joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4327b0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x5080f4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x25c]
mov dword [0x5133e0], eax
mov eax, dword [ebp - 0x244]
mov dword [0x513260], eax
mov eax, dword [ebp - 0x254]
mov dword [0x508bb0], eax
mov eax, dword [ebp - 0x24c]
push 0x118
mov dword [0x508bb8], eax
lea eax, [ebp - 0x11c]
push 0
push eax
mov dword [0x508bb4], 0
call fcn.004a08b0
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x43284e
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
mov esi, dword [0x513388]
test esi, esi
jne 0x43287c
push str.RtlGetVersion
push str.NTDLL.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x513388], esi
test esi, esi
je 0x4328c6
push 0x118
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.004a08b0
add esp, 0xc
mov dword [ebp - 0x23c], 0x11c
lea eax, [ebp - 0x23c]
mov ecx, esi
push eax
call dword [0x4d9444]
call esi
test eax, eax
jne 0x4328c6
push edi
mov ecx, 0x47
lea esi, [ebp - 0x23c]
lea edi, [ebp - 0x120]
rep movsd dword es:[edi], dword [esi]
pop edi
cmp dword [ebp - 0x110], 2
pop esi
jne 0x432a53
mov ecx, dword [ebp - 0x11c]
mov eax, 0xa
cmp ecx, 5
jb 0x432aa8
mov eax, 0xb
cmp ecx, 6
jb 0x432a43
mov eax, 0xd
cmp ecx, 7
jb 0x432a0b
mov eax, 0x11
cmp ecx, 0xb
jae 0x432925
cmp ecx, 0xa
jb 0x432aa8
mov ecx, dword [ebp - 0x114]
cmp ecx, 0x55f0
jb 0x43292f
mov eax, 0x1e
jmp 0x432aa8
cmp ecx, 0x4a64
jb 0x432941
mov eax, 0x1d
jmp 0x432aa8
cmp ecx, 0x4a63
jb 0x432953
mov eax, 0x1c
jmp 0x432aa8
cmp ecx, 0x4a62
jb 0x432965
mov eax, 0x1b
jmp 0x432aa8
cmp ecx, 0x4a38
jb 0x432977
mov eax, 0x1a
jmp 0x432aa8
cmp ecx, 0x47bb
jb 0x432989
mov eax, 0x19
jmp 0x432aa8
cmp ecx, 0x4650
jb 0x43299b
mov eax, 0x18
jmp 0x432aa8
cmp ecx, 0x44c0
jb 0x4329ad
mov eax, 0x17
jmp 0x432aa8
cmp ecx, 0x4268
jb 0x4329bf
mov eax, 0x16
jmp 0x432aa8
cmp ecx, 0x3e80
jb 0x4329d1
mov eax, 0x15
jmp 0x432aa8
cmp ecx, 0x3a98
jb 0x4329e3
mov eax, 0x14
jmp 0x432aa8
cmp ecx, 0x36b0
jb 0x4329f5
mov eax, 0x13
jmp 0x432aa8
cmp ecx, 0x295a
jb 0x432aa8
mov eax, 0x12
jmp 0x432aa8
mov ecx, dword [ebp - 0x118]
cmp ecx, 1
jb 0x432aa8
mov eax, 0xe
cmp ecx, 2
jb 0x432aa8
mov eax, 0xf
cmp ecx, 3
jb 0x432aa8
mov eax, 0x10
cmp ecx, 4
jb 0x432aa8
mov eax, 0x11
jmp 0x432aa8
cmp dword [ebp - 0x118], 1
jb 0x432aa8
mov eax, 0xc
jmp 0x432aa8
cmp dword [ebp - 0x11c], 4
jne 0x432aa6
mov ecx, dword [ebp - 0x118]
mov eax, 1
test ecx, ecx
jne 0x432a80
mov ecx, 0x457
cmp word [ebp - 0x114], cx
jb 0x432aa8
mov eax, 2
jmp 0x432aa8
cmp ecx, 0x5a
jae 0x432a9f
mov ecx, 0x8ae
mov eax, 3
cmp word [ebp - 0x114], cx
jb 0x432aa8
mov eax, 4
jmp 0x432aa8
mov eax, 5
jmp 0x432aa8
xor eax, eax
mov ecx, dword [ebp - 4]
mov dword [0x5133e4], eax
xor ecx, ebp
xor eax, eax
call fcn.00484d55
mov esp, ebp
pop ebp
ret
Function at 0x436030
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1430
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x5080f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], edx
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x436067
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43619f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4360bf
cmp dword [esi + 0x14], 8
jb 0x43608c
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4360a0
test al, 0x10
jne 0x43619f
push 0xb7
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x4360ab
xor eax, eax
mov edi, dword [esi + 0x14]
mov ecx, esi
mov ebx, dword [esi + 0x10]
cmp edi, 8
jb 0x4360d5
mov ecx, dword [esi]
push dword [ebp - 0x14]
inc eax
mov edx, ebx
push 2
push 0x4eb8d4
push eax
call fcn.0040d310
add esp, 0x10
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x43614d
mov dword [ebp - 0x2c], 0
inc eax
mov dword [ebp - 0x1c], 0
cmp ebx, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
cmovb eax, ebx
cmp edi, 8
jb 0x43611e
mov ecx, dword [esi]
push eax
push ecx
lea ecx, [ebp - 0x2c]
call fcn.004123e0
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push dword [ebp - 0x10]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 0x2c]
call fcn.004127e0
mov eax, dword [ebp - 0x14]
jmp 0x4360c6
mov eax, esi
cmp edi, 8
jb 0x436156
mov eax, dword [esi]
push dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43619f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0x14], 8
mov edi, eax
jb 0x436174
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436184
test al, 0x10
jne 0x43619f
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4361c0
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1450
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5080f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x436202
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x43620c
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436276
test al, 0x10
je 0x436276
xor edi, edi
mov ebx, 0x80
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x43622d
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436253
and eax, 0x3126
mov ecx, esi
cmove eax, ebx
cmp dword [esi + 0x14], 8
jb 0x43624b
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x43625d
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x436276
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 1
jl 0x436223
cmp dword [esi + 0x14], 8
jb 0x43627e
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436292
test al, 0x10
jne 0x4361ee
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4362b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d14a0
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x5080f4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x2c], 0
xor eax, eax
mov dword [ebp - 0x1c], 0
push eax
push 0x104
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], al
call fcn.004344f0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
push dword [ebp - 0x1c]
cmovae eax, dword [ebp - 0x2c]
push eax
push str._TMP_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, eax
test ecx, ecx
je 0x4365b8
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
ja 0x4365b8
dec ecx
cmp ecx, eax
ja 0x43636a
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x1c], ecx
cmovae eax, dword [ebp - 0x2c]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x436377
sub ecx, eax
push 0
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00411a90
lea eax, [ebp - 0x2c]
push eax
call fcn.00436610
movups xmm0, xmmword [ebp - 0x2c]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x1c]
movq qword [esi + 0x10], xmm0
xor eax, eax
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.004127e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00484d55
mov esp, ebp
pop ebp
ret
push str.Unable_to_expand__TMP__environment_variable_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x60]
call fcn.0043e110
push 0x5057bc
lea eax, [ebp - 0x60]
push eax
call fcn.004a0209
push str.Unable_to_expand__TEMP__environment_variable_
push 0x4eba9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x74]
call fcn.0041b400
push 0x5057bc
lea eax, [ebp - 0x74]
push eax
call fcn.004a0209
int3
Function at 0x4366d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1507
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
push edi
mov eax, dword [0x5080f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], edx
mov esi, ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
mov dword [esi], 0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea edi, [eax + 1]
cmp dword [ecx + 0x14], 8
mov eax, ecx
jb 0x43673b
mov eax, dword [ecx]
mov dword [ebp - 0x24], eax
call fcn.0043aca0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
mov eax, ecx
mov dword [ebp - 0x44], edx
cmp dword [ecx + 0x14], 8
jb 0x436756
mov eax, dword [ecx]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, ecx
cmp dword [ecx + 0x14], 8
jb 0x436766
mov eax, dword [ecx]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x40], 0
xor eax, eax
mov byte [ebp - 4], 2
mov word [ebp - 0x40], ax
lea ecx, [ebp - 0x40]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], 0
push eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x2c], 7
push eax
lea eax, [ebp - 0x28]
or edi, 2
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x20], edi
push eax
call fcn.00438e10
lea eax, [ebp - 0x40]
add esp, 0x10
cmp esi, eax
je 0x4367e3
mov ecx, esi
call fcn.004127e0
movups xmm0, xmmword [ebp - 0x40]
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x30]
movq qword [esi + 0x10], xmm0
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0
and edi, 0xfffffffd
call fcn.004127e0
cmp dword [esi + 0x10], 0
mov eax, esi
je 0x43683c
cmp dword [esi + 0x14], 8
jb 0x436802
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436819
mov ecx, dword [ebp - 0x10]
test al, 0x10
je 0x436731
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x436823
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x43683a
mov ecx, dword [ebp - 0x10]
test al, 0x10
jne 0x436731
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x436850
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
mov bh, 1
mov esi, edx
push edi
mov edi, ecx
mov bl, bh
nop dword [eax + eax]
test bl, bl
je 0x4368a0
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x43686e
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov bl, 1
cmp eax, 0xffffffff
je 0x4368a0
and eax, 0x3126
mov ecx, 0x80
cmove eax, ecx
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x436893
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
sete bl
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x4368aa
mov ecx, dword [esi]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4368b4
mov eax, dword [edi]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4368f3
add bh, 0xff
je 0x4368ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4368dc
cmp eax, 0x20
mov eax, 0x14
jne 0x4368e1
mov eax, 0xc8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x436860
pop edi
pop esi
xor al, al
pop ebx
ret
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4368fd
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436926
and eax, 0x3126
mov ecx, 0x80
cmove eax, ecx
cmp dword [esi + 0x14], 8
jb 0x43691e
mov esi, dword [esi]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop edi
pop esi
mov al, 1
pop ebx
ret

Function at 0x436b60
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov bl, 1
nop word [eax + eax]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x436b7a
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436bd0
test al, 0x10
jne 0x436bd0
test bl, bl
je 0x436bd0
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x436b98
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x436bab
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x436bc8
add bl, 0xff
je 0x436b70
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x436b70
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439af0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5080f4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 0x18]
lea eax, [ebp - 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push eax
push edi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x439b80
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x14], ecx
mov ecx, eax
mov edx, dword [esi + 0x14]
mov dword [esi + 0x10], eax
or eax, edx
je 0x439b62
push 0
push ecx
push edx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
mov eax, dword [esi + 8]
test eax, eax
je 0x439b5b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], edi
test edi, edi
je 0x439ba2
mov ecx, dword [ebp - 8]
pop edi
mov dword [esi + 0x18], 2
xor ecx, ebp
mov byte [esi + 4], 1
pop esi
pop ebx
call fcn.00484d55
mov esp, ebp
pop ebp
ret 0x14
push str.Unable_to_get_file_size_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x28]
call fcn.0043e0b0
push 0x5057bc
lea eax, [ebp - 0x28]
push eax
call fcn.004a0209
push str.Unable_to_create_file_mapping_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x28]
call fcn.0043e0b0
push 0x5057bc
lea eax, [ebp - 0x28]
push eax
call fcn.004a0209
int3
Function at 0x43aa80
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi
Get disk size
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x5080f4]
xor eax, ebp
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x1b4]
call fcn.0043dd90
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 8
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x1b4]
call fcn.0043dde0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 4
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1b4]
call fcn.0043dde0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 4
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1b4]
call fcn.0043dde0
push 0x3c
lea eax, [ebp - 0x88]
mov dword [ebp - 0x8c], 0x40
push 0
push eax
call fcn.004a08b0
add esp, 0x10
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x43ab49
push 8
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x1b4]
call fcn.0043dde0
push 8
lea edx, [ebp - 0x6c]
lea ecx, [ebp - 0x1b4]
call fcn.0043dde0
add esp, 8
push 0
push 0
lea eax, [ebp - 0x44]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x43ab70
push 8
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x1b4]
call fcn.0043dde0
add esp, 4
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimes]
test eax, eax
je 0x43abe9
push 4
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x1b4]
call fcn.0043dde0
push 4
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x1b4]
call fcn.0043dde0
push 4
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x1b4]
call fcn.0043dde0
push 4
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x1b4]
call fcn.0043dde0
push 4
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x1b4]
call fcn.0043dde0
push 4
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x1b4]
call fcn.0043dde0
add esp, 0x18
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x43ac0a
push 8
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x1b4]
call fcn.0043dde0
add esp, 4
rdtsc
mov dword [ebp - 0x10], edx
lea ecx, [ebp - 0x1b4]
push 8
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
call fcn.0043dde0
add esp, 4
lea eax, [ebp - 0x18]
push 0xf0000040
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x43ac7a
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push 8
push dword [ebp - 0x18]
movlpd qword [ebp - 0x14], xmm0
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x43ac6f
push 8
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x1b4]
call fcn.0043dde0
add esp, 4
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x1b4]
call fcn.0043de40
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor ecx, ebp
call fcn.00484d55
mov esp, ebp
pop ebp
ret
Function at 0x43c430
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d1c6d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5080f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x14], esi
push 0x10000
mov dword [ebp - 0x14], esi
call fcn.00485139
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
push 0x8000
push edi
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x43c4e2
cmp eax, 0x8000
ja 0x43c4e2
mov dword [esi], 0
xor ecx, ecx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
push eax
mov word [esi], cx
mov byte [ebp - 4], cl
mov ecx, esi
push edi
call fcn.004123e0
push edi
call fcn.00485360
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00484d55
mov esp, ebp
pop ebp
ret
push ebx
push str.Unable_to_retrieve_environment_variable__ls_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041bc90
push 0x5057bc
lea eax, [ebp - 0x28]
push eax
call fcn.004a0209
int3
Function at 0x43dc20
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x28], ebx
push edi
lea eax, [ebx + 0x2c]
mov ebx, 0x30
mov edx, dword [eax + 0x34]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov edi, edx
mov ecx, edx
rol edi, 0xf
rol ecx, 0xd
xor edi, ecx
shr edx, 0xa
xor edi, edx
mov ecx, esi
mov edx, esi
ror ecx, 7
rol edx, 0xe
xor edx, ecx
shr esi, 3
xor edx, esi
add edi, edx
add edi, dword [eax + 0x1c]
add edi, dword [eax - 8]
mov dword [eax + 0x38], edi
sub ebx, 1
jne 0x43dc36
mov ebx, dword [ebp - 0x28]
mov edx, 0x4ec6d0
mov dword [ebp - 0x24], edx
mov eax, dword [ebx + 8]
mov edi, eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebx + 0x28]
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov esi, ebx
mov eax, ebx
rol eax, 7
mov ecx, ebx
ror esi, 0xb
not ecx
and ecx, dword [ebp - 0xc]
xor esi, eax
mov eax, ebx
ror eax, 6
xor esi, eax
mov eax, dword [ebp - 8]
and eax, ebx
xor ecx, eax
mov eax, dword [ebp - 0x14]
add esi, ecx
add dword [ebp - 0x14], 4
add esi, dword [eax]
mov eax, edi
add esi, dword [edx]
mov edx, edi
add esi, dword [ebp - 0x20]
rol eax, 0xa
ror edx, 0xd
xor edx, eax
mov eax, edi
ror eax, 2
xor edx, eax
mov eax, dword [ebp - 0x10]
mov ecx, eax
and eax, edi
xor ecx, edi
and ecx, dword [ebp - 4]
xor ecx, eax
mov eax, dword [ebp - 0xc]
add edx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov ecx, edi
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x18]
lea edi, [edx + esi]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x24]
add ebx, esi
mov eax, dword [ebp - 4]
add edx, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], edx
cmp edx, str._b86362a5.exe
jl 0x43dcb7
mov eax, dword [ebp - 0x2c]
add eax, edi
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x28]
pop edi
pop esi
add dword [ebx + 0xc], ecx
mov dword [ebx + 8], eax
mov eax, dword [ebp - 4]
add dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x18]
add dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x1c]
add dword [ebx + 0x18], eax
mov eax, dword [ebp - 8]
add dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0xc]
add dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x20]
add dword [ebx + 0x24], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43dd90
Capabilities:
Hash data using sha256

Disassembly:
mov edx, ecx
xor eax, eax
push edi
mov ecx, 0x40
lea edi, [edx + 0x28]
rep stosd dword es:[edi], eax
mov dword [edx + 4], eax
mov dword [edx], eax
mov dword [edx + 8], 0x6a09e667
mov dword [edx + 0xc], 0xbb67ae85
mov dword [edx + 0x10], 0x3c6ef372
mov dword [edx + 0x14], 0xa54ff53a
mov dword [edx + 0x18], 0x510e527f
mov dword [edx + 0x1c], 0x9b05688c
mov dword [edx + 0x20], 0x1f83d9ab
mov dword [edx + 0x24], 0x5be0cd19
pop edi
ret
Function at 0x448e80
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.00475dd0

Function at 0x448e90
Capabilities:
Get process heap force flags
Read http header

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.00475b40

Function at 0x448ea0
Capabilities:
Check http status code
Get process heap flags
Get process heap force flags
Read http header

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.00476030

Function at 0x448ff0
Capabilities:
Get process heap force flags
Read http header

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.00476340