joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a954
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x43a963
or edx, 0x200
test eax, 0x20000000
je 0x43a997
test eax, 0x40000000
je 0x43a982
test eax, 0x80000000
je 0x43a97d
or edx, 0x40
jmp 0x43a9be
or edx, 0x20
jmp 0x43a9be
test eax, 0x80000000
je 0x43a991
or edx, 0x80
jmp 0x43a9be
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x43a9af
test eax, 0x80000000
je 0x43a9aa
or edx, 4
jmp 0x43a9be
or edx, 2
jmp 0x43a9be
test eax, 0x80000000
je 0x43a9bb
or edx, 8
jmp 0x43a9be
or edx, 1
mov eax, edx
ret

Function at 0x43af24
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
cmp byte [0x472bb8], 0
je 0x43af54
mov edx, 0xc8
mov eax, 0x32
call fcn.0040ece4
push eax
call sub.kernel32.dll_Sleep
cmp bl, 0x90
jne 0x43af97
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp al, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_GetKeyboardState
test bl, bl
je 0x43af82
and byte [ebp - 0x72], 0xfe
jmp 0x43af86
or byte [ebp - 0x72], 1
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_SetKeyboardState
jmp 0x43b01d
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov byte [ebp - 2], al
test si, si
jbe 0x43b01d
mov eax, ebx
and eax, 0xff
bt dword [0x4713cc], eax
jae 0x43afed
mov eax, dword [ebp + 8]
push eax
mov ecx, 1
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.0043aed8
pop ecx
cmp byte [ebp - 1], 0
je 0x43b018
mov eax, dword [ebp + 8]
push eax
mov ecx, 3
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.0043aed8
pop ecx
jmp 0x43b018
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.0043aed8
pop ecx
cmp byte [ebp - 1], 0
je 0x43b018
mov eax, dword [ebp + 8]
push eax
mov ecx, 2
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.0043aed8
pop ecx
dec si
jne 0x43afad
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43b024
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
cmp byte [0x472bb8], 0
je 0x43b048
mov edx, 0xc8
mov eax, 0x32
call fcn.0040ece4
push eax
call sub.kernel32.dll_Sleep
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov edx, ebx
and edx, 0xff
bt dword [0x4713cc], edx
jae 0x43b07a
mov edx, dword [ebp + 8]
push edx
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.0043aed8
pop ecx
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
mov ecx, 2
mov edx, eax
mov eax, ebx
call fcn.0043aed8
pop ecx
pop ebx
pop ebp
ret
Function at 0x43d9d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404984
mov eax, dword [ebp - 8]
call fcn.00404984
xor eax, eax
push ebp
push 0x43db05
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.004030fc
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 1
lea edx, [ebp - 0x60]
mov eax, 0x43db1c
call fcn.00457458
mov eax, dword [ebp - 0x60]
call fcn.00404994
mov dword [ebp - 0x44], eax
lea edx, [ebp - 0x68]
mov eax, 0x43db34
call fcn.00457458
push dword [ebp - 0x68]
push dword [ebp - 4]
push 0x43db58
push dword [ebp - 8]
lea eax, [ebp - 0x64]
mov edx, 4
call fcn.00404854
mov eax, dword [ebp - 0x64]
call fcn.00449bf0
cmp dword [ebp - 8], 0
jne 0x43da89
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404550
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404994
push eax
mov eax, dword [ebp - 4]
call fcn.00404994
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x43dabd
mov ebx, dword [ebp - 0x54]
jmp 0x43dadd
lea edx, [ebp - 0x6c]
mov eax, 0x43db70
call fcn.00457458
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 4]
call fcn.0040479c
mov eax, dword [ebp - 0x6c]
call fcn.00449bf0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43db0c
lea eax, [ebp - 0x6c]
mov edx, 4
call fcn.004044dc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044dc
ret

Function at 0x43db98
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43dc36
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.0040702c
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 2
lea eax, [ebp - 0x24]
mov ecx, 0x43dc50
mov edx, ebx
call fcn.004047e0
mov eax, dword [ebp - 0x24]
call fcn.00404994
mov dword [ebp - 0x16], eax
lea eax, [ebp - 0x28]
mov ecx, 0x43dc50
mov edx, esi
call fcn.004047e0
mov eax, dword [ebp - 0x28]
call fcn.00404994
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x614
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43dc3d
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004044dc
ret

Function at 0x43ec60
Capabilities:
Log keystrokes

Disassembly:
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
ret
Function at 0x43efec
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43f0c0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, 0x43f0d4
call fcn.00457458
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.00457050
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
pop ecx
call fcn.004047e0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0045df24
test al, al
jne 0x43f0a5
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43f086
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 7
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00405504
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f08d
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f0c7
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004044dc
ret

Function at 0x43f214
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43f2df
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, 0x43f2f4
call fcn.00457458
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0045e5e4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0045df24
test al, al
jne 0x43f2ac
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43f2a5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 5
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00405504
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f2ac
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040c980
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040450c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f2e6
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004044dc
ret
Function at 0x43f9e8
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404984
xor eax, eax
push ebp
push 0x43fb33
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004044b8
cmp dword [ebp - 4], 0
jne 0x43fa2a
push 0
call sub.user32.dll_GetDC
mov ebx, eax
jmp 0x43fa40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404994
push eax
call sub.gdi32.dll_CreateDCA
mov ebx, eax
test ebx, ebx
jne 0x43fa53
mov eax, 0x43fb4c
call fcn.00449bf0
jmp 0x43fb1d
push 8
push ebx
call sub.gdi32.dll_GetDeviceCaps
push 0xa
push ebx
call sub.gdi32.dll_GetDeviceCaps
push ebx
push 0
call sub.user32.dll_ReleaseDC
mov dl, 1
mov eax, dword [0x4342cc]
call fcn.004378fc
mov ebx, eax
xor ecx, ecx
mov dl, byte [ebp - 5]
mov eax, ebx
call fcn.0043ef14
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, esi
call fcn.0043f33c
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x58]
push 1
call sub.kernel32.dll_Sleep_1
cmp byte [0x472cc6], 0
jne 0x43faa4
mov byte [0x472cc5], 1
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [0x47162c]
push eax
mov ecx, 0x43f3dc
xor edx, edx
xor eax, eax
call fcn.0040446c
mov esi, eax
mov edx, 0x1770
mov eax, esi
call fcn.0045c6b4
mov byte [0x472cc5], 0
sub eax, 1
jae 0x43fb06
mov esi, dword [ebp - 0x24]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [esi + 4]
mov eax, edi
call fcn.004045a8
jmp 0x43fb0e
push 0
push esi
call sub.kernel32.dll_TerminateThread
mov eax, ebx
call fcn.004036e4
mov eax, dword [ebp - 0x24]
call fcn.004036e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43fb3a
lea eax, [ebp - 4]
call fcn.004044b8
ret

Function at 0x440480
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x472cc8]
mov edx, dword [eax]
call dword [edx + 0x44]
mov byte [0x472cc4], 0
push 0
mov eax, dword [0x472cd0]
push eax
call sub.kernel32.dll_TerminateThread
ret
Function at 0x44061c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404984
xor eax, eax
push ebp
push 0x440765
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004044b8
mov eax, dword [ebp - 4]
call fcn.0045d894
test al, al
je 0x44073f
mov al, 2
call fcn.0043f868
mov ebx, 0x50
mov esi, 0x9d
mov edi, 0x8c
push 1
mov eax, dword [ebp - 4]
call fcn.00404994
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.0043f33c
push 0
push 0
mov eax, dword [ebp - 0x28]
call fcn.00419354
lea eax, [ebp - 0x28]
push eax
push 0
push 0x472cf4
mov ecx, 0x43f394
xor edx, edx
xor eax, eax
call fcn.0040446c
mov ebx, eax
mov edx, 0xbb8
mov eax, ebx
call fcn.0045c6b4
xor edx, edx
push ebp
push 0x440738
push dword fs:[edx]
mov dword fs:[edx], esp
sub eax, 1
jae 0x44071a
mov eax, dword [ebp - 0x28]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x4406ea
cmp eax, 0
jbe 0x440722
jmp 0x4406ec
jle 0x440722
mov ebx, dword [ebp - 0x28]
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [ebx + 4]
lea eax, [ebp - 0xc]
call fcn.004045a8
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.00427ec0
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 8]
call fcn.004567d8
jmp 0x440722
push 0
push ebx
call sub.kernel32.dll_TerminateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44073f
mov eax, dword [ebp - 0x28]
call fcn.004036e4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44076c
lea eax, [ebp - 0x2c]
call fcn.004044b8
lea eax, [ebp - 0xc]
call fcn.004044b8
lea eax, [ebp - 4]
call fcn.004044b8
ret
Function at 0x44184c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0
xor eax, eax
push ebp
push 0x4418a0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [0x472ce8]
push eax
call sub.kernel32.dll_TerminateThread
lea edx, [ebp - 4]
mov eax, 0x4418b4
call fcn.00457458
mov eax, dword [ebp - 4]
mov dl, 1
call fcn.00454bc0
mov byte [0x472ce4], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4418a7
lea eax, [ebp - 4]
call fcn.004044b8
ret

Function at 0x4426f0
Capabilities:
Terminate thread

Disassembly:
push 0
mov eax, dword [0x472cec]
push eax
call sub.kernel32.dll_TerminateThread
push 0
mov eax, dword [0x472cf0]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [0x472ce5], 0
mov byte [0x472d14], 1
ret

Function at 0x4427c4
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44290a
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040c96c
lea eax, [ebp - 0x144]
push eax
lea edx, [ebp - 0x14c]
mov eax, 0x442924
call fcn.00457458
mov ecx, dword [ebp - 0x14c]
lea eax, [ebp - 0x148]
mov edx, dword [ebp - 4]
call fcn.004047e0
mov eax, dword [ebp - 0x148]
call fcn.00404994
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4428e4
test byte [ebp - 0x144], 0x10
je 0x4428c2
cmp byte [ebp - 0x118], 0x2e
je 0x4428c3
mov edx, 0x44292c
lea eax, [ebp - 0x118]
call fcn.00408ddc
test eax, eax
je 0x4428c3
mov edx, 0x442930
lea eax, [ebp - 0x118]
call fcn.00408ddc
test eax, eax
je 0x4428c3
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00404728
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0x150]
mov edx, dword [ebp - 4]
call fcn.004047e0
mov eax, dword [ebp - 0x150]
call fcn.004427c4
add esi, eax
jmp 0x4428c3
inc esi
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x44284f
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442911
lea eax, [ebp - 0x154]
mov edx, 4
call fcn.004044dc
lea eax, [ebp - 4]
call fcn.004044b8
ret
Function at 0x4429b4
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x442bc2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004044b8
push 0
push 0
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
xor edx, edx
mov eax, 0x3c
call fcn.0043f33c
xor edx, edx
push ebp
push 0x442ba0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x471854]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x442b82
inc esi
xor ebx, ebx
mov dl, 1
mov eax, dword [0x4342cc]
call fcn.004378fc
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x28]
mov eax, dword [0x471854]
mov eax, dword [eax]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
call fcn.0040858c
mov edx, dword [ebp - 8]
call fcn.0043e6fc
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0x29a
jl 0x442b72
lea ecx, [ebp - 0x2c]
mov eax, dword [0x471854]
mov eax, dword [eax]
mov edx, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x2c]
call fcn.0040858c
mov edx, dword [0x47153c]
mov dword [edx], eax
mov eax, dword [0x47153c]
mov eax, dword [eax]
call fcn.0043e768
test al, al
je 0x442a9c
mov eax, dword [0x47153c]
mov eax, dword [eax]
call fcn.0043e75c
push 6
movzx eax, word [0x472d28]
push eax
movzx eax, word [0x472d26]
push eax
push 0
push 0
push 0
mov eax, dword [0x47153c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowPos
mov eax, dword [0x47153c]
mov eax, dword [eax]
call fcn.0043e1f4
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x442af1
cmp eax, 0x2710
jbe 0x442b82
jmp 0x442af7
jle 0x442b82
mov eax, 1
call fcn.0045be2c
mov eax, dword [0x4714e0]
cmp byte [eax], 0
jne 0x442af7
mov eax, dword [0x47160c]
mov byte [eax], 1
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [0x471628]
push eax
mov ecx, 0x43f3b8
xor edx, edx
xor eax, eax
call fcn.0040446c
mov esi, eax
mov edx, 0x1770
mov eax, esi
call fcn.0045c6b4
mov edx, dword [0x47160c]
mov byte [edx], 0
sub eax, 1
jae 0x442b61
mov esi, dword [ebp - 0x24]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [esi + 4]
mov eax, dword [ebp - 4]
call fcn.004045a8
jmp 0x442b82
push 0
push esi
call sub.kernel32.dll_TerminateThread
push 0
call sub.kernel32.dll_ExitThread_1
mov eax, dword [ebp - 8]
call fcn.004036e4
inc ebx
dec esi
jne 0x442a1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442ba7
mov eax, dword [ebp - 8]
call fcn.004036e4
mov eax, dword [ebp - 0x24]
call fcn.004036e4
ret
Function at 0x444d94
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x444d9c
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404984
xor eax, eax
push ebp
push 0x444fa6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x471888]
mov eax, dword [eax]
call fcn.0045d894
test al, al
je 0x444ddb
mov eax, dword [0x471888]
mov eax, dword [eax]
call fcn.0045e904
lea eax, [ebp - 0xc]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004049f4
mov eax, dword [ebp - 0xc]
push eax
lea edx, [ebp - 0x10]
mov eax, 0x444fbc
call fcn.00457458
mov edx, dword [ebp - 0x10]
pop eax
call fcn.004048e0
je 0x444e27
lea edx, [ebp - 0x14]
mov eax, 0x444fc8
call fcn.00457458
mov eax, dword [ebp - 0x14]
call fcn.00449d28
jmp 0x444f8b
test bl, bl
je 0x444e43
mov eax, dword [0x471638]
mov eax, dword [eax]
call fcn.004549b0
mov eax, dword [0x4716d4]
mov eax, dword [eax]
call fcn.004549b0
lea ecx, [ebp - 0x18]
mov eax, dword [0x4714a0]
mov eax, dword [eax]
mov edx, 0x444ff8
call fcn.004181f0
mov eax, dword [ebp - 0x18]
call fcn.0044d148
test al, al
je 0x444f58
lea ecx, [ebp - 0x1c]
mov eax, dword [0x4714a0]
mov eax, dword [eax]
mov edx, 0x445004
call fcn.004181f0
mov eax, dword [ebp - 0x1c]
call fcn.0044d148
test al, al
je 0x444f38
lea eax, [ebp - 8]
call fcn.0045bfd0
call fcn.00444bb8
test al, al
jne 0x444efe
lea eax, [ebp - 0x20]
call fcn.004571ec
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, 6
call fcn.004569c8
mov edx, dword [ebp - 0x24]
pop eax
call fcn.0040479c
mov eax, dword [ebp - 0x20]
call fcn.00404994
push eax
mov eax, dword [ebp - 8]
call fcn.00404994
push eax
call sub.kernel32.dll_MoveFileA
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0045d984
test bl, bl
je 0x444f8b
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0045dce0
call fcn.0045bf34
jmp 0x444f8b
mov ecx, dword [0x4714c0]
mov ecx, dword [ecx]
mov edx, dword [0x4716fc]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.004047e0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0045d984
test bl, bl
je 0x444f8b
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0045dce0
call fcn.0045bf34
jmp 0x444f8b
push 0
push 0
push 0
lea eax, [ebp - 4]
call fcn.004049ec
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.004586f0
call fcn.0045bf34
jmp 0x444f8b
lea edx, [ebp - 0x28]
mov eax, 0x445010
call fcn.00457458
mov eax, dword [ebp - 0x28]
call fcn.00449d28
push 0
push 0
push 0
lea eax, [ebp - 4]
call fcn.004049ec
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.004586f0
call fcn.0045bf34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444fad
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004044dc
ret
Function at 0x445434
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x44543c
push ecx
push ebx
xor eax, eax
push ebp
push 0x4455c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x4714c0]
mov ecx, dword [ecx]
mov edx, dword [0x4716fc]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.004047e0
mov eax, dword [ebp - 8]
call fcn.0045d894
test al, al
je 0x4455a9
lea edx, [ebp - 0x10]
mov eax, 0x4455d8
call fcn.00457458
push dword [ebp - 0x10]
push 0x4455f8
mov eax, dword [0x4716fc]
push dword [eax]
mov eax, dword [0x47161c]
push dword [eax]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00404854
mov eax, dword [ebp - 0xc]
call fcn.00449d28
lea edx, [ebp - 0x18]
mov eax, 0x445604
call fcn.00457458
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0045bee8
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
call fcn.00457144
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
pop ecx
call fcn.004047e0
lea edx, [ebp - 0x20]
mov eax, 4
call fcn.004569c8
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0045d984
push 0
mov eax, dword [0x471514]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_TerminateThread
call fcn.00445390
push 0
push 0
mov ecx, dword [0x47161c]
mov ecx, dword [ecx]
mov edx, dword [0x4716fc]
mov edx, dword [edx]
lea eax, [ebp - 0x24]
call fcn.004047e0
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [0x4714c0]
mov ecx, dword [ecx]
mov edx, dword [0x4716fc]
mov edx, dword [edx]
lea eax, [ebp - 0x28]
call fcn.004047e0
mov eax, dword [ebp - 0x28]
mov ecx, dword [0x4716fc]
mov ecx, dword [ecx]
pop edx
call fcn.004552dc
test eax, eax
jbe 0x4455a9
xor ebx, ebx
inc ebx
cmp ebx, 0x1e
jne 0x44558e
push 0x445618
mov eax, dword [0x4716fc]
push dword [eax]
mov eax, dword [0x47161c]
push dword [eax]
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00404854
mov eax, dword [ebp - 0x2c]
call fcn.00449d28
jmp 0x4455a9
mov eax, 0x64
call fcn.0045be2c
mov eax, dword [ebp - 4]
call fcn.0045d894
test al, al
jne 0x44555e
call fcn.0045bf34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4455cb
lea eax, [ebp - 0x2c]
mov edx, 0xb
call fcn.004044dc
ret