joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445e74
Capabilities:
Enumerate gui resources
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00445e74
xor esi, esi
xor edi, edi
mov ecx, 0x98
push esi
dec ecx
jne 0x445e90
fild dword [0x186b3c8]
mov eax, dword [0x45d838]
call fcn.0045a848
fcompp
fnstsw ax
sahf
jae 0x445eb5
jmp 0x44609b
push 0
mov eax, 2
mov ecx, 1
add eax, ecx
mov ecx, 4
add eax, ecx
mov ecx, 8
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
jne 0x445ee7
jmp 0x44609b
mov eax, 0x128
mov dword [ebp - 0x1c0], eax
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32First]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
nop
nop
nop
nop
nop
cmp dword [ebp - 0x1cc], 0
jne 0x445f1e
jmp 0x446067
push dword [ebp - 0x1b8]
call fcn.0041ed15
call fcn.0045b69e
lea ebx, [ebp - 0x2dc]
mov ecx, 0x104
call fcn.0045b4a3
lea ebx, [ebp - 0x2dc]
call fcn.0045b45a
mov edx, 0x185e9a0
call fcn.0045b687
call fcn.0045abcf
jne 0x445f75
lea ebx, [ebp - 0x19c]
call fcn.0045b45a
lea ebx, [ebp - 0x2dc]
mov ecx, 0x104
call fcn.0045b4a3
mov eax, dword [0x45d838]
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x1d0], 1
jmp 0x446037
mov eax, dword [ebp - 0x1d0]
sub eax, dword [0x185e5b4]
imul eax, eax, 0xcc
add eax, dword [0x185e59c]
mov ebx, eax
push ebx
lea ebx, [ebp - 0x2dc]
push ebx
call dword [sym.imp.SHLWAPI.DLL_PathMatchSpecA]
fldcw word [ebp - 0x10]
test eax, eax
je 0x446031
inc dword [ebp - 0x1d4]
cmp dword [ebp - 0x1d4], 0x12c
jle 0x445fda
jmp 0x446067
mov eax, dword [ebp - 0x1d4]
sub eax, dword [0x185e628]
imul eax, eax, 0x108
add eax, dword [0x185e610]
mov ebx, dword [ebp - 0x1b8]
mov dword [eax], ebx
lea ebx, [ebp - 0x2dc]
call fcn.0045b45a
mov eax, dword [ebp - 0x1d4]
sub eax, dword [0x185e628]
imul eax, eax, 0x108
add eax, dword [0x185e610]
mov ebx, eax
lea ebx, [ebx + 4]
mov ecx, 0x104
call fcn.0045b4a3
jmp 0x446031
inc dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x1d0]
cmp eax, dword [ebp - 0x2e4]
jle 0x445f90
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32Next]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
jmp 0x445f10
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x1d4]
test eax, eax
je 0x44609b
push dword [ebp - 0x1d4]
mov eax, 0x4460b6
push eax
call dword [sym.imp.USER32.DLL_EnumWindows]
fldcw word [ebp - 0x10]
jmp 0x44609b
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x447fc3
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00447fc3
xor esi, esi
mov ecx, 0x6e
push esi
dec ecx
jne 0x447fdd
push 0
lea ebx, [ebp - 0x22c]
push ebx
mov ecx, 2
mov eax, 1
movzx eax, al
shl eax, 8
mov al, cl
push eax
call dword [sym.imp.WS2_32.DLL_WSAStartup]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x44809a
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.WS2_32.DLL_gethostbyname]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x448091
mov ebx, dword [ebp - 0x230]
mov ebx, dword [ebx + 0xc]
mov eax, esi
shl eax, 2
add ebx, eax
mov eax, dword [ebx]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x448091
mov ebx, dword [ebp - 0x234]
push dword [ebx]
call dword [sym.imp.WS2_32.DLL_inet_ntoa]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x238], eax
mov ebx, dword [ebp - 0x238]
call fcn.0045b45a
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
call fcn.0045b4a3
mov dword [ebp - 0x98], 1
inc esi
call dword [sym.imp.WS2_32.DLL_WSACleanup]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x448900
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00448900
xor esi, esi
mov ecx, 0x6e
push esi
dec ecx
jne 0x44891a
push 0
lea ebx, [ebp - 0x22c]
push ebx
mov ecx, 2
mov eax, 1
movzx eax, al
shl eax, 8
mov al, cl
push eax
call dword [sym.imp.WS2_32.DLL_WSAStartup]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x4489ef
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.WS2_32.DLL_gethostbyname]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x4489e6
mov ebx, dword [ebp - 0x230]
mov ebx, dword [ebx + 0xc]
mov eax, esi
shl eax, 2
add ebx, eax
mov eax, dword [ebx]
mov dword [ebp - 0x234], eax
fild dword [0x186b388]
mov eax, dword [ebp - 0x234]
call fcn.0045a848
fcompp
fnstsw ax
sahf
jne 0x4489a5
jmp 0x4489e6
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x4489e4
mov ebx, dword [ebp - 0x234]
push dword [ebx]
call dword [sym.imp.WS2_32.DLL_inet_ntoa]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x238], eax
mov ebx, 0x45dd78
push ebx
mov ebx, dword [ebp - 0x238]
push ebx
call fcn.004480bb
mov dword [ebp - 0x98], eax
inc esi
jmp 0x448970
call dword [sym.imp.WS2_32.DLL_WSACleanup]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x449190
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00449190
xor esi, esi
mov ecx, 0x9a
push esi
dec ecx
jne 0x4491aa
lea ebx, [ebp + 8]
call fcn.0045b45a
mov edx, 0x1860ca8
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [ebp - 0x2ec]
mov ecx, 0x104
call fcn.0045b4a3
lea ebx, [ebp - 0x1e8]
push ebx
lea ebx, [ebp - 0x2ec]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
fldcw word [ebp - 0x10]
mov esi, eax
fild qword [0x186aa78]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
je 0x4493f7
nop
nop
nop
nop
fild dword [0x186aa28]
fild dword [0x186aa28]
mov eax, dword [ebp - 0x1e8]
call fcn.0045a848
call fcn.0045a6d3
fcompp
fnstsw ax
sahf
je 0x44923c
jmp 0x4493d0
lea ebx, [ebp - 0x1bc]
call fcn.0045b45a
mov edx, 0x185ea14
call fcn.0045b687
call fcn.0045abcf
je 0x4493d0
lea ebx, [ebp - 0x1bc]
call fcn.0045b45a
mov edx, 0x1860cb8
call fcn.0045b687
call fcn.0045abcf
je 0x4493d0
push 0
lea ebx, [ebp + 8]
call fcn.0045b45a
lea ebx, [ebp - 0x1bc]
call fcn.0045b45a
call fcn.0045ab3a
mov edx, 0x18687c0
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [esp]
call fcn.0045a938
call fcn.00419351
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
test eax, eax
je 0x449326
mov edx, 0x18687ec
call fcn.0045b687
lea ebx, [ebp + 8]
call fcn.0045b45a
call fcn.0045ab3a
lea ebx, [ebp - 0x1bc]
call fcn.0045b45a
call fcn.0045ab3a
push 0
mov ebx, esp
call fcn.0045a876
mov eax, 4
call fcn.004588d6
mov edx, 0x18687d8
call fcn.0045b687
call fcn.0045ab3a
push 0
mov ebx, esp
call fcn.0045a876
call fcn.00448e2d
jmp 0x4493d0
lea ebx, [ebp - 0x1bc]
call fcn.0045b45a
mov eax, 1
mov edx, 0x1868810
call fcn.0045b687
call fcn.0045020d
test eax, eax
je 0x4493a9
mov edx, 0x186881c
call fcn.0045b687
lea ebx, [ebp + 8]
call fcn.0045b45a
call fcn.0045ab3a
lea ebx, [ebp - 0x1bc]
call fcn.0045b45a
call fcn.0045ab3a
push 0
mov ebx, esp
call fcn.0045a876
mov eax, 4
call fcn.004588d6
mov edx, 0x18687d8
call fcn.0045b687
call fcn.0045ab3a
push 0
mov ebx, esp
call fcn.0045a876
call fcn.00448e2d
jmp 0x4493d0
lea ebx, [ebp + 8]
call fcn.0045b45a
lea ebx, [ebp - 0x1bc]
call fcn.0045b45a
call fcn.0045ab3a
mov eax, 0x80000104
call fcn.00452ee2
call fcn.0044940e
lea ebx, [ebp - 0x1e8]
push ebx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
fldcw word [ebp - 0x10]
test eax, eax
jne 0x449210
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104
Function at 0x4499d7
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004499d7
xor esi, esi
mov ecx, 0x9a
push esi
dec ecx
jne 0x4499f1
lea ebx, [ebp + 8]
call fcn.0045b45a
mov edx, 0x1860ca8
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [ebp - 0x2ec]
mov ecx, 0x104
call fcn.0045b4a3
lea ebx, [ebp - 0x1e8]
push ebx
lea ebx, [ebp - 0x2ec]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
fldcw word [ebp - 0x10]
mov esi, eax
fild qword [0x186aa78]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
je 0x449c56
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
fild dword [0x186aa28]
fild dword [0x186aa28]
mov eax, dword [ebp - 0x1e8]
call fcn.0045a848
call fcn.0045a6d3
fcompp
fnstsw ax
sahf
je 0x449a8c
jmp 0x449c2f
lea ebx, [ebp - 0x1bc]
call fcn.0045b45a
mov edx, 0x185ea14
call fcn.0045b687
call fcn.0045abcf
je 0x449c2f
lea ebx, [ebp - 0x1bc]
call fcn.0045b45a
mov edx, 0x1860cb8
call fcn.0045b687
call fcn.0045abcf
je 0x449c2f
push 0
lea ebx, [ebp + 8]
call fcn.0045b45a
lea ebx, [ebp - 0x1bc]
call fcn.0045b45a
call fcn.0045ab3a
mov edx, 0x18687c0
call fcn.0045b687
call fcn.0045ab3a
lea ebx, [esp]
call fcn.0045a938
call fcn.00419351
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00456355
pop eax
add esp, 4
test eax, eax
je 0x449b76
mov edx, 0x18687ec
call fcn.0045b687
lea ebx, [ebp + 8]
call fcn.0045b45a
call fcn.0045ab3a
lea ebx, [ebp - 0x1bc]
call fcn.0045b45a
call fcn.0045ab3a
push 0
mov ebx, esp
call fcn.0045a876
mov eax, 4
call fcn.004588d6
mov edx, 0x18687d8
call fcn.0045b687
call fcn.0045ab3a
push 0
mov ebx, esp
call fcn.0045a876
call fcn.00448e2d
jmp 0x449c2f
lea ebx, [ebp - 0x1bc]
call fcn.0045b45a
mov eax, 1
mov edx, 0x1868810
call fcn.0045b687
call fcn.0045020d
test eax, eax
je 0x449bf9
mov edx, 0x186881c
call fcn.0045b687
lea ebx, [ebp + 8]
call fcn.0045b45a
call fcn.0045ab3a
lea ebx, [ebp - 0x1bc]
call fcn.0045b45a
call fcn.0045ab3a
push 0
mov ebx, esp
call fcn.0045a876
mov eax, 4
call fcn.004588d6
mov edx, 0x18687d8
call fcn.0045b687
call fcn.0045ab3a
push 0
mov ebx, esp
call fcn.0045a876
call fcn.00448e2d
jmp 0x449c2f
lea ebx, [ebp + 8]
call fcn.0045b45a
lea ebx, [ebp - 0x1bc]
call fcn.0045b45a
call fcn.0045ab3a
mov edx, 0x18688b8
call fcn.0045b687
call fcn.0045ab3a
mov eax, 0x80000104
call fcn.00452ee2
call fcn.00449c6d
lea ebx, [ebp - 0x1e8]
push ebx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
fldcw word [ebp - 0x10]
test eax, eax
jne 0x449a60
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104
Function at 0x44e7f2
Capabilities:
Accept command line arguments
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..data
test word [0x44e7d4], 4
jne 0x44e80d
jmp 0x44ec3c
jmp fcn.0044ea3f
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.0044e93b
mov dword [ebx + 0x3f0], 1
lea eax, [ebx + 0x5c4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, 0xa
test dword [esp + 0x2c], 1
je 0x44ec8d
movzx eax, word [esp + 0x30]
add esp, 0x44
mov dword [ebx + 0x3e4], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.0044e9e1
mov dword [ebx + 0x3e0], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebx + 0x3ec], eax
call fcn.0044e812
push 0xff
jb 0x44ed0c
pop eax
movzx ecx, word [0x44e7d2]
jecxz 0x44ecd7
push ecx
push 8
push esp
call dword [sym.imp.COMCTL32.DLL_InitCommonControlsEx]
pop eax
pop eax
call fcn.0044e887
push eax
mov ebx, section..data
mov ecx, dword [ebx + 0xd8]
call fcn.0044ed18
mov ecx, dword [ebx + 0xb4]
jecxz 0x44ecfc
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov edi, dword [ebx + 0x428]
call fcn.0044e88c
call fcn.0044e873
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x44e812
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x44e872
mov dword [ebx + 0x3d0], eax
mov dword [ebx + 0x3d8], 0
mov dword [ebx + 0x3d4], 0
call fcn.0044eb1e
jb 0x44e872
mov dword [ebx + 0x3d4], eax
mov word [eax + 0xac], 8
call fcn.0044e861
dec ebp
push ebx
and byte [ebx + 0x61], dl
outsb dx, byte [esi]
jae 0x44e87b
push ebx
jb 0x44e8c8
add byte [esi - 4], bl
mov bl, 0xd0
add eax, dword [eax]
add bh, bh
adc eax, sym.imp.KERNEL32.DLL_TlsFree
ret

Function at 0x44ed54
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
sub esp, 0x20
call fcn.0044ee3b
mov edi, esp
mov cl, 4
call fcn.0044ed75
call fcn.0044ed75
mov edx, 8
jmp 0x44edce
or esi, esi
jne 0x44edd6
mov byte [edi], 0x30
inc esi
mov ecx, dword [esp + 0x2c]
jecxz 0x44ede4
cmp ecx, edx
jbe 0x44ede6
mov ecx, edx
jmp 0x44ede6
mov ecx, esi
cmp ecx, esi
ja 0x44edf0
add esi, esp
sub esi, ecx
jmp 0x44ee0e
mov edx, esi
lea edi, [esp + ecx - 1]
lea esi, [esp + esi - 1]
push ecx
mov ebx, ecx
sub ebx, edx
mov ecx, edx
std
rep movsb byte es:[edi], byte [esi]
mov al, 0x30
mov ecx, ebx
rep stosb byte es:[edi], al
cld
pop ecx
mov esi, esp
call fcn.0045b74b
jb 0x44ee1d
add esp, 0x20
pop edi
pop esi
pop ebx
pop eax
ret
add esp, 0x20
pop edi
pop esi
pop ebx
pop edx
jmp fcn.0044ea56
Function at 0x44ee43
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
sub esp, 0x170
mov dword [esp], eax
mov dword [esp + 4], ecx
and eax, 0x7fff
mov esi, eax
cld
xor eax, eax
mov ecx, 4
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x5c]
call fcn.0045aaf5
mov dword [esp + 0x18], 0x44
mov dword [esp + 0x44], 1
mov word [esp + 0x48], si
lea eax, [esp + 8]
lea ebx, [esp + 0x18]
mov edi, dword [esp + 4]
push edi
push 0
push 0xc
mov ecx, esp
push eax
push ebx
push 0
push 0
push 0x20
push edi
push ecx
push ecx
push edx
push 0
mov edx, dword [sym.imp.KERNEL32.DLL_CreateProcessA]
call fcn.0045bc61
pop ecx
pop ecx
pop ecx
jae 0x44eec6
test eax, eax
je 0x44ef0d
mov ebx, dword [esp + 0x10]
test dword [esp], 0x8000
je 0x44eeed
push 0xffffffffffffffff
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [esp + 8]
push eax
push esp
push eax
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
pop ebx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebx
add esp, 0x170
pop edi
pop esi
pop ebx
ret
add esp, 0x170
pop edi
pop esi
pop ebx
xor eax, eax
jmp fcn.0044ea4b

Function at 0x44ef1d
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
lea esi, [esp + 0x18]
mov ecx, dword [esi - 4]
push ecx
call fcn.004558fd
jb 0x44ef53
jecxz 0x44ef40
lea esi, [esi + ecx*4 - 4]
mov eax, dword [esi]
mov byte [edi], al
sub esi, 4
inc edi
loop 0x44ef36
call fcn.0045b704
pop edx
pop edi
pop esi
pop ecx
pop eax
shl edx, 2
pop dword [esp + edx]
add esp, edx
ret
call fcn.0045b702
pop edx
pop edi
pop esi
pop ecx
add esp, 4
shl edx, 2
pop dword [esp + edx]
add esp, edx
jmp fcn.0044ea56
Function at 0x44f111
Capabilities:
Terminate process

Disassembly:
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], edi
pop dword [ebp - 0x6c]
pop edx
pop ax
test byte [ebx + 4], 4
je 0x44f133
pop cx
movzx ecx, ch
add esp, 4
add esp, 8
loop 0x44f12b
jmp dword [ebp - 0x6c]
mov byte [ebx + 5], 2
mov byte [ebx + 4], al
mov dword [ebx], edx
pop word [ebx + 6]
pop dword [ebx + 0x14]
movzx ecx, byte [ebx + 7]
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
pop dword [ebx + esi + 0x10]
pop dword [ebx + esi + 0xc]
sub esi, 0xc
jne 0x44f150
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x44f1c5
inc eax
dec ecx
je 0x44f188
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x44f1c5
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x44f16b
je 0x44f188
jb 0x44f1c5
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x44f1c5
test byte [ebx + 4], 1
je 0x44f19b
mov dword [ebx + 0xc], eax
jmp 0x44f1b8
push eax
call fcn.0044ea07
pop ecx
jb 0x44f1c7
mov dword [ebx], eax
mov dword [ebx + 0xc], ecx
mov edi, eax
cld
xor eax, eax
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
or byte [ebx + 4], 4
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp dword [ebp - 0x6c]
mov al, 9
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
push dword [ebp - 0x6c]
jmp fcn.0044ea56
Function at 0x44f23b
Capabilities:
Terminate process

Disassembly:
test byte [ebx + 4], 4
jne 0x44f246
jmp fcn.0044f111
mov dword ds:[ebp - 0x68], esi
mov dword ds:[ebp - 0x64], edi
pop dword ds:[ebp - 0x6c]
pop eax
pop ax
xor ah, ah
pop cx
cmp cl, byte [ebx + 6]
call fcn.0044f362
pop edx
cmp edx, dword [ebx + 0x14]
call fcn.0044f362
movzx ecx, ch
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
lea edi, [ebx + esi + 0x10]
pop dword ds:[ebp - 0x60]
push dword [edi]
pop edx
cmp edx, dword [ebx + esi + 0x10]
call fcn.0044f362
pop edx
cmp edx, dword [ebx + esi + 0xc]
call fcn.0044f362
sub esi, 0xc
jne 0x44f280
or ah, ah
jne 0x44f34f
cmp cl, byte [ebx + 7]
jne 0x44f34f
mov edx, dword ds:[ebp - 0x60]
cmp edx, dword [edi - 4]
jl 0x44f34f
mov byte [ebx + 4], al
mov ecx, dword [edi]
sub ecx, edx
jle 0x44f2e5
cmp byte [ebx + 7], 1
je 0x44f2ca
imul ecx, dword [edi - 8]
push edi
mov al, byte [ebx + 6]
mov esi, ecx
mov edi, dword [ebx]
push dword [ebx + 8]
sub dword [esp], ecx
pop ecx
imul ecx, dword [ebx + 0x14]
add edi, ecx
call fcn.0044f4cd
pop edi
push dword [ebx + 8]
push dword [ebx + 0xc]
movzx ecx, byte [ebx + 7]
xor esi, esi
mov dword [edi], edx
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
inc eax
dec ecx
je 0x44f318
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x44f2ff
jb 0x44f345
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x44f345
mov ecx, eax
xchg dword [ebx + 0xc], eax
mov edx, eax
mov eax, dword [ebx]
call fcn.0044f367
jb 0x44f347
add esp, 8
mov dword [ebx], eax
or byte [ebx + 4], 4
mov esi, dword ds:[ebp - 0x68]
mov edi, dword ds:[ebp - 0x64]
notrack jmp dword ds:[ebp - 0x6c]
mov al, 9
pop dword [ebx + 0xc]
pop dword [ebx + 8]
mov dx, 0x9b0
mov al, 9
mov esi, dword ds:[ebp - 0x68]
mov edi, dword ds:[ebp - 0x64]
push dword ds:[ebp - 0x6c]
jmp fcn.0044ea56

Function at 0x44f3db
Capabilities:
Terminate process

Disassembly:
push esi
push ebx
call fcn.004559d1
jb 0x44f418
mov al, byte [esi + 0xc]
test al, 0xa
jne 0x44f40c
test al, 1
jne 0x44f3f9
test word [esi + 0x2c], 2
jne 0x44f410
jmp 0x44f40c
push ecx
call fcn.0044fd8c
mov ebx, ecx
pop ecx
jb 0x44f41d
or ebx, ebx
je 0x44f410
cmp al, 0x1a
je 0x44f410
xor eax, eax
jmp 0x44f415
mov eax, 0xffffffff
pop ebx
pop esi
ret
mov eax, 0x35
mov edx, eax
pop ebx
pop esi
mov eax, 0xffffffff
jmp fcn.0044ea4b

Function at 0x44f455
Capabilities:
Terminate process

Disassembly:
call fcn.0044f462
jb 0x44f45d
ret
jmp fcn.0044ea56
Function at 0x44f5fb
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x258
mov edi, eax
call fcn.0044eb1e
mov ebx, eax
lea edx, [ebp - 0x114]
push ebp
mov ebp, dword [ebp]
call fcn.0045aaf5
pop ebp
or eax, eax
je 0x44f72e
xor ecx, ecx
xchg dword [ebx + 0xc], ecx
jecxz 0x44f641
push eax
push edx
push ecx
mov edx, dword [sym.imp.KERNEL32.DLL_FindClose]
call fcn.0045bc61
pop edx
pop eax
mov esi, edx
add esi, eax
mov al, byte [esi - 1]
and edi, 0x9e
test edi, 0x80
je 0x44f664
test edi, 0x16
jne 0x44f664
xor edi, 0x80
mov dword [ebx + 0x10], edi
test edi, 8
jne 0x44f6a8
cmp al, 0x3a
je 0x44f677
cmp al, 0x5c
jne 0x44f682
mov word [esi], 0x2e2a
mov word [esi + 2], 0x2a
lea eax, [ebp - 0x258]
push eax
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
call fcn.0045bc61
cmp eax, 0xffffffff
stc
je 0x44f75f
mov dword [ebx + 0xc], eax
cmc
jmp 0x44f75f
push eax
cld
xor al, al
mov ecx, 0x140
lea edi, [ebp - 0x258]
rep stosb byte es:[edi], al
pop eax
cmp word [edx], 0x5c5c
jne 0x44f6cc
cmp al, 0x5c
je 0x44f6d6
mov word [esi], 0x5c
jmp 0x44f6d6
mov byte [edx + 1], 0x3a
mov word [edx + 2], 0x5c
push 0
push 0
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x234]
push eax
push 0
push 0x104
lea eax, [ebp - 0x22c]
push eax
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
call fcn.0045bc61
xor ecx, ecx
xor esi, esi
test eax, eax
je 0x44f82b
lea esi, [ebp - 0x22c]
jmp 0x44f7fe
xor ecx, ecx
test dword [ebx + 0xc], 0xffffffff
je 0x44f82b
test dword [ebx + 0x10], 8
jne 0x44f82b
lea edx, [ebp - 0x258]
push edx
push dword [ebx + 0xc]
mov edx, dword [sym.imp.KERNEL32.DLL_FindNextFileA]
call fcn.0045bc61
mov word [ebp - 0x90], 0
lea esi, [ebp - 0x22c]
jae 0x44f79a
cld
xor al, al
mov ecx, 0x140
lea edi, [ebp - 0x258]
rep stosb byte es:[edi], al
xor ecx, ecx
mov byte [esi], cl
mov dword [ebx + 0x10], ecx
xchg dword [ebx + 0xc], ecx
jecxz 0x44f798
push ecx
mov edx, dword [sym.imp.KERNEL32.DLL_FindClose]
call fcn.0045bc61
jmp 0x44f7fe
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebx + 0x10]
test ecx, 8
je 0x44f7b4
test eax, 8
je 0x44f74a
jmp 0x44f7fe
and eax, 0x16
je 0x44f7ee
test eax, 2
je 0x44f7c8
test ecx, 2
je 0x44f74a
test eax, 4
je 0x44f7db
test ecx, 4
je 0x44f74a
test eax, 0x10
je 0x44f7ee
test ecx, 0x10
je 0x44f74a
test ecx, 0x80
je 0x44f7fe
test ecx, eax
je 0x44f74a
cld
xor al, al
mov ecx, 0x103
mov edi, esi
repne scasb al, byte es:[edi]
lea ecx, [edi - 1]
sub ecx, esi
mov ax, word [esi]
cmp ax, 0x2e
je 0x44f74a
cmp ax, 0x2e2e
jne 0x44f82b
cmp ecx, 2
je 0x44f74a
push ecx
push esi
cld
mov ecx, 0x140
lea esi, [ebp - 0x258]
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x44f842
rep movsb byte es:[edi], byte [esi]
pop esi
pop ecx
push ebp
mov ebp, dword [ebp]
call fcn.0045b74b
pop ebp
mov esp, ebp
pop ebp
pop edi
pop esi
pop ecx
pop ebx
jb 0x44f859
pop eax
ret
mov edx, eax
pop eax
jmp fcn.0044ea4b
Function at 0x44f99d
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, eax
mov ax, word [ebp - 0x46]
call fcn.004559d1
jb 0x44fa18
mov al, byte [esi + 0xc]
test al, 0x20
je 0x44fa14
mov ecx, edi
call fcn.004558fd
jb 0x44fa1e
push ecx
push edx
push 0
lea edx, [esi + 0x3c]
push edx
push ecx
push edi
push dword [esi + 6]
mov edx, dword [sym.imp.KERNEL32.DLL_ReadFile]
call fcn.0045bc61
mov al, dl
pop edx
pop ecx
jb 0x44fa07
and word [esi + 0x2c], 0xfffd
mov eax, dword [esi + 0x3c]
cmp eax, ecx
je 0x44f9f8
or word [esi + 0x2c], 2
push esi
mov ecx, eax
mov esi, edx
call fcn.0045597f
pop esi
jb 0x44fa1e
add dword [esi + 0x14], eax
adc dword [esi + 0x18], 0
call fcn.0045b704
pop edi
pop esi
ret
mov esi, edx
call fcn.00455931
jmp 0x44fa1e
mov al, 0x36
mov dx, 0x34b0
mov al, 0x34
mov dx, 0x3fb0
call fcn.0045b702
pop edi
pop esi
jmp fcn.0044ea56