joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4226f0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0
push 0
mov esi, ebp
push 1
mov edi, ecx
shl esi, 5
push 0
add esi, edi
call ebx
push 0
push 0
push 1
push 0
mov dword [esi + 8], eax
call ebx
mov dword [esi + 0xc], eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x4202d0
push 0x10000
push 0
mov dword [esi + 0x14], 0
mov byte [esi + 0x18], 0
mov byte [esi + 4], 1
mov dword [esi + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x422778
push str.CreateThread_failed
mov ecx, 0x45d404
call fcn.00416560
mov ecx, 0x45d404
call fcn.00416290
push 2
mov ecx, 0x45d404
call fcn.004166d0
push 1
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov dword [esi], ebx
mov dword [esp + 0x1c], ebp
call fcn.004203a0
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x423d10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, ecx
mov cl, byte [eax + 0x5771]
mov byte [ebp + 0x14a5], cl
mov dl, byte [eax + 0x5772]
mov byte [ebp + 0x14a4], dl
mov ecx, dword [eax + 0x55b8]
push esi
mov dword [ebp + 0x14a0], ecx
mov edx, dword [eax + 0x4c00]
push edi
add eax, 0x55c4
push eax
lea ecx, [ebp + 0x63c8]
mov dword [ebp + 0x60a8], edx
call fcn.0040d480
mov ecx, dword [ebp + 0x20]
cmp ecx, 0x400000
jae 0x423dc3
mov edx, dword [ebp + 0x14a0]
cmp edx, ecx
jae 0x423d94
mov esi, 0x400000
mov eax, edx
sub esi, ecx
lea esp, [esp]
mov ecx, dword [ebp]
lea edx, [ecx + esi]
mov dl, byte [edx + eax]
mov byte [ecx + eax], dl
inc eax
cmp eax, dword [ebp + 0x20]
jb 0x423d80
jmp 0x423dc3
sub edx, ecx
xor eax, eax
mov esi, edx
test ecx, ecx
jbe 0x423db2
mov edi, edi
mov ecx, dword [ebp]
lea edx, [ecx + esi]
mov dl, byte [edx + eax]
mov byte [ecx + eax], dl
inc eax
cmp eax, dword [ebp + 0x20]
jb 0x423da0
mov dword [ebp + 0x14a0], 0
mov byte [ebp + 0x14a5], 1
mov esi, dword [ebp]
mov edi, dword [ebp + 0x20]
add edi, esi
cmp dword [esp + 0x18], 0
mov ecx, 0x44
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, dword [ebp + 0x14a0]
lea eax, [ebx + 1]
jne 0x423e39
mov esi, dword [ebp + 0x24]
and eax, esi
xor edx, edx
mov dword [ebp + 0x14a0], eax
cmp eax, ebx
je 0x423e62
mov ecx, dword [ebp]
movzx ecx, byte [eax + ecx + 2]
shl edx, 5
xor ecx, edx
mov edx, dword [ebp + 0x10]
and ecx, 0x7fff
lea edi, [edx + ecx*4]
mov edx, dword [edi]
mov dword [edi], eax
mov eax, dword [ebp + 0x14a0]
and edx, esi
mov esi, dword [ebp + 0x14]
mov dword [esi + eax*4], edx
mov eax, dword [ebp + 0x14a0]
mov esi, dword [ebp + 0x24]
inc eax
and eax, esi
mov edx, ecx
mov dword [ebp + 0x14a0], eax
cmp eax, ebx
jne 0x423df4
jmp 0x423e62
and eax, dword [ebp + 0x24]
mov dword [ebp + 0x14a0], eax
cmp eax, ebx
je 0x423e62
push eax
mov ecx, ebp
call fcn.00421260
mov eax, dword [ebp + 0x14a0]
inc eax
and eax, dword [ebp + 0x24]
mov dword [ebp + 0x14a0], eax
cmp eax, ebx
jne 0x423e46
mov esi, dword [esp + 0x14]
push 0x4bf0
add esi, 0x10
lea ecx, [ebp + 0x14b4]
push esi
push ecx
mov byte [ebp + 0x60a4], 0
call fcn.0043e570
add esp, 0xc
mov ecx, esi
call fcn.00437690
lea ecx, [ebp + 0xda8]
call fcn.00426500
pop edi
xor eax, eax
pop esi
mov dword [ebp + 0x974], eax
mov dword [ebp + 0x978], eax
mov byte [ebp + 0x97c], 1
pop ebp
pop ebx
ret 8
Function at 0x427800
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
push 0x1a
push 0
mov byte [esi], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x427887
mov edx, dword [esp + 4]
push esi
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x427887
cmp byte [esi], 0
je 0x427887
push esi
call fcn.00427740
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x427847
mov ecx, dword [0x44cab8]
mov dword [eax], ecx
mov dx, word [0x44cabc]
mov word [eax + 4], dx
mov cl, byte [0x44cabe]
push 0
push esi
mov byte [eax + 6], cl
call fcn.0041b230
test al, al
jne 0x4278b3
push 0
push 0
push 0
push esi
call fcn.0041b9e0
test eax, eax
je 0x4278b3
push 0x400
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
call fcn.004272c0
lea edx, [esi + 2]
cmp eax, edx
jb 0x4278b0
cmp byte [esi + 1], 0x3a
jne 0x4278af
add esi, 4
cmp eax, esi
jb 0x4278b0
dec eax
mov byte [eax], 0
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
pop esi
add esp, 8
ret 4

Function at 0x4278d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
push 1
push 0
push str.SoftwareWinRARPaths
push 0x80000001
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x427927
lea ecx, [esp + 4]
push ecx
push esi
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [esp + 0x20]
push str.AppData
push eax
mov dword [esp + 0x1c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esi], 0
je 0x427938
push 0
push esi
call fcn.0041b230
test al, al
jne 0x42793e
push esi
call fcn.00427800
pop esi
add esp, 8
ret 4
Function at 0x430600
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x810
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
mov ebx, dword [esp + 0x81c]
push ebp
mov ebp, dword [esp + 0x824]
push esi
mov esi, dword [esp + 0x820]
cmp ebx, esi
je 0x430638
push ebp
push esi
push ebx
call fcn.004352a0
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SoftwareWinRARGeneral
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x430720
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x430660
sub eax, edx
mov ecx, 0x3ff
sub ecx, eax
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x41c]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.LanguageFolder
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x430715
mov byte [esp + 0x18], al
push 0x400
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edx, [esp + 0x18]
push edx
call fcn.00427740
push esi
call fcn.004272c0
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4306d0
push edi
lea edi, [esp + 0x1c]
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4306e0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [esp + 0x20]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.0041b230
pop edi
test al, al
je 0x430715
push ebp
lea ecx, [esp + 0x1c]
push ecx
push ebx
call fcn.004352a0
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x818]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043e3c6
add esp, 0x810
ret 0xc
Function at 0x4307f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x498
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x494], eax
push esi
mov esi, ecx
cmp byte [esi], 0
je 0x430827
mov eax, dword [0x45d400]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [0x45d3fc]
mov dword [0x45d400], ecx
mov byte [esi], 0
mov eax, dword [esp + 0x4a4]
lea edx, [esp + 0x98]
test eax, eax
je 0x43084c
sub edx, eax
jmp 0x430840
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x430840
jmp 0x43085a
push 0x400
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x98]
push eax
call fcn.004272c0
mov ecx, dword [str.rarlng.dll]
mov dword [eax], ecx
mov edx, dword [0x44cc10]
mov dword [eax + 4], edx
mov cx, word [0x44cc14]
mov word [eax + 8], cx
mov dl, byte [0x44cc16]
mov byte [eax + 0xa], dl
push 0x400
lea eax, [esp + 0x9c]
push eax
mov ecx, eax
push ecx
call fcn.00430600
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x14], 2
jne 0x4308e1
mov eax, dword [esp + 8]
cmp eax, 5
ja 0x4308cd
jne 0x4308e1
cmp dword [esp + 0xc], 1
jbe 0x4308e1
push 2
push 0
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x4308ef
lea ecx, [esp + 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x45d400], eax
setne al
mov byte [esi], al
pop esi
test al, al
jne 0x430928
mov eax, dword [esp + 0x49c]
mov dword [0x45d400], eax
mov dword [0x45d3fc], eax
mov ecx, dword [esp + 0x494]
xor ecx, esp
call fcn.0043e3c6
add esp, 0x498
ret 8
mov ecx, dword [esp + 0x494]
mov edx, dword [esp + 0x49c]
xor ecx, esp
mov dword [0x45d3fc], edx
call fcn.0043e3c6
add esp, 0x498
ret 8
Function at 0x430950
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
mov ebp, ecx
mov ecx, 8
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
xor ecx, ecx
xor eax, eax
lea esp, [esp]
cmp edi, 0xa
jg 0x430aad
cmp eax, 4
jge 0x4309c6
mov edi, edi
cmp ecx, 4
jge 0x4309c9
mov bl, byte [esp + eax*4 + 0x10]
lea edx, [ecx + edi*4]
mov byte [ebp + edx*4 + 0x14], bl
lea edx, [ecx + edi*4]
lea esi, [ebp + edx*4]
movzx edx, byte [esp + eax*4 + 0x11]
mov byte [esi + 0x15], dl
movzx edx, byte [esp + eax*4 + 0x12]
mov byte [esi + 0x16], dl
movzx edx, byte [esp + eax*4 + 0x13]
inc eax
inc ecx
cmp eax, 4
mov byte [esi + 0x17], dl
jl 0x430990
cmp ecx, 4
jne 0x4309ce
inc edi
xor ecx, ecx
cmp eax, 4
jl 0x430980
cmp edi, 0xa
jg 0x430aad
mov edx, 0x462050
movzx esi, byte [esp + 0x1d]
mov al, byte [esp + 0x10]
xor al, byte [esi + 0x462170]
movzx esi, byte [esp + 0x1e]
movzx ebx, byte [esi + 0x462170]
movzx esi, byte [esp + 0x1f]
xor byte [esp + 0x11], bl
movzx ebx, byte [esi + 0x462170]
movzx esi, byte [esp + 0x1c]
xor byte [esp + 0x12], bl
movzx ebx, byte [esi + 0x462170]
xor al, byte [edx]
xor byte [esp + 0x13], bl
mov byte [esp + 0x10], al
inc edx
lea eax, [esp + 0x11]
mov esi, 3
movzx ebx, byte [eax - 1]
xor byte [eax + 3], bl
movzx ebx, byte [eax]
xor byte [eax + 4], bl
movzx ebx, byte [eax + 1]
xor byte [eax + 5], bl
movzx ebx, byte [eax + 2]
xor byte [eax + 6], bl
add eax, 4
sub esi, 1
jne 0x430a30
xor eax, eax
cmp edi, 0xa
jg 0x430aad
cmp eax, 4
jge 0x430a97
nop
cmp ecx, 4
jge 0x430a9a
movzx ebx, byte [esp + eax*4 + 0x10]
lea esi, [ecx + edi*4]
mov byte [ebp + esi*4 + 0x14], bl
movzx ebx, byte [esp + eax*4 + 0x11]
lea esi, [ecx + edi*4]
lea esi, [ebp + esi*4]
mov byte [esi + 0x15], bl
movzx ebx, byte [esp + eax*4 + 0x12]
mov byte [esi + 0x16], bl
movzx ebx, byte [esp + eax*4 + 0x13]
inc eax
inc ecx
cmp eax, 4
mov byte [esi + 0x17], bl
jl 0x430a60
cmp ecx, 4
jne 0x430a9f
inc edi
xor ecx, ecx
cmp eax, 4
jl 0x430a55
cmp edi, 0xa
jle 0x4309e1
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043e3c6
add esp, 0x24
ret 4
Function at 0x430ad0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
mov eax, ecx
push edi
lea esi, [eax + 0x24]
lea ecx, [eax + 0x28]
mov edi, 9
mov edi, edi
xor eax, eax
jmp 0x430b00
movzx edx, byte [ecx - 1]
movzx edx, byte [eax + edx*4 + 0x45f050]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x45f450]
movzx ebx, byte [ecx - 3]
xor dl, byte [eax + ebx*4 + 0x45f850]
movzx ebx, byte [ecx - 4]
xor dl, byte [eax + ebx*4 + 0x45fc50]
movzx ebx, byte [ecx + 2]
mov byte [esp + eax + 0xc], dl
movzx edx, byte [ecx + 3]
movzx edx, byte [eax + edx*4 + 0x45f050]
xor dl, byte [eax + ebx*4 + 0x45f450]
movzx ebx, byte [ecx + 1]
xor dl, byte [eax + ebx*4 + 0x45f850]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x45fc50]
movzx ebx, byte [ecx + 6]
mov byte [esp + eax + 0x10], dl
movzx edx, byte [ecx + 7]
movzx edx, byte [eax + edx*4 + 0x45f050]
xor dl, byte [eax + ebx*4 + 0x45f450]
movzx ebx, byte [ecx + 5]
xor dl, byte [eax + ebx*4 + 0x45f850]
movzx ebx, byte [ecx + 4]
xor dl, byte [eax + ebx*4 + 0x45fc50]
movzx ebx, byte [ecx + 0xa]
mov byte [esp + eax + 0x14], dl
movzx edx, byte [ecx + 0xb]
movzx edx, byte [eax + edx*4 + 0x45f050]
xor dl, byte [eax + ebx*4 + 0x45f450]
movzx ebx, byte [ecx + 9]
xor dl, byte [eax + ebx*4 + 0x45f850]
movzx ebx, byte [ecx + 8]
xor dl, byte [eax + ebx*4 + 0x45fc50]
inc eax
cmp eax, 4
mov byte [esp + eax + 0x17], dl
jl 0x430b00
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esi], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
add ecx, 0x10
add esi, 0x10
sub edi, 1
jne 0x430af0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043e3c6
add esp, 0x14
ret
Function at 0x431da0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
push ebx
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
mov ebx, ecx
test eax, eax
ja 0x431dd9
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0043e3c6
add esp, 0x18
ret 0xc
mov ecx, dword [esi + 4]
xor ecx, dword [ebx + 8]
mov edx, dword [esi + 8]
xor edx, dword [ebx + 0xc]
shr eax, 4
push ebp
mov ebp, eax
mov eax, dword [esi]
xor eax, dword [ebx + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
xor eax, dword [ebx + 0x10]
push edi
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
call fcn.00430c10
add esi, 0x10
add ebp, 0xffffffff
je 0x431e5e
nop
mov edx, dword [edi]
xor edx, dword [esi]
mov eax, dword [edi + 4]
xor eax, dword [esi + 4]
mov ecx, dword [edi + 8]
xor ecx, dword [esi + 8]
mov dword [esp + 0x14], edx
mov edx, dword [edi + 0xc]
xor edx, dword [esi + 0xc]
mov dword [esp + 0x18], eax
add edi, 0x10
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x20], ecx
push eax
mov ecx, ebx
mov dword [esp + 0x28], edx
call fcn.00430c10
add esi, 0x10
sub ebp, 1
jne 0x431e20
mov ecx, dword [edi]
mov dword [ebx + 4], ecx
mov edx, dword [edi + 4]
mov dword [ebx + 8], edx
mov eax, dword [edi + 8]
mov dword [ebx + 0xc], eax
mov ecx, dword [edi + 0xc]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [ebx + 0x10], ecx
mov ecx, dword [esp + 0x1c]
pop esi
pop ebx
xor ecx, esp
shl eax, 4
call fcn.0043e3c6
add esp, 0x18
ret 0xc
Function at 0x431ea0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
mov esi, dword [esp + 0x38]
push edi
mov edi, dword [esp + 0x44]
mov ebx, ecx
test esi, esi
je 0x431f95
mov eax, dword [esp + 0x40]
test eax, eax
jbe 0x431f95
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
shr eax, 4
mov dword [esp + 0x18], ecx
mov ecx, dword [ebx + 0x10]
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
test eax, eax
jbe 0x431f65
lea edx, [esp + 0x28]
push edx
push esi
mov ecx, ebx
call fcn.00431310
mov edx, dword [esp + 0x20]
xor dword [esp + 0x30], edx
mov edx, dword [esp + 0x24]
xor dword [esp + 0x34], edx
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x2c]
xor ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
xor eax, ebp
mov ebp, dword [esi]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 8]
mov dword [esp + 0x20], edx
mov edx, dword [esi + 0xc]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x34]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
add esi, 0x10
add edi, 0x10
sub dword [esp + 0x10], 1
mov dword [esp + 0x24], edx
jne 0x431ef7
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [ebx + 4], ebp
pop ebp
mov dword [ebx + 8], edx
mov edx, dword [esp + 0x20]
pop edi
mov dword [ebx + 0xc], ecx
pop esi
mov dword [ebx + 0x10], edx
shl eax, 4
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0043e3c6
add esp, 0x2c
ret 0xc
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0043e3c6
add esp, 0x2c
ret 0xc

Function at 0x434c70
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
ret 4

Function at 0x435a30
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x435a83
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x80000000
push 0xd
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
Function at 0x439400
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x408
push ebx
push ebp
push esi
mov esi, dword [esp + 0x418]
push edi
mov ebx, ecx
movzx edi, word [ebx]
sub edi, dword [esi + 0x654]
mov dword [esp + 0x14], ebx
push edi
push esi
call fcn.004375b0
mov dl, byte [esi + 0xa6c]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 4]
sub eax, 6
lea ebp, [esp + 0x18]
xor ecx, ecx
lea ecx, [ecx]
movzx ebx, byte [eax + 6]
add eax, 6
cmp byte [ebx + esi + 0x66c], dl
je 0x439440
movzx ebx, byte [eax + 1]
mov dword [ebp], eax
add ecx, ebx
add ebp, 4
sub edi, 1
jne 0x439440
add dword [esi + 0x4a84], ecx
mov eax, dword [esi + 0x4a78]
xor edx, edx
div dword [esi + 0x4a84]
xor edx, edx
mov edi, eax
mov eax, dword [esi + 0x4a74]
sub eax, dword [esi + 0x4a70]
mov dword [esi + 0x4a78], edi
div edi
mov ebx, dword [esi + 0x4a84]
cmp eax, ebx
jl 0x4394a6
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x408
ret 4
cmp eax, ecx
mov edx, dword [esp + 0x18]
lea edi, [esp + 0x18]
jge 0x439523
movzx ecx, byte [edx + 1]
cmp ecx, eax
jg 0x4394d0
lea ebx, [ebx]
mov edx, dword [edi + 4]
movzx ebx, byte [edx + 1]
add edi, 4
add ecx, ebx
cmp ecx, eax
jle 0x4394c0
mov edi, dword [esp + 0x10]
mov dword [esi + 0x4a80], ecx
movzx eax, byte [edx + 1]
sub ecx, eax
mov dword [esi + 0x4a7c], ecx
mov cl, byte [edi + 2]
cmp cl, 7
jae 0x439509
add byte [edi + 3], 0xff
jne 0x439509
mov ax, word [edi]
add ax, ax
mov word [edi], ax
mov al, 3
shl al, cl
inc cl
mov byte [edi + 2], cl
mov byte [edi + 3], al
mov ecx, dword [esp + 0x14]
push edx
push esi
call fcn.00439270
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x408
ret 4
mov edi, dword [esp + 0x14]
mov dword [esi + 0x4a7c], ecx
mov dword [esi + 0x4a80], ebx
movzx ecx, word [edi]
sub ecx, dword [esi + 0x654]
lea eax, [esp + 0x18]
sub eax, 4
mov edx, dword [eax + 4]
movzx edx, byte [edx]
mov bl, byte [esi + 0xa6c]
add eax, 4
sub ecx, 1
mov byte [edx + esi + 0x66c], bl
jne 0x439543
mov cx, word [esi + 0x4a84]
mov eax, dword [esp + 0x10]
add word [eax], cx
movzx edx, word [edi]
pop edi
mov dword [esi + 0x654], edx
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x408
ret 4

Function at 0x43e3c6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4537b0]
jne 0x43e3d0
repz ret
jmp fcn.004419e8
Function at 0x440abf
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x44ffc8
call fcn.004417d0
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4409bf
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4409bf
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4409bf
cmp dword [eax + 0x400074], 0xe
jbe 0x4409bf
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4409c3
and dword [ebp - 0x1c], 0
push 1
call fcn.00440b48
pop ecx
test eax, eax
jne 0x4409d7
push 0x1c
call fcn.00440949
pop ecx
call fcn.00443d09
test eax, eax
jne 0x4409e8
push 0x10
call fcn.00440949
pop ecx
call fcn.004452d2
and dword [ebp - 4], 0
call fcn.0044619f
test eax, eax
jge 0x440a02
push 0x1b
call fcn.0043fb52
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x464504], eax
call fcn.0044606a
mov dword [0x462938], eax
call fcn.00445fb1
test eax, eax
jge 0x440a28
push 8
call fcn.0043fb52
pop ecx
call fcn.00445d6d
test eax, eax
jge 0x440a39
push 9
call fcn.0043fb52
pop ecx
push 1
call fcn.0043fbfb
pop ecx
test eax, eax
je 0x440a4c
push eax
call fcn.0043fb52
pop ecx
mov eax, dword [0x46290c]
mov dword [0x462910], eax
push eax
push dword [0x462904]
push dword [0x462900]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x440a7a
push eax
call fcn.0043fdb9
call fcn.0043fddb
jmp 0x440aaf
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00441815
ret
call fcn.004463f3
jmp 0x44096d

Function at 0x442639
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x4537b0]
xor eax, ebp
mov dword [ebp + 0x2a4], eax
and dword [ebp - 0x80], 0
push ebx
push 0x4c
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.0043e8e0
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp + 0x88], eax
mov dword [ebp + 0x84], ecx
mov dword [ebp + 0x80], edx
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x78], esi
mov dword [ebp + 0x74], edi
mov word [ebp + 0xa0], ss
mov word [ebp + 0x94], cs
mov word [ebp + 0x70], ds
mov word [ebp + 0x6c], es
mov word [ebp + 0x68], fs
mov word [ebp + 0x64], gs
pushfd
pop dword [ebp + 0x98]
mov eax, dword [ebp + 0x2ac]
lea ecx, [ebp + 0x2ac]
mov dword [ebp - 0x28], 0x10001
mov dword [ebp + 0x90], eax
mov dword [ebp + 0x9c], ecx
mov ecx, dword [ecx - 4]
mov dword [ebp + 0x8c], ecx
mov dword [ebp - 0x80], 0xc0000417
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x442718
test ebx, ebx
jne 0x442718
push 2
call fcn.004465db
pop ecx
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
xor ecx, ebp
pop ebx
call fcn.0043e3c6
add ebp, 0x2a8
leave
ret