joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408c50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b376
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x636b1c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0
push 0x404
push 0
lea eax, [ebp - 0x420]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x420], 0
mov byte [ebp - 4], 1
push 0x60
push 0
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call ebx
mov edi, eax
mov dword [ebp - 0x42c], edi
test edi, edi
jne 0x408d14
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x42c], eax
test edi, edi
jne 0x408d14
call fcn.00407040
mov esi, eax
jmp 0x408e0f
push dword [ebp - 0x428]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x408d37
call fcn.00407040
jmp 0x408e02
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x424], ebx
test ebx, ebx
jne 0x408d55
call fcn.00407040
jmp 0x408e02
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x428], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x408d76
mov esi, 0x8007000e
jmp 0x408e04
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x420]
call fcn.00406e20
mov dword [ebp - 4], 1
jmp 0x408db9
mov eax, dword [ebp - 0x420]
test eax, eax
jne 0x408dca
mov esi, 0x8007000e
jmp 0x408e04
push esi
push eax
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x408de5
call fcn.00407040
jmp 0x408e02
xor edx, edx
mov eax, dword [ebp - 0x420]
mov word [eax + ecx*2], dx
push dword [ebp + 0x14]
push dword [ebp - 0x420]
lea ecx, [ebp - 0x1c]
call fcn.004089b0
mov esi, eax
test edi, edi
je 0x408e0f
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x408e2c
lea ecx, [ebp - 0x420]
call fcn.00407ca0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004743e6
mov esp, ebp
pop ebp
ret 0x10
Function at 0x409a80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x409a99
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409aa5
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x409aa0
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x409b00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x409b15
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x409b20
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409b20
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x40c1d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b930
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x636b1c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
cmp byte [esi], 0
jne 0x40c24e
xorps xmm0, xmm0
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0
mov byte [esi], 1
lea eax, [ebp - 0x18]
push eax
push 0
push esi
push 0x40bfb0
push 0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004743e6
mov esp, ebp
pop ebp
ret

Function at 0x40c280
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b960
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x636b1c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
cmp byte [esi], 0
jne 0x40c300
xorps xmm0, xmm0
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0
mov byte [esi], 1
lea eax, [ebp - 0x18]
push eax
push 0
push esi
push 0x40c1c0
push 0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
jmp 0x40c311
xor al, al
jmp 0x40c313
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004743e6
mov esp, ebp
pop ebp
ret

Function at 0x40c330
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b990
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x636b1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
cmp byte [esi], 0
jne 0x40c390
mov eax, dword [esi + 4]
test eax, eax
je 0x40c375
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x40c3ac
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40c3cc
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c400
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49b9b0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x636b1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
cmp byte [esi], 0
jne 0x40c462
mov eax, dword [esi + 8]
test eax, eax
je 0x40c447
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esi], 0
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x40c47e
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x1c], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x40c49e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x14], eax
jmp 0x40c4b0
lea ecx, [esi + 0x20]
test eax, eax
je 0x40c4db
lea eax, [ebp - 0x14]
push eax
call fcn.00404890
mov edi, dword [eax]
test edi, edi
je 0x40c4d6
mov ecx, edi
call fcn.0040c330
push edi
call sub.mfc120u.dll_Ordinal_1508
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x40c4b0
call sub.mfc120u.dll_Ordinal_12482
xor eax, eax
mov word [esi + 2], ax
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4150c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49dd5d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x636b1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.mfc120u.dll_Ordinal_296]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push str.EurothermIDM.Mini8
call dword [sym.imp.mfc120u.dll_Ordinal_286]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
push eax
call dword [sym.imp.mfc120u.dll_Ordinal_1518]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.AppID
push SysReAllocStringLen
call esi
test eax, eax
jne 0x41520c
push str.0b76c9f6_94e0_4aa1_af17_13d031a3168f
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc120u.dll_Ordinal_286]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x14]
push eax
call dword [sym.imp.mfc120u.dll_Ordinal_1518]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc120u.dll_Ordinal_1658]
push eax
push dword [ebp - 0x20]
call esi
test eax, eax
jne 0x41520c
push str.Eurotherm_IDM_Mini8_Class
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc120u.dll_Ordinal_286]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
push eax
call dword [sym.imp.mfc120u.dll_Ordinal_1518]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc120u.dll_Ordinal_5787]
lea ecx, [ebp - 0x14]
lea eax, [eax*2 + 2]
push eax
call dword [sym.imp.mfc120u.dll_Ordinal_1658]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
push 1
push 0
push 0x4b4618
push dword [ebp - 0x1c]
call esi
test eax, eax
je 0x415223
cmp eax, 5
jne 0x415279
cmp byte [ebp + 8], 0
je 0x415279
call fcn.004162e0
mov esi, 0x80004005
jmp 0x415292
push str.Interactive_User
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc120u.dll_Ordinal_286]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x14]
push eax
call dword [sym.imp.mfc120u.dll_Ordinal_1518]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc120u.dll_Ordinal_5787]
lea ecx, [ebp - 0x14]
lea eax, [eax*2 + 2]
push eax
call dword [sym.imp.mfc120u.dll_Ordinal_1658]
push eax
push 1
push 0
push str.RunAs
push dword [ebp - 0x1c]
call esi
test eax, eax
je 0x415280
mov esi, 0x80004005
jmp 0x415292
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x20]
call esi
xor esi, esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004743e6
mov esp, ebp
pop ebp
ret
Function at 0x4162e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x636b1c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x41636f
push 0x3c
lea eax, [ebp - 0x248]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x248], 0x3c
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x23c], str.runas
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x234], str._REGSERVERASADMINISTRATOR
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x416383
push 0
push str.IDM_Registration_Error
push str.Permissions_Error_n_nUnable_to_register_IDM_on_this_computer_due_to_Windows_Administration_privileges_being_restricted_nThis_is_normal_for_Windows_7_and_later_n_nPlease_try_the_following:_n___Copy_to_the_computers_local_disk_and_try_again_n___Please_launch_a__Command_Prompt__using__Run_as_administrator__and_try_again
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004743e6
mov esp, ebp
pop ebp
ret

Function at 0x416450
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e059
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x636b1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0xf
mov eax, dword [ebp + 0x10]
jb 0x41649d
ja 0x416493
cmp eax, 0xffffffff
jbe 0x41649d
push 8
lea eax, [ebp + 0x10]
push eax
push 0xb
jmp 0x4164a8
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push 0
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc120u.dll_Ordinal_1658]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4164d1
cmp eax, 5
mov esi, 0x80070005
mov ecx, 0x80004005
cmovne esi, ecx
jmp 0x4164d3
xor esi, esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004743e6
mov esp, ebp
pop ebp
ret
Function at 0x416500
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x636b1c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x41658f
push 0x3c
lea eax, [ebp - 0x248]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x248], 0x3c
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x23c], str.runas
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x234], str._UNREGSERVERASADMINISTRATOR
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4165a3
push 0
push str.IDM_Registration_Error
push str.Permissions_Error_n_nUnable_to_unregister_IDM_on_this_computer_due_to_Windows_Administration_privileges_being_restricted___this_is_normal_for_Windows_7_and_later_n_nPlease_launch_a__Command_Prompt__using__Run_as_administrator__and_try_again
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004743e6
mov esp, ebp
pop ebp
ret
Function at 0x419230
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49e73c
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x636b1c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x4193c5
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x220]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4193b9
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4192a6
sub eax, edx
sar eax, 1
je 0x4193b9
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc120u.dll_Ordinal_286]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
push 0x4bd274
call dword [sym.imp.mfc120u.dll_Ordinal_2416]
push 0
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc120u.dll_Ordinal_1658]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call esi
push 0x4bd28c
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc120u.dll_Ordinal_2416]
push 0
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc120u.dll_Ordinal_1658]
push eax
call esi
push str.idm
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc120u.dll_Ordinal_2416]
push 0
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc120u.dll_Ordinal_1658]
push eax
call esi
push 0x4b46c0
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc120u.dll_Ordinal_2416]
push 0x4b57e8
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc120u.dll_Ordinal_2416]
push 0
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc120u.dll_Ordinal_1658]
push eax
call esi
push str.ESI
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc120u.dll_Ordinal_2416]
push 0
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc120u.dll_Ordinal_1658]
push eax
call esi
lea eax, [ebp - 0x21c]
push eax
lea ecx, [edi + 0x4c]
call dword [sym.imp.mfc120u.dll_Ordinal_1518]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
push dword [ebp - 0x220]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004743e6
mov esp, ebp
pop ebp
ret
Function at 0x4332c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x534], 0
je 0x433322
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x534]
cmp eax, ecx
jae 0x4332ef
test ecx, ecx
je 0x4332ef
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x534], eax
sub eax, dword [esi + 0x534]
cmp eax, 0x1b7740
jae 0x433322
add esi, 0x578
mov ecx, esi
call dword [sym.imp.mfc120u.dll_Ordinal_8064]
test al, al
jne 0x433322
push dword [ebp + 8]
push esi
call fcn.004042b0
add esp, 8
movzx eax, al
pop esi
pop ebp
ret 4
mov eax, 0x80004005
pop esi
pop ebp
ret 4

Function at 0x4355d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x636b1c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor bl, bl
cmp byte [esi + 0x4bc], bl
jne 0x435640
lea eax, [ebp - 8]
mov dword [ebp - 0x14], 0xc
push eax
push 0
push esi
push 0x432a90
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
movzx ecx, bl
mov dword [esi + 0x4c0], eax
mov edx, 1
cmovne ecx, edx
pop esi
mov al, cl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004743e6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.004743e6
mov esp, ebp
pop ebp
ret
Function at 0x44c950
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a4e31
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x636b1c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x28], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
mov byte [esi + 0x4bc], 0
mov byte [esi + 0x4c4], 0
mov byte [esi + 0x4b0], 0
mov eax, dword [esi + 0x4c0]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x44c9d1
push 0x3e8
push eax
call edi
cmp eax, 0xffffffff
jne 0x44c9d1
push 0
push dword [esi + 0x4c0]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x4c8]
test eax, eax
je 0x44c9f6
push 0x3e8
push eax
call edi
cmp eax, 0xffffffff
jne 0x44c9f6
push 0
push dword [esi + 0x4c8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
call fcn.00455c50
xor eax, eax
jmp 0x44ca66
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004743e6
mov esp, ebp
pop ebp
ret 8
Function at 0x4657d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x636b1c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x44]
push 0x20
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x48], esi
xor bl, bl
mov byte [ebp - 0x24], 0
push 0x18
push str.320_8rfuhKJHYed987sdUYT5
movdqu xmmword [ebp - 0x23], xmm0
mov dword [ebp - 0xb], 0
movq qword [ebp - 0x13], xmm0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
mov byte [ebp - 0x44], bl
movdqu xmmword [ebp - 0x43], xmm0
mov dword [ebp - 0x2b], 0
movq qword [ebp - 0x33], xmm0
mov word [ebp - 0x27], 0
mov byte [ebp - 0x25], bl
call fcn.00463c60
add esp, 0x10
cmp al, 1
jne 0x46585e
push 0x20
lea eax, [ebp - 0x24]
push eax
push 0x100
push esi
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.0045e840
add esp, 0x18
mov bl, al
xor al, al
cmp bl, 1
jne 0x4658bf
push edi
mov edi, dword [ebp + 0xc]
lea edx, [ebp - 0x24]
mov eax, edx
mov cl, bl
sub edi, eax
mov esi, 0x20
mov al, byte [edi + edx]
lea edx, [edx + 1]
xor ebx, ebx
movzx ecx, cl
cmp al, byte [edx - 1]
cmovne ecx, ebx
dec esi
jne 0x465877
pop edi
cmp cl, 1
jne 0x4658bd
mov esi, dword [ebp - 0x48]
mov cl, 0xa5
mov edx, 0xff
lea eax, [esi + 1]
mov edi, edi
xor cl, byte [eax]
lea eax, [eax + 1]
dec edx
jne 0x4658a0
cmp cl, byte [esi]
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004743e6
mov esp, ebp
pop ebp
ret
mov al, cl
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004743e6
mov esp, ebp
pop ebp
ret
Function at 0x4693b0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 0x68], ecx
test ecx, ecx
jne 0x469409
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret
mov dword [eax + 8], 0xc1059ed8
mov dword [eax + 0xc], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0xf70e5939
mov dword [eax + 0x18], 0xffc00b31
mov dword [eax + 0x1c], 0x68581511
mov dword [eax + 0x20], 0x64f98fa7
mov dword [eax + 0x24], 0xbefa4fa4
xor eax, eax
pop ebp
ret