joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404f6b
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x27d0]
mov eax, 0x2850
call fcn.0040c7c0
mov eax, dword [0x412034]
xor eax, ebp
mov dword [ebp + 0x27cc], eax
push esi
push edi
xor esi, esi
push 0x1ffe
lea eax, [ebp + 0x5c6]
push esi
push eax
mov edi, ecx
mov dword [ebp - 0x70], esi
call fcn.00406040
add esp, 0xc
cmp edi, esi
mov word [ebp + 0x5c4], 0x22
je 0x405120
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xffa
jge 0x405120
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp + 0x5c4]
push eax
call edi
push 0x40fd6c
lea eax, [ebp + 0x5c4]
push eax
call edi
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, esi
mov dword [ebp - 0x80], eax
je 0x405120
push str.ShellExecuteW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
mov dword [ebp - 0x74], eax
je 0x405120
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00404cfb
pop ecx
mov dword [ebp - 0x78], esi
lea ebx, [ebp - 0x6c]
mov edi, str.open
cmp word [ebx], si
je 0x405046
push 1
push esi
lea eax, [ebp + 0x5c4]
push eax
push ebx
push edi
push esi
call dword [ebp - 0x74]
cmp eax, 0x20
ja 0x405057
inc dword [ebp - 0x78]
add ebx, 0x210
cmp dword [ebp - 0x78], 3
jl 0x40502c
jmp 0x40507e
mov eax, dword [ebp - 0x78]
imul eax, eax, 0x210
cmp dword [ebp + eax + 0x19c], esi
mov eax, dword [ebp + eax + 0x1a0]
jne 0x405073
add eax, 0x10
cmp eax, esi
mov dword [ebp - 0x70], eax
jne 0x405111
push 1
push esi
push esi
lea eax, [ebp + 0x5c4]
push eax
push edi
push esi
call dword [ebp - 0x74]
cmp eax, 0x20
ja 0x40510a
mov dword [ebp - 0x7c], str._programfiles_x86__Internet_Exploreriexplore.exe
mov dword [ebp - 0x78], str._programfiles_Internet_Exploreriexplore.exe
xor ebx, ebx
push 0x206
lea eax, [ebp + 0x25c6]
push esi
push eax
mov word [ebp + 0x25c4], si
call fcn.00406040
add esp, 0xc
push 0x103
lea eax, [ebp + 0x25c4]
push eax
push dword [ebp + ebx*4 - 0x7c]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp + 0x25c4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405102
push 1
push esi
lea eax, [ebp + 0x5c4]
push eax
lea eax, [ebp + 0x25c4]
push eax
push edi
push esi
call dword [ebp - 0x74]
cmp eax, 0x20
ja 0x40510a
inc ebx
cmp ebx, 2
jb 0x4050a3
jmp 0x405111
mov dword [ebp - 0x70], 0x10
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x70]
pop ebx
jmp 0x405122
xor eax, eax
mov ecx, dword [ebp + 0x27cc]
pop edi
xor ecx, ebp
pop esi
call fcn.004058de
add ebp, 0x27d0
leave
ret
Function at 0x4058de
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412034]
jne 0x4058e8
repz ret
jmp fcn.004068f9

Function at 0x407691
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x412048]
je 0x4076ac
inc edi
cmp edi, 0x17
jb 0x40769d
cmp edi, 0x17
jae 0x40782c
push ebp
push 3
call fcn.0040afc0
cmp eax, 1
pop ecx
je 0x4077f8
push 3
call fcn.0040afc0
test eax, eax
pop ecx
jne 0x4076e0
cmp dword [section..data], 1
je 0x4077f8
cmp ebx, 0xfc
je 0x40782b
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x413180
push ebp
call fcn.00409655
add esp, 0xc
test eax, eax
je 0x407716
push esi
push esi
push esi
push esi
push esi
call fcn.00405e11
add esp, 0x14
push 0x104
mov esi, 0x413199
push esi
push 0
mov byte [0x41329d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40775a
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00409655
add esp, 0xc
test eax, eax
je 0x40775a
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00405e11
add esp, 0x14
push esi
call fcn.00406760
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40779f
push esi
call fcn.00406760
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x413494
push 0x40e804
sub ecx, eax
push ecx
push eax
call fcn.0040af0d
add esp, 0x14
test eax, eax
je 0x40779f
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00405e11
add esp, 0x14
jmp 0x4077a1
xor esi, esi
push 0x40e800
push ebx
push ebp
call fcn.0040ae9c
add esp, 0xc
test eax, eax
je 0x4077c1
push esi
push esi
push esi
push esi
push esi
call fcn.00405e11
add esp, 0x14
push dword [edi*8 + 0x41204c]
push ebx
push ebp
call fcn.0040ae9c
add esp, 0xc
test eax, eax
je 0x4077e3
push esi
push esi
push esi
push esi
push esi
call fcn.00405e11
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0040acdf
add esp, 0xc
jmp 0x40782b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x40782b
cmp ebp, 0xffffffff
je 0x40782b
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x41204c]
push dword [esi]
call fcn.00406760
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x40acdf
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00406ad7
xor ebx, ebx
cmp dword [0x413880], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x40adb5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40ae95
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40ae95
push eax
call fcn.00406a69
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x413880], eax
call esi
push eax
call fcn.00406a69
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x413884], eax
call esi
push eax
call fcn.00406a69
mov dword [0x413888], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004071d8
test eax, eax
pop ecx
pop ecx
je 0x40ad83
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00405e11
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x40adb5
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00406a69
cmp eax, ebx
pop ecx
mov dword [0x413890], eax
je 0x40adb5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406a69
pop ecx
mov dword [0x41388c], eax
mov eax, dword [0x41388c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x40ae3a
cmp dword [0x413890], ecx
je 0x40ae3a
push eax
call fcn.00406ae0
push dword [0x413890]
mov esi, eax
call fcn.00406ae0
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x40ae3a
cmp edi, ebx
je 0x40ae3a
call esi
cmp eax, ebx
je 0x40ae07
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ae07
test byte [ebp - 0x18], 1
jne 0x40ae3a
lea eax, [ebp - 0x10]
push eax
call fcn.0040720f
test eax, eax
pop ecx
je 0x40ae22
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00405e11
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x40ae31
or dword [ebp + 0x10], 0x200000
jmp 0x40ae75
or dword [ebp + 0x10], 0x40000
jmp 0x40ae75
mov eax, dword [0x413884]
cmp eax, dword [ebp - 8]
je 0x40ae75
push eax
call fcn.00406ae0
cmp eax, ebx
pop ecx
je 0x40ae75
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40ae75
mov eax, dword [0x413888]
cmp eax, dword [ebp - 8]
je 0x40ae75
push eax
call fcn.00406ae0
cmp eax, ebx
pop ecx
je 0x40ae75
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x413880]
call fcn.00406ae0
cmp eax, ebx
pop ecx
je 0x40ae95
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ae97
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407cea
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ce763
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push ebx
push esi
push edi
mov eax, dword [0x509590]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov edi, dword [eax]
lea eax, [esp + 0x2c]
push eax
call fcn.00405267
and dword [esp + 0xc0], 0
push 0x4dfabc
push ecx
lea eax, [edi + 0xa0]
push eax
push ecx
lea eax, [esp + 0x44]
push 0x4dfac0
push eax
call fcn.00405d69
add esp, 0xc
push eax
call fcn.0042e7fa
add esp, 0xc
push eax
call fcn.00405d69
pop ecx
pop ecx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
call fcn.004052f9
mov esi, eax
mov byte [esp + 0xc0], 1
call fcn.0040522f
push eax
mov ecx, esi
call fcn.0042e855
push 0
push 1
lea esi, [esp + 0x18]
call fcn.004075b1
or dword [esp + 0xc0], 0xffffffff
lea eax, [esp + 0x2c]
call fcn.004051fd
lea ecx, [ebx + 0x378]
mov eax, dword [ecx]
add edi, 0xbc
push edi
call dword [eax + 0xc]
mov al, 1
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409f07
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d1148
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x509590]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
push 0x4df40c
lea eax, [esp + 0x4c]
call fcn.004078c5
and dword [esp + 0x70], 0
lea eax, [esp + 0x48]
push eax
call fcn.0040a0e0
or dword [esp + 0x70], 0xffffffff
xor ebx, ebx
push 0
inc ebx
push ebx
lea esi, [esp + 0x50]
call fcn.004075b1
push 0x6b4
call fcn.0045e877
pop ecx
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x70], ebx
je 0x409f83
push eax
call fcn.00407a94
jmp 0x409f85
xor eax, eax
or dword [esp + 0x70], 0xffffffff
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0040a68c
mov dword [esp + 0x70], 2
test byte [0x50fce8], bl
jne 0x409fab
or dword [0x50fce8], ebx
mov esi, dword [esp + 0x28]
mov ecx, esi
call fcn.00434c5a
test byte [0x50fce4], bl
jne 0x409fc4
or dword [0x50fce4], ebx
lea edi, [esi + 4]
mov ebx, dword [edi + 8]
lea esi, [esp + 0x40]
call fcn.0040849c
mov ebx, dword [edi + 4]
lea esi, [esp + 0x18]
call fcn.0040849c
jmp 0x40a0a3
lea esi, [esp + 0x18]
call fcn.0040a5c4
mov esi, eax
call fcn.0040a5b1
cmp dword [eax + 0x98], 1
jne 0x40a09a
mov eax, dword [esi]
lea edi, [eax + 0x474]
mov ebx, dword [edi + 8]
lea esi, [esp + 0x30]
call fcn.0040d4e8
mov eax, dword [esp + 0x30]
mov ebx, dword [edi + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x34]
lea esi, [esp + 0x38]
mov dword [esp + 0x24], eax
call fcn.0040d4e8
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
jmp 0x40a089
lea esi, [esp + 0x10]
call fcn.0040a4d0
lea ecx, [esp + 0x48]
push ecx
call fcn.00405245
add eax, 0x24
push eax
call fcn.0040945d
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0x74], 3
call fcn.0040a0e0
push 0
push 1
lea esi, [esp + 0x50]
mov byte [esp + 0x78], 2
call fcn.004075b1
lea esi, [esp + 0x10]
call fcn.0040a4ed
lea edi, [esp + 0x20]
lea esi, [esp + 0x10]
call fcn.0040a797
test al, al
je 0x40a043
lea esi, [esp + 0x18]
call fcn.0040a5e1
lea edi, [esp + 0x40]
lea esi, [esp + 0x18]
call fcn.0040a8b3
test al, al
je 0x409fe4
or dword [esp + 0x70], 0xffffffff
cmp dword [esp + 0x28], 0
je 0x40a0cd
lea esi, [esp + 0x28]
call fcn.0040a965
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41dab2
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ca64e
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
push edi
mov eax, dword [0x509590]
xor eax, esp
push eax
lea eax, [esp + 0xf8]
mov dword fs:[0], eax
cmp dword [esi + 0x18], 8
jb 0x41daed
mov eax, dword [esi + 4]
jmp 0x41daf0
lea eax, [esi + 4]
push eax
call dword [0x50cac0]
cmp eax, 0xffffffff
jne 0x41dbcd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 2
jb 0x41db19
cmp edi, 3
ja 0x41db19
xor al, al
jmp 0x41dbd7
test edi, edi
je 0x41dbd5
lea eax, [esp + 0x6c]
push eax
call fcn.00405267
and dword [esp + 0x100], 0
push esi
push ecx
lea eax, [esp + 0x7c]
push str.GetFileAttributesW:
push eax
call fcn.00405d69
add esp, 0xc
push eax
call fcn.00405eb8
pop ecx
pop ecx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x70]
call fcn.004052f9
mov byte [esp + 0x100], 1
cmp dword [eax + 0x18], 8
jb 0x41db70
mov eax, dword [eax + 4]
jmp 0x41db73
add eax, 4
push eax
lea eax, [esp + 0x54]
push eax
mov eax, edi
call fcn.00425a0e
push eax
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x110], 2
call fcn.004167e3
add esp, 0x10
mov byte [esp + 0x100], 3
cmp dword [eax + 0x18], 0x10
jb 0x41dba9
mov eax, dword [eax + 4]
jmp 0x41dbac
add eax, 4
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
call fcn.0048ec72
push 0x4f7698
lea eax, [esp + 0x10]
push eax
call fcn.0048febc
test al, 0x10
jne 0x41db12
mov al, 1
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4226fa
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 0x24], 0
push edi
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x24], 0
pop edi
jne 0x422734
call fcn.00422696
test al, al
je 0x422734
lea eax, [ebp - 0x24]
push eax
call fcn.004226d3
pop ecx
mov ax, word [ebp - 0x24]
leave
ret
Function at 0x437b69
Capabilities:
Accept command line arguments

Disassembly:
push 0xe4
mov eax, 0x4cb278
call fcn.004981ed
and dword [ebp - 0x10], 0
lea eax, [ebp - 0xf0]
push eax
call fcn.00405267
mov esi, dword [ebp + 8]
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x14], 0
je 0x437bc3
mov ecx, 0x4e231c
push ecx
push ecx
push esi
push ecx
push ecx
lea eax, [ebp - 0xe8]
push eax
call fcn.00405d69
add esp, 0xc
push eax
call fcn.00405eb8
add esp, 0xc
push eax
call fcn.00405d69
pop ecx
pop ecx
jmp 0x437c09
lea edi, [ebp - 0x30]
call fcn.004202be
mov ecx, 0x4e231c
push ecx
push ecx
push eax
push ecx
push ecx
lea eax, [ebp - 0xe8]
push eax
mov byte [ebp - 4], 2
call fcn.00405d69
add esp, 0xc
push eax
call fcn.00405eb8
add esp, 0xc
push eax
call fcn.00405d69
pop ecx
pop ecx
push 0
push ebx
mov esi, edi
mov byte [ebp - 4], bl
call fcn.004075b1
mov esi, dword [ebp + 8]
cmp dword [0x50ec08], ebx
jle 0x437cc3
push str.__t_n_r
lea eax, [ebp - 0x30]
call fcn.004078c5
mov byte [ebp - 4], 3
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call edi
mov dword [ebp - 0x14], eax
mov eax, dword [0x50ec10]
push dword [eax]
call fcn.0048e169
mov esi, eax
mov eax, dword [ebp - 0x14]
mov ax, word [eax]
sub ax, 0x22
neg ax
pop ecx
sbb eax, eax
and eax, 0xfffffffe
inc eax
inc eax
add esi, eax
add esi, esi
call edi
add eax, esi
push eax
lea eax, [ebp - 0x4c]
call fcn.004078c5
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.00416cb8
pop ecx
pop ecx
push eax
push ecx
lea eax, [ebp - 0xe8]
push 0x4e3f0c
push eax
mov byte [ebp - 4], 5
call fcn.00405d69
add esp, 0xc
push eax
call fcn.00405eb8
pop ecx
pop ecx
xor edi, edi
push edi
push ebx
lea esi, [ebp - 0x68]
call fcn.004075b1
push edi
push ebx
lea esi, [ebp - 0x4c]
call fcn.004075b1
push edi
push ebx
lea esi, [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.004075b1
mov esi, dword [ebp + 8]
cmp dword [esi + 0x30], 0
je 0x437cea
add esi, 0x1c
push esi
push ecx
lea eax, [ebp - 0xe8]
push 0x4e3f0c
push eax
call fcn.00405d69
add esp, 0xc
push eax
call fcn.00405eb8
pop ecx
pop ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0xf0]
call fcn.004052f9
lea eax, [ebp - 0xf0]
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 0
call fcn.004051fd
mov eax, dword [ebp + 0xc]
call fcn.004982c5
ret 8
Function at 0x437d15
Capabilities:
Accept command line arguments

Disassembly:
push 0xe4
mov eax, 0x4c73b6
call fcn.004981ed
and dword [ebp - 0x14], 0
lea eax, [ebp - 0xf0]
push eax
call fcn.00405267
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
cmp dword [0x50ec08], ebx
jle 0x437df1
push str.__t_n_r
lea eax, [ebp - 0x4c]
call fcn.004078c5
mov byte [ebp - 4], 2
mov edi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call edi
mov dword [ebp - 0x10], eax
mov eax, dword [0x50ec10]
push dword [eax]
call fcn.0048e169
mov esi, eax
mov eax, dword [ebp - 0x10]
mov ax, word [eax]
sub ax, 0x22
neg ax
pop ecx
sbb eax, eax
and eax, 0xfffffffe
inc eax
inc eax
add esi, eax
add esi, esi
call edi
add eax, esi
push eax
lea eax, [ebp - 0x30]
call fcn.004078c5
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 3
call fcn.00416cb8
pop ecx
pop ecx
push eax
push ecx
lea eax, [ebp - 0xe8]
push 0x4e3f0c
push eax
mov byte [ebp - 4], 4
call fcn.00405d69
add esp, 0xc
push eax
call fcn.00405eb8
pop ecx
pop ecx
xor edi, edi
push edi
push ebx
lea esi, [ebp - 0x68]
call fcn.004075b1
push edi
push ebx
lea esi, [ebp - 0x30]
call fcn.004075b1
push edi
push ebx
lea esi, [ebp - 0x4c]
mov byte [ebp - 4], bl
call fcn.004075b1
mov eax, dword [ebp + 8]
cmp dword [eax + 0x30], 0
je 0x437e1b
add eax, 0x1c
push eax
push ecx
lea eax, [ebp - 0xe8]
push 0x4e3f0c
push eax
call fcn.00405d69
add esp, 0xc
push eax
call fcn.00405eb8
pop ecx
pop ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0xf0]
call fcn.004052f9
lea eax, [ebp - 0xf0]
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 0
call fcn.004051fd
mov eax, dword [ebp + 0xc]
call fcn.004982c5
ret 8

Function at 0x4380b0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4cb213
mov eax, dword fs:[0]
push eax
sub esp, 0xf4
push ebx
push edi
mov eax, dword [0x509590]
xor eax, esp
push eax
lea eax, [esp + 0x100]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push 4
push ebx
push ebx
push esi
push 0x437f17
call fcn.004681b8
lea edi, [esi + 4]
push eax
call fcn.00438453
cmp dword [edi], ebx
pop ecx
jne 0x4381a3
lea eax, [esp + 0x74]
push eax
call fcn.00405267
lea eax, [esp + 0x7c]
push 0x4e6ad0
push eax
mov dword [esp + 0x110], ebx
call fcn.00405d69
pop ecx
pop ecx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x78]
call fcn.004052f9
mov byte [esp + 0x108], 1
cmp dword [eax + 0x18], 8
jb 0x438148
mov eax, dword [eax + 4]
jmp 0x43814b
add eax, 4
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.00425a3b
push eax
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0x118], 2
call fcn.004167e3
add esp, 0x10
mov byte [esp + 0x108], 3
cmp dword [eax + 0x18], 0x10
jb 0x43817f
mov eax, dword [eax + 4]
jmp 0x438182
add eax, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
call fcn.0048ec72
push 0x4f7698
lea eax, [esp + 0x18]
push eax
call fcn.0048febc
mov eax, edi
call fcn.00438376
mov dword [eax + 0x28], ebx
mov eax, edi
call fcn.00438376
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x100]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439801
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4cb131
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x509590]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
mov eax, dword [0x509590]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
lea edi, [esp + 0x30]
call fcn.004202be
lea ecx, [esp + 0x4c]
xor edi, edi
push ecx
mov dword [esp + 0x7c], edi
call fcn.004200c6
pop ecx
push edi
push 1
lea esi, [esp + 0x38]
mov byte [esp + 0x80], 2
call fcn.004075b1
mov ebx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push ebx
lea eax, [esp + 0x18]
call fcn.004078c5
push edi
lea eax, [esp + 0x50]
push eax
lea edi, [esp + 0x1c]
mov ecx, SysFreeString
mov byte [esp + 0x80], 3
call fcn.00425d4d
pop ecx
pop ecx
push 0
push 1
mov esi, edi
mov byte [esp + 0x1b], al
mov byte [esp + 0x80], 2
call fcn.004075b1
cmp byte [esp + 0x13], 0
je 0x4398da
push ebx
lea eax, [esp + 0x18]
call fcn.004078c5
lea eax, [esp + 0x4c]
push eax
lea edi, [esp + 0x18]
mov byte [esp + 0x7c], 4
call fcn.0042680f
pop ecx
push 0
push 1
mov esi, edi
call fcn.004075b1
push 0
push 1
lea esi, [esp + 0x54]
call fcn.004075b1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.0048e32a
mov esp, ebp
pop ebp
ret
Function at 0x43c74f
Capabilities:
Get thread local storage value

Disassembly:
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ebp, ebp
cmp dword [esi + 0x1108], eax
je 0x43c777
lea eax, [esi + 0x10cc]
mov dword [eax + 0x18], 0x3f3
mov dword [eax + 0x1c], ebp
mov dword [eax + 0x20], ebp
xor eax, eax
pop ebp
ret
mov eax, dword [0x50fb1c]
cmp eax, 0xffffffff
je 0x43c79b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebp
je 0x43c79b
lea eax, [esi + 0x10cc]
mov dword [eax + 0x18], 0x3f4
jmp 0x43c76d
push esi
push 1
call fcn.0043c0ed
test eax, eax
pop ecx
pop ecx
jne 0x43c7bb
lea eax, [esi + 0x10cc]
mov dword [eax + 0x18], ebp
mov dword [eax + 0x1c], 0xe
jmp 0x43c770
push ebx
lea ebx, [esi + 0x10cc]
mov eax, ebx
call fcn.0043b673
cmp dword [esi + 0x10f0], ebp
jne 0x43c870
cmp dword [esi + 0x110c], ebp
jne 0x43c874
push edi
push str.Cabinet.dll
call dword [0x50cb24]
mov edi, dword [0x50cadc]
push str.FDICreate
push eax
mov dword [esi + 0x110c], eax
call edi
push str.FDICopy
push dword [esi + 0x110c]
mov dword [esi + 0x1110], eax
call edi
push str.FDIIsCabinet
push dword [esi + 0x110c]
mov dword [esi + 0x1114], eax
call edi
push str.FDIDestroy
push dword [esi + 0x110c]
mov dword [esi + 0x1118], eax
call edi
cmp dword [esi + 0x1110], ebp
mov dword [esi + 0x111c], eax
pop edi
je 0x43c85d
cmp dword [esi + 0x1114], ebp
je 0x43c85d
cmp dword [esi + 0x1118], ebp
je 0x43c85d
cmp eax, ebp
jne 0x43c874
mov dword [esi + 0x110c], ebp
mov dword [ebx + 0x18], 0x3e8
mov dword [ebx + 0x1c], ebp
mov dword [ebx + 0x20], ebp
xor eax, eax
jmp 0x43c8b2
push ebx
push 1
push 0x43c8b5
push 0x43c91a
push 0x43c93b
push 0x43ca7e
push 0x43d3a4
push 0x43d416
push 0x43d41b
call dword [esi + 0x1110]
xor ecx, ecx
add esp, 0x24
cmp eax, ebp
setne cl
mov dword [esi + 0x10f0], eax
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x43d47d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
lea ecx, [esi + 0x48]
call fcn.0043bdbd
test eax, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
jl 0x43d4ab
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
test eax, eax
jle 0x43d4b3
add dword [edi + 4], eax
jmp 0x43d4b3
call fcn.00497e26
add esp, 0xc
pop edi
pop esi
pop ebp
ret 0xc