joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4347fc
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x218], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x434a6e
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x43493a
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
jbe 0x434882
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.004068d8
jmp 0x43488b
mov eax, ebx
xor edx, edx
call fcn.004066d8
cmp dword [ebx], 0
jne 0x43489e
mov ecx, ebx
xor edx, edx
mov eax, 0x1a
call fcn.00436bbc
cmp dword [ebx], 0
je 0x434a2a
push 0
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_CreateDirectoryW
mov eax, dword [ebx]
call fcn.00406988
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4348d2
mov eax, ebx
mov edx, 0x434a88
call fcn.00406a2c
push dword [ebx]
lea edx, [ebp - 0x218]
xor eax, eax
call fcn.00434544
mov eax, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.0040ebcc
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
call fcn.004345f8
push dword [ebp - 0x210]
push 0x434a98
mov eax, ebx
mov edx, 3
call fcn.00406b7c
push 0
mov eax, dword [ebx]
call fcn.00406764
push eax
call sub.kernel32.dll_CreateDirectoryW
mov eax, ebx
mov edx, 0x434a88
call fcn.00406a2c
jmp 0x434a2a
lea eax, [ebp - 0x20a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
jbe 0x434a21
lea eax, [ebp - 0x21c]
lea esi, [ebp - 0x20a]
mov edx, esi
mov ecx, 0
call fcn.00405c38
mov edx, dword [ebp - 0x21c]
mov eax, ebx
call fcn.004068f4
cmp dword [ebx], 0
je 0x434a2a
push 0
push esi
call sub.kernel32.dll_CreateDirectoryA
mov eax, dword [ebx]
call fcn.00406988
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4349a6
mov eax, ebx
mov edx, 0x434a88
call fcn.00406a2c
push dword [ebx]
lea edx, [ebp - 0x228]
xor eax, eax
call fcn.00434544
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x224]
call fcn.0040ebcc
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
call fcn.004345f8
push dword [ebp - 0x220]
push 0x434a98
mov eax, ebx
mov edx, 3
call fcn.00406b7c
push 0
lea eax, [ebp - 0x22c]
mov edx, dword [ebx]
mov ecx, 0
call fcn.0040691c
mov eax, dword [ebp - 0x22c]
call fcn.00406040
push eax
call sub.kernel32.dll_CreateDirectoryA
mov eax, ebx
mov edx, 0x434a88
call fcn.00406a2c
jmp 0x434a2a
mov eax, ebx
xor edx, edx
call fcn.004066d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434a75
lea eax, [ebp - 0x22c]
call fcn.00405984
lea eax, [ebp - 0x228]
mov edx, 3
call fcn.004066d0
lea eax, [ebp - 0x21c]
call fcn.00405984
lea eax, [ebp - 0x218]
mov edx, 3
call fcn.004066d0
ret
Function at 0x434ab0
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd8c
push ebx
xor eax, eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x434cff
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004347fc
cmp dword [ebp - 4], 0
je 0x434cc9
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x434bcd
mov eax, dword [ebp - 4]
call fcn.00406764
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x434cc9
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x258]
mov ecx, 0x434d18
mov edx, dword [ebp - 4]
call fcn.00406aac
mov eax, dword [ebp - 0x258]
call fcn.00406764
push eax
call sub.kernel32.dll_FindFirstFileW_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x434bba
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x228]
mov ecx, 0x104
call fcn.004068d8
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 0x25c]
mov edx, dword [ebp - 4]
call fcn.00406aac
mov eax, dword [ebp - 0x25c]
call fcn.00406764
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x434b68
push ebx
call sub.kernel32.dll_FindClose_1
mov eax, dword [ebp - 4]
call fcn.00406764
push eax
call sub.kernel32.dll_RemoveDirectoryW
jmp 0x434cc9
lea eax, [ebp - 0x264]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040691c
mov eax, dword [ebp - 0x264]
call fcn.00406040
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x434cc9
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x268]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040691c
lea eax, [ebp - 0x268]
mov edx, 0x434d2c
call fcn.00405d4c
mov eax, dword [ebp - 0x268]
call fcn.00406040
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x434ca5
lea eax, [ebp - 0x26c]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040691c
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x254]
add edx, 0x2c
mov ecx, 0x104
push 0
call fcn.00405cbc
mov edx, dword [ebp - 0x270]
pop eax
call fcn.00405d4c
mov eax, dword [ebp - 0x26c]
call fcn.00406040
push eax
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x254]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x434c3c
push ebx
call sub.kernel32.dll_FindClose_1
lea eax, [ebp - 0x274]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040691c
mov eax, dword [ebp - 0x274]
call fcn.00406040
push eax
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434d06
lea eax, [ebp - 0x274]
mov edx, 5
call fcn.004059a8
lea eax, [ebp - 0x260]
mov edx, 3
call fcn.004066d0
lea eax, [ebp - 4]
call fcn.004066c8
ret
Function at 0x434d30
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor edx, edx
mov dword [ebp - 0x214], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x434dd5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x104
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x434d89
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_GetComputerNameW
mov eax, ebx
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.004068d8
jmp 0x434dbc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20e]
mov ecx, 0
call fcn.00405c38
mov edx, dword [ebp - 0x214]
mov eax, ebx
call fcn.004068f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434ddc
lea eax, [ebp - 0x214]
call fcn.00405984
ret
Function at 0x434de4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x434fa1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor edx, edx
call fcn.004066d8
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x434ec2
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call fcn.00406764
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x434f86
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406764
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x434eb4
cmp dword [ebp - 0xc], 0
je 0x434eb4
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x434eae
mov eax, ebx
mov edx, esi
call fcn.00406884
push esi
call sub.kernel32.dll_LocalFree
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x434f86
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x14]
mov edx, edi
mov ecx, 0
call fcn.0040691c
mov eax, dword [ebp - 0x14]
call fcn.00406040
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x434f86
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040691c
mov eax, dword [ebp - 0x18]
call fcn.00406040
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x434f7d
cmp dword [ebp - 0xc], 0
je 0x434f7d
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x434f77
lea eax, [ebp - 0x1c]
mov edx, esi
mov ecx, 0
call fcn.00405c38
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.004068f4
push esi
call sub.kernel32.dll_LocalFree
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434fa8
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004059a8
ret
Function at 0x434fb4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.004066c0
xor eax, eax
push ebp
push 0x435123
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x435063
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, edi
call fcn.00406764
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExW
test eax, eax
jne 0x4350f8
lea eax, [ebp + 8]
call fcn.00405b64
call fcn.00406988
add eax, eax
add eax, 2
push eax
mov eax, dword [ebp + 8]
call fcn.00406764
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00406764
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4350f8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov edx, edi
mov ecx, 0
call fcn.0040691c
mov eax, dword [ebp - 0x14]
call fcn.00406040
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x4350f8
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
mov ecx, 0
call fcn.0040691c
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405b94
call fcn.00405d18
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00406040
push eax
push 1
push 0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
mov ecx, 0
call fcn.0040691c
mov eax, dword [ebp - 0x18]
call fcn.00406040
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43512a
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004059a8
lea eax, [ebp - 4]
call fcn.00405984
lea eax, [ebp + 8]
call fcn.004066c8
ret
Function at 0x435138
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x435223
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4351ab
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov eax, edi
call fcn.00406764
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x435208
mov eax, dword [ebp - 4]
call fcn.00406764
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x435208
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0xc]
mov edx, edi
mov ecx, 0
call fcn.0040691c
mov eax, dword [ebp - 0xc]
call fcn.00406040
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x435208
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040691c
mov eax, dword [ebp - 0x10]
call fcn.00406040
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43522a
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004059a8
ret

Function at 0x4358bc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00419e1c
test eax, eax
je 0x43596d
cmp word [eax + 0x18], 0x20b
jne 0x4358fa
add eax, 0x18
add eax, 0x78
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
jmp 0x43590c
add eax, 0x80
mov edx, dword [eax]
mov esi, edx
add esi, dword [ebp - 4]
add edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
test esi, esi
je 0x43596d
jmp 0x435967
mov eax, dword [esi + 0x10]
cmp eax, dword [ebp - 0x10]
jbe 0x435923
push ebp
call fcn.004356fc
pop ecx
jmp 0x43596d
cmp dword [esi + 0x10], 0
je 0x435964
mov ebx, dword [ebp - 4]
add ebx, dword [esi + 0x10]
jmp 0x43595f
cmp edi, dword [ebx]
jne 0x43595c
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x43595c
mov eax, dword [ebp - 8]
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
add ebx, 4
cmp dword [ebx], 0
jne 0x435931
add esi, 0x14
cmp dword [esi + 0xc], 0
jne 0x435912
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x436bbc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x436d41
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
xor edx, edx
call fcn.004066d8
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x436d15
lea eax, [ebp - 8]
push eax
push esi
push 0xffffffffffffffff
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x436d15
cmp dword [0x55bcd0], 0
jne 0x436c3e
push 0x436d50
push 0x436d7c
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00409750
mov dword [0x55bcd0], eax
cmp dword [0x55bcd0], 0
je 0x436c70
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x55bcd0]
test eax, eax
je 0x436c70
mov eax, edi
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.004068d8
jmp 0x436ca7
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x436ca7
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x212]
mov ecx, 0
call fcn.00405c38
mov edx, dword [ebp - 0x218]
mov eax, edi
call fcn.004068f4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
cmp dword [edi], 0
jne 0x436cd3
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.00434544
mov eax, dword [ebp - 0x21c]
mov edx, edi
call fcn.0040ec0c
cmp dword [edi], 0
je 0x436d15
mov eax, dword [edi]
call fcn.00406988
mov edx, dword [edi]
cmp word [edx + eax*2 - 2], 0x5c
sete al
cmp bl, al
je 0x436d15
test bl, bl
je 0x436d00
mov eax, edi
mov edx, 0x436da0
call fcn.00406a2c
jmp 0x436d15
mov eax, dword [edi]
call fcn.00406988
mov edx, eax
mov eax, edi
mov ecx, 1
call fcn.00406dfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x436d48
lea eax, [ebp - 0x21c]
call fcn.004066c8
lea eax, [ebp - 0x218]
call fcn.00405984
lea eax, [ebp - 4]
call fcn.004087a4
ret
Function at 0x4377ec
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004066c0
xor eax, eax
push ebp
push 0x4378a2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x437820
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x43788c
lea eax, [ebp - 4]
call fcn.00405b64
call fcn.00406988
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
je 0x437887
lea eax, [ebp - 4]
call fcn.00405b64
call fcn.00406988
add eax, eax
add eax, 2
push eax
mov eax, dword [ebp - 4]
call fcn.00406764
mov edx, esi
pop ecx
call fcn.0040323c
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 0xd
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4378a9
lea eax, [ebp - 4]
call fcn.004066c8
ret
Function at 0x439a40
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x439bf4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.00439974
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x439bd2
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [0x54ceac], 0
jne 0x439ba6
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x14]
call fcn.004352f8
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040d33c
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x439c14
call fcn.00405dc8
mov eax, dword [ebp - 0x2c]
call fcn.00406040
push eax
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov edi, eax
test edi, edi
sete bl
test bl, bl
je 0x439b1a
lea eax, [ebp - 0x38]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040d33c
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x439c14
call fcn.00405dc8
mov eax, dword [ebp - 0x34]
call fcn.00406040
push eax
push 4
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
test edi, edi
jne 0x439b35
xor esi, esi
push 0
push 0x439c2c
push 0x439c38
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x439b95
test bl, bl
je 0x439b7c
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push 4
push 0x1000
push 0x28
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov dword [esi], ebx
mov eax, ebx
mov edx, 0x28
call fcn.0040a41c
mov eax, dword [esi]
mov dword [eax + 4], edi
add eax, 8
push eax
call sub.kernel32.dll_InitializeCriticalSection
jmp 0x439b95
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push edi
call sub.kernel32.dll_CloseHandle_1
test esi, esi
je 0x439ba6
mov eax, esi
call fcn.00467ec4
mov dword [0x54ceac], esi
cmp dword [0x54ceac], 0
je 0x439bbc
mov eax, dword [0x54ceac]
mov eax, dword [eax]
inc dword [eax]
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439bd9
mov eax, dword [ebp - 8]
call fcn.00439a2c
ret

Function at 0x43dc48
Capabilities:
Create thread
Resume thread

Disassembly:
cmp dword [0x54ced8], 0
jne 0x43dcdb
xor eax, eax
call fcn.004195bc
mov dword [0x54ced8], eax
cmp dword [0x54ced8], 0
je 0x43dcdb
mov eax, 0x43daac
xor ecx, ecx
xor edx, edx
call fcn.00419ac0
mov dword [0x54cedc], eax
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x54ceec], eax
push 0x54ced0
push 4
push 0
push 0x43daf4
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x54ced4], eax
cmp dword [0x54ced4], 0
je 0x43dcdb
mov edx, 0x43dce8
mov eax, dword [0x54ced0]
call fcn.00435f54
push 2
mov eax, dword [0x54ced4]
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, dword [0x54ced4]
push eax
call sub.kernel32.dll_ResumeThread
ret
Function at 0x43dd24
Capabilities:
Terminate thread

Disassembly:
push ebx
cmp dword [0x54ced8], 0
je 0x43ddf5
mov ebx, dword [0x54ceec]
xor eax, eax
mov dword [0x54ceec], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
cmp dword [0x54cee8], 0
je 0x43dd6d
mov ebx, dword [0x54cee8]
xor eax, eax
mov dword [0x54cee8], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
mov dword [0x54cee4], 0xffffffff
mov eax, 0x43daac
xor ecx, ecx
xor edx, edx
call fcn.00419cec
push 0x1f4
mov eax, dword [0x54ced4]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x43ddba
push 0
mov eax, dword [0x54ced4]
push eax
call sub.kernel32.dll_TerminateThread
cmp dword [0x54cef0], 0
je 0x43ddba
mov eax, dword [0x54cef0]
push eax
call sub.kernel32.dll_LocalFree
xor eax, eax
mov dword [0x54cef0], eax
mov eax, dword [0x54ced4]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [0x54ced0]
call fcn.00435cc8
xor eax, eax
mov dword [0x54ced4], eax
xor eax, eax
mov dword [0x54ced0], eax
xor eax, eax
mov dword [0x54ced8], eax
pop ebx
ret
Function at 0x445d5c
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.00406040
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x445d88
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x445d88
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x447984
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
or dword [ebp + 0xc], 0xc11c
cmp byte [0x54c574], 0
je 0x4479aa
or dword [ebp + 0xc], 0x80000
push 1
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 1
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 1
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0x11
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0044791c
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x18]
mov esi, eax
mov eax, esi
call fcn.00433c0c
test al, al
jne 0x447a2a
cmp esi, 0x80090318
jne 0x447a32
test edi, edi
je 0x447a32
mov byte [ebx + 0x5c], 1
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x447a62
cmp dword [ebp - 0x24], 0
je 0x447a62
push 0
mov eax, dword [ebp - 0x24]
push eax
push edi
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x447a58
mov esi, 0x80090304
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x447a76
cmp dword [ebp - 0x18], 0
je 0x447a76
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc