joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406bae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push edi
xor edi, 0xe43d
and edi, 0x1154a
add edi, 0x26c9
pop edi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x406be3
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
invalid
xchg ebp, eax
cwde
invalid
invalid

Function at 0x406ef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x77c]
add eax, 1
mov dword [ebp - 0x77c], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x77c]
cmp edx, dword [ecx + 0x18]
jae 0x4070c0
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a4]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x780], edx
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a8]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19ac]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19b0], ecx
mov dword [ebp - 0x1a0], 0
jmp 0x406f24
mov edx, dword [ebp - 0x1a0]
add edx, 1
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x406fd6
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
test eax, eax
je 0x406fd6
push eax
add eax, 0x1b53
add eax, 0x50ad
pop eax
push ebx
xor ebx, 0x9880
pop ebx
push edi
or edi, 0xc59d
sub edi, 0xcd8
add edi, 0x11758
pop edi
push eax
xor eax, 0x12161
pop eax
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
cmp edx, ecx
je 0x406fc8
mov edx, dword [ebp - 0x780]
add edx, dword [ebp - 0x1a0]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1a0]
movsx edx, byte [ebp + ecx - 0x8a4]
cmp eax, edx
jne 0x406fcf
jmp 0x406f15
jmp 0x406fd6
push edx
push edi
add esp, 4
sub edx, 0xf3c2
pop edx
push eax
jmp 0x406fe9
sub eax, 0x14994
add eax, 0x6b75
pop eax
push esi
push esi
add esp, 4
or esi, 0x96fb
and esi, 0x17b92
pop esi
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
cmp ecx, eax
jne 0x407035
mov dword [ebp - 0xcd4], 0
jmp 0x4070a4
push eax
add eax, 0xaa20
or eax, 0x5df7
xor eax, 0xc480
pop eax
push eax
or eax, 0xf32
or eax, 0xd2e
call 0x407063
add byte [esi + 0x40], cl
xor al, 0x45
dec ebp
inc ecx
cmp al, byte [ebx - 0x74a7fb3c]
lea eax, [eax + 0x3fffff8]
lea esp, [eax - 2]
invalid
cmp dword [ebp - 0xcd4], 0
jne 0x4070bb
mov edx, dword [ebp - 0x19b0]
mov dword [ebp - 0x3f8], edx
jmp 0x4070cc
jmp 0x406ea5
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0
je 0x4071a7
push edi
add edi, 0x141e
Function at 0x407063
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp - 0x77c]
add eax, 1
mov dword [ebp - 0x77c], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x77c]
cmp edx, dword [ecx + 0x18]
jae 0x4070c0
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a4]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x780], edx
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a8]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19ac]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19b0], ecx
mov dword [ebp - 0x1a0], 0
jmp 0x406f24
mov edx, dword [ebp - 0x1a0]
add edx, 1
mov dword [ebp - 0x1a0], edx
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x406fd6
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
test eax, eax
je 0x406fd6
push eax
add eax, 0x1b53
add eax, 0x50ad
pop eax
push ebx
xor ebx, 0x9880
pop ebx
push edi
or edi, 0xc59d
sub edi, 0xcd8
add edi, 0x11758
pop edi
push eax
xor eax, 0x12161
pop eax
mov ecx, dword [ebp - 0x780]
add ecx, dword [ebp - 0x1a0]
movsx edx, byte [ecx]
mov eax, dword [ebp - 0x1a0]
movsx ecx, byte [ebp + eax - 0x8a4]
cmp edx, ecx
je 0x406fc8
mov edx, dword [ebp - 0x780]
add edx, dword [ebp - 0x1a0]
movsx eax, byte [edx]
xor eax, 0x20
mov ecx, dword [ebp - 0x1a0]
movsx edx, byte [ebp + ecx - 0x8a4]
cmp eax, edx
jne 0x406fcf
jmp 0x406f15
jmp 0x406fd6
push edx
push edi
add esp, 4
sub edx, 0xf3c2
pop edx
push eax
jmp 0x406fe9
sub eax, 0x14994
add eax, 0x6b75
pop eax
push esi
push esi
add esp, 4
or esi, 0x96fb
and esi, 0x17b92
pop esi
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x1a0]
movsx eax, byte [ebp + edx - 0x8a4]
cmp ecx, eax
jne 0x407035
mov dword [ebp - 0xcd4], 0
jmp 0x4070a4
push eax
add eax, 0xaa20
or eax, 0x5df7
xor eax, 0xc480
pop eax
push eax
or eax, 0xf32
or eax, 0xd2e
call 0x407063
add byte [esi + 0x40], cl
xor al, 0x45
dec ebp
inc ecx
cmp al, byte [ebx - 0x74a7fb3c]
lea eax, [eax + 0x3fffff8]
lea esp, [eax - 2]
invalid
cmp dword [ebp - 0xcd4], 0
jne 0x4070bb
mov edx, dword [ebp - 0x19b0]
mov dword [ebp - 0x3f8], edx
jmp 0x4070cc
jmp 0x406ea5
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0
je 0x4071a7
push edi
add edi, 0x141e
Function at 0x4073c6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc edi
dec ebx
cmp al, byte [esi + 0x38]
add esp, 4
pop eax
push ebx
push ebx
add esp, 4
or ebx, 0x12ffd
pop ebx
lea eax, [ebp - 0x1738]
mov dword [ebp - 0xcdc], eax
mov ecx, dword [ebp - 0x51c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xcd8], edx
xor eax, eax
mov word [ebp - 0x224], ax
xor ecx, ecx
mov word [ebp - 0x40], cx
push ebx
and ebx, 0x215a
xor ebx, 0x7223
xor ebx, 0x3554
sub ebx, 0x93d7
pop ebx
push ecx
push ecx
add esp, 4
or ecx, 0x9a84
pop ecx
push eax
push edi
add esp, 4
add eax, 0xd484
pop eax
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
mov word [ebp - 0x224], dx
mov eax, dword [ebp - 0xcdc]
mov cx, word [eax]
mov word [ebp - 0x1048], cx
mov edx, dword [ebp - 0xcdc]
add edx, 2
mov dword [ebp - 0xcdc], edx
mov ax, word [ebp - 0x1048]
mov word [ebp - 0x40], ax
push edi
push edx
add esp, 4
sub edi, 0x17957
pop edi
push ebx
jmp 0x4073ac
pop ebx
push ebx
xor ebx, 0x7c11
add ebx, 0xf70f
call 0x4073c6
add byte [0x4b4b474d], bh
xor al, byte [ebx + 0xf5b04c4]
mov bh, 0x4d
rol byte [ebp + 0xf1575c9], 0xb7
xchg ebp, eax
fdiv st(5), st(0)
invalid

Function at 0x407472
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add eax, 0xd21c
pop eax
mov edx, dword [ebp - 0x51c]
mov dword [ebp - 0x2fc], edx
jmp 0x4074f2

Function at 0x41d470
Capabilities:
Encode data using xor

Disassembly:
or dword [esi + 0x57], ebx
push ebp
mov cl, cl
or eax, esi
or edx, dword [ecx + 0x45]
dec ebp
aaa
push esp
aas
pop edi
imul edx, dword [eax + 0x5051d12], 0x7d928e05
out 4, eax
add al, 0x90
mov ss, word [edx + 0x404e77d]
nop
lcall 0x4790, 0x404e77d
xor eax, 0xe7798a8e
add al, 4
nop
xchg edx, eax
jns 0x41d487
add al, 4
mov ss, word [edx + 0x404effd]
push ebp
xchg ch, dh
sal esp, cl
add eax, 0x5be58605
aaa
add eax, 0x8f58605
or eax, dword [0x6bf58605]
cmp al, byte [esi]
add eax, 0x8855555d
leave
or dword [esi + 0x60617e5], eax
add eax, 0x3a78c586
push es
add eax, 0x5a5ded86
push es
add eax, 0xfdc2885d
out dx, eax
add al, 4
add eax, 0x8acc147a
cmp dword [edx], eax
add al, 4
add eax, 0xee050505
rol dword [edi], 5
add eax, 0xeffd9a90
add al, 4
nop
inc edi
adc dword [eax - 0x6d71eeb3], edx
xor eax, 0x580404f5
in eax, dx
adc byte [0x3e050505], al
dec edx
push eax
push ecx
dec esi
inc edx
inc edx
push ebp
aaa
cmp ecx, dword [eax + 0x5b6009c9]
pop ebx
mov cl, cl
or dword [esi + 0x5ed05fb], eax
add eax, 0xed0505ed
push cs
add eax, 0x40050505
push ecx
cmp byte [edi], dh
Function at 0x437b90
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481783
mov eax, dword fs:[0]
push eax
sub esp, 0x1dc
mov eax, dword [0x49c498]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1e8], ebx
push 0x104
lea eax, [ebp - 0x148]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0047de77
mov ecx, 0x10
mov dword [ebp - method.Util::MD5::MD5_CTX.virtual_0], vtable.Util::MD5::MD5_CTX.0
xor eax, eax
mov dword [ebp - 0x1cc], 0
lea edi, [ebp - 0x188]
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1e0], 0x67452301
add esp, 0xc
mov dword [ebp - 0x1dc], 0xefcdab89
mov dword [ebp - 0x1d8], 0x98badcfe
mov dword [ebp - 0x1d4], 0x10325476
rep stosd dword es:[edi], eax
mov byte [ebp - 0x188], 0x80
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
cmp dword [eax - 4], 1
mov esi, dword [eax - 0xc]
jle 0x437c5c
push esi
lea ecx, [ebp + 0xc]
call fcn.0040e280
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x1e4]
push eax
call fcn.0043fba0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x1e4]
call fcn.0043fc70
xor eax, eax
xor esi, esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], al
mov word [ebp - 0x1e8], ax
mov byte [ebp - 0x1e6], al
push 0x10
lea eax, [ebp - 0x1e8]
push eax
movzx eax, byte [ebp + esi - 0x44]
push eax
call fcn.0047df0d
add esp, 0xc
cmp byte [ebp - 0x1e7], 0
jne 0x437cf9
push 0x48c15c
lea eax, [ebp - 0x34]
push 0x21
push eax
call fcn.0047a450
lea eax, [ebp - 0x1e8]
push eax
lea eax, [ebp - 0x34]
push 0x21
push eax
call fcn.0047a450
add esp, 0x18
jmp 0x437d0e
lea eax, [ebp - 0x1e8]
push eax
lea eax, [ebp - 0x34]
push 0x21
push eax
call fcn.0047a450
add esp, 0xc
inc esi
cmp esi, 0x10
jl 0x437cb2
push 0x20
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x148]
push 0x103
push eax
call fcn.0047a4f0
mov eax, dword [ebp + 0xc]
push dword [eax - 8]
push eax
call fcn.00470150
mov ecx, eax
add esp, 0x18
test ecx, ecx
js 0x437dbc
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax - 8]
jg 0x437dbc
mov dword [eax - 0xc], ecx
mov eax, dword [ebp + 0xc]
mov byte [ecx + eax], 0
lea ecx, [ebp - 0x148]
lea edx, [ecx + 1]
jmp 0x437d60
mov al, byte [ecx]
inc ecx
test al, al
jne 0x437d60
sub ecx, edx
lea edx, [ebp - 0x148]
push ecx
mov ecx, ebx
call fcn.00445620
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov esi, dword [ebp + 0xc]
or eax, 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x437d9c
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047d9e4
mov esp, ebp
pop ebp
ret 8
push 0x80070057
call fcn.00403b50
int3
Function at 0x43b150
Capabilities:
Delete file
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov esi, ecx
jne 0x43b295
mov eax, dword [ebp + 0xc]
cmp eax, 2
jne 0x43b1bd
push 0x7ec
push ecx
lea eax, [esi + 0x78]
mov dword [esi + 0x50], 1
push eax
call fcn.0043bd40
mov eax, dword [esi + 0x88]
cmp eax, 0xffffffff
je 0x43b19c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x88], 0xffffffff
mov eax, dword [esi + 0x84]
cmp dword [eax - 0xc], 0
je 0x43b1af
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
jmp 0x43b283
cmp eax, 0x4a
jne 0x43b295
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x50], 1
test ecx, ecx
je 0x43b27e
mov eax, dword [ecx]
cmp eax, 7
jne 0x43b1f3
mov ecx, dword [esi + 0x54]
test ecx, ecx
je 0x43b279
mov eax, dword [ecx]
call dword [eax]
jmp 0x43b279
cmp eax, 8
jne 0x43b21a
mov ecx, dword [esi + 0x54]
test ecx, ecx
je 0x43b204
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esi + 0x78]
cmp dword [eax - 0xc], 0
jne 0x43b279
push 0
push dword [esi + 0x30]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43b279
cmp eax, 0xc
jne 0x43b257
mov edx, dword [esi + 0x54]
test edx, edx
je 0x43b279
mov edi, dword [ecx + 8]
test edi, edi
je 0x43b24e
mov edx, edi
lea ecx, [esi + 0x78]
lea ebx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x43b235
sub edx, ebx
sar edx, 1
push edx
push edi
call fcn.004039f0
mov edx, dword [esi + 0x54]
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 8]
jmp 0x43b279
cmp eax, 0x100
jne 0x43b279
mov edx, dword [esi + 0x54]
test edx, edx
je 0x43b279
mov ecx, dword [ecx + 8]
test ecx, ecx
je 0x43b279
mov eax, dword [edx]
push 0
push 0
push dword [ecx]
mov ecx, edx
call dword [eax + 0x10]
mov ecx, 1
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
cmp dword [esi + 0x50], 0
je 0x43b295
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x18
Function at 0x43b2a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481a3f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x49c498]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov eax, dword [0x486590]
mov dword [esi + 4], eax
mov eax, dword [0x486594]
mov dword [esi + 8], eax
mov eax, dword [0x486598]
mov dword [esi + 0xc], eax
mov eax, dword [0x48659c]
mov dword [esi + 0x10], eax
mov eax, dword [0x486590]
mov dword [esi + 0x14], eax
mov eax, dword [0x486594]
mov dword [esi + 0x18], eax
mov eax, dword [0x486598]
mov dword [esi + 0x1c], eax
mov eax, dword [0x48659c]
mov dword [esi + 0x20], eax
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], 0xfefefefe
mov dword [esi + 0x30], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 0x4c], eax
mov dword [esi], vtable.CSimpleIMEBaseEdit.1.0
mov dword [esi + 0x2c], vtable.CSimpleIMEBaseEdit.0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
lea ecx, [esi + 0x5c]
call fcn.0043b0c0
mov byte [ebp - 4], 3
mov dword [esi + 0x74], 0
call fcn.00403da0
mov ecx, eax
test ecx, ecx
je 0x43b45f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x78], eax
mov byte [ebp - 4], 4
call fcn.00403da0
mov ecx, eax
test ecx, ecx
je 0x43b469
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x7c], eax
mov byte [ebp - 4], 5
lea eax, [esi + 0x80]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [edi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi - 4], 0
mov ecx, eax
lea eax, [edi - 4]
jl 0x43b3d1
cmp ecx, dword [edi - 0x10]
jne 0x43b3d1
lea ebx, [edi - 0x10]
lock inc dword [eax]
jmp 0x43b3fb
mov eax, dword [ecx]
push 2
push dword [edi - 0xc]
call dword [eax]
mov ebx, eax
test ebx, ebx
je 0x43b473
mov eax, dword [edi - 0xc]
lea ecx, [ebx + 0x10]
mov dword [ebx + 4], eax
mov edx, dword [edi - 0xc]
inc edx
push edx
push edi
call fcn.00403960
add esp, 8
lea eax, [ebx + 0x10]
mov dword [esi + 0x80], eax
call fcn.00403da0
mov ecx, eax
test ecx, ecx
je 0x43b478
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
mov dword [esi + 0x84], eax
add edx, 0xfffffff0
mov dword [esi + 0x88], 0xffffffff
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43b449
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00403b50
push 0x80004005
call fcn.00403b50
call fcn.004038b0
push 0x80004005
call fcn.00403b50
int3
Function at 0x43c090
Capabilities:
Check if file exists
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 5
lea esp, [esp]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push edi
call esi
mov ebx, eax
mov dword [ebp - 0xc], ebx
cmp ebx, 0xffffffff
je 0x43c239
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
call esi
mov edi, eax
xor esi, esi
cmp edi, 0xffffffff
je 0x43c1a3
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x43c122
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
mov edi, dword [ebp + 0xc]
jmp 0x43c219
mov ebx, dword [ebp - 0x28]
cmp ebx, 0x100000
jb 0x43c132
mov ebx, 0x100000
push 0x49f728
push ebx
call fcn.0046eef0
mov esi, eax
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
test esi, esi
je 0x43c196
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov eax, dword [ebp - 8]
je 0x43c16e
test eax, eax
je 0x43c185
push 0
lea ecx, [ebp - 0x1c]
push ecx
push eax
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43c154
jmp 0x43c18c
mov dword [ebp - 4], 1
push esi
call dword [0x4861b4]
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x43c277
mov edi, dword [ebp + 0xc]
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push edi
call eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x88], eax
cmp eax, 0xffffffff
je 0x43c277
call fcn.00406ef0
test eax, eax
je 0x43c219
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, edi
call fcn.004070e0
test eax, eax
je 0x43c219
mov eax, dword [ebp - 0x10]
cmp eax, 3
je 0x43c213
cmp eax, 0xffffffff
je 0x43c213
mov eax, 1
jmp 0x43c215
xor eax, eax
test eax, eax
jne 0x43c277
mov eax, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
dec eax
mov dword [ebp - 0x14], eax
test eax, eax
jg 0x43c0b0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
xor esi, esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43c277
mov ecx, edi
call fcn.0043c950
test eax, eax
je 0x43c277
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push edi
call eax
mov ecx, dword [ebp - 0x18]
mov esi, 1
mov dword [ecx + 0x88], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43e5d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481d10
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x49c498]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
push 0x488200
lea ecx, [ebp - 0x10]
call fcn.00403600
mov dword [ebp - 4], 1
push 0x1000
mov dword [ebp - 0x14], 0x800
mov dword [ebp - 0x18], 1
call dword [0x4861c8]
mov edi, eax
add esp, 4
or ebx, 0xffffffff
test edi, edi
je 0x43e6ec
mov ecx, dword [ebp - 0x14]
add ecx, ecx
push ecx
push 0
push edi
call fcn.0047de77
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push edi
lea ecx, [ebp - 0x20]
call fcn.00403600
mov byte [ebp - 4], 2
mov edx, dword [eax]
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
lea ecx, [edx - 0x10]
cmp ecx, esi
je 0x43e6c4
cmp dword [esi + 0xc], 0
jl 0x43e6b8
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x43e6b8
call fcn.004036a0
mov dword [ebp - 0x1c], eax
lea edx, [esi + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43e6b0
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x1c]
add eax, 0x10
mov dword [ebp - 0x10], eax
jmp 0x43e6c4
push dword [edx - 0xc]
lea ecx, [ebp - 0x10]
push edx
call fcn.004039f0
mov byte [ebp - 4], 1
mov eax, ebx
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43e6e2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push edi
call dword [0x4861b4]
add esp, 4
mov esi, dword [ebp - 0x10]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi - 4], 0
mov ecx, eax
lea eax, [esi - 4]
jl 0x43e70f
cmp ecx, dword [esi - 0x10]
jne 0x43e70f
lea edi, [esi - 0x10]
lock inc dword [eax]
jmp 0x43e735
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x43e770
mov eax, dword [esi - 0xc]
lea ecx, [edi + 0x10]
mov dword [edi + 4], eax
mov edx, dword [esi - 0xc]
inc edx
push edx
push esi
call fcn.00403960
add esp, 8
mov esi, dword [ebp - 0x24]
lea eax, [edi + 0x10]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
mov dword [esi], eax
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x43e75c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004038b0
int3
Function at 0x43fc70
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x49c498]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 0x16]
lea ecx, [ecx]
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
mov byte [ebp + edx - 0xc], cl
movzx ecx, byte [eax - 5]
mov byte [ebp + edx - 0xb], cl
movzx ecx, byte [eax - 4]
mov byte [ebp + edx - 0xa], cl
movzx ecx, byte [eax - 3]
mov byte [ebp + edx - 9], cl
add edx, 4
cmp edx, 8
jb 0x43fc90
mov eax, dword [esi + 0x14]
mov ecx, 0x38
shr eax, 3
and eax, 0x3f
cmp eax, 0x38
jb 0x43fcd3
mov ecx, 0x78
sub ecx, eax
lea ebx, [esi + 0x5c]
push ecx
push ebx
mov ecx, esi
call fcn.0043fba0
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.0043fba0
lea ecx, [edi + 1]
mov edi, 4
lea edx, [esi + 6]
lea esp, [esp]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 5]
mov byte [ecx - 4], al
movzx eax, byte [edx - 4]
mov byte [ecx - 3], al
movzx eax, byte [edx - 3]
mov byte [ecx - 2], al
sub edi, 1
jne 0x43fd00
xor eax, eax
mov edi, esi
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 4], 0x67452301
xor ecx, ebp
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
pop esi
mov byte [ebx], 0x80
pop ebx
call fcn.0047d9e4
mov esp, ebp
pop ebp
ret 4

Function at 0x441a50
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, edx
push edi
mov edi, ecx
mov eax, dword [esi]
mov dword [esi + 4], eax
test edi, edi
je 0x441aa4
push 0
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 1
push 0
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x441aa4
push esi
push eax
mov ecx, esi
call fcn.00442550
push 0
push 0
lea eax, [ebp - 4]
push eax
push dword [esi]
push 1
push 0
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret