joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441a9e
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x45e998
call fcn.00455768
mov edi, 0x94
mov eax, edi
call fcn.004550b0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x468044], ecx
mov eax, dword [esi + 4]
mov dword [0x468050], eax
mov edx, dword [esi + 8]
mov dword [0x468054], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x468048], esi
cmp ecx, 2
je 0x441afe
or esi, 0x8000
mov dword [0x468048], esi
shl eax, 8
add eax, edx
mov dword [0x46804c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x441b39
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x441b39
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x441b51
cmp eax, 0x20b
je 0x441b3e
mov dword [ebp - 0x1c], esi
jmp 0x441b65
cmp dword [ecx + 0x84], 0xe
jbe 0x441b39
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x441b5f
cmp dword [ecx + 0x74], 0xe
jbe 0x441b39
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.0043dda9
pop ecx
test eax, eax
jne 0x441b91
cmp dword [0x46809c], 1
jne 0x441b7e
call fcn.0043d104
push 0x1c
call fcn.0043d13d
push 0xff
call fcn.0043d021
call fcn.0043de42
mov dword [ebp - 4], esi
call fcn.0043e268
test eax, eax
jge 0x441baa
push 0x1b
call fcn.00441a79
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x468624], eax
call fcn.0043c2be
mov dword [0x468094], eax
call fcn.00440def
test eax, eax
jge 0x441bd0
push 8
call fcn.00441a79
pop ecx
call fcn.00440e91
test eax, eax
jge 0x441be1
push 9
call fcn.00441a79
pop ecx
push 1
call fcn.0043d06f
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x441bf7
push eax
call fcn.00441a79
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
call fcn.00441a1c
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x441c18
movzx eax, word [ebp - 0x40]
jmp 0x441c1b
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0044c8e3
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x441c39
push edi
call fcn.0043d0ea
call fcn.0043d060
jmp 0x441c6b
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004557a3
ret
Function at 0x441deb
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov ecx, dword [ebp + 0x3a4]
cmp ecx, dword [0x4684e0]
mov eax, dword [0x463b28]
push ebx
push esi
mov dword [ebp + 0x398], eax
push edi
jae 0x441fb1
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x468500]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x441fb1
xor edi, edi
cmp dword [ebp + 0x3ac], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
jne 0x441e55
xor eax, eax
jmp 0x441fc5
test al, 0x20
je 0x441e66
push 2
push edi
push edi
push ecx
call fcn.0043e567
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x441f3b
cmp dword [ebp + 0x3ac], edi
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x3a4], edi
jbe 0x441f82
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp + 0x3a8]
lea eax, [ebp - 0x6c]
cmp ecx, dword [ebp + 0x3ac]
jae 0x441ec8
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x441eb9
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x441e9b
mov edi, eax
lea eax, [ebp - 0x6c]
sub edi, eax
push 0
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x441f08
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x441f14
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp + 0x3a8]
xor edi, edi
cmp eax, dword [ebp + 0x3ac]
jb 0x441e8f
jmp 0x441f16
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp + 0x3a4], eax
xor edi, edi
mov eax, dword [ebp - 0x74]
cmp eax, edi
jne 0x441fac
cmp dword [ebp + 0x3a4], edi
je 0x441f82
push 5
pop eax
cmp dword [ebp + 0x3a4], eax
jne 0x441f74
mov dword [0x46803c], eax
jmp 0x441fb8
push edi
lea ecx, [ebp - 0x78]
push ecx
push dword [ebp + 0x3ac]
push dword [ebp + 0x3a8]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x441f66
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x3a4], edi
mov dword [ebp - 0x74], eax
jmp 0x441f16
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp + 0x3a4], eax
jmp 0x441f16
push dword [ebp + 0x3a4]
call fcn.0043d776
pop ecx
jmp 0x441fc2
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x441f9a
mov eax, dword [ebp + 0x3a8]
cmp byte [eax], 0x1a
je 0x441e4e
mov dword [0x468038], 0x1c
mov dword [0x46803c], edi
jmp 0x441fc2
sub eax, dword [ebp - 0x7c]
jmp 0x441fc5
and dword [0x46803c], 0
mov dword [0x468038], 9
or eax, 0xffffffff
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
pop ebx
call fcn.00440a69
add ebp, 0x39c
leave
ret
Function at 0x4422b4
Capabilities:
Read file on windows
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov dword [ebp - 0x14], ecx
mov ebx, 0x465240
mov ecx, ebx
call fcn.00442a48
test eax, eax
jne 0x4422ed
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 0x14]
push 0x4575d8
push 0
push 0x4577ec
call fcn.0044a1f8
jmp 0x442331
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [sym.imp.KERNEL32.DLL_ReadFile]
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x44231b
cmp dword [ebp - 4], 4
jae 0x4423cb
push edi
mov ecx, ebx
call fcn.004426b4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
push edi
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x442438
cmp dword [ebp - 4], 4
jb 0x442438
push dword [ebp - 0x10]
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
cmp eax, edi
mov dword [ebp - 8], eax
je 0x4423d6
cmp dword [ebp - 0x10], edi
je 0x4423a5
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
cmp eax, edi
je 0x4423f4
push edi
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x10]
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x442426
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x10]
jb 0x442426
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetClipboardData]
push edi
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call esi
test eax, eax
je 0x442438
cmp dword [ebp - 4], 4
jb 0x442438
cmp dword [ebp - 0xc], edi
jne 0x442336
jmp 0x442438
push edi
mov ecx, ebx
call fcn.004426b4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x4575d8
push edi
push 0x458d18
jmp 0x442419
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push edi
mov ecx, ebx
call fcn.004426b4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x4575d8
push edi
push 0x457750
mov ecx, dword [ebp - 0x14]
call fcn.0044a1f8
jmp 0x44232f
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push edi
mov ecx, ebx
call fcn.004426b4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0xc], edi
jne 0x44232c
mov ecx, dword [0x464be0]
push 1
push edi
push 0xffffffffffffffff
push 0x45771c
call fcn.00401592
jmp 0x44232f
Function at 0x44246c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov esi, 0x465240
mov ecx, esi
call fcn.00442a48
test eax, eax
jne 0x44249d
push 0x4575d8
push eax
push 0x4577a4
mov ecx, edi
call fcn.0044a1f8
jmp 0x44265c
mov ecx, dword [0x464be0]
push ebx
push 1
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x458f14
call fcn.00401592
push ebx
push ebx
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
push ebx
jne 0x4424de
mov ecx, esi
call fcn.004426b4
jmp 0x44265b
mov byte [ebp - 2], bl
mov byte [ebp - 3], bl
mov byte [ebp - 4], bl
mov dword [ebp - 8], ebx
jmp 0x4425f6
cmp eax, 1
je 0x442501
cmp eax, 7
je 0x442501
cmp eax, 0xd
mov byte [ebp + 0xb], bl
jne 0x442505
mov byte [ebp + 0xb], 1
cmp eax, 8
je 0x442512
cmp eax, 0x11
mov byte [ebp - 1], bl
jne 0x442516
mov byte [ebp - 1], 1
cmp eax, 0xe
je 0x442524
cmp eax, 3
je 0x442524
xor cl, cl
jmp 0x442526
mov cl, 1
cmp byte [ebp + 0xb], bl
je 0x442534
cmp byte [ebp - 2], bl
jne 0x4425f5
cmp byte [ebp - 1], bl
je 0x442542
cmp byte [ebp - 3], bl
jne 0x4425f5
cmp cl, bl
je 0x44254f
cmp byte [ebp - 4], bl
jne 0x4425f5
cmp byte [ebp + 0xb], bl
je 0x44255a
mov byte [ebp - 2], 1
jmp 0x44256d
cmp byte [ebp - 1], bl
je 0x442565
mov byte [ebp - 3], 1
jmp 0x44256d
cmp cl, bl
je 0x44256d
mov byte [ebp - 4], 1
push eax
mov ecx, esi
call fcn.0044290b
mov edi, eax
cmp edi, ebx
je 0x4425f2
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalSize]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x442597
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x4425f2
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x442609
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x442609
cmp dword [ebp - 0x10], ebx
je 0x4425f2
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
cmp esi, ebx
mov esi, 0x465240
je 0x442615
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_EnumClipboardFormats]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x4424ef
jmp 0x442615
cmp dword [ebp - 0x10], ebx
je 0x442615
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push ebx
mov ecx, esi
call fcn.004426b4
cmp dword [ebp - 8], ebx
jne 0x44264f
push ebx
lea eax, [ebp - 0x14]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x44264f
mov ecx, dword [0x464be0]
push 1
push ebx
push 0xffffffffffffffff
push 0x45771c
call fcn.00401592
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x442700
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x18], ebx
jne 0x442722
call fcn.00442a48
test eax, eax
jne 0x442722
push 0x4577ec
jmp 0x4427af
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x44273b
push ebx
mov ecx, esi
call fcn.004426b4
push 0x4577dc
jmp 0x4427af
mov ecx, dword [esi + 4]
cmp ecx, ebx
je 0x44277f
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x44278d
cmp byte [eax], bl
jne 0x44275e
cmp dword [ebp + 8], 0xd
jne 0x442758
cmp byte [eax + 1], bl
jne 0x44275e
mov byte [ebp - 1], 1
jmp 0x442761
mov byte [ebp - 1], bl
push ecx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
cmp byte [ebp - 1], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
je 0x44278d
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov dword [esi + 4], eax
push ebx
mov ecx, esi
call fcn.004426b4
pop esi
pop ebx
leave
ret 4
push dword [esi + 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x4427a2
mov dword [esi + 4], ebx
jmp 0x44277f
push ebx
mov ecx, esi
call fcn.004426b4
push 0x4577c8
mov ecx, esi
call fcn.00442662
jmp 0x442787

Function at 0x44290b
Capabilities:
Check for time delay via gettickcount
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, 0xc000
jb 0x4429c0
cmp ebx, 0xffff
ja 0x4429c0
push 0x104
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
push 0xb
lea eax, [ebp - 0x108]
push 0x457798
push eax
call fcn.00441494
add esp, 0xc
test eax, eax
je 0x4429b9
lea eax, [ebp - 0x108]
push 0x45778c
push eax
call fcn.00441451
test eax, eax
pop ecx
pop ecx
je 0x4429b9
lea eax, [ebp - 0x108]
push 0x457780
push eax
call fcn.00441451
test eax, eax
pop ecx
pop ecx
je 0x4429b9
lea eax, [ebp - 0x108]
push 0x457778
push eax
call fcn.00441451
test eax, eax
pop ecx
pop ecx
je 0x4429b9
lea eax, [ebp - 0x108]
push 0x457768
push eax
call fcn.00441451
test eax, eax
pop ecx
pop ecx
jne 0x4429c7
xor eax, eax
jmp 0x442a43
mov byte [ebp - 0x108], 0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call edi
mov esi, dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp + 8], eax
jmp 0x442a36
cmp ebx, 0xf
je 0x442a3f
lea eax, [ebp - 0x108]
push 0x457780
push eax
call fcn.00441451
test eax, eax
pop ecx
pop ecx
je 0x442a3f
mov eax, dword [0x462064]
cmp eax, 0xffffffff
je 0x442a1a
test eax, eax
je 0x442a3f
call edi
mov ecx, dword [0x462064]
mov edx, dword [ebp + 8]
add ecx, edx
sub ecx, eax
cmp ecx, 5
jle 0x442a3f
push 1
push 0x8000012f
mov byte [0x462069], 0
call fcn.0040b58c
pop ecx
pop ecx
mov byte [0x462069], 1
push ebx
call esi
test eax, eax
je 0x4429dc
jmp 0x442a41
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x442a48
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx + 0x18], 0
je 0x442a56
xor eax, eax
inc eax
pop ebx
ret
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push edi
call esi
mov edi, dword [sym.imp.USER32.dll_OpenClipboard]
mov ebp, eax
jmp 0x442aa6
mov eax, dword [0x462064]
cmp eax, 0xffffffff
je 0x442a8a
test eax, eax
je 0x442aba
call esi
mov ecx, dword [0x462064]
add ecx, ebp
sub ecx, eax
cmp ecx, 5
jle 0x442aba
push 1
push 0x8000012f
mov byte [0x462069], 0
call fcn.0040b58c
pop ecx
pop ecx
mov byte [0x462069], 1
push dword [0x4642c8]
call edi
test eax, eax
je 0x442a6b
xor eax, eax
inc eax
mov dword [ebx + 0x18], eax
jmp 0x442abc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x442dfb
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
jmp 0x442e07
mov esi, dword [esi + 4]
cmp byte [esi + 0xf], 0
je 0x442e04
mov ebp, dword [esp + 0x18]
cmp byte [ebp + 0xf], 0
jne 0x442e1c
mov edi, dword [ebp + 4]
jmp 0x442e1e
mov edi, ebp
xor ebx, ebx
inc ebx
cmp byte [esi + 0xf], bl
jne 0x442e57
mov eax, dword [edi]
cmp eax, dword [esi]
je 0x442e53
push ebx
push 0
push dword [edi + 4]
mov ecx, esi
push 0
call fcn.00401592
test eax, eax
je 0x442e9b
mov eax, dword [edi + 4]
inc eax
push eax
push dword [edi]
push dword [esi]
call fcn.00454510
add esp, 0xc
or byte [esi + 0xd], bl
mov eax, ebx
jmp 0x442e9b
mov ecx, 0x465240
call fcn.00442a48
test eax, eax
jne 0x442e74
push 0x4575d8
push 0x4577ec
jmp 0x442f41
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [ebp]
mov eax, dword [ebp + 4]
lea eax, [eax + esi + 1]
lea edi, [esi + 4]
cmp edi, eax
mov dword [esp + 0x18], eax
jbe 0x442ea7
push 0
mov ecx, 0x465240
call fcn.004426b4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0x18]
mov esi, dword [esi]
test esi, esi
mov dword [esp + 0x10], esi
je 0x442e8f
mov ecx, edi
add edi, 4
cmp edi, eax
ja 0x442e8f
mov ebx, dword [ecx]
mov esi, edi
add edi, ebx
cmp edi, eax
ja 0x442e8f
push ebx
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x442f0c
test ebx, ebx
je 0x442ef6
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
test eax, eax
je 0x442f24
push ebx
push esi
push eax
call fcn.00454510
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov esi, edi
push ebp
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
lea edi, [esi + 4]
cmp edi, dword [esp + 0x18]
jbe 0x442ea3
jmp 0x442e8f
push 0
mov ecx, 0x465240
call fcn.004426b4
push 0x4575d8
push 0x458d18
jmp 0x442f41
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push 0
mov ecx, 0x465240
call fcn.004426b4
push 0x4575d8
push 0x457750
mov ecx, 0x464d48
call fcn.0044a3b9
jmp 0x442e9b
Function at 0x442f50
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
sub esp, 0x28
call fcn.00443dcc
cmp byte [esp + 0x2c], al
mov byte [esp + 2], al
je 0x44314b
test al, al
push esi
jne 0x442fa1
cmp byte [esp + 0x34], al
jne 0x442fa1
push 0x4641f0
xor esi, esi
push esi
push esi
push 0x443f5a
push 0x2000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, esi
mov dword [0x465478], eax
je 0x443038
push 0xf
push eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
movzx esi, byte [esp + 0x30]
push ebx
xor eax, eax
xor ebx, ebx
cmp byte [esp + 0x38], al
push ebp
sete al
push edi
mov edi, 0x417
mov ebp, eax
push ebp
push esi
push edi
push dword [0x4641f0]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
test eax, eax
jne 0x442fdc
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc ebx
cmp ebx, 0x32
jl 0x442fbb
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov byte [esp + 0x13], 0
call ebp
mov dword [esp + 0x18], eax
cmp byte [esp + 0x3c], 0
mov ebx, dword [sym.imp.KERNEL32.DLL_CloseHandle]
je 0x443042
push 1
push edi
push edi
xor esi, esi
push esi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x443073
cmp dword [esp + 0x24], esi
je 0x4430a2
mov byte [esp + 0x13], 1
call fcn.00443dcc
test al, al
jne 0x4430a2
cmp byte [esp + 0x40], al
jne 0x44311e
mov byte [esp + 0x3c], al
jmp 0x442fed
call fcn.00443d59
jmp 0x44314a
cmp byte [esp + 0x40], 0
je 0x443056
call fcn.00443dcc
xor esi, esi
test al, al
je 0x4430a2
jmp 0x443073
lea eax, [esp + 0x14]
push eax
push dword [0x465478]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
cmp dword [esp + 0x14], 0x103
jne 0x44308c
xor esi, esi
call ebp
sub eax, dword [esp + 0x18]
cmp eax, 0x1f4
ja 0x4430a2
push esi
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x442fed
push dword [0x465478]
call ebx
and dword [0x465478], 0
call fcn.00443d59
xor esi, esi
cmp byte [esp + 0x40], 0
jne 0x443117
cmp dword [0x4643f8], esi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateMutexA]
je 0x4430ce
test byte [esp + 0x12], 1
jne 0x4430e3
push 0x4586d0
push esi
push esi
call edi
mov dword [0x465454], eax
jmp 0x4430e3
test byte [esp + 0x12], 1
je 0x4430e3
push dword [0x465454]
call ebx
mov dword [0x465454], esi
cmp dword [0x4643fc], esi
je 0x443102
test byte [esp + 0x12], 2
jne 0x443117
push 0x4586dc
push esi
push esi
call edi
mov dword [0x465458], eax
jmp 0x443117
test byte [esp + 0x12], 2
je 0x443117
push dword [0x465458]
call ebx
mov dword [0x465458], esi
cmp byte [esp + 0x13], 0
je 0x443147
push esi
fldz
push ecx
push ecx
fstp qword [esp]
push esi
push 0x10000
push 0x458a88
mov byte [0x462069], 0
call fcn.0043b223
add esp, 0x18
mov byte [0x462069], 1
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x28
ret
Function at 0x4440ed
Capabilities:
Check for time delay via gettickcount

Disassembly:
test byte [esp + 4], 0x10
je 0x4440f7
xor al, al
ret
cmp byte [esp + 8], 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
je 0x44410c
cmp byte [esp + 0xc], 0x10
jne 0x444161
xor cl, cl
cmp byte [esp + 0x10], cl
jne 0x444161
cmp byte [0x465447], cl
je 0x44412f
call fcn.00443d42
test al, al
jne 0x44412f
mov byte [0x465447], cl
xor al, al
pop esi
ret
cmp byte [0x465441], cl
je 0x444161
xor eax, eax
mov ax, word [0x465444]
push eax
xor eax, eax
mov al, byte [0x465446]
push eax
call fcn.00444089
add esp, 8
test al, al
je 0x444161
call esi
sub eax, dword [0x46543c]
cmp eax, 0x16
jb 0x44412b
call esi
mov dword [0x46541c], eax
mov al, 1
pop esi
ret
Function at 0x44603d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x465440], 0
je 0x4460b8
mov al, byte [0x465446]
cmp al, 0xa0
je 0x446056
cmp al, 0x10
jne 0x4460b8
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x46543c]
cmp eax, 0x16
jae 0x4460b8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00444089
add esp, 8
cmp byte [0x465441], 0
jne 0x446090
call fcn.00443d42
test al, al
je 0x4460b8
mov byte [0x465447], 1
jmp 0x44609a
cmp byte [ebp + 0x14], 0
jne 0x446083
test al, al
je 0x4460b8
mov al, byte [0x465438]
mov byte [0x4642e6], al
mov al, byte [0x465437]
mov byte [0x4642f8], al
mov al, byte [0x465436]
mov byte [0x464388], al
mov al, byte [0x4642e6]
mov ecx, dword [0x465468]
mov byte [0x465438], al
mov al, byte [0x4642f8]
push ebx
push esi
movzx esi, byte [ebp + 0xc]
mov byte [0x465437], al
mov al, byte [0x464388]
mov byte [0x465436], al
lea eax, [esi + esi*8]
shl eax, 5
mov bl, byte [eax + ecx + 4]
test bl, bl
push edi
mov edi, dword [ebp + 8]
je 0x446202
push dword [ebp + 0x14]
cmp dword [edi + 0x10], 0xffc3d44f
push dword [ebp + 0xc]
setne byte [ebp + 0xb]
push dword [edi + 8]
call fcn.004440ed
add esp, 0xc
cmp byte [ebp + 0x14], 0
je 0x4461a8
cmp byte [ebp + 0x18], 0
jne 0x44613a
mov cl, bl
not cl
and byte [0x4642e4], cl
cmp byte [ebp + 0xb], 0
je 0x44613a
and byte [0x4642e5], cl
test al, al
je 0x446202
not bl
and byte [0x4642e6], bl
sub esi, 0xa0
mov byte [esi + 0x464388], 0
je 0x4461a1
dec esi
je 0x446195
dec esi
je 0x446189
dec esi
je 0x446182
dec esi
je 0x446173
dec esi
jne 0x446202
mov al, byte [0x46438c]
jmp 0x446178
mov al, byte [0x46438d]
mov byte [0x4642fa], al
jmp 0x446202
mov al, byte [0x46438a]
jmp 0x44618e
mov al, byte [0x46438b]
mov byte [0x4642f9], al
jmp 0x446202
mov al, byte [0x464388]
mov byte [0x4642f8], al
jmp 0x446202
mov al, byte [0x464389]
jmp 0x44619a
cmp byte [ebp + 0x18], 0
jne 0x4461c0
or byte [0x4642e4], bl
cmp byte [ebp + 0xb], 0
je 0x4461c0
or byte [0x4642e5], bl
test al, al
je 0x446202
or byte [0x4642e6], bl
cmp byte [ebp + 0xc], 0xa0
mov byte [esi + 0x4642e8], 0x80
jb 0x446202
cmp byte [ebp + 0xc], 0xa1
jbe 0x4461fb
cmp byte [ebp + 0xc], 0xa3
jbe 0x4461f2
cmp byte [ebp + 0xc], 0xa5
ja 0x446202
mov byte [0x4642fa], 0x80
jmp 0x446202
mov byte [0x4642f9], 0x80
jmp 0x446202
mov byte [0x4642f8], 0x80
mov cx, word [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov word [0x465444], cx
mov ecx, dword [ebp + 0x14]
push ecx
push eax
push dword [edi + 8]
mov byte [0x465446], al
mov byte [0x465441], cl
call fcn.004440ed
add esp, 0xc
mov byte [0x465440], al
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
pop edi
pop esi
mov dword [0x46543c], eax
pop ebx
pop ebp
ret
Function at 0x446518
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x10c
push edi
mov edi, dword [esp + 0x114]
push edi
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
test eax, eax
jne 0x44654c
cmp byte [0x4651f4], al
je 0x4465e9
push 1
push eax
push 0xffffffffffffffff
push 0x458f14
jmp 0x4465de
cmp byte [0x4651f4], 0
push ebx
push ebp
push esi
mov ebp, 0x464be8
jne 0x446561
lea ebp, [esp + 0x18]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
push ebp
mov esi, 0x104
push esi
call ebx
test eax, eax
je 0x4465bc
cmp byte [edi], 0
je 0x4465c7
cmp byte [edi + 1], 0x3a
jne 0x4465c7
cmp byte [edi + 2], 0
jne 0x4465c7
push ebp
push edi
call fcn.00441451
test eax, eax
pop ecx
pop ecx
je 0x4465c7
push edi
lea eax, [esp + 0x14]
push 0x45bdbc
push eax
call fcn.00409d03
add esp, 0xc
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
test eax, eax
je 0x4465c7
push ebp
push esi
call ebx
test eax, eax
jne 0x4465c7
push esi
push edi
push ebp
call fcn.004388bd
add esp, 0xc
cmp byte [0x4651f4], 0
pop esi
pop ebp
pop ebx
je 0x4465e9
push 1
push 0
push 0xffffffffffffffff
push 0x45771c
mov ecx, dword [0x464be0]
call fcn.00401592
pop edi
add esp, 0x10c
ret