joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416830
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
jmp 0x416830
sub esp, 0x18
mov eax, dword [0x4e6b6c]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
push 6
push 1
mov esi, ecx
push 2
mov byte [esi + 0x20], 0
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
jne 0x41687b
mov edi, dword [esi]
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov eax, dword [edi + 4]
mov ecx, esi
call eax
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00449d8b
add esp, 0x18
ret
movzx ecx, word [esi + 0x14]
push ecx
mov word [esp + 0x10], 2
call sub.WSOCK32.dll_htons
mov edx, dword [esi + 0x10]
push edx
mov word [esp + 0x12], ax
call sub.WSOCK32.dll_htonl
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0x14], 1
call sub.WSOCK32.dll_ioctlsocket
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x18]
push 0x10
push 0x401
push edx
push eax
call sub.WSOCK32.dll_WSAAsyncSelect
cmp eax, 0xffffffff
jne 0x4168fb
mov edi, dword [esi]
call sub.WSOCK32.dll_WSAGetLastError
mov edx, dword [edi + 4]
push eax
mov ecx, esi
call edx
mov ecx, esi
call fcn.00401eba
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00449d8b
add esp, 0x18
ret
mov ecx, dword [esi + 0x18]
push 0x10
lea eax, [esp + 0x10]
push eax
push ecx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x41691c
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4168d2
mov eax, dword [esi + 0xc]
push 0
push 0x2710
push 0
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.00449d8b
add esp, 0x18
ret

Function at 0x416a60
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x416a60
sub esp, 0x1bc
mov eax, dword [0x4e6b6c]
xor eax, esp
mov dword [esp + 0x1b8], eax
mov eax, dword [esp + 0x1c0]
mov dword [0x4ed180], eax
mov eax, dword [0x4ed17c]
add eax, 1
cmp eax, 1
mov dword [0x4ed17c], eax
jne 0x416b0d
lea eax, [esp + 0x28]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x416aef
mov ecx, dword [0x4ed180]
lea edx, [esp]
push edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x401da2
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], str.CasinoNetClass
call dword [0x4ec824]
test ax, ax
jne 0x416b0d
call sub.WSOCK32.dll_WSACleanup
sub dword [0x4ed17c], 1
xor al, al
mov ecx, dword [esp + 0x1b8]
xor ecx, esp
call fcn.00449d8b
add esp, 0x1bc
ret
mov ecx, dword [esp + 0x1b8]
xor ecx, esp
mov al, 1
call fcn.00449d8b
add esp, 0x1bc
ret
Function at 0x417050
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x1c]
mov al, byte [edx]
mov byte [ebp - 0x21], al
add dword [ebp - 0x1c], 1
cmp byte [ebp - 0x21], 0
jne 0x41707b
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
jg 0x4170a9
xor eax, eax
jmp 0x4171db
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x14]
jge 0x4170d8
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x20
je 0x4170cd
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 9
jne 0x4170d8
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x4170a9
mov dword [ebp - 0xc], 0
jmp 0x4170ea
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x417175
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x14]
jge 0x417175
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x14]
jge 0x41714d
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x2e
je 0x41714d
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x20
je 0x41714d
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 9
je 0x41714d
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0xa
je 0x41714d
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x417102
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov esi, dword [ebp - 0x10]
shl esi, 8
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
push edx
call fcn.0044ba23
add esp, 4
add esi, eax
mov dword [ebp - 0x10], esi
jmp 0x4170e1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp eax, 4
jge 0x417191
mov edx, dword [ebp - 0x10]
shl edx, 8
mov dword [ebp - 0x10], edx
jmp 0x417175
cmp dword [ebp - 0x10], 0
jne 0x4171d8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4171d8
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4171cb
mov dword [ebp - 0x10], 0
jmp 0x4171d8
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.WSOCK32.dll_ntohl]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 8], 0
je 0x41959e
cmp dword [ebp + 0xc], 0
jl 0x41959e
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0xffffffff
jne 0x4195a3
or eax, 0xffffffff
jmp 0x4195f4
cmp dword [ebp + 0xc], 0
jne 0x4195ad
xor eax, eax
jmp 0x4195f4
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
and edx, 4
je 0x4195cb
push 2
push 0
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x4195f1
mov eax, dword [ebp - 4]
jmp 0x4195f4
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8
Function at 0x43e8d0
Capabilities:
Check if file exists
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x485e36
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x4e6b6c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
call sub.urlmon.dll_URLDownloadToFileW
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
movzx ecx, byte [eax + 0x10]
test ecx, ecx
je 0x43e92d
mov eax, 1
jmp 0x43ea8e
cmp dword [ebp - 0x10], 0
jge 0x43ea6c
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x254], edx
cmp dword [ebp - 0x254], 0x800c0007
jg 0x43e97d
cmp dword [ebp - 0x254], 0x800c0006
jge 0x43e992
cmp dword [ebp - 0x254], 0x800c0002
je 0x43ea57
cmp dword [ebp - 0x254], 0x800c0005
je 0x43ea57
jmp 0x43ea65
cmp dword [ebp - 0x254], 0x800c0300
je 0x43ea5e
jmp 0x43ea65
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x238]
call fcn.0040104b
mov dword [ebp - 4], 0
push 0x4ed328
lea ecx, [ebp - 0x238]
call fcn.0040173f
push 0x4ed300
lea ecx, [ebp - 0x24c]
push ecx
mov ecx, 0x4ed2b0
call fcn.004015b4
mov dword [ebp - 0x258], eax
mov edx, dword [ebp - 0x258]
mov dword [ebp - 0x25c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x238]
call fcn.0040173f
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24c]
call fcn.00401af5
push 0
push 0
push 0x105
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x238]
call fcn.00401320
push eax
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
mov dword [ebp - 0x10], eax
xor edx, edx
cmp dword [ebp - 0x10], 0
setge dl
add edx, 2
mov dword [ebp - 0x250], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.00401af5
mov eax, dword [ebp - 0x250]
jmp 0x43ea8e
mov eax, 2
jmp 0x43ea8e
mov eax, 6
jmp 0x43ea8e
mov eax, 4
jmp 0x43ea8e
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
test eax, eax
jne 0x43ea8c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x43ea8c
mov eax, 8
jmp 0x43ea8e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00449d8b
mov esp, ebp
pop ebp
ret

Function at 0x43fd60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push 0x4ed360
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x43fdd9
cmp dword [ebp - 4], 0x104
jge 0x43fdd9
push 0x4ed360
push 0
push str.unicows
push 0x4ed360
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
je 0x43fdd9
mov eax, 0x4ed360
add eax, 0xffffffff
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 1]
mov byte [ebp - 9], dl
add dword [ebp - 8], 1
cmp byte [ebp - 9], 0
jne 0x43fdaf
mov edi, dword [ebp - 8]
mov eax, dword [str..dll]
mov dword [edi], eax
mov cl, byte [0x48e99c]
mov byte [edi + 4], cl
mov al, 1
jmp 0x43fddb
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x440c90
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486169
mov eax, dword fs:[0]
push eax
sub esp, 0x2b4
mov eax, dword [0x4e6b6c]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x20]
call fcn.00401b3b
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.00401005
push 0x48ea4c
lea ecx, [ebp - 0x290]
call fcn.00401e1a
mov byte [ebp - 4], 1
push 1
lea ecx, [ebp - 0x290]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0040159b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x290]
call fcn.00401af5
lea ecx, [ebp - 0x20]
call fcn.00401320
mov dword [ebp - 0x2bc], eax
lea edx, [ebp - 0x27c]
push edx
mov eax, dword [ebp - 0x2bc]
push eax
call dword [0x4e9a70]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
je 0x440e50
mov ecx, dword [ebp - 0x27c]
and ecx, 0x10
je 0x440dc0
push 0x48c148
lea edx, [ebp - 0x250]
push edx
call dword [0x4eb2d0]
test eax, eax
je 0x440dbe
push 0x48c140
lea eax, [ebp - 0x250]
push eax
call dword [0x4eb2d0]
test eax, eax
je 0x440dbe
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x20]
call fcn.00401005
lea edx, [ebp - 0x250]
push edx
lea ecx, [ebp - 0x2a4]
call fcn.0040104b
mov byte [ebp - 4], 2
push 1
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040159b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2a4]
call fcn.00401af5
lea ecx, [ebp - 0x20]
push ecx
call fcn.004018a2
add esp, 4
jmp 0x440e34
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x20]
call fcn.00401005
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x2b8]
call fcn.0040104b
mov byte [ebp - 4], 3
push 1
lea ecx, [ebp - 0x2b8]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0040159b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2b8]
call fcn.00401af5
lea ecx, [ebp - 0x20]
call fcn.00401320
mov dword [ebp - 0x2c0], eax
mov edx, dword [ebp - 0x2c0]
push edx
call dword [0x4e996c]
test eax, eax
jne 0x440e34
push 4
push 0
lea ecx, [ebp - 0x20]
call fcn.00401320
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
lea eax, [ebp - 0x27c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [0x4e9b74]
test eax, eax
jne 0x440e4b
jmp 0x440e50
jmp 0x440d2f
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov ecx, dword [ebp + 8]
call fcn.00401320
push eax
call dword [0x4eadbc]
test eax, eax
jne 0x440e80
push 4
push 0
mov ecx, dword [ebp + 8]
call fcn.00401320
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00401a0f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.00449d8b
mov esp, ebp
pop ebp
ret
Function at 0x4421e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x4e6b6c]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 1
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0xffff
movzx ecx, ax
and ecx, 0xff
movzx edx, cl
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], 6
jae 0x442258
xor eax, eax
jmp 0x442374
cmp dword [ebp + 8], 0
jne 0x442268
mov eax, 0x57
jmp 0x442374
lea eax, [ebp - 0x48]
push eax
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 4
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x442297
jmp 0x442341
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x4422c2
jmp 0x442341
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x3c], 0x1f01ff
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 5
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x18]
push edx
lea eax, [ebp - 0x3c]
push eax
push 1
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x442326
jmp 0x442341
push 0
mov ecx, dword [ebp - 0x44]
push ecx
push 0
push 0
push 4
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x1c], 0
je 0x442351
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x48], 0
je 0x442361
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
cmp dword [ebp - 0x44], 0
je 0x442371
mov edx, dword [ebp - 0x44]
push edx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00449d8b
mov esp, ebp
pop ebp
ret
Function at 0x4467c9
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x52c
mov eax, dword [0x4e6b6c]
mov dword [ebp - 4], eax
mov eax, dword [0x4d9ac0]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x4467f8
call eax
cmp eax, ebx
mov dword [ebp - 0x528], eax
jne 0x446985
push dword [0x4e5a88]
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 0x528], eax
je 0x446985
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
jne 0x446830
mov byte [ebp - 0x41c], bl
push esi
lea eax, [ebp - 0x524]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
test eax, eax
jne 0x446848
mov byte [ebp - 0x524], bl
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push esi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x528]
call edi
test eax, eax
jne 0x446869
mov byte [ebp - 0x10c], bl
push esi
lea eax, [ebp - 0x214]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call edi
test eax, eax
pop edi
jne 0x446886
mov byte [ebp - 0x214], bl
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0044672c
lea eax, [ebp - 0x52c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4468a9
sub eax, edx
mov ecx, eax
lea eax, [ebp - 0x314]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4468bd
sub eax, esi
add eax, ecx
mov byte [ebp + eax - 0x213], bl
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.0044672c
lea eax, [ebp - 0x52c]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4468f2
sub eax, ecx
lea ecx, [ebp - 0x314]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x446904
sub ecx, esi
add ecx, eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x524]
push eax
mov byte [ebp + ecx - 0x10b], bl
call fcn.0044665d
test eax, eax
pop esi
jne 0x446945
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x524]
push eax
call fcn.0044665d
test eax, eax
jne 0x446973
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.0044665d
test eax, eax
jne 0x446985
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.0044665d
test eax, eax
je 0x446985
push dword [ebp - 0x528]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov dword [ebp - 0x528], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x528]
pop ebx
call fcn.00449d8b
leave
ret
Function at 0x448b00
Capabilities:
Encrypt data using blowfish

Disassembly:
sub esp, 8
mov ecx, 0x412
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov esi, 0x4e5b20
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
cmp ecx, 0x48
jle 0x448b26
mov ecx, 0x48
mov edi, dword [esp + 0x20]
push ebp
mov eax, edi
mov ebp, ebx
lea esi, [ecx + edi]
mov dword [esp + 0x1c], 0x12
xor ecx, ecx
mov cl, byte [eax]
inc eax
cmp eax, esi
jb 0x448b45
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x448b55
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x448b65
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x448b75
mov eax, edi
mov edx, dword [ebp]
add ebp, 4
xor edx, ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebp - 4], edx
dec ecx
mov dword [esp + 0x1c], ecx
jne 0x448b3a
xor eax, eax
mov esi, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov edi, 9
pop ebp
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.00448bf0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
add esp, 8
add esi, 8
dec edi
jne 0x448b9d
lea esi, [ebx + 0x48]
mov edi, 0x200
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.00448bf0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
add esp, 8
add esi, 8
dec edi
jne 0x448bc6
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x449d8b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4e6b6c]
jne 0x449d95
repz ret
jmp fcn.0044f60e

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408e84
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xf0d60d0
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x73dc5273
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x403b3a
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2002c
call fcn.00431940
push esi
push edi
lea ecx, [ebp - 0x2c]
call fcn.00407667
xor eax, eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 6], al
mov byte [ebp - 5], al
lea eax, [ebp - 0x1002c]
push eax
push 0x7fff
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
lea eax, [ebp - 7]
push eax
push dword [ebp + 8]
call fcn.00403766
call dword [sym.imp.KERNEL32.DLL_IsDebuggerPresent]
test eax, eax
jne 0x43d272
mov eax, dword [0x4c52e0]
test eax, eax
je 0x403c85
xor edi, edi
mov esi, 0x4c6290
inc edi
cmp eax, edi
je 0x43d28c
lea eax, [ebp - 6]
push eax
push ecx
push 0x4c52e0
push 0x4c52f8
mov ecx, esi
call fcn.00407285
test al, al
je 0x403c8e
mov al, byte [0x4c6290]
mov byte [0x4c52e4], al
mov al, byte [0x4c6291]
mov byte [ebp - 5], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2002c]
push eax
push 0x7fff
push dword [0x4c52f8]
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
push dword [ebp - 0xc]
mov ecx, 0x4c52d0
call fcn.00407bcc
mov al, byte [ebp - 6]
mov dword [ebp - 0xc], eax
push dword [0x4c52e0]
push 0x4c52f8
call fcn.0041092d
test eax, eax
jne 0x43d2ab
cmp byte [ebp - 5], 1
je 0x43d2ca
call fcn.00403a46
call fcn.004039d5
cmp byte [0x4c52e4], 0
jne 0x403c43
mov ecx, 0x4c5890
call fcn.0040434a
push edi
mov ecx, 0x4c5310
call fcn.004109d0
cmp byte [0x4c52e4], 0
jne 0x403c61
mov ecx, 0x4c5890
call fcn.0040443a
mov ecx, esi
call fcn.004072db
lea eax, [ebp - 0x1002c]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
lea ecx, [ebp - 0x2c]
call fcn.00405904
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
or dword [0x4c527c], 0xffffffff
jmp 0x403c68
mov dword [0x4c527c], edi
jmp 0x403c68
push 0x10
push 0x4b7770
push str.This_is_a_third_party_compiled_AutoIt_script.
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403c75
push 0xffffffffffffffff
push dword [0x4c52e8]
mov ecx, esi
push edi
call fcn.00407213
mov al, byte [0x4c5284]
mov byte [0x4c6292], al
jmp 0x403c04
mov ecx, esi
call fcn.004072db
lea eax, [ebp - 0x1002c]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov dword [0x4c527c], edi
jmp 0x403c75
call fcn.0045874b
test al, al
jne 0x403c26
cmp byte [ebp - 7], al
jne 0x403c26
lea ecx, [ebp - 0x2c]
call fcn.00404706
push 0x4b4260
lea ecx, [ebp - 0x1c]
call fcn.00407de1
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x1c]
test al, al
je 0x43d324
mov edi, 0x4b77a4
push edi
call fcn.00407cab
push 0x4c52f8
lea ecx, [ebp - 0x1c]
call fcn.00407b2e
push edi
lea ecx, [ebp - 0x1c]
call fcn.00407cab
push 1
jmp 0x43d32d
push dword [ebp + 8]
call fcn.00407cab
push edi
lea eax, [ebp - 0x1002c]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x2c]
push 0x4b77a8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x1c]
call fcn.00405904
jmp 0x403c61