joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x408ecc
nop
mov ecx, 0x360c4b
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x62ac458e
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4129f4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x57c
mov dword [esp], 0x10001
push esp
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 8]
cmp eax, 0x3ff
jae 0x412a17
adc ch, al
sbb byte [eax], al
add byte [eax], al
call 0x412a34
test eax, eax
je 0x412a2a
jmp eax
leave
push 0x42
jmp dword ss:[sym.imp.KERNEL32.dll_RaiseException]

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
nop
nop
nop
nop
nop
pushal
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x4bbd0f72
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e0f2
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e0c8
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x7aa22513
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e128
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e110
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x4012bd
Function at 0x401460
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
lea eax, [server.sin_zero]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call sym._WSAStartup_8
sub esp, 8
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call sym._socket_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [esp], str.127.0.0.1
call sym._inet_addr_4
sub esp, 4
mov dword [ebp - 0x1a8], eax
mov word [ebp - 0x1ac], 2
mov dword [esp], 0x115c
call sym._htons_4
sub esp, 4
mov word [ebp - 0x1aa], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x1ac]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._connect_12
sub esp, 0xc
test eax, eax
jns 0x40150a
mov dword [esp], str.Connection_failed__as_expected_in_a_test_environment_.
call sym._puts
jmp 0x401516
mov dword [esp], str.Connected_to_suspicious_server_
call sym._puts
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._closesocket_4
sub esp, 4
call sym._WSACleanup_0
nop
leave
ret

Function at 0x40152c
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x10], str.SuspiciousApp
mov dword [ebp - 0x14], str.C:_suspicious_app.exe
lea eax, [ebp - 0x18]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sym._RegOpenKeyA_12
sub esp, 0xc
test eax, eax
jne 0x4015c2
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
mov dword [esp], str.Registry_modified_to_autostart_application__simulated_malware_behavior_.
call sym._puts
jmp 0x4015ce
mov dword [esp], str.Failed_to_modify_registry.
call sym._puts
nop
leave
ret

Function at 0x4015d1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x400
mov dword [esp], 0
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401648
mov eax, dword [ebp - 0xc]
mov dword [eax], 0x656a6e49
mov dword [eax + 4], 0x64657463
mov dword [eax + 8], 0x646f4320
mov dword [eax + 0xc], 0x69532065
mov dword [eax + 0x10], 0x616c756d
mov dword [eax + 0x14], 0x6e6f6974
mov byte [eax + 0x18], 0
mov dword [esp], str.Code_injected__simulated_.
call sym._puts
mov eax, dword [ebp - 0xc]
call eax
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualFree_12
sub esp, 0xc
nop
leave
ret
Function at 0x40cc50
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0f40
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x527534]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 0x4e1910
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], ebx
push eax
push ebx
mov dword [ebp - 0x20], str.grid.item.state.failCodes.httpcode
call fcn.00452af0
add esp, 0xc
lea eax, [ebx + 0x40]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x28], eax
call dword [0x4df1e4]
mov byte [ebp - 0x24], 1
mov esi, dword [ebx + 0x30]
push 0x18
mov byte [ebp - 4], 1
mov byte [ebx + 0x1c], 1
call fcn.004b0527
mov edi, eax
add esp, 4
test edi, edi
je 0x40ccf7
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xa
jmp 0x40ccf9
xor edi, edi
push esi
push 0x4e1650
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.004522a0
add esp, 0x10
test esi, esi
jne 0x40cd28
test edi, edi
je 0x40cd83
mov ecx, edi
call fcn.00409e70
push 0x18
push edi
call fcn.004af9b5
add esp, 8
jmp 0x40cd83
mov esi, dword [ebx + 0x28]
lea eax, [ebx + 0x28]
mov dword [ebp - 0x18], eax
test esi, esi
je 0x40cd6b
mov ebx, dword [esi + 8]
mov esi, dword [esi]
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x40cd61
mov eax, dword [ebx]
mov ecx, ebx
push 1
call dword [eax + 0x28]
mov eax, dword [ebp - 0x10]
push ebx
mov ecx, dword [eax + 0x14]
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.00405d50
test esi, esi
jne 0x40cd35
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov ecx, eax
call fcn.00409e70
push 0
push edi
push 0x412
push dword [ebx + 0x20]
call dword [0x4df504]
push dword [ebp - 0x28]
call dword [0x4df1e8]
push 0x4e1978
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 3
push eax
push dword [ebp - 0x1c]
call fcn.00452af0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4100a0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d14b8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x527534]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
lea edi, [esi + 0x30]
mov dword [esi + 0x14], 0x80000001
mov edx, 0x4e1a28
mov dword [esi + 0xc], 0x80000002
mov dword [ebp - 4], 0
cmp dword [eax - 0xc], 0
cmovne edx, eax
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4100f3
sub eax, ebx
mov ecx, edi
sar eax, 1
push eax
push edx
call fcn.00404580
push edi
lea ecx, [esi + 0x18]
call fcn.004024b0
push edi
lea ecx, [esi + 0x10]
call fcn.004024b0
mov edx, dword [ebp + 8]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41013f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x412d60
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push ebx
mov ebx, ecx
je 0x412e82
movups xmm0, xmmword [0x526040]
push esi
push edi
movups xmmword [ebx], xmm0
lea edi, [ebx + 0x48]
mov ecx, 0x400
movups xmm0, xmmword [0x526050]
mov esi, str.GetSecurityDescriptorControl
movups xmmword [ebx + 0x10], xmm0
movups xmm0, xmmword [0x526060]
movups xmmword [ebx + 0x20], xmm0
movups xmm0, xmmword [0x526070]
movups xmmword [ebx + 0x30], xmm0
movq xmm0, qword [0x526080]
movq qword [ebx + 0x40], xmm0
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], edi
lea eax, [edi + 1]
cdq
idiv ecx
movzx eax, byte [edi + esi]
shl eax, 8
movzx ecx, byte [edx + esi]
or ecx, eax
lea eax, [edi + 2]
cdq
idiv dword [ebp + 0xc]
shl ecx, 8
movzx eax, byte [edx + esi]
or ecx, eax
lea eax, [edi + 3]
cdq
idiv dword [ebp + 0xc]
shl ecx, 8
movzx eax, byte [edx + esi]
or ecx, eax
mov eax, dword [ebp - 4]
xor dword [ebx + eax*4], ecx
lea eax, [edi + 4]
mov ecx, dword [ebp + 0xc]
cdq
idiv ecx
mov eax, dword [ebp - 4]
inc eax
mov edi, edx
mov dword [ebp - 4], eax
cmp eax, 0x12
jl 0x412dc5
mov dword [ebp + 0xc], 0
xor esi, esi
mov dword [ebp + 8], 0
lea eax, [ebp + 8]
mov ecx, ebx
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004123a0
mov eax, dword [ebp + 0xc]
mov dword [ebx + esi*4], eax
mov eax, dword [ebp + 8]
mov dword [ebx + esi*4 + 4], eax
add esi, 2
cmp esi, 0x12
jl 0x412e25
lea esi, [ebx + 0x4c]
mov dword [ebp - 4], 4
mov edi, 0x80
lea eax, [ebp + 8]
mov ecx, ebx
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004123a0
mov eax, dword [ebp + 0xc]
mov dword [esi - 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], eax
add esi, 8
sub edi, 1
jne 0x412e58
sub dword [ebp - 4], 1
jne 0x412e53
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41bfd0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2413
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x527534]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x4e5afc
push edi
call fcn.00451ed0
mov eax, dword [ebp + 0x1c]
lea esi, [edi + 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], esi
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00404d60
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebp + 0x20]
lea esi, [edi + 0x18]
mov byte [ebp - 4], 1
mov dword [ebp + 0x1c], esi
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.00404d60
mov ecx, dword [ebp + 0x18]
add esp, 8
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ecx]
mov dword [edi + 0x1c], eax
mov eax, dword [ecx + 4]
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 0x14]
movsd xmm0, qword [eax]
mov eax, dword [ebp + 0x10]
movsd qword [edi + 0x28], xmm0
movsd xmm0, qword [ebp + 8]
mov dword [edi + 0x38], eax
mov eax, edi
movsd qword [edi + 0x30], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x429000
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d382b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x527534]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [0x4df5dc]
mov dword [esi + 4], 0
mov dword [esi], 0x4e6a08
mov dword [esi + 0x58], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0xe0], 0
mov dword [esi + 0xe4], 0
mov dword [esi + 0xf0], 0
mov eax, dword [esi + 0xd0]
and dword [esi + 0xa0], 0xffffff40
and eax, 0xfffffffb
or eax, 3
mov dword [esi + 0xd4], 0
push 8
mov dword [esi + 0xd0], eax
call dword [0x4df520]
and dword [esi + 0xa0], 0xffffffbf
xorps xmm0, xmm0
mov dword [esi + 0xd8], eax
mov ecx, esi
mov eax, dword [esi + 0xd0]
and eax, 0xffffffaf
movlpd qword [ebp - 0x18], xmm0
or eax, 0x28
mov dword [esi + 0xdc], 0x400
mov dword [esi + 0xd0], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0xac], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0xb0], eax
movlpd qword [ebp - 0x18], xmm0
mov eax, dword [ebp - 0x18]
mov dword [esi + 0xb4], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 0xb8], eax
mov eax, dword [ebp + 8]
test eax, eax
movups xmmword [esi + 0x88], xmm0
cmovne ecx, eax
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0xcdcdcdcd
mov dword [esi + 0xe8], 4
mov dword [esi + 0xec], 0
mov dword [esi + 0x60], 0
mov byte [esi + 0x64], 1
mov dword [esi + 0xcc], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], 0
movups xmmword [esi + 0xbc], xmm0
mov dword [esi + 8], 0x4e67a0
mov dword [esi + 0x2c], 0x4e67b8
mov dword [esi + 0x30], 0x4e67e8
mov dword [esi + 0x34], 0x4e6810
mov dword [esi + 0x38], 0x4e688c
mov dword [esi + 0x3c], 0x4e68b8
mov dword [esi + 0x40], 0x4e68d4
mov dword [esi + 0x48], 0x4e68f0
mov dword [esi + 0x4c], 0x4e6904
mov dword [esi + 0x50], 0x4e6928
mov dword [esi + 0x54], 0x4e6974
mov dword [esi + 0x58], ecx
mov ecx, dword [0x52abec]
mov dword [ebp - 4], 0
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x43c5d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4cf0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x527534]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0x4e1910
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x4e9ccc
lea ebx, [esi + 0xa8]
push eax
push ebx
mov dword [ebp - 0x30], ebx
call fcn.00452af0
add esp, 0xc
lea eax, [esi + 0x164]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x3c], eax
call dword [0x4df1e4]
mov byte [ebp - 0x38], 1
push dword [esi + 0xec]
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
call fcn.00485ab0
add esp, 8
mov dword [ebp - 0x18], eax
mov ecx, dword [esi + 0x30]
lea eax, [ebp - 0x24]
push ecx
push eax
mov byte [ebp - 4], 3
call fcn.0043f290
add esp, 8
mov dword [ebp - 0x1c], eax
mov ecx, dword [esi + 0x34]
lea eax, [ebp - 0x20]
push ecx
push eax
mov byte [ebp - 4], 4
call fcn.0043f290
add esp, 8
mov edi, eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 5
mov ecx, dword [edx + 0x64]
push dword [eax]
mov eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x1c]
push dword [eax]
lea eax, [ebp - 0x34]
push dword [edi]
push dword [edx + 0x68]
push 0x4e9cf0
push eax
push ebx
call fcn.004522a0
mov edx, dword [ebp - 0x20]
or edi, 0xffffffff
add esp, 0x20
mov byte [ebp - 4], 4
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43c6d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x24]
mov eax, edi
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43c6f0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x28]
mov eax, edi
mov byte [ebp - 4], 2
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43c70e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [ecx + 0x60], 2
call dword [eax + 0x28]
test eax, eax
je 0x43c78c
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x64]
cmp dword [ecx], 0
jne 0x43c78c
mov ecx, esi
mov dword [esi + 0xec], eax
call fcn.0043eed0
mov ecx, esi
call fcn.0043bf30
push dword [esi + 0xec]
lea eax, [ebp - 0x2c]
push eax
call fcn.00485ab0
add esp, 8
push dword [esi + 0xd4]
mov byte [ebp - 4], 6
push dword [eax]
lea eax, [ebp - 0x34]
push 0x4e9d80
push eax
push ebx
call fcn.004522d0
mov edx, dword [ebp - 0x2c]
add esp, 0x14
mov byte [ebp - 4], 2
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x43c78c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x3c]
call dword [0x4df1e8]
push 0x4e1978
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 7
push eax
push dword [ebp - 0x30]
call fcn.00452af0
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43eed0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d50b8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x527534]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x4e1910
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x4e8c7c
lea edi, [ebx + 0xa8]
push eax
push edi
mov dword [ebp - 0x18], edi
call fcn.00452af0
mov eax, dword [ebx + 0x30]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
call fcn.0043f290
mov esi, eax
mov ecx, dword [ebx + 0x34]
lea eax, [ebp - 0x10]
push ecx
push eax
mov byte [ebp - 4], 1
call fcn.0043f290
push dword [esi]
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0x1c]
push 0x4e8cb0
push eax
push edi
call fcn.004522a0
mov edx, dword [ebp - 0x10]
or esi, 0xffffffff
add esp, 0x30
mov byte [ebp - 4], 1
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43ef7b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x43ef97
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebx + 0xe4], 1
push 0x4e1978
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 3
push eax
push dword [ebp - 0x18]
call fcn.00452af0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x443770
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
lea eax, [esi + 0x1c]
push eax
call dword [0x4df290]
test eax, eax
jne 0x4437a6
lea eax, [esi + 0x24]
push eax
push 0
push esi
push fcn.00442bb0
push 0
push 0
call fcn.004ba1a0
add esp, 0x18
mov dword [esi + 0x20], eax
test eax, eax
jne 0x4437a6
pop esi
ret
mov eax, 1
pop esi
ret

Function at 0x44eb80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d0360
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x527534]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x30]
call fcn.00410c60
mov ecx, esi
call fcn.00410c60
mov edx, dword [esi + 0x60]
or eax, 0xffffffff
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x44ebd0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esi + 0x30]
call fcn.0040d570
mov ecx, esi
call fcn.0040d570
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44ffa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x527534]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x450041
cmp byte [esi + 0x3d], 0
je 0x450041
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x44fff7
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x450009
sub eax, 1
je 0x45000d
sub eax, 2
je 0x450041
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004afed2
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x45002a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004bb25e
add esp, 0x10
cmp edi, eax
jne 0x44fff7
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004afed2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004afed2
mov esp, ebp
pop ebp
ret