joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442864
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov esi, 0x4642d8
mov ecx, esi
call fcn.00442e4b
test eax, eax
jne 0x442895
push 0x4565d8
push eax
push str.Cant_open_clipboard_for_reading.
mov ecx, edi
call fcn.0044a6b8
jmp 0x442a54
mov ecx, dword [0x463c78]
push ebx
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x457f24
call fcn.00401525
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
push ebx
jne 0x4428d6
mov ecx, esi
call fcn.00442aac
jmp 0x442a53
mov byte [ebp - 2], bl
mov byte [ebp - 3], bl
mov byte [ebp - 4], bl
mov dword [ebp - 8], ebx
jmp 0x4429ee
cmp eax, 1
je 0x4428f9
cmp eax, 7
je 0x4428f9
cmp eax, 0xd
mov byte [ebp + 0xb], bl
jne 0x4428fd
mov byte [ebp + 0xb], 1
cmp eax, 8
je 0x44290a
cmp eax, 0x11
mov byte [ebp - 1], bl
jne 0x44290e
mov byte [ebp - 1], 1
cmp eax, 0xe
je 0x44291c
cmp eax, 3
je 0x44291c
xor cl, cl
jmp 0x44291e
mov cl, 1
cmp byte [ebp + 0xb], bl
je 0x44292c
cmp byte [ebp - 2], bl
jne 0x4429ed
cmp byte [ebp - 1], bl
je 0x44293a
cmp byte [ebp - 3], bl
jne 0x4429ed
cmp cl, bl
je 0x442947
cmp byte [ebp - 4], bl
jne 0x4429ed
cmp byte [ebp + 0xb], bl
je 0x442952
mov byte [ebp - 2], 1
jmp 0x442965
cmp byte [ebp - 1], bl
je 0x44295d
mov byte [ebp - 3], 1
jmp 0x442965
cmp cl, bl
je 0x442965
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.00442d0e
mov edi, eax
cmp edi, ebx
je 0x4429ea
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalSize]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x44298f
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x4429ea
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x442a01
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x442a01
cmp dword [ebp - 0x10], ebx
je 0x4429ea
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
cmp esi, ebx
mov esi, 0x4642d8
je 0x442a0d
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_EnumClipboardFormats]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x4428e7
jmp 0x442a0d
cmp dword [ebp - 0x10], ebx
je 0x442a0d
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push ebx
mov ecx, esi
call fcn.00442aac
cmp dword [ebp - 8], ebx
jne 0x442a47
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x442a47
mov ecx, dword [0x463c78]
push 1
push ebx
push 0xffffffffffffffff
push 0x45671c
call fcn.00401525
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x442af8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x18], bl
jne 0x442b1a
call fcn.00442e4b
test eax, eax
jne 0x442b1a
push str.Cant_open_clipboard_for_writing.
jmp 0x442ba7
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x442b33
push ebx
mov ecx, esi
call fcn.00442aac
push 0x4567f0
jmp 0x442ba7
mov ecx, dword [esi + 4]
cmp ecx, ebx
je 0x442b77
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x442b85
cmp byte [eax], bl
jne 0x442b56
cmp dword [ebp + 8], 0xd
jne 0x442b50
cmp byte [eax + 1], bl
jne 0x442b56
mov byte [ebp - 1], 1
jmp 0x442b59
mov byte [ebp - 1], bl
push ecx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
cmp byte [ebp - 1], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
je 0x442b85
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov dword [esi + 4], eax
push ebx
mov ecx, esi
call fcn.00442aac
pop esi
pop ebx
leave
ret 4
push dword [esi + 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x442b9a
mov dword [esi + 4], ebx
jmp 0x442b77
push ebx
mov ecx, esi
call fcn.00442aac
push 0x4567dc
mov ecx, esi
call fcn.00442a5a
jmp 0x442b7f

Function at 0x442d0e
Capabilities:
Check for time delay via gettickcount
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 0xc000
jb 0x442dc3
cmp ebx, 0xffff
ja 0x442dc3
push 0x104
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
push 0xb
lea eax, [ebp - 0x108]
push str.Link_Source
push eax
call fcn.0044188c
add esp, 0xc
test eax, eax
je 0x442dbc
lea eax, [ebp - 0x108]
push str.ObjectLink
push eax
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x442dbc
lea eax, [ebp - 0x108]
push str.OwnerLink
push eax
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x442dbc
lea eax, [ebp - 0x108]
push str.Native
push eax
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x442dbc
lea eax, [ebp - 0x108]
push str.Embed_Source
push eax
call fcn.00441849
test eax, eax
pop ecx
pop ecx
jne 0x442dca
xor eax, eax
jmp 0x442e46
mov byte [ebp - 0x108], 0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call edi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp + 8], eax
jmp 0x442e39
cmp ebx, 0xf
je 0x442e42
lea eax, [ebp - 0x108]
push str.OwnerLink
push eax
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x442e42
mov eax, dword [0x461064]
cmp eax, 0xffffffff
je 0x442e1d
test eax, eax
je 0x442e42
call edi
mov ecx, dword [0x461064]
mov edx, dword [ebp + 8]
add ecx, edx
sub ecx, eax
cmp ecx, 5
jle 0x442e42
push 1
push 0x8000012f
mov byte [0x461069], 0
call fcn.0040bd90
pop ecx
pop ecx
mov byte [0x461069], 1
push ebx
call esi
test eax, eax
je 0x442ddf
jmp 0x442e44
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x442e4b
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebp
mov ebp, ecx
cmp byte [ebp + 0x18], 0
je 0x442e59
xor eax, eax
inc eax
pop ebp
ret
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push edi
call esi
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebx, eax
jmp 0x442ea9
mov eax, dword [0x461064]
cmp eax, 0xffffffff
je 0x442e8d
test eax, eax
je 0x442ebe
call esi
mov ecx, dword [0x461064]
add ecx, ebx
sub ecx, eax
cmp ecx, 5
jle 0x442ebe
push 1
push 0x8000012f
mov byte [0x461069], 0
call fcn.0040bd90
pop ecx
pop ecx
mov byte [0x461069], 1
push dword [0x463360]
call edi
test eax, eax
je 0x442e6e
xor eax, eax
mov byte [ebp + 0x18], 1
inc eax
jmp 0x442ec0
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4431ff
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebp
push esi
push edi
mov esi, ecx
jmp 0x44320a
mov esi, dword [esi + 4]
cmp byte [esi + 0xf], 2
je 0x443207
mov ebp, dword [esp + 0x14]
cmp byte [ebp + 0xf], 2
jne 0x44321f
mov edi, dword [ebp + 4]
jmp 0x443221
mov edi, ebp
cmp byte [esi + 0xf], 3
jne 0x44325b
mov eax, dword [edi]
cmp eax, dword [esi]
je 0x443256
push 1
push 0
push dword [edi + 4]
mov ecx, esi
push 0
call fcn.00401525
test eax, eax
je 0x4432a8
mov eax, dword [edi + 4]
inc eax
push eax
push dword [edi]
push dword [esi]
call fcn.00453500
add esp, 0xc
or byte [esi + 0xd], 1
xor eax, eax
inc eax
jmp 0x4432a8
mov ecx, 0x4642d8
call fcn.00442e4b
test eax, eax
jne 0x44327f
push 0x4565d8
push str.Cant_open_clipboard_for_writing.
mov ecx, 0x463de0
call fcn.0044a877
jmp 0x4432a8
push ebx
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [ebp]
mov eax, dword [ebp + 4]
lea eax, [eax + esi + 1]
lea edi, [esi + 4]
cmp edi, eax
mov dword [esp + 0x18], eax
jbe 0x4432b3
push 0
mov ecx, 0x4642d8
call fcn.00442aac
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret 4
mov eax, dword [esp + 0x18]
mov esi, dword [esi]
test esi, esi
mov dword [esp + 0x10], esi
je 0x44329b
mov ecx, edi
add edi, 4
cmp edi, eax
ja 0x44329b
mov ebx, dword [ecx]
mov esi, edi
add edi, ebx
cmp edi, eax
ja 0x44329b
push ebx
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x443318
test ebx, ebx
je 0x443302
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
test eax, eax
je 0x44333d
push ebx
push esi
push eax
call fcn.00453500
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov esi, edi
push ebp
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
lea edi, [esi + 4]
cmp edi, dword [esp + 0x18]
jbe 0x4432af
jmp 0x44329b
push 0
mov ecx, 0x4642d8
call fcn.00442aac
push 0x4565d8
push str.Out_of_memory.
mov ecx, 0x463de0
call fcn.0044a877
jmp 0x4432a7
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push 0
mov ecx, 0x4642d8
call fcn.00442aac
push 0x4565d8
push 0x456750
jmp 0x44332e
Function at 0x44335c
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 0x28
call fcn.004441d8
cmp byte [esp + 0x2c], al
mov byte [esp + 2], al
je 0x443557
test al, al
push esi
jne 0x4433ad
cmp byte [esp + 0x34], al
jne 0x4433ad
push 0x463210
xor esi, esi
push esi
push esi
push 0x444366
push 0x2000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, esi
mov dword [0x464510], eax
je 0x443444
push 0xf
push eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
movzx esi, byte [esp + 0x30]
push ebx
xor eax, eax
xor ebx, ebx
cmp byte [esp + 0x38], al
push ebp
sete al
push edi
mov edi, 0x417
mov ebp, eax
push ebp
push esi
push edi
push dword [0x463210]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
test eax, eax
jne 0x4433e8
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc ebx
cmp ebx, 0x32
jl 0x4433c7
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov byte [esp + 0x13], 0
call ebp
mov dword [esp + 0x18], eax
cmp byte [esp + 0x3c], 0
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
je 0x44344e
push 1
push edi
push edi
xor esi, esi
push esi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x44347f
cmp dword [esp + 0x24], esi
je 0x4434ae
mov byte [esp + 0x13], 1
call fcn.004441d8
test al, al
jne 0x4434ae
cmp byte [esp + 0x40], al
jne 0x44352a
mov byte [esp + 0x3c], al
jmp 0x4433f9
call fcn.00444165
jmp 0x443556
cmp byte [esp + 0x40], 0
je 0x443462
call fcn.004441d8
xor esi, esi
test al, al
je 0x4434ae
jmp 0x44347f
lea eax, [esp + 0x14]
push eax
push dword [0x464510]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
cmp dword [esp + 0x14], 0x103
jne 0x443498
xor esi, esi
call ebp
sub eax, dword [esp + 0x18]
cmp eax, 0x1f4
ja 0x4434ae
push esi
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4433f9
push dword [0x464510]
call ebx
and dword [0x464510], 0
call fcn.00444165
xor esi, esi
cmp byte [esp + 0x40], 0
jne 0x443523
cmp dword [0x463490], esi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateMutexA]
je 0x4434da
test byte [esp + 0x12], 1
jne 0x4434ef
push str.AHK_Keybd
push esi
push esi
call edi
mov dword [0x4644ec], eax
jmp 0x4434ef
test byte [esp + 0x12], 1
je 0x4434ef
push dword [0x4644ec]
call ebx
mov dword [0x4644ec], esi
cmp dword [0x463494], esi
je 0x44350e
test byte [esp + 0x12], 2
jne 0x443523
push str.AHK_Mouse
push esi
push esi
call edi
mov dword [0x4644f0], eax
jmp 0x443523
test byte [esp + 0x12], 2
je 0x443523
push dword [0x4644f0]
call ebx
mov dword [0x4644f0], esi
cmp byte [esp + 0x13], 0
je 0x443553
push esi
fldz
push ecx
push ecx
fstp qword [esp]
push esi
push 0x10000
push 0x457a98
mov byte [0x461069], 0
call fcn.0043b595
add esp, 0x18
mov byte [0x461069], 1
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x28
ret
Function at 0x4444f9
Capabilities:
Check for time delay via gettickcount

Disassembly:
test byte [esp + 4], 0x10
je 0x444503
xor al, al
ret
cmp byte [esp + 8], 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
je 0x444518
cmp byte [esp + 0xc], 0x10
jne 0x44456d
xor cl, cl
cmp byte [esp + 0x10], cl
jne 0x44456d
cmp byte [0x4644df], cl
je 0x44453b
call fcn.0044414e
test al, al
jne 0x44453b
mov byte [0x4644df], cl
xor al, al
pop esi
ret
cmp byte [0x4644d9], cl
je 0x44456d
xor eax, eax
mov ax, word [0x4644dc]
push eax
xor eax, eax
mov al, byte [0x4644de]
push eax
call fcn.00444495
add esp, 8
test al, al
je 0x44456d
call esi
sub eax, dword [0x4644d4]
cmp eax, 0x16
jb 0x444537
call esi
mov dword [0x4644b4], eax
mov al, 1
pop esi
ret
Function at 0x446430
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x4644d8], 0
je 0x4464ab
mov al, byte [0x4644de]
cmp al, 0xa0
je 0x446449
cmp al, 0x10
jne 0x4464ab
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x4644d4]
cmp eax, 0x16
jae 0x4464ab
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00444495
add esp, 8
cmp byte [0x4644d9], 0
jne 0x446483
call fcn.0044414e
test al, al
je 0x4464ab
mov byte [0x4644df], 1
jmp 0x44648d
cmp byte [ebp + 0x14], 0
jne 0x446476
test al, al
je 0x4464ab
mov al, byte [0x4644d0]
mov byte [0x46337e], al
mov al, byte [0x4644cf]
mov byte [0x463390], al
mov al, byte [0x4644ce]
mov byte [0x463420], al
mov al, byte [0x46337e]
mov ecx, dword [0x464500]
mov byte [0x4644d0], al
mov al, byte [0x463390]
push ebx
push esi
movzx esi, byte [ebp + 0xc]
mov byte [0x4644cf], al
mov al, byte [0x463420]
mov byte [0x4644ce], al
lea eax, [esi + esi*8]
shl eax, 5
mov bl, byte [eax + ecx + 4]
test bl, bl
push edi
mov edi, dword [ebp + 8]
je 0x4465f5
push dword [ebp + 0x14]
cmp dword [edi + 0x10], 0xffc3d44f
push dword [ebp + 0xc]
setne byte [ebp + 0xb]
push dword [edi + 8]
call fcn.004444f9
add esp, 0xc
cmp byte [ebp + 0x14], 0
je 0x44659b
cmp byte [ebp + 0x18], 0
jne 0x44652d
mov cl, bl
not cl
and byte [0x46337c], cl
cmp byte [ebp + 0xb], 0
je 0x44652d
and byte [0x46337d], cl
test al, al
je 0x4465f5
not bl
and byte [0x46337e], bl
sub esi, 0xa0
mov byte [esi + 0x463420], 0
je 0x446594
dec esi
je 0x446588
dec esi
je 0x44657c
dec esi
je 0x446575
dec esi
je 0x446566
dec esi
jne 0x4465f5
mov al, byte [0x463424]
jmp 0x44656b
mov al, byte [0x463425]
mov byte [0x463392], al
jmp 0x4465f5
mov al, byte [0x463422]
jmp 0x446581
mov al, byte [0x463423]
mov byte [0x463391], al
jmp 0x4465f5
mov al, byte [0x463420]
mov byte [0x463390], al
jmp 0x4465f5
mov al, byte [0x463421]
jmp 0x44658d
cmp byte [ebp + 0x18], 0
jne 0x4465b3
or byte [0x46337c], bl
cmp byte [ebp + 0xb], 0
je 0x4465b3
or byte [0x46337d], bl
test al, al
je 0x4465f5
or byte [0x46337e], bl
cmp byte [ebp + 0xc], 0xa0
mov byte [esi + 0x463380], 0x80
jb 0x4465f5
cmp byte [ebp + 0xc], 0xa1
jbe 0x4465ee
cmp byte [ebp + 0xc], 0xa3
jbe 0x4465e5
cmp byte [ebp + 0xc], 0xa5
ja 0x4465f5
mov byte [0x463392], 0x80
jmp 0x4465f5
mov byte [0x463391], 0x80
jmp 0x4465f5
mov byte [0x463390], 0x80
mov cx, word [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov word [0x4644dc], cx
mov ecx, dword [ebp + 0x14]
push ecx
push eax
push dword [edi + 8]
mov byte [0x4644de], al
mov byte [0x4644d9], cl
call fcn.004444f9
add esp, 0xc
mov byte [0x4644d8], al
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
pop edi
pop esi
mov dword [0x4644d4], eax
pop ebx
pop ebp
ret
Function at 0x44690b
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x10c
push edi
mov edi, dword [esp + 0x114]
push edi
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
test eax, eax
jne 0x44693f
cmp byte [0x46428c], al
je 0x4469dc
push 1
push eax
push 0xffffffffffffffff
push 0x457f24
jmp 0x4469d1
cmp byte [0x46428c], 0
push ebx
push ebp
push esi
mov ebp, 0x463c80
jne 0x446954
lea ebp, [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
push ebp
mov esi, 0x104
push esi
call ebx
test eax, eax
je 0x4469af
cmp byte [edi], 0
je 0x4469ba
cmp byte [edi + 1], 0x3a
jne 0x4469ba
cmp byte [edi + 2], 0
jne 0x4469ba
push ebp
push edi
call fcn.00441849
test eax, eax
pop ecx
pop ecx
je 0x4469ba
push edi
lea eax, [esp + 0x14]
push 0x45b0b4
push eax
call fcn.0044118f
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
test eax, eax
je 0x4469ba
push ebp
push esi
call ebx
test eax, eax
jne 0x4469ba
push esi
push edi
push ebp
call fcn.00438c34
add esp, 0xc
cmp byte [0x46428c], 0
pop esi
pop ebp
pop ebx
je 0x4469dc
push 1
push 0
push 0xffffffffffffffff
push 0x45671c
mov ecx, dword [0x463c78]
call fcn.00401525
pop edi
add esp, 0x10c
ret

Function at 0x4469e4
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x494]
xor ebx, ebx
cmp eax, ebx
mov byte [esi + 0x50], 1
mov byte [esi + 0x4ad], bl
mov byte [esi + 0x4ac], bl
je 0x446af7
cmp byte [eax], bl
je 0x446af7
push 0x10
call fcn.0044bdc7
cmp eax, ebx
pop ecx
je 0x446a32
mov dword [eax], 0x4565d8
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x446a34
xor eax, eax
cmp eax, ebx
mov dword [esi + 0x240], eax
je 0x446af7
push ebx
push ebx
push dword [esi + 0x494]
mov ecx, esi
call fcn.00446afe
cmp eax, 1
jne 0x446af7
push dword [0x463d84]
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
inc dword [esi + 0x4c]
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.00449ba4
test eax, eax
je 0x446af7
push ebx
push ebx
push ebx
push 0x67
mov ecx, esi
call fcn.00449ba4
test eax, eax
je 0x446af7
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0x240]
push ebx
mov dword [eax + 4], ecx
push ebx
push dword [esi]
mov ecx, esi
call fcn.0044b508
test eax, eax
je 0x446af7
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [esi]
mov ecx, esi
call fcn.0044b84d
test eax, eax
je 0x446af7
push ebx
push ebx
push ebx
push str.ErrorLevel
mov ecx, esi
call fcn.0041cc48
cmp eax, ebx
mov dword [0x463c78], eax
je 0x446af7
push 1
push ebx
push 0xffffffffffffffff
push 0x45671c
mov ecx, eax
call fcn.00401525
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
push dword [ebp - 8]
call fcn.00413f78
mov eax, dword [esi + 8]
pop ecx
jmp 0x446afa
or eax, 0xffffffff
pop esi
pop ebx
leave
ret
Function at 0x44b2cb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov al, byte [0x46108c]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x13], al
push edi
lea eax, [ebp - 0x14]
push eax
push esi
mov ebx, ecx
mov byte [ebp - 0x14], 0x20
mov byte [ebp - 0x12], 0x28
mov byte [ebp - 0x11], 9
mov byte [ebp - 0x10], 0x3c
mov byte [ebp - 0xf], 0x3e
mov byte [ebp - 0xe], 0x3a
mov byte [ebp - 0xd], 0x3d
mov byte [ebp - 0xc], 0x2b
mov byte [ebp - 0xb], 0x2d
mov byte [ebp - 0xa], 0x2a
mov byte [ebp - 9], 0x2f
mov byte [ebp - 8], 0x21
mov byte [ebp - 7], 0x7e
mov byte [ebp - 6], 0x26
mov byte [ebp - 5], 0x7c
mov byte [ebp - 4], 0x5e
mov byte [ebp - 3], 0
call fcn.00438ef0
test eax, eax
pop ecx
pop ecx
je 0x44b34f
cmp byte [eax], 0x3d
jne 0x44b348
cmp eax, esi
jbe 0x44b35a
lea ecx, [eax - 1]
cmp byte [ecx], 0x2e
jne 0x44b348
mov eax, ecx
cmp eax, esi
jbe 0x44b35a
dec eax
jmp 0x44b35a
push esi
call fcn.00453b00
pop ecx
lea eax, [eax + esi - 1]
push eax
push esi
call fcn.00438e3c
mov edi, eax
sub eax, esi
inc eax
cmp eax, 0xfd
pop ecx
pop ecx
jbe 0x44b386
cmp byte [ebp + 0x10], 0
je 0x44b382
push esi
push str.This_line_does_not_contain_a_recognized_action.
mov ecx, ebx
call fcn.0044a877
xor eax, eax
jmp 0x44b396
inc eax
push eax
push esi
push dword [ebp + 8]
call fcn.00438c34
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x44db10
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8c58
call fcn.004540a0
push esi
mov esi, dword [ecx + 8]
test esi, esi
je 0x44db8e
lea ecx, [ebp - 0x8c58]
call fcn.0043ae9c
mov al, byte [ebp + 8]
mov byte [ebp - 0x8414], al
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8410], eax
lea eax, [ebp - 0x8c58]
push eax
push 0x44e156
mov dword [ebp - 0x8418], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x8428], 0
je 0x44db8e
mov eax, dword [0x46326c]
cmp eax, 0xffffffff
jle 0x44db8e
cmp eax, 0x19
jge 0x44db84
cmp byte [0x464499], 0
je 0x44db84
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x44db8e
push 1
push eax
call fcn.0040bd90
pop ecx
pop ecx
xor eax, eax
inc eax
pop esi
leave
ret 8

Function at 0x44e010
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8c5c
call fcn.004540a0
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x44e14d
push ebx
call fcn.0044e35a
test eax, eax
je 0x44e150
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x463218
push eax
mov ecx, edi
mov dword [ebp - 4], eax
call fcn.0044dd92
test eax, eax
je 0x44e05f
xor esi, esi
mov dword [0x4674c4], esi
jmp 0x44e065
mov esi, dword [0x4674c4]
lea ecx, [ebp - 0x8c5c]
call fcn.0043ae9c
cmp byte [ebp + 8], bl
je 0x44e07f
cmp esi, ebx
mov byte [ebp - 0x8434], bl
je 0x44e086
mov byte [ebp - 0x8434], 1
mov eax, dword [0x4674c0]
mov dword [ebp - 0x8424], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x841c], eax
lea eax, [ebp - 0x8c5c]
push eax
push 0x44e25c
mov dword [ebp - 0x8420], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x842c], ebx
je 0x44e122
push dword [ebp - 0x842c]
call fcn.0043bdec
mov esi, eax
cmp esi, ebx
pop ecx
je 0x44e0de
push dword [ebp - 0x842c]
call fcn.0044e328
pop ecx
mov dword [ebp - 0x842c], esi
push dword [ebp - 0x842c]
call fcn.0043b752
push dword [ebp - 0x842c]
call fcn.0044e328
mov eax, dword [0x46326c]
cmp eax, 0xffffffff
pop ecx
pop ecx
jle 0x44e14c
cmp eax, 0x19
jge 0x44e116
cmp byte [0x464499], bl
je 0x44e116
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x44e14c
push 1
push eax
call fcn.0040bd90
pop ecx
pop ecx
jmp 0x44e14c
mov eax, dword [0x4674c4]
cmp eax, ebx
je 0x44e14c
cmp eax, 1
setg al
cmp al, bl
mov dword [0x4674c4], ebx
je 0x44e14c
push dword [ebp - 4]
call fcn.0044e328
pop ecx
push ebx
mov ecx, edi
call fcn.0044e010
pop esi
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 4
Function at 0x44e44c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
cmp dword [0x465ab0], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x4650f0
jne 0x44e46c
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.00413f78
pop ecx
mov dword [0x4621d8], 0x270
mov dword [0x4650e8], esi
mov edx, 0xe3
mov ecx, 0x7ffffffe
mov eax, 0x9908b0df
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi + 0x634]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x44e48b
mov edx, 0x18c
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi - 0x38c]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x44e4c1
mov edx, dword [0x4650f0]
mov edi, dword [esi]
xor edi, edx
and edi, ecx
xor edi, dword [esi]
and dl, 1
shr edi, 1
neg dl
sbb edx, edx
and edx, eax
xor edi, edx
xor edi, dword [esi - 0x38c]
mov dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x44e841
Capabilities:
Encode data using xor

Disassembly:
push edi
push dword [esp + 0x10]
call fcn.00413f78
xor edi, edi
pop ecx
cmp dword [esp + 0xc], edi
jbe 0x44e86b
push esi
mov eax, dword [esp + 0xc]
lea esi, [edi + eax]
call fcn.00413e96
xor byte [esi], al
inc edi
cmp edi, dword [esp + 0x10]
jb 0x44e855
pop esi
pop edi
ret 0xc

Function at 0x44ecdd
Capabilities:
Hash data using crc32b

Disassembly:
mov eax, ecx
push esi
push edi
mov edi, eax
or dword [eax + 0x400], 0xffffffff
xor esi, esi
mov edx, esi
push 8
shl edx, 0x18
pop ecx
test edx, 0x80000000
je 0x44ed06
add edx, edx
xor edx, 0x4c11db7
jmp 0x44ed08
shl edx, 1
dec ecx
jne 0x44ecf4
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x44ecec
pop edi
pop esi
ret