joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c5e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x43c601
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x43c5fa
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x43c615
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043bfac
test bl, bl
jne 0x43c6e8
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x44cc58
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x43c64c
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x43c660
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043c4c0
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov bl, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x43c692
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x43c641
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x43c6b5
mov eax, 4
mov edx, dword [ebp + 0xc]
mov cl, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x43c6c6
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov bl, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x43c6da
jmp 0x43c7a3
cmp bl, 1
jne 0x43c7a3
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x44ccb2
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
mov cl, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x43c708
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
mov cl, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x43c71c
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043c4c0
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
mov cl, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x43c74e
sub ebx, 6
inc dword [ebp - 8]
jne 0x43c6fd
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
mov cl, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x43c775
mov eax, 4
mov ebx, dword [ebp + 0xc]
mov dl, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x43c786
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov cl, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x43c79a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.0043c030
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x43ce04
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43ce77
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004044fc
mov dword [ebp - 8], 0x1e
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404b48
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004049bc
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x43ce61
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404a1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ce7e
lea eax, [ebp - 4]
call fcn.004044fc
ret

Function at 0x43ce84
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd4c
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049ac
xor eax, eax
push ebp
push 0x43cf99
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004044fc
xor ecx, ecx
push ebp
push 0x43cf79
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push pe_nt_image_headers32
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x294]
mov edx, dword [ebp - 4]
call fcn.00408724
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x43cf6a
mov edx, dword [eax + 0xc]
test edx, edx
je 0x43cf6a
mov esi, dword [edx]
test esi, esi
je 0x43cf6a
push ebx
xor eax, eax
mov al, byte [esi]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
xor eax, eax
mov al, byte [esi + 1]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
xor eax, eax
mov al, byte [esi + 2]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
xor eax, eax
mov al, byte [esi + 3]
mov dword [ebp - 0x29c], eax
mov byte [ebp - 0x298], 0
lea edx, [ebp - 0x2b4]
mov ecx, 3
mov eax, 0x43cfb0
call fcn.00408c98
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43cf83
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43cfa0
lea eax, [ebp - 4]
call fcn.004044fc
ret

Function at 0x43d240
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
mov ebx, eax
mov edx, ebx
mov eax, 0x43d2e0
call fcn.0043ea10
xor edx, edx
push ebp
push 0x43d2c4
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x43d2b5
push pe_nt_image_headers32
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x294]
push eax
call sub.wsock32.dll_gethostbyname
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 4], eax
push dword [ebp - 4]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebx
call fcn.004046f4
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43d2ce
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43dc44
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43dd3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.004047bc
cmp eax, 2
jl 0x43dd22
mov eax, ebx
call fcn.00408508
test al, al
je 0x43dd22
lea ecx, [ebp - 8]
mov edx, 0x43dd58
mov eax, ebx
call fcn.0043dbbc
xor eax, eax
push ebp
push 0x43dd18
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.004049bc
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43dd0e
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004085b0
mov eax, dword [ebp - 0xc]
call fcn.004047bc
mov edi, eax
push 0
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0xc]
call fcn.00404a14
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
push ebx
call sub.kernel32.dll_CloseHandle_1
push esi
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43dd22
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43dd44
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404520
ret

Function at 0x43de68
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43df3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.004047bc
cmp eax, 2
jl 0x43df29
xor eax, eax
push ebp
push 0x43df1f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
mov eax, ebx
call fcn.004049bc
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x43df15
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004085b0
mov eax, dword [ebp - 8]
call fcn.004047bc
mov edi, eax
inc edi
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
call fcn.00404a14
push eax
push esi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
call fcn.004049bc
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43df29
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43df46
lea eax, [ebp - 8]
call fcn.004044fc
ret

Function at 0x43e04c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov eax, ebx
call fcn.004044fc
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x43e07a
mov edx, ebx
lea eax, [esp + 4]
call fcn.004087f4
add esp, 0x18
pop ebx
ret
Function at 0x43e5a8
Capabilities:
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov esi, eax
mov byte [ebp - 1], 0
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
mov eax, esi
call fcn.004049bc
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cdq
cmp edx, 0
jne 0x43e5f5
cmp eax, 0xffffffff
jne 0x43e5f5
mov byte [ebp - 1], 1
jmp 0x43e772
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
je 0x43e624
push 0
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x4e]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x43e624
mov bl, 1
test bl, bl
jne 0x43e631
mov byte [ebp - 1], 1
jmp 0x43e772
xor ebx, ebx
cmp word [ebp - 0x4e], 0x5a4d
je 0x43e641
cmp dword [ebp - 8], 0x40
jne 0x43e693
push 0
push 0
mov eax, dword [ebp - 0x12]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
je 0x43e693
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x146]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x43e693
mov eax, dword [ebp - 0x146]
cmp eax, 0x4550
je 0x43e691
cmp eax, 0x454e
je 0x43e691
cmp eax, 0x454c
jne 0x43e693
mov bl, 1
test bl, bl
je 0x43e769
xor eax, eax
push ebp
push 0x43e75f
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0043e500
mov dword [ebp - 0x13e], eax
call fcn.00402af0
mov eax, 9
call fcn.00403024
mov word [ebp - 0x102], ax
mov eax, 9
call fcn.00403024
mov word [ebp - 0x100], ax
push 0
push 0
mov eax, dword [ebp - 0x12]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
je 0x43e715
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x146]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp word [ebp - 0x4e], 0x5a4d
je 0x43e755
mov word [ebp - 0xe], 0x5a4d
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
je 0x43e755
push 0
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 0xe]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43e769
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e884
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x43e91a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004044fc
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00406abc
test eax, eax
je 0x43e901
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.0040476c
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call fcn.0040c604
mov edx, dword [ebp - 0x110]
mov eax, ebx
call fcn.00404550
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e921
lea eax, [ebp - 0x110]
call fcn.004044fc
ret

Function at 0x43e98c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43ea04
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.0040476c
lea edx, [ebp - 0x10c]
mov eax, dword [ebx]
call fcn.0040c604
mov edx, dword [ebp - 0x10c]
mov eax, ebx
call fcn.00404550
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ea0b
lea eax, [ebp - 0x10c]
call fcn.004044fc
ret

Function at 0x43ea10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43ea8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004044fc
mov eax, dword [ebp - 4]
call fcn.004047bc
mov esi, eax
test esi, esi
jle 0x43ea74
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov bl, byte [eax + edx - 1]
xor bl, 0xa
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.004046e4
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.004047c4
inc dword [ebp - 8]
dec esi
jne 0x43ea4d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ea91
lea eax, [ebp - 0xc]
call fcn.004044fc
ret

Function at 0x43ee98
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x44
call fcn.00403004
lea eax, [esp + 0x44]
xor ecx, ecx
mov edx, 0x10
call fcn.00403004
mov dword [esp], 0x44
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 4]
push eax
push edi
push 0
push 0x20
push 0
push 0
push 0
push esi
push ebx
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x54
pop edi
pop esi
pop ebx
ret
Function at 0x43eef4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43f05a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, edi
call fcn.004044fc
lea eax, [ebp - 0x24]
push eax
mov eax, ebx
call fcn.004049bc
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43f037
mov eax, dword [ebp - 0xc]
call fcn.00402728
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x43f02f
xor eax, eax
push ebp
push 0x43f025
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x43f068
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x43f01b
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
mov edx, 4
call fcn.004080a0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
call fcn.00406a68
movzx eax, ax
lea ecx, [ebp - 0x18]
mov edx, 4
call fcn.004080a0
push 0x43f08c
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push 0x43f0a8
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.0040487c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
call fcn.00404808
mov eax, dword [ebp - 0x28]
call fcn.004049bc
push eax
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x43f01b
mov eax, edi
mov edx, dword [ebp - 0x20]
call fcn.004046f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43f02f
mov eax, dword [ebp - 8]
call fcn.00402748
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f061
lea eax, [ebp - 0x28]
call fcn.004044fc
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404520
ret
Function at 0x43fb08
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x43fc03
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea edx, [ebp - 8]
mov eax, 0x43fc1c
call fcn.0043ea10
lea eax, [ebp - 8]
mov edx, edi
call fcn.004047c4
mov eax, dword [ebp - 8]
call fcn.004049bc
mov esi, eax
xor edx, edx
push ebp
push 0x43fbe3
push dword fs:[edx]
mov dword fs:[edx], esp
push esi
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenMutexA
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x43fb82
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43fbed
mov eax, edi
call fcn.004049bc
push eax
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenMutexA
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x43fbb2
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43fbed
push esi
push 0xffffffffffffffff
push 0
call fcn.004067c8
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x43fbcf
cmp eax, 5
jne 0x43fbd9
mov byte [ebp - 1], 1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43fbed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fc0a
lea eax, [ebp - 8]
call fcn.004044fc
ret
Function at 0x43fc24
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x150], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x43fdb0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov dword [esi], 2
mov eax, edi
call fcn.004044fc
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.004049bc
push eax
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43fd92
push 0
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
je 0x43fd8c
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
lea eax, [ebp - 0x50]
push eax
push ebx
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x43fd8c
cmp word [ebp - 0x50], 0x5a4d
jne 0x43fd8c
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
je 0x43fd8c
push 0
lea eax, [ebp - 0xc]
push eax
push 0xf8
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x43fd8c
cmp dword [ebp - 0x148], 0x4550
jne 0x43fd8c
mov eax, dword [ebp - 0x140]
xor eax, 0x50485e00
xor eax, dword [ebp - 0x120]
movzx edx, word [ebp - 0x142]
xor eax, edx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], 2
jne 0x43fd3f
call fcn.0043cc6c
add eax, 0x7c6
xor dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jle 0x43fd59
cmp dword [ebp - 0x10], 0x7a120
jge 0x43fd59
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
mov byte [ebp - 5], 1
jmp 0x43fd8c
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 0x10]
call fcn.00407f8c
mov eax, dword [ebp - 0x14c]
push eax
lea edx, [ebp - 0x150]
mov eax, 0x43fdcc
call fcn.0043ea10
mov edx, dword [ebp - 0x150]
mov eax, edi
pop ecx
call fcn.00404808
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fdb7
lea eax, [ebp - 0x150]
mov edx, 2
call fcn.00404520
ret
Function at 0x43fdfc
Capabilities:
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x43ffba
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
mov eax, esi
call fcn.004049bc
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x43ff9e
push 0
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
je 0x43ff98
push 0
lea eax, [ebp - 8]
push eax
push 0x40
lea eax, [ebp - 0x4c]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x43ff98
cmp word [ebp - 0x4c], 0x5a4d
jne 0x43ff98
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
je 0x43ff98
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x43ff98
cmp dword [ebp - 0x144], 0x4550
jne 0x43ff98
call sub.kernel32.dll_GetCurrentProcessId
add eax, 0x7c6
xor eax, dword [ebp - 0x13c]
mov dword [ebp - 0x13c], eax
call fcn.00402af0
mov eax, 9
call fcn.00403024
mov word [ebp - 0x100], ax
mov eax, 9
call fcn.00403024
mov word [ebp - 0xfe], ax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push esi
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
je 0x43ff3c
push 0
lea eax, [ebp - 8]
push eax
push 0xf8
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp byte [ebp - 1], 0
je 0x43ff98
mov eax, 0x200
call fcn.00403024
mov edi, eax
shl edi, 4
test edi, edi
jle 0x43ff98
push 2
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
je 0x43ff98
push edi
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x43fdd8]
call fcn.004058ac
add esp, 4
mov edx, edi
mov eax, dword [ebp - 0xc]
call fcn.00406a74
push 0
lea eax, [ebp - 8]
push eax
push edi
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ffc1
lea eax, [ebp - 0xc]
mov edx, dword [0x43fdd8]
call fcn.004058b8
ret

Function at 0x442a2c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x442aa9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004044fc
mov eax, dword [ebp - 4]
call fcn.004047bc
mov esi, eax
test esi, esi
jle 0x442a93
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov bl, byte [eax + edx - 1]
xor bl, byte [ebp - 5]
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004046e4
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.004047c4
inc dword [ebp - 0xc]
dec esi
jne 0x442a6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442ab0
lea eax, [ebp - 0x10]
call fcn.004044fc
ret