joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b724
Capabilities:
Hash data with md5

Disassembly:
push ebx
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov edx, 0x40
lea ecx, [eax + 0x18]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x42b737
mov edx, 0x10
lea ecx, [eax + 0x58]
xor ebx, ebx
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0x42b746
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebx
ret

Function at 0x42c418
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
xor eax, eax
push ebp
push 0x42c5cf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00404698
add eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp + 8]
call fcn.004043bc
test esi, esi
jbe 0x42c59e
push esi
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x42c59e
mov esi, dword [ebp - 0x38]
jmp 0x42c577
push 0x1c
lea eax, [ebp - 0x5c]
push eax
push esi
push edi
call sub.kernel32.dll_VirtualQueryEx
test eax, eax
jne 0x42c4b4
call sub.kernel32.dll_GetLastError
add esi, dword [ebp - 0x3c]
jmp 0x42c577
cmp ebx, dword [ebp - 0x50]
jae 0x42c4e5
mov eax, dword [ebp - 0x50]
xor edx, edx
push edx
push eax
push 0
push 0x10000
call fcn.0040e914
mov ebx, eax
push ebx
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x42c3f4]
call fcn.00405914
add esp, 4
lea eax, [ebp - 0x10]
push eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x50]
xor edx, edx
push edx
push eax
call fcn.0040e914
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x5c]
push eax
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x42c56e
cmp dword [ebp - 0x10], 0x400
jbe 0x42c56e
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404698
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
mov ecx, dword [ebp - 0x14]
pop edx
call fcn.0042c2fc
test eax, eax
je 0x42c56e
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
call fcn.004046a0
mov eax, dword [ebp + 8]
cmp dword [ebp - 8], 0
je 0x42c56e
mov edx, dword [ebp + 8]
mov edx, dword [edx]
mov eax, dword [ebp - 8]
call fcn.00404980
test eax, eax
jg 0x42c59e
lea eax, [ebx + esi]
cmp esi, eax
ja 0x42c580
add esi, ebx
cmp esi, dword [ebp - 0x34]
jb 0x42c496
push 0
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x42c3f4]
call fcn.00405914
add esp, 4
push edi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42c5d6
lea eax, [ebp - 0x18]
call fcn.004043bc
lea eax, [ebp - 0x14]
mov edx, dword [0x42c3f4]
call fcn.00405920
lea eax, [ebp - 8]
mov edx, 2
call fcn.004043e0
ret
Function at 0x42d060
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x42d18a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edx, edx
push ebp
push 0x42d15f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
push esi
mov eax, dword [0x4565f0]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x42d0c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42d174
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
cmp al, 0xe9
jne 0x42d0d9
pop dword fs:[0]
add esp, 8
jmp 0x42d174
cmp al, 0xff
jne 0x42d0ea
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42d174
mov edi, ebx
sub edi, dword [ebp - 0x10]
sub edi, 5
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, 0xff
call fcn.00402a30
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebx], eax
mov edx, ebx
add edx, 5
mov eax, dword [ebp - 0x10]
call fcn.0042d1a0
mov edx, ebx
add edx, 4
mov byte [edx], al
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
mov eax, dword [ebp - 0x10]
inc eax
mov dword [eax], edi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 5
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
add ebx, 5
mov eax, dword [ebp + 8]
mov dword [eax], ebx
push esi
call sub.kernel32.dll_FreeLibrary_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42d170
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d191
lea eax, [ebp - 4]
call fcn.004043bc
ret

Function at 0x42d464
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x42d473
or edx, 0x200
test eax, 0x20000000
je 0x42d4a7
test eax, 0x40000000
je 0x42d492
test eax, 0x80000000
je 0x42d48d
or edx, 0x40
jmp 0x42d4ce
or edx, 0x20
jmp 0x42d4ce
test eax, 0x80000000
je 0x42d4a1
or edx, 0x80
jmp 0x42d4ce
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x42d4bf
test eax, 0x80000000
je 0x42d4ba
or edx, 4
jmp 0x42d4ce
or edx, 2
jmp 0x42d4ce
test eax, 0x80000000
je 0x42d4cb
or edx, 8
jmp 0x42d4ce
or edx, 1
mov eax, edx
ret
Function at 0x42f688
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
cmp byte [0x457c8c], 0
je 0x42f6b8
mov edx, 0xc8
mov eax, 0x32
call fcn.0040e954
push eax
call sub.kernel32.dll_Sleep
cmp bl, 0x90
jne 0x42f6fb
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp al, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_GetKeyboardState
test bl, bl
je 0x42f6e6
and byte [ebp - 0x72], 0xfe
jmp 0x42f6ea
or byte [ebp - 0x72], 1
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_SetKeyboardState
jmp 0x42f781
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov byte [ebp - 2], al
test si, si
jbe 0x42f781
mov eax, ebx
and eax, 0xff
bt dword [0x455944], eax
jae 0x42f751
mov eax, dword [ebp + 8]
push eax
mov ecx, 1
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.0042f63c
pop ecx
cmp byte [ebp - 1], 0
je 0x42f77c
mov eax, dword [ebp + 8]
push eax
mov ecx, 3
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.0042f63c
pop ecx
jmp 0x42f77c
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.0042f63c
pop ecx
cmp byte [ebp - 1], 0
je 0x42f77c
mov eax, dword [ebp + 8]
push eax
mov ecx, 2
mov dl, byte [ebp - 2]
mov eax, ebx
call fcn.0042f63c
pop ecx
dec si
jne 0x42f711
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42f788
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
cmp byte [0x457c8c], 0
je 0x42f7ac
mov edx, 0xc8
mov eax, 0x32
call fcn.0040e954
push eax
call sub.kernel32.dll_Sleep
push 0
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov edx, ebx
and edx, 0xff
bt dword [0x455944], edx
jae 0x42f7de
mov edx, dword [ebp + 8]
push edx
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.0042f63c
pop ecx
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
mov ecx, 2
mov edx, eax
mov eax, ebx
call fcn.0042f63c
pop ecx
pop ebx
pop ebp
ret
Function at 0x42fdb4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
xor ecx, ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
xor eax, eax
push ebp
push 0x42febc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.004030e4
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 1
mov eax, 0x42fecc
mov dword [ebp - 0x44], eax
push 0x42fee0
push dword [ebp - 4]
push 0x42ff00
push dword [ebp - 8]
lea eax, [ebp - 0x60]
mov edx, 4
call fcn.00404758
mov eax, dword [ebp - 0x60]
call fcn.0043eea0
cmp dword [ebp - 8], 0
jne 0x42fe48
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404454
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x42fe7c
mov ebx, dword [ebp - 0x54]
jmp 0x42fe94
lea eax, [ebp - 0x64]
mov ecx, dword [ebp - 4]
mov edx, 0x42ff18
call fcn.004046e4
mov eax, dword [ebp - 0x64]
call fcn.0043eea0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42fec3
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.004043e0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004043e0
ret

Function at 0x42ff3c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42ffda
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00406f30
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 2
lea eax, [ebp - 0x24]
mov ecx, 0x42fff4
mov edx, ebx
call fcn.004046e4
mov eax, dword [ebp - 0x24]
call fcn.00404898
mov dword [ebp - 0x16], eax
lea eax, [ebp - 0x28]
mov ecx, 0x42fff4
mov edx, esi
call fcn.004046e4
mov eax, dword [ebp - 0x28]
call fcn.00404898
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x614
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ffe1
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004043e0
ret

Function at 0x430e74
Capabilities:
Log keystrokes

Disassembly:
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
ret
Function at 0x431200
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4312cb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.004490fc
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, 0x4312e0
call fcn.004046e4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00444bb0
test al, al
jne 0x4312b0
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x431291
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 7
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00405408
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431298
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4312d2
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004043e0
ret

Function at 0x431400
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4314b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x4314cc
call fcn.00444ee0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00444bb0
test al, al
jne 0x43148a
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x431483
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 5
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00405408
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43148a
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040c7ec
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00404410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4314bf
lea eax, [ebp - 0xc]
call fcn.004043bc
ret
Function at 0x431b54
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x431c6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004043bc
mov eax, dword [ebp - 4]
call fcn.004446c8
test al, al
je 0x431c59
mov al, 2
call fcn.00433c50
mov ebx, 0x46
mov esi, 0x9d
mov edi, 0x8c
push 1
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
mov edx, esi
mov eax, ebx
call fcn.00431510
push 0
push 0
mov eax, dword [ebp - 0x24]
call fcn.00417f24
lea eax, [ebp - 0x24]
push eax
push 0
push 0x457d08
mov ecx, 0x431568
xor edx, edx
xor eax, eax
call fcn.00404370
mov ebx, eax
mov edx, 0xbb8
mov eax, ebx
call fcn.00443fbc
xor edx, edx
push ebp
push 0x431c52
push dword fs:[edx]
mov dword fs:[edx], esp
sub eax, 1
jae 0x431c34
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x431c1a
cmp eax, 0
jbe 0x431c3c
jmp 0x431c1c
jle 0x431c3c
mov ebx, dword [ebp - 0x24]
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [ebx + 4]
mov eax, dword [ebp - 8]
call fcn.004044ac
jmp 0x431c3c
push 0
push ebx
call sub.kernel32.dll_TerminateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431c59
mov eax, dword [ebp - 0x24]
call fcn.00403698
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x431c76
lea eax, [ebp - 4]
call fcn.004043bc
ret
Function at 0x432c54
Capabilities:
Terminate thread

Disassembly:
push 0
mov eax, dword [0x457cfc]
push eax
call sub.kernel32.dll_TerminateThread
mov dl, 1
mov eax, 0x432c80
call fcn.004470c8
mov byte [0x457cf8], 0
ret

Function at 0x4339a8
Capabilities:
Terminate thread

Disassembly:
push 0
mov eax, dword [0x457d00]
push eax
call sub.kernel32.dll_TerminateThread
push 0
mov eax, dword [0x457d04]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [0x457cf9], 0
mov byte [0x457d28], 1
ret

Function at 0x433a7c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x433bab
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040c7d8
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x148]
mov ecx, 0x433bc4
mov edx, dword [ebp - 4]
call fcn.004046e4
mov eax, dword [ebp - 0x148]
call fcn.00404898
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x433b85
test byte [ebp - 0x144], 0x10
je 0x433b63
cmp byte [ebp - 0x118], 0x2e
je 0x433b64
mov edx, 0x433bc8
lea eax, [ebp - 0x118]
call fcn.00408c48
test eax, eax
je 0x433b64
mov edx, 0x433bcc
lea eax, [ebp - 0x118]
call fcn.00408c48
test eax, eax
je 0x433b64
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.0040462c
mov ecx, dword [ebp - 0x150]
lea eax, [ebp - 0x14c]
mov edx, dword [ebp - 4]
call fcn.004046e4
mov eax, dword [ebp - 0x14c]
call fcn.00433a7c
add esi, eax
jmp 0x433b64
inc esi
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x433af0
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433bb2
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.004043e0
lea eax, [ebp - 4]
call fcn.004043bc
ret
Function at 0x433dd0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x433f1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004043bc
cmp dword [ebp - 4], 0
jne 0x433e12
push 0
call sub.user32.dll_GetDC
mov ebx, eax
jmp 0x433e28
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.gdi32.dll_CreateDCA
mov ebx, eax
test ebx, ebx
jne 0x433e3b
mov eax, 0x433f34
call fcn.0043eea0
jmp 0x433f05
push 8
push ebx
call sub.gdi32.dll_GetDeviceCaps
push 0xa
push ebx
call sub.gdi32.dll_GetDeviceCaps
push ebx
push 0
call sub.user32.dll_ReleaseDC
mov dl, 1
mov eax, dword [0x4262b0]
call fcn.004298e0
mov ebx, eax
xor ecx, ecx
mov dl, byte [ebp - 5]
mov eax, ebx
call fcn.00431128
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, esi
call fcn.00431510
mov edx, dword [ebp - 0x24]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x58]
push 1
call sub.kernel32.dll_Sleep_1
cmp byte [0x457d2e], 0
jne 0x433e8c
mov byte [0x457d2d], 1
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [0x45665c]
push eax
mov ecx, 0x4315b0
xor edx, edx
xor eax, eax
call fcn.00404370
mov esi, eax
mov edx, 0x1770
mov eax, esi
call fcn.00443fbc
mov byte [0x457d2d], 0
sub eax, 1
jae 0x433eee
mov esi, dword [ebp - 0x24]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [esi + 4]
mov eax, edi
call fcn.004044ac
jmp 0x433ef6
push 0
push esi
call sub.kernel32.dll_TerminateThread
mov eax, ebx
call fcn.00403698
mov eax, dword [ebp - 0x24]
call fcn.00403698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433f22
lea eax, [ebp - 4]
call fcn.004043bc
ret

Function at 0x434834
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x457d30]
mov edx, dword [eax]
call dword [edx + 0x44]
mov byte [0x457d2c], 0
push 0
mov eax, dword [0x457d38]
push eax
call sub.kernel32.dll_TerminateThread
ret
Function at 0x43488c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x434a9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004043bc
push 0
push 0
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
xor edx, edx
mov eax, 0x3c
call fcn.00431510
xor edx, edx
push ebp
push 0x434a78
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x456860]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x434a5a
inc esi
xor ebx, ebx
mov dl, 1
mov eax, dword [0x4262b0]
call fcn.004298e0
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x28]
mov eax, dword [0x456860]
mov eax, dword [eax]
mov edx, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
call fcn.0040842c
mov edx, dword [ebp - 8]
call fcn.004309b8
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
cmp eax, 0x29a
jl 0x434a4a
lea ecx, [ebp - 0x2c]
mov eax, dword [0x456860]
mov eax, dword [eax]
mov edx, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x2c]
call fcn.0040842c
mov edx, dword [0x45657c]
mov dword [edx], eax
mov eax, dword [0x45657c]
mov eax, dword [eax]
call fcn.00430a24
test al, al
je 0x434974
mov eax, dword [0x45657c]
mov eax, dword [eax]
call fcn.00430a18
push 6
movzx eax, word [0x457d50]
push eax
movzx eax, word [0x457d4e]
push eax
push 0
push 0
push 0
mov eax, dword [0x45657c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowPos
mov eax, dword [0x45657c]
mov eax, dword [eax]
call fcn.00430570
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x24]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x4349c9
cmp eax, 0x2710
jbe 0x434a5a
jmp 0x4349cf
jle 0x434a5a
mov eax, 1
call fcn.00443ad0
mov eax, dword [0x456520]
cmp byte [eax], 0
jne 0x4349cf
mov eax, dword [0x45663c]
mov byte [eax], 1
lea eax, [ebp - 0x24]
push eax
push 0
mov eax, dword [0x456658]
push eax
mov ecx, 0x43158c
xor edx, edx
xor eax, eax
call fcn.00404370
mov esi, eax
mov edx, 0x1770
mov eax, esi
call fcn.00443fbc
mov edx, dword [0x45663c]
mov byte [edx], 0
sub eax, 1
jae 0x434a39
mov esi, dword [ebp - 0x24]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [esi + 4]
mov eax, dword [ebp - 4]
call fcn.004044ac
jmp 0x434a5a
push 0
push esi
call sub.kernel32.dll_TerminateThread
push 0
call sub.kernel32.dll_ExitThread_1
mov eax, dword [ebp - 8]
call fcn.00403698
inc ebx
dec esi
jne 0x4348f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434a7f
mov eax, dword [ebp - 8]
call fcn.00403698
mov eax, dword [ebp - 0x24]
call fcn.00403698
ret
Function at 0x435ed0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x4360bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x456890]
mov eax, dword [eax]
call fcn.004446c8
test al, al
je 0x435f14
mov eax, dword [0x456890]
mov eax, dword [eax]
call fcn.0044509c
lea eax, [ebp - 0xc]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004048f8
mov eax, dword [ebp - 0xc]
mov edx, 0x4360d0
call fcn.004047e4
je 0x435f48
mov eax, 0x4360dc
call fcn.0043efa0
jmp 0x4360a1
test bl, bl
je 0x435f64
mov eax, dword [0x456668]
mov eax, dword [eax]
call fcn.00446de8
mov eax, dword [0x4566f8]
mov eax, dword [eax]
call fcn.00446de8
lea ecx, [ebp - 0x10]
mov eax, dword [0x4564e8]
mov eax, dword [eax]
mov edx, 0x436104
call fcn.00416dc0
mov eax, dword [ebp - 0x10]
call fcn.0043bec0
test al, al
je 0x436079
lea ecx, [ebp - 0x14]
mov eax, dword [0x4564e8]
mov eax, dword [eax]
mov edx, 0x436110
call fcn.00416dc0
mov eax, dword [ebp - 0x14]
call fcn.0043bec0
test al, al
je 0x436059
lea eax, [ebp - 8]
call fcn.00443c30
call fcn.00435d5c
test al, al
jne 0x43601f
lea eax, [ebp - 0x18]
call fcn.00449268
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, 6
call fcn.00448ad4
mov edx, dword [ebp - 0x1c]
pop eax
call fcn.004046a0
mov eax, dword [ebp - 0x18]
call fcn.00404898
push eax
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
call sub.kernel32.dll_MoveFileA
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004447b8
test bl, bl
je 0x4360a1
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004449a0
call fcn.00443bd8
jmp 0x4360a1
mov ecx, dword [0x456534]
mov ecx, dword [ecx]
mov edx, dword [0x456720]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.004046e4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004447b8
test bl, bl
je 0x4360a1
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004449a0
call fcn.00443bd8
jmp 0x4360a1
push 0
push 0
push 0
lea eax, [ebp - 4]
call fcn.004048f0
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.00441350
call fcn.00443bd8
jmp 0x4360a1
mov eax, 0x43611c
call fcn.0043efa0
push 0
push 0
push 0
lea eax, [ebp - 4]
call fcn.004048f0
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.00441350
call fcn.00443bd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4360c3
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004043e0
ret