joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4058cf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421988
push esi
call fcn.00405cfb
push esi
call fcn.00405882
mov edi, eax
test edi, edi
jne 0x4058f0
xor eax, eax
jmp 0x405942
push edi
call fcn.00405f5d
test byte [0x423f98], 0x80
je 0x405909
mov al, byte [edi]
test al, al
je 0x4058ec
cmp al, 0x5c
je 0x4058ec
sub edi, esi
jmp 0x405921
call fcn.00405ff6
test eax, eax
je 0x40591b
test byte [eax], 0x10
je 0x4058ec
push esi
call fcn.00405835
push esi
call sub.KERNEL32.DLL_lstrlenA
cmp eax, edi
push esi
jg 0x40590d
call fcn.004057ee
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4059b3
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4059cf
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
ret 4

Function at 0x4059d2
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
ret 0xc

Function at 0x405a01
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
jne 0x405a45
test edi, edi
jne 0x405a0c
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405a3f
Function at 0x405a49
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 2
call fcn.00406087
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405a6d
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405ba6
mov ebx, dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
mov dword [0x422710], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x422710
je 0x405ab1
push 1
push 0
push esi
call fcn.004059d2
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405bac
cmp eax, edi
jg 0x405bac
mov esi, 0x422188
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405bac
cmp eax, edi
jg 0x405bac
push esi
push ebp
push str._s_s_r_n
push 0x421d88
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x423f90]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405d1d
push 4
push 0xc0000000
push esi
call fcn.004059d2
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405ba6
push 0
push ebp
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405b9f
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x405b9f
cmp edi, dword [esp + 0x18]
jne 0x405b9f
push str._Rename__r_n
push esi
call fcn.00405947
test eax, eax
jne 0x405bb3
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405cfb
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x421d88
push eax
call fcn.00405993
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc dword [0x424010]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409424
push eax
call fcn.00405947
test eax, eax
je 0x405b6a
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405bda
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405bcf
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405b6c
Function at 0x40601d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406041
xor eax, eax
test eax, eax
je 0x406053
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406053
xor ecx, ecx
jmp 0x406056
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409010]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
leave
ret 4

Function at 0x4060f6
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422b14], 0
push esi
jne 0x40612d
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406107
mov dword [ecx*4 + 0x422b10], eax
inc ecx
cmp ecx, 0x100
jl 0x406102
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40615e
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422b10]
xor eax, esi
inc ecx
dec edx
jne 0x406140
pop edi
not eax
pop esi
ret 0xc
Function at 0x403728
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.004066ac
test esi, esi
jne 0x403760
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004067e8
jmp 0x40377e
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040366c
mov edi, eax
test esi, esi
je 0x40377e
cmp dword [ebx], 0
je 0x40377e
dec esi
jmp 0x403767
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x4037b0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x573008], 0x8088405
inc edx
mov dword [ebx + 0x573008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403e70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x573024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403f08
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x403ee8
xor eax, eax
push ebp
push 0x403ee1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403f40
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403ee8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x573024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x573024], ax
mov esp, ebp
pop ebp
ret

Function at 0x405258
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x579054], 0
je 0x4052b9
cmp word [0x579330], 0xd7b2
jne 0x405281
cmp dword [0x579338], 0
jbe 0x405281
mov eax, 0x57932c
call dword [0x579348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4052e4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x573030], 0
jne 0x4052d5
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405484
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x573034], 0
je 0x4054aa
mov edx, esi
mov eax, ebx
call dword [0x573034]
jmp 0x4054b9
mov eax, 8
call fcn.00403350
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x579055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40544c
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4071bc
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4071fe
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x40721e
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.004068ac
add esp, 0x41c
pop esi
pop ebx
ret
Function at 0x40af9c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
mov esi, 0x57bb64
push 0xa
push 0x40b030
mov eax, dword [0x57bb50]
push eax
call sub.kernel32.dll_FindResourceW
mov ebx, eax
test ebx, ebx
jne 0x40afc0
call fcn.00415a0c
push ebx
mov eax, dword [0x57bb50]
push eax
call sub.kernel32.dll_LoadResource
mov ebx, eax
test ebx, ebx
jne 0x40afd7
call fcn.00415a0c
push ebx
call sub.kernel32.dll_LockResource
mov dword [esi], eax
cmp dword [esi], 0
jne 0x40afe9
call fcn.00415a0c
mov eax, dword [esi]
mov edx, dword [esi]
mov ecx, edx
add ecx, dword [eax]
mov dword [0x57bb68], ecx
mov ecx, edx
add ecx, dword [eax + 4]
mov dword [0x57bb6c], ecx
mov ecx, edx
add ecx, dword [eax + 8]
mov dword [0x57bb70], ecx
mov ecx, edx
add ecx, dword [eax + 0xc]
mov dword [0x57bb74], ecx
mov ecx, edx
add ecx, dword [eax + 0x10]
mov dword [0x57bb78], ecx
add edx, dword [eax + 0x14]
mov dword [0x57bb7c], edx
pop esi
pop ebx
ret

Function at 0x40c8e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40c98d
test eax, edx
je 0x40c990
push 0
push 0
cmp word [eax - 0xa], 2
je 0x40c90d
push edx
mov edx, eax
mov eax, esp
call fcn.004068c8
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x40c923
push eax
lea eax, [esp + 8]
call fcn.004068c8
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x40c932
movzx eax, word [eax]
sub eax, ecx
jmp 0x40c959
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40c973
add ecx, 4
js 0x40c94a
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x40c970
push eax
mov eax, ecx
mov edx, 2
call fcn.00405524
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x40c957
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x40c959
xor eax, eax
ret
test eax, eax
je 0x40c9a0
test edx, edx
jne 0x40c8f4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x40de50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00406738
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x40de6e
test al, 0x10
sete al
pop esi
pop ebx
ret
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 2
je 0x40de8f
cmp ebx, 3
je 0x40de8f
cmp ebx, 0x7b
je 0x40de8f
mov eax, esi
call fcn.0040de10
test al, al
jne 0x40de93
xor eax, eax
jmp 0x40de95
mov al, 1
pop esi
pop ebx
ret

Function at 0x40de98
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00406738
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x40deb1
test al, 0x10
jne 0x40deb5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40e078
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00406738
push eax
call sub.kernel32.dll_GetFileAttributesW
pop ebx
ret
Function at 0x40e08c
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
push edi
mov eax, esi
call fcn.00406738
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x40e0ae
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4129a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x4129dd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.004067e8
jmp 0x4129e6
mov eax, ebx
mov edx, esi
call fcn.004066ac
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4129f0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x412a12
movzx eax, word [esp]
jmp 0x412a14
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4132e8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41340d
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.004130fc
mov esi, eax
mov eax, dword [0x5783ac]
cmp byte [eax], 0
je 0x4133b5
mov eax, dword [0x577e34]
call fcn.00403878
call fcn.004034b8
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4132c4]
call fcn.004082b0
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x413428
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4133f1
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x577d78]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x57bb50]
call fcn.004084b8
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413414
lea eax, [ebp - 4]
mov edx, dword [0x4132c4]
call fcn.004083d0
ret
Function at 0x414098
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41416e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406700
lea eax, [ebp - 4]
call fcn.0040711c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406738
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x414158
mov eax, ebx
call fcn.00403350
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x414151
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00406738
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x41413b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x414180
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x41413b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414158
mov eax, dword [ebp - 0x10]
call fcn.0040336c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414175
lea eax, [ebp - 4]
call fcn.0040669c
ret

Function at 0x41583b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004058b0
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x41585e
mov eax, edi
add eax, eax
call fcn.00403350
mov esi, eax
jmp 0x415860
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x415899
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x415883
mov eax, esp
cmp esi, eax
je 0x4158a6
mov eax, esi
call fcn.0040336c
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4158e0
cmp bl, 0
je 0x4158dc
cmp bl, 0x41
jl 0x4158d7
cmp bl, 0x5a
jg 0x4158d7
or bl, 0x20
xor al, bl
inc esi
jmp 0x4158bb
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x415820

Function at 0x433bf8
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004338fc
dec esi
jne 0x433c1a
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x434dd8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x57de9c
cmp dword [edi], 0
jne 0x434e54
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x57de98]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x573f64
mov ecx, 2
call fcn.0040356c
mov edx, 0x434db0
lea eax, [esi + 5]
call fcn.00434dd0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00434dd0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x434e29
mov dword [0x57de98], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x435abc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x14]
mov edx, dword [0x4176f0]
call fcn.00407424
xor eax, eax
push ebp
push 0x435c7d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x573f90], 0
jne 0x435b10
mov ecx, dword [0x577b64]
mov dl, 1
mov eax, dword [0x40b180]
call fcn.0041351c
call fcn.00404bfc
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x10
call fcn.00403968
mov eax, ebx
call fcn.004061f0
mov dword [ebp - 0x28], eax
push esi
mov esi, 0x435c8c
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
call fcn.00408bac
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, ebx
test eax, eax
je 0x435b57
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x435c23
mov dword [ebp - 0x1c], 0x20
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x435c0f
lea eax, [ebp - 4]
lea edx, [ebp - 0x5c]
mov ecx, 0x10
call fcn.004068ac
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00406914
mov eax, dword [ebp - 4]
test eax, eax
je 0x435bb2
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x435bb2
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.004056ec
mov ebx, eax
test ebx, ebx
je 0x435bbd
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 8]
test eax, eax
je 0x435bda
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x435bda
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call fcn.004056ec
mov edi, eax
test edi, edi
je 0x435be5
sub edi, 4
mov edi, dword [edi]
push edi
mov eax, dword [ebp - 8]
call fcn.00406738
push eax
push ebx
mov eax, dword [ebp - 4]
call fcn.00406738
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringW_1
sub eax, 2
test eax, eax
sete al
jmp 0x435c11
xor eax, eax
test al, al
je 0x435c1c
mov ebx, 0x15
jmp 0x435c28
mov ebx, 0x10
jmp 0x435c28
mov ebx, 0x15
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x2c]
push eax
push ebx
push 0
push esi
call dword [0x573f90]
call fcn.00435928
mov eax, dword [ebp - 0xc]
call fcn.00435928
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
call fcn.00408bc4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435c84
lea eax, [ebp - 0x14]
mov edx, dword [0x4176f0]
call fcn.004074fc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004066a4
ret