joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bb14
Capabilities:
Hash data with md5

Disassembly:
push ebx
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov edx, 0x40
lea ecx, [eax + 0x18]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x42bb27
mov edx, 0x10
lea ecx, [eax + 0x58]
xor ebx, ebx
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0x42bb36
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebx
ret

Function at 0x42c808
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
xor eax, eax
push ebp
push 0x42c9bf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00404698
add eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp + 8]
call fcn.004043bc
test esi, esi
jbe 0x42c98e
push esi
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x42c98e
mov esi, dword [ebp - 0x38]
jmp 0x42c967
push 0x1c
lea eax, [ebp - 0x5c]
push eax
push esi
push edi
call sub.kernel32.dll_VirtualQueryEx
test eax, eax
jne 0x42c8a4
call sub.kernel32.dll_GetLastError
add esi, dword [ebp - 0x3c]
jmp 0x42c967
cmp ebx, dword [ebp - 0x50]
jae 0x42c8d5
mov eax, dword [ebp - 0x50]
xor edx, edx
push edx
push eax
push 0
push 0x10000
call fcn.0041a6e4
mov ebx, eax
push ebx
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x42c7e4]
call fcn.00405914
add esp, 4
lea eax, [ebp - 0x10]
push eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x50]
xor edx, edx
push edx
push eax
call fcn.0041a6e4
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x42c95e
cmp dword [ebp - 0x10], 0x400
jbe 0x42c95e
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404698
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
mov ecx, dword [ebp - 0x14]
pop edx
call fcn.0042c6ec
test eax, eax
je 0x42c95e
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
call fcn.004046a0
mov eax, dword [ebp + 8]
cmp dword [ebp - 8], 0
je 0x42c95e
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.00404980
test eax, eax
jg 0x42c98e
lea eax, [ebx + esi]
cmp esi, eax
ja 0x42c970
add esi, ebx
cmp esi, dword [ebp - 0x34]
jb 0x42c886
push 0
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x42c7e4]
call fcn.00405914
add esp, 4
push edi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c9c6
lea eax, [ebp - 0x18]
call fcn.004043bc
lea eax, [ebp - 0x14]
mov edx, dword [0x42c7e4]
call fcn.00405920
lea eax, [ebp - 8]
mov edx, 2
call fcn.004043e0
ret
Function at 0x42d450
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x42d57a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
push ebp
push 0x42d54f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
push esi
mov eax, dword [0x4565f0]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x42d4b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42d564
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
cmp al, 0xe9
jne 0x42d4c9
pop dword fs:[0]
add esp, 8
jmp 0x42d564
cmp al, 0xff
jne 0x42d4da
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42d564
mov edi, ebx
sub edi, dword [ebp - 0x10]
sub edi, 5
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, 0xff
call fcn.00402a30
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov edx, ebx
add edx, 5
mov eax, dword [ebp - 0x10]
call fcn.0042d590
mov edx, ebx
add edx, 4
mov byte [edx], al
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
mov eax, dword [ebp - 0x10]
inc eax
mov dword [eax], edi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 5
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
add ebx, 5
mov eax, dword [ebp + 8]
mov dword [eax], ebx
push esi
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42d560
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d581
lea eax, [ebp - 4]
call fcn.004043bc
ret

Function at 0x42d854
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x42d863
or edx, 0x200
test eax, 0x20000000
je 0x42d897
test eax, 0x40000000
je 0x42d882
test eax, 0x80000000
je 0x42d87d
or edx, 0x40
jmp 0x42d8be
or edx, 0x20
jmp 0x42d8be
test eax, 0x80000000
je 0x42d891
or edx, 0x80
jmp 0x42d8be
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x42d8af
test eax, 0x80000000
je 0x42d8aa
or edx, 4
jmp 0x42d8be
or edx, 2
jmp 0x42d8be
test eax, 0x80000000
je 0x42d8bb
or edx, 8
jmp 0x42d8be
or edx, 1
mov eax, edx
ret
Function at 0x42f65c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
cmp byte [0x457c8c], 0
je 0x42f68c
mov edx, 0xc8
mov eax, 0x32
call fcn.0041a724
push eax
call sub.kernel32.dll_Sleep
cmp bl, 0x90
jne 0x42f6cf
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp al, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_GetKeyboardState
test bl, bl
je 0x42f6ba
and byte [ebp - 0x72], 0xfe
jmp 0x42f6be
or byte [ebp - 0x72], 1
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_SetKeyboardState
jmp 0x42f755
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov byte [ebp - 2], al
test si, si
jbe 0x42f755
mov eax, ebx
and eax, 0xff
bt dword [0x455944], eax
jae 0x42f725
mov eax, dword [ebp + 8]
push eax
mov ecx, 1
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.0042f610
pop ecx
cmp byte [ebp - 1], 0
je 0x42f750
mov eax, dword [ebp + 8]
push eax
mov ecx, 3
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.0042f610
pop ecx
jmp 0x42f750
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.0042f610
pop ecx
cmp byte [ebp - 1], 0
je 0x42f750
mov eax, dword [ebp + 8]
push eax
mov ecx, 2
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.0042f610
pop ecx
dec si
jne 0x42f6e5
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42f75c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
cmp byte [0x457c8c], 0
je 0x42f780
mov edx, 0xc8
mov eax, 0x32
call fcn.0041a724
push eax
call sub.kernel32.dll_Sleep
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov edx, ebx
and edx, 0xff
bt dword [0x455944], edx
jae 0x42f7b2
mov edx, dword [ebp + 8]
push edx
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.0042f610
pop ecx
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
mov ecx, 2
mov edx, eax
mov eax, ebx
call fcn.0042f610
pop ecx
pop ebx
pop ebp
ret
Function at 0x42fd88
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
xor ecx, ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
xor eax, eax
push ebp
push 0x42fe90
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.004030e4
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 1
mov eax, 0x42fea0
mov dword [ebp - 0x44], eax
push 0x42feb4
push dword [ebp - 4]
push 0x42fed4
push dword [ebp - 8]
lea eax, [ebp - 0x60]
mov edx, 4
call fcn.00404758
mov eax, dword [ebp - 0x60]
call fcn.0043ca3c
cmp dword [ebp - 8], 0
jne 0x42fe1c
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404454
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x42fe50
mov ebx, dword [ebp - 0x54]
jmp 0x42fe68
lea eax, [ebp - 0x64]
mov ecx, dword [ebp - 4]
mov edx, 0x42feec
call fcn.004046e4
mov eax, dword [ebp - 0x64]
call fcn.0043ca3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fe97
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.004043e0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004043e0
ret

Function at 0x42ff10
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42ffae
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00406f28
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 2
lea eax, [ebp - 0x24]
mov ecx, 0x42ffc8
mov edx, ebx
call fcn.004046e4
mov eax, dword [ebp - 0x24]
call fcn.00404898
mov dword [ebp - 0x16], eax
lea eax, [ebp - 0x28]
mov ecx, 0x42ffc8
mov edx, esi
call fcn.004046e4
mov eax, dword [ebp - 0x28]
call fcn.00404898
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x614
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ffb5
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004043e0
ret

Function at 0x430e48
Capabilities:
Log keystrokes

Disassembly:
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
ret
Function at 0x4311d4
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43129f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00443fb0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, 0x4312b4
call fcn.004046e4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004454a4
test al, al
jne 0x431284
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x431265
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 7
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00405408
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43126c
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4312a6
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004043e0
ret

Function at 0x4313d4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43148c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x4314a0
call fcn.004457d4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004454a4
test al, al
jne 0x43145e
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x431457
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 5
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00405408
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43145e
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040c7e4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00404410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431493
lea eax, [ebp - 0xc]
call fcn.004043bc
ret
Function at 0x431b28
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x431c43
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004043bc
mov eax, dword [ebp - 4]
call fcn.00444fbc
test al, al
je 0x431c2d
mov al, 2
call fcn.00433c24
mov ebx, 0x46
mov esi, 0x9d
mov edi, 0x8c
push 1
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.004314e4
push 0
push 0
mov eax, dword [ebp - 0x24]
call fcn.00418418
lea eax, [ebp - 0x24]
push eax
push 0
push 0x457d08
mov ecx, 0x43153c
xor edx, edx
xor eax, eax
call fcn.00404370
mov ebx, eax
mov edx, 0xbb8
mov eax, ebx
call fcn.004448b0
xor edx, edx
push ebp
push 0x431c26
push dword fs:[edx]
mov dword fs:[edx], esp
sub eax, 1
jae 0x431c08
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x431bee
cmp eax, 0
jbe 0x431c10
jmp 0x431bf0
jle 0x431c10
mov ebx, dword [ebp - 0x24]
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [ebx + 4]
mov eax, dword [ebp - 8]
call fcn.004044ac
jmp 0x431c10
push 0
push ebx
call sub.kernel32.dll_TerminateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431c2d
mov eax, dword [ebp - 0x24]
call fcn.00403698
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431c4a
lea eax, [ebp - 4]
call fcn.004043bc
ret
Function at 0x432c28
Capabilities:
Terminate thread

Disassembly:
push 0
mov eax, dword [0x457cfc]
push eax
call sub.kernel32.dll_TerminateThread
mov dl, 1
mov eax, 0x432c54
call fcn.00441f7c
mov byte [0x457cf8], 0
ret

Function at 0x43397c
Capabilities:
Terminate thread

Disassembly:
push 0
mov eax, dword [0x457d00]
push eax
call sub.kernel32.dll_TerminateThread
push 0
mov eax, dword [0x457d04]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [0x457cf9], 0
mov byte [0x457d28], 1
ret

Function at 0x433a50
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x433b7f
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040c7d0
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x148]
mov ecx, 0x433b98
mov edx, dword [ebp - 4]
call fcn.004046e4
mov eax, dword [ebp - 0x148]
call fcn.00404898
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x433b59
test byte [ebp - 0x144], 0x10
je 0x433b37
cmp byte [ebp - 0x118], 0x2e
je 0x433b38
mov edx, 0x433b9c
lea eax, [ebp - 0x118]
call fcn.00408c40
test eax, eax
je 0x433b38
mov edx, 0x433ba0
lea eax, [ebp - 0x118]
call fcn.00408c40
test eax, eax
je 0x433b38
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.0040462c
mov ecx, dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
mov edx, dword [ebp - 4]
call fcn.004046e4
mov eax, dword [ebp - 0x14c]
call fcn.00433a50
add esi, eax
jmp 0x433b38
inc esi
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x433ac4
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433b86
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.004043e0
lea eax, [ebp - 4]
call fcn.004043bc
ret
Function at 0x433da4
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x433eef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004043bc
cmp dword [ebp - 4], 0
jne 0x433de6
push 0
call sub.user32.dll_GetDC
mov ebx, eax
jmp 0x433dfc
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.gdi32.dll_CreateDCA
mov ebx, eax
test ebx, ebx
jne 0x433e0f
mov eax, 0x433f08
call fcn.0043ca3c
jmp 0x433ed9
push 8
push ebx
call sub.gdi32.dll_GetDeviceCaps
push 0xa
push ebx
call sub.gdi32.dll_GetDeviceCaps
push ebx
push 0
call sub.user32.dll_ReleaseDC
mov dl, 1
mov eax, dword [0x4266a0]
call fcn.00429cd0
mov ebx, eax
xor ecx, ecx
mov dl, byte [ebp - 5]
mov eax, ebx
call fcn.004310fc
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, esi
call fcn.004314e4
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x58]
push 1
call sub.kernel32.dll_Sleep_1
cmp byte [0x457d2e], 0
jne 0x433e60
mov byte [0x457d2d], 1
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [0x45665c]
push eax
mov ecx, 0x431584
xor edx, edx
xor eax, eax
call fcn.00404370
mov esi, eax
mov edx, 0x1770
mov eax, esi
call fcn.004448b0
mov byte [0x457d2d], 0
sub eax, 1
jae 0x433ec2
mov esi, dword [ebp - 0x24]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [esi + 4]
mov eax, edi
call fcn.004044ac
jmp 0x433eca
push 0
push esi
call sub.kernel32.dll_TerminateThread
mov eax, ebx
call fcn.00403698
mov eax, dword [ebp - 0x24]
call fcn.00403698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433ef6
lea eax, [ebp - 4]
call fcn.004043bc
ret

Function at 0x434808
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x457d30]
mov edx, dword [eax]
call dword [edx + 0x44]
mov byte [0x457d2c], 0
push 0
mov eax, dword [0x457d38]
push eax
call sub.kernel32.dll_TerminateThread
ret
Function at 0x434860
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x434a6e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004043bc
push 0
push 0
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
xor edx, edx
mov eax, 0x3c
call fcn.004314e4
xor edx, edx
push ebp
push 0x434a4c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x456860]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x434a2e
inc esi
xor ebx, ebx
mov dl, 1
mov eax, dword [0x4266a0]
call fcn.00429cd0
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x28]
mov eax, dword [0x456860]
mov eax, dword [eax]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
call fcn.00408424
mov edx, dword [ebp - 8]
call fcn.0043098c
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0x29a
jl 0x434a1e
lea ecx, [ebp - 0x2c]
mov eax, dword [0x456860]
mov eax, dword [eax]
mov edx, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x2c]
call fcn.00408424
mov edx, dword [0x45657c]
mov dword [edx], eax
mov eax, dword [0x45657c]
mov eax, dword [eax]
call fcn.004309f8
test al, al
je 0x434948
mov eax, dword [0x45657c]
mov eax, dword [eax]
call fcn.004309ec
push 6
movzx eax, word [0x457d50]
push eax
movzx eax, word [0x457d4e]
push eax
push 0
push 0
push 0
mov eax, dword [0x45657c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowPos
mov eax, dword [0x45657c]
mov eax, dword [eax]
call fcn.00430544
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x43499d
cmp eax, 0x2710
jbe 0x434a2e
jmp 0x4349a3
jle 0x434a2e
mov eax, 1
call fcn.004443c4
mov eax, dword [0x456520]
cmp byte [eax], 0
jne 0x4349a3
mov eax, dword [0x45663c]
mov byte [eax], 1
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [0x456658]
push eax
mov ecx, 0x431560
xor edx, edx
xor eax, eax
call fcn.00404370
mov esi, eax
mov edx, 0x1770
mov eax, esi
call fcn.004448b0
mov edx, dword [0x45663c]
mov byte [edx], 0
sub eax, 1
jae 0x434a0d
mov esi, dword [ebp - 0x24]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [esi + 4]
mov eax, dword [ebp - 4]
call fcn.004044ac
jmp 0x434a2e
push 0
push esi
call sub.kernel32.dll_TerminateThread
push 0
call sub.kernel32.dll_ExitThread_1
mov eax, dword [ebp - 8]
call fcn.00403698
inc ebx
dec esi
jne 0x4348c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434a53
mov eax, dword [ebp - 8]
call fcn.00403698
mov eax, dword [ebp - 0x24]
call fcn.00403698
ret
Function at 0x436028
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x436214
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x456890]
mov eax, dword [eax]
call fcn.00444fbc
test al, al
je 0x43606c
mov eax, dword [0x456890]
mov eax, dword [eax]
call fcn.00445990
lea eax, [ebp - 0xc]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004048f8
mov eax, dword [ebp - 0xc]
mov edx, 0x436228
call fcn.004047e4
je 0x4360a0
mov eax, 0x436234
call fcn.0043cb3c
jmp 0x4361f9
test bl, bl
je 0x4360bc
mov eax, dword [0x456668]
mov eax, dword [eax]
call fcn.00441c9c
mov eax, dword [0x4566f8]
mov eax, dword [eax]
call fcn.00441c9c
lea ecx, [ebp - 0x10]
mov eax, dword [0x4564e8]
mov eax, dword [eax]
mov edx, 0x43625c
call fcn.004172b4
mov eax, dword [ebp - 0x10]
call fcn.0043b408
test al, al
je 0x4361d1
lea ecx, [ebp - 0x14]
mov eax, dword [0x4564e8]
mov eax, dword [eax]
mov edx, 0x436268
call fcn.004172b4
mov eax, dword [ebp - 0x14]
call fcn.0043b408
test al, al
je 0x4361b1
lea eax, [ebp - 8]
call fcn.00444524
call fcn.00435eb4
test al, al
jne 0x436177
lea eax, [ebp - 0x18]
call fcn.0044411c
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, 6
call fcn.00443988
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.004046a0
mov eax, dword [ebp - 0x18]
call fcn.00404898
push eax
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
call sub.kernel32.dll_MoveFileA
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004450ac
test bl, bl
je 0x4361f9
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00445294
call fcn.004444cc
jmp 0x4361f9
mov ecx, dword [0x456534]
mov ecx, dword [ecx]
mov edx, dword [0x456720]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.004046e4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004450ac
test bl, bl
je 0x4361f9
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00445294
call fcn.004444cc
jmp 0x4361f9
push 0
push 0
push 0
lea eax, [ebp - 4]
call fcn.004048f0
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.0043ee18
call fcn.004444cc
jmp 0x4361f9
mov eax, 0x436274
call fcn.0043cb3c
push 0
push 0
push 0
lea eax, [ebp - 4]
call fcn.004048f0
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.0043ee18
call fcn.004444cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43621b
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004043e0
ret