joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e820
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
jne 0x42e840
xor eax, eax
jmp 0x42e8fd
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x240], 0
push 0x228
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.004caa30
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x42e884
xor eax, eax
jmp 0x42e8fd
mov dword [ebp - 0x240], 0x22c
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42e8f1
mov eax, dword [ebp + 8]
push eax
call fcn.004ce469
add esp, 4
push eax
lea ecx, [ebp - 0x21c]
push ecx
call fcn.004ce469
add esp, 4
push eax
call fcn.004cbc4a
add esp, 8
test eax, eax
jne 0x42e8dd
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x238]
jmp 0x42e8fd
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42e8a2
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret

Function at 0x42ee80
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, 1
test eax, eax
je 0x42ef9a
mov word [ebp - 0x218], 0
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.004caa30
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x42eeed
mov edx, dword [ebp + 0xc]
push edx
push 0x54c1c4
lea eax, [ebp - 0x218]
push eax
call fcn.004cb62b
add esp, 0xc
jmp 0x42ef09
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x54c1d4
lea eax, [ebp - 0x218]
push eax
call fcn.004cb62b
add esp, 0x10
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42ef27
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004ce4d2
add esp, 8
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42ef73
push 5
push 0
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x42ef9a
push 5
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [ebp - 8], 0xa
jl 0x42ef8c
jmp 0x42efa8
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x42eea1
push 5
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret
Function at 0x430340
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.004caa30
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jne 0x4303ab
cmp dword [ebp - 0x120], 0
je 0x43039b
cmp dword [ebp - 0x120], 1
jne 0x4303ab
movzx edx, byte [ebp - 0xe]
cmp edx, 1
jne 0x4303ab
mov eax, 1
jmp 0x4303ad
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret

Function at 0x430f90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004caee6
add esp, 4
test eax, eax
jne 0x430fad
xor eax, eax
jmp 0x43100a
push 0x3c
push 0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004caa30
add esp, 0xc
mov dword [ebp - 0x30], 0x54c404
mov dword [ebp - 0x38], 0x200
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 1
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x54c410
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x431005
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x40]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x40]
mov edx, dword [eax + 0x20]
call edx
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x431010
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x834], ecx
push 0x44
push 0
lea eax, [ebp - 0x830]
push eax
call fcn.004caa30
add esp, 0xc
mov dword [ebp - 0x830], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x7e8]
push ecx
call fcn.004caa30
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x54c41c
lea eax, [ebp - 0x7d8]
push eax
call fcn.004cb62b
add esp, 0xc
lea ecx, [ebp - 0x7e8]
push ecx
lea edx, [ebp - 0x830]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x7d8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4310a2
xor eax, eax
jmp 0x4310c1
mov ecx, dword [ebp - 0x7e8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x7e4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret 4
Function at 0x4310e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x83c], ecx
push 0x44
push 0
lea eax, [ebp - 0x838]
push eax
call fcn.004caa30
add esp, 0xc
mov dword [ebp - 0x838], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x7ec]
push ecx
call fcn.004caa30
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x54c424
lea eax, [ebp - 0x7d8]
push eax
call fcn.004cb62b
add esp, 0xc
lea ecx, [ebp - 0x7ec]
push ecx
lea edx, [ebp - 0x838]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x7d8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x431172
xor eax, eax
jmp 0x4311b4
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x7ec]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 0x7dc]
push edx
mov eax, dword [ebp - 0x7ec]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 0x7ec]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x7e8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret 4

Function at 0x4311d0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24c], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004caee6
add esp, 4
test eax, eax
jne 0x431200
xor eax, eax
jmp 0x43129f
push 0x104
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Program_FilesInternet_Exploreriexplore.exe
lea edx, [ebp - 0x23c]
push edx
call fcn.004caa10
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x248]
push ecx
call fcn.004ca9e6
add esp, 8
push 0x3c
push 0
lea edx, [ebp - 0x3c]
push edx
call fcn.004caa30
add esp, 0xc
mov dword [ebp - 0x30], 0x54c490
mov dword [ebp - 0x38], 0x200
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 1
push 1
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x43129a
lea edx, [ebp - 0x248]
push edx
mov eax, dword [ebp - 0x24c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x24c]
mov eax, dword [edx + 0x20]
call eax
mov eax, 1
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret 4
Function at 0x4312b0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1414
call fcn.004cd300
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1414], ecx
mov eax, dword [ebp + 8]
push eax
push 0x54c4a8
lea ecx, [ebp - 0x7d8]
push ecx
call fcn.004cb62b
add esp, 0xc
lea edx, [ebp - 0xa30]
push edx
lea eax, [ebp - 0x7d8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0xa34], eax
cmp dword [ebp - 0xa34], 0xffffffff
je 0x4313fc
lea ecx, [ebp - 0xa30]
push ecx
mov edx, dword [ebp - 0xa34]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 0
jne 0x431334
jmp 0x4313fc
movzx eax, word [ebp - 0xa04]
cmp eax, 0x2e
jne 0x431342
jmp 0x4312ff
movzx ecx, word [ebp - 0xa02]
test ecx, ecx
jne 0x43134f
jmp 0x4312ff
movzx edx, word [ebp - 0xa02]
cmp edx, 0x2e
jne 0x431368
movzx eax, word [ebp - 0xa00]
test eax, eax
jne 0x431368
jmp 0x4312ff
mov ecx, dword [ebp - 0xa30]
and ecx, 0x10
je 0x4313cb
mov word [ebp - 0x1410], 0
push 0x206
push 0
lea edx, [ebp - 0x140e]
push edx
call fcn.004caa30
add esp, 0xc
lea eax, [ebp - 0xa04]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_s_
lea edx, [ebp - 0x1410]
push edx
call fcn.004cb62b
add esp, 0x10
lea eax, [ebp - 0x1410]
push eax
mov ecx, dword [ebp - 0x1414]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x1414]
mov eax, dword [edx + 0x2c]
call eax
lea ecx, [ebp - 0xa04]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x54c4c0
lea eax, [ebp - 0x1208]
push eax
call fcn.004cb62b
add esp, 0x10
lea ecx, [ebp - 0x1208]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4312ff
mov edx, dword [ebp - 0xa34]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret 4
Function at 0x431420
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.004caee6
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004aa3b0
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.004caa10
add esp, 8
mov byte [ebp - 1], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
jmp 0x43148d
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 8]
jg 0x4314fb
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + edx*2]
cmp ecx, 0x5c
jne 0x4314f9
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov cx, word [eax + edx*2]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov word [eax + edx*2], 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4314e2
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4314e2
mov byte [ebp - 1], 0
jmp 0x4314fb
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dx, word [ebp - 0x18]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x431484
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.004aa3b5
add esp, 4
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 4

Function at 0x432b10
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x432b29
xor eax, eax
jmp 0x432b8b
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x432b3d
xor eax, eax
jmp 0x432b8b
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x432b52
xor eax, eax
jmp 0x432b8b
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x432b69
xor eax, eax
jmp 0x432b8b
mov eax, dword [ebp - 0xc]
push eax
call fcn.004cade0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x432ba0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x432bb7
jmp 0x432c1b
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x432bc1
jmp 0x432c1b
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x432bd3
jmp 0x432c1b
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x432be6
jmp 0x432c1b
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x432bfb
jmp 0x432c1b
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004cb400
add esp, 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esp, ebp
pop ebp
ret 8
Function at 0x433920
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
mov dword [ebp - 0x148], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x433950
xor eax, eax
jmp 0x433b37
mov dword [ebp - 8], 0
push 0
push 0x80
push 4
push 0
push 1
push SysReAllocStringLen
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x43398b
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
push eax
call fcn.004aa3b0
add esp, 4
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x20], 0
push 0
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xe
mov esi, str.identifierBegin:abcdefghijklmnopqrstuvwxyz:identifierEnd
lea edi, [ebp - 0x130]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0xcb
push 0
lea ecx, [ebp - 0xf7]
push ecx
call fcn.004caa30
add esp, 0xc
lea edx, [ebp - 0x130]
push edx
call fcn.004cade0
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x134], 0
jmp 0x433a40
mov eax, dword [ebp - 0x134]
add eax, 1
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x134]
cmp ecx, dword [ebp - 8]
jge 0x433b16
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x134]
movsx eax, byte [edx]
movsx ecx, byte [ebp - 0x130]
cmp eax, ecx
jne 0x433b11
cmp dword [ebp - 0x1c], 0
je 0x433a75
jmp 0x433b16
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x138], 0
jmp 0x433aa0
mov eax, dword [ebp - 0x138]
add eax, 1
mov dword [ebp - 0x138], eax
mov ecx, dword [ebp - 0x138]
cmp ecx, dword [ebp - 4]
jge 0x433b11
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x138]
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax + edx]
mov edx, dword [ebp - 0x138]
movsx eax, byte [ebp + edx - 0x130]
cmp ecx, eax
jne 0x433b06
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 4]
jne 0x433b04
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x140], eax
mov ecx, dword [ebp - 0x140]
push ecx
call fcn.004aa3b5
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, 1
jmp 0x433b37
jmp 0x433b0f
mov dword [ebp - 0x10], 0
jmp 0x433b11
jmp 0x433a91
jmp 0x433a31
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x144]
push eax
call fcn.004aa3b5
add esp, 4
mov dword [ebp - 0xc], 0
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret 4
Function at 0x434050
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x435720
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539998
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5925f0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68], ecx
mov eax, dword [ebp - 0x68]
cmp dword [eax + 0x3c], 0
je 0x435760
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x43576c
mov al, 1
jmp 0x43590f
mov dword [ebp - 0x10], 8
call fcn.00435ca0
push eax
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x3c], eax
call fcn.00435ca0
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00435c80
add esp, 8
movzx eax, al
test eax, eax
je 0x4357af
xor al, al
jmp 0x43590f
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.00435930
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.00435970
mov ecx, eax
call fcn.004359a0
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.00401ee0
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.00435970
mov ecx, eax
call fcn.004359a0
push eax
mov ecx, dword [ebp - 0x68]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x68]
mov ecx, dword [edx + 0x3c]
call fcn.00435bb0
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x43582a
cmp dword [ebp - 0x6c], 1
je 0x435831
cmp dword [ebp - 0x6c], 3
je 0x4358cb
jmp 0x4358e3
mov eax, dword [ebp - 0x68]
mov byte [eax + 0x41], 0
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00435970
mov ecx, eax
call fcn.004359a0
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x435894
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x34]
call fcn.00435970
mov ecx, eax
call fcn.004359a0
push eax
call fcn.004cb9f7
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x435894
mov byte [ebp - 0x61], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004015a0
mov al, byte [ebp - 0x61]
jmp 0x43590f
mov ecx, dword [ebp - 0x68]
movzx edx, byte [ecx + 0x41]
test edx, edx
jne 0x4358b7
mov byte [ebp - 0x62], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004015a0
mov al, byte [ebp - 0x62]
jmp 0x43590f
cmp dword [ebp - 0x38], 0
jne 0x4358c9
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.004307e0
jmp 0x4358fb
mov byte [ebp - 0x63], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004015a0
mov al, byte [ebp - 0x63]
jmp 0x43590f
mov byte [ebp - 0x64], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004015a0
mov al, byte [ebp - 0x64]
jmp 0x43590f
jmp 0x4357c2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004ca9d7
mov esp, ebp
pop ebp
ret
Function at 0x437280
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp eax, 0xb7
setne dl
mov eax, dword [ebp - 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x4372f0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp eax, 0xb7
setne dl
mov eax, dword [ebp - 4]
mov dword [eax + 4], edx
mov esp, ebp
pop ebp
ret 4

Function at 0x43a060
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add eax, 0x14
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x43a3c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x43a096
jmp 0x43a0b3
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 0xffffffff
jne 0x43a0a1
jmp 0x43a0b3
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
mov esp, ebp
pop ebp
ret

Function at 0x43a0c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add eax, 0x14
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x43a3e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x43a0f6
jmp 0x43a113
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 0xffffffff
jne 0x43a101
jmp 0x43a113
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
mov esp, ebp
pop ebp
ret

Function at 0x453250
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 1
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
push 4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov esp, ebp
pop ebp
ret 0x10