joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418010
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push str.StealthExtensionHelper::removePolicyForWebmailChromeExtension
push str._s_enter_
push str.stealth_manager
call fcn.00402320
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x428a5c], 8
lea ecx, [ebp - 4]
mov edi, 0x428a48
mov eax, edi
cmovae eax, dword [0x428a48]
push ecx
push 0x203
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push str.Status_local_machine:__d
push str.stealth_manager
call fcn.00402320
mov eax, dword [ebp - 4]
add esp, 0xc
test eax, eax
je 0x41809f
push 0x423640
push 0x421bac
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
push eax
push str.Delete_key_on_local_machine:__d
push str.stealth_manager
call fcn.00402320
add esp, 0xc
cmp dword [0x428a5c], 8
lea eax, [ebp - 8]
push eax
cmovae edi, dword [0x428a48]
push 0x203
push 0
push edi
push SysReAllocString
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push str.Status_current_user:__d
push str.stealth_manager
call fcn.00402320
mov eax, dword [ebp - 8]
add esp, 0xc
pop edi
test eax, eax
je 0x41810a
push 0x423640
push 0x421bac
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
push eax
push str.Delete_key_on_current_user:__d
push str.stealth_manager
call fcn.00402320
add esp, 0xc
push str.StealthExtensionHelper::removePolicyForWebmailChromeExtension
push str._s_exit_
push str.stealth_manager
call fcn.00402320
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x418a50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c618
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x428024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0
call fcn.004172f0
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x64]
mov edx, dword [ebp - 0x60]
cmp esi, edx
je 0x418b53
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
nop dword [eax + eax]
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.00405950
push 0xb
push str.extensions
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00402750
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call edi
cmp eax, 0xffffffff
je 0x418b2c
test al, 0x10
je 0x418b2c
push 1
push 0x42192c
lea ecx, [ebp - 0x28]
call fcn.00402750
push 0xffffffffffffffff
push 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.004029f0
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x58]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call ebx
add esp, 8
test eax, eax
jne 0x418b2c
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
call fcn.0040a780
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x418b42
inc eax
push eax
push dword [ebp - 0x28]
call fcn.00402b40
mov edx, dword [ebp - 0x60]
add esi, 0x18
cmp esi, edx
jne 0x418ab0
mov esi, dword [ebp - 0x64]
test esi, esi
je 0x418b9a
push dword [ebp - 0x68]
push ecx
mov ecx, esi
call fcn.004069b0
mov ecx, dword [ebp - 0x5c]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x64]
add esp, 8
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.00406330
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x418bac
inc eax
push eax
push dword [ebp + 8]
call fcn.00402b40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00419532
mov esp, ebp
pop ebp
ret
Function at 0x40bb6b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x40bb7a
pop dword [ebp - 4]
mov eax, 0x40bb7a
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x3a96d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x3c93
xor esi, esi
add esi, eax
mov edi, 0xad344d35
sub edi, 0xacf0ed35
add edi, dword [ebp - 4]
mov edx, 0x47e2e54c
sub edx, 0x1e816ed9
mov ebx, dword [edi]
xor ebx, edx
mov dword [esi], ebx
add esi, 0x918c35cf
sub esi, 0x918c35cb
add edi, 0xb8705591
sub edi, 0xb870558d
loop 0x40bbcb
add eax, 0xe51f
xor ebx, ebx
add ebx, eax
add eax, 0x5dcf5879
sub eax, 0x5dcf5874
mov ecx, 0x400000
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x1d7944d3
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..rsrc
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x180e1394
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x416810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, edx
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
xor esi, esi
lea edx, [eax + edx*2]
movzx ebx, byte [eax + 1]
cmp byte [eax], ch
lea eax, [eax + 2]
lea edi, [esi + ebx]
jne 0x416860
cmp esi, edi
ja 0x4168c8
cmp edi, dword [esp + 0x1c]
ja 0x4168db
add esi, dword [esp + 0x18]
nop word [eax + eax]
test ebx, ebx
je 0x416862
dec ebx
cmp byte [esi], cl
lea esi, [esi + 1]
jne 0x416850
jmp 0x4168bf
ja 0x416868
cmp eax, edx
mov esi, edi
jne 0x416823
mov edi, dword [esp + 0x24]
movzx ecx, cx
mov al, 1
add edi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movzx edx, byte [ebp]
lea esi, [ebp + 1]
test dl, dl
js 0x4168a0
mov ebp, esi
sub ecx, edx
jns 0x4168b7
jmp 0x4168c1
cmp esi, edi
je 0x4168f0
movzx esi, byte [ebp + 1]
and edx, 0x7f
add ebp, 2
shl edx, 8
or edx, esi
sub ecx, edx
js 0x4168c1
xor al, 1
cmp ebp, edi
jne 0x416880
jmp 0x4168c1
xor eax, eax
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, esi
mov edx, edi
push 0xc6b5f0
call fcn.0044af70
add esp, 4
ud2
mov edx, dword [esp + 0x1c]
mov ecx, edi
push 0xc6b5f0
call fcn.0044ad60
add esp, 4
ud2
mov ecx, str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112librarycore_srcio_borrowed_buf.rs_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_alloc_srccollections_btree_navigate.rs
mov edx, 0x2b
push 0xc6b5e0
call fcn.0044add0
add esp, 4
ud2
Function at 0x41fc10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0xc7b04c]
test eax, eax
je 0x41fc38
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x41fc4e
cmp dword [eax + 4], 0
mov edi, eax
je 0x41fc4e
add edi, 8
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0xc7b04c
call fcn.0044b930
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x41fc28
mov eax, dword [0xc7b04c]
test eax, eax
je 0x41fd02
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41fd1c
mov esi, eax
test eax, eax
jne 0x41fcc9
movzx eax, byte [0xc7b9b8]
mov eax, dword [0xc7ba38]
test eax, eax
jne 0x41fc95
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x41fd2f
mov dword [0xc7ba38], eax
push 0xc
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41fd2f
mov dword [eax], 0xc7b04c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0xc7b04c]
test eax, eax
je 0x41fd23
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x41fc33
test ecx, ecx
je 0x41fc33
lock dec dword [ecx]
jne 0x41fc33
call fcn.00411110
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0xc7b04c
call fcn.0044b930
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41fc6c
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0xc7b04c
call fcn.0044b930
jmp 0x41fcc1
mov ecx, 4
mov edx, 0xc
call fcn.0044aba0
ud2

Function at 0x420610
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0xc7b05c]
test eax, eax
je 0x4206b4
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x420633
cmp byte [eax + 4], 0
mov esi, eax
jne 0x4206ad
mov eax, dword [0xc7b05c]
test eax, eax
je 0x4206d3
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4206ed
mov esi, eax
test eax, eax
jne 0x4206a7
movzx eax, byte [0xc7b9b8]
mov eax, dword [0xc7ba38]
test eax, eax
jne 0x42067a
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x4206ff
mov dword [0xc7ba38], eax
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4206ff
mov dword [eax], 0xc7b05c
mov byte [eax + 4], 0
mov esi, eax
mov eax, dword [0xc7b05c]
test eax, eax
je 0x4206f3
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov word [esi + 4], 1
add esi, 5
mov eax, esi
pop esi
ret
mov ecx, 0xc7b05c
call fcn.0044b930
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x42062b
jmp 0x420633
mov ecx, 0xc7b05c
call fcn.0044b930
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x420651
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 0xc7b05c
call fcn.0044b930
jmp 0x42069f
mov ecx, 4
mov edx, 8
call fcn.0044aba0
ud2
Function at 0x420e20
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x420e74
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x420e97
test eax, eax
js 0x420e83
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov al, 4
jmp 0x420e8f
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
xor eax, eax
mov byte [esi], al
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0xc718b8
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0041f3f0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0041f550
mov ecx, 7
int 0x29
ud2
Function at 0x421720
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0xc7b03c]
test eax, eax
je 0x421742
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x421758
cmp dword [eax + 4], 0
je 0x421758
add eax, 8
pop esi
ret
mov ecx, 0xc7b03c
call fcn.0044b930
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x421737
mov eax, dword [0xc7b03c]
test eax, eax
je 0x4217de
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x4217f8
mov esi, eax
test eax, eax
jne 0x4217c7
movzx eax, byte [0xc7b9b8]
mov eax, dword [0xc7ba38]
test eax, eax
jne 0x421797
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x421808
mov dword [0xc7ba38], eax
push 0x10
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x421808
mov dword [eax], 0xc7b03c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0xc7b03c]
test eax, eax
je 0x4217fc
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
lea eax, [esi + 8]
mov byte [esi + 0xc], 0
pop esi
ret
mov ecx, 0xc7b03c
call fcn.0044b930
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x421772
xor eax, eax
pop esi
ret
mov ecx, 0xc7b03c
call fcn.0044b930
jmp 0x4217bf
mov ecx, 4
mov edx, 0x10
call fcn.0044aba0
ud2
Function at 0x428d70
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x428dbd
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x428dcd
mov dword [esi + 4], 0
jmp 0x428ddf
cmp eax, 0x103
je 0x428dfb
test eax, eax
js 0x428de8
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0xc718b8
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0041f3f0
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0041f550
mov ecx, 7
int 0x29
ud2

Function at 0x42c320
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0xc7b06c]
test eax, eax
je 0x42c348
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jb 0x42c35e
cmp dword [eax + 4], 0
mov edi, eax
je 0x42c35e
add edi, 8
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0xc7b06c
call fcn.0044b930
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 2
jae 0x42c338
mov eax, dword [0xc7b06c]
test eax, eax
je 0x42c412
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x42c42c
mov esi, eax
test eax, eax
jne 0x42c3d9
movzx eax, byte [0xc7b9b8]
mov eax, dword [0xc7ba38]
test eax, eax
jne 0x42c3a5
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x42c43f
mov dword [0xc7ba38], eax
push 0xc
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x42c43f
mov dword [eax], 0xc7b06c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0xc7b06c]
test eax, eax
je 0x42c433
dec eax
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x42c343
test ecx, ecx
je 0x42c343
lock dec dword [ecx]
jne 0x42c343
call fcn.0042c450
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0xc7b06c
call fcn.0044b930
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x42c37c
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0xc7b06c
call fcn.0044b930
jmp 0x42c3d1
mov ecx, 4
mov edx, 0xc
call fcn.0044aba0
ud2
Function at 0x433df0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.00421f30
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test edx, edx
je 0x433e55
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.00433d20
mov edi, dword [esp]
test edi, edi
je 0x433e64
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x433e79
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebp
jmp 0x433e71
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], 0
mov ecx, esp
call fcn.00422120
mov dword [esi], 0
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
mov dword [esi], 0
je 0x433e71
push edi
push 0
push dword [0xc7ba38]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x433e71
Function at 0x435e10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x43c460
mov esi, edx
mov edi, ecx
mov eax, dword fs:[0]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword fs:[0], eax
movzx eax, byte [0xc7b9b8]
mov eax, dword [0xc7ba38]
test eax, eax
jne 0x435e63
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x435f1e
mov dword [0xc7ba38], eax
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x435f1e
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
push 0
push 0x10000
push ebx
push 0x435ff0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x435ea5
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x435f0d
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], eax
push eax
mov dword [ebp - 0x24], ecx
call dword [ecx]
add esp, 4
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
cmp dword [eax + 4], 0
je 0x435ef2
cmp dword [eax + 8], 9
jae 0x435edd
mov eax, dword [ebp - 0x20]
jmp 0x435ee3
mov eax, dword [ebp - 0x20]
mov eax, dword [eax - 4]
push eax
push 0
push dword [0xc7ba38]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push 0
push dword [0xc7ba38]
call dword [sym.imp.KERNEL32.dll_HeapFree]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 8
mov dword [ebp - 0x10], 0
call fcn.0044aba0
ud2
Function at 0x436490
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1038
call fcn.0043c840
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x43c490
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], edx
lea esi, [ebp - 0x1044]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x1000
push 0
push esi
call fcn.0043d1f0
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push 0x42d3d0
push eax
push 0x1000
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x4365e4
mov ebx, dword [sym.imp.KERNEL32.dll_SleepEx]
mov dword [ebp - 0x20], edi
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x43651a
cmp dword [ebp - 0x2c], 0
jne 0x4365f5
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x4365f5
cmp esi, 0x1000
ja 0x436631
xor edi, edi
nop dword [eax]
mov eax, esi
sub eax, edi
jb 0x436617
xorps xmm0, xmm0
lea edx, [ebp - 0x30]
lea ecx, [ebp + edi - 0x1044]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], edx
push 0x42d3d0
lea edx, [ebp - 0x44]
push edx
push eax
push ecx
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
je 0x4365ec
nop dword [eax]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x436590
cmp dword [ebp - 0x2c], 0
jne 0x4365f2
add edi, dword [ebp - 0x28]
cmp edi, esi
jne 0x436550
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
push 0x42d3d0
lea eax, [ebp - 0x44]
push eax
push 0x1000
lea eax, [ebp - 0x1044]
push eax
mov edi, dword [ebp - 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x43651a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4365f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push dword [ebp - 0x24]
call esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1038
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, edi
mov edx, esi
push 0xc71af0
call fcn.0044af70
add esp, 4
jmp 0x43664c
mov dword [ebp - 0x10], 0
mov ecx, esi
mov edx, 0x1000
push 0xc71af0
call fcn.0044ad60
add esp, 4
ud2
Function at 0x436740
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, esp
mov dword [esi + 0x38], ebp
mov dword [esi + 0x3c], esp
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x44], 0x43c4b0
lea eax, [esi + 0x40]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x40], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x4367a4
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, esi
lea ecx, [esi + 8]
mov dword [esi + 0x20], 0xc71c18
mov dword [esi + 0x24], 1
mov dword [esi + 0x30], 0
mov byte [esi], 0
mov dword [esi + 4], eax
mov dword [esi + 0x48], 0
mov dword [esi + 8], edx
mov dword [esi + 0x28], ecx
lea ecx, [esi + 0x20]
mov edx, 0xc71c44
mov dword [esi + 0xc], 0x426fc0
mov dword [esi + 0x2c], 1
call fcn.0044ac50
ud2

Function at 0x437ff0
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
cmp dword [edx], 0
mov edi, edx
jne 0x4380c1
mov ebx, dword [edi + 0xc]
mov esi, ecx
mov edx, dword [ebx + 4]
test edx, edx
jne 0x43801a
mov eax, dword [ebx + 8]
xor edx, edx
lea ecx, [eax + 0xf]
cmp ecx, 0xf
jbe 0x43808e
mov eax, dword [ebx + 8]
cmp edx, eax
je 0x4380aa
mov ecx, dword [edi + 8]
sub edx, eax
add eax, dword [ebx]
mov dword [esp], 0
mov ebx, esp
push ecx
push ebx
push edx
push eax
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x438054
mov eax, dword [esp]
mov ecx, 2
test eax, eax
jne 0x438072
jmp 0x438066
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x43806d
cmp eax, 0x6d
jne 0x438083
mov word [esi], 4
jmp 0x43807c
mov ecx, 1
mov dword [edi], ecx
mov dword [edi + 4], eax
mov word [esi], 0x104
add esp, 0x18
pop esi
pop edi
pop ebx
ret
mov dword [esi], 0
mov dword [esi + 4], eax
jmp 0x43807c
mov edx, eax
mov ecx, ebx
push 0x10
call fcn.0044ab00
add esp, 4
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 8]
cmp edx, eax
jne 0x438025
mov ecx, ebx
push 1
call fcn.0044ab00
add esp, 4
mov edx, dword [ebx + 4]
mov eax, dword [ebx + 8]
jmp 0x438025
mov edx, esp
mov ecx, edi
mov dword [esp], 0
call fcn.0044bdb0
ud2