joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436240
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x436248
push ecx
push ebx
xor eax, eax
push ebp
push 0x4363b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x456534]
mov ecx, dword [ecx]
mov edx, dword [0x456720]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.004046e4
mov eax, dword [ebp - 8]
call fcn.004446c8
test al, al
je 0x43639a
push 0x4363cc
mov eax, dword [0x456720]
push dword [eax]
mov eax, dword [0x45664c]
push dword [eax]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404758
mov eax, dword [ebp - 0xc]
call fcn.0043efa0
lea edx, [ebp - 0x10]
mov eax, 0x4363e8
call fcn.00443b8c
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.004491c0
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
pop ecx
call fcn.004046e4
lea edx, [ebp - 0x18]
mov eax, 4
call fcn.00448ad4
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004447b8
push 0
mov eax, dword [0x456554]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_TerminateThread
call fcn.004361a8
push 0
push 0
mov ecx, dword [0x45664c]
mov ecx, dword [ecx]
mov edx, dword [0x456720]
mov edx, dword [edx]
lea eax, [ebp - 0x1c]
call fcn.004046e4
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [0x456534]
mov ecx, dword [ecx]
mov edx, dword [0x456720]
mov edx, dword [edx]
lea eax, [ebp - 0x20]
call fcn.004046e4
mov eax, dword [ebp - 0x20]
mov ecx, dword [0x456720]
mov ecx, dword [ecx]
pop edx
call fcn.00447770
test eax, eax
jbe 0x43639a
xor ebx, ebx
inc ebx
cmp ebx, 0x1e
jne 0x43637f
push 0x4363f8
mov eax, dword [0x456720]
push dword [eax]
mov eax, dword [0x45664c]
push dword [eax]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404758
mov eax, dword [ebp - 0x24]
call fcn.0043efa0
jmp 0x43639a
mov eax, 0x64
call fcn.00443ad0
mov eax, dword [ebp - 4]
call fcn.004446c8
test al, al
jne 0x43634f
call fcn.00443bd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4363bc
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.004043e0
ret
Function at 0x438e58
Capabilities:
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x438e60
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4390ba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.004490fc
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0x4390d0
call fcn.004046e4
mov eax, dword [ebp - 4]
call fcn.00444bb0
test al, al
je 0x438f30
mov dl, 1
mov eax, 0x4390e4
call fcn.004470c8
mov eax, 0x9c4
call fcn.00443ad0
push 0x4390f8
push dword [ebp - 4]
push 0x43910c
lea edx, [ebp - 0x14]
mov eax, 6
call fcn.00448ad4
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404758
mov edx, dword [ebp - 0x10]
mov eax, 0x439130
call fcn.00444a2c
lea eax, [ebp - 0x18]
mov ecx, 0x439140
mov edx, dword [ebp - 4]
call fcn.004046e4
mov eax, dword [ebp - 0x18]
call fcn.00444bb0
test al, al
je 0x438f30
push 0x439150
push dword [ebp - 4]
push 0x43916c
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404758
mov edx, dword [ebp - 0x1c]
mov eax, 0x439130
call fcn.00444a2c
lea eax, [ebp - 0x20]
call fcn.00449034
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 4]
mov ecx, 0x439180
call fcn.004046e4
mov eax, dword [ebp - 4]
call fcn.00444bb0
test al, al
je 0x438fec
lea eax, [ebp - 4]
call fcn.00449034
mov dl, 1
mov eax, 0x439190
call fcn.004470c8
mov eax, 0x9c4
call fcn.00443ad0
push 0x4390f8
push dword [ebp - 4]
push 0x4391a4
lea edx, [ebp - 0x28]
mov eax, 6
call fcn.00448ad4
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404758
mov edx, dword [ebp - 0x24]
mov eax, 0x439130
call fcn.00444a2c
lea eax, [ebp - 4]
call fcn.004490fc
push 0x4390f8
push dword [ebp - 4]
push 0x4391a4
lea edx, [ebp - 0x30]
mov eax, 6
call fcn.00448ad4
push dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00404758
mov edx, dword [ebp - 0x2c]
mov eax, 0x439130
call fcn.00444a2c
mov dl, 1
mov eax, dword [0x415550]
call fcn.00403668
mov ebx, eax
lea eax, [ebp - 0x34]
call fcn.004490fc
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 4]
mov ecx, 0x4391c4
call fcn.004046e4
mov eax, dword [ebp - 4]
call fcn.00444bb0
test al, al
je 0x439097
lea eax, [ebp - 0x38]
push eax
mov ecx, 0x4391dc
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00447ff8
mov dl, 1
mov eax, 0x4391ec
call fcn.004470c8
mov eax, 0x64
call fcn.00443ad0
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x439090
inc eax
mov dword [ebp - 8], eax
xor esi, esi
lea ecx, [ebp - 0x3c]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x3c]
mov eax, 0x4391dc
call fcn.00404980
test eax, eax
jle 0x43908a
lea ecx, [ebp - 0x40]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x40]
call fcn.0044509c
inc esi
dec dword [ebp - 8]
jne 0x439059
mov eax, ebx
call fcn.00403698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4390c1
lea eax, [ebp - 0x40]
mov edx, 0xe
call fcn.004043e0
lea eax, [ebp - 4]
call fcn.004043bc
ret
Function at 0x439678
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x43985b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x4396b6
lea eax, [ebp - 4]
mov edx, 0x439878
call fcn.00404454
xor ebx, ebx
cmp byte [ebp + 8], 0
je 0x4397c4
xor edi, edi
inc edi
cmp edi, 0xd
je 0x4397c4
lea eax, [ebp - 0xb0]
mov edx, 0x48
call fcn.00425654
call fcn.00439604
mov ecx, eax
xor edx, edx
mov eax, 0x2000000
call fcn.00443e5c
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 1
push 0
call sub.kernel32.dll_InitializeProcThreadAttributeList
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.kernel32.dll_GetProcessHeap
push eax
call sub.kernel32.dll_HeapAlloc
mov esi, eax
mov dword [ebp - 0x6c], esi
lea eax, [ebp - 0x10]
push eax
push 0
push 1
push esi
call sub.kernel32.dll_InitializeProcThreadAttributeList
push 0
push 0
push 4
lea eax, [ebp - 0x14]
push eax
call fcn.004256cc
push eax
push 0
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_UpdateProcThreadAttribute
mov dword [ebp - 0xb0], 0x48
mov word [ebp - 0x80], 0
mov dword [ebp - 0x84], 1
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0xb0]
push eax
push 0
push 0
push 0x80004
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
push 0
call sub.kernel32.dll_CreateProcessA_1
test eax, eax
je 0x4396c4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc0]
call fcn.0042cf40
mov ebx, eax
test bl, bl
je 0x439845
cmp byte [ebp - 9], 0
je 0x4397b4
call fcn.00443bd8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xb8]
mov dword [eax], edx
jmp 0x439845
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x58]
mov edx, 0x44
call fcn.00425654
lea eax, [ebp - 0x68]
mov edx, 0x10
call fcn.00425654
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x28], 0
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x439845
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x68]
call fcn.0042cf40
mov ebx, eax
test bl, bl
je 0x439845
cmp byte [ebp - 9], 0
je 0x43983d
call fcn.00443bd8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x60]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439862
lea eax, [ebp - 4]
call fcn.004043bc
ret
Function at 0x43bcc0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43bd65
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4565b8]
cmp byte [eax], 0
jne 0x43bd4f
mov eax, dword [0x45675c]
cmp byte [eax], 0
jne 0x43bd4f
mov eax, dword [0x4564bc]
cmp byte [eax], 0
jne 0x43bd4f
lea eax, [ebp - 8]
call fcn.0043d6e0
mov eax, dword [ebp - 8]
mov edx, 0x43bd78
call fcn.004047e4
je 0x43bd4f
cmp byte [0x457de0], 0
jne 0x43bd4f
cmp dword [0x457dec], 0
jbe 0x43bd2d
push 0
mov eax, dword [0x457dec]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [0x457de0], 1
push 0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x43bb00
xor edx, edx
xor eax, eax
call fcn.00404370
mov dword [0x457dec], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43bd6c
lea eax, [ebp - 8]
call fcn.004043bc
ret

Function at 0x43bdb4
Capabilities:
Terminate thread

Disassembly:
call fcn.0043a380
cmp dword [0x457dec], 0
jbe 0x43bdcf
push 0
mov eax, dword [0x457dec]
push eax
call sub.kernel32.dll_TerminateThread
mov byte [0x457de0], 0
ret

Function at 0x43d618
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov eax, dword [0x456644]
cmp dword [eax], 0
je 0x43d63c
mov eax, ebx
mov edx, dword [0x456644]
mov edx, dword [edx]
call fcn.00404410
jmp 0x43d676
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x43d65f
mov edx, dword [esp]
dec edx
mov eax, ebx
call fcn.004049c8
jmp 0x43d666
mov eax, ebx
call fcn.004043bc
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.0040462c
add esp, 0x108
pop ebx
ret

Function at 0x43db44
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x43f2e8
Capabilities:
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43f3c8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00443c70
mov edx, dword [ebp - 4]
mov eax, 0x43f3dc
call fcn.00404980
test eax, eax
jle 0x43f394
lea ecx, [ebp - 8]
mov edx, 0x43f3dc
mov eax, dword [ebp - 4]
call fcn.00449378
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
call fcn.00404698
cmp eax, 4
jne 0x43f394
mov eax, 0x43f3e8
call fcn.00408b7c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
mov ecx, 0x43f3f4
mov edx, dword [ebp - 4]
call fcn.004046e4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x1c]
mov ecx, 1
mov eax, 0x43f400
call fcn.004091cc
mov edx, dword [ebp - 0xc]
mov eax, 0x43f440
call fcn.00444a2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f3cf
lea eax, [ebp - 0x20]
call fcn.004043bc
lea eax, [ebp - 0xc]
call fcn.004043bc
lea eax, [ebp - 8]
mov edx, dword [0x4466c8]
call fcn.00405920
lea eax, [ebp - 4]
call fcn.004043bc
ret
Function at 0x440ef0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
mov eax, dword [ebp - 0xc]
call fcn.00404888
xor eax, eax
push ebp
push 0x4410c3
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 0x6c]
mov edx, 0x44
call fcn.00425654
lea eax, [ebp - 0x28]
mov edx, 0x10
call fcn.00425654
mov dword [ebp - 0x6c], 0x44
mov word [ebp - 0x3c], 0
mov dword [ebp - 0x40], 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x440fd5
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x70]
push eax
xor ecx, ecx
mov edx, 0x4410dc
mov eax, dword [ebp - 8]
call fcn.00448c3c
mov eax, dword [ebp - 0x70]
call fcn.00404898
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x440fd5
mov eax, 0x4410e8
call fcn.0043efa0
jmp 0x4410a0
mov ebx, dword [ebp - 0x28]
push 0x40
push 0x1000
mov eax, dword [ebp - 0xc]
call fcn.00404698
push eax
push 0
push ebx
call fcn.00440824
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x441016
push 0x1000
push 0x40
mov eax, dword [ebp - 0xc]
call fcn.00404698
mov ecx, eax
xor edx, edx
mov eax, ebx
call fcn.00444c88
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4410a0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404698
push eax
lea eax, [ebp - 0xc]
call fcn.004048f0
push eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.004408bc
mov eax, dword [ebp - 0xc]
call fcn.00404698
sub eax, 2
cdq
push edx
push eax
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x441062
cmp eax, dword [esp]
pop edx
pop eax
jae 0x441087
jmp 0x441066
pop edx
pop eax
jge 0x441087
mov eax, dword [ebp - 0xc]
call fcn.00404698
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
call fcn.004048f0
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00444434
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.00444df4
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4410ca
lea eax, [ebp - 0x70]
call fcn.004043bc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004043e0
ret
Function at 0x441110
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
xor eax, eax
push ebp
push 0x44132c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 8], 0
je 0x44122b
cmp dword [ebp - 4], 0
jne 0x44115b
lea eax, [ebp - 4]
mov edx, 0x441348
call fcn.00404454
lea eax, [ebp - 0x68]
mov edx, 0x44
call fcn.00425654
lea eax, [ebp - 0x24]
mov edx, 0x10
call fcn.00425654
mov dword [ebp - 0x68], 0x44
mov word [ebp - 0x38], 0
mov dword [ebp - 0x3c], 1
mov eax, dword [ebp - 4]
mov edx, 0x441348
call fcn.004047e4
jne 0x4411e0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404898
mov esi, eax
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x441226
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call sub.kernel32.dll_CreateProcessA
jmp 0x441226
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404898
mov esi, eax
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x441226
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push esi
call sub.kernel32.dll_CreateProcessA
mov esi, dword [ebp - 0x24]
jmp 0x441245
xor ebx, ebx
mov ecx, esi
xor edx, edx
mov eax, 0x1f0fff
call fcn.00443e5c
mov esi, eax
test esi, esi
je 0x441311
push 0x40
push 0x1000
mov eax, dword [ebp - 8]
call fcn.00404698
push eax
push 0
push esi
call fcn.00440824
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x441283
push 0x1000
push 0x40
mov eax, dword [ebp - 8]
call fcn.00404698
mov ecx, eax
xor edx, edx
mov eax, esi
call fcn.00444c88
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x441311
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00404698
push eax
lea eax, [ebp - 8]
call fcn.004048f0
push eax
mov eax, dword [ebp - 0xc]
push eax
push esi
call fcn.004408bc
mov eax, dword [ebp - 8]
call fcn.00404698
sub eax, 2
cdq
push edx
push eax
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4412cf
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4412f4
jmp 0x4412d3
pop edx
pop eax
jge 0x4412f4
mov eax, dword [ebp - 8]
call fcn.00404698
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
call fcn.004048f0
mov ecx, eax
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00444434
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.00444df4
test eax, eax
jbe 0x441311
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x441333
lea eax, [ebp - 8]
mov edx, 2
call fcn.004043e0
ret
Function at 0x442230
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
mov eax, dword [ebp - 0xc]
call fcn.00404888
xor eax, eax
push ebp
push 0x44232c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x457ef0], eax
mov eax, 0x457f04
mov edx, dword [ebp - 4]
call fcn.00404410
mov eax, 0x457f00
mov edx, dword [ebp - 0xc]
call fcn.00404410
lea eax, [ebp - 0x10]
call fcn.00444e44
mov eax, dword [ebp - 8]
call fcn.00404898
call fcn.00443f0c
mov eax, 0x64
call fcn.00443ad0
mov eax, 0x440448
call fcn.00446768
mov edi, eax
xor ebx, ebx
xor esi, esi
cmp dword [0x457ef0], 0
jne 0x4422fe
mov eax, 0x64
call fcn.00443ad0
inc ebx
cmp bx, 0x190
jle 0x4422f5
cmp si, 2
je 0x4422fe
inc esi
push 0
push edi
call sub.kernel32.dll_TerminateThread_1
mov eax, 0x440448
call fcn.00446768
mov edi, eax
xor ebx, ebx
cmp dword [0x457ef0], 0
je 0x4422c6
mov ebx, dword [0x457ef0]
mov eax, dword [ebp - 0x10]
call fcn.00404898
call fcn.00443f0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442333
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004043e0
ret
Function at 0x4428ac
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
xor edx, edx
mov dword [esp], edx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4428e7
push 0
push 0x4429e4
push 0x4429e8
push 0
call sub.user32.dll_MessageBoxA_1
xor edx, edx
mov eax, ebp
call fcn.00444cdc
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
call fcn.00402a30
mov ebx, eax
lea eax, [esp + 8]
push eax
push 0
mov edx, ebx
mov ecx, dword [esp + 0xc]
mov eax, ebp
call fcn.00444d48
test eax, eax
jne 0x44292a
push 0
push 0x4429e4
push 0x4429ec
push 0
call sub.user32.dll_MessageBoxA_1
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x3c]
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x50]
call fcn.00402a30
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x50]
mov eax, dword [esp]
call fcn.00406f30
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x54]
push eax
push ebx
mov eax, dword [esp + 8]
push eax
call fcn.00443ab4
mov eax, dword [esp + 0x10]
mov si, word [eax + 6]
dec esi
test si, si
jb 0x4429c6
inc esi
xor edi, edi
mov edx, dword [esp + 0xc]
mov edx, dword [edx + 0x3c]
mov eax, ebx
add edx, eax
add edx, 0xf8
movzx ecx, di
shl ecx, 3
lea ecx, [ecx + ecx*4]
add edx, ecx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x14]
mov edx, dword [edx + 0x10]
push edx
mov edx, dword [esp + 0x18]
mov edx, dword [edx + 0x14]
add edx, eax
push edx
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0xc]
add eax, dword [esp + 8]
push eax
call fcn.00443ab4
inc edi
dec si
jne 0x44297d
mov edx, dword [esp + 4]
mov eax, ebx
call fcn.00402a60
mov eax, ebp
call fcn.0044405c
mov eax, dword [esp]
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x442a5c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov dword [esp], edx
mov esi, eax
xor eax, eax
mov dword [esp + 4], eax
mov edx, dword [esi + 0x3c]
mov eax, esi
add edx, eax
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
add edx, 0x78
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
mov edx, dword [edx]
add edx, eax
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x1c]
add edx, eax
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x20]
add edx, eax
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x24]
add edx, eax
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov ebx, dword [eax + 0x18]
dec ebx
test ebx, ebx
jb 0x442b46
inc ebx
mov eax, dword [esp + 0x20]
movzx edx, word [eax]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
cmp edx, eax
jbe 0x442ae9
add dword [esp + 0x18], 4
inc eax
cmp edx, eax
ja 0x442adf
mov edx, dword [esp + 0xc]
mov edx, dword [edx]
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
cmp edx, eax
ja 0x442b04
mov ecx, dword [esp + 0xc]
add edx, dword [ecx + 4]
cmp eax, edx
jb 0x442b39
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
add eax, esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
call fcn.00442798
mov ecx, eax
mov edx, dword [esp + 0x24]
xor eax, eax
call fcn.004427ac
cmp eax, dword [esp]
jne 0x442b39
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
add eax, esi
mov dword [esp + 4], eax
jmp 0x442b46
add dword [esp + 0x20], 2
add dword [esp + 0x1c], 4
dec ebx
jne 0x442aca
mov eax, dword [esp + 4]
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x4430c0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
xor eax, eax
push ebp
push 0x44315c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x102
lea eax, [ebp - 0xc]
push eax
mov edx, 0x44316c
xor ecx, ecx
mov eax, 0x80000002
call fcn.004445f0
test eax, eax
jne 0x443141
push 1
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, dword [ebp - 8]
call fcn.00404698
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
mov edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0xc]
call fcn.00443f40
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
call fcn.004445c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443163
lea eax, [ebp - 8]
mov edx, 2
call fcn.004043e0
ret