joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c700
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 7
add esp, 0xfffff004
push eax
dec eax
jne 0x41c709
mov eax, dword [ebp - 4]
add esp, 0xfffffabc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x7548], ebx
mov dword [ebp - 0x7544], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x41c82a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push esi
call sub.kernel32.dll_PeekNamedPipe
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x41c764
cmp dword [ebp - 0xc], 0
ja 0x41c768
xor eax, eax
jmp 0x41c76a
mov al, 1
mov ebx, eax
test bl, bl
je 0x41c80c
push 0
lea eax, [ebp - 8]
push eax
push 0x7530
lea eax, [ebp - 0x753d]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x41c80c
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x753d], 0
lea eax, [ebp - 0x753d]
push eax
lea eax, [ebp - 0x753d]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x7544]
lea edx, [ebp - 0x753d]
mov ecx, 0x7531
call fcn.0040490c
mov edx, dword [ebp - 0x7544]
mov eax, edi
call fcn.00404964
cmp word [ebp + 0xa], 0
je 0x41c803
lea eax, [ebp - 0x7548]
lea edx, [ebp - 0x753d]
mov ecx, 0x7531
call fcn.0040490c
mov edx, dword [ebp - 0x7548]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
call dword [ebp + 8]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41c831
lea eax, [ebp - 0x7548]
mov edx, 2
call fcn.004046c0
ret
Function at 0x41d894
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x41d94d
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
call fcn.004181c4
test al, al
je 0x41d8d4
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0041cc18
mov esi, eax
jmp 0x41d8fd
call fcn.004180a8
test al, al
je 0x41d8ee
mov ecx, ebx
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.0041d0a4
mov esi, eax
jmp 0x41d8fd
mov ecx, ebx
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.0041ce44
mov esi, eax
test esi, esi
je 0x41d937
mov dl, 1
mov eax, dword [0x41d688]
call fcn.00403a1c
mov ebx, eax
mov eax, ebx
call fcn.0041d6e0
mov dword [ebx + 0x2ef0], esi
push ebx
push 0x41d858
call sub.user32.dll_EnumWindows
mov eax, ebx
call fcn.0041d81c
mov edi, eax
mov eax, ebx
call fcn.00403a4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41d954
lea eax, [ebp - 4]
call fcn.0040469c
ret

Function at 0x41daa0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x41db25
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call fcn.004180a8
test al, al
je 0x41dade
xor ecx, ecx
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.0041d3b8
jmp 0x41daeb
xor ecx, ecx
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.0041ce44
test eax, eax
je 0x41db0f
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41db2c
lea eax, [ebp - 4]
call fcn.0040469c
ret
Function at 0x421144
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffee4
mov ebp, ecx
mov edi, edx
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
push eax
push 0
mov esi, dword [ebx + 4]
mov eax, esi
call fcn.00405948
mov ecx, eax
mov edx, esi
mov eax, ebx
call fcn.004210e4
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fstp qword [esp]
wait
push edi
push 1
mov esi, dword [ebx + 8]
mov eax, esi
call fcn.00405948
mov ecx, eax
mov edx, esi
mov eax, ebx
call fcn.004210e4
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fstp qword [esp + 8]
wait
mov eax, dword [ebx + 4]
cmp dword [eax], 0
je 0x42120e
fld qword [esp]
fcomp dword [0x421224]
fnstsw ax
sahf
je 0x42120e
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x14]
cmp eax, 0x1f4
jbe 0x42120e
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x14], eax
fld qword [esp]
fdiv dword [0x421228]
fdivr qword [esp + 8]
fdiv dword [0x42122c]
fstp qword [esp + 0x10]
wait
fld qword [esp + 0x10]
add esp, 0xfffffff4
fstp xword [esp]
wait
lea ecx, [esp + 0x28]
mov edx, 2
xor eax, eax
call fcn.00403404
lea edx, [esp + 0x1c]
lea eax, [ebx + 0x10]
call fcn.00404900
mov eax, ebp
mov edx, dword [ebx + 0x10]
call fcn.004046f0
add esp, 0x11c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42669c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x426833
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402a48
mov eax, 0x1869f
call fcn.00402f80
mov edx, dword [ebp - 8]
call fcn.004081ac
mov eax, dword [ebp - 4]
call fcn.0040495c
mov ebx, eax
test ebx, ebx
jle 0x426707
mov esi, 1
lea eax, [ebp - 4]
call fcn.00404bb4
sub byte [eax + esi - 1], 0x32
inc esi
dec ebx
jne 0x4266f6
lea eax, [ebp - 0x10]
call fcn.0040469c
push 0xffffffffffffffff
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404bbc
mov eax, dword [ebp - 0x18]
call fcn.004196a8
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00404884
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00404964
lea eax, [ebp - 4]
mov ecx, 2
mov edx, 1
call fcn.00404bfc
cmp dword [ebp - 4], 0
jne 0x42670f
mov eax, dword [ebp - 0x10]
call fcn.0040495c
mov edi, eax
cmp edi, 4
jle 0x426810
mov eax, dword [ebp - 0x10]
mov al, byte [eax + edi - 2]
mov byte [ebp - 0xa], al
xor eax, eax
mov ebx, edi
test ebx, ebx
jle 0x42679a
mov esi, 1
mov edx, edi
dec edx
cmp esi, edx
je 0x426796
mov edx, dword [ebp - 0x10]
add al, byte [edx + esi - 1]
inc esi
dec ebx
jne 0x426788
cmp al, byte [ebp - 0xa]
jne 0x426810
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + edi - 1]
xor al, dl
mov byte [ebp - 9], al
mov ebx, edi
dec ebx
sub ebx, 2
jl 0x4267d8
inc ebx
mov esi, 2
lea eax, [ebp - 0x10]
call fcn.00404bb4
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + esi - 1]
xor dl, byte [ebp - 9]
mov byte [eax + esi - 1], dl
inc esi
dec ebx
jne 0x4267be
mov eax, dword [ebp - 0x10]
mov al, byte [eax + 1]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 2]
mov esi, eax
and esi, 0xff
add esi, 3
inc esi
and eax, 0xff
sub edi, eax
xor eax, eax
mov al, dl
sub edi, eax
sub edi, 4
mov eax, dword [ebp - 8]
push eax
mov ecx, edi
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.00404bbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42683a
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004046c0
lea eax, [ebp - 4]
call fcn.0040469c
ret
Function at 0x426844
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x426911
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x42687b
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00408508
mov esi, eax
push 0
push 0
xor edx, edx
mov eax, esi
call fcn.0041aa74
lea edx, [ebp - 5]
mov ecx, 1
mov eax, esi
call fcn.0040858c
lea edx, [ebp - 6]
mov ecx, 1
mov eax, esi
call fcn.0040858c
cmp byte [ebp - 5], 0x4d
jne 0x4268ee
cmp byte [ebp - 6], 0x5a
jne 0x4268ee
push 0
push pe_nt_image_headers32
xor edx, edx
mov eax, esi
call fcn.0041aa74
lea edx, [ebp - 5]
mov ecx, 1
mov eax, esi
call fcn.0040858c
lea edx, [ebp - 6]
mov ecx, 1
mov eax, esi
call fcn.0040858c
cmp byte [ebp - 5], 0x50
jne 0x4268ee
cmp byte [ebp - 6], 0x45
jne 0x4268ee
mov bl, 1
cmp dword [ebp - 4], 0
je 0x4268fb
mov eax, esi
call fcn.0040861c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426918
lea eax, [ebp - 4]
call fcn.0040469c
ret

Function at 0x426ac4
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x426b48
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404bbc
mov eax, dword [ebp - 0x18]
call fcn.00404b5c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x426b2a
mov ebx, dword [ebp - 8]
imul ebx, dword [ebp - 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426b4f
lea eax, [ebp - 0x18]
call fcn.0040469c
lea eax, [ebp - 4]
call fcn.0040469c
ret

Function at 0x42b9d0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov esi, ecx
mov edi, edx
mov dword [esp], eax
xor ebp, ebp
test esi, esi
jbe 0x42ba5b
mov ebx, 1
mov eax, esi
xor edx, edx
push edx
push eax
push 0
push 0x10000
call fcn.004156a4
mov dword [esp + 4], eax
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, edi
call fcn.00404bb4
lea eax, [eax + ebx - 1]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x42ba28
or ebp, 0xffffffff
add ebx, dword [esp + 8]
sub esi, dword [esp + 8]
xor eax, eax
call fcn.004166b4
cmp ebp, 0xffffffff
je 0x42ba47
mov eax, dword [edi]
call fcn.0040495c
cmp ebx, eax
jle 0x42b9e9
mov eax, dword [edi]
call fcn.0040495c
cmp ebx, eax
jle 0x42ba5b
mov eax, dword [edi]
call fcn.0040495c
mov ebp, eax
mov eax, ebp
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42c89c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x42ca7f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x437f14], 0
jne 0x42ca4d
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x38
call fcn.00402f60
mov bl, 0x43
lea esi, [ebp - 0x50]
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404884
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x18]
mov ecx, 0x42ca98
call fcn.004049a8
mov eax, dword [ebp - 0x18]
call fcn.00404b5c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x42c9b6
lea eax, [ebp - 0x10]
mov ecx, 0x42caa4
mov edx, dword [ebp - 0x18]
call fcn.004049a8
mov eax, dword [ebp - 0x10]
call fcn.0040869c
test al, al
je 0x42c968
push dword [ebp - 0x10]
push 0x42cab4
push 0
push 0x2710
push 0
push 0x186a0
lea eax, [ebp - 0x58]
call fcn.00415bf4
push dword [ebp - 0x58]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404a1c
mov eax, dword [ebp - 0x10]
call fcn.004086c0
lea eax, [ebp - 0x14]
mov ecx, 0x42cac4
mov edx, dword [ebp - 0x10]
call fcn.004049a8
push 0
push 0
xor ecx, ecx
mov edx, 0x42cad8
mov eax, dword [ebp - 0x14]
call fcn.0041ad78
mov eax, dword [ebp - 0x14]
call fcn.0040868c
test al, al
je 0x42c9aa
mov eax, dword [ebp - 0x10]
call fcn.0041b114
fstp qword [esi]
wait
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.0041ba14
inc ebx
add esi, 8
cmp bl, 0x46
jne 0x42c8ed
lea edx, [ebp - 0x60]
mov al, 1
call fcn.00418d0c
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00407f98
mov eax, dword [ebp - 0x5c]
mov dl, byte [eax]
mov byte [ebp - 9], dl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov bl, 0x43
lea ecx, [ebp - 0x50]
fld qword [ecx]
fcomp qword [ebp - 8]
fnstsw ax
sahf
jbe 0x42ca05
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
mov byte [ebp - 9], bl
inc ebx
add ecx, 8
cmp bl, 0x46
jne 0x42c9ed
cmp dl, byte [ebp - 9]
je 0x42ca4d
lea eax, [ebp - 0x64]
mov dl, byte [ebp - 9]
call fcn.00404884
mov edx, dword [ebp - 0x64]
mov eax, 0x437f14
mov ecx, 0x42cae4
call fcn.004049a8
mov eax, dword [0x437f14]
call fcn.0040869c
test al, al
je 0x42ca4d
mov eax, 0x437f14
mov edx, 0x42cab4
call fcn.00404964
cmp dword [0x437f14], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42ca86
lea eax, [ebp - 0x64]
mov edx, 5
call fcn.004046c0
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004046c0
ret
Function at 0x42f3f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b4c
xor eax, eax
push ebp
push 0x42f47d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402f60
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], si
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404b5c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x42f467
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f484
lea eax, [ebp - 4]
call fcn.0040469c
ret
Function at 0x432f5c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x433058
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x43306c
call fcn.00422e94
mov eax, dword [0x4380c8]
cmp dword [eax], 0
jg 0x433033
lea eax, [ebp - 0xc]
call fcn.0042da78
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 0x433098
call fcn.004049a8
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004029a4
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00408a14
push dword [ebp - 0x10]
lea edx, [ebp - 0x18]
mov eax, dword [0x438044]
mov eax, dword [eax]
call fcn.00427180
push dword [ebp - 0x18]
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404a1c
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x4330c0
call fcn.004049a8
mov eax, dword [ebp - 0x1c]
call fcn.00422e94
push 0
mov eax, dword [ebp - 8]
call fcn.00404b5c
push eax
call sub.kernel32.dll_WinExec
push 0
push 0x3e8
xor eax, eax
call fcn.0041673c
mov eax, 0x4330d8
call fcn.00422e94
push 0
push 0
push 2
mov eax, dword [0x437fd4]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageA
mov eax, 0x4330fc
call fcn.00422e94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43305f
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004046c0
ret
Function at 0x434024
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4341bf
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00418b34
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4265dc]
call fcn.00426dc4
call fcn.00427580
mov dword [ebp - 0xc], eax
mov ebx, 0x46
mov eax, dword [ebp - 0xc]
add eax, 0xffffff4f
sub eax, 2
jae 0x434079
add ebx, 0x34
mov esi, 0x14
mov edi, 0x154
mov dword [ebp - 8], 0x12
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x439660]
push eax
push 0
mov edx, 0x4341d0
mov eax, 0x4341d4
mov ecx, 0x50000000
call fcn.00406ecc
mov edx, dword [0x438168]
mov dword [edx], eax
mov ebx, 0x46
mov esi, 0x26
mov edi, 0x188
mov dword [ebp - 8], 0xd
push 0x50000000
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x439660]
push eax
push 0
mov edx, 0x4341dc
xor ecx, ecx
xor eax, eax
call fcn.00406e74
mov edx, dword [0x43806c]
mov dword [edx], eax
mov ebx, 0x1a0
mov eax, dword [ebp - 0xc]
add eax, 0xffffff4f
sub eax, 2
jae 0x434118
mov ebx, 0x46
mov esi, 0x14
mov edi, 0x2e
mov dword [ebp - 8], 0xd
push 0x40000000
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x439660]
push eax
push 0
mov edx, 0x4341dc
xor ecx, ecx
xor eax, eax
call fcn.00406e74
mov edx, dword [0x437ff4]
mov dword [edx], eax
push 0
push 0x3e8
push 1
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetTimer
mov edx, dword [0x43802c]
mov dword [edx], eax
push 0x4341f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffff5
call sub.gdi32.dll_CreateFontA
push 0
push eax
push 0x30
mov eax, dword [0x438168]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4341c6
lea eax, [ebp - 0x10]
call fcn.0040469c
ret
Function at 0x4344ac
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x434695
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, 0x4346ac
call fcn.004193ac
test eax, eax
jl 0x4344ea
neg eax
mov edx, dword [0x4380ec]
mov dword [edx], eax
call sub.comctl32.dll_InitCommonControls
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x28
call fcn.00402f60
mov dword [ebp - 0x50], 0x434330
mov eax, dword [0x439660]
mov dword [ebp - 0x44], eax
mov eax, dword [0x437f58]
call fcn.00404b5c
mov dword [ebp - 0x30], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x3c], eax
push 0x4346b8
mov eax, dword [0x439660]
push eax
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x54], 8
lea eax, [ebp - 0x54]
push eax
call sub.user32.dll_RegisterClassA
mov esi, 0x1ec
mov edi, 0x6e
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
mov edx, edi
mov eax, esi
call fcn.0041a4cc
mov dword [ebp - 0xc], 0x2c80000
lea edx, [ebp - 0x58]
xor eax, eax
call fcn.00418b34
mov ecx, dword [ebp - 0x58]
mov dl, 1
mov eax, dword [0x4265dc]
call fcn.00426dc4
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4346cc
mov edx, 0x4346f0
mov eax, ebx
call fcn.00427474
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
push edi
push 0
push 0
mov eax, dword [0x439660]
push eax
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404b5c
push eax
mov eax, dword [0x437f58]
call fcn.00404b5c
mov edx, eax
xor eax, eax
pop ecx
call fcn.00406e74
mov edx, dword [0x437fd4]
mov dword [edx], eax
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.00427678
mov eax, dword [ebp - 0x5c]
push eax
mov eax, ebx
call fcn.00427580
push eax
mov eax, ebx
call fcn.004275f8
mov edx, eax
pop ecx
pop eax
call fcn.0041deb8
mov eax, dword [0x437fd4]
cmp dword [eax], 0
je 0x43464b
push 0
mov eax, dword [0x437fd4]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
jmp 0x434638
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_DispatchMessageA
cmp byte [0x437f60], 0
jne 0x43464b
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x43461d
push 1
mov eax, dword [0x437fd4]
mov eax, dword [eax]
push eax
call sub.user32.dll_KillTimer
mov al, 1
call fcn.00422230
call fcn.004220f4
xor edx, edx
mov eax, 0x2b
call fcn.00422f74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43469c
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.004046c0
lea eax, [ebp - 0x10]
call fcn.0040469c
ret
Function at 0x434928
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x434930
xor eax, eax
push ebp
push 0x434a3c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.004029a4
lea eax, [ebp - 0x10]
call fcn.0042c710
push dword [ebp - 0x10]
push 0x434a50
push 0x434a5c
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00408a9c
push dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 4
call fcn.00404a1c
push 0
mov eax, dword [ebp - 8]
call fcn.00404b5c
push eax
mov eax, dword [ebp - 4]
call fcn.00404b5c
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x18]
call fcn.00418fd8
push dword [ebp - 0x18]
push 0x434a68
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.004029a4
push dword [ebp - 0x1c]
push 0x434a90
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00404a1c
push dword [ebp - 0xc]
push 0x434aa0
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.004029a4
push dword [ebp - 0x20]
push 0x434ab8
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00404a1c
push 0
push dword [ebp - 8]
push 0x434ac4
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00408110
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404a1c
mov eax, dword [ebp - 0x24]
call fcn.00404b5c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434a43
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004046c0
ret
Function at 0x4020ea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
mov eax, dword [0x42e040]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
mov esi, dword [0x47d120]
xor ebx, ebx
push edi
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + esi + 0x78]
add ebp, esi
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add edi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x402151
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
add eax, esi
push eax
call fcn.0040241e
lea ecx, [esp + 0x1c]
call fcn.00401f1a
cmp eax, dword [esp + 0x14]
je 0x402169
lea ecx, [esp + 0x1c]
add edi, 4
call fcn.004024ab
inc ebx
cmp ebx, dword [esp + 0x18]
jb 0x402121
xor edi, edi
mov ecx, dword [esp + 0x34]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040693b
add esp, 0x2c
ret
mov edx, str.QwruxAA
call fcn.0040263e
push eax
call fcn.004028b7
mov eax, dword [ebp + 0x24]
pop ecx
lea eax, [eax + ebx*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebp + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x1c]
call fcn.004024ab
jmp 0x402153