], eax
mov ecx, dword [esp + 0x914]
xor ecx, esp
call fcn.00441b8e
add esp, 0x918
ret 8
Function at 0x4332d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
mov ebp, ecx
mov ecx, 8
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
xor ecx, ecx
xor eax, eax
lea esp, [esp]
cmp edi, 0xa
jg 0x43342d
cmp eax, 4
jge 0x433346
mov edi, edi
cmp ecx, 4
jge 0x433349
mov bl, byte [esp + eax*4 + 0x10]
lea edx, [ecx + edi*4]
mov byte [ebp + edx*4 + 0x14], bl
lea edx, [ecx + edi*4]
lea esi, [ebp + edx*4]
movzx edx, byte [esp + eax*4 + 0x11]
mov byte [esi + 0x15], dl
movzx edx, byte [esp + eax*4 + 0x12]
mov byte [esi + 0x16], dl
movzx edx, byte [esp + eax*4 + 0x13]
inc eax
inc ecx
cmp eax, 4
mov byte [esi + 0x17], dl
jl 0x433310
cmp ecx, 4
jne 0x43334e
inc edi
xor ecx, ecx
cmp eax, 4
jl 0x433300
cmp edi, 0xa
jg 0x43342d
mov edx, 0x466658
movzx esi, byte [esp + 0x1d]
mov al, byte [esp + 0x10]
xor al, byte [esi + 0x466778]
movzx esi, byte [esp + 0x1e]
movzx ebx, byte [esi + 0x466778]
movzx esi, byte [esp + 0x1f]
xor byte [esp + 0x11], bl
movzx ebx, byte [esi + 0x466778]
movzx esi, byte [esp + 0x1c]
xor byte [esp + 0x12], bl
movzx ebx, byte [esi + 0x466778]
xor al, byte [edx]
xor byte [esp + 0x13], bl
mov byte [esp + 0x10], al
inc edx
lea eax, [esp + 0x11]
mov esi, 3
movzx ebx, byte [eax - 1]
xor byte [eax + 3], bl
movzx ebx, byte [eax]
xor byte [eax + 4], bl
movzx ebx, byte [eax + 1]
xor byte [eax + 5], bl
movzx ebx, byte [eax + 2]
xor byte [eax + 6], bl
add eax, 4
sub esi, 1
jne 0x4333b0
xor eax, eax
cmp edi, 0xa
jg 0x43342d
cmp eax, 4
jge 0x433417
nop
cmp ecx, 4
jge 0x43341a
movzx ebx, byte [esp + eax*4 + 0x10]
lea esi, [ecx + edi*4]
mov byte [ebp + esi*4 + 0x14], bl
movzx ebx, byte [esp + eax*4 + 0x11]
lea esi, [ecx + edi*4]
lea esi, [ebp + esi*4]
mov byte [esi + 0x15], bl
movzx ebx, byte [esp + eax*4 + 0x12]
mov byte [esi + 0x16], bl
movzx ebx, byte [esp + eax*4 + 0x13]
inc eax
inc ecx
cmp eax, 4
mov byte [esi + 0x17], bl
jl 0x4333e0
cmp ecx, 4
jne 0x43341f
inc edi
xor ecx, ecx
cmp eax, 4
jl 0x4333d5
cmp edi, 0xa
jle 0x433361
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00441b8e
add esp, 0x24
ret 4
Function at 0x433450
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
mov eax, ecx
push edi
lea esi, [eax + 0x24]
lea ecx, [eax + 0x28]
mov edi, 9
mov edi, edi
xor eax, eax
jmp 0x433480
movzx edx, byte [ecx - 1]
movzx edx, byte [eax + edx*4 + 0x463658]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x463a58]
movzx ebx, byte [ecx - 3]
xor dl, byte [eax + ebx*4 + 0x463e58]
movzx ebx, byte [ecx - 4]
xor dl, byte [eax + ebx*4 + 0x464258]
movzx ebx, byte [ecx + 2]
mov byte [esp + eax + 0xc], dl
movzx edx, byte [ecx + 3]
movzx edx, byte [eax + edx*4 + 0x463658]
xor dl, byte [eax + ebx*4 + 0x463a58]
movzx ebx, byte [ecx + 1]
xor dl, byte [eax + ebx*4 + 0x463e58]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x464258]
movzx ebx, byte [ecx + 6]
mov byte [esp + eax + 0x10], dl
movzx edx, byte [ecx + 7]
movzx edx, byte [eax + edx*4 + 0x463658]
xor dl, byte [eax + ebx*4 + 0x463a58]
movzx ebx, byte [ecx + 5]
xor dl, byte [eax + ebx*4 + 0x463e58]
movzx ebx, byte [ecx + 4]
xor dl, byte [eax + ebx*4 + 0x464258]
movzx ebx, byte [ecx + 0xa]
mov byte [esp + eax + 0x14], dl
movzx edx, byte [ecx + 0xb]
movzx edx, byte [eax + edx*4 + 0x463658]
xor dl, byte [eax + ebx*4 + 0x463a58]
movzx ebx, byte [ecx + 9]
xor dl, byte [eax + ebx*4 + 0x463e58]
movzx ebx, byte [ecx + 8]
xor dl, byte [eax + ebx*4 + 0x464258]
inc eax
cmp eax, 4
mov byte [esp + eax + 0x17], dl
jl 0x433480
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esi], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
add ecx, 0x10
add esi, 0x10
sub edi, 1
jne 0x433470
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00441b8e
add esp, 0x14
ret
Function at 0x434720
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
push ebx
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
mov ebx, ecx
test eax, eax
ja 0x434759
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00441b8e
add esp, 0x18
ret 0xc
mov ecx, dword [esi + 4]
xor ecx, dword [ebx + 8]
mov edx, dword [esi + 8]
xor edx, dword [ebx + 0xc]
shr eax, 4
push ebp
mov ebp, eax
mov eax, dword [esi]
xor eax, dword [ebx + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
xor eax, dword [ebx + 0x10]
push edi
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
call fcn.00433590
add esi, 0x10
add ebp, 0xffffffff
je 0x4347de
nop
mov edx, dword [edi]
xor edx, dword [esi]
mov eax, dword [edi + 4]
xor eax, dword [esi + 4]
mov ecx, dword [edi + 8]
xor ecx, dword [esi + 8]
mov dword [esp + 0x14], edx
mov edx, dword [edi + 0xc]
xor edx, dword [esi + 0xc]
mov dword [esp + 0x18], eax
add edi, 0x10
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x20], ecx
push eax
mov ecx, ebx
mov dword [esp + 0x28], edx
call fcn.00433590
add esi, 0x10
sub ebp, 1
jne 0x4347a0
mov ecx, dword [edi]
mov dword [ebx + 4], ecx
mov edx, dword [edi + 4]
mov dword [ebx + 8], edx
mov eax, dword [edi + 8]
mov dword [ebx + 0xc], eax
mov ecx, dword [edi + 0xc]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [ebx + 0x10], ecx
mov ecx, dword [esp + 0x1c]
pop esi
pop ebx
xor ecx, esp
shl eax, 4
call fcn.00441b8e
add esp, 0x18
ret 0xc
Function at 0x434820
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
mov esi, dword [esp + 0x38]
push edi
mov edi, dword [esp + 0x44]
mov ebx, ecx
test esi, esi
je 0x434915
mov eax, dword [esp + 0x40]
test eax, eax
jbe 0x434915
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
shr eax, 4
mov dword [esp + 0x18], ecx
mov ecx, dword [ebx + 0x10]
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
test eax, eax
jbe 0x4348e5
lea edx, [esp + 0x28]
push edx
push esi
mov ecx, ebx
call fcn.00433c90
mov edx, dword [esp + 0x20]
xor dword [esp + 0x30], edx
mov edx, dword [esp + 0x24]
xor dword [esp + 0x34], edx
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x2c]
xor ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
xor eax, ebp
mov ebp, dword [esi]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 8]
mov dword [esp + 0x20], edx
mov edx, dword [esi + 0xc]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x34]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
add esi, 0x10
add edi, 0x10
sub dword [esp + 0x10], 1
mov dword [esp + 0x24], edx
jne 0x434877
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [ebx + 4], ebp
pop ebp
mov dword [ebx + 8], edx
mov edx, dword [esp + 0x20]
pop edi
mov dword [ebx + 0xc], ecx
pop esi
mov dword [ebx + 0x10], edx
shl eax, 4
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00441b8e
add esp, 0x2c
ret 0xc
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00441b8e
add esp, 0x2c
ret 0xc

Function at 0x437710
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
ret 4

Function at 0x438560
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4385b3
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp]
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x80000000
push 0xd
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
Function at 0x43bc50
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x408
push ebx
push ebp
push esi
mov esi, dword [esp + 0x418]
push edi
mov ebx, ecx
movzx edi, word [ebx]
sub edi, dword [esi + 0x654]
mov dword [esp + 0x14], ebx
push edi
push esi
call fcn.0043ba40
mov dl, byte [esi + 0xa6c]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 4]
sub eax, 6
lea ebp, [esp + 0x18]
xor ecx, ecx
lea ecx, [ecx]
movzx ebx, byte [eax + 6]
add eax, 6
cmp byte [ebx + esi + 0x66c], dl
je 0x43bc90
movzx ebx, byte [eax + 1]
mov dword [ebp], eax
add ecx, ebx
add ebp, 4
sub edi, 1
jne 0x43bc90
add dword [esi + 0x4a84], ecx
mov eax, dword [esi + 0x4a78]
xor edx, edx
div dword [esi + 0x4a84]
xor edx, edx
mov edi, eax
mov eax, dword [esi + 0x4a74]
sub eax, dword [esi + 0x4a70]
mov dword [esi + 0x4a78], edi
div edi
mov ebx, dword [esi + 0x4a84]
cmp eax, ebx
jl 0x43bcf6
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x408
ret 4
cmp eax, ecx
mov edx, dword [esp + 0x18]
lea edi, [esp + 0x18]
jge 0x43bd73
movzx ecx, byte [edx + 1]
cmp ecx, eax
jg 0x43bd20
lea ebx, [ebx]
mov edx, dword [edi + 4]
movzx ebx, byte [edx + 1]
add edi, 4
add ecx, ebx
cmp ecx, eax
jle 0x43bd10
mov edi, dword [esp + 0x10]
mov dword [esi + 0x4a80], ecx
movzx eax, byte [edx + 1]
sub ecx, eax
mov dword [esi + 0x4a7c], ecx
mov cl, byte [edi + 2]
cmp cl, 7
jae 0x43bd59
add byte [edi + 3], 0xff
jne 0x43bd59
mov ax, word [edi]
add ax, ax
mov word [edi], ax
mov al, 3
shl al, cl
inc cl
mov byte [edi + 2], cl
mov byte [edi + 3], al
mov ecx, dword [esp + 0x14]
push edx
push esi
call fcn.0043ba00
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x408
ret 4
mov edi, dword [esp + 0x14]
mov dword [esi + 0x4a7c], ecx
mov dword [esi + 0x4a80], ebx
movzx ecx, word [edi]
sub ecx, dword [esi + 0x654]
lea eax, [esp + 0x18]
sub eax, 4
mov edx, dword [eax + 4]
movzx edx, byte [edx]
mov bl, byte [esi + 0xa6c]
add eax, 4
sub ecx, 1
mov byte [edx + esi + 0x66c], bl
jne 0x43bd93
mov cx, word [esi + 0x4a84]
mov eax, dword [esp + 0x10]
add word [eax], cx
movzx edx, word [edi]
pop edi
mov dword [esi + 0x654], edx
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x408
ret 4
Function at 0x441b8e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4577c0]
jne 0x441b98
repz ret
jmp fcn.004452f8

Function at 0x4443cf
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x4541d0
call fcn.004450e0
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4442cf
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4442cf
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4442cf
cmp dword [eax + 0x400074], 0xe
jbe 0x4442cf
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4442d3
and dword [ebp - 0x1c], 0
push 1
call fcn.00444458
pop ecx
test eax, eax
jne 0x4442e7
push 0x1c
call fcn.00444259
pop ecx
call fcn.00447619
test eax, eax
jne 0x4442f8
push 0x10
call fcn.00444259
pop ecx
call fcn.00448be2
and dword [ebp - 4], 0
call fcn.0044a3eb
test eax, eax
jge 0x444312
push 0x1b
call fcn.00443374
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x468b04], eax
call fcn.0044a2b6
mov dword [0x466f38], eax
call fcn.0044a1fd
test eax, eax
jge 0x444338
push 8
call fcn.00443374
pop ecx
call fcn.00449fb9
test eax, eax
jge 0x444349
push 9
call fcn.00443374
pop ecx
push 1
call fcn.0044341d
pop ecx
test eax, eax
je 0x44435c
push eax
call fcn.00443374
pop ecx
mov eax, dword [0x466f14]
mov dword [0x466f18], eax
push eax
push dword [0x466f0c]
push dword [0x466f08]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x44438a
push eax
call fcn.004435db
call fcn.004435fd
jmp 0x4443bf
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00445125
ret
call fcn.0044a63f
jmp 0x44427d