joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443288
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4432c0]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4432a1
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4432b0
or bl, 4
test esi, 0x20000000
je 0x4432bb
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4498c4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4498d6
add esp, 0xfffffff0
call fcn.00403ef8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b898
mov eax, dword [0x464d74]
mov dword [eax + 4], ebx
mov dword [eax], 0x449c68
mov eax, dword [0x464d80]
mov dword [eax + 4], ebx
mov dword [eax], 0x449c74
mov eax, ebx
call fcn.00449c80
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4118f8]
call fcn.00403b7c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4118f8]
call fcn.00403b7c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4118f8]
call fcn.00403b7c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4118f8]
call fcn.00403b7c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4118f8]
call fcn.00403b7c
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x446148
push eax
push 0
push 0
mov eax, dword [0x464eac]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41d228]
call fcn.0041e62c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41d228]
call fcn.0041e62c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41d228]
call fcn.0041e62c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044a0a0
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x449f7c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x449f7c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x449f7c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x449a13
call fcn.00403f50
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x449d60
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x449f0b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x449eec
mov dl, 1
mov eax, dword [0x411de8]
call fcn.00403b7c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404900
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x449edb
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00437984
test al, al
je 0x449ece
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x449f1c
lea eax, [ebp - 0x254]
call fcn.00409648
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x449ece
xor eax, eax
push ebp
push 0x449ec7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x449f54
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x449eb0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404b68
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x449eb0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404b68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449ece
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x449dd1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415f30
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449f12
lea eax, [ebp - 0x260]
call fcn.00404900
ret

Function at 0x44a840
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x466bfc]
cmp byte [eax + 0xa5], 0
jne 0x44a8b1
cmp dword [0x466c14], 0
jne 0x44a872
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44a7fc
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x466c14], eax
cmp dword [0x466c10], 0
jne 0x44a88d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x466c10], eax
cmp dword [0x466c18], 0
jne 0x44a8b1
push esp
push 0
push 0
push 0x44a7a0
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x466c18], eax
pop edx
ret
Function at 0x44a9a8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44a9bf
add esp, 0xfffffff0
call fcn.00403ef8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b898
mov eax, dword [0x464e9c]
cmp word [eax + 2], 0
jne 0x44a9e7
mov eax, dword [0x464e9c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044bfdc
mov eax, dword [0x464f40]
cmp word [eax + 2], 0
jne 0x44aa01
mov eax, dword [0x464f40]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044c1d4
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4118f8]
call fcn.00403b7c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4118f8]
call fcn.00403b7c
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41d9d8]
call fcn.004235e4
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44ab88
mov eax, dword [0x464dcc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004239b4
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44c744
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x464dcc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040aec8
test eax, eax
je 0x44aaf6
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408fa4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040aef0
test eax, eax
je 0x44ab0a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404b68
mov eax, dword [0x464cbc]
cmp byte [eax], 0
jne 0x44ab3e
mov eax, ebx
call fcn.0044acb0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044c920
mov eax, ebx
call fcn.0044d260
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44ab7e
call fcn.00403f50
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44af24
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x466bfc]
cmp dword [eax + 0x30], 0
je 0x44afce
cmp dword [ebx + 0x94], 0
jne 0x44afc8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44aeb4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44afc8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44af8e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44afc8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413f98
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44af9d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44baac
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44bae1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004049f0
jmp 0x44baee
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404954
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44cafc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44cb3d
mov eax, esi
call fcn.00433248
test al, al
je 0x44cb3d
mov eax, dword [ebx + 0x84]
call fcn.00432f44
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44cb3d
push 0
mov eax, dword [ebx + 0x84]
call fcn.00432f44
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x458218
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4583ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, 4
mov eax, 0x7fffd8ef
call fcn.004030e4
add eax, 0x2710
lea edx, [ebp - 4]
call fcn.0045e58c
mov eax, 0x7fffd8ef
call fcn.004030e4
add eax, 0x2710
lea edx, [ebp - 8]
call fcn.0045e58c
mov ebx, 0x20000
lea eax, [ebp - 0xc]
call fcn.00460d78
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404cfc
je 0x458292
mov eax, 0x37
call fcn.004030e4
cmp eax, 4
jne 0x4582e8
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00404af0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00404cfc
je 0x4582bd
mov eax, 0x37
call fcn.004030e4
cmp eax, 4
jne 0x4582e8
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00402adc
mov eax, dword [ebp - 0x14]
call fcn.00404db0
push eax
call sub.kernel32.dll_GetModuleHandleA_3
xor edx, edx
cmp edx, 0xffffffff
jne 0x4582e8
cmp eax, 0xffffff9d
je 0x4583b3
dec ebx
jne 0x45826e
mov eax, 0x7fffd8ef
call fcn.004030e4
add eax, 0x2710
lea edx, [ebp - 4]
call fcn.0045e58c
mov eax, 0x7fffd8ef
call fcn.004030e4
add eax, 0x2710
lea edx, [ebp - 8]
call fcn.0045e58c
mov ebx, 0x10000
mov eax, 0x32
call fcn.004030e4
test eax, eax
jne 0x458331
dec esi
test esi, esi
jmp 0x4583a5
lea eax, [ebp - 0x18]
call fcn.00460d78
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00404cfc
je 0x458355
mov eax, 0x37
call fcn.004030e4
cmp eax, 4
jne 0x4583a5
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.00404af0
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.00404cfc
je 0x458380
mov eax, 0x37
call fcn.004030e4
cmp eax, 4
jne 0x4583a5
lea edx, [ebp - 0x20]
mov eax, 1
call fcn.00402adc
mov eax, dword [ebp - 0x20]
call fcn.00404db0
push eax
call sub.kernel32.dll_GetModuleHandleA_3
xor edx, edx
cmp edx, 0xffffffff
jne 0x4583a5
cmp eax, 0xffffff9d
dec ebx
jne 0x45831e
dec edi
jne 0x45823b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4583d5
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00404924
ret
Function at 0x45de5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404da0
xor eax, eax
push ebp
push 0x45df26
push dword fs:[eax]
mov dword fs:[eax], esp
lea ebx, [ebp - 0xc]
mov dword [ebx], esi
mov eax, dword [ebp - 4]
call fcn.00404bb8
mov edi, eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp edi, 4
jl 0x45dec6
mov esi, dword [ebx]
lea eax, [ebp - 4]
call fcn.00404e08
mov edx, edi
test edx, edx
jns 0x45deaf
add edx, 3
sar edx, 2
mov dword [ebp - 0x10], edx
mov ebx, dword [ebp - 0x10]
dec ebx
test ebx, ebx
jl 0x45dec6
inc ebx
xor dword [eax], esi
add eax, 4
dec ebx
jne 0x45debe
xor esi, esi
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0x10]
shl eax, 2
inc eax
mov ebx, edi
sub ebx, eax
jl 0x45df05
inc ebx
mov edi, eax
lea eax, [ebp - 4]
call fcn.00404e08
mov edx, dword [ebp - 4]
mov dl, byte [edx + edi - 1]
xor dl, byte [ebp + esi - 0xc]
mov byte [eax + edi - 1], dl
inc esi
and esi, 0x80000003
jns 0x45df01
dec esi
or esi, 0xfffffffc
inc esi
inc edi
dec ebx
jne 0x45dedc
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404954
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45df2d
lea eax, [ebp - 4]
call fcn.00404900
ret

Function at 0x45e330
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x466c7c
mov eax, ebx
mov edx, 0xfffffff8
test al, 1
je 0x45e34c
shr eax, 1
xor eax, 0xedb88320
jmp 0x45e34e
shr eax, 1
inc edx
jne 0x45e33f
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x45e338
pop ebx
ret

Function at 0x45e364
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
cmp byte [0x466c78], 0
jne 0x45e37d
mov byte [0x466c78], 1
call fcn.0045e330
or ebx, 0xffffffff
mov eax, esi
call fcn.00404bb8
mov edx, eax
test edx, edx
jle 0x45e3b7
mov ecx, 1
mov eax, ebx
xor ebx, ebx
mov bl, byte [esi + ecx - 1]
xor ebx, eax
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x466c7c]
shr eax, 8
and eax, 0xffffff
xor ebx, eax
inc ecx
dec edx
jne 0x45e392
and ebx, 0x7fffffff
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x462a6c
Capabilities:
Move file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x462cdf
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004589b0
test al, al
je 0x462cc4
mov ebx, fcn.00463034
mov esi, fcn.00463070
call fcn.004627b8
lea edx, [ebp - 4]
mov eax, 0x462cf4
call fcn.0045dc70
mov eax, dword [ebp - 4]
call fcn.00404db0
push eax
call ebx
mov ebx, eax
lea edx, [ebp - 8]
mov eax, 0x462d08
call fcn.0045dc70
mov eax, dword [ebp - 8]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670d0], eax
lea edx, [ebp - 0xc]
mov eax, 0x462d30
call fcn.0045dc70
mov eax, dword [ebp - 0xc]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x4670d8], eax
lea edx, [ebp - 0x10]
mov eax, 0x462d50
call fcn.0045dc70
mov eax, dword [ebp - 0x10]
call fcn.00404db0
push eax
push ebx
call esi
mov dword [0x467164], eax
call fcn.004618c8
mov eax, 2
call fcn.004030e4
cmp eax, 0xb
jne 0x462cc4
push 0x2b
push 0x63
push 0x26
call sub.user32.dll_SetMenuInfo
fld xword [0x462d6c]
call fcn.00402b98
call fcn.00402bc4
cmp edx, 0
jne 0x462b56
cmp eax, 0x6d4
je 0x462b70
fld xword [0x462d78]
call fcn.00402b98
fmul st(0)
fcomp dword [0x462d84]
fnstsw ax
sahf
jne 0x462b8c
fld xword [0x462d88]
fldln2
fxch st(1)
fyl2x
fcomp dword [0x462d94]
fnstsw ax
sahf
jne 0x462b8c
call sub.kernel32.dll_GetTickCount_1
push 0x34
push 0x23
call sub.user32.dll_SetWinEventHook
test al, al
jne 0x462cc4
push 0x27
push 0x1d
push 0x38
call sub.user32.dll_GetClipCursor
call sub.kernel32.dll_GetProcessPriorityBoost
push 0x462da0
push 0x462db8
push 0x462dc8
call sub.kernel32.dll_ReadFile_2
push 0
push 0x7b
call fcn.00406974
add esp, 8
fcomp dword [0x462dd8]
fnstsw ax
sahf
je 0x462bed
lea ecx, [ebp - 0x14]
mov edx, 0xd
mov al, 0x74
call fcn.00404fa0
cmp dword [ebp - 0x14], 0
jne 0x462bf6
push 0x43
push 0x56
call sub.kernel32.dll_SleepEx
push 0x462de4
push 0x462df4
call sub.kernel32.dll_GetBinaryTypeW
fld xword [0x462e00]
call fcn.00402b98
fcomp dword [0x462e0c]
fnstsw ax
sahf
jne 0x462c26
push 0x37
push 0x3c
push 0x58
call sub.user32.dll_InternalGetWindowText
push 9
call sub.user32.dll_GetClipboardSequenceNumber
lea ecx, [ebp - 0x18]
mov edx, 7
mov al, 0x66
call fcn.00404fa0
cmp dword [ebp - 0x18], 0
jne 0x462c6e
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, 0x462e18
call fcn.00404e10
mov eax, dword [ebp - 0x1c]
mov edx, 0x462e30
call fcn.00404cfc
je 0x462c6e
call sub.kernel32.dll_GetDateFormatA
push 0x2e
call sub.kernel32.dll_SetSystemPowerState
push 0x2b
push 0x25
push 0xa
call sub.kernel32.dll_MoveFileExW
lea ecx, [ebp - 0x20]
mov edx, 0x10
mov al, 0x6f
call fcn.00404fa0
mov eax, dword [ebp - 0x20]
mov edx, 0x462e48
call fcn.00404cfc
je 0x462cb8
fld xword [0x462e4c]
fsqrt
fcomp dword [0x462e58]
fnstsw ax
sahf
je 0x462cb8
push 0x3a
call sub.kernel32.dll_GetStartupInfoA_1
push 0x2f
call sub.kernel32.dll_BeginUpdateResourceW
call sub.kernel32.dll_Beep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462ce6
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00404924
ret
Function at 0x401985
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4019c4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4019c4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4019c4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4019c4
cmp dword [ecx + 0x74], 0xe
jbe 0x4019c4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x406239
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x406284
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00406456
test al, al
jne 0x40627e
sub edx, 2
cmp edx, edi
jne 0x406264
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x4062a6
lea eax, [edi + 2]
cmp edx, eax
je 0x4062a6
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00406185
add esp, 0x10
jmp 0x4063a0
push esi
lea ecx, [ebp - 0x255]
call fcn.00406456
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4062e9
push dword [ebp - 0x25c]
jmp 0x406296
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x406326
cmp word [ebp - 0x226], 0
je 0x406347
cmp word [ebp - 0x226], ax
jne 0x406326
cmp word [ebp - 0x224], 0
je 0x406347
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00406185
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x406393
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x406300
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x40637b
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4063a0
push 0x405fb5
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00409000
add esp, 0x10
jmp 0x406370
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401155
leave
ret

Function at 0x407ed3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40efac
push 0x40efa4
push str.FlsAlloc
push 0x1f
call fcn.00407e0e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407f07
push dword [ebp + 8]
mov ecx, esi
call dword [0x40d10c]
call esi
jmp 0x407f0d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x407f51
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40efbc
push 0x40efb4
push str.FlsGetValue
push 0x21
call fcn.00407e0e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407f88
push dword [ebp + 8]
mov ecx, esi
call dword [0x40d10c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x407f90
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40efc4
push 0x40efbc
push str.FlsSetValue
push 0x22
call fcn.00407e0e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407fca
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40d10c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40cd20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40cd4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40cd4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret