joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423748
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x489628]
cmp byte [eax + 0x7f], 0
jne 0x42379b
cmp dword [0x489654], 0
jne 0x423777
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, 0x423704
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x489654], eax
cmp dword [0x489658], 0
jne 0x42379b
push esp
push 0
push 0
push 0x4236b4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x489658], eax
pop edx
ret

Function at 0x4237a0
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x489654], 0
je 0x4237b4
mov eax, dword [0x489654]
push eax
call sub.user32.dll_UnhookWindowsHookEx
xor eax, eax
mov dword [0x489654], eax
cmp dword [0x489658], 0
je 0x4237d1
push 0
mov eax, dword [0x489658]
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
mov dword [0x489658], eax
ret

Function at 0x423870
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x423887
add esp, 0xfffffff0
call fcn.00402e78
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00410404
mov dl, 1
mov eax, 0x40a6a8
call fcn.00402c78
mov dword [ebx + 0x70], eax
mov dl, 1
mov eax, 0x40a6a8
call fcn.00402c78
mov dword [ebx + 0x80], eax
xor eax, eax
mov dword [ebx + 0x40], eax
xor eax, eax
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x3c], 0x80000018
mov dword [ebx + 0x54], 0x1f4
mov dword [ebx + 0x58], 0x32
mov dword [ebx + 0x5c], 0x9c4
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x7d], 1
mov dl, 1
mov eax, 0x419be0
call fcn.0041dbf8
mov esi, eax
mov dword [ebx + 0x78], esi
push 0x4239c8
mov eax, dword [0x489014]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041df84
mov eax, dword [ebx + 0x78]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x424c88
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x489014]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.004076a0
test eax, eax
je 0x423964
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00407508
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.00407680
test eax, eax
je 0x423978
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x6c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004036a4
cmp byte [0x489034], 0
jne 0x4239a8
mov eax, ebx
call fcn.00423a58
mov byte [ebx + 0x39], 1
mov byte [ebx + 0x3a], 1
cmp byte [ebp - 1], 0
je 0x4239c0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424460
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x7e], 0
je 0x424492
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x20]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403628
jmp 0x42449c
mov eax, esi
mov edx, dword [ebx + 0x6c]
call fcn.004035dc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x424e60
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x60]
test esi, esi
je 0x424e98
mov eax, esi
call fcn.0041855c
test al, al
je 0x424e98
mov eax, dword [ebx + 0x60]
call fcn.004183c4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x424e98
push 0
mov eax, dword [ebx + 0x60]
call fcn.004183c4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x42cd58
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x42cda0
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0042cc34
mov eax, dword [ebp - 4]
call fcn.00403880
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42cda7
lea eax, [ebp - 4]
call fcn.00403548
ret

Function at 0x42cde8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403880
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x42ce06
test al, 0x10
je 0x42ce06
test ah, 4
je 0x42ce0a
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x42ce10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, ebx
mov edx, 0x3ff
call fcn.004039ec
test esi, esi
je 0x42ce76
mov eax, esi
call fcn.00403880
push eax
push 0x400
mov eax, ebx
call fcn.0040388c
push eax
mov eax, dword [ebp - 8]
call fcn.00403880
push eax
mov eax, dword [ebp - 4]
call fcn.00403880
push eax
mov eax, edi
call fcn.00403880
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov edx, eax
mov eax, ebx
call fcn.004039ec
jmp 0x42ceab
push 0x400
mov eax, ebx
call fcn.0040388c
push eax
mov eax, dword [ebp - 8]
call fcn.00403880
push eax
mov eax, dword [ebp - 4]
call fcn.00403880
push eax
mov eax, edi
call fcn.00403880
push eax
call sub.kernel32.dll_GetProfileStringA
mov edx, eax
mov eax, ebx
call fcn.004039ec
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x42cf78
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov byte [ebp - 8], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 0
je 0x42cfc0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00403880
push eax
push 8
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00403880
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00403880
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
jmp 0x42cfe4
push 8
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.00403880
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00403880
push eax
call sub.kernel32.dll_GetProfileStringA
push ebx
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
sete al
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x42d044
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov ebx, edx
mov esi, eax
mov byte [esp], 0
test ebx, ebx
je 0x42d080
mov eax, ebx
call fcn.00403880
push eax
push pe_nt_image_headers32
lea eax, [esp + 8]
push eax
push 0x42d0b0
push 0
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
jmp 0x42d09e
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push 0x42d0b0
push 0
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_GetProfileStringA
cmp byte [esp], 0
sete al
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x42d850
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.004076c4
add esp, 0x104
pop ebx
ret

Function at 0x42d87c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.004076c4
add esp, 0x104
pop ebx
ret
Function at 0x42da9c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x42dbbd
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x42dba7
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x42daf5
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x42dba7
cmp dword [ebp - 0xc], 0
jne 0x42db0a
mov eax, dword [ebp - 4]
call fcn.00403548
mov bl, 1
jmp 0x42dba7
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.00403628
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.0040388c
push eax
lea eax, [ebp - 8]
push eax
push 0
push edi
push esi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x42dac1
test eax, eax
jne 0x42dba7
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
je 0x42db51
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x42dba7
jmp 0x42db51
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
je 0x42db64
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp byte [eax + edx - 1], 0
je 0x42db4e
cmp dword [ebp - 8], 7
jne 0x42db73
cmp dword [ebp - 0xc], 0
je 0x42db73
inc dword [ebp - 0xc]
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004039ec
cmp dword [ebp - 8], 7
jne 0x42db9a
cmp dword [ebp - 0xc], 0
je 0x42db9a
lea eax, [ebp - 0x10]
call fcn.0040388c
mov edx, dword [ebp - 0xc]
mov byte [eax + edx - 1], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00403598
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42dbc4
lea eax, [ebp - 0x10]
call fcn.00403548
ret

Function at 0x42dbe8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
mov edi, eax
push 0
push 0
push 0
push 0
push esi
push edi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
sete bl
test bl, bl
je 0x42dc5d
test esi, esi
je 0x42dc13
cmp byte [esi], 0
jne 0x42dc5d
cmp dword [0x4880e0], 2
je 0x42dc5d
xor ebx, ebx
xor esi, esi
mov dword [esp + 4], 2
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push esi
push edi
call sub.advapi32.dll_RegEnumValueA
test eax, eax
je 0x42dc4c
cmp eax, 0xea
jne 0x42dc5d
test eax, eax
jne 0x42dc5a
cmp byte [esp], 0
jne 0x42dc5a
mov bl, 1
jmp 0x42dc5d
inc esi
jmp 0x42dc20
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x42dc68
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42dd8b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4880e0], 2
jne 0x42dd66
lea eax, [ebp - 0xc]
push eax
push 8
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x42dd66
xor edx, edx
push ebp
push 0x42dd5f
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
mov ecx, pe_nt_image_headers32
xor edx, edx
call fcn.00403628
xor ebx, ebx
mov eax, dword [ebp - 0x10]
call fcn.004036bc
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
call fcn.0040388c
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0xea
jne 0x42dd2b
mov eax, dword [ebp - 0x10]
call fcn.004036bc
cmp eax, 0x10000
jge 0x42dd48
mov eax, dword [ebp - 0x10]
call fcn.004036bc
mov ecx, eax
add ecx, ecx
lea eax, [ebp - 0x10]
xor edx, edx
call fcn.00403628
jmp 0x42dcd3
test eax, eax
jne 0x42dd48
mov eax, dword [ebp - 0x10]
call fcn.00403880
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0042dc68
test eax, eax
je 0x42dcd3
inc ebx
jmp 0x42dcd3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42dd66
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42dd92
lea eax, [ebp - 0x10]
call fcn.00403548
ret

Function at 0x42dd9c
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov edi, edx
mov esi, eax
push esp
push 1
push 0
push edi
push esi
call sub.advapi32.dll_RegOpenKeyExA
mov ebx, eax
test ebx, ebx
jne 0x42de0b
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [esp + 0x2c]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov ebx, eax
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
test ebx, ebx
jne 0x42de0b
cmp dword [esp + 4], 0
jne 0x42de06
cmp dword [esp + 8], 0
jne 0x42de06
push edi
push esi
call sub.advapi32.dll_RegDeleteKeyA
mov ebx, eax
jmp 0x42de0b
mov ebx, 0x91
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x42ded4
Capabilities:
Check os version
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
mov ebx, eax
cmp dword [0x4880e0], 2
je 0x42def0
mov byte [ebp - 1], 1
jmp 0x42e0bf
mov byte [ebp - 1], 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push 0x20
push 2
push 0x48879c
call sub.advapi32.dll_AllocateAndInitializeSid
test eax, eax
je 0x42e0bf
xor eax, eax
push ebp
push 0x42e0b8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.kernel32.dll_GetVersion
and ax, 0xff
cmp ax, 5
jb 0x42df51
push 0x42e0c8
push 0x42e0e0
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x42df7a
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call ebx
test eax, eax
je 0x42e0a1
mov eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 1], al
jmp 0x42e0a1
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 1
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
test eax, eax
jne 0x42dfcb
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
je 0x42dfac
call fcn.00403304
jmp 0x42e0bf
lea eax, [ebp - 0x10]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x42dfcb
call fcn.00403304
jmp 0x42e0bf
xor eax, eax
push ebp
push 0x42e09a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x42e00e
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x7a
je 0x42e00e
call fcn.00403304
call fcn.00403304
jmp 0x42e0bf
mov eax, dword [ebp - 0x14]
call fcn.00402650
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 2
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_GetTokenInformation
test eax, eax
jne 0x42e040
call fcn.00403304
call fcn.00403304
jmp 0x42e0bf
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
dec esi
test esi, esi
jl 0x42e07b
inc esi
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x42e077
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + ebx*8 + 8]
and eax, 0x14
cmp eax, 4
jne 0x42e077
mov byte [ebp - 1], 1
jmp 0x42e07b
inc ebx
dec esi
jne 0x42e04d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e0a1
mov eax, dword [ebp - 0x18]
call fcn.00402668
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e0bf
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_FreeSid
ret
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4300fc
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
ret

Function at 0x4359a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov bl, 1
mov eax, dword [ebp + 8]
mov esi, dword [eax - 0x18]
dec esi
test esi, esi
jl 0x435b4c
inc esi
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.004347f4
pop ecx
test al, al
jne 0x4359e5
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00435c80
xor ebx, ebx
jmp 0x435b4c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x20]
cmp eax, dword [ebp - 0x10]
ja 0x435a04
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.00435c80
xor ebx, ebx
jmp 0x435b4c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov edx, dword [eax + edx*4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.00446eec
test eax, eax
jne 0x435a3c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 2
call fcn.00435c80
xor ebx, ebx
jmp 0x435b4c
test byte [ebp - 0xc], 1
je 0x435b45
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 4]
mov edx, 4
call fcn.004347f4
pop ecx
test al, al
jne 0x435a70
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00435c80
xor ebx, ebx
jmp 0x435b4c
mov edx, 0x43277c
mov eax, 0xc
call fcn.00403cc8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x435b18
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, dword [ebp - 8]
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004039ec
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.0040388c
mov edx, dword [ebp - 4]
call fcn.004347f4
pop ecx
test al, al
jne 0x435adb
mov edx, 0x43277c
mov eax, dword [ebp - 8]
call fcn.00403cdc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov dl, 0xd
call fcn.00435c80
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x435b4c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00430de8
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [ebp - 8]
call fcn.00431080
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x435b45
dec esi
jne 0x4359bb
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b064
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
xor ebx, ebx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x44b0b0
cmp dword [ebp - 0x84], 2
jne 0x44b0b0
cmp dword [ebp - 0x90], 5
jg 0x44b0ae
cmp dword [ebp - 0x90], 5
jne 0x44b0b0
cmp dword [ebp - 0x8c], 1
jl 0x44b0b0
mov bl, 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44f1c8
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov byte [0x489740], 0
cmp dword [0x4880e0], 2
jne 0x44f1fb
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x44f1fb
cmp dword [esp + 4], 5
setge byte [0x489740]
add esp, 0x94
ret

Function at 0x4503f4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x48976c
mov eax, esi
mov edx, 8
test al, 1
je 0x450410
shr eax, 1
xor eax, 0xedb88320
jmp 0x450412
shr eax, 1
dec edx
jne 0x450403
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4503fc
pop esi
ret

Function at 0x450428
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x489768], 0
jne 0x45044b
call fcn.004503f4
push 1
push 0x489768
call sub.kernel32.dll_InterlockedExchange
mov eax, edi
test esi, esi
je 0x450476
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x48976c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x450451
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x450a14
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov esi, eax
cmp edi, 0x50
jle 0x450a35
mov eax, esi
mov edx, 0x488878
mov ecx, 0x40
call fcn.004029f4
je 0x450a3a
call fcn.004509ac
mov eax, esi
add eax, 0x40
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 8]
not edx
cmp eax, edx
jne 0x450a59
cmp edi, eax
jne 0x450a59
cmp dword [ebx], 0xcc
je 0x450a5e
call fcn.004509ac
mov eax, ebx
add eax, 0x10
mov ebp, eax
add esi, dword [ebx + 4]
mov dword [esp], esi
mov edx, dword [esp]
sub edx, ebp
mov eax, ebp
call fcn.0045047c
cmp eax, dword [ebx + 0xc]
jne 0x450a85
mov eax, dword [esp]
cmp byte [eax - 1], 0
je 0x450a8a
call fcn.004509ac
mov bl, 0xcc
mov esi, 0x489b6c
cmp ebp, dword [esp]
jb 0x450a9b
call fcn.004509ac
mov eax, ebp
call fcn.004074a0
mov edi, eax
mov eax, esi
mov ecx, edi
mov edx, ebp
call fcn.00403628
inc edi
add ebp, edi
add esi, 4
dec bl
jne 0x450a91
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4519c0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x451ad2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, ebx
call fcn.0042c5e0
lea eax, [ebp - 0x14c]
mov edx, 0x451aec
call fcn.004036c4
mov eax, dword [ebp - 0x14c]
call fcn.00403880
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x451ab5
xor eax, eax
push ebp
push 0x451aae
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
test byte [ebp - 0x148], 0x10
jne 0x451a47
mov byte [ebp - 1], 0
jmp 0x451a97
mov edx, 0x451af0
lea eax, [ebp - 0x11c]
call fcn.004075ec
test eax, eax
je 0x451a75
mov edx, 0x451af4
lea eax, [ebp - 0x11c]
call fcn.004075ec
test eax, eax
je 0x451a75
mov byte [ebp - 1], 0
jmp 0x451a97
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x451a38
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x12
je 0x451a97
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451ab9
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451ad9
lea eax, [ebp - 0x14c]
call fcn.00403548
ret