joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44334a
Capabilities:
Read file on windows
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov dword [ebp - 0x14], ecx
mov ebx, 0x4681d8
mov ecx, ebx
call fcn.00443ae3
test eax, eax
jne 0x443383
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0x14]
push 0x45a5d8
push 0
push str.Cant_open_clipboard_for_writing.
call fcn.0044c1bc
jmp 0x4433c7
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [sym.imp.KERNEL32.DLL_ReadFile]
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x4433b1
cmp dword [ebp - 4], 4
jae 0x443461
push edi
mov ecx, ebx
call fcn.0044374a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
push edi
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x4434ce
cmp dword [ebp - 4], 4
jb 0x4434ce
push dword [ebp - 0x10]
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
cmp eax, edi
mov dword [ebp - 8], eax
je 0x44346c
cmp dword [ebp - 0x10], edi
je 0x44343b
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
cmp eax, edi
je 0x44348a
push edi
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x10]
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x4434bc
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jb 0x4434bc
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetClipboardData]
push edi
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x4434ce
cmp dword [ebp - 4], 4
jb 0x4434ce
cmp dword [ebp - 0xc], edi
jne 0x4433cc
jmp 0x4434ce
push edi
mov ecx, ebx
call fcn.0044374a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x45a5d8
push edi
push str.Out_of_memory.
jmp 0x4434af
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push edi
mov ecx, ebx
call fcn.0044374a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x45a5d8
push edi
push 0x45a768
mov ecx, dword [ebp - 0x14]
call fcn.0044c1bc
jmp 0x4433c5
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push edi
mov ecx, ebx
call fcn.0044374a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0xc], edi
jne 0x4433c2
mov ecx, dword [0x467b78]
push 1
push edi
push 0xffffffffffffffff
push 0x45a734
call fcn.0040184e
jmp 0x4433c5
Function at 0x443502
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov esi, 0x4681d8
mov ecx, esi
call fcn.00443ae3
test eax, eax
jne 0x443533
push 0x45a5d8
push eax
push str.Cant_open_clipboard_for_reading.
mov ecx, edi
call fcn.0044c1bc
jmp 0x4436f2
mov ecx, dword [0x467b78]
push ebx
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x45bf4c
call fcn.0040184e
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
push ebx
jne 0x443574
mov ecx, esi
call fcn.0044374a
jmp 0x4436f1
mov byte [ebp - 2], bl
mov byte [ebp - 3], bl
mov byte [ebp - 4], bl
mov dword [ebp - 8], ebx
jmp 0x44368c
cmp eax, 1
je 0x443597
cmp eax, 7
je 0x443597
cmp eax, 0xd
mov byte [ebp + 0xb], bl
jne 0x44359b
mov byte [ebp + 0xb], 1
cmp eax, 8
je 0x4435a8
cmp eax, 0x11
mov byte [ebp - 1], bl
jne 0x4435ac
mov byte [ebp - 1], 1
cmp eax, 0xe
je 0x4435ba
cmp eax, 3
je 0x4435ba
xor cl, cl
jmp 0x4435bc
mov cl, 1
cmp byte [ebp + 0xb], bl
je 0x4435ca
cmp byte [ebp - 2], bl
jne 0x44368b
cmp byte [ebp - 1], bl
je 0x4435d8
cmp byte [ebp - 3], bl
jne 0x44368b
cmp cl, bl
je 0x4435e5
cmp byte [ebp - 4], bl
jne 0x44368b
cmp byte [ebp + 0xb], bl
je 0x4435f0
mov byte [ebp - 2], 1
jmp 0x443603
cmp byte [ebp - 1], bl
je 0x4435fb
mov byte [ebp - 3], 1
jmp 0x443603
cmp cl, bl
je 0x443603
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.004439a1
mov edi, eax
cmp edi, ebx
je 0x443688
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalSize]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x44362d
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x443688
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x44369f
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x44369f
cmp dword [ebp - 0x10], ebx
je 0x443688
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
cmp esi, ebx
mov esi, 0x4681d8
je 0x4436ab
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_EnumClipboardFormats]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x443585
jmp 0x4436ab
cmp dword [ebp - 0x10], ebx
je 0x4436ab
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push ebx
mov ecx, esi
call fcn.0044374a
cmp dword [ebp - 8], ebx
jne 0x4436e5
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x4436e5
mov ecx, dword [0x467b78]
push 1
push ebx
push 0xffffffffffffffff
push 0x45a734
call fcn.0040184e
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x443796
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x4437b8
call fcn.00443ae3
test eax, eax
jne 0x4437b8
push str.Cant_open_clipboard_for_writing.
jmp 0x443845
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x4437d1
push ebx
mov ecx, esi
call fcn.0044374a
push 0x45a7f4
jmp 0x443845
mov ecx, dword [esi + 4]
cmp ecx, ebx
je 0x443815
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x443823
cmp byte [eax], bl
jne 0x4437f4
cmp dword [ebp + 8], 0xd
jne 0x4437ee
cmp byte [eax + 1], bl
jne 0x4437f4
mov byte [ebp - 1], 1
jmp 0x4437f7
mov byte [ebp - 1], bl
push ecx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
cmp byte [ebp - 1], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
je 0x443823
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov dword [esi + 4], eax
push ebx
mov ecx, esi
call fcn.0044374a
pop esi
pop ebx
leave
ret 4
push dword [esi + 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x443838
mov dword [esi + 4], ebx
jmp 0x443815
push ebx
mov ecx, esi
call fcn.0044374a
push 0x45a7e0
mov ecx, esi
call fcn.004436f8
jmp 0x44381d

Function at 0x4439a1
Capabilities:
Check for time delay via gettickcount
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
mov esi, dword [ebp + 8]
cmp esi, 0xc000
jb 0x443a56
cmp esi, 0xffff
ja 0x443a56
push 0x104
lea eax, [ebp - 0x10c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
push 0xb
lea eax, [ebp - 0x10c]
push str.Link_Source
push eax
call fcn.00442545
add esp, 0xc
test eax, eax
je 0x443a4f
lea eax, [ebp - 0x10c]
push str.ObjectLink
push eax
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x443a4f
lea eax, [ebp - 0x10c]
push str.OwnerLink
push eax
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x443a4f
lea eax, [ebp - 0x10c]
push str.Native
push eax
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x443a4f
lea eax, [ebp - 0x10c]
push str.Embed_Source
push eax
call fcn.00442502
test eax, eax
pop ecx
pop ecx
jne 0x443a5d
xor eax, eax
jmp 0x443ade
mov byte [ebp - 0x10c], 0
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call edi
push esi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 4], eax
jmp 0x443ad3
cmp dword [ebp + 8], 0xf
je 0x443adb
lea eax, [ebp - 0x10c]
push str.OwnerLink
push eax
call fcn.00442502
test eax, eax
pop ecx
pop ecx
je 0x443adb
mov eax, dword [0x465064]
cmp eax, 0xffffffff
je 0x443ab1
test eax, eax
je 0x443adb
call edi
mov ecx, dword [0x465064]
mov edx, dword [ebp - 4]
add ecx, edx
sub ecx, eax
cmp ecx, 5
jle 0x443adb
and dword [0x46506c], 0
push 1
push 0x8000012f
call fcn.0040de6e
pop ecx
pop ecx
push dword [ebp + 8]
mov dword [0x46506c], 1
call esi
test eax, eax
je 0x443a72
jmp 0x443add
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x443ae3
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ecx
cmp dword [ecx + 0x18], 0
mov dword [esp], ecx
je 0x443af2
xor eax, eax
inc eax
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push edi
call esi
push dword [0x467254]
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebx, eax
call edi
xor ebp, ebp
inc ebp
jmp 0x443b54
mov eax, dword [0x465064]
cmp eax, 0xffffffff
je 0x443b32
test eax, eax
je 0x443b63
call esi
mov ecx, dword [0x465064]
add ecx, ebx
sub ecx, eax
cmp ecx, 5
jle 0x443b63
and dword [0x46506c], 0
push ebp
push 0x8000012f
call fcn.0040de6e
pop ecx
pop ecx
push dword [0x467254]
mov dword [0x46506c], ebp
call edi
test eax, eax
je 0x443b13
mov eax, dword [esp + 0x10]
mov dword [eax + 0x18], ebp
mov eax, ebp
jmp 0x443b65
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x443ea6
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push esi
push edi
mov esi, ecx
jmp 0x443eb1
mov esi, dword [esi + 0xc]
cmp byte [esi + 0x17], 0
je 0x443eae
mov edi, dword [esp + 0x14]
cmp byte [edi + 0x17], 0
jne 0x443ec4
mov edi, dword [edi + 0xc]
mov ecx, edi
call fcn.00401dcc
xor ebx, ebx
inc ebx
cmp byte [esi + 0x17], bl
jne 0x443f13
push ebx
mov ecx, esi
call fcn.00401e61
cmp dword [edi + 8], eax
je 0x443f0f
push ebx
push 0
push dword [edi + 0xc]
mov ecx, esi
push 0
call fcn.0040184e
test eax, eax
je 0x443f60
mov eax, dword [edi + 0xc]
inc eax
push eax
push dword [edi + 8]
mov ecx, esi
push ebx
call fcn.00401e61
push eax
call fcn.004576b0
add esp, 0xc
or byte [esi + 0x15], bl
mov eax, ebx
jmp 0x443f60
mov ecx, 0x4681d8
call fcn.00443ae3
test eax, eax
jne 0x443f37
push 0x45a5d8
push str.Cant_open_clipboard_for_writing.
mov ecx, 0x467ce0
call fcn.0044c37d
jmp 0x443f60
push ebp
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [edi + 8]
mov eax, dword [edi + 0xc]
lea eax, [eax + esi + 1]
lea edi, [esi + 4]
cmp edi, eax
mov dword [esp + 0x18], eax
jbe 0x443f6b
push 0
mov ecx, 0x4681d8
call fcn.0044374a
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0x18]
mov esi, dword [esi]
test esi, esi
mov dword [esp + 0x10], esi
je 0x443f53
mov ecx, edi
add edi, 4
cmp edi, eax
ja 0x443f53
mov ebx, dword [ecx]
mov esi, edi
add edi, ebx
cmp edi, eax
ja 0x443f53
push ebx
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x443fd0
test ebx, ebx
je 0x443fba
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
test eax, eax
je 0x443ff5
push ebx
push esi
push eax
call fcn.004576b0
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov esi, edi
push ebp
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
lea edi, [esi + 4]
cmp edi, dword [esp + 0x18]
jbe 0x443f67
jmp 0x443f53
push 0
mov ecx, 0x4681d8
call fcn.0044374a
push 0x45a5d8
push str.Out_of_memory.
mov ecx, 0x467ce0
call fcn.0044c37d
jmp 0x443f5f
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push 0
mov ecx, 0x4681d8
call fcn.0044374a
push 0x45a5d8
push 0x45a768
jmp 0x443fe6
Function at 0x444014
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 0x28
call fcn.00444e8e
cmp byte [esp + 0x2c], al
mov byte [esp + 2], al
je 0x444211
test al, al
push esi
jne 0x444065
cmp byte [esp + 0x34], al
jne 0x444065
push 0x467248
xor esi, esi
push esi
push esi
push 0x44501c
push 0x2000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, esi
mov dword [0x468414], eax
je 0x4440fc
push 0xf
push eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
movzx esi, byte [esp + 0x30]
push ebx
xor eax, eax
xor ebx, ebx
cmp byte [esp + 0x38], al
push ebp
sete al
push edi
mov edi, 0x417
mov ebp, eax
push ebp
push esi
push edi
push dword [0x467248]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
test eax, eax
jne 0x4440a0
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc ebx
cmp ebx, 0x32
jl 0x44407f
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov byte [esp + 0x13], 0
call ebp
mov dword [esp + 0x18], eax
cmp byte [esp + 0x3c], 0
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
je 0x444106
push 1
push edi
push edi
xor esi, esi
push esi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x444137
cmp dword [esp + 0x24], esi
je 0x444166
mov byte [esp + 0x13], 1
call fcn.00444e8e
test al, al
jne 0x444166
cmp byte [esp + 0x40], al
jne 0x4441e2
mov byte [esp + 0x3c], al
jmp 0x4440b1
call fcn.00444e1b
jmp 0x444210
cmp byte [esp + 0x40], 0
je 0x44411a
call fcn.00444e8e
xor esi, esi
test al, al
je 0x444166
jmp 0x444137
lea eax, [esp + 0x14]
push eax
push dword [0x468414]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
cmp dword [esp + 0x14], 0x103
jne 0x444150
xor esi, esi
call ebp
sub eax, dword [esp + 0x18]
cmp eax, 0x1f4
ja 0x444166
push esi
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4440b1
push dword [0x468414]
call ebx
and dword [0x468414], 0
call fcn.00444e1b
xor esi, esi
cmp byte [esp + 0x40], 0
jne 0x4441db
cmp dword [0x467388], esi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateMutexA]
je 0x444192
test byte [esp + 0x12], 1
jne 0x4441a7
push str.AHK_Keybd
push esi
push esi
call edi
mov dword [0x4683f0], eax
jmp 0x4441a7
test byte [esp + 0x12], 1
je 0x4441a7
push dword [0x4683f0]
call ebx
mov dword [0x4683f0], esi
cmp dword [0x46738c], esi
je 0x4441c6
test byte [esp + 0x12], 2
jne 0x4441db
push str.AHK_Mouse
push esi
push esi
call edi
mov dword [0x4683f4], eax
jmp 0x4441db
test byte [esp + 0x12], 2
je 0x4441db
push dword [0x4683f4]
call ebx
mov dword [0x4683f4], esi
cmp byte [esp + 0x13], 0
je 0x44420d
push esi
fldz
push ecx
push ecx
fstp qword [esp]
push esi
push 0x10000
push 0x45bac0
mov dword [0x46506c], esi
call fcn.0043c205
add esp, 0x18
mov dword [0x46506c], 1
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x28
ret
Function at 0x44cf96
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov al, byte [0x465090]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x13], al
push edi
lea eax, [ebp - 0x14]
push eax
push esi
mov ebx, ecx
mov byte [ebp - 0x14], 0x20
mov byte [ebp - 0x12], 0x28
mov byte [ebp - 0x11], 9
mov byte [ebp - 0x10], 0x3c
mov byte [ebp - 0xf], 0x3e
mov byte [ebp - 0xe], 0x3a
mov byte [ebp - 0xd], 0x3d
mov byte [ebp - 0xc], 0x2b
mov byte [ebp - 0xb], 0x2d
mov byte [ebp - 0xa], 0x2a
mov byte [ebp - 9], 0x2f
mov byte [ebp - 8], 0x21
mov byte [ebp - 7], 0x7e
mov byte [ebp - 6], 0x26
mov byte [ebp - 5], 0x7c
mov byte [ebp - 4], 0x5e
mov byte [ebp - 3], 0
call fcn.00439b0d
test eax, eax
pop ecx
pop ecx
je 0x44d01a
cmp byte [eax], 0x3d
jne 0x44d013
cmp eax, esi
jbe 0x44d025
lea ecx, [eax - 1]
cmp byte [ecx], 0x2e
jne 0x44d013
mov eax, ecx
cmp eax, esi
jbe 0x44d025
dec eax
jmp 0x44d025
push esi
call fcn.00457cb0
pop ecx
lea eax, [eax + esi - 1]
push eax
push esi
call fcn.00439a59
mov edi, eax
sub eax, esi
inc eax
cmp eax, 0xfd
pop ecx
pop ecx
jbe 0x44d051
cmp byte [ebp + 0x10], 0
je 0x44d04d
push esi
push str.This_line_does_not_contain_a_recognized_action.
mov ecx, ebx
call fcn.0044c37d
xor eax, eax
jmp 0x44d061
inc eax
push eax
push esi
push dword [ebp + 8]
call fcn.00439851
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x44fbdd
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8958
call fcn.00458250
push esi
mov esi, dword [ecx + 8]
test esi, esi
je 0x44fc5e
lea ecx, [ebp - 0x8958]
call fcn.0043bb0e
mov al, byte [ebp + 8]
mov byte [ebp - 0x8114], al
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8110], eax
lea eax, [ebp - 0x8958]
push eax
push 0x45022c
mov dword [ebp - 0x8118], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x8128], 0
je 0x44fc5e
mov eax, dword [0x465108]
mov eax, dword [eax + 0x54]
cmp eax, 0xffffffff
jle 0x44fc5e
cmp eax, 0x19
jge 0x44fc54
cmp byte [0x468399], 0
je 0x44fc54
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x44fc5e
push 1
push eax
call fcn.0040de6e
pop ecx
pop ecx
xor eax, eax
inc eax
pop esi
leave
ret 8
Function at 0x450782
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x494]
xor ebx, ebx
cmp eax, ebx
mov byte [esi + 0x50], 1
mov byte [esi + 0x4ad], bl
mov byte [esi + 0x4ac], bl
je 0x4508ad
cmp byte [eax], bl
je 0x4508ad
push 0x10
call fcn.0044e80b
cmp eax, ebx
pop ecx
je 0x4507d0
mov dword [eax], 0x45a5d8
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x4507d2
xor eax, eax
cmp eax, ebx
mov dword [esi + 0x240], eax
je 0x4508ad
push ebx
push ebx
push dword [esi + 0x494]
mov ecx, esi
call fcn.004481e0
cmp eax, 1
jne 0x4508ad
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.0044b395
test eax, eax
je 0x4508ad
push ebx
push ebx
push dword [esi]
mov ecx, esi
call fcn.0044deb1
test eax, eax
je 0x4508ad
push dword [0x467c84]
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
inc dword [esi + 0x4c]
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.0044b395
test eax, eax
je 0x4508ad
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.0044b395
test eax, eax
je 0x4508ad
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0x240]
push ebx
push ebx
push ebx
push ebx
mov dword [eax + 4], ecx
push ebx
push dword [esi]
mov ecx, esi
call fcn.0044e24c
test eax, eax
je 0x4508ad
push ebx
push ebx
push ebx
push str.ErrorLevel
mov ecx, esi
call fcn.0040c0f7
cmp eax, ebx
mov dword [0x467b78], eax
je 0x4508ad
push 1
push ebx
push 0xffffffffffffffff
push 0x45a734
mov ecx, eax
call fcn.0040184e
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
push dword [ebp - 8]
call fcn.00415fbd
mov eax, dword [esi + 8]
pop ecx
jmp 0x4508b0
or eax, 0xffffffff
pop esi
pop ebx
leave
ret

Function at 0x450aba
Capabilities:
Encode data using xor

Disassembly:
push edi
push dword [esp + 0x10]
call fcn.00415fbd
xor edi, edi
pop ecx
cmp dword [esp + 0xc], edi
jbe 0x450ae4
push esi
mov eax, dword [esp + 0xc]
lea esi, [edi + eax]
call fcn.00415edb
xor byte [esi], al
inc edi
cmp edi, dword [esp + 0x10]
jb 0x450ace
pop esi
pop edi
ret 0xc

Function at 0x450f56
Capabilities:
Hash data using crc32b

Disassembly:
mov eax, ecx
push esi
push edi
mov edi, eax
or dword [eax + 0x400], 0xffffffff
xor esi, esi
mov edx, esi
push 8
shl edx, 0x18
pop ecx
test edx, 0x80000000
je 0x450f7f
add edx, edx
xor edx, 0x4c11db7
jmp 0x450f81
shl edx, 1
dec ecx
jne 0x450f6d
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x450f65
pop edi
pop esi
ret
Function at 0x457be0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x46b4e4], esi
push edi
jne 0x457c00
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x46b4e0], esi
mov byte [0x46b4dc], al
jne 0x457c66
mov ecx, dword [0x46ba90]
test ecx, ecx
je 0x457c47
mov eax, dword [0x46ba8c]
sub eax, 4
cmp eax, ecx
jmp 0x457c40
mov eax, dword [eax]
test eax, eax
je 0x457c32
call eax
mov eax, dword [0x46ba8c]
sub eax, 4
cmp eax, dword [0x46ba90]
mov dword [0x46ba8c], eax
jae 0x457c2a
mov eax, 0x465040
mov esi, 0x465048
cmp eax, esi
mov edi, eax
jae 0x457c66
mov eax, dword [edi]
test eax, eax
je 0x457c5f
call eax
add edi, 4
cmp edi, esi
jb 0x457c57
mov eax, 0x46504c
mov esi, 0x465050
cmp eax, esi
mov edi, eax
jae 0x457c85
mov eax, dword [edi]
test eax, eax
je 0x457c7e
call eax
add edi, 4
cmp edi, esi
jb 0x457c76
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x457c9f
push dword [ebp + 8]
mov dword [0x46b4e4], 1
call fcn.0043e033
pop ebp
ret
Function at 0x10002620
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1003e030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov ebx, eax
call fcn.10002c70
test eax, eax
jne 0x100026ee
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 4
xor edi, edi
push eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
call fcn.10002fa0
push eax
push edi
lea eax, [esi + 0xcac]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100026d3
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push str.ErrLog
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100026c2
cmp dword [ebp - 8], 1
jne 0x100026c2
cmp dword [esi + 0xca4], edi
jne 0x100026bb
push dword [ebp - 0x10]
mov ecx, esi
call fcn.10002d40
mov dword [esi + 0xca4], 1
mov edi, 1
jmp 0x100026ca
mov dword [esi + 0xca4], edi
xor edi, edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi + 0xeb4], 1
jne 0x100026e9
push ecx
lea eax, [esi + 0x218]
push eax
call fcn.10002e50
test edi, edi
pop edi
je 0x10002701
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
push dword [ebp + 0xc]
push str._ERROR_
call fcn.10002720
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10018459
mov esp, ebp
pop ebp
ret
Function at 0x10002720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1003e030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov dword [ebp - 0x210], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebx + 0x218]
xor ecx, ecx
mov dword [ebp - 0x218], esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x21c], edi
cmp cx, word [eax]
je 0x10002778
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10002858
test al, 0x10
je 0x10002858
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0
push 0
push esi
push 0
push 0
call fcn.100011b0
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 2
push ecx
call fcn.1001eac6
mov esi, eax
add esp, 0x1c
or eax, 0xffffffff
test esi, esi
cmovs esi, eax
add esi, 0x43
test edi, edi
je 0x100027bf
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add esi, eax
cmp esi, 0x104
jbe 0x100027ec
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100184cd
add esp, 4
mov dword [ebp - 0x214], eax
mov edi, eax
jmp 0x100027f7
lea edi, [ebp - 0x20c]
mov esi, 0x104
push esi
push edi
lea eax, [ebx + 0xa18]
push eax
push dword [ebp - 0x210]
push dword [ebp - 0x218]
push dword [ebp - 0x21c]
call fcn.10002a50
mov eax, dword [ebx + 0xca8]
test eax, eax
jne 0x1000282e
mov ecx, ebx
call fcn.10002870
mov eax, dword [ebx + 0xca8]
cmp eax, 1
jne 0x10002845
test edi, edi
je 0x10002845
push edi
push 0x10035bcc
call fcn.10004c40
add esp, 8
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x10002858
push eax
call fcn.100184d6
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018459
mov esp, ebp
pop ebp
ret 0xc