joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4437f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4438ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x14], 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x14]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x443866
call sub.wsock32.dll_WSAGetLastError
lea edx, [ebp - 0xc]
call fcn.00437924
mov edx, dword [ebp - 0xc]
mov ecx, 0x4438e0
mov eax, dword [ebp - 4]
call fcn.004439c8
jmp 0x4438b4
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
add dword [eax + 0x1c], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
sub dword [eax + 0x18], edx
xor eax, eax
push ebp
push 0x443898
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4438b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4438d1
lea eax, [ebp - 0xc]
call fcn.00405044
ret

Function at 0x4448ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
dec eax
test eax, eax
jl 0x444931
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor al, byte [edx + ecx]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x44490e
mov esp, ebp
pop ebp
ret 4
Function at 0x444a4c
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x4d0a84]
mov byte [ebp - 2], al
xor eax, eax
mov al, byte [ebp - 2]
call dword [0x4d0c84]
mov byte [ebp - 4], al
xor eax, eax
mov al, byte [ebp - 2]
call dword [0x4d0c88]
mov byte [ebp - 6], al
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 0x4d0b84]
mov byte [ebp - 1], al
xor eax, eax
mov al, byte [ebp - 1]
call dword [0x4d0c84]
mov byte [ebp - 3], al
xor eax, eax
mov al, byte [ebp - 1]
call dword [0x4d0c88]
mov byte [ebp - 5], al
xor eax, eax
mov al, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 3]
shl edx, 8
or eax, edx
xor edx, edx
mov dl, byte [ebp - 5]
shl edx, 0x10
or eax, edx
xor edx, edx
mov dl, byte [ebp - 5]
shl edx, 0x18
or eax, edx
mov edx, dword [ebp - 0xc]
mov dword [edx*4 + 0x4d57a0], eax
xor eax, eax
mov al, byte [ebp - 6]
xor edx, edx
mov dl, byte [ebp - 6]
shl edx, 8
or eax, edx
xor edx, edx
mov dl, byte [ebp - 4]
shl edx, 0x10
or eax, edx
xor edx, edx
mov dl, byte [ebp - 2]
shl edx, 0x18
or eax, edx
mov edx, dword [ebp - 0xc]
mov dword [edx*4 + 0x4d5ba0], eax
xor eax, eax
mov al, byte [ebp - 3]
xor edx, edx
mov dl, byte [ebp - 5]
shl edx, 8
or eax, edx
xor edx, edx
mov dl, byte [ebp - 1]
shl edx, 0x10
or eax, edx
xor edx, edx
mov dl, byte [ebp - 5]
shl edx, 0x18
or eax, edx
mov edx, dword [ebp - 0xc]
mov dword [edx*4 + 0x4d5fa0], eax
xor eax, eax
mov al, byte [ebp - 4]
xor edx, edx
mov dl, byte [ebp - 2]
shl edx, 8
or eax, edx
xor edx, edx
mov dl, byte [ebp - 6]
shl edx, 0x10
or eax, edx
xor edx, edx
mov dl, byte [ebp - 4]
shl edx, 0x18
or eax, edx
mov edx, dword [ebp - 0xc]
mov dword [edx*4 + 0x4d63a0], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x100
jne 0x444a57
mov esp, ebp
pop ebp
ret
Function at 0x444c50
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0xff
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
shr eax, 8
and eax, 0xff
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xff
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
shr eax, 0x18
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0xc], 0x100
jne 0x444d07
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x4d0b84]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0xc]
and edx, 0xff
xor eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x4d0a84]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0xc]
shr edx, 8
and edx, 0xff
xor eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + 0x4d0a84]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0xc]
shr edx, 0x10
and edx, 0xff
xor eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax + 0x4d0b84]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0xc]
shr edx, 0x18
xor eax, edx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0xc], 0xc0
jl 0x444d7f
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x4d0b84]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 8]
and edx, 0xff
xor eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + 0x4d0b84]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 8]
shr edx, 8
and edx, 0xff
xor eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + 0x4d0a84]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 8]
shr edx, 0x10
and edx, 0xff
xor eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax + 0x4d0a84]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 8]
shr edx, 0x18
xor eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x4d0a84]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 4]
and edx, 0xff
xor eax, edx
movzx eax, byte [eax + 0x4d0a84]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
and edx, 0xff
xor eax, edx
mov eax, dword [eax*4 + 0x4d57a0]
mov edx, dword [ebp - 0x18]
movzx edx, byte [edx + 0x4d0b84]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 4]
shr ecx, 8
and ecx, 0xff
xor edx, ecx
movzx edx, byte [edx + 0x4d0a84]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
shr ecx, 8
and ecx, 0xff
xor edx, ecx
xor eax, dword [edx*4 + 0x4d5ba0]
mov edx, dword [ebp - 0x1c]
movzx edx, byte [edx + 0x4d0a84]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 4]
shr ecx, 0x10
and ecx, 0xff
xor edx, ecx
movzx edx, byte [edx + 0x4d0b84]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
shr ecx, 0x10
and ecx, 0xff
xor edx, ecx
xor eax, dword [edx*4 + 0x4d5fa0]
mov edx, dword [ebp - 0x20]
movzx edx, byte [edx + 0x4d0b84]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 4]
shr ecx, 0x18
xor edx, ecx
movzx edx, byte [edx + 0x4d0b84]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
shr ecx, 0x18
xor edx, ecx
xor eax, dword [edx*4 + 0x4d63a0]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x444e5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [eax + edx*4]
xor edx, edx
mov dl, byte [ebp - 9]
imul edx, edx, 0x1010101
xor eax, edx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x40
jne 0x444e70
mov esp, ebp
pop ebp
ret
Function at 0x445a94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
dec eax
test eax, eax
jl 0x445af9
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 4]
add edx, 0x10c4
mov eax, dword [ebp - 4]
call fcn.00445370
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
xor al, byte [ebp - 0x24]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
mov eax, dword [ebp - 4]
add eax, 0x10c4
mov edx, 0x10
call fcn.00444938
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x445ab6
mov esp, ebp
pop ebp
ret 4

Function at 0x445b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
dec eax
test eax, eax
jl 0x445b65
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 4]
add edx, 0x10c4
mov eax, dword [ebp - 4]
call fcn.00445370
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
xor al, byte [ebp - 0x24]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
mov eax, dword [ebp - 4]
add eax, 0x10c4
mov edx, 0x10
call fcn.00444938
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x445b22
mov esp, ebp
pop ebp
ret 4

Function at 0x448208
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x44829c
push 0
mov eax, ebx
call fcn.00405504
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x448277
mov eax, esi
call fcn.00405304
inc eax
push eax
mov eax, esi
call fcn.00405504
push eax
push 1
push 0
mov eax, edi
call fcn.00405504
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x448292
mov ecx, dword [0x4d39cc]
mov dl, 1
mov eax, dword [0x446ec0]
call fcn.0040dec0
call fcn.004049b4
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x449bcc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x449c4c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405044
push 0x105
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.0040ad88
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040eb40
mov edx, dword [ebp - 0x110]
mov eax, dword [ebp - 4]
call fcn.00405098
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449c53
lea eax, [ebp - 0x110]
call fcn.00405044
ret
Function at 0x449d84
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
mov eax, dword [ebp - 8]
call fcn.004054f4
xor eax, eax
push ebp
push 0x449f1f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x449dc8
lea edx, [ebp - 8]
xor eax, eax
call fcn.00402f58
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
call fcn.00405504
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x449df5
mov eax, dword [ebp - 0xc]
mov edx, 0x449f34
call fcn.00405098
jmp 0x449efc
mov eax, dword [ebp - 0x14]
call fcn.00402b20
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x449ef5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00405504
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x449f38
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
shr eax, 0x10
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
and eax, 0xffff
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
shr eax, 0x10
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
and eax, 0xffff
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x24]
call fcn.00409ea8
push dword [ebp - 0x34]
push 0x449f44
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0x28]
call fcn.00409ea8
push dword [ebp - 0x38]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.004053c4
cmp byte [ebp - 1], 0
je 0x449edc
mov eax, dword [ebp - 0xc]
push dword [eax]
push 0x449f44
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
call fcn.00409ea8
push dword [ebp - 0x3c]
push 0x449f44
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x30]
call fcn.00409ea8
push dword [ebp - 0x40]
mov eax, dword [ebp - 0xc]
mov edx, 5
call fcn.004053c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449efc
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.00402b50
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449f26
lea eax, [ebp - 0x40]
mov edx, 4
call fcn.00405068
lea eax, [ebp - 8]
call fcn.00405044
ret
Function at 0x44a120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004054f4
mov eax, dword [ebp - 8]
call fcn.004054f4
xor eax, eax
push ebp
push 0x44a2a5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x44a275
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x44a264
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
mov eax, dword [ebp - 4]
call fcn.00405504
push eax
mov eax, dword [0x4d4668]
push eax
call sub.kernel32.dll_FindResourceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x4d4668]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44a21e
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x4d4668]
push eax
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x168]
xor edx, edx
xor eax, eax
call fcn.004498bc
lea eax, [ebp - 0x168]
mov edx, dword [ebp - 8]
call fcn.0040530c
mov edx, dword [ebp - 0x168]
lea eax, [ebp - 0x164]
call fcn.00403354
mov edx, 1
lea eax, [ebp - 0x164]
call fcn.004039f0
call fcn.00402cac
push 0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x164]
call fcn.004034b0
call fcn.00402cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a26b
xor eax, eax
push ebp
push 0x44a259
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x14], 0
je 0x44a24f
lea eax, [ebp - 0x164]
call fcn.004034d0
call fcn.00402cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44a263
ret
Function at 0x44aa44
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
xor edx, edx
mov dword [ebp - 0x200], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
mov edx, dword [0x44a4c4]
call fcn.00405a48
xor eax, eax
push ebp
push 0x44abd5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [0x4d3d80]
mov edx, dword [edx]
call fcn.004050dc
lea eax, [ebp - 0x1fc]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0x40
lea eax, [ebp - 0x6c]
push eax
call sub.wsock32.dll_gethostname
inc eax
je 0x44aab6
lea eax, [ebp - 8]
lea edx, [ebp - 0x6c]
mov ecx, 0x40
call fcn.004052b4
cmp dword [ebp - 8], 0
jne 0x44aac9
lea eax, [ebp - 8]
mov edx, 0x44abe8
call fcn.004050dc
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
jne 0x44aba6
mov eax, dword [0x4d38e8]
cmp byte [eax], 0
jne 0x44aba6
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
call fcn.004050dc
lea eax, [ebp - 0x24]
mov edx, 0x44abf8
call fcn.004050dc
lea eax, [ebp - 0x20]
mov edx, dword [0x4d3d80]
mov edx, dword [edx]
call fcn.004050dc
mov byte [ebp - 0x1c], 0
lea eax, [ebp - 0x18]
mov edx, dword [0x4d0d20]
call fcn.004050dc
mov eax, dword [0x4d0d24]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x2c], 1
lea edx, [ebp - 0x200]
mov eax, dword [0x4d6850]
call fcn.0040983c
mov eax, dword [ebp - 0x200]
mov edx, dword [0x4d0d34]
call fcn.00405450
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x44ab7b
lea eax, [ebp - 0x24]
mov edx, dword [0x4d0d34]
call fcn.004050dc
mov byte [ebp - 0x1c], 1
lea eax, [ebp - 0x18]
mov edx, dword [0x4d0d20]
call fcn.004050dc
lea eax, [ebp - 0x24]
mov edx, dword [0x4d6850]
call fcn.004050dc
lea eax, [ebp - 0x20]
mov edx, dword [0x4d6854]
call fcn.004050dc
mov byte [ebp - 0x1c], 1
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.0044ac08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44abdc
lea eax, [ebp - 0x200]
call fcn.00405044
lea eax, [ebp - 0x2c]
mov edx, dword [0x44a4c4]
call fcn.00405b18
lea eax, [ebp - 8]
call fcn.00405044
ret
Function at 0x44c35c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x44c482
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x44c45d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x427f60]
call fcn.00428060
mov dword [ebp - 8], eax
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.00428100
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 0x20019
mov eax, dword [0x4d3f24]
cmp dword [eax], 2
jne 0x44c3ed
lea edx, [ebp - 0x10]
mov eax, dword [0x4d3c74]
mov eax, dword [eax]
call fcn.0040a330
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x44c49c
call fcn.00405350
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.004288c4
test al, al
je 0x44c44b
mov byte [ebp - 1], 1
jmp 0x44c44b
xor eax, eax
push ebp
push 0x44c441
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, 0x44c4c8
mov eax, dword [ebp - 8]
call fcn.00428164
lea edx, [ebp - 0x14]
mov eax, 0x7d0
call fcn.0040a330
lea eax, [ebp - 0x14]
mov edx, 0x44c508
call fcn.0040530c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0042881c
test al, al
je 0x44c437
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44c44b
mov eax, dword [ebp - 8]
call fcn.00404214
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44c467
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c489
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405068
ret
Function at 0x44c510
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x44c67f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4d3f24]
cmp dword [eax], 2
je 0x44c546
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44c689
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
jne 0x44c597
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x44c597
lea eax, [ebp - 8]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x44c675
xor eax, eax
push ebp
push 0x44c66e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x400
call fcn.00402b20
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x400
mov eax, dword [ebp - 0xc]
push eax
push 2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_GetTokenInformation
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x19], al
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp byte [ebp - 0x19], 0
je 0x44c658
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x4d0d58]
push eax
mov eax, dword [0x4d0d54]
push eax
push 2
push 0x4d0d4c
call sub.advapi32.dll_AllocateAndInitializeSid
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
test eax, eax
jl 0x44c64f
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
mov eax, dword [eax + edx*8 + 4]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x44c647
mov byte [ebp - 1], 1
jmp 0x44c64f
inc dword [ebp - 0x18]
dec dword [ebp - 0x20]
jne 0x44c629
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_FreeSid
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c675
mov eax, dword [ebp - 0xc]
call fcn.00402b50
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44c689
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4522f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405504
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x45231a
test byte [ebp - 0xc], 0x10
jne 0x45231e
xor eax, eax
jmp 0x452320
mov al, 1
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x454f84
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x12c], 0
jne 0x454fba
cmp dword [eax + 0x128], 0
jne 0x454fba
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov dword [eax + 0x84], 0x5000
jmp 0x4550bb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x12c], 0
jne 0x454fdb
cmp dword [eax + 0x128], 0
jbe 0x4550bb
jmp 0x454fe1
jle 0x4550bb
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov ecx, dword [ecx - 4]
sub eax, dword [ecx + 0x128]
sbb edx, dword [ecx + 0x12c]
cmp edx, 0
jne 0x45500b
cmp eax, 0x3e8
jbe 0x45504f
jmp 0x45500d
jle 0x45504f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x84], 0x1f4
jle 0x45504f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
fild dword [eax + 0x84]
fld xword [0x455138]
fmulp st(1)
call fcn.00403034
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x84], eax
jmp 0x4550bb
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov ecx, dword [ecx - 4]
sub eax, dword [ecx + 0x128]
sbb edx, dword [ecx + 0x12c]
cmp edx, 0
jne 0x455079
cmp eax, 0x3e8
jae 0x4550bb
jmp 0x45507b
jge 0x4550bb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x84], 0x1400000
jge 0x4550bb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
fild dword [eax + 0x84]
fld xword [0x455144]
fmulp st(1)
call fcn.00403034
mov edx, dword [ebp + 8]
mov edx, dword [edx + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x84], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x84]
cdq
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov ecx, dword [ecx - 4]
cmp edx, dword [ecx + 0x15c]
jne 0x4550e6
cmp eax, dword [ecx + 0x158]
jbe 0x455119
jmp 0x4550e8
jle 0x455119
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x84]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
add eax, 0x160
mov ecx, 1
mov edx, dword [0x4530f8]
call fcn.00406528
add esp, 4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov dword [eax + 0x128], 0xffffffff
mov dword [eax + 0x12c], 0xffffffff
pop ebp
ret