joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d778
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x48abb0]
cmp dword [eax + 0x30], 0
je 0x45d822
cmp dword [ebx + 0x94], 0
jne 0x45d81c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45d708
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45d81c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45d7e2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45d81c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413be0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45d7f1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45e384
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45e3b9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403fd8
jmp 0x45e3c6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403f3c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45f430
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45f471
mov eax, esi
call fcn.00445680
test al, al
je 0x45f471
mov eax, dword [ebx + 0x84]
call fcn.0044537c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45f471
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044537c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x462b38
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x462b66
mov eax, ebx
call fcn.004635ec
cmp dword [ebx + 0x40], 0
je 0x462b5f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x462bd7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x462bc9
cmp dword [ebx + 8], 0
je 0x462b88
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x462b9a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x462bc9
cmp dword [ebx + 8], 0
je 0x462b7b
cmp eax, 3
je 0x462bad
dec eax
jne 0x462b7b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x462b7b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x462b7b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x462bf5
cmp dword [ebx + 0x14], 0xcc
je 0x462bf5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00462c00
pop ebx
ret
Function at 0x474578
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4747d8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4745db
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.00474040
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040bfb0
cmp al, 1
jne 0x4745db
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.00474358
test al, al
je 0x474767
cmp dword [ebp - 8], 0
jge 0x4745f9
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.00474040
mov eax, dword [ebp - 0x210]
call fcn.004041a8
cmp ebx, eax
jge 0x474643
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.00474040
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4894c4]
and eax, 0xff
bt dword [edx], eax
jae 0x474643
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x474657
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00474554
cmp ebx, dword [ebp - 8]
je 0x474759
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x474683
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403394
and eax, 0x7f
movzx eax, word [eax*2 + 0x487794]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x474746
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403394
and eax, 0x7f
movzx eax, word [eax*2 + 0x487794]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0044537c
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403394
and eax, 0x7f
movzx eax, word [eax*2 + 0x487794]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0044537c
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47474d
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4747ba
cmp dword [ebp - 8], 0
jge 0x474772
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00474040
mov eax, dword [ebp - 0x218]
call fcn.004041a8
cmp eax, dword [ebp - 8]
jg 0x4747ac
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.00474040
mov eax, dword [ebp - 0x21c]
call fcn.004041a8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00474554
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4747df
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00403f0c
ret
Function at 0x47ef64
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
push 4
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x47efe6
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x47efd5
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 4
call fcn.004028c8
mov eax, dword [ebp - 8]
push eax
push 0x10
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47efdc
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
Function at 0x803277
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07f2588
jmp 0x80323f
setae ah
mov eax, 0x19a08e5b
mov edx, edi
dec bh
jmp 0x803297
pushfd
jmp 0x80307a
mov esi, dword [esp + 0x2c]
not dl
bt cx, si
jge 0x803281
or ch, cl
jmp 0x80329d
mov dword [esp + 0x10], edi
lea esp, [esp + 0x10]
jmp 0x803255
jmp 0x80329b
ja 0x80325b
jbe 0x80325b
or ch, cl
lea edi, [esp]
mov ecx, dword [esp]
mov dh, bh
jmp 0x8045a8
sub esp, 0xc0
mov ebp, esp
xchg bh, dh
pushfd
jmp fcn.00803b1a

Function at 0x80eeaf
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfd
pop word [esp]
lea esp, [esp + 2]
jmp fcn.00810235
jmp 0x7f2cae
pushfd
lea esp, [esp + 4]
jmp 0x7f2cf0

Function at 0x8eb20f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0xb], dh
push dword [esp + 6]
pop word [esp + 5]
jmp 0x8eb1ed
mov ax, 0x40b5
btc bp, di
push dword [esp + 4]
mov bl, bh
shl dl, 6
pop edi
jmp 0x8eb1c3
mov ebx, dword [esp + 0xb]
mov eax, dword [esp + 7]
cpuid
cpuid
setae dl
mov esi, dword [esp + 0xc]
jmp 0x8eb227
jmp 0x8eb1d9
setge ah
and ch, cl
not cx
sbb bx, 0x9ffc
bswap ebx
jmp 0x8eb24f
bswap edi
bswap ecx
add esp, 0xd
pop cx
bswap edx
mov ecx, 0x1b34da09
jmp 0x8eb211
mov ch, al
xchg edi, ecx
rdtsc
lea ebx, reloc.user32.dll_GetMessageA
rdtsc
jmp 0x8eb351
mov dx, word [esp]
dec ch
shr cx, cl
mov bh, byte [esp]
push sp
mov bh, ah
jmp 0x8eb239
xchg edx, ecx
mov edx, ebx
xchg dword [esp + 9], edx
inc ecx
mov dword [esp + 8], edx
xchg dword [esp + 7], eax
jmp 0x8eb286
xchg dword [esp + 2], eax
mov bl, byte [esp + 0xc]
mov di, si
setne al
lea ecx, [eax*4]
mov cx, word [esp + 0xd]
jmp 0x8eb29c
mov word [esp], ax
sub esp, 0xc
bsf ecx, ebp
mov cl, dh
mov byte [esp], bh
xchg ah, dl
jmp 0x8eb2d5
bts eax, eax
mov ch, 0x42
xchg si, ax
bswap ebx
cpuid
not si
jmp 0x8eb31a

Function at 0x8eb61a
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xa
pop edx
mov byte [esp + 8], ah
bswap esi
bt dx, bp
jmp 0x8eb637

Function at 0x8eb74f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x12], cx
xchg dx, ax
bswap eax
mov cl, ch
xchg dword [esp + 0x26], eax
mov ebp, eax
jmp 0x8eb6d7
rdtsc
pop dword [esp + 8]
mov word [esp], sp
sub esp, 0x1e
mov ah, 0xac
bts edx, esi
jmp 0x8eb666
xchg al, cl
push word [esp + 9]
not cl
inc ebx
xchg ebx, edi
lea eax, [eax + edi]
jmp 0x8eb71f
bsf esi, esi
bswap esi
lea edi, [eax + 7]
std
btc ecx, esi
neg eax
jmp 0x8eb6a0
mov di, word [esp + 0x12]
push word [esp + 0xd]
lea ebp, [edi + ebp]
pop dx
lea esp, [esp + 0x26]
push dword [esp + 4]
jmp 0x8eb6b6
bsr cx, sp
bts bx, dx
mov word [esp + 0xa], si
mov byte [esp + 4], ch
call fcn.008eb6f0
xchg edi, eax
invalid
mov cx, word [esp + 0xb]
sub esp, 5
bsf edi, esi
lea edi, [esi*4]
cpuid
cmp ebp, 0x770e2a9a
jmp 0x8eb706
mov byte [esp], cl
dec ecx
mov word [esp + 0xd], ax
rdtsc
mov byte [esp + 0xd], dl
jmp 0x8eb68c
Function at 0x8f0217
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dx, 0x61e5
adc eax, esp
jmp 0x8f0256
rdtsc
mov bh, 0xa6
xchg di, bx
cmc
bt ebx, ecx
setge al
jmp 0x8f0275
lea ecx, [ebp*4]
pop bp
lea edi, reloc.user32.dll_GetMessageA
lea ebp, [ebp*4]
mov ah, byte [esp + 1]
xchg dword [esp], esi
jmp 0x8f023c
push word [esp + 3]
pushal
xchg byte [esp + 0x11], al
xchg dl, bl
xchg word [esp + 0xc], si
pop ecx
jmp 0x8f04d5
lea ebp, [edi + edi]
xchg byte [esp + 0xd], bh
sub esp, 0x1f
mov byte [esp + 0x26], ch
pop dword [esp + 0x12]
mov byte [esp + 3], dh
jmp 0x8f0316
bswap esi
pop si
lea ecx, [ebp - 0xf3]
mov dl, cl
pop si
sub esp, 1
jmp 0x8f02a8
mov dx, word [esp + 1]
xchg byte [esp + 0x17], al
mov word [esp + 0x1a], ax
inc di
lea ecx, [eax + edi]
call fcn.008f02e4
pop es
scasb al, byte es:[edi]
mov ecx, 0xd5876698
xchg bp, dx
dec edi
pop word [esp + 8]
lea edi, [ecx*4]
xchg si, dx
mov eax, 0x40f57b63
jmp 0x8f02fa
xchg al, cl
mov word [esp + 6], sp
mov al, ah
pop dword [esp + 3]
mov edx, ebp
lea ecx, reloc.user32.dll_GetMessageA
jmp 0x8f02d1
rdtsc
mov ebx, ebp
xchg ebp, ecx
mov cl, 0xdc
xchg bp, dx
mov word [esp + 0x16], dx
jmp 0x8f0384
bswap edi
add bp, si
xchg ch, ah
mov dword [esp + 0x11], ebx
mov dword [esp + 3], eax
lea ebx, [eax*4]
jmp 0x8f03f8

Function at 0x8f043b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x8f047b
xchg edx, esi
mov bp, 0x1460
xchg bx, si
add esp, 5
mov dword [esp + 0x16], edx
xchg ah, dh
jmp 0x8f0465
pop ebp
not di
not ah
mov bh, ch
xchg dword [esp + 0x1f], ecx
inc bh
jmp 0x8f04bb
mov eax, ebp
mov dx, ax
inc bx
rdtsc
push word [esp + 0x20]
mov al, dh
jmp 0x8f043d
mov bh, ch
setg dh
lea esi, [eax*4]
mov ebx, dword [esp + 0x23]
setb ah
jmp 0x8f06e6
rdtsc
mov bx, cx
sub esp, 0x16
call fcn.008f04f0
test eax, 0xab5839
push eax
retf 0x3f58
xchg edx, eax
std
add esp, 5
mov byte [esp + 1], dh
push word [esp + 5]
lea esp, [esp + 7]
jmp 0x8f0506
push cx
lea ebx, [ebx + esi]
popal
xchg bp, bx
and dh, cl
mov byte [esp + 3], ch
jmp 0x8f0520

Function at 0x8f0742
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg dl
lea ebp, [eax + edi]
lea esp, [esp + 3]
mov word [esp], di
mov edx, dword [esp]
jmp 0x8f0722
mov edi, dword [esp + 5]
mov ecx, dword [esp + 1]
rdtsc
xchg dl, ah
pop bp
xchg bh, bl
jmp 0x8f06fa
mov ebx, dword [esp]
mov edx, dword [esp]
lea ecx, reloc.user32.dll_GetMessageA
mov esi, dword [esp]
cpuid
btc ax, di
jmp 0x8f0764
mov ebp, 0xbaa76fe1
push word [esp + 4]
jmp 0x8f0710
xchg byte [esp + 3], ch
setnp al
xchg dword [esp], ecx
xchg word [esp + 0xa], di
jmp 0x8f07a8
xchg esi, ecx
rdtsc
xchg ch, bh
sub esp, 0x19
mov eax, dword [esp + 9]
mov byte [esp + 0x15], dl
jmp 0x8f074e
lea ecx, [esi + ebp]
rdtsc
shr cl, 6
mov ax, 0x9c47
shr bl, cl
pop ecx
jmp 0x8f0792
Function at 0x8f09ee
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, byte [esp + 0xd]
mov ah, byte [esp + 0xc]
xchg dword [esp + 0x11], esi
mov byte [esp + 0x13], al
jmp 0x8f08c8
neg bl
sub esp, 0x19
pop dword [esp + 7]
mov word [esp + 0xc], cx
mov byte [esp + 0x12], al
cpuid
jmp 0x8f0881
lea ebx, reloc.user32.dll_GetMessageA
pop ecx
mov byte [esp + 0xb], al
mov ch, dh
pop word [esp + 4]
mov ax, si
jmp 0x8f0897
xchg dword [esp + 0xc], ebp
rdtsc
mov cl, byte [esp + 0x18]
lea edi, [ebp + 0x17]
cpuid
not cl
jmp 0x8f0969
rdtsc
sub esp, 6
mov di, dx
mov ebx, 0xc0cdf7e8
btc ebx, esi
pushfd
jmp 0x8f08b1
xchg ebx, ebp
mov bl, al
mov al, ch
lea ecx, reloc.user32.dll_GetMessageA
jmp 0x8f093d
push dword [esp + 7]
mov ebx, ecx
ror al, 7
pop word [esp + 6]
not bl
xchg word [esp + 1], bp
jmp 0x8f08fa
mov dx, 0xb2c3
sub esp, 1
lea esi, [edi*4]
jmp 0x8f0952
lea ecx, reloc.user32.dll_GetMessageA
cld
xchg word [esp], cx
or bp, bx
bswap eax
add esp, 3
jmp 0x8f0927
xchg byte [esp + 7], cl
mov cl, byte [esp + 8]
lea ebp, reloc.user32.dll_GetMessageA
jmp 0x8f0996
mov byte [esp + 1], dl
lea esp, [esp + 0x14]
xchg bx, bp
xchg byte [esp + 3], dh
mov byte [esp + 6], ah
mov al, dh
jmp 0x8f0910
bsf ebx, edi
rdtsc
mov ebp, dword [esp + 4]
xchg bl, cl
not ecx
jmp 0x8f09c2
pop word [esp + 4]
xchg esi, eax
or al, dl
bswap ecx
mov word [esp + 7], bx
mov di, word [esp + 5]
jmp 0x8f0980
push dword [esp]
bswap eax
push dword [esp + 6]
xchg word [esp + 5], dx
jmp 0x8f09d4
mov dword [esp + 2], esp
push ebp
lea ecx, reloc.user32.dll_GetMessageA
rdtsc
cpuid
cld
jmp 0x8f09ac
btc ax, cx
lea ebx, [ecx - 0x5d]
rdtsc
mov ecx, dword [esp + 0x11]
xchg byte [esp + 6], ah
jmp 0x8f0a49
jmp 0x8f08e7
mov di, 0x61d6
mov ebx, eax
mov ah, dl
lea esp, [esp + 1]
lea eax, [edi + ebp]
lea esp, [esp + 1]
jmp 0x8f0a2b
cpuid
xchg word [esp + 4], di
mov ax, dx
rcl bx, 8
shl edi, cl
add esp, 5
jmp 0x8f09f3
and cx, 0x81ce
lea edx, [edx + edi]
cld
mov bl, byte [esp]
mov cx, si
mov dl, byte [esp]
jmp 0x8f0a79
mov ecx, 0xe890197a
pop dword [esp + 2]
sub esp, 3
xchg dword [esp + 0xb], edx
add esp, 0xd
mov cx, word [esp + 7]
jmp 0x8f0a16
mov ebx, ebp
lea ebx, [esp + eax]
call fcn.008f0b60
pop eax
aad 0x45
sub al, 0xdf
aas
les esi, [edi + 0x5e]
test eax, 0x2c8d6bc8
mov ch, 0
add byte [eax], al
add byte [ebp + 0xb51c], cl
add byte [eax], al
lea ebp, [esi*4]
lea ebx, [esi*4]
bswap edi
mov edx, 0x4ca01e39
neg eax
mov bh, byte [esp]
jmp 0x8f0a63
Function at 0x41cb19
Capabilities:
Read file on windows

Disassembly:
push 8
mov eax, 0x41e1bc
call fcn.00405af4
mov ebx, ecx
cmp byte [ebx + 0x21], 0
jne 0x41cbd2
cmp dword [ebp + 8], 0x10
jne 0x41cc9f
mov eax, dword [ebx + 0x80]
cmp eax, 0x10
jb 0x41cc9f
lea esi, [ebx + 0x24]
push eax
mov ecx, esi
call fcn.0041c4d4
cmp dword [esi], 0
jne 0x41cb5f
call fcn.00405d2c
push dword [ebp + 8]
lea eax, [ebx + 0x74]
push eax
push dword [ebx + 0x80]
push dword [esi]
call dword [sym.imp.MSVCR100.dll_memcpy_s]
mov edx, dword [ebx + 0x80]
add esp, 0x10
cmp edx, dword [ebp + 8]
je 0x41cbd2
push 5
pop ecx
lea eax, [ebx + 0x28]
push eax
mov edi, eax
lea eax, [ebp + 8]
push eax
mov esi, 0x402dd8
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x24]
lea eax, [edx - 0x10]
push eax
lea eax, [ecx + 0x10]
push eax
push dword [ebx + 0x14]
mov word [ebx + 0x20], 0x101
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41cc9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x41cc9f
mov byte [ebx + 0x20], 0
call fcn.00405ebd
lea edi, [ebx + 0x24]
mov eax, dword [edi]
test dword [eax + 4], 0x2000000
je 0x41cc27
push 0x421748
push dword [eax + 0xc]
call fcn.0041d25c
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x41cb5a
mov eax, dword [edi]
push dword [eax + 0xc]
mov dword [ebp - 0x10], ecx
push eax
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.0041ccf7
cmp dword [ebp - 0x10], 0
je 0x41cc88
push dword [ebp - 0x10]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
pop ecx
jmp 0x41cc88
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x7c]
mov ecx, ebx
call fcn.0041cca7
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x41cc79
mov eax, dword [edi]
and dword [ebp - 0x10], 0
test byte [eax + 7], 1
je 0x41cc5b
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
test eax, eax
js 0x41cc6f
jmp 0x41cc68
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
push edi
call dword [eax + 0xc]
test al, al
jne 0x41cc6f
mov dword [ebp - 0x10], 0x8007000d
push dword [ebp - 0x10]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x41cc88
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [edi]
test eax, eax
je 0x41cc98
and dword [edi], 0
push eax
call fcn.0040501c
pop ecx
mov ecx, ebx
call fcn.0041cac8
call fcn.00405bcc
ret 4
Function at 0x448dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x4db9e0
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x508208], 1
jge 0x4dba4f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x4dba25
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x4dba25
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x4dba02
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x4dba3b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x4dba42
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x4dbb3f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x4dbb10
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x4dbb05
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x4dbaf9
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x4dbb00
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x4dbb3f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x4dbb3a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x4dbb23
mov eax, dword [ebx + 8]
jmp 0x4dbb3f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x4dbb31
xor eax, eax
jmp 0x4dbb3f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x4dba6f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x44a2c9
Capabilities:
Query environment variable

Disassembly:
jmp 0x4b4297
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4b42ab
xor edi, edi
jmp 0x4b42ef
push ebx
push esi
call fcn.004b418e
sub eax, esi
sar eax, 1
push 0x40
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
lea ebx, [eax + eax]
push ebx
call fcn.0044a81e
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4b42dc
push ebx
push esi
push edi
call fcn.0044a3d2
add esp, 0xc
push 2
push 0
call fcn.0044acd3
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret
Function at 0x4ad400
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.0044a148
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4ad43e
cmp dword [ebp + 8], 0
je 0x4ad42c
lea eax, [ebp + 8]
push eax
call fcn.004495a9
add esp, 4
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x4ad43e
mov eax, 4
jmp 0x4ad56e
call fcn.0044b246
movzx edx, al
test edx, edx
jne 0x4ad46c
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4ad45d
mov dword [ebp - 0xc], 4
jmp 0x4ad464
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
jmp 0x4ad56e
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4ad515
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x4ad8c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 8]
call fcn.0044ab8e
lea ecx, [ebp - 8]
call fcn.004493a6
movzx edx, al
test edx, edx
jne 0x4ad4d7
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.0044ab25
mov eax, dword [ebp - 0x10]
jmp 0x4ad56e
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.00449e19
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x4ad502
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
call fcn.0044ab25
mov eax, dword [ebp - 0x14]
jmp 0x4ad56e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 8]
call fcn.0044ab25
mov eax, dword [ebp - 0x18]
jmp 0x4ad56e
call fcn.0044a675
movzx ecx, al
test ecx, ecx
jne 0x4ad54e
mov edx, dword [ebp + 0x10]
or edx, 0x200000
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.00449595
add esp, 0x10
jmp 0x4ad56e
call fcn.0044927a
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.0044836b
add esp, 0x10
mov esp, ebp
pop ebp
ret