joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425120
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, ecx
mov cl, byte [eax + 0xcc49]
mov byte [ebp + 0x14a5], cl
mov dl, byte [eax + 0xcc4a]
mov byte [ebp + 0x14a4], dl
mov ecx, dword [eax + 0xca94]
push esi
mov dword [ebp + 0x14a0], ecx
mov edx, dword [eax + 0x4c00]
push edi
add eax, 0xcaa0
push eax
lea ecx, [ebp + 0x63c8]
mov dword [ebp + 0x60a8], edx
call fcn.0040daa0
mov ecx, dword [ebp + 0x20]
cmp ecx, 0x400000
jae 0x4251d3
mov edx, dword [ebp + 0x14a0]
cmp edx, ecx
jae 0x4251a4
mov esi, 0x400000
mov eax, edx
sub esi, ecx
lea esp, [esp]
mov ecx, dword [ebp]
lea edx, [ecx + esi]
mov dl, byte [edx + eax]
mov byte [ecx + eax], dl
inc eax
cmp eax, dword [ebp + 0x20]
jb 0x425190
jmp 0x4251d3
sub edx, ecx
xor eax, eax
mov esi, edx
test ecx, ecx
jbe 0x4251c2
mov edi, edi
mov ecx, dword [ebp]
lea edx, [ecx + esi]
mov dl, byte [edx + eax]
mov byte [ecx + eax], dl
inc eax
cmp eax, dword [ebp + 0x20]
jb 0x4251b0
mov dword [ebp + 0x14a0], 0
mov byte [ebp + 0x14a5], 1
mov esi, dword [ebp]
mov edi, dword [ebp + 0x20]
add edi, esi
cmp dword [esp + 0x18], 0
mov ecx, 0x44
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, dword [ebp + 0x14a0]
lea eax, [ebx + 1]
jne 0x425249
mov esi, dword [ebp + 0x24]
and eax, esi
xor edx, edx
mov dword [ebp + 0x14a0], eax
cmp eax, ebx
je 0x425272
mov ecx, dword [ebp]
movzx ecx, byte [eax + ecx + 2]
shl edx, 5
xor ecx, edx
mov edx, dword [ebp + 0x10]
and ecx, 0x7fff
lea edi, [edx + ecx*4]
mov edx, dword [edi]
mov dword [edi], eax
mov eax, dword [ebp + 0x14a0]
and edx, esi
mov esi, dword [ebp + 0x14]
mov dword [esi + eax*4], edx
mov eax, dword [ebp + 0x14a0]
mov esi, dword [ebp + 0x24]
inc eax
and eax, esi
mov edx, ecx
mov dword [ebp + 0x14a0], eax
cmp eax, ebx
jne 0x425204
jmp 0x425272
and eax, dword [ebp + 0x24]
mov dword [ebp + 0x14a0], eax
cmp eax, ebx
je 0x425272
push eax
mov ecx, ebp
call fcn.00422670
mov eax, dword [ebp + 0x14a0]
inc eax
and eax, dword [ebp + 0x24]
mov dword [ebp + 0x14a0], eax
cmp eax, ebx
jne 0x425256
mov esi, dword [esp + 0x14]
push 0x4bf0
add esi, 0x10
lea ecx, [ebp + 0x14b4]
push esi
push ecx
mov byte [ebp + 0x60a4], 0
call fcn.00441bb0
add esp, 0xc
mov ecx, esi
call fcn.00439db0
lea ecx, [ebp + 0xda8]
call fcn.00427910
pop edi
xor eax, eax
pop esi
mov dword [ebp + 0x974], eax
mov dword [ebp + 0x978], eax
mov byte [ebp + 0x97c], 1
pop ebp
pop ebx
ret 8
Function at 0x428f60
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
push 0x1a
push 0
mov byte [esi], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x428fe7
mov edx, dword [esp + 4]
push esi
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x428fe7
cmp byte [esi], 0
je 0x428fe7
push esi
call fcn.00428ea0
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x428fa7
mov ecx, dword [0x450b4c]
mov dword [eax], ecx
mov dx, word [0x450b50]
mov word [eax + 4], dx
mov cl, byte [0x450b52]
push 0
push esi
mov byte [eax + 6], cl
call fcn.0041c3d0
test al, al
jne 0x429013
push 0
push 0
push 0
push esi
call fcn.0041cba0
test eax, eax
je 0x429013
push 0x400
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
call fcn.004289a0
lea edx, [esi + 2]
cmp eax, edx
jb 0x429010
cmp byte [esi + 1], 0x3a
jne 0x42900f
add esi, 4
cmp eax, esi
jb 0x429010
dec eax
mov byte [eax], 0
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
pop esi
add esp, 8
ret 4

Function at 0x429030
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov esi, dword [esp + 0x10]
lea edx, [esp + 4]
push edx
xor ecx, ecx
push 0x1a
push ecx
mov word [esi], cx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4290cd
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4290cd
cmp word [esi], 0
je 0x4290cd
push esi
call fcn.00428590
mov eax, esi
add eax, 0xfffffffe
jmp 0x429080
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x429080
mov ecx, dword [0x450b54]
mov dword [eax], ecx
mov edx, dword [0x450b58]
mov dword [eax + 4], edx
mov ecx, dword [0x450b5c]
mov dword [eax + 8], ecx
mov dx, word [0x450b60]
push esi
push 0
mov word [eax + 0xc], dx
call fcn.0041c3d0
test al, al
jne 0x4290fe
push 0
push 0
push esi
push 0
call fcn.0041cba0
test eax, eax
je 0x4290fe
push 0x400
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call fcn.00428a20
lea ecx, [esi + 4]
cmp eax, ecx
jb 0x4290f9
cmp word [esi + 2], 0x3a
jne 0x4290f6
add esi, 8
cmp eax, esi
jb 0x4290f9
sub eax, 2
xor edx, edx
mov word [eax], dx
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
pop esi
add esp, 8
ret 4
Function at 0x429120
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
push 1
push 0
push 0x450b6c
push 0x80000001
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x429177
lea ecx, [esp + 4]
push ecx
push esi
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [esp + 0x20]
push 0x450b64
push eax
mov dword [esp + 0x1c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esi], 0
je 0x429188
push 0
push esi
call fcn.0041c3d0
test al, al
jne 0x42918e
push esi
call fcn.00428f60
pop esi
add esp, 8
ret 4

Function at 0x4291a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push 1
xor eax, eax
push eax
push str.SoftwareWinRARPaths
push 0x80000001
mov word [esi], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4291f9
mov ecx, dword [esp + 0x10]
lea edx, [esp + 4]
push edx
push esi
lea eax, [esp + 0x10]
push eax
push 0
push str.AppData
push ecx
mov dword [esp + 0x1c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esi], 0
je 0x42920b
push esi
push 0
call fcn.0041c3d0
test al, al
jne 0x429211
push esi
call fcn.00429030
pop esi
add esp, 8
ret 4
Function at 0x432e20
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x1010
call fcn.00442380
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x100c], eax
push ebx
mov ebx, dword [esp + 0x101c]
push ebp
mov ebp, dword [esp + 0x1024]
push esi
mov esi, dword [esp + 0x1020]
cmp ebx, esi
je 0x432e5c
push ebp
push esi
push ebx
call fcn.00437cd0
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SoftwareWinRARGeneral
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x432f59
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432e82
sub eax, edx
sar eax, 1
mov ecx, 0x3ff
sub ecx, eax
add ecx, ecx
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x81c]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0x450d98
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x432f4e
push 0x400
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x820]
push edx
mov word [esp + 0x24], ax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [esp + 0x18]
push eax
call fcn.00428590
push esi
call fcn.00428a20
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x432f00
push edi
lea edi, [esp + 0x1c]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x432f15
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
push 0
call fcn.0041c3d0
pop edi
test al, al
je 0x432f4e
push ebp
lea edx, [esp + 0x1c]
push edx
push ebx
call fcn.00437cd0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1018]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00441a0e
add esp, 0x1010
ret 0xc
Function at 0x433080
Capabilities:
Check os version

Disassembly:
sub esp, 0x918
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x914], eax
push edi
mov edi, ecx
cmp byte [edi], 0
je 0x4330b7
mov eax, dword [0x462608]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [0x462604]
mov dword [0x462608], ecx
mov byte [edi], 0
mov eax, dword [esp + 0x924]
lea edx, [esp + 0x118]
test eax, eax
je 0x4330e1
sub edx, eax
jmp 0x4330d0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4330d0
jmp 0x4330ef
push 0x400
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [esp + 0x11c]
push eax
mov esi, str.rarlng.dll
call fcn.00428a20
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x433102
push 0x400
lea ecx, [esp + 0x120]
push ecx
mov edx, ecx
push edx
call fcn.00432e20
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x18], 2
pop esi
jne 0x433169
mov eax, dword [esp + 8]
cmp eax, 5
ja 0x433155
jne 0x433169
cmp dword [esp + 0xc], 1
jbe 0x433169
push 2
push 0
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x433177
lea edx, [esp + 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x462608], eax
setne al
mov byte [edi], al
test al, al
mov eax, dword [esp + 0x920]
pop edi
mov dword [0x462604], eax
jne 0x433199
mov dword [0x462608], eax
mov ecx, dword [esp + 0x914]
xor ecx, esp
call fcn.00441a0e
add esp, 0x918
ret 8
Function at 0x4331b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
mov ebp, ecx
mov ecx, 8
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
xor ecx, ecx
xor eax, eax
lea esp, [esp]
cmp edi, 0xa
jg 0x43330d
cmp eax, 4
jge 0x433226
mov edi, edi
cmp ecx, 4
jge 0x433229
mov bl, byte [esp + eax*4 + 0x10]
lea edx, [ecx + edi*4]
mov byte [ebp + edx*4 + 0x14], bl
lea edx, [ecx + edi*4]
lea esi, [ebp + edx*4]
movzx edx, byte [esp + eax*4 + 0x11]
mov byte [esi + 0x15], dl
movzx edx, byte [esp + eax*4 + 0x12]
mov byte [esi + 0x16], dl
movzx edx, byte [esp + eax*4 + 0x13]
inc eax
inc ecx
cmp eax, 4
mov byte [esi + 0x17], dl
jl 0x4331f0
cmp ecx, 4
jne 0x43322e
inc edi
xor ecx, ecx
cmp eax, 4
jl 0x4331e0
cmp edi, 0xa
jg 0x43330d
mov edx, 0x467260
movzx esi, byte [esp + 0x1d]
mov al, byte [esp + 0x10]
xor al, byte [esi + 0x467380]
movzx esi, byte [esp + 0x1e]
movzx ebx, byte [esi + 0x467380]
movzx esi, byte [esp + 0x1f]
xor byte [esp + 0x11], bl
movzx ebx, byte [esi + 0x467380]
movzx esi, byte [esp + 0x1c]
xor byte [esp + 0x12], bl
movzx ebx, byte [esi + 0x467380]
xor al, byte [edx]
xor byte [esp + 0x13], bl
mov byte [esp + 0x10], al
inc edx
lea eax, [esp + 0x11]
mov esi, 3
movzx ebx, byte [eax - 1]
xor byte [eax + 3], bl
movzx ebx, byte [eax]
xor byte [eax + 4], bl
movzx ebx, byte [eax + 1]
xor byte [eax + 5], bl
movzx ebx, byte [eax + 2]
xor byte [eax + 6], bl
add eax, 4
sub esi, 1
jne 0x433290
xor eax, eax
cmp edi, 0xa
jg 0x43330d
cmp eax, 4
jge 0x4332f7
nop
cmp ecx, 4
jge 0x4332fa
movzx ebx, byte [esp + eax*4 + 0x10]
lea esi, [ecx + edi*4]
mov byte [ebp + esi*4 + 0x14], bl
movzx ebx, byte [esp + eax*4 + 0x11]
lea esi, [ecx + edi*4]
lea esi, [ebp + esi*4]
mov byte [esi + 0x15], bl
movzx ebx, byte [esp + eax*4 + 0x12]
mov byte [esi + 0x16], bl
movzx ebx, byte [esp + eax*4 + 0x13]
inc eax
inc ecx
cmp eax, 4
mov byte [esi + 0x17], bl
jl 0x4332c0
cmp ecx, 4
jne 0x4332ff
inc edi
xor ecx, ecx
cmp eax, 4
jl 0x4332b5
cmp edi, 0xa
jle 0x433241
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00441a0e
add esp, 0x24
ret 4
Function at 0x433330
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
mov eax, ecx
push edi
lea esi, [eax + 0x24]
lea ecx, [eax + 0x28]
mov edi, 9
mov edi, edi
xor eax, eax
jmp 0x433360
movzx edx, byte [ecx - 1]
movzx edx, byte [eax + edx*4 + 0x464260]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x464660]
movzx ebx, byte [ecx - 3]
xor dl, byte [eax + ebx*4 + 0x464a60]
movzx ebx, byte [ecx - 4]
xor dl, byte [eax + ebx*4 + 0x464e60]
movzx ebx, byte [ecx + 2]
mov byte [esp + eax + 0xc], dl
movzx edx, byte [ecx + 3]
movzx edx, byte [eax + edx*4 + 0x464260]
xor dl, byte [eax + ebx*4 + 0x464660]
movzx ebx, byte [ecx + 1]
xor dl, byte [eax + ebx*4 + 0x464a60]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x464e60]
movzx ebx, byte [ecx + 6]
mov byte [esp + eax + 0x10], dl
movzx edx, byte [ecx + 7]
movzx edx, byte [eax + edx*4 + 0x464260]
xor dl, byte [eax + ebx*4 + 0x464660]
movzx ebx, byte [ecx + 5]
xor dl, byte [eax + ebx*4 + 0x464a60]
movzx ebx, byte [ecx + 4]
xor dl, byte [eax + ebx*4 + 0x464e60]
movzx ebx, byte [ecx + 0xa]
mov byte [esp + eax + 0x14], dl
movzx edx, byte [ecx + 0xb]
movzx edx, byte [eax + edx*4 + 0x464260]
xor dl, byte [eax + ebx*4 + 0x464660]
movzx ebx, byte [ecx + 9]
xor dl, byte [eax + ebx*4 + 0x464a60]
movzx ebx, byte [ecx + 8]
xor dl, byte [eax + ebx*4 + 0x464e60]
inc eax
cmp eax, 4
mov byte [esp + eax + 0x17], dl
jl 0x433360
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esi], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
add ecx, 0x10
add esi, 0x10
sub edi, 1
jne 0x433350
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00441a0e
add esp, 0x14
ret
Function at 0x434600
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
push ebx
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
mov ebx, ecx
test eax, eax
ja 0x434639
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00441a0e
add esp, 0x18
ret 0xc
mov ecx, dword [esi + 4]
xor ecx, dword [ebx + 8]
mov edx, dword [esi + 8]
xor edx, dword [ebx + 0xc]
shr eax, 4
push ebp
mov ebp, eax
mov eax, dword [esi]
xor eax, dword [ebx + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
xor eax, dword [ebx + 0x10]
push edi
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
call fcn.00433470
add esi, 0x10
add ebp, 0xffffffff
je 0x4346be
nop
mov edx, dword [edi]
xor edx, dword [esi]
mov eax, dword [edi + 4]
xor eax, dword [esi + 4]
mov ecx, dword [edi + 8]
xor ecx, dword [esi + 8]
mov dword [esp + 0x14], edx
mov edx, dword [edi + 0xc]
xor edx, dword [esi + 0xc]
mov dword [esp + 0x18], eax
add edi, 0x10
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x20], ecx
push eax
mov ecx, ebx
mov dword [esp + 0x28], edx
call fcn.00433470
add esi, 0x10
sub ebp, 1
jne 0x434680
mov ecx, dword [edi]
mov dword [ebx + 4], ecx
mov edx, dword [edi + 4]
mov dword [ebx + 8], edx
mov eax, dword [edi + 8]
mov dword [ebx + 0xc], eax
mov ecx, dword [edi + 0xc]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [ebx + 0x10], ecx
mov ecx, dword [esp + 0x1c]
pop esi
pop ebx
xor ecx, esp
shl eax, 4
call fcn.00441a0e
add esp, 0x18
ret 0xc
Function at 0x434700
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x4577c0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
mov esi, dword [esp + 0x38]
push edi
mov edi, dword [esp + 0x44]
mov ebx, ecx
test esi, esi
je 0x4347f5
mov eax, dword [esp + 0x40]
test eax, eax
jbe 0x4347f5
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
shr eax, 4
mov dword [esp + 0x18], ecx
mov ecx, dword [ebx + 0x10]
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
test eax, eax
jbe 0x4347c5
lea edx, [esp + 0x28]
push edx
push esi
mov ecx, ebx
call fcn.00433b70
mov edx, dword [esp + 0x20]
xor dword [esp + 0x30], edx
mov edx, dword [esp + 0x24]
xor dword [esp + 0x34], edx
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x2c]
xor ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
xor eax, ebp
mov ebp, dword [esi]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 8]
mov dword [esp + 0x20], edx
mov edx, dword [esi + 0xc]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x34]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
add esi, 0x10
add edi, 0x10
sub dword [esp + 0x10], 1
mov dword [esp + 0x24], edx
jne 0x434757
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [ebx + 4], ebp
pop ebp
mov dword [ebx + 8], edx
mov edx, dword [esp + 0x20]
pop edi
mov dword [ebx + 0xc], ecx
pop esi
mov dword [ebx + 0x10], edx
shl eax, 4
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00441a0e
add esp, 0x2c
ret 0xc
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00441a0e
add esp, 0x2c
ret 0xc

Function at 0x4375f0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
ret 4

Function at 0x438440
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x438493
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp]
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x80000000
push 0xd
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
Function at 0x43bad0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x408
push ebx
push ebp
push esi
mov esi, dword [esp + 0x418]
push edi
mov ebx, ecx
movzx edi, word [ebx]
sub edi, dword [esi + 0x654]
mov dword [esp + 0x14], ebx
push edi
push esi
call fcn.0043b8c0
mov dl, byte [esi + 0xa6c]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 4]
sub eax, 6
lea ebp, [esp + 0x18]
xor ecx, ecx
lea ecx, [ecx]
movzx ebx, byte [eax + 6]
add eax, 6
cmp byte [ebx + esi + 0x66c], dl
je 0x43bb10
movzx ebx, byte [eax + 1]
mov dword [ebp], eax
add ecx, ebx
add ebp, 4
sub edi, 1
jne 0x43bb10
add dword [esi + 0x4a84], ecx
mov eax, dword [esi + 0x4a78]
xor edx, edx
div dword [esi + 0x4a84]
xor edx, edx
mov edi, eax
mov eax, dword [esi + 0x4a74]
sub eax, dword [esi + 0x4a70]
mov dword [esi + 0x4a78], edi
div edi
mov ebx, dword [esi + 0x4a84]
cmp eax, ebx
jl 0x43bb76
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x408
ret 4
cmp eax, ecx
mov edx, dword [esp + 0x18]
lea edi, [esp + 0x18]
jge 0x43bbf3
movzx ecx, byte [edx + 1]
cmp ecx, eax
jg 0x43bba0
lea ebx, [ebx]
mov edx, dword [edi + 4]
movzx ebx, byte [edx + 1]
add edi, 4
add ecx, ebx
cmp ecx, eax
jle 0x43bb90
mov edi, dword [esp + 0x10]
mov dword [esi + 0x4a80], ecx
movzx eax, byte [edx + 1]
sub ecx, eax
mov dword [esi + 0x4a7c], ecx
mov cl, byte [edi + 2]
cmp cl, 7
jae 0x43bbd9
add byte [edi + 3], 0xff
jne 0x43bbd9
mov ax, word [edi]
add ax, ax
mov word [edi], ax
mov al, 3
shl al, cl
inc cl
mov byte [edi + 2], cl
mov byte [edi + 3], al
mov ecx, dword [esp + 0x14]
push edx
push esi
call fcn.0043b880
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x408
ret 4
mov edi, dword [esp + 0x14]
mov dword [esi + 0x4a7c], ecx
mov dword [esi + 0x4a80], ebx
movzx ecx, word [edi]
sub ecx, dword [esi + 0x654]
lea eax, [esp + 0x18]
sub eax, 4
mov edx, dword [eax + 4]
movzx edx, byte [edx]
mov bl, byte [esi + 0xa6c]
add eax, 4
sub ecx, 1
mov byte [edx + esi + 0x66c], bl
jne 0x43bc13
mov cx, word [esi + 0x4a84]
mov eax, dword [esp + 0x10]
add word [eax], cx
movzx edx, word [edi]
pop edi
mov dword [esi + 0x654], edx
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x408
ret 4
Function at 0x441a0e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4577c0]
jne 0x441a18
repz ret
jmp fcn.00445178

Function at 0x44424f
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x4541d0
call fcn.00444f60
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x44414f
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x44414f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x44414f
cmp dword [eax + 0x400074], 0xe
jbe 0x44414f
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x444153
and dword [ebp - 0x1c], 0
push 1
call fcn.004442d8
pop ecx
test eax, eax
jne 0x444167
push 0x1c
call fcn.004440d9
pop ecx
call fcn.00447499
test eax, eax
jne 0x444178
push 0x10
call fcn.004440d9
pop ecx
call fcn.00448a62
and dword [ebp - 4], 0
call fcn.0044a26b
test eax, eax
jge 0x444192
push 0x1b
call fcn.004431f4
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x469704], eax
call fcn.0044a136
mov dword [0x467b40], eax
call fcn.0044a07d
test eax, eax
jge 0x4441b8
push 8
call fcn.004431f4
pop ecx
call fcn.00449e39
test eax, eax
jge 0x4441c9
push 9
call fcn.004431f4
pop ecx
push 1
call fcn.0044329d
pop ecx
test eax, eax
je 0x4441dc
push eax
call fcn.004431f4
pop ecx
mov eax, dword [0x467b1c]
mov dword [0x467b20], eax
push eax
push dword [0x467b14]
push dword [0x467b10]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x44420a
push eax
call fcn.0044345b
call fcn.0044347d
jmp 0x44423f
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00444fa5
ret
call fcn.0044a4bf
jmp 0x4440fd
Function at 0x445dc9
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x4577c0]
xor eax, ebp
mov dword [ebp + 0x2a4], eax
and dword [ebp - 0x80], 0
push ebx
push 0x4c
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.00441f20
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp + 0x88], eax
mov dword [ebp + 0x84], ecx
mov dword [ebp + 0x80], edx
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x78], esi
mov dword [ebp + 0x74], edi
mov word [ebp + 0xa0], ss
mov word [ebp + 0x94], cs
mov word [ebp + 0x70], ds
mov word [ebp + 0x6c], es
mov word [ebp + 0x68], fs
mov word [ebp + 0x64], gs
pushfd
pop dword [ebp + 0x98]
mov eax, dword [ebp + 0x2ac]
lea ecx, [ebp + 0x2ac]
mov dword [ebp - 0x28], 0x10001
mov dword [ebp + 0x90], eax
mov dword [ebp + 0x9c], ecx
mov ecx, dword [ecx - 4]
mov dword [ebp + 0x8c], ecx
mov dword [ebp - 0x80], 0xc0000417
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x445ea8
test ebx, ebx
jne 0x445ea8
push 2
call fcn.0044a6a7
pop ecx
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
xor ecx, ebp
pop ebx
call fcn.00441a0e
add ebp, 0x2a8
leave
ret

Function at 0x445ed0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [0x467fd4]
call fcn.0044710d
pop ecx
test eax, eax
je 0x445ee6
pop ebp
jmp eax
push 2
call fcn.0044a6a7
pop ecx
pop ebp
jmp fcn.00445dc9