joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40633e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x40636c
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x406373
cmp ebx, dword [eax + 4]
jae 0x406373
xor eax, eax
jmp 0x406563
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x406384
xor eax, eax
inc eax
jmp 0x406562
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x40639a
cmp ecx, edx
jae 0x4064df
cmp dword [eax + 4], 0
je 0x4063a3
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x40638b
cmp dword [ebp + 8], 0
je 0x4063c5
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4064df
cmp eax, esi
jae 0x4064df
mov eax, dword [0x4110f0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x4063ea
cmp dword [esi*4 + 0x4110f8], edi
je 0x4064e3
inc esi
cmp esi, eax
jl 0x4063d8
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40655f
cmp dword [ebp - 8], 0x1000000
jne 0x40655f
test byte [ebp - 0xc], 0xcc
je 0x406468
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x40655f
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40655f
cmp word [eax + 0x18], 0x10b
jne 0x40655f
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x40655f
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x406468
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x406468
test byte [ecx + 0x27], 0x80
jne 0x4064df
push 1
push 0x411138
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x40637c
mov ecx, dword [0x4110f0]
test ecx, ecx
mov edx, ecx
jle 0x40649c
lea eax, [ecx*4 + 0x4110f4]
cmp dword [eax], edi
je 0x40649c
dec edx
sub eax, 4
test edx, edx
jg 0x406490
test edx, edx
jne 0x4064cd
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4064a9
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4064c1
lea eax, [edx*4 + 0x4110f8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4064af
cmp ecx, 0x10
jge 0x4064cd
inc ecx
mov dword [0x4110f0], ecx
push 0
push 0x411138
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x40637c
xor eax, eax
jmp 0x406562
test esi, esi
jle 0x40637c
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x411138
call ebx
test eax, eax
jne 0x40637c
cmp dword [esi*4 + 0x4110f8], edi
je 0x406539
mov eax, dword [0x4110f0]
lea esi, [eax - 1]
test esi, esi
jl 0x406527
cmp dword [esi*4 + 0x4110f8], edi
je 0x406523
dec esi
jns 0x406517
test esi, esi
jge 0x406537
cmp eax, 0x10
jge 0x406532
inc eax
mov dword [0x4110f0], eax
lea esi, [eax - 1]
jmp 0x406539
je 0x406551
xor ecx, ecx
test esi, esi
jl 0x406551
lea eax, [ecx*4 + 0x4110f8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x40653f
push 0
push 0x411138
call ebx
jmp 0x40637c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406567
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x41113c], ebx
push esi
push edi
jne 0x4065e7
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x406622
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40b6c4
push edi
call esi
test eax, eax
mov dword [0x41113c], eax
je 0x406622
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x411140], eax
call esi
cmp dword [0x410e1c], 2
mov dword [0x411144], eax
jne 0x4065e7
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x41114c], eax
je 0x4065e7
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x411148], eax
mov eax, dword [0x411148]
test eax, eax
je 0x40662c
call eax
test eax, eax
je 0x406613
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x41114c]
test eax, eax
je 0x406613
test byte [ebp - 8], 1
jne 0x40662c
cmp dword [0x410e28], 4
jb 0x406626
or byte [ebp + 0x12], 0x20
jmp 0x40664b
xor eax, eax
jmp 0x40665b
or byte [ebp + 0x12], 4
jmp 0x40664b
mov eax, dword [0x411140]
test eax, eax
je 0x40664b
call eax
mov ebx, eax
test ebx, ebx
je 0x40664b
mov eax, dword [0x411144]
test eax, eax
je 0x40664b
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x41113c]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40947f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00403050
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40951a
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x410e1c]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x40951a
cmp eax, 1
je 0x40953b
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40951a
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4094e7
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x409516
xor eax, eax
inc eax
jmp 0x40955a
cmp edi, eax
jae 0x40951e
xor eax, eax
jmp 0x40955a
cmp eax, esi
jae 0x409525
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x410e1c]
jmp 0x40953e
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41b5f0
Capabilities:
Packed with generic packer

Disassembly:
mov fs, eax
or dword [ebx + 0x234788f], ecx
inc edi
add byte [ebx - 0x3f7ad3bf], cl
mov fs, eax
or dword [ebx + 0x5500598f], ecx
pop eax
les ecx, [eax]
test dword [ebx], edi
js 0x41b642
add al, byte [edi]
je 0x41b65e
invalid
sub byte [esi - 0x3f7afef8], dh
jne 0x8b96b66a
push edi
mov esi, eax
pop esp
les ecx, [eax]
test dword [ecx], eax
add byte [eax], al
add byte [ebx - 0x769b0bb3], cl
or eax, 0x2886c7ce
mov dh, 8
add dword [ecx], eax
add byte [ebx], dh
rcr byte [esi - 0x3d], 0x53
push esi
dec dword [ebx + 0x244c8b96]
or byte [ebx + 0x244c8bf1], cl
or byte [edi + 0x52], dl
or byte [ebx + 0x7fe00786], cl
inc edi
test esi, esi
je 0x41b6ba
mov al, byte [0xc79090a4]
test al, 1
jne 0x41b6a3
or al, 1
mov byte [0xc79090a4], al
mov eax, dword [esi + 0x477fe007]
mov dword [0xc79090a0], eax
pushal
call dword [0xc79090a0]
popal
mov ecx, dword [ebp - 4]
push 0x781c7f1
loopne 0x41b734
inc edi
add byte [eax], al
xor eax, eax
mov ebx, dword [esi + 0x62516e8]
xor edi, edi
shr ebx, 2
test ebx, ebx
jle 0x41b6ec
inc edi
add byte [eax - 0x73], dl
invalid
and al, 0x18
or bh, al
add dword [eax - 0x39ffffff], eax
inc esp
and al, 0x18
pop es
mov dword [ecx], 0x180
mov byte [ebx + ecx*4 - 0x62], 0xdb
add dword [eax], ebx
mov ecx, 0xdb8502eb
jle 0x41b75a
xor edi, edi
test ebx, ebx
jle 0x41b72e
mov eax, dword [esi - 0x7717288]
mov eax, dword [eax + edi*4]
add al, byte [eax]
add byte [edi], al
inc edi
add byte [ebp - 0x3e7af100], al
salc
movsd dword es:[edi], dword [esi]
push es
add bh, ah
and al, 0x18
or eax, edi
add dword [eax - 0x39ffffff], eax
add dword [eax], eax
add dh, al
inc esp
and al, 0x18
or al, 0xc7
add dword [eax - 0x39ffffff], eax
inc esp
and al, 0x18
or edi, eax
add dword [eax - 0x39ffffff], eax
inc esp
and al, 0x18
or al, bh
add dword [eax - 0x39ffffff], eax
inc esp
mov ebx, dword [esi - 0x38e7fe44]
shr ebx, 2
test ebx, ebx
jle 0x41b79c
xor edi, edi
test ebx, ebx
jle 0x41b782
mov ecx, dword [esi - 0x771724c]
mov edx, dword [ecx + edi*4]
push edx
add byte [ebp - 0x3e7af100], al
salc
movsd dword es:[edi], dword [esi]
push es
add bl, ch
rol byte [ecx], 0
add dh, al
inc esp
add dword [eax], eax
add dh, al
inc esp
push 0xffffffffffffffff
push 0xffffffffffffff8e
fadd dword [ecx]
add byte [eax], al
mov byte [eax + ebp*8 + 0x42], 0x14
test eax, 0x4400063c
and al, 0x24
push es
add byte [esp + 0x24], al
invalid
Function at 0x408277
Capabilities:
Check os version

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
push edi
call esi
movzx edi, al
call esi
cmp edi, 6
movzx eax, ah
ja 0x408294
jne 0x4082bf
test eax, eax
jbe 0x4082bf
mov esi, dword [esp + 0xc]
add esi, 4
mov eax, dword [esi]
test eax, eax
je 0x4082aa
and dword [esi], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push esi
push 0x5352e8
push 0x17
push 0
push 0x525d9c
call dword [sym.imp.ole32.dll_CoCreateInstance]
pop edi
xor eax, eax
pop esi
ret 4

Function at 0x412b1c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x412b33
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x412b68
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x412b64
cmp edi, eax
jae 0x412b68
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x412b56
cmp edi, eax
jb 0x412b6c
xor eax, eax
jmp 0x412b76
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x4191e3
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x419232
push esi
mov esi, dword [esp + 8]
push 0xfffffffffffffff0
add esi, 4
push dword [esi]
call dword [0x574ed8]
test al, 4
jne 0x419231
push ebx
push edi
xor edi, edi
push edi
push edi
push 0x1004
push dword [esi]
call dword [0x574f08]
mov ebx, eax
test ebx, ebx
jle 0x41922f
push 2
push 2
push edi
push esi
call fcn.0041b9bf
inc edi
cmp edi, ebx
jl 0x41921f
pop edi
pop ebx
pop esi
mov eax, dword [esp + 8]
and dword [eax], 0
xor eax, eax
inc eax
ret 8

Function at 0x41bfd8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [eax]
mov dword [ebp - 8], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
neg eax
leave
ret 4

Function at 0x427810
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x427851
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
push edi
push edi
push 0x1004
add esi, 4
push dword [esi]
call dword [0x574f08]
mov ebx, eax
test ebx, ebx
jle 0x42784e
push 2
push 2
push edi
push esi
call fcn.0041b9bf
inc edi
cmp edi, ebx
jl 0x42783e
pop edi
pop esi
pop ebx
mov eax, dword [esp + 8]
and dword [eax], 0
xor eax, eax
inc eax
ret 8
Function at 0x427ee9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movsx ecx, ax
push edi
shr eax, 0x10
movsx edx, ax
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x1012
push dword [esi + 4]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
call dword [0x574f08]
cmp eax, 0xffffffff
pop edi
je 0x427f3e
cmp dword [ebp - 0xc], 8
jne 0x427f3e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x427f3e
push dword [ebp - 8]
push esi
call fcn.0042802a
mov eax, dword [ebp + 8]
and dword [eax], 0
xor eax, eax
inc eax
leave
ret 4

Function at 0x427f4b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push 1
push 0xffffffffffffffff
lea esi, [edi + 4]
push esi
call fcn.0041b8aa
mov ebx, eax
cmp ebx, 0xffffffff
je 0x427f8a
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x427f8a
push 0
push 0
push 0x1037
push dword [esi]
call dword [0x574f08]
test al, 4
je 0x427f8a
push ebx
push edi
call fcn.0042802a
mov eax, dword [esp + 0xc]
and dword [eax], 0
xor eax, eax
pop esi
inc eax
pop ebx
ret 4

Function at 0x4284c7
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ebx, ebx
push ebx
push ebx
mov esi, eax
push ebx
push dword [esi]
call edi
push ebx
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 8]
push eax
push dword [esi]
mov byte [ebp - 1], bl
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42850f
cmp dword [ebp - 0xc], ebx
jbe 0x42850f
cmp word [ebp - 8], 0xfeff
jne 0x42850f
mov byte [ebp - 1], 1
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp byte [ebp - 1], bl
mov dword [ebp - 8], eax
je 0x428532
push 2
xor ecx, ecx
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
jmp 0x42853e
push ebx
push ebx
push ebx
push dword [esi]
call edi
mov eax, dword [ebp - 8]
inc eax
push eax
call fcn.004440c6
cmp dword [ebp - 8], ebx
mov edi, eax
pop ecx
mov dword [ebp - 0x10], ebx
jne 0x428553
xor esi, esi
inc esi
jmp 0x42858d
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov eax, esi
push edi
call fcn.004286b3
mov esi, eax
cmp esi, ebx
je 0x42858d
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jbe 0x42858d
cmp byte [ebp - 1], bl
push edi
push dword [ebp + 8]
je 0x428585
shr eax, 1
mov word [edi + eax*2], bx
call fcn.00412116
jmp 0x42858d
mov byte [eax + edi], bl
call fcn.00418fef
push edi
call fcn.00448953
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x430d10
Capabilities:
Create thread

Disassembly:
push 0x24
mov eax, 0x522cb8
call fcn.0044c7ac
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp - 0x18]
call fcn.00411df3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x28]
call fcn.00411df3
push ebx
push ebx
push esi
push ebx
call dword [0x574d88]
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
mov dword [ebp - 0x24], eax
je 0x430d73
call fcn.00411e0e
mov dword [edi], ebx
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
push 0x430dd4
push ebx
push ebx
mov dword [ebp - 0x10], esi
call fcn.0044a0dc
mov esi, eax
add esp, 0x18
cmp esi, ebx
je 0x430d9e
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x24], ebx
mov dword [edi], esi
je 0x430db1
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x24], ebx
mov ecx, dword [ebp - 0x28]
cmp ecx, ebx
je 0x430dbd
call fcn.00411e0e
mov byte [ebp - 4], bl
mov ecx, dword [ebp + 0x14]
cmp ecx, ebx
je 0x430dcc
call fcn.00411e0e
mov eax, edi
call fcn.0044c884
ret

Function at 0x44118f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], 0x20
push esi
jne 0x4411d9
mov eax, dword [edi]
push 0xffff0000
push 9
add eax, 4
push 0x110a
push dword [eax]
call dword [0x574f08]
mov ebx, eax
test ebx, ebx
je 0x4411d9
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x4411d9
mov eax, dword [edi]
push ebx
call fcn.004620ff
mov esi, dword [edi]
push ebx
call fcn.00462895
push dword [ebp + 0x10]
mov eax, dword [edi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00428248
cmp dword [ebp + 0xc], 0x20
mov dword [ebp + 0x10], eax
jne 0x4411fe
test ebx, ebx
je 0x4411fe
mov esi, dword [edi]
push ebx
call fcn.0046217a
mov eax, dword [ebp + 0x10]
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4421b2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0x20
push ebx
push esi
push 4
pop ebx
jne 0x442234
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x44226c
mov eax, dword [edi]
push 2
push 0xffffffffffffffff
add eax, ebx
push eax
call fcn.0041b8aa
mov esi, eax
mov eax, dword [edi]
lea ecx, [eax + 0x24]
mov eax, dword [ecx]
push esi
call dword [eax + 0x1c]
test al, al
je 0x44226c
mov eax, dword [edi]
lea ecx, [eax + 0x24]
mov eax, dword [ecx]
push esi
call dword [eax + 0x28]
neg al
sbb al, al
inc al
push 2
mov byte [ebp - 4], al
push 0xffffffffffffffff
jmp 0x44221c
mov eax, dword [edi]
push esi
push dword [ebp - 4]
lea ecx, [eax + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x20]
push 2
push esi
mov eax, dword [edi]
add eax, ebx
push eax
call fcn.0041b8aa
mov esi, eax
cmp esi, 0xffffffff
jne 0x44220b
mov esi, dword [edi]
call fcn.00461eda
cmp dword [ebp + 0xc], 0x41
jne 0x44226c
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x44226c
mov eax, dword [edi]
add eax, ebx
push 0xfffffffffffffff0
push dword [eax]
call dword [0x574ed8]
test bl, al
jne 0x44226c
mov eax, dword [edi]
mov eax, dword [eax + 0x30]
push 2
push 2
push 0xffffffffffffffff
add eax, ebx
push eax
call fcn.0041b9bf
push dword [ebp + 0x10]
mov eax, dword [edi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00428248
pop esi
pop ebx
leave
ret 0xc

Function at 0x443a64
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x574fb8], 0
push esi
jne 0x4439d7
call fcn.00443902
test eax, eax
je 0x443a1a
mov eax, dword [0x574fb8]
cmp eax, 1
jne 0x4439f8
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x443a1a
pop esi
ret
push eax
call dword [0x574fc0]
test eax, eax
jne 0x443a62
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x443a1e
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x574fb8]
call dword [0x574fc0]
mov edi, eax
test edi, edi
je 0x443a45
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x443a61
lea edi, [esi + 0xff0]
push esi
push dword [0x574fb8]
call dword [0x574fbc]
add esi, 0x10
cmp esi, edi
jb 0x443a4b
mov eax, esi
pop edi
pop esi
ret
jmp 0x4439c4
Function at 0x443c32
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x5675a0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00443b71
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00449940
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x443c81
cmp dword [ebp - 0x1c], 5
jb 0x443c99
jmp 0x443c95
cmp dword [ebp - 0x10], 1
jne 0x443c99
cmp dword [ebp - 0x1c], 4
ja 0x443c95
jne 0x443c99
cmp dword [ebp - 0x18], 0
jbe 0x443c99
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x525eac
call fcn.004150de
test eax, eax
jge 0x443cba
mov byte [0x575e08], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00447dd1
add ebp, 0x78
leave
ret
Function at 0x444ee0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x50f4d8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5675a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x57515c]
test eax, eax
jne 0x444f12
xor esi, esi
jmp 0x444f1b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
je 0x444f5d
cmp dword [esi + 0x14], 0
jne 0x444f9f
cmp dword [esi + 0x10], 0
jne 0x444fa5
push 0x444260
push 0x575158
call fcn.004448c0
mov eax, dword [0x57515c]
add esp, 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
mov dword [esp + 0x20], 0xffffffff
je 0x444f8b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x444f8b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x444fe5
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x444fd3
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x444fa5
cmp dword [esi + 0x14], 0
je 0x444f37
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x44500a
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x44503b
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x44503b
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x44503b
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x444fef
jmp 0x444f31
Function at 0x4450f0
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, ecx
mov eax, dword [edi + 8]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x445060
push 0
push 0
call fcn.0044a0dc
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x44513c
lea ecx, [esp + 8]
call fcn.00447786
push 0x54d4c0
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
call fcn.0044c39b
mov eax, dword [edi + 8]
push esi
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi + 8]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x445165
cmp eax, 0xffffffff
je 0x445165
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi + 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop edi
pop ebx
add esp, 0x10
ret

Function at 0x445b90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50f5e8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5675a0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00411175
mov dword [esi], vtable.boost::gregorian::bad_day_of_month.0
test edi, edi
mov dword [esp + 0x18], 0
je 0x445bda
add edi, 0x28
jmp 0x445bdc
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
test ecx, ecx
mov dword [esi + 0x2c], ecx
je 0x445bf4
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_struct_boost::gregorian::bad_day_of_month_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4