joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431ac2
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x431b81
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x431b6e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x431b2e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x431b2c
push 0x47d
push 0
push 0x7e04
push 1
push 1
push 1
call fcn.0043dd9a
add esp, 0x18
jmp 0x431b6c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x431b6c
push 0
push 0x11af
push 0x2423
push 0x25c8
push 0xe5f
push 0x12e7
push 0xb3d
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x431b7f
push 1
push 1
push 0x2d70
call fcn.0042db89
add esp, 0xc
jmp 0x431bd9
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0xa7f
push dword [ebp - 0x2c]
push 0
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push 0x7d7f
push 0x1ba8
push dword [ebp - 0x3c]
call fcn.0042e668
add esp, 0x2c
mov esp, ebp
pop ebp
ret
Function at 0x431f44
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x43204f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x432027
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43200e
mov dword [ebp - 4], 0xe0a8eac8
mov dword [ebp - 8], 0
jmp 0x431faf
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x431fc2
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x60], 0xffffffff
jmp 0x431fa8
mov dword [ebp - 4], 3
jmp 0x431fd2
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x19
jge 0x431fe9
mov dword [ebp - 0x20], 0xd6887694
cmp dword [ebp - 0x20], 0
je 0x431fe7
jmp 0x431fe9
jmp 0x431fcb
mov dword [ebp - 4], 0
jmp 0x431ff9
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x43200c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x60], 0xd421
jmp 0x431ff2
jmp 0x432025
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
jmp 0x43204a
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 0
push dword [ebp - 0x34]
push 0
push 0x80c
push dword [ebp - 0x38]
call fcn.00436a94
add esp, 0x14
jmp 0x432103
lea eax, [ebp + 0xc]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x4320c0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x4320b1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x4320af
push 0
push 0
push 0
push 0x11eb
push 0x514f
call fcn.00430e6e
add esp, 0x14
jmp 0x4320be
push 0x1378
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x432103
push 0x3694
push 0x5069
push 0
push 0
push 0x6342
push 0x56a9
push 0x1e3b
push 0x4267
push 0x369a
push 0x6a8e
push 0x6421
push 0x1c85
push 0x95b
call fcn.0043c2ea
add esp, 0x34
mov esp, ebp
pop ebp
ret
Function at 0x434723
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x4347db
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4347b4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4347a0
mov byte [ebp - 1], 0
push 0x56e4
push 0x7e41
push 0
push 1
lea eax, [ebp - 1]
push eax
push 1
push 1
push 0x5d1a
push 1
push 0x720f
push 0xd9
push 0x714b
push 0x4f9e
call fcn.0043eb8a
add esp, 0x34
jmp 0x4347b2
push 0x900
push 0x30f
push 0
call dword [sym.imp.USER32.dll_InflateRect]
jmp 0x4347d9
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4347cc
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x4347d9
push 0xa4d
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
jmp 0x434800
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
push 0
push 0x4a67
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x20]
call fcn.0043baff
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x435822
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x4358d2
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x43585a
push 1
push 0x178a
call fcn.00435914
pop ecx
pop ecx
jmp 0x4358d0
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x435876
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x4358d0
mov dword [ebp - 0x20], 1
push 0x79b8
push 0x7e42
push 0x4b6e
push 0x73f7
push 0
push 0x54df
push 0
push 0x2ffb
push 0x4aaf
push 0x1052
push 0x3a51
push 1
push 1
push 0x6d3b
call fcn.00437458
add esp, 0x38
push 0
push 0x208e
push 1
call fcn.00437c16
add esp, 0xc
jmp 0x435910
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
push 1
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
push eax
push 0x4069
push 0x7a98
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 1
call fcn.0042f66d
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x435b8c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x435d3b
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x435ce5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x435cc7
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], 0x7790660d
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x28], 0x3421ad7b
mov dword [ebp - 4], 0x6c8a81d5
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], 0xa5c12438
mov dword [ebp - 0x2c], 0x9e7721ca
push 0x93
lea eax, [ebp - 0x18]
push eax
push 1
lea eax, [ebp - 0x1c]
push eax
push 1
push 0x63d9
lea eax, [ebp - 0x20]
push eax
push 0x1fe1
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x720c
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
push 1
call fcn.0043412c
add esp, 0x48
push 0x113d
push 0x2db
push 1
push 0x61e5
push 0
push 0x5d1c
push 0x44c7
lea eax, [ebp - 4]
push eax
push 0x3c1
push 1
push 0x2862
push 0x1b1
push 0x5eff
push 0
push 0x5ab7
push 0x10d0
push 0x265b
push 0
call fcn.0043412c
add esp, 0x48
jmp 0x435ce3
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x435ce3
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x435d39
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x435d24
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax]
test eax, eax
je 0x435d22
push 0
push 1
call fcn.0043530d
pop ecx
pop ecx
jmp 0x435d39
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [eax], 0
jmp 0x435d55
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x6c], eax
push dword [ebp - 0x6c]
push 0
push 1
push 0x2753
call fcn.00432843
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x437c33
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x437cd0
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x437c71
push 1
push 0x6705
call fcn.00437cec
pop ecx
pop ecx
jmp 0x437cce
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x437ca6
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x437ca4
push 1
push 0
push 0x2986
call fcn.0042db89
add esp, 0xc
jmp 0x437cce
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x437cce
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x437ce8
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
push 0x6244
push dword [ebp - 0x24]
push 0
call fcn.0043de76
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x437d14
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x437d47
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
push eax
push dword [ebp - 8]
push 0
call fcn.0043d82d
add esp, 0xc
jmp 0x437df8
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x437dd9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x437db7
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x437db5
push 0
push 0x5f22
push 0x377e
call fcn.0043869f
add esp, 0xc
jmp 0x437dd7
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x437dd7
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x437df8
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push 1
push 0x1dd9
push 0
push dword [ebp - 0x3c]
push 0x59c4
call fcn.00436a94
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x438c0f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x438cc0
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x438cad
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x438ca5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x438c75
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jg 0x438ca3
push 1
push 0x2b04
push 0xd79
push 0x602
push 1
push 1
push 1
push 0x4085
call fcn.00430a89
add esp, 0x20
jmp 0x438c6a
jmp 0x438cab
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x438cbe
push 1
push 0x298e
push 1
call fcn.0042df44
add esp, 0xc
jmp 0x438d2a
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x438cec
push 1
push 0x2dea
call fcn.0043544c
pop ecx
pop ecx
jmp 0x438d2a
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x438d20
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x438d1e
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
jmp 0x438d2a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov esp, ebp
pop ebp
ret
Function at 0x43a307
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x43a3f5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43a387
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43a37d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43a37b
push 0
push 0x560b
call fcn.0043a5e5
pop ecx
pop ecx
jmp 0x43a385
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x43a3f3
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x43a3cf
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43a3cd
push 0x7847
push 1
push 0x4f0b
push 1
push 0
push 1
push 0x5886
push 0x1b5c
call fcn.0043614b
add esp, 0x20
jmp 0x43a3f3
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x43a3f3
push 0x5a98
push 0
call fcn.0043be32
pop ecx
pop ecx
jmp 0x43a406
push 1
push 1
push 0x6297
call fcn.0042f4ec
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x43a64d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x43a6ed
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x43a6da
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43a6cd
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43a6cb
push 1
push 0x19f5
push 0x2ec0
push 0x7640
push 1
push 0
push 1
push 0x2be9
call fcn.00430a89
add esp, 0x20
jmp 0x43a6d8
push 0x9bd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x43a6eb
push 1
push 0
push 0x71b2
call fcn.0042db89
add esp, 0xc
jmp 0x43a719
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
push 1
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0x1f2a
push dword [ebp - 0x28]
push 0
call fcn.0043bea9
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x43add9
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x43af4d
lea eax, [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43af3a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43aeed
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x43ae6b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xfffffff1
jg 0x43aeeb
mov dword [ebp - 0x38], 0xfffffff7
push 0x3fad
push 0x2410
push 1
push 0x158a
push 0x7cf2
push 0x23cc
push 0x49dc
push 1
push 1
push 0x7358
push 0
call fcn.0042fabb
add esp, 0x2c
push 1
push 0x44cc
push dword [ebp - 0x34]
push 1
push 1
push 0xd39
lea eax, [ebp - 0x38]
push eax
push 1
push 0x2b81
push 0x567a
push 0x3a7
push 0x1155
push 1
push 1
call fcn.004312ac
add esp, 0x38
jmp 0x43ae60
jmp 0x43af38
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x43af0f
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x19
jl 0x43af38
push 0x7866
push 0
push 0
push 1
push 0x1735
push 1
push 0x5fc6
call fcn.0042d882
add esp, 0x1c
jmp 0x43af04
jmp 0x43af4b
push 0x5f7c
push 1
push 0
call fcn.00438d6a
add esp, 0xc
jmp 0x43afa7
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x43af83
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
push 0x7af2
push dword [ebp - 0x4c]
push 0
call fcn.0043367e
add esp, 0xc
jmp 0x43afa7
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x43af9f
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x43afa7
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
mov esp, ebp
pop ebp
ret
Function at 0x43b8f6
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43b92f
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
push 1
push dword [ebp - 0xc]
call fcn.0043b98e
add esp, 0x10
jmp 0x43b98a
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43b982
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43b96d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x43b980
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
and dword [eax + 4], 0
jmp 0x43b98a
push 0
call fcn.00432f80
pop ecx
mov esp, ebp
pop ebp
ret