joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448385
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x46b9f8
cmp edx, dword [eax]
je 0x4483a7
add eax, 8
inc ecx
cmp eax, 0x46ba88
jl 0x448398
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x46b9f8]
jne 0x4484d5
mov eax, dword [0x4705b4]
cmp eax, 1
je 0x4484af
test eax, eax
jne 0x4483d8
cmp dword [0x46b5d4], 1
je 0x4484af
cmp edx, 0xfc
je 0x4484d5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x44840f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00445ac0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00444de0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x448452
lea eax, [ebp - 0x1a4]
push eax
call fcn.00444de0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x462c4c
push edi
call fcn.00445cb0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00445ac0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00445ad0
lea eax, [ebp - 0xa0]
push 0x462c2c
push eax
call fcn.00445ad0
push dword [esi + 0x46b9fc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00445ad0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0044e808
add esp, 0x2c
pop edi
jmp 0x4484d5
lea eax, [ebp + 8]
lea esi, [esi + 0x46b9fc]
push 0
push eax
push dword [esi]
call fcn.00444de0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4532c0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
push edi
push str.QuickTime.qts
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x453308
lea ecx, [esp + 0x10]
push 0x104
push ecx
push eax
call esi
test eax, eax
jbe 0x453308
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
lea eax, [esp + 0x10]
push 0x104
push eax
push 0
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jbe 0x45339c
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0xf]
lea ecx, [esp + 0x10]
cmp eax, ecx
jb 0x45339c
mov cl, byte [eax]
cmp cl, 0x5c
je 0x453351
cmp cl, 0x2f
je 0x453351
dec eax
lea edx, [esp + 0x10]
cmp eax, edx
jae 0x45333a
jmp 0x45339c
lea ecx, [esp + 0x10]
cmp eax, ecx
jb 0x45339c
mov byte [eax + 1], 0
mov edi, str.QuickTime.qts
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebp
mov ebx, eax
test ebx, ebx
jne 0x45341c
lea ecx, [esp + 0x10]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x45341c
mov edi, 0x4684cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.QuickTime.qts
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x45534d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x37c
push ebx
push esi
push edi
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x45554d
xor ebx, ebx
push ebx
push 9
push dword [ebp + 8]
call fcn.0040daff
push ebx
push 0xb
push dword [ebp + 8]
mov esi, eax
call fcn.0040daff
cmp dword [esi + 0x10], 1
mov dword [ebp - 8], ebx
je 0x4553a0
push 1
push 4
push eax
call fcn.0040b46b
push eax
call fcn.0043a445
mov dword [ebp - 8], eax
push dword [ebp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x174]
push eax
call edi
push dword [ebp + 8]
lea eax, [ebp - 0x174]
push eax
call fcn.0045682e
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x174]
push eax
call fcn.00456719
mov esi, eax
cmp esi, 0xffffffff
jne 0x4553f3
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x37c]
push eax
call edi
jmp 0x455497
lea eax, [ebp - 0x174]
mov byte [ebp + esi - 0x174], bl
push eax
lea eax, [ebp - 0x37c]
push eax
call edi
mov eax, dword [ebp - 4]
push ebx
add eax, esi
push ebx
lea eax, [ebp + eax - 0x174]
push eax
call fcn.00456719
mov edi, eax
cmp edi, 0xffffffff
je 0x455433
mov eax, dword [ebp - 4]
add eax, edi
add eax, esi
mov byte [ebp + eax - 0x174], bl
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.004568cb
mov eax, dword [ebp - 4]
add eax, esi
lea eax, [ebp + eax - 0x174]
push eax
lea eax, [ebp - 0x278]
push eax
call fcn.00456678
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x37c]
push eax
call esi
mov eax, dword [ebp - 4]
add edi, eax
cmp byte [ebp + edi - 0x174], bl
lea eax, [ebp + edi - 0x174]
je 0x455491
push eax
lea eax, [ebp - 0x37c]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea eax, [ebp - 0x37c]
pop esi
push esi
push ebx
push ebx
push eax
push ebx
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x455551
cmp dword [ebp + 0x10], 0xc2
je 0x45554d
lea eax, [ebp - 0x278]
push str.iexplore.exe
push eax
call edi
lea eax, [ebp - 0x278]
push eax
call fcn.0040a5bf
test eax, eax
jne 0x455500
lea eax, [ebp - 0x278]
push str.netscape.exe
push eax
call edi
lea eax, [ebp - 0x278]
push eax
call fcn.0040a5bf
test eax, eax
je 0x45554d
push 0x44
lea eax, [ebp - 0x70]
pop edi
push edi
push ebx
push eax
call fcn.004447a0
push 0x10
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.004447a0
add esp, 0x18
lea eax, [ebp - 0x18]
mov word [ebp - 0x40], si
mov dword [ebp - 0x70], edi
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x37c]
push ebx
push eax
lea eax, [ebp - 0x278]
push eax
mov dword [ebp - 0x44], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x455551
xor eax, eax
jmp 0x455553
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x456035
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
push 0x44
pop edi
xor esi, esi
push edi
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.004447a0
add esp, 0xc
mov dword [ebp - 0x70], edi
lea eax, [ebp - 0x10]
push 1
pop edi
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
mov word [ebp - 0x40], di
push dword [ebp + 0x10]
mov dword [ebp - 0x44], edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x456136
cmp dword [ebp + 0x14], esi
jne 0x45611e
push dword [ebp + 0xc]
call fcn.00407b0c
mov eax, dword [ebp - 0x10]
mov ebx, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [ebp + 0x14], eax
push 0x1ff
push 0xffffffffffffffff
lea eax, [ebp + 0x14]
push esi
push eax
push edi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, edi
mov dword [ebp + 0x10], eax
jne 0x45610a
push edi
push esi
push esi
lea eax, [ebp - 0x2c]
push esi
push eax
call ebx
test eax, eax
je 0x45609b
mov eax, dword [ebp - 0x28]
cmp eax, 0x12
je 0x456117
cmp eax, 0x400
jb 0x4560d9
cmp eax, 0xffff
jbe 0x4560e8
cmp eax, 0xf
je 0x4560e8
cmp eax, 0x11
je 0x4560e8
cmp eax, 0x16
jne 0x4560fc
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
push esi
push esi
lea eax, [ebp - 0x2c]
push esi
push eax
call ebx
test eax, eax
jne 0x4560c3
cmp dword [ebp + 0x10], 0xffffffff
je 0x45611e
cmp dword [ebp + 0x10], esi
je 0x45611e
jmp 0x45609b
push esi
call dword [sym.imp.USER32.dll_PostQuitMessage]
push dword [ebp + 0xc]
call fcn.00407ad9
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4568cb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push edi
mov edi, dword [ebp + 0xc]
push str._path_
push edi
call esi
test eax, eax
jne 0x4568f9
push 0x104
push dword [ebp + 8]
call fcn.0040a102
jmp 0x456a6d
push str._temp_
push edi
call esi
test eax, eax
jne 0x456917
push 0x104
push dword [ebp + 8]
call fcn.0040a167
jmp 0x456a6d
push str._cd_
push edi
call esi
test eax, eax
jne 0x4569a1
mov al, byte [0x46f8a4]
mov esi, dword [ebp + 8]
test al, al
je 0x45694c
and byte [esi + 3], 0
push esi
mov byte [esi], al
mov byte [esi + 1], 0x3a
mov byte [esi + 2], 0x5c
call fcn.00456a77
test eax, eax
pop ecx
jne 0x456a6d
push 0x104
push esi
call fcn.0040a102
cmp byte [esi + 1], 0x3a
jne 0x456976
cmp byte [esi + 2], 0x5c
jne 0x456976
and byte [esi + 3], 0
push esi
call fcn.00456a77
test eax, eax
pop ecx
jne 0x456a6d
and byte [esi + 3], 0
push 0x41
mov byte [esi + 1], 0x3a
mov byte [esi + 2], 0x5c
pop ebx
push esi
mov byte [esi], bl
call fcn.00456a77
test eax, eax
pop ecx
jne 0x456a6d
inc ebx
cmp ebx, 0x5b
jl 0x456985
jmp 0x456a70
push str._wind_
push edi
call esi
test eax, eax
je 0x456a5f
push str._windir_
push edi
call esi
test eax, eax
je 0x456a5f
push str._winsysdir_
push edi
call esi
test eax, eax
jne 0x4569e0
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x456a6d
push str._programfilesdir_
push edi
call esi
test eax, eax
mov ebx, str._commonfilesdir_
je 0x456a05
push ebx
push edi
call esi
test eax, eax
je 0x456a05
push str._desktopdir_
push edi
call esi
test eax, eax
jne 0x456a6d
push str.SHFolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebp - 4], eax
je 0x456a6d
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x456a54
push str._programfilesdir_
push edi
call esi
test eax, eax
jne 0x456a3b
push 0x26
pop eax
jmp 0x456a48
push ebx
push edi
call esi
neg eax
sbb eax, eax
and al, 0xe5
add eax, 0x2b
push dword [ebp + 8]
xor ecx, ecx
push ecx
push ecx
push eax
push ecx
call dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x456a6d
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x45b199
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 9
push dword [ebp + 8]
call fcn.0040daff
push ebx
push 0xb
push dword [ebp + 8]
call fcn.0040daff
push 1
push 4
push eax
mov dword [ebp - 4], eax
call fcn.0040b46b
push eax
call fcn.0043a445
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
cmp si, 0x10e1
mov dword [ebp + 8], eax
jne 0x45b232
cmp di, 0x4d2
jne 0x45b232
cmp dword [ebp + 0xc], ebx
je 0x45b217
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
call fcn.00416c1f
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
cdq
sub eax, edx
mov esi, eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
sar esi, 1
add esi, dword [ebp - 0x20]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
add edi, dword [ebp - 0x1c]
jmp 0x45b232
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call edi
cdq
sub eax, edx
push 1
mov esi, eax
sar esi, 1
call edi
cdq
sub eax, edx
mov edi, eax
sar edi, 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
movzx ecx, word [ebp + 0x10]
imul ecx, ecx, 0xfa
mov dword [ebp + 0x18], ecx
mov dword [ebp + 0xc], eax
add ecx, eax
lea eax, [ebp - 8]
push eax
push 0
push 0x22
mov dword [ebp + 0x10], ecx
push dword [ebp - 4]
call fcn.0040b5d8
cmp dword [ebp - 8], 1
jne 0x45b28d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45b28d
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ClientToScreen]
add esi, dword [ebp - 0x10]
add edi, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
movzx esi, si
movzx edi, di
mov dword [ebp - 4], esi
sub esi, dword [ebp - 0x10]
mov dword [ebp + 0x14], edi
sub edi, dword [ebp - 0xc]
call ebx
cmp eax, dword [ebp + 0x10]
jae 0x45b2f2
mov ecx, dword [ebp + 0xc]
imul ecx, ecx, 0x64
mov dword [ebp + 8], ecx
jmp 0x45b2be
mov ecx, dword [ebp + 8]
imul eax, eax, 0x64
sub eax, ecx
xor edx, edx
div dword [ebp + 0x18]
push 0x64
pop ecx
mov dword [ebp + 0xc], eax
imul eax, edi
cdq
idiv ecx
add eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp + 0xc]
imul eax, esi
cdq
idiv ecx
add eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
call ebx
cmp eax, dword [ebp + 0x10]
jb 0x45b2bb
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetCursorPos]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45b3fa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x110]
push edi
push eax
push dword [ebp + 0xc]
call fcn.0040945d
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x110]
push 0x46f41c
push eax
call esi
test eax, eax
je 0x45b445
lea eax, [ebp - 0x110]
push 0x46f418
push eax
call esi
test eax, eax
mov dword [ebp - 4], edi
jne 0x45b44c
mov dword [ebp - 4], 1
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.00418240
mov ebx, eax
cmp ebx, edi
je 0x45b47d
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x45b481
xor eax, eax
jmp 0x45b4c8
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
push dword [ebp + 8]
call fcn.0045b306
add esp, 0x10
mov edi, eax
lea eax, [ebp - 0xc]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x7ffe
push ebx
push esi
call fcn.0040a362
push edi
push esi
call fcn.0040a362
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45b519
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push ebx
push esi
push edi
xor edi, edi
push edi
push 0xb
push dword [ebp + 8]
call fcn.0040daff
push 4
pop ebx
push ebx
push eax
call fcn.0040b46b
push 1
pop esi
push esi
push eax
call fcn.0043a445
mov dword [ebp - 4], eax
push 0x18
lea eax, [ebp - 0x2c]
push edi
push eax
call fcn.004447a0
add esp, 0xc
lea eax, [ebp - 0x194]
mov dword [ebp - 0x28], esi
push str.SMTP:
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x194]
push 0x30
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x194]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.004447a0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x14]
add esp, 0xc
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x2c]
cmp ebx, edi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], eax
je 0x45b5dc
push 0x18
lea eax, [ebp - 0x74]
push edi
push eax
call fcn.004447a0
lea eax, [ebp - 0x74]
add esp, 0xc
or dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x68], ebx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push edi
push eax
push 0x45b4cd
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp + 8], eax
push 0x1ff
push 0xffffffffffffffff
lea eax, [ebp + 8]
push edi
push eax
push esi
call ebx
test eax, eax
je 0x45b660
push esi
push edi
push edi
lea eax, [ebp - 0x90]
push edi
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x45b651
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x45b620
push 0x1ff
push 0xffffffffffffffff
lea eax, [ebp + 8]
push edi
push eax
push esi
jmp 0x45b61a
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x45b669
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push esi
lea eax, [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.00456719
mov esi, eax
cmp esi, 0xffffffff
jne 0x45b69c
lea eax, [ebp - 0x21c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x45b6f5
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004568cb
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0x10]
push 0
add eax, esi
push 0
add eax, edi
push eax
call fcn.00456719
cmp eax, 0xffffffff
je 0x45b6e1
mov ecx, dword [ebp + 0x10]
add eax, ecx
add eax, esi
and byte [eax + edi], 0
mov eax, dword [ebp + 0x10]
add eax, esi
add eax, edi
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00456678
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004092fa
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop edi
cmp eax, 0xffffffff
pop esi
jne 0x45b72e
lea eax, [ebp - 0x118]
push eax
call fcn.004098d5
test eax, eax
jne 0x45b72e
leave
ret
lea eax, [ebp - 0x21c]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
leave
ret
Function at 0x45f3ca
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
lea eax, [ebp - 0x6c]
push eax
call edi
mov esi, str.MS_Shell_Dlg
lea eax, [ebp - 0x6c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
xor ebx, ebx
test eax, eax
jne 0x45f45a
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFontSubstitutes
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x45f45a
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x28
push eax
lea eax, [ebp - 0x94]
push eax
push ebx
push ebx
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x45f45a
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x6c]
push eax
call edi
cmp dword [0x470afc], ebx
jne 0x45f467
call fcn.0045f310
mov eax, dword [ebp + 8]
cmp eax, ebx
jne 0x45f473
mov eax, dword [0x470af8]
push dword [0x470afc]
mov dword [ebp + 8], eax
xor esi, esi
call fcn.00408e8c
mov edi, eax
cmp edi, ebx
je 0x45f4ab
lea eax, [ebp - 0x6c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x45f49a
mov esi, edi
push dword [0x470afc]
call fcn.00408ec2
cmp esi, ebx
mov edi, eax
je 0x45f485
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0x200a
mov byte [ebp + 0xf], 4
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
cmp dword [ebp - 4], 2
jne 0x45f4cd
mov byte [ebp + 0xf], 5
cmp esi, ebx
je 0x45f516
push 0x20
lea eax, [ebp - 0x28]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov al, byte [esi + 0x4e]
cmp al, bl
mov byte [ebp - 0x2d], al
jne 0x45f4ec
mov byte [ebp - 0x2d], 1
mov al, byte [esi + 0x4d]
push 0xffffffffffffffb8
mov byte [ebp - 0x2b], al
mov al, byte [esi + 0x4c]
mov byte [ebp - 0x2c], al
mov al, byte [ebp + 0xf]
mov byte [ebp - 0x2a], al
mov eax, dword [ebp + 8]
imul eax, dword [ebp + 0x10]
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x44], eax
mov al, byte [esi + 0x48]
mov byte [ebp - 0x29], al
jmp 0x45f54a
lea eax, [ebp - 0x28]
push str.Arial
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 8]
push 0xffffffffffffffb8
imul eax, dword [ebp + 0x10]
cdq
pop ecx
mov byte [ebp - 0x2c], 7
idiv ecx
mov byte [ebp - 0x29], 0x22
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2d], 1
mov dword [ebp - 0x44], eax
mov al, byte [ebp + 0xf]
mov byte [ebp - 0x2a], al
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], ebx
neg eax
sbb eax, eax
mov byte [ebp - 0x2e], bl
and eax, 0x12c
mov dword [ebp - 0x40], ebx
add eax, 0x190
cmp dword [ebp + 0x18], ebx
mov dword [ebp - 0x34], eax
setne al
cmp dword [ebp + 0x1c], ebx
mov byte [ebp - 0x30], al
setne al
mov byte [ebp - 0x2f], al
mov eax, dword [ebp + 0x24]
lea eax, [eax + eax*4]
shl eax, 1
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
pop edi
pop esi
pop ebx
leave
ret 0x20
Function at 0x45f616
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edi, ebx
and ebx, 0x7fffffff
shr edi, 0x1f
cmp ebx, 0x2bf20
jbe 0x45f645
or eax, 0xffffffff
jmp 0x45f695
call esi
sub eax, dword [ebp - 4]
cmp eax, ebx
jae 0x45f693
xor eax, eax
push 1
cmp edi, eax
je 0x45f683
push eax
push eax
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x45f645
cmp dword [ebp - 0x1c], 0x12
je 0x45f68b
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x45f645
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x45f645
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc