joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427ef0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x427f01
jmp dword [ecx*4 + 0x427f70]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret

Function at 0x428100
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5675c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x428165
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x428165
lea edx, [ebp - 0x108]
push edx
call dword [0x5675a8]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff7f3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004ff7f3
mov esp, ebp
pop ebp
ret

Function at 0x428180
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00428100

Function at 0x42cb30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1ec]
test esi, esi
jne 0x42cb4b
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.0040b950
push edx
push eax
call fcn.0040b980
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x1e0], 0
je 0x42cb98
mov eax, dword [ebx + 0x148]
mov ecx, dword [ebx + 0x144]
push eax
push ecx
call fcn.0040b950
push edx
push eax
call fcn.0040b980
mov ecx, dword [edi + 0x1e0]
sub ecx, eax
add esp, 0x10
mov eax, ecx
cmp esi, ecx
jge 0x42cb9a
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x42eec0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x42eef4
push 0x2e
push esi
call dword [sym.imp.VCRUNTIME140.dll_strchr]
add esp, 8
test eax, eax
je 0x42eef2
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x42f1e0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5675c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 0x1c]
mov esi, 8
push eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x42f271
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esi
lea esi, [ebp - 0xc]
mov eax, ebx
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
call fcn.0042f150
mov ecx, esi
push 8
push ecx
call fcn.004333a0
mov ecx, dword [ebp - 0x1c]
add esp, 8
lea edx, [ebp - 0x24]
push edx
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x42f282
mov edx, dword [ebp - 0x1c]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff7f3
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x20]
push ecx
push edi
push 0
push 0
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x24]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 0x1c]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.004ff7f3
mov esp, ebp
pop ebp
ret
Function at 0x42f430
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42f441
sub eax, edx
mov esi, eax
lea eax, [esi + esi]
push eax
mov dword [ebp - 0xc], eax
call dword [0x56759c]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x42f46c
pop edi
pop esi
lea eax, [ebx + 0x1b]
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.0042f3c0
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov esi, dword [ebp + 0x10]
test eax, eax
je 0x42f4eb
mov edx, dword [ebp - 8]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x8002
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x42f4df
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
push 0
push eax
push ebx
push ecx
mov dword [ebp - 0x10], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov eax, dword [ebp - 4]
push 0
lea edx, [ebp - 0x10]
push edx
push esi
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edx, dword [ebp - 8]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov dword [esi + 0x10], eax
push ebx
mov byte [esi + 0x14], al
call dword [0x5675a0]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42f7d0
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x42f803
mov ecx, dword [esi]
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
pop ebp
ret

Function at 0x4319c0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x4319e2
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4319d6
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x431a14
cmp dword [esi + 8], 0
jne 0x431a06
mov ecx, dword [eax + 8]
push 0x51c684
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x431a06
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x431a37
mov eax, dword [esi + 8]
test eax, eax
je 0x431a31
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x433210
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x56759c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x43323b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x433282
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x433285
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x4332e6
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x4332b0
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x43331f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push 0x538887
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x538888
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x4332f0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43576e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 4], 0
je 0x43579e
push esi
xor esi, esi
cmp dword [edx + 0x3cc], esi
jle 0x43579d
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, ecx
mov al, byte [edi + ecx]
xor byte [ecx], al
inc ecx
inc esi
cmp esi, dword [edx + 0x3cc]
jl 0x43578d
pop edi
pop esi
pop ebp
ret 8

Function at 0x435e04
Capabilities:
Encode data using base64

Disassembly:
push 0x10
mov eax, 0x503cd8
call fcn.004ff83b
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov esi, dword [ebp + 8]
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], ebx
jb 0x435e2c
mov eax, dword [esi]
jmp 0x435e2e
mov eax, esi
mov byte [eax], bl
mov eax, dword [ebp + 0x10]
mov ecx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], 1
test eax, eax
je 0x435f9b
push 3
pop edi
mov edx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [edx]
mov byte [ebp + ecx - 0x14], al
inc ecx
mov ah, byte [ebp - 0x12]
inc edx
mov dword [ebp + 0xc], edx
mov dl, byte [ebp - 0x13]
mov dh, byte [ebp - 0x14]
mov byte [ebp - 0xf], ah
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], dh
cmp ecx, edi
jne 0x435ede
mov al, dh
mov cl, dh
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ah
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ah
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
cmp dword [0x567020], 0x10
mov eax, 0x56700c
movzx ecx, byte [ebp + edi - 0x18]
cmovae eax, dword [0x56700c]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
push 1
call fcn.00435abf
inc edi
cmp edi, 4
jl 0x435ea7
mov dl, byte [ebp - 0xd]
mov ecx, ebx
mov dh, byte [ebp - 0xe]
push 3
pop edi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x435e4a
mov dword [ebp + 0x10], ecx
test ecx, ecx
je 0x435f9b
mov eax, ecx
cmp ecx, edi
jge 0x435f17
cmp eax, edi
jae 0x435f12
mov byte [ebp + eax - 0x14], bl
inc eax
cmp eax, edi
jl 0x435efc
mov ah, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov dh, byte [ebp - 0x14]
jmp 0x435f1a
call fcn.004ff601
mov ah, byte [ebp - 0xf]
mov al, dh
and dh, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl dh, 4
add dh, al
shl dl, 2
mov al, ah
mov byte [ebp - 0x17], dh
shr al, 6
and ah, 0x3f
add dl, al
mov byte [ebp - 0x15], ah
lea eax, [ecx + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x435f85
mov edi, eax
cmp dword [0x567020], 0x10
mov eax, 0x56700c
movzx ecx, byte [ebp + ebx - 0x18]
cmovae eax, dword [0x56700c]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
push 1
call fcn.00435abf
inc ebx
cmp ebx, edi
jl 0x435f54
mov ecx, dword [ebp + 0x10]
push 3
pop edi
cmp ecx, edi
jge 0x435f9b
sub edi, ecx
push 0x3d
push 1
mov ecx, esi
call fcn.00435abf
sub edi, 1
jne 0x435f8b
mov eax, esi
call fcn.004ff804
ret

Function at 0x436b9d
Capabilities:
Hide graphical window

Disassembly:
push 0
call fcn.00457d10
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x43ab14
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x504a1e
call fcn.004ff83b
mov esi, ecx
and dword [ebp - 0x14], 0
push str.ClientAppRenderer::OnContextCreated__create_window_binding_r_n
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ebx, str.JsCallWindowsClient
mov byte [ebp - 4], 3
push ebx
lea ecx, [ebp - 0x24]
call fcn.00436100
push ecx
lea eax, [esi + 8]
mov byte [ebp - 4], 4
mov ecx, esp
push eax
call fcn.00437505
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004bf680
add esp, 0xc
mov edi, vtable.CefStringBase_struct_CefStringTraitsUTF16_.0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], edi
call fcn.00436665
push ebx
lea ecx, [ebp - 0x30]
call fcn.00436100
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push 0
push ecx
mov ecx, esp
mov byte [ebp - 4], 7
push eax
call fcn.0043816c
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, esi
call dword [eax + 0x88]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], edi
call fcn.00436665
lea ecx, [ebp - 0x10]
call fcn.00438e6c
lea ecx, [ebp - 0x14]
call fcn.00438e6c
lea ecx, [ebp + 8]
call fcn.0043630e
lea ecx, [ebp + 0xc]
call fcn.00436355
lea ecx, [ebp + 0x10]
call fcn.00438d97
call fcn.004ff804
ret 0xc

Function at 0x43b794
Capabilities:
Hide graphical window

Disassembly:
push 4
mov eax, 0x504d5f
call fcn.004ff83b
mov edi, ecx
and dword [ebp - 0x10], 0
push dword [ebp + 8]
and dword [ebp - 4], 0
lea esi, [edi + 0x554]
mov ecx, esi
call fcn.004391f6
mov ecx, dword [esi]
test ecx, ecx
je 0x43b7fd
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push edx
call dword [eax]
mov esi, dword [eax]
mov ecx, edi
mov eax, dword [edi]
mov byte [ebp - 4], 1
call dword [eax + 0xf4]
movzx eax, al
mov ecx, esi
neg eax
sbb eax, eax
and eax, 4
push eax
mov eax, dword [esi]
call dword [eax + 0x10]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.00438899
mov ecx, edi
call fcn.0045b200
lea ecx, [ebp + 8]
call fcn.0043630e
call fcn.004ff804
ret 4

Function at 0x43b836
Capabilities:
Hide graphical window

Disassembly:
push 4
mov eax, 0x504d82
call fcn.004ff83b
and dword [ebp - 0x10], 0
mov ecx, dword [ecx + 0x554]
test ecx, ecx
je 0x43b87e
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push edx
call dword [eax]
mov ecx, dword [eax]
xor eax, eax
and dword [ebp - 4], 0
cmp byte [ebp + 8], al
push 4
pop edx
cmovne eax, edx
push eax
mov eax, dword [ecx]
call dword [eax + 0x10]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x10]
call fcn.00438899
call fcn.004ff804
ret 4
Function at 0x43b919
Capabilities:
Hide graphical window

Disassembly:
push 4
mov eax, 0x504dd2
call fcn.004ff83b
and dword [ebp - 0x10], 0
mov ecx, dword [ecx + 0x554]
test ecx, ecx
je 0x43b961
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push edx
call dword [eax]
mov ecx, dword [eax]
xor eax, eax
and dword [ebp - 4], 0
cmp byte [ebp + 8], al
push 4
pop edx
cmovne eax, edx
push eax
mov eax, dword [ecx]
call dword [eax + 0x10]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x10]
call fcn.00438899
call fcn.004ff804
ret 4

Function at 0x43eaae
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
mov eax, dword [0x5675c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x43ebc2
test esi, esi
je 0x43ebc2
lea eax, [ebp - 0x4bc]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x43ebba
xor eax, eax
mov dword [ebp - 0x4c0], eax
cmp word [ebp - 0x4bc], ax
je 0x43ebba
lea ebx, [ebp - 0x4bc]
mov dword [ebp - 0x4c4], eax
push 0x51b318
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43eb90
push 0x51b320
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x43eb90
mov ax, word [ebx]
mov word [ebp - 0xc], ax
mov eax, dword [ebp - 0x4c4]
push 0x64
mov ax, word [ebp + eax - 0x4ba]
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x43ebc2
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebp - 0xd4]
push ebx
push eax
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x43ebd5
mov eax, dword [ebp - 0x4c0]
lea ebx, [ebp - 0x4bc]
add eax, 4
mov dword [ebp - 0x4c0], eax
add eax, eax
add ebx, eax
mov dword [ebp - 0x4c4], eax
xor eax, eax
cmp word [ebx], ax
jne 0x43eb15
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ff7f3
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [edi + ebx*2]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
inc eax
jmp 0x43ebc4
Function at 0x43f0b7
Capabilities:
Get process image filename

Disassembly:
push 0x21c
mov eax, 0x505265
call fcn.004ff86f
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test edi, edi
jne 0x43f0d7
xor eax, eax
jmp 0x43f22d
push eax
xor ebx, ebx
xor ecx, ecx
push ebx
push 0x400
mov word [edi], cx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x43f0d0
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
call sub.KERNEL32.dll_K32GetProcessImageFileNameW
test eax, eax
jne 0x43f110
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43f0d0
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.0043eaae
pop ecx
pop ecx
push esi
test eax, eax
je 0x43f108
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0043ef48
push eax
lea ecx, [ebp - 0x220]
call fcn.0043dad9
push edi
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], ebx
call fcn.0043f9ee
mov edi, dword [ebp - 0x220]
push 0x5c
push edi
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
jne 0x43f164
or eax, 0xffffffff
jmp 0x43f168
sub eax, edi
sar eax, 1
inc eax
lea ecx, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0043f6ec
mov eax, dword [0x5699b0]
mov ecx, dword [0x5699ac]
sub eax, ecx
sar eax, 2
mov byte [ebp - 4], 1
mov byte [ebp - 0x219], 1
test eax, eax
je 0x43f203
mov ebx, dword [ebp - 0x224]
xor edi, edi
mov eax, dword [ecx + edi*4]
sub eax, 0x10
push eax
call fcn.0043e806
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x228], esi
push ebx
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 2
call fcn.0043e861
neg eax
mov byte [ebp - 4], 1
lea ecx, [esi - 0x10]
sbb al, al
and byte [ebp - 0x219], al
call fcn.0043f97e
mov eax, dword [0x5699b0]
inc edi
mov ecx, dword [0x5699ac]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x43f1a3
cmp byte [ebp - 0x219], 0
mov edi, dword [ebp - 0x220]
je 0x43f21a
lea eax, [ebp - 0x224]
mov ecx, 0x5699ac
push eax
call fcn.0044014b
mov ebx, dword [ebp - 0x224]
lea ecx, [ebx - 0x10]
call fcn.0043f97e
lea ecx, [edi - 0x10]
call fcn.0043f97e
xor eax, eax
inc eax
call fcn.004ff819
ret
Function at 0x43f440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x8c
mov eax, 0x505298
call fcn.004ff86f
push 4
call fcn.004567c0
lea eax, [ebp - 0x94]
push eax
call fcn.0044f960
pop ecx
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0044fcf0
sub eax, 1
je 0x43f583
sub eax, 1
je 0x43f560
sub eax, 1
je 0x43f52d
sub eax, 1
jne 0x43f5bb
push 0x51b2a0
lea ecx, [ebp - 0x94]
call fcn.0044b550
lea ecx, [ebp - 0x94]
call fcn.0044bc50
push eax
call fcn.00456770
mov dword [esp], str.ZIPRES
push str.IDR_ZIPRES
call fcn.0044fcd0
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x43f5bb
push esi
call fcn.0044fcd0
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x43f521
push esi
call fcn.0044fcd0
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x43f521
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.004567d0
add esp, 0xc
push ebx
push ecx
mov eax, esp
mov dword [eax], str.res.xml
call fcn.0043efff
mov ecx, eax
call fcn.0045def0
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x43f5bb
push 0x51b2a0
lea ecx, [ebp - 0x94]
call fcn.0044b550
lea ecx, [ebp - 0x94]
call fcn.0044bc50
push eax
call fcn.00456770
mov dword [esp], 0x51b2c0
push ecx
mov eax, esp
mov dword [eax], str.IDR_RES
jmp 0x43f5af
lea ecx, [ebp - 0x94]
call fcn.0044bc50
push eax
call fcn.00456770
push ebx
push 1
push str.HYGame.zip
call fcn.00456870
add esp, 0x10
jmp 0x43f5a5
push 0x51b2a0
lea ecx, [ebp - 0x94]
call fcn.0044b550
lea ecx, [ebp - 0x94]
call fcn.0044bc50
push eax
call fcn.00456770
pop ecx
push ebx
push ecx
mov eax, esp
mov dword [eax], str.res.xml
call fcn.0043efff
mov ecx, eax
call fcn.0045def0
lea ecx, [ebp - 0x94]
call fcn.0044af90
call fcn.004ff819
ret
Function at 0x43fe70
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x5675c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x358]
push eax
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__findfirst64i32]
mov esi, eax
pop ecx
pop ecx
cmp esi, 0xffffffff
jne 0x43ffb8
push 0
call fcn.004401a4
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004ff7f3
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
call fcn.00440119
pop ecx
test al, al
jne 0x43ffb8
push dword [ebp - 0x230]
call fcn.004400fb
add esp, 4
test al, al
lea eax, [ebp - 0x108]
je 0x43ff53
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.00440092
lea eax, [ebp - 0x108]
push eax
call fcn.0043fe70
lea eax, [ebp - 0x108]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add eax, 0xfffffffe
add esp, 0x14
cmp eax, 0x104
jae 0x43ffdc
cmp dword [ebp - 0x230], 0x14
mov byte [ebp + eax - 0x108], 0
jne 0x43ff3c
push str.This_is_system_file__cant_delete__n
call fcn.0043d606
jmp 0x43ffb7
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__rmdir]
pop ecx
cmp eax, 0xffffffff
jne 0x43ffb8
push 0
jmp 0x43ffb2
push edi
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
lea eax, [ebp - 0x108]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 0x10
mov ecx, 0x104
dec eax
cmp eax, ecx
jae 0x43ffdc
mov byte [ebp + eax - 0x108], 0
lea eax, [ebp - 0x20c]
push eax
push ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 0x10
cmp eax, 0xffffffff
jne 0x43ffb8
lea eax, [ebp - 0x20c]
push eax
call fcn.004401a4
pop ecx
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__findnext64i32]
pop ecx
pop ecx
test eax, eax
je 0x43febb
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__findclose]
jmp 0x43feaa
call fcn.004ff601
int3