joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4340c8
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x434235
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x24], 0
jne 0x43421a
push 0
mov eax, dword [ebx + 0x1c]
push eax
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x28], esi
inc esi
jne 0x434132
push 0
call sub.wsock32.dll_WSAGetLastError
lea edx, [ebp - 0x10]
call fcn.0040e624
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea ecx, [ebp - 0xc]
mov edx, 0x43424c
mov eax, ebx
call fcn.00433e68
mov word [ebx + 4], 2
mov edx, dword [ebx + 0x14]
mov eax, ebx
call fcn.00433e04
mov dword [ebx + 8], eax
mov ax, word [ebx + 0x18]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 6], ax
push 0
push 0
push 0
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_WSAAsyncSelect
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0x8004667e
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_ioctlsocket
push 0x10
lea eax, [ebx + 4]
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x4341b4
push 0
call sub.wsock32.dll_WSAGetLastError
lea edx, [ebp - 0x14]
call fcn.0040e624
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea ecx, [ebp - 0xc]
mov edx, 0x43426c
mov eax, ebx
call fcn.00433e68
cmp dword [ebx + 0x28], 0xffffffff
setne al
mov byte [ebx + 0x24], al
lea eax, [ebp - 0x18]
push eax
xor eax, eax
mov al, byte [ebx + 8]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
xor eax, eax
mov al, byte [ebx + 9]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
xor eax, eax
mov al, byte [ebx + 0xa]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
xor eax, eax
mov al, byte [ebx + 0xb]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
movzx eax, word [ebx + 0x18]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x40]
mov ecx, 4
mov eax, 0x43428c
call fcn.0040b7ac
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x2c]
call fcn.00404c00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43423c
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404bd0
ret
Function at 0x4342b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x434345
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
cmp byte [ebx + 0x24], 0
je 0x43432f
push 0
mov eax, dword [ebp - 4]
push eax
push edx
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jne 0x43432f
call sub.wsock32.dll_WSAGetLastError
mov edi, eax
cmp edi, 0x2733
je 0x43432f
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
test edi, edi
je 0x43432f
push 0
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.0040e624
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea ecx, [ebp - 0xc]
mov edx, 0x434360
mov eax, ebx
call fcn.00433e68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43434c
lea eax, [ebp - 0x10]
call fcn.00404bac
ret

Function at 0x434430
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4344e7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
cmp esi, 0xffffffff
jne 0x434476
cmp byte [ebx + 0x24], 0
je 0x434476
lea eax, [ebp - 4]
push eax
push 0x4004667f
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x4344d1
cmp byte [ebx + 0x24], 0
je 0x4344d1
push 0
push esi
push edi
mov eax, dword [ebx + 0x28]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4344d1
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
cmp esi, 0x2733
je 0x4344d1
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 4]
test esi, esi
je 0x4344d1
push 0
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0040e624
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea ecx, [ebp - 0xc]
mov edx, 0x434500
mov eax, ebx
call fcn.00433e68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4344ee
lea eax, [ebp - 0x10]
call fcn.00404bac
ret
Function at 0x434518
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4345e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404bac
or ecx, 0xffffffff
xor edx, edx
mov eax, esi
call fcn.00434430
mov ebx, eax
test ebx, ebx
jbe 0x4345c2
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00405214
mov eax, dword [ebp - 8]
call fcn.00404e88
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00434430
mov edx, eax
lea eax, [ebp - 8]
call fcn.00405214
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404e90
mov eax, dword [ebp - 4]
lea eax, [esi + 0x2c]
mov edx, dword [ebp - 8]
call fcn.00404e90
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
or ecx, 0xffffffff
xor edx, edx
mov eax, esi
call fcn.00434430
mov ebx, eax
push 1
call sub.kernel32.dll_Sleep
test ebx, ebx
ja 0x4345c2
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp eax, 0x3e8
jbe 0x43459b
test ebx, ebx
jne 0x434541
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4345e7
lea eax, [ebp - 8]
call fcn.00404bac
ret

Function at 0x4345f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
mov edx, ebx
mov eax, esi
call fcn.00434518
cmp dword [ebx], 0
jne 0x434613
push 1
call sub.kernel32.dll_Sleep
cmp dword [ebx], 0
jne 0x434624
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp eax, dword [esi + 0x20]
jb 0x4345fe
pop edi
pop esi
pop ebx
ret
Function at 0x434f64
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x435143
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
add eax, 0x96
mov ecx, 5
xor edx, edx
div ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404bac
lea eax, [ebp - 0x14]
push eax
mov edx, ebx
mov eax, 0x435158
call fcn.004051cc
inc eax
push eax
mov eax, ebx
call fcn.00404e88
mov ecx, eax
mov eax, ebx
pop edx
call fcn.004050e8
call fcn.0043493c
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x435119
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x24], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x435095
push 0x35
push 0
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x433c8c]
call fcn.00433f44
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43508e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.00434d4c
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00434378
mov ebx, eax
mov eax, dword [ebp - 0x18]
call fcn.00404e88
cmp ebx, eax
jne 0x435078
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004345f0
cmp dword [ebp - 0x10], 0
je 0x435078
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.00434e74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435095
mov eax, dword [ebp - 0xc]
call fcn.00403c2c
ret
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, dword [ebp - 0x20]
jl 0x4350bc
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x4350bc
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 4]
jbe 0x434ffb
inc dword [ebp - 0x24]
add dword [ebp - 4], 0x32
cmp dword [ebp - 0x24], 5
je 0x4350d5
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x434fe9
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x435103
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
lea eax, [ebp - 0x34]
push eax
push 0
mov ecx, 0x435164
mov dl, 1
mov eax, dword [0x433d78]
call fcn.0040f180
call fcn.004044bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435120
mov eax, dword [ebp - 0x1c]
call fcn.00403c2c
ret

Function at 0x43a87c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x43a89c
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x43a88a
pop edi
pop esi
pop ebx
ret
Function at 0x43b190
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x40
call fcn.004034bc
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x10
call fcn.004034bc
mov dword [ebp - 0x50], 0x67452301
mov dword [ebp - 0x4c], 0xefcdab89
mov dword [ebp - 0x48], 0x98badcfe
mov dword [ebp - 0x44], 0x10325476
mov eax, ebx
shr eax, 0x1d
add dword [ebp - 0x5c], eax
mov eax, ebx
shl eax, 3
add dword [ebp - 0x60], eax
cmp eax, dword [ebp - 0x60]
jbe 0x43b201
inc dword [ebp - 0x5c]
mov dword [ebp - 0x64], esi
test ebx, ebx
jbe 0x43b255
mov esi, 0x40
sub esi, dword [ebp - 0x54]
cmp esi, ebx
ja 0x43b23b
mov ecx, esi
mov eax, dword [ebp - 0x54]
lea edx, [ebp + eax - 0x40]
mov eax, dword [ebp - 0x64]
call fcn.00402bf8
mov edi, 0x40
sub edi, dword [ebp - 0x54]
sub ebx, edi
add dword [ebp - 0x64], edi
push ebp
call fcn.0043a8d4
pop ecx
jmp 0x43b251
mov eax, dword [ebp - 0x54]
lea edx, [ebp + eax - 0x40]
mov eax, dword [ebp - 0x64]
mov ecx, ebx
call fcn.00402bf8
add dword [ebp - 0x54], ebx
xor ebx, ebx
test ebx, ebx
ja 0x43b208
mov eax, dword [ebp - 0x54]
mov byte [ebp + eax - 0x40], 0x80
cmp dword [ebp - 0x54], 0x38
jb 0x43b26a
push ebp
call fcn.0043a8d4
pop ecx
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x60]
mov dword [eax], edx
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x5c]
mov dword [eax], edx
push ebp
call fcn.0043a8d4
pop ecx
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0x50]
mov ecx, 0x10
call fcn.00402bf8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43b298
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov esi, eax
mov eax, dword [esi]
call fcn.0043a8a0
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.0043a8a0
mov esi, eax
xor eax, eax
mov ecx, dword [0x513164]
mov edx, dword [0x513168]
mov dword [esp + 4], edx
mov edx, dword [0x51316c]
mov dword [esp + 8], edx
mov edx, dword [0x513170]
mov dword [esp + 0xc], edx
mov edx, 0x20
add eax, 0x9e3779b9
mov edi, esi
shl edi, 4
mov ebp, esi
xor ebp, ecx
add edi, ebp
mov ebp, esi
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 4]
add ebx, edi
mov edi, ebx
shl edi, 4
mov ebp, dword [esp + 8]
xor ebp, ebx
add edi, ebp
mov ebp, ebx
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 0xc]
add esi, edi
dec edx
jne 0x43b2e4
mov eax, ebx
call fcn.0043a8a0
mov edx, dword [esp]
mov dword [edx], eax
mov eax, esi
call fcn.0043a8a0
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x43b348
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov esi, eax
mov eax, dword [esi]
call fcn.0043a8a0
mov ebx, eax
add esi, 4
mov eax, dword [esi]
call fcn.0043a8a0
mov esi, eax
mov eax, 0xc6ef3720
mov ecx, dword [0x513164]
mov edx, dword [0x513168]
mov dword [esp + 4], edx
mov edx, dword [0x51316c]
mov dword [esp + 8], edx
mov edx, dword [0x513170]
mov dword [esp + 0xc], edx
mov edx, 0x20
mov edi, ebx
shl edi, 4
mov ebp, dword [esp + 8]
xor ebp, ebx
add edi, ebp
mov ebp, ebx
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 0xc]
sub esi, edi
mov edi, esi
shl edi, 4
mov ebp, esi
xor ebp, ecx
add edi, ebp
mov ebp, esi
shr ebp, 5
xor ebp, eax
add edi, ebp
add edi, dword [esp + 4]
sub ebx, edi
sub eax, 0x9e3779b9
dec edx
jne 0x43b397
mov eax, ebx
call fcn.0043a8a0
mov edx, dword [esp]
mov dword [edx], eax
mov eax, esi
call fcn.0043a8a0
mov edx, dword [esp]
add edx, 4
mov dword [edx], eax
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x43b5cc
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov esi, dword [eax]
mov edi, dword [ecx]
mov eax, ebx
mov ecx, 3
xor edx, edx
div ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
lea ecx, [0x50ea40]
xor eax, eax
xor ebx, ebx
xor edx, edx
cmp dword [ebp - 4], 0
je 0x43b633
lodsw ax, word [esi]
mov bl, al
shr bl, 2
mov dl, byte [ebx + ecx]
mov bh, ah
and bh, 0xf
rol ax, 4
and ax, 0x3f
mov dh, byte [eax + ecx]
mov ax, dx
stosw word es:[edi], ax
lodsb al, byte [esi]
mov bl, al
shr bx, 6
mov dl, byte [ebx + ecx]
and al, 0x3f
xor ah, ah
mov dh, byte [eax + ecx]
mov ax, dx
stosw word es:[edi], ax
dec dword [ebp - 4]
jne 0x43b5f9
cmp dword [ebp - 8], 0
je 0x43b683
xor eax, eax
xor ebx, ebx
xor edx, edx
lodsb al, byte [esi]
shl ax, 6
mov bl, ah
mov dl, byte [ebx + ecx]
dec dword [ebp - 8]
je 0x43b66e
shl ax, 2
and ah, 3
lodsb al, byte [esi]
shl ax, 4
mov bl, ah
mov dh, byte [ebx + ecx]
shl edx, 0x10
shr al, 2
mov bl, al
mov dl, byte [ebx + ecx]
mov dh, 0x3d
jmp 0x43b67d
shr al, 2
mov bl, al
mov dh, byte [ebx + ecx]
shl edx, 0x10
mov dh, 0x3d
mov dl, 0x3d
mov eax, edx
ror eax, 0x10
stosd dword es:[edi], eax
pop ecx
pop ecx
pop ebp
ret

Function at 0x43b830
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x43b83f
xor eax, eax
pop esi
pop ebx
ret
cmp byte [0x50ea80], 0
jne 0x43b84d
call fcn.0043b7d4
or eax, 0xffffffff
xor edx, edx
mov dl, byte [ebx]
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x51317c]
shr eax, 8
xor edx, eax
mov eax, edx
inc ebx
dec esi
test esi, esi
jne 0x43b850
xor eax, 0xffffffff
pop esi
pop ebx
ret

Function at 0x443788
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.00404e1c
add esp, 0x104
pop ebx
ret
Function at 0x4444a4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x44461c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [edi], eax
add esi, 4
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x10]
mov eax, 8
call fcn.00409f70
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 8
call fcn.00409f70
push dword [ebp - 0x14]
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404f48
mov eax, dword [ebp - 0xc]
call fcn.00405088
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
test ebx, ebx
je 0x444601
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x444559
cmp esi, 4
jne 0x444559
push ebx
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
jmp 0x444601
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x4445e3
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov esi, dword [eax]
mov eax, dword [edi]
push eax
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle_1
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x1c]
mov eax, 8
call fcn.00409f70
push dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x20]
mov eax, 8
call fcn.00409f70
push dword [ebp - 0x20]
push dword [ebp - 8]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404f48
mov eax, dword [ebp - 0x18]
call fcn.00405088
push eax
push esi
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
push 0
push 0
push 0
push 0xf001f
push ebx
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
add eax, 4
mov dword [edi], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444623
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00404bd0
ret
Function at 0x445abc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x445ba6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x513724], bl
mov eax, 0x513728
mov edx, esi
call fcn.00404c00
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
xor edx, edx
mov dl, bl
mov eax, dword [0x443178]
call fcn.0041ca94
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
call fcn.004029c0
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x24]
mov eax, 8
call fcn.00409f70
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea edx, [ebp - 0x1c]
mov ecx, 2
mov eax, 0x445bbc
call fcn.0040b7ac
mov eax, dword [ebp - 4]
call fcn.00405088
push eax
call sub.kernel32.dll_OutputDebugStringA
cmp dword [0x513a14], 0
je 0x445b83
add bl, 0xfb
sub bl, 4
jae 0x445b83
push 0x242010
push 0x445bf0
mov eax, esi
call fcn.00405088
push eax
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445bad
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00404bd0
lea eax, [ebp - 4]
call fcn.00404bac
ret

Function at 0x445d8c
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x445d54
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x445e28
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, eax
mov eax, esi
call fcn.00404e88
mov ebx, eax
inc ebx
call sub.kernel32.dll_GetCurrentProcessId
call fcn.00445d8c
push eax
call sub.user32.dll_OpenClipboard
xor eax, eax
push ebp
push 0x445f00
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x445ee6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x445ec8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00405088
mov edx, dword [ebp - 8]
mov ecx, ebx
call fcn.00402bf8
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 4]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445ecf
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
Function at 0x445f10
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
add esp, 0xffffffac
test al, al
je 0x445f5c
push esp
call sub.kernel32.dll_GetStartupInfoA_1
lea eax, [esp + 0x44]
xor ecx, ecx
mov edx, 0x10
call fcn.004034bc
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 4]
push eax
mov eax, dword [0x513714]
call fcn.00405088
push eax
push 0
push 0x220
push 0
push 0
push 0
call sub.kernel32.dll_GetCommandLineA_1
push eax
push 0
call sub.kernel32.dll_CreateProcessA
push 1
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
add esp, 0x54
ret

Function at 0x44623c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov edx, dword [0x510d04]
mov dl, byte [edx]
mov byte [ebp - 1], dl
mov ecx, eax
mov dl, 1
mov eax, dword [0x44322c]
call fcn.00445f70
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x44630c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.00445fe8
test al, al
je 0x4462f6
cmp word [ebp - 4], 0x5a4d
jne 0x4462f6
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.00424f58
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00445fe8
test al, al
je 0x4462f6
cmp dword [ebp - 8], 0
je 0x4462f6
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.00424f58
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00445fe8
test al, al
je 0x4462f6
cmp dword [ebp - 0xc], 0x4550
jne 0x4462f6
lea edx, [ebp - 0x24]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.00445fe8
test al, al
je 0x4462f6
test byte [ebp - 0x11], 0x20
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446313
mov eax, dword [ebp - 0x10]
call fcn.00403c2c
ret
Function at 0x44631c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4464b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov ecx, ebx
mov dl, 1
mov eax, dword [0x44322c]
call fcn.00445f70
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x446496
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.00445fe8
test al, al
je 0x446480
cmp word [ebp - 4], 0x5a4d
jne 0x446480
push 0
push 0x3c
mov eax, dword [ebp - 0x10]
call fcn.00424f58
lea edx, [ebp - 8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00445fe8
test al, al
je 0x446480
cmp dword [ebp - 8], 0
je 0x446480
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.00424f58
lea edx, [ebp - 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00445fe8
test al, al
je 0x446480
cmp dword [ebp - 0xc], 0x4550
jne 0x446480
lea edx, [ebp - 0x28]
mov ecx, 0x14
mov eax, dword [ebp - 0x10]
call fcn.00445fe8
test al, al
je 0x44647c
test byte [ebp - 0x15], 0x20
je 0x44647c
push 2
push 0
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.00446024
mov eax, dword [ebp - 0x2c]
call fcn.00405088
push eax
call sub.kernel32.dll_LoadLibraryExA_1
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x446475
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
push 0x4464c4
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x44645a
push 0xa
push 0x4464d0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x44645a
mov byte [ebp - 1], 2
jmp 0x44645e
mov byte [ebp - 1], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446480
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44649d
mov eax, dword [ebp - 0x10]
call fcn.00403c2c
ret