joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3750
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov ebp, ecx
xor ebx, ebx
mov dword [esp + 0xc], ebp
push edi
mov edi, edx
mov dword [esp + 0x24], edi
test ebp, ebp
je 0x4a377b
push 2
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [esp + 0x1c], eax
jmp 0x4a3785
mov esi, dword [0x4e9878]
mov dword [esp + 0x1c], esi
test esi, esi
je 0x4a3916
test edi, edi
jns 0x4a379a
mov eax, edi
neg eax
movzx eax, ax
jmp 0x4a37cb
test edi, edi
mov dword [esp + 0x2c], ebx
mov eax, 1
mov dword [esp + 0x30], 0x4ed8e4
cmovne eax, edi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
push 0x4a3720
push 0xe
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov eax, dword [esp + 0x30]
cmp eax, 0x4ed8e4
je 0x4a38ef
push 0xe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4a38ef
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4a38ef
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x4a38ef
cmp dword [esp + 0x38], 0xffffffff
mov ebx, dword [esp + 0x3c]
cmovne ebx, dword [esp + 0x38]
test ebx, ebx
jne 0x4a382d
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [esp + 0x18]
mov ebx, eax
lea eax, [ecx + 6]
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], eax
xor ebp, ebp
movzx eax, word [ecx + 4]
mov dword [esp + 0x18], eax
test eax, eax
je 0x4a38e9
mov edi, dword [esp + 0x20]
mov esi, 0x100
movzx edx, byte [edi]
test edx, edx
cmove edx, esi
xor ecx, ecx
cmp edx, ebp
jle 0x4a386c
cmp ebp, ebx
setl cl
jmp 0x4a3871
cmp edx, ebx
setge cl
test ecx, ecx
mov eax, edi
cmove eax, dword [esp + 0x14]
add edi, 0xe
test ecx, ecx
mov dword [esp + 0x14], eax
cmove edx, ebp
sub dword [esp + 0x18], 1
mov ebp, edx
jne 0x4a3857
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x24]
test eax, eax
je 0x4a38e9
movzx eax, word [eax + 0xc]
push 3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4a38e9
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4a38e9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x4a38e9
push 0
push 0
push 0
push 0x30000
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebp
call dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov ebx, eax
jmp 0x4a38eb
xor ebx, ebx
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x40]
test eax, eax
je 0x4a3907
test ebx, ebx
je 0x4a3907
mov dword [eax], esi
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x24
ret
test ebp, ebp
je 0x4a3912
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jne 0x4a38fd
test edi, edi
jle 0x4a392f
lea eax, [edi - 1]
push eax
push ebp
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
xor eax, eax
cmp edi, 0xffffffff
cmovl eax, edi
push eax
push ebp
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x4a4c80
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x85c
push ebx
push 0x800
lea eax, [esp + 0x64]
mov dword [esp + 8], edx
push 0
push eax
mov ebx, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x10]
push 0xf0000000
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4a4e65
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x8004
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4a4e65
movaps xmm0, xmmword [0x4e1490]
movups xmmword [esp + 0x14], xmm0
push esi
movaps xmm0, xmmword [0x4e1460]
mov esi, dword [esp + 0x868]
mov dword [esp + 0x58], 0x64
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0xa0
movups xmmword [esp + 0x28], xmm0
movaps xmm0, xmmword [0x4e1480]
movups xmmword [esp + 0x38], xmm0
movaps xmm0, xmmword [0x4e1470]
movups xmmword [esp + 0x48], xmm0
test esi, esi
je 0x4a4d6b
cmp dword [esi], 0
je 0x4a4d6b
push edi
lea edi, [esp + 0x1c]
xor edx, edx
mov ecx, esi
sub edi, esi
cmp esi, 0x4e8168
jne 0x4a4d57
mov eax, dword [edi + ecx]
lea eax, [eax*2 + 0x4e0a18]
jmp 0x4a4d59
mov eax, dword [ecx]
mov ax, word [eax]
add ecx, 4
mov word [esp + edx*2 + 0x68], ax
inc edx
cmp edx, 0x13
jb 0x4a4d43
pop edi
lea ecx, [esp + 0x64]
lea edx, [ecx + 2]
pop esi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a4d73
sub ecx, edx
sar ecx, 1
push 0
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x68]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4a4e65
push 0x800
lea eax, [esp + 0x64]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esp + 0x878]
add esp, 0xc
cmp ecx, 0x80
jne 0x4a4dc9
mov eax, 0x660e
jmp 0x4a4dd9
xor eax, eax
cmp ecx, 0xc0
setne al
add eax, 0x660f
lea edx, [esp + 0xc]
shl ecx, 0x10
push edx
push ecx
push dword [esp + 0x10]
push eax
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x4a4e65
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
je 0x4a4e65
cmp byte [esp + 0x868], 0
je 0x4a4e2d
mov eax, dword [esp + 4]
add eax, 0x10
push eax
lea eax, [esp + 8]
push eax
push ebx
push 0
push 1
push 0
push dword [esp + 0x24]
call dword [0x4e9840]
jmp 0x4a4e43
lea eax, [esp + 4]
push eax
push ebx
push 0
push 1
push 0
push dword [esp + 0x20]
call dword [0x4e983c]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 4]
pop ebx
add esp, 0x85c
ret
xor eax, eax
pop ebx
add esp, 0x85c
ret
Function at 0x4a5d70
Capabilities:
Write clipboard data

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, 0x4ec4e8
push esi
mov esi, edx
call fcn.00405ee0
test eax, eax
jne 0x4a5da1
push 0x4bfb90
push str.Cant_open_clipboard_for_writing.
mov ecx, 0x4eb990
call fcn.0043eb10
pop esi
pop ebx
add esp, 8
ret
push ebp
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [ebx + esi]
lea esi, [ebx + 4]
mov dword [esp + 0x14], eax
cmp esi, eax
ja 0x4a5e29
mov ecx, dword [ebx]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x4a5e29
mov edi, esi
add esi, 4
cmp esi, eax
ja 0x4a5e29
mov edi, dword [edi]
mov ebx, esi
add esi, edi
cmp esi, eax
ja 0x4a5e29
xor eax, eax
test edi, edi
sete al
add eax, edi
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x4a5edd
test edi, edi
je 0x4a5e13
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4a5e78
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, esi
push ebp
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
mov eax, dword [esp + 0x14]
lea esi, [ebx + 4]
cmp esi, eax
jbe 0x4a5db7
cmp dword [0x4ec500], 0
je 0x4a5e6b
cmp dword [0x4ec4f0], 0
je 0x4a5e51
push dword [0x4ec4e8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4ec4f0], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4ec500], 0
mov dword [0x4ec4e8], 0
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x4ec500], 0
je 0x4a5ec1
cmp dword [0x4ec4f0], 0
je 0x4a5ea7
push dword [0x4ec4e8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4ec4f0], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4ec500], 0
mov dword [0x4ec4e8], 0
push 0x4bfb90
push 0x4c0094
mov ecx, 0x4eb990
call fcn.0043eb10
pop edi
pop ebp
pop esi
pop ebx
add esp, 8
ret
cmp dword [0x4ec500], 0
je 0x4a5f1f
cmp dword [0x4ec4f0], 0
je 0x4a5f05
push dword [0x4ec4e8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4ec4f0], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4ec500], 0
mov dword [0x4ec4e8], 0
push 0x4bfb90
push str.Out_of_memory.
mov ecx, 0x4eb990
call fcn.0043eb10
pop edi
pop ebp
pop esi
pop ebx
add esp, 8
ret
Function at 0x4a7130
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ecx
cmp byte [esp + 8], 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
je 0x4a719a
lea eax, [esp + 0xc]
push eax
push 0x1f4
push 2
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x4a71a7
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4a71a7
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4a71a7
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4a71a7
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
xor edi, edi
test ebx, ebx
cmovns edi, ebx
test edi, edi
je 0x4a7213
push ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword fs:[0x24]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x18], eax
nop word [eax + eax]
cmp dword [0x4eb104], ebx
jne 0x4a71e9
mov edx, 1
mov ecx, 0x8000012f
call fcn.004016d0
jmp 0x4a71ed
push 0xa
call ebp
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a720b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x18]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jg 0x4a71d0
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
Function at 0x4a73b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x11c6c
call fcn.004bd970
mov eax, edx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
mov dword [esp + 8], eax
movzx eax, word [eax]
push edi
mov edi, ecx
cmp eax, 0x41
je 0x4a73e1
cmp eax, 0x61
jne 0x4a7444
mov ecx, dword [esp + 0xc]
cmp word [ecx + 2], 0
jne 0x4a7444
cmp word [ebx], 0
jne 0x4a7444
cmp word [edx], 0
jne 0x4a7444
cmp word [esi], 0
jne 0x4a7444
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x4a742b
cmp byte [edi + 0xea], 0
jne 0x4a742b
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4a7429
mov ecx, esi
call fcn.004a8120
test al, al
je 0x4a742b
xor esi, esi
cmp byte [ebp + 0x18], 0
je 0x4a743b
test esi, esi
je 0x4a743b
mov dword [edi + 0xc4], esi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ax, ax
jne 0x4a7466
cmp word [ebx], ax
jne 0x4a7466
cmp word [edx], ax
jne 0x4a7466
cmp word [esi], ax
jne 0x4a7466
mov ecx, edi
call fcn.004a7570
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x10]
call fcn.004406e0
push esi
push edx
push ebx
push dword [esp + 0x18]
push edi
call fcn.004a8270
test eax, eax
je 0x4a7532
test byte [esp + 0x10], 2
mov al, byte [ebp + 0x14]
mov byte [esp + 0x183d], al
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x184c], eax
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x1850], eax
je 0x4a753b
mov esi, dword [esp + 0x102c]
cmp esi, 0xffff
je 0x4a750a
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a7532
cmp byte [edi + 0xea], 0
mov esi, dword [esp + 0x102c]
jne 0x4a750a
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4a74ed
mov ecx, esi
call fcn.004a8120
test al, al
je 0x4a7503
push 0xfffffffffffffff0
push dword [esp + 0x1030]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x4a7532
mov esi, dword [esp + 0x102c]
cmp dword [esp + 0x1864], esi
je 0x4a7523
lea ecx, [esp + 0x10]
mov dword [esp + 0x1864], esi
call fcn.004a86e0
push 0
lea ecx, [esp + 0x14]
call fcn.004a87c0
test eax, eax
jne 0x4a754b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x10]
push eax
push 0x4a7610
call dword [sym.imp.USER32.dll_EnumWindows]
cmp byte [ebp + 0x18], 0
mov eax, dword [esp + 0x1844]
je 0x4a7534
test eax, eax
je 0x4a7534
mov dword [edi + 0xc4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a86e0
Capabilities:
Get graphical window text

Disassembly:
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1854]
test ecx, ecx
je 0x4a87b9
mov eax, dword [esi]
test eax, eax
je 0x4a87b9
push edi
test al, 1
jne 0x4a870d
mov eax, dword [esi + 0x100c]
cmp word [eax], 0
je 0x4a8727
push 0x7fff
lea edi, [esi + 0x1860]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x4a8727
mov word [edi], ax
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test al, 4
je 0x4a8744
lea eax, [esi + 0x185c]
push eax
push dword [esi + 0x1854]
call edi
mov eax, dword [esi]
test al, 0x20
je 0x4a877f
lea eax, [esp + 8]
push eax
push dword [esi + 0x1854]
call edi
test eax, eax
je 0x4a877f
movzx eax, byte [esi + 0x182c]
lea edx, [esi + 0x11a60]
push eax
push ecx
mov ecx, dword [esp + 0x10]
call fcn.0046c3a0
add esp, 8
test eax, eax
jne 0x4a877f
mov word [esi + 0x11a60], ax
mov eax, dword [esi]
pop edi
test al, 8
je 0x4a87a0
push 0x101
lea eax, [esi + 0x1185e]
push eax
push dword [esi + 0x1854]
call dword [sym.imp.USER32.dll_GetClassNameW]
mov eax, dword [esi]
test eax, 0x100
je 0x4a87b9
push dword [esi + 0x1854]
call dword [sym.imp.USER32.dll_GetParent]
mov dword [esi + 0x1858], eax
pop esi
pop ecx
ret

Function at 0x4a90d0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x11c68
call fcn.004bd970
mov edx, dword [ecx + 8]
test edx, edx
je 0x4a916b
lea ecx, [esp]
call fcn.004406e0
mov al, byte [ebp + 8]
mov byte [esp + 0x1848], al
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x184c], eax
mov eax, ecx
push eax
push 0x4a98b0
mov dword [esp + 0x184c], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0x1834], 0
je 0x4a916b
mov eax, dword [0x4e7024]
cmp dword [eax + 0x54], 0xffffffff
jle 0x4a916b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4eb104], eax
je 0x4a9158
mov eax, dword [0x4e7024]
push dword [eax + 0x54]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x4e7024]
mov edx, 1
mov ecx, dword [ecx + 0x54]
call fcn.004016d0
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x4a9450
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x11c74
call fcn.004bd970
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
je 0x4a9640
push 0
call fcn.004a9650
test eax, eax
jne 0x4a9483
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push dword [0x4e7024]
mov ebx, eax
mov ecx, esi
push ebx
call fcn.004a96f0
mov edx, dword [0x4eb0fc]
xor ecx, ecx
test eax, eax
cmovne edx, ecx
lea ecx, [esp + 0x18]
mov dword [0x4eb0fc], edx
call fcn.004406e0
cmp byte [ebp + 8], 0
je 0x4a94c7
mov byte [esp + 0x1845], 0
test edx, edx
je 0x4a94cf
mov byte [esp + 0x1845], 1
mov eax, dword [0x4eb0f8]
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x1854], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x185c], eax
lea eax, [esp + 0x18]
push eax
push 0x4a9780
mov dword [esp + 0x1860], edx
call edi
mov eax, dword [esp + 0x184c]
test eax, eax
je 0x4a9608
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 0x4a8060
mov dword [esp + 0x1c], 0
call edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4a956b
mov ecx, dword [0x4eb0fc]
xor eax, eax
mov edx, dword [esp + 0x184c]
mov esi, dword [0x4eb0f8]
test ecx, ecx
jle 0x4a9550
cmp dword [esi + eax*4], edx
je 0x4a9562
inc eax
cmp eax, ecx
jl 0x4a9546
cmp ecx, 0x1f4
jge 0x4a9562
mov dword [esi + ecx*4], edx
inc ecx
mov dword [0x4eb0fc], ecx
mov dword [esp + 0x184c], edi
jmp 0x4a9572
mov edi, dword [esp + 0x184c]
mov ecx, edi
call fcn.004a6da0
mov ecx, dword [0x4eb0fc]
xor eax, eax
mov edx, dword [esp + 0x184c]
mov esi, dword [0x4eb0f8]
test ecx, ecx
jle 0x4a959c
cmp dword [esi + eax*4], edx
je 0x4a95ae
inc eax
cmp eax, ecx
jl 0x4a9592
cmp ecx, 0x1f4
jge 0x4a95ae
mov dword [esi + ecx*4], edx
inc ecx
mov dword [0x4eb0fc], ecx
mov eax, dword [0x4e7024]
cmp dword [eax + 0x54], 0xffffffff
jle 0x4a9640
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4eb104], eax
je 0x4a95e7
mov eax, dword [0x4e7024]
push dword [eax + 0x54]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [0x4e7024]
mov edx, 1
mov ecx, dword [ecx + 0x54]
call fcn.004016d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x4eb0fc]
test eax, eax
je 0x4a9640
cmp eax, 1
mov dword [0x4eb0fc], 0
setg al
test al, al
je 0x4a9640
mov ecx, dword [0x4eb0f8]
push 0
mov dword [0x4eb0fc], 1
mov dword [ecx], ebx
mov ecx, esi
call fcn.004a9450
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x453e40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x50000]
push edi
or ebp, 0xffffffff
jmp 0x453e62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x453e69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x453e58
mov eax, 1
add ebx, ebx
jne 0x453e7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x453e8c
jne 0x453eab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x453eab
dec eax
add ebx, ebx
jne 0x453e98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x453e70
add ebx, ebx
jne 0x453ea7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x453efd
xor ecx, ecx
sub eax, 3
jb 0x453ec3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x453f32
sar eax, 1
mov ebp, eax
jmp 0x453ece
add ebx, ebx
jne 0x453ece
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x453e9c
inc ecx
add ebx, ebx
jne 0x453edc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x453e9c
add ebx, ebx
jne 0x453ee9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x453ede
jne 0x453efa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x453ede
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x453f1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x453f0e
jmp 0x453e5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x453f1c
add edi, ecx
jmp 0x453e5e
pop esi
mov edi, esi
mov ecx, 0x90
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x453f3a
cmp byte [edi], 3
jne 0x453f3a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x453f3f
lea edi, [esi + 0x51000]
mov eax, dword [edi]
or eax, eax
je 0x453fae
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9b7e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9b834]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x453f6c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9b838]
or eax, eax
je 0x453fa8
mov dword [ebx], eax
add ebx, 4
jmp 0x453f89
call dword [esi + 0x9b840]
mov ebp, dword [esi + 0x9b83c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x453fe2
sub esp, 0xffffff80
jmp 0x4015c9
Function at 0x44e470
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e30bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004d5159
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x44e4f2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004d26cd
mov eax, dword [eax]
push 0x69a278
push eax
call fcn.004b2294
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004d53e4
test bl, bl
je 0x44e4f2
push 0x69a278
lea ecx, [esp + 0xc]
call fcn.004d57c0
push 0x69ddf4
lea ecx, [esp + 0xc]
call fcn.004d57c0
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x44e52e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004d53e4
jmp 0x44e5f9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x44e5b2
lea edx, [esp + 0x7c]
push 0x69ddf0
push edx
call fcn.004b2294
add esp, 8
test eax, eax
je 0x44e5b2
lea eax, [esp + 0x7c]
push 0x69ddec
push eax
call fcn.004b2294
add esp, 8
test eax, eax
je 0x44e5b2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x44e542
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004d53e4
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x44edf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x44ee52
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc