joyce8/EMBER2024-capa huggingface dataset:
Function at 0x587620
Capabilities:
Encode data using base64
Terminate process

Disassembly:
sub esp, 0x118
mov ecx, 0x3f
mov eax, 0x80808080
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x41
mov cl, al
sub cl, 0x41
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 0x5a
jle 0x587642
mov eax, 0x61
mov dl, al
sub dl, 0x47
mov byte [esp + eax + 0x28], dl
inc eax
cmp eax, 0x7a
jle 0x587656
mov eax, 0x30
mov cl, al
add cl, 4
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 0x39
jle 0x58766a
mov edi, dword [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x53], 0x3e
mov byte [esp + 0x57], 0x3f
mov byte [esp + 0x65], 0
mov dword [esp + 0x18], ebp
je 0x5877fd
mov ebx, dword [esp + 0x130]
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 4
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x12c]
xor eax, eax
lea esi, [edx + ecx]
movsx ecx, byte [esi + eax]
mov dl, byte [esp + ecx + 0x28]
test dl, 0x80
jne 0x5877ce
mov byte [esp + eax + 0x20], cl
mov byte [esp + eax + 0x1c], dl
inc eax
cmp eax, 4
jl 0x5876cc
mov esi, dword [esp + 0x138]
mov edx, dword [esp + 0x10]
cmp edx, dword [esi]
jle 0x587736
mov eax, dword [esp + 0x14]
push eax
call fcn.005a5f07
mov ecx, dword [esi]
mov esi, ebx
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
mov dword [esp + 0x2c], eax
rep movsb byte es:[edi], byte [esi]
call fcn.005a5e1e
mov ecx, dword [esp + 0x140]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x2c]
add esp, 8
mov dword [ecx], eax
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov dl, ch
mov al, cl
sar dl, 4
shl al, 2
or dl, al
mov eax, dword [esp + 0x14]
mov byte [ebx + ebp], dl
inc ebp
inc eax
mov cl, ch
mov dword [esp + 0x14], eax
mov al, byte [esp + 0x1e]
mov dl, al
inc edi
sar dl, 2
shl cl, 4
or dl, cl
mov ecx, dword [esp + 0x14]
shl al, 6
or al, byte [esp + 0x1f]
mov byte [ebx + ebp], dl
inc ebp
mov edx, edi
inc ecx
inc edx
mov byte [ebx + ebp], al
mov al, byte [esp + 0x22]
inc ebp
inc ecx
inc edx
mov dword [esp + 0x10], edi
cmp al, 0x3d
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
je 0x5877e3
mov cl, byte [esp + 0x23]
xor eax, eax
cmp cl, 0x3d
setne al
add eax, 2
cmp eax, 3
jl 0x5877e3
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
add edx, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], edx
cmp edx, ecx
jae 0x587804
jmp 0x5876bc
push ecx
push str.Illegal_character__c_in_input._n
call fcn.005a7b2d
add esp, 8
push 1
call fcn.005a7cfe
mov eax, dword [esp + 0x134]
mov byte [ebx + ebp], 0
pop edi
pop esi
mov dword [eax], ebp
mov eax, ebx
pop ebp
pop ebx
add esp, 0x118
ret
mov ebx, dword [esp + 0x130]
mov ecx, dword [esp + 0x134]
mov byte [ebx + ebp], 0
pop edi
pop esi
mov dword [ecx], ebp
mov eax, ebx
pop ebp
pop ebx
add esp, 0x118
ret
Function at 0x5888a0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x588943
test eax, eax
jbe 0x588943
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x588943
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x5888ee
xor esi, esi
jmp 0x5888f4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x58891f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0058a7f0
add esi, eax
push esi
mov ebx, esi
call fcn.0058a7f0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x588900
pop ebp
test edi, edi
pop edi
jne 0x588943
test ebx, ebx
je 0x588943
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.005a5d20
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x588a65
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x588b7d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x588b7d
mov eax, dword [esi + 0x3c]
push eax
call fcn.005b7b7f
mov esi, eax
test esi, esi
je 0x588b7d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x588b7d
mov ecx, esi
call fcn.005889f0
cmp edi, eax
jge 0x588b7d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x588b03
mov dword [esp + 0x34], 1
jmp 0x588b5e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x588b7d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00587ff0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x58b820
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x6e8014]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x58b833
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x58b874
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x6e80bc]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x58b8a6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x58b8aa
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x58b89b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x58b8c8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x58b8cc
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x58b8bd
xor ecx, ecx
mov eax, 0x6e8024
xor ebx, ebx
mov bl, byte [ecx + 0x6e80cc]
cmp byte [esp + ebx + 0x14], 0
je 0x58b8f7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x6e80e4]
cmp byte [esp + ebx + 0x14], 0
je 0x58b90e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x58b8de
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x58b867
lea edx, [esp + 0x84]
push edx
call fcn.0058b950
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x5900d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x724fd4]
xor edx, edx
cmp eax, edx
jne 0x5900f6
xor eax, eax
mov byte [eax + 0x724ed4], al
inc eax
cmp eax, 0x100
jl 0x5900de
mov dword [0x724fd4], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x724ed4
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x590187
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x59015a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x590128
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x590190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x5901e3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x5901ca
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x596b60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c522e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00597480
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x6c9fbc
call fcn.005b5e93
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x596bf3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005b5e93
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x596bec
push 0
mov ecx, eax
call fcn.0058dd00
mov dword [esi + 0xc], eax
jmp 0x596bf5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x596bf5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x5b8523
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5b855b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005b65ad
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005b6585
jmp 0x5b8567
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5b9c11
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5b9c53
call fcn.005bf712
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5b9c53
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5b9c4a
xor eax, eax
jmp 0x5b9c5b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005b9c61
pop edi
pop esi
pop ebx
ret 4

Function at 0x5bfc42
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5bfc70
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5bfc8e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005bfba8
jmp 0x5bfc8e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5bfc8e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005bfba8
test edi, edi
mov eax, edi
jne 0x5bfc78
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x415ce0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x18
mov eax, 0x584f40
call fcn.0053d79c
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
mov byte [ebp - 0x11], 0
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.004b9e31
test eax, eax
pop ecx
je 0x415d16
push eax
mov byte [ebp - 0x11], bl
call dword [sym.imp.USER32.dll_CloseDesktop]
call fcn.0046d0c4
mov ecx, dword [0x6b2efc]
push ebx
lea esi, [ebp - 0x24]
mov edi, eax
call fcn.0048b6fc
cmp dword [ebp - 0x24], 0
je 0x415d38
cmp byte [ebp - 0x20], 0
jne 0x415d86
call fcn.0046bdbe
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
sete byte [ebp - 0x12]
test byte [0x6d2b94], bl
jne 0x415d65
or dword [0x6d2b94], ebx
mov byte [ebp - 4], 2
call esi
mov dword [0x6d2b90], eax
mov byte [ebp - 4], bl
call esi
mov esi, eax
sub eax, dword [0x6d2b90]
cmp eax, 0x3e8
jbe 0x415d89
push dword [ebp + 8]
call fcn.00415dc2
mov dword [0x6d2b90], esi
jmp 0x415d89
mov byte [ebp - 0x12], bl
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
setne al
cmp byte [ebp - 0x11], 0
je 0x415da9
cmp byte [ebp - 0x12], 0
jne 0x415dab
test al, al
jne 0x415dab
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x1c]
push eax
call fcn.00405946
mov al, bl
call fcn.0053d874
ret 4
Function at 0x41efbe
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xbc
mov eax, 0x584ad2
call fcn.0053d79c
mov esi, ecx
mov eax, dword [esi + 0x188]
xor ebx, ebx
cmp dword [eax + 0x14], 8
mov byte [ebp - 0xd], bl
jg 0x41efe6
push esi
call fcn.0040459b
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x696774]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.0041ed12
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x41f131
push esi
call fcn.0041f27f
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
cmp eax, dword [esi + 0x128]
jl 0x41f089
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
cmp eax, dword [esi + 0x12c]
jl 0x41f089
call edi
mov dword [esi + 0x114], eax
call edi
sub eax, dword [ebp - 0x14]
mov ecx, 0x96
mov dword [esi + 0x154], eax
cdq
sub eax, edx
sar eax, 1
cmp eax, ecx
mov edx, eax
jl 0x41f073
mov edx, ecx
cmp edx, 0x28
jge 0x41f07d
push 0x28
pop eax
jmp 0x41f083
cmp eax, ecx
jl 0x41f083
mov eax, ecx
mov dword [esi + 0x150], eax
cmp byte [ebp - 0xd], bl
je 0x41f131
cmp dword [esi + 0x1b0], ebx
jne 0x41f131
call edi
sub eax, dword [ebp - 0x14]
mov ecx, 0x1388
mov dword [esi + 0x118], eax
add eax, 0xc8
imul eax, eax, 5
cmp eax, ecx
jle 0x41f0bc
mov eax, ecx
mov dword [esi + 0x158], eax
lea eax, [ebp - 0xc8]
push eax
call fcn.004208dd
mov dword [ebp - 4], ebx
push dword [esi + 0x118]
lea esi, [eax + 8]
push ecx
push str.first_fullscreen_grab_time_in_ms_
push 0x423f0d
call fcn.004201e3
push eax
call fcn.00410b84
add esp, 0xc
push eax
call fcn.00410520
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00463646
pop ecx
pop ecx
mov byte [ebp - 4], 1
push eax
call fcn.00421d59
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.0041382c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.00420973
lea ecx, [ebp - 0x74]
call fcn.00414b24
mov al, byte [ebp - 0xd]
call fcn.0053d874
ret
Function at 0x43377e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56699c
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x67d978]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x67d978]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov esi, ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00433872
and dword [esp + 0x38], 0
lea eax, [esp + 0xc]
push eax
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00433814
or dword [esp + 0x38], 0xffffffff
push 0
push 1
lea ecx, [esp + 0x14]
call fcn.0041382c
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00536476
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x433aeb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, dword [0x689424]
push esi
push edi
xor edi, edi
push edi
push edi
push 1
push edi
mov esi, eax
call ebx
cmp eax, edi
mov dword [esp + 0x10], eax
mov dword [esi + 4], eax
jne 0x433b4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov dword [esp + 0x18], edi
call fcn.00524420
neg edi
sbb edi, edi
test edi, fcn.00491f48
mov dword [esp + 0x1c], eax
je 0x433b4b
lea eax, [esp + 0x18]
push eax
mov ecx, str.thread.entry_event
call fcn.00412152
xor edi, edi
push edi
push edi
push 1
push edi
call ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 8], eax
mov dword [esi + 8], eax
cmp dword [ebx + 8], edi
jne 0x433b99
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov dword [esp + 0x18], edi
call fcn.00524420
neg edi
sbb edi, edi
test edi, fcn.00491f48
mov dword [esp + 0x1c], eax
je 0x433b97
lea eax, [esp + 0x18]
push eax
mov ecx, str.thread.exit_event
jmp 0x433b46
xor edi, edi
lea eax, [esp + 0x14]
push eax
push edi
push esi
push 0x433c3d
push dword [ebp + 0xc]
mov dword [esp + 0x28], edi
push edi
call fcn.0053703b
add esp, 0x18
cmp eax, edi
mov dword [ebx + 4], eax
jne 0x433c18
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
cmp dword [esp + 0x10], edi
je 0x433bde
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebx + 8]
cmp ebx, edi
je 0x433bec
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x18], esi
call fcn.00524420
neg esi
sbb esi, esi
test esi, fcn.00491f48
mov dword [esp + 0x1c], eax
je 0x433c18
lea eax, [esp + 0x18]
push eax
mov ecx, str.thread
jmp 0x433b46
cmp dword [esp + 0x10], edi
je 0x433c34
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x433e8c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
push 0xffffffffffffffff
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x6d247c
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test eax, eax
push 0
push dword [esi + 4]
je 0x433ed4
call dword [sym.imp.KERNEL32.dll_TerminateThread]
leave
ret
push method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_52
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
push 0xffffffffffffffff
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
leave
ret
Function at 0x43b497
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x43b4d2

Function at 0x43b643
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebx
adc cl, byte [ebx - 0x24ccefbb]
cmp eax, ebx
je 0x43bc50
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.0043b457
or byte [esi - 0x48f0b93d], 0x47
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.0043b457
pop edi
fnsave dword [ebx + 0x478b66ec]
push es
cmp ax, bx
jbe 0x43b6b1
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x43b6ab
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x43b69c
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0043b457
dec ebx
lodsd eax, dword [esi]
add eax, 0xa8458d4d
push eax
call fcn.0043b467
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0043b41c
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x43b745
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0043b457
call 0x8d4b5204
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret