joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69ca80
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x76f950]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x77a68e], 0
jne 0x430755
cmp dword [0x7766b0], 8
mov byte [0x77a68e], 1
jb 0x430583
mov edi, dword [0x77669c]
test edi, edi
jne 0x430588
xor esi, esi
jmp 0x4305a3
mov edi, 0x77669c
cmp word [edi], 0
jne 0x430592
xor esi, esi
jmp 0x4305a3
call fcn.004df4c0
mov esi, eax
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.0040bb30
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x4305bd
mov eax, dword [esi + 4]
test eax, eax
jne 0x4305c2
lea eax, [esi + 8]
jmp 0x4305c2
mov eax, 0x6f4744
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4305d6
test al, 0x10
je 0x4305d6
mov al, 1
jmp 0x4305d8
xor al, al
test al, al
sete bl
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4305fa
mov eax, dword [esi]
test eax, eax
jne 0x4305f7
mov ecx, esi
call fcn.004df580
jmp 0x4305fa
dec eax
mov dword [esi], eax
test bl, bl
je 0x430755
cmp dword [0x7766b0], 8
jb 0x430619
mov edi, dword [0x77669c]
test edi, edi
jne 0x43061e
xor esi, esi
jmp 0x430639
mov edi, 0x77669c
cmp word [edi], 0
jne 0x430628
xor esi, esi
jmp 0x430639
call fcn.004df4c0
mov esi, eax
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.0040bb30
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.004250e0
mov bl, al
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x43066a
mov eax, dword [esi]
test eax, eax
jne 0x430667
mov ecx, esi
call fcn.004df580
jmp 0x43066a
dec eax
mov dword [esi], eax
test bl, bl
je 0x4306be
mov eax, dword [0x788c84]
mov ecx, dword [0x788c80]
test eax, eax
cmovne ecx, eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00401430
mov dword [ebp - 4], 2
mov eax, dword [0x789864]
mov edx, dword [0x789860]
test eax, eax
cmovne edx, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.00452570
add esp, 4
mov byte [ebp - 4], 3
mov ecx, eax
call fcn.004e18e0
mov byte [ebp - 4], 2
jmp 0x43070c
mov eax, dword [0x789714]
mov ecx, dword [0x789710]
test eax, eax
cmovne ecx, eax
push ecx
lea ecx, [ebp - 0x10]
call fcn.00401430
mov dword [ebp - 4], 4
mov eax, dword [0x789864]
mov edx, dword [0x789860]
test eax, eax
cmovne edx, eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.00452570
add esp, 4
mov byte [ebp - 4], 5
mov ecx, eax
call fcn.004e18e0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x430725
mov ecx, dword [eax]
test ecx, ecx
jne 0x430722
mov ecx, eax
call fcn.004df580
jmp 0x430725
dec ecx
mov dword [eax], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x430755
mov ecx, dword [eax]
test ecx, ecx
jne 0x430752
mov ecx, eax
call fcn.004df580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432210
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, ecx
mov bl, dl
lea eax, [esi - 0x1b0]
cmp eax, 0x2f
ja 0x432228
pop esi
pop ebx
jmp 0x56e410
cmp esi, 1
je 0x432232
cmp esi, 2
jne 0x432246
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x432246
dec esi
neg esi
sbb esi, esi
add esi, 2
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test bl, bl
mov ecx, 1
mov edx, 0x8000
cmovne ecx, edx
and eax, ecx
neg eax
sbb eax, eax
pop esi
neg eax
pop ebx
ret
push esi
cmp ecx, 0x1df
je 0x56e432
call fcn.0056d1a0
cmp eax, 0xffffffff
jne 0x56e427
xor al, al
pop esi
ret
mov esi, 1
mov ecx, eax
shl esi, cl
jmp 0x56e435
or esi, 0xffffffff
test dl, dl
je 0x56e469
push edi
mov edi, dword [0x77e31c]
xor edx, edx
test edi, edi
je 0x56e45c
mov eax, dword [edi]
mov edi, dword [edi + 4]
cmp eax, edi
je 0x56e45c
nop
mov ecx, dword [eax]
add eax, 4
or edx, dword [ecx + 8]
cmp eax, edi
jne 0x56e450
and edx, esi
neg edx
sbb edx, edx
neg edx
pop edi
mov al, dl
pop esi
ret
mov ecx, dword [0x77e314]
test esi, ecx
not esi
setne al
and ecx, esi
mov dword [0x77e314], ecx
pop esi
ret
Function at 0x432320
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69d18d
mov eax, dword fs:[0]
push eax
sub esp, 0x32c
mov eax, dword [0x76f950]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x334], 0
push eax
mov dword [ebp - 0x338], edi
mov dword [ebp - 0x32c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x31c]
mov ecx, dword [ebp - 0x324]
mov esi, dword [ebp - 0x328]
mov ebx, dword [ebp - 0x320]
sub eax, 0
je 0x432484
dec eax
je 0x432457
dec eax
je 0x4323b3
mov eax, 0x6e4478
jmp 0x432489
cmp esi, 5
jne 0x4323e7
mov eax, ecx
sub eax, 0
je 0x4323dd
dec eax
je 0x4323d3
dec eax
jne case.default.0x4323f1
mov eax, str.Windows_Server_2003
jmp 0x432489
mov eax, str.Windows_XP
jmp 0x432489
mov eax, str.Windows_2000
jmp 0x432489
cmp esi, 6
jne case.default.0x4323f1
cmp ecx, 3
ja case.default.0x4323f1
jmp dword [ecx*4 + 0x432578]
cmp byte [ebp - 0x212], 1
mov eax, str.Windows_Vista
mov edx, str.Windows_Server_2008
cmovne eax, edx
jmp 0x432489
cmp byte [ebp - 0x212], 1
mov eax, str.Windows_7
mov edx, str.Windows_Server_2008_R2
cmovne eax, edx
jmp 0x432489
cmp byte [ebp - 0x212], 1
mov eax, str.Windows_8
mov edx, str.Windows_Server_2012
cmovne eax, edx
jmp 0x432489
cmp byte [ebp - 0x212], 1
mov eax, str.Windows_8.1
mov edx, str.Windows_Server_2012_R2
cmovne eax, edx
jmp 0x432489
mov eax, str.Windows_NT
jmp 0x432489
movzx edx, bx
cmp edx, 0x5f
je 0x43247d
mov eax, str.Win9x
cmp edx, 0x7ce
mov dword [ebp - 0x330], str.Windows_98
cmove eax, dword [ebp - 0x330]
jmp 0x432489
mov eax, str.Windows_95
jmp 0x432489
mov eax, str.Win32s
and ebx, 0xfff
push ebx
push ecx
push esi
push eax
push str._ls__d._d._d
lea eax, [ebp - 0x210]
push 0x100
push eax
call fcn.0063439c
add esp, 0x1c
cmp word [ebp - 0x210], 0
jne 0x4324ba
xor esi, esi
jmp 0x4324d1
call fcn.004df4c0
mov esi, eax
push 0xffffffffffffffff
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call fcn.0040bb30
mov dword [edi], esi
mov dword [ebp - 4], 0
cmp word [ebp - 0x318], 0
mov dword [ebp - 0x334], 1
jne 0x4324f2
xor esi, esi
jmp 0x432509
call fcn.004df4c0
mov esi, eax
push 0xffffffffffffffff
lea eax, [ebp - 0x318]
push eax
mov ecx, esi
call fcn.0040bb30
mov dword [ebp - 0x330], esi
mov dword [ebp - 4], 1
test esi, esi
je 0x43253f
mov eax, dword [edi]
test eax, eax
je 0x43252c
cmp dword [eax], 0
je 0x43252c
mov ecx, edi
call fcn.004db0b0
mov edx, dword [esi + 4]
test edx, edx
jne 0x432536
lea edx, [esi + 8]
mov ecx, dword [edi]
call fcn.004dfa30
mov dword [edi], eax
mov byte [ebp - 4], 0
test esi, esi
je 0x432559
mov eax, dword [esi]
test eax, eax
jne 0x432556
mov ecx, esi
call fcn.004df580
jmp 0x432559
dec eax
mov dword [esi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00633732
mov esp, ebp
pop ebp
ret
Function at 0x432590
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [edx]
test eax, eax
jne 0x43259a
xor edx, edx
jmp 0x4325a4
mov edx, dword [eax + 4]
test edx, edx
jne 0x4325a4
lea edx, [eax + 8]
mov ecx, dword [ecx]
test ecx, ecx
je 0x4325b6
mov eax, dword [ecx + 4]
test eax, eax
jne 0x4325bb
lea eax, [ecx + 8]
jmp 0x4325bb
mov eax, 0x6f4744
push 1
push 0x6e44a4
push edx
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta al
ret
Function at 0x436d90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69a478
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x76f950]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx], vtable.TJS::tTJSBinaryStream.0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [edx + 0xc], eax
mov dword [edx], vtable.tTVPXP3ArchiveStream.0
mov dword [edx + 0x48], 0
mov dword [edx + 0x20], 0
mov eax, dword [eax]
mov dword [edx + 0x24], eax
mov ecx, eax
mov dword [edx + 0x40], 0
mov dword [edx + 0x44], 0
mov eax, dword [ecx + 0x10]
mov dword [edx + 0x38], eax
mov eax, dword [ecx + 0x14]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov byte [edx + 0x4c], 0
mov dword [edx + 0x30], 0
mov dword [edx + 0x34], 0
mov dword [edx + 0x28], 0xffffffff
inc dword [eax + 4]
mov eax, dword [ebp + 0x14]
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [edx + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [edx + 0x1c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x439f00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69e008
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x76f950]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x6e49c0
mov edi, eax
push 0x7f
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x439f53
xor al, al
jmp 0x43a055
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x439f4c
shr esi, 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, 0x7766d0
call fcn.0040ae70
cmp dword [0x7766e0], 0
je 0x439f4c
mov esi, dword [ebp - 0x5c]
push 0x208
push 0
push esi
call fcn.0063ac00
add esp, 0xc
lea ecx, [ebp - 0x58]
call fcn.0043eba0
mov dword [ebp - 4], 0
mov edx, eax
lea ecx, [ebp - 0x40]
call fcn.00420a00
mov byte [ebp - 4], 1
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.00420900
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x439fcd
mov eax, dword [eax]
mov edx, eax
mov ecx, esi
call fcn.00496890
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 8
jb 0x439feb
push dword [ebp - 0x28]
call fcn.00633f98
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov byte [ebp - 4], al
cmp dword [ebp - 0x2c], 8
jb 0x43a013
push dword [ebp - 0x40]
call fcn.00633f98
add esp, 4
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x44], 8
jb 0x43a03f
push dword [ebp - 0x58]
call fcn.00633f98
add esp, 4
xor eax, eax
mov word [ebp - 0x58], ax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x48], 0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00633732
mov esp, ebp
pop ebp
ret
Function at 0x43ae70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
test byte [ebp + 0x10], 0xf
je 0x43ae7d
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
mov dword [ebp + 0x10], 0
call fcn.0043a400
mov edi, eax
test edi, edi
je 0x43aeef
mov esi, dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [ebp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x43aeef
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x43aeef
mov ecx, dword [ebp + 0xc]
call fcn.0043a5b0
mov edx, dword [ebp + 0x10]
mov esi, eax
push esi
mov ecx, edi
call fcn.0043a6d0
add esp, 4
mov edi, eax
test esi, esi
je 0x43aee9
mov ecx, dword [esi]
push esi
call dword [ecx + 4]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x43b670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ebx, [ecx + 8]
cmp eax, 8
jb 0x43b726
shr eax, 3
mov dword [ebp - 4], eax
movzx eax, byte [edi + 7]
cdq
mov ecx, eax
movzx eax, byte [edi + 6]
mov esi, edx
shld esi, ecx, 8
shl ecx, 8
cdq
or ecx, eax
movzx eax, byte [edi + 5]
or esi, edx
shld esi, ecx, 8
shl ecx, 8
cdq
or ecx, eax
movzx eax, byte [edi + 4]
or esi, edx
shld esi, ecx, 8
shl ecx, 8
cdq
or ecx, eax
movzx eax, byte [edi + 3]
or esi, edx
shld esi, ecx, 8
shl ecx, 8
cdq
or ecx, eax
movzx eax, byte [edi + 2]
or esi, edx
shld esi, ecx, 8
cdq
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
or esi, edx
shld esi, ecx, 8
cdq
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
or esi, edx
shld esi, ecx, 8
cdq
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 0xc]
xor dword [ebx], ecx
or esi, edx
xor dword [ebx + 4], esi
sub eax, 8
add ebx, 8
add edi, 8
dec dword [ebp - 4]
mov dword [ebp + 0xc], eax
jne 0x43b691
test eax, eax
je 0x43b811
dec eax
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
cmp eax, 6
ja case.default.0x43b740
jmp dword [eax*4 + 0x43b81c]
movzx eax, byte [edi + 6]
cdq
mov ecx, eax
movzx eax, byte [edi + 5]
cdq
shl eax, 8
shl ecx, 0x10
or ecx, eax
movzx eax, byte [edi + 4]
cdq
xor esi, esi
or ecx, eax
jmp 0x43b794
movzx eax, byte [edi + 5]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
cdq
shl eax, 8
or ecx, eax
movzx eax, byte [edi + 4]
cdq
or ecx, eax
jmp 0x43b794
movzx eax, byte [edi + 4]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
cdq
or ecx, eax
jmp 0x43b794
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
movzx eax, byte [edi + 3]
cdq
shld edx, eax, 0x18
shl eax, 0x18
or esi, eax
or ecx, edx
jmp 0x43b7ac
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
movzx eax, byte [edi + 2]
cdq
shld edx, eax, 0x10
shl eax, 0x10
or esi, eax
or ecx, edx
jmp 0x43b7c4
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
movzx eax, byte [edi + 1]
cdq
shld edx, eax, 8
shl eax, 8
or esi, eax
movzx eax, byte [edi]
or ecx, edx
cdq
or esi, eax
xor dword [ebx], esi
or ecx, edx
xor dword [ebx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, byte [edi]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cdq
or esi, eax
xor dword [ebx], esi
or ecx, edx
xor dword [ebx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor dword [ebx], esi
xor dword [ebx + 4], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43be30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
mov eax, dword [0x76f950]
xor eax, esp
mov dword [esp + 0x90], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x3f
mov dword [esp + 0x14], eax
lea eax, [esp + 0x5d]
push 0
push eax
mov dword [esp + 0x18], esi
mov byte [esp + 0x64], 0
call fcn.0063ac00
mov ecx, dword [ebp + 0x10]
add esp, 0xc
test ecx, ecx
je 0x43bf1e
mov edx, dword [ebp + 0x14]
lea edi, [esi + 0x14]
mov eax, edx
and eax, 0x3f
mov dword [esp + 0x14], eax
mov ebx, 0x40
sub ebx, eax
cmp ebx, ecx
cmova ebx, ecx
mov eax, edx
xor edx, edx
xor edx, dword [esi + 0xc]
shr eax, 6
xor eax, dword [esi + 8]
mov esi, edi
mov ecx, 0x10
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0xc]
not edx
push dword [esi + 0x10]
not eax
mov dword [esp + 0x50], edx
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x5c]
mov dword [esp + 0x4c], eax
call fcn.0043c420
mov edi, dword [esp + 0x14]
add esp, 4
mov edx, ebx
mov eax, edi
test ebx, ebx
je 0x43beff
mov ecx, dword [esp + 0x14]
sub ecx, edi
lea esi, [esp + 0x58]
add esi, ecx
lea esp, [esp]
mov cl, byte [esi + eax]
xor byte [eax], cl
lea eax, [eax + 1]
dec edx
jne 0x43bef0
mov esi, dword [esp + 0xc]
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
add edi, ebx
add edx, ebx
sub ecx, ebx
mov dword [esp + 0x10], edi
mov dword [ebp + 0x14], edx
mov dword [ebp + 0x10], ecx
lea edi, [esi + 0x14]
jne 0x43be82
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00633732
mov esp, ebp
pop ebp
ret
Function at 0x43d1f0
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, ecx
mov ecx, 0x5a4d
mov dword [ebp - 4], eax
cmp word [eax], cx
je 0x43d216
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x43d235
mov eax, 0x14c
cmp word [ebx + 4], ax
jne 0x43d235
test byte [ebx + 0x38], 1
je 0x43d247
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x3000
push dword [ebx + 0x50]
push dword [ebx + 0x34]
call edi
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
jne 0x43d27d
push 4
push 0x3000
push dword [ebx + 0x50]
push eax
call edi
mov esi, eax
mov dword [ebp - 8], eax
test esi, esi
je 0x43d2a1
push 0x34
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x43d2b2
push 0x8000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi + 4], esi
movzx eax, word [ebx + 0x16]
shr eax, 0xd
and eax, 1
mov dword [edi + 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [edi + 0x1c], 0x43d1b0
mov dword [edi + 0x20], 0x43d1c0
mov dword [edi + 0x24], 0x43d1e0
mov dword [edi + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [ebp - 0x28]
push 4
push 0x1000
mov dword [edi + 0x30], eax
push dword [ebx + 0x54]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [ebx + 0x54]
mov esi, eax
push dword [ebp - 4]
push esi
call fcn.0063a5b0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
add eax, esi
mov esi, dword [ebp - 8]
mov dword [edi], eax
push edi
mov edx, ebx
mov dword [eax + 0x34], esi
call fcn.0043cc80
add esp, 0x10
test eax, eax
je 0x43d391
mov edx, esi
sub edx, dword [ebx + 0x34]
je 0x43d342
mov ecx, edi
call fcn.0043cf90
mov dword [edi + 0x18], eax
jmp 0x43d349
mov dword [edi + 0x18], 1
mov ecx, edi
call fcn.0043d040
test eax, eax
je 0x43d391
mov ecx, edi
call fcn.0043ce10
test eax, eax
je 0x43d391
mov ecx, edi
call fcn.0043cf50
test eax, eax
je 0x43d391
mov eax, dword [edi]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x43d3bd
add eax, esi
cmp dword [edi + 0x14], 0
je 0x43d3b1
push 0
push 1
push esi
call eax
test eax, eax
jne 0x43d3a1
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call fcn.0043d480
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi + 0x10], 1
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi + 0x2c], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi + 0x2c], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d760
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69e1f1
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x76f950]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 2
cmp byte [esi + 1], 0
je 0x43d7a2
lea ecx, [esi + 8]
mov byte [esi + 1], 0
call fcn.004219b0
cmp byte [esi], 0
je 0x43d7e8
mov byte [esi], 0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43d7bd
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43d7c2
lea eax, [ecx + 8]
jmp 0x43d7c2
mov eax, 0x6f4744
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x43d7dc
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43d7e1
lea eax, [ecx + 8]
jmp 0x43d7e1
mov eax, 0x6f4744
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x43d803
mov eax, dword [ecx]
test eax, eax
jne 0x43d800
call fcn.004df580
jmp 0x43d803
dec eax
mov dword [ecx], eax
mov byte [ebp - 4], 0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43d81e
mov eax, dword [ecx]
test eax, eax
jne 0x43d81b
call fcn.004df580
jmp 0x43d81e
dec eax
mov dword [ecx], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x43d84a
mov eax, dword [ecx]
test eax, eax
jne 0x43d847
call fcn.004df580
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
dec eax
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43dbc0
Capabilities:
Delete directory
Delete file

Disassembly:
push esi
mov esi, ecx
cmp byte [esi], 0
je 0x43dc10
mov byte [esi], 0
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43dbde
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43dbe3
lea eax, [ecx + 8]
jmp 0x43dbe3
mov eax, 0x6f4744
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x43dc04
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43dc09
lea eax, [ecx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop esi
ret
mov eax, 0x6f4744
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop esi
ret
Function at 0x43f540
Capabilities:
Create process memory minidump

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69e94b
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x76f950]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x434], ecx
mov eax, dword [0x789164]
mov ecx, dword [0x789160]
test eax, eax
cmovne ecx, eax
mov dword [ebp - 0x438], ecx
lea ecx, [ebp - 0x43c]
call fcn.00453230
mov dword [ebp - 4], 0
mov eax, dword [eax]
test eax, eax
je 0x43f5ac
mov esi, dword [eax + 4]
test esi, esi
jne 0x43f5b1
lea esi, [eax + 8]
jmp 0x43f5b1
mov esi, 0x6f4744
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x43c]
test eax, eax
je 0x43f5d4
mov ecx, dword [eax]
test ecx, ecx
jne 0x43f5d1
mov ecx, eax
call fcn.004df580
jmp 0x43f5d4
dec ecx
mov dword [eax], ecx
call fcn.00430530
cmp dword [0x7766b0], 8
mov eax, 0x77669c
cmovae eax, dword [0x77669c]
lea edx, [ebp - 0x420]
movzx ecx, word [eax]
test cx, cx
je 0x43f611
lea ebx, [ebx]
lea eax, [eax + 2]
mov word [edx], cx
movzx ecx, word [eax]
add edx, 2
test cx, cx
jne 0x43f600
xor eax, eax
mov word [edx], ax
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
movzx eax, word [ebp - 0x424]
push eax
movzx eax, word [ebp - 0x426]
push eax
movzx eax, word [ebp - 0x428]
push eax
movzx eax, word [ebp - 0x42a]
push eax
movzx eax, word [ebp - 0x42e]
push eax
movzx eax, word [ebp - 0x430]
push eax
push esi
push dword [ebp - 0x438]
lea eax, [ebp - 0x420]
push eax
push str._s_s_s__04d_02d_02d__02d_02d_02d__ld__ld.dmp
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0043eae0
add esp, 0x38
lea eax, [ebp - 0x218]
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x434]
push 0
push 0
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x448]
push eax
push 1
push esi
mov dword [ebp - 0x440], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00633732
mov esp, ebp
pop ebp
ret