joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c2a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x43c2b9
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x43c2b2
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x43c2cd
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043bc64
test bl, bl
jne 0x43c3a0
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x524c58
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x43c304
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x43c318
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043c178
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x43c34a
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x43c2f9
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x43c36d
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x43c37e
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x43c392
jmp 0x43c45b
cmp bl, 1
jne 0x43c45b
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x524cb2
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x43c3c0
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x43c3d4
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043c178
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x43c406
sub ebx, 6
inc dword [ebp - 8]
jne 0x43c3b5
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x43c42d
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x43c43e
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x43c452
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043bce8
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x43c9ec
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x43cae7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea edx, [ebp - 8]
mov eax, 0x43cb00
call fcn.0043cb08
lea eax, [ebp - 8]
mov edx, edi
call fcn.00404328
mov eax, dword [ebp - 8]
call fcn.00404520
mov esi, eax
xor edx, edx
push ebp
push 0x43cac7
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenMutexA
mov ebx, eax
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x43ca66
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43cad1
mov eax, edi
call fcn.00404520
push eax
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenMutexA
mov ebx, eax
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x43ca96
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43cad1
push esi
push 0xffffffffffffffff
push 0
call fcn.00406304
mov ebx, eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x43cab3
cmp eax, 5
jne 0x43cabd
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43cad1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43caee
lea eax, [ebp - 8]
call fcn.00404060
ret

Function at 0x43cb08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43cb82
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404060
mov eax, dword [ebp - 4]
call fcn.00404320
mov esi, eax
test esi, esi
jle 0x43cb6c
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov bl, byte [eax + edx - 1]
xor bl, 0xa
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404248
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404328
inc dword [ebp - 8]
dec esi
jne 0x43cb45
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43cb89
lea eax, [ebp - 0xc]
call fcn.00404060
ret

Function at 0x43cc60
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43ccd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404060
mov dword [ebp - 8], 0x1e
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004046ac
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404520
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x43ccbd
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404580
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ccda
lea eax, [ebp - 4]
call fcn.00404060
ret
Function at 0x43cce0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd50
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404060
xor ecx, ecx
push ebp
push 0x43cdbd
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push pe_nt_image_headers32
lea eax, [ebp - 0x290]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x290]
mov edx, esi
call fcn.00408280
lea eax, [ebp - 0x290]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x43cdae
mov edx, dword [eax + 0xc]
test edx, edx
je 0x43cdae
mov esi, dword [edx]
test esi, esi
je 0x43cdae
push ebx
xor eax, eax
mov al, byte [esi]
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 0x2ac], 0
xor eax, eax
mov al, byte [esi + 1]
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 0x2a4], 0
xor eax, eax
mov al, byte [esi + 2]
mov dword [ebp - 0x2a0], eax
mov byte [ebp - 0x29c], 0
xor eax, eax
mov al, byte [esi + 3]
mov dword [ebp - 0x298], eax
mov byte [ebp - 0x294], 0
lea edx, [ebp - 0x2b0]
mov ecx, 3
mov eax, 0x43cdd8
call fcn.004087f4
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43cdc7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43d0b4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
mov ebx, eax
mov edx, ebx
mov eax, 0x43d154
call fcn.0043cb08
xor edx, edx
push ebp
push 0x43d138
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x43d129
push pe_nt_image_headers32
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostbyname
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 4], eax
push dword [ebp - 4]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.00404258
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43d142
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43dbac
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43dca6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.00404320
cmp eax, 2
jl 0x43dc8b
mov eax, ebx
call fcn.00408064
test al, al
je 0x43dc8b
lea ecx, [ebp - 8]
mov edx, 0x43dcc0
mov eax, ebx
call fcn.0043db24
xor eax, eax
push ebp
push 0x43dc81
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.00404520
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43dc77
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0040810c
mov eax, dword [ebp - 0xc]
call fcn.00404320
mov edi, eax
inc edi
push 0
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0xc]
call fcn.00404578
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
push ebx
call sub.kernel32.dll_CloseHandle
push esi
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43dc8b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43dcad
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404084
ret

Function at 0x43ddd0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43dea6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.00404320
cmp eax, 2
jl 0x43de90
xor eax, eax
push ebp
push 0x43de86
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov eax, ebx
call fcn.00404520
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x43de7c
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0040810c
mov eax, dword [ebp - 8]
call fcn.00404320
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
call fcn.00404578
push eax
push esi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
call fcn.00404520
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43de90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43dead
lea eax, [ebp - 8]
call fcn.00404060
ret

Function at 0x43dfb4
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov eax, ebx
call fcn.00404060
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x43dfe2
mov edx, ebx
lea eax, [esp + 4]
call fcn.00408350
add esp, 0x18
pop ebx
ret
Function at 0x43e8a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x43e936
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404060
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00406610
test eax, eax
je 0x43e91d
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.004042d0
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call fcn.0040c2bc
mov edx, dword [ebp - 0x110]
mov eax, ebx
call fcn.004040b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e93d
lea eax, [ebp - 0x110]
call fcn.00404060
ret

Function at 0x43e944
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43e9d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, 0x29
call fcn.0043e8a0
mov eax, dword [ebx]
call fcn.00408064
test al, al
jne 0x43e9a4
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
jbe 0x43e9a4
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004042d0
lea edx, [ebp - 0x10c]
mov eax, dword [ebx]
call fcn.0040c2bc
mov edx, dword [ebp - 0x10c]
mov eax, ebx
call fcn.004040b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e9de
lea eax, [ebp - 0x10c]
call fcn.00404060
ret

Function at 0x43e9e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43ea77
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, 0x24
call fcn.0043e8a0
mov eax, dword [ebx]
call fcn.00408064
test al, al
jne 0x43ea44
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
jbe 0x43ea44
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004042d0
lea edx, [ebp - 0x10c]
mov eax, dword [ebx]
call fcn.0040c2bc
mov edx, dword [ebp - 0x10c]
mov eax, ebx
call fcn.004040b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ea7e
lea eax, [ebp - 0x10c]
call fcn.00404060
ret

Function at 0x43ea84
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43eafc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.004042d0
lea edx, [ebp - 0x10c]
mov eax, dword [ebx]
call fcn.0040c2bc
mov edx, dword [ebp - 0x10c]
mov eax, ebx
call fcn.004040b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43eb03
lea eax, [ebp - 0x10c]
call fcn.00404060
ret
Function at 0x43ec18
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x43ec20
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x43ed7b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
lea edx, [ebp - 0x14]
mov eax, 0x43ed90
call fcn.0043cb08
mov eax, dword [ebp - 0x14]
call fcn.00404520
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
jne 0x43ec73
mov dword [ebp - 4], 0xaacd2aec
lea edx, [ebp - 0x10]
mov eax, 0x43ed9c
call fcn.0043cb08
lea edx, [ebp - 0x18]
mov eax, 0x43eda8
call fcn.0043cb08
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, 0x58
xor edx, edx
div ecx
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x1c]
mov eax, 8
call fcn.00407c24
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 4]
shr eax, 4
movzx eax, ax
mov edx, 4
call fcn.00407bfc
push dword [ebp - 0x20]
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
shr eax, 4
call fcn.004065b4
movzx eax, ax
lea ecx, [ebp - 0x24]
mov edx, 4
call fcn.00407bfc
push dword [ebp - 0x24]
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
shr eax, 5
call fcn.004065b4
movzx eax, ax
lea ecx, [ebp - 0x28]
mov edx, 4
call fcn.00407bfc
push dword [ebp - 0x28]
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
shl eax, 6
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x2c]
mov eax, 8
call fcn.00407c24
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 4]
shr eax, 5
movzx eax, ax
mov edx, 4
call fcn.00407bfc
push dword [ebp - 0x30]
lea edx, [ebp - 0x34]
mov eax, 0x43edb4
call fcn.0043cb08
push dword [ebp - 0x34]
mov eax, ebx
mov edx, 0xc
call fcn.004043e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ed82
lea eax, [ebp - 0x34]
mov edx, 0xa
call fcn.00404084
ret

Function at 0x43ee80
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x44
call fcn.00402cc4
lea eax, [esp + 0x44]
xor ecx, ecx
mov edx, 0x10
call fcn.00402cc4
mov dword [esp], 0x44
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 4]
push eax
push edi
push 0
push 0x20
push 0
push 0
push 0
push esi
push ebx
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x54
pop edi
pop esi
pop ebx
ret
Function at 0x43eedc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43f042
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, edi
call fcn.00404060
lea eax, [ebp - 0x24]
push eax
mov eax, ebx
call fcn.00404520
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43f01f
mov eax, dword [ebp - 0xc]
call fcn.004026e8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x43f017
xor eax, eax
push ebp
push 0x43f00d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x43f050
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x43f003
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
mov edx, 4
call fcn.00407bfc
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
call fcn.004065b4
movzx eax, ax
lea ecx, [ebp - 0x18]
mov edx, 4
call fcn.00407bfc
push 0x43f074
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push 0x43f090
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.004043e0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.0040436c
mov eax, dword [ebp - 0x28]
call fcn.00404520
push eax
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x43f003
mov eax, edi
mov edx, dword [ebp - 0x20]
call fcn.00404258
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f017
mov eax, dword [ebp - 8]
call fcn.00402708
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f049
lea eax, [ebp - 0x28]
call fcn.00404060
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404084
ret
Function at 0x43f12c
Capabilities:
Encode data using xor
Parse pe header
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x18], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x43f36d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [ebp + 8]
call fcn.00404060
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov eax, esi
call fcn.00404520
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x43f1bb
lea eax, [ebp - 0x154]
call fcn.0043e818
mov edx, dword [ebp - 0x154]
mov eax, dword [ebp + 8]
call fcn.004040b4
jmp 0x43f341
cmp byte [ebp + 0xc], 0
je 0x43f1f9
call fcn.00402ab0
mov eax, 0x1ff
call fcn.00402ce4
mov edx, eax
inc edx
mov eax, edx
shl eax, 4
add eax, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov ecx, 1
mov edx, dword [0x43f108]
call fcn.004053e8
add esp, 4
jmp 0x43f1fc
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov ecx, 1
mov edx, dword [0x43f108]
call fcn.004053e8
add esp, 4
mov ecx, edi
mov eax, ebx
dec eax
test eax, eax
jb 0x43f232
inc eax
xor edx, edx
mov bl, byte [ecx]
xor bl, 0xff
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], bl
inc ecx
inc edx
dec eax
jne 0x43f222
xor ebx, ebx
cmp byte [ebp + 0x10], 0
je 0x43f2e9
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x58]
mov ecx, 0x40
call fcn.004065c0
cmp word [ebp - 0x58], 0x5a4d
jne 0x43f2c9
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
lea edx, [eax + edx]
lea eax, [ebp - 0x150]
mov ecx, 0xf8
call fcn.004065c0
cmp dword [ebp - 0x150], 0x4550
jne 0x43f2a9
cmp word [ebp - 0x138], 0x10b
jb 0x43f2a9
call fcn.0043e468
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
lea eax, [eax + edx + 8]
lea edx, [ebp - 0x14]
mov ecx, 4
call fcn.004065b8
mov bl, 1
jmp 0x43f2eb
lea edx, [ebp - 0x158]
mov eax, 0x43f388
call fcn.0043cb08
mov edx, dword [ebp - 0x158]
mov eax, dword [ebp + 8]
call fcn.004040b4
jmp 0x43f2eb
lea edx, [ebp - 0x15c]
mov eax, 0x43f3a0
call fcn.0043cb08
mov edx, dword [ebp - 0x15c]
mov eax, dword [ebp + 8]
call fcn.004040b4
jmp 0x43f2eb
mov bl, 1
test bl, bl
je 0x43f338
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x43f31f
mov byte [ebp - 1], 1
jmp 0x43f338
lea eax, [ebp - 0x160]
call fcn.0043e818
mov edx, dword [ebp - 0x160]
mov eax, dword [ebp + 8]
call fcn.004040b4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f374
lea eax, [ebp - 0x160]
mov edx, 4
call fcn.00404084
lea eax, [ebp - 0x18]
mov edx, dword [0x43f108]
call fcn.004053f4
ret
Function at 0x43fec8
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x14c], ebx
mov esi, ecx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x44003a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov dword [esi], 2
mov eax, edi
call fcn.00404060
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.00404520
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x44001c
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x440016
push 0
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x4c]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x440016
cmp word [ebp - 0x4c], 0x5a4d
jne 0x440016
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x440016
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x440016
cmp dword [ebp - 0x144], 0x4550
jne 0x440016
mov eax, dword [ebp - 0x13c]
xor eax, 0x50485e00
xor eax, dword [ebp - 0x11c]
movzx edx, word [ebp - 0x13e]
xor eax, edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jle 0x43ffe3
cmp dword [ebp - 0xc], 0x7a120
jge 0x43ffe3
mov eax, dword [ebp - 0xc]
mov dword [esi], eax
mov byte [ebp - 1], 1
jmp 0x440016
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 0xc]
call fcn.00407ae8
mov eax, dword [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, 0x440058
call fcn.0043cb08
mov edx, dword [ebp - 0x14c]
mov eax, edi
pop ecx
call fcn.0040436c
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440041
lea eax, [ebp - 0x14c]
mov edx, 2
call fcn.00404084
ret