joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100680ed
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1006810f
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1006810f
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1006810f
ret
cmp word [ebx + 4], 0x14c
jne 0x1006810f
test word [ebx + 0x16], 2
je 0x1006810f
test word [ebx + 0x16], 0x100
je 0x1006810f
cmp word [ebx + 0x18], 0x10b
jne 0x1006810f
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1006810f
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1006819b
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1006812f
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1004f07a
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1006810f
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x1006819b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1006810f
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1006810f
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1006810f
ret
cmp word [ebx + 4], 0x14c
jne 0x1006810f
test word [ebx + 0x16], 2
je 0x1006810f
test word [ebx + 0x16], 0x100
je 0x1006810f
cmp word [ebx + 0x18], 0x10b
jne 0x1006810f
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x1006810f
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x1006819b
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x1006812f
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1004f07a
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1006810f
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x10068252
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100682ab
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10068252
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10068261
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1046df04
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100682b2
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1004f128
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10068351
add edi, 4
add eax, 2
dec ecx
jne 0x10068297
call 0x100682fe
loope 0x100682f4
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1006834e
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1006835f
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10068312
cmp eax, ecx
ja 0x10068312
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1006839c
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10068392
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1004f607
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10068261
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x100682ab
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10068252
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10068261
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1046df04
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x100682b2
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1004f128
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10068351
add edi, 4
add eax, 2
dec ecx
jne 0x10068297
call 0x100682fe
loope 0x100682f4
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1006834e
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1006835f
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10068312
cmp eax, ecx
ja 0x10068312
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1006839c
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10068392
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1004f607
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x78b337c3
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x69852009
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xe486faf
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x38dd7ced
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x404a00
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x47d084]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
xor esi, esi
or eax, 0x2001f
lea ebx, [esp + 0x18]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call fcn.00404c70
mov ebx, eax
cmp ebx, esi
je 0x404a62
cmp dword [esp + 0x10], esi
je 0x404a5e
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x404ad8
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x404a80
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.00404a00
mov dword [esp + 0x24], eax
cmp eax, esi
jne 0x404aef
lea eax, [esp + 0x28]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x44]
push eax
push esi
push dword [esp + 0x2c]
mov dword [esp + 0x3c], 0x100
call ebx
test eax, eax
je 0x404a6a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x10], esi
je 0x404abb
push dword [esp + 0x10]
call ebx
mov dword [esp + 0x10], esi
push dword [esp + 0x20]
mov dword [esp + 0x18], esi
call fcn.00404992
mov edi, eax
cmp dword [esp + 0x10], esi
je 0x404ad6
push dword [esp + 0x10]
call ebx
mov eax, edi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00410cf1
mov esp, ebp
pop ebp
ret 4
cmp dword [esp + 0x10], esi
je 0x404aff
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
jmp 0x404ad8
Function at 0x407742
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x459ff3
call fcn.0045381c
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov edi, edx
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x41c], eax
cmp eax, esi
jne 0x40779a
call fcn.00406512
mov esi, eax
jmp 0x4078a4
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x4077b3
call fcn.00406512
jmp 0x407896
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x420], eax
cmp eax, esi
je 0x4077a9
push edi
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x424], edi
cmp eax, edi
jae 0x4077f0
mov esi, 0x8007000e
jmp 0x407898
xor ecx, ecx
shld ecx, eax, 1
add eax, eax
mov byte [ebp - 4], 2
cmp ecx, esi
ja 0x407805
cmp eax, 0xffffffff
jbe 0x40780f
push 0x80070216
call fcn.0040529c
cmp eax, 0x400
jbe 0x40783c
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.0040699d
jmp 0x407848
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], esi
je 0x4077e6
push edi
push dword [ebp - 0x418]
push edi
push dword [ebp - 0x420]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
je 0x4077a9
mov edx, dword [ebp - 0x418]
push dword [ebp + 0x10]
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, dword [ebp - 0x418]
lea edx, [ebp - 0x42c]
call fcn.004075e2
mov esi, eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x4078bd
lea eax, [ebp - 0x418]
call fcn.004064fc
mov eax, esi
call fcn.00453878
ret 0xc
Function at 0x40b0f5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b159
cmp dword [ebp + 0xc], 1
je 0x40b131
cmp dword [ebp + 0xc], 2
je 0x40b131
push 0xd
pop eax
jmp 0x40b159
mov eax, dword [ebp - 4]
test edi, edi
je 0x40b153
test eax, eax
je 0x40b14e
test al, 1
jne 0x40b12c
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x40b153
jmp 0x40b12c
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x4109c4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x47f0e0], 0
push esi
push edi
jne 0x41093a
call fcn.004108a6
test eax, eax
je 0x41097f
mov eax, dword [0x47f0e0]
cmp eax, 1
jne 0x41095b
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41097f
jmp 0x4109c1
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x4109c1
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x410983
xor eax, eax
jmp 0x4109c1
mov eax, dword [esi]
push dword [0x47f0e0]
call edi
mov edi, eax
test edi, edi
je 0x4109a5
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4109c1
lea edi, [esi + 0xff0]
push esi
push dword [0x47f0e0]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x4109ab
mov eax, esi
pop edi
pop esi
ret
jmp 0x410926

Function at 0x410cf1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47d084]
jne 0x410cfb
repz ret
jmp fcn.00413f82
Function at 0x41e67b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47d084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004170bb
and dword [ebp - 0x14], 0
cmp dword [0x47ff24], 0
mov dword [ebp - 0x18], eax
jne 0x41e72e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41e7d6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x45ccb4
push ebx
call edi
test eax, eax
je 0x41e7d6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x47ff24], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x47ff28], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x47ff2c], eax
call edi
push eax
call esi
mov dword [0x47ff34], eax
test eax, eax
je 0x41e72e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x47ff30], eax
mov eax, dword [0x47ff30]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41e787
cmp dword [0x47ff34], ecx
je 0x41e787
push eax
call esi
push dword [0x47ff34]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41e787
test ebx, ebx
je 0x41e787
call edi
test eax, eax
je 0x41e77e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41e77e
test byte [ebp - 8], 1
jne 0x41e787
or dword [ebp + 0x10], 0x200000
jmp 0x41e7ba
mov eax, dword [0x47ff28]
cmp eax, dword [ebp - 0x18]
je 0x41e7ba
push eax
call esi
test eax, eax
je 0x41e7ba
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41e7ba
mov eax, dword [0x47ff2c]
cmp eax, dword [ebp - 0x18]
je 0x41e7ba
push eax
call esi
test eax, eax
je 0x41e7ba
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x47ff24]
call esi
test eax, eax
je 0x41e7d6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41e7d8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410cf1
leave
ret
Function at 0x42fcff
Capabilities:
Resume thread

Disassembly:
push 0x20
mov eax, 0x4585a0
call fcn.0045377d
mov edi, ecx
cmp dword [ebp + 8], 0
je 0x42fecd
mov eax, dword [ebx]
push ebx
call dword [eax + 4]
lea esi, [ebx + 4]
cmp dword [esi], edi
je 0x42fd29
call fcn.00403fe4
mov esi, dword [esi]
xor edi, edi
cmp esi, edi
je 0x42fd38
mov eax, dword [esi]
push ebx
push esi
call dword [eax + 0xc]
mov dword [ebp - 0x28], 0x61
mov dword [ebp - 0x20], 0x10
mov dword [ebp - 0x14], 0x50
mov dword [ebp - 0x20], 0x21
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x18], 0xd
mov eax, dword [ebp - 0x14]
push 0x13
pop ecx
sub ecx, eax
mov eax, dword [ebp - 0x20]
sub ecx, eax
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x20]
sub eax, 0x4d
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp eax, ecx
jl 0x42fda3
mov eax, dword [ebp - 0x18]
cdq
push 0xe
pop ecx
idiv ecx
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
imul eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
lea esi, [ebx + 8]
cmp dword [esi], eax
je 0x42fdb6
mov edi, eax
call fcn.00403fe4
xor edi, edi
mov esi, dword [esi]
cmp esi, edi
je 0x42fdcf
push edi
push dword [0x47e970]
push esi
call fcn.0044d555
add esp, 0xc
mov dword [ebx + 0xc], eax
call fcn.0043f8da
lea ecx, [ebp - 0x1c]
push ecx
push 0x45b408
mov dword [ebx + 0x14], eax
mov eax, dword [ebx]
push ebx
mov dword [ebp - 0x1c], edi
call dword [eax]
mov dword [ebp - 4], edi
fld qword [0x4778f0]
fst qword [ebp - 0x2c]
push 8
fld qword [ebp - 0x2c]
fmul qword [ebp - 0x2c]
fsub qword [0x4778e8]
fadd qword [ebp - 0x2c]
fadd qword [ebp - 0x2c]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
fsub qword [ebp - 0x2c]
fadd qword [0x477878]
fadd qword [ebp - 0x2c]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
fmul qword [0x4778e0]
fsub qword [ebp - 0x2c]
fadd qword [0x4778d8]
fld qword [ebp - 0x2c]
fmul qword [0x4778d0]
fdiv qword [0x477888]
faddp st(1)
fsub qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
fmul qword [0x4778c8]
faddp st(1)
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
fadd qword [ebp - 0x2c]
fstp qword [ebp - 0x2c]
fdivr qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
fmul qword [ebp - 0x2c]
fsubp st(1)
fadd qword [0x4778c0]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
fmul qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
fsub qword [ebp - 0x2c]
faddp st(1)
fadd qword [ebp - 0x2c]
fstp qword [ebp - 0x2c]
call fcn.00412511
mov esi, eax
pop ecx
cmp esi, edi
je 0x42fea2
mov eax, dword [ebp - 0x1c]
push esi
push eax
mov dword [esi], edi
mov dword [esi + 4], edi
call fcn.0043f264
mov dword [esi + 4], eax
jmp 0x42fea4
xor esi, esi
push ebx
push 0x42fb31
mov dword [ebx + 0x18], esi
call fcn.0043f601
push eax
mov dword [ebx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
cmp eax, edi
je 0x42fecd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.00453855
ret 4
Function at 0x4382fa
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, eax
call fcn.00436fc3
test al, al
jne 0x438313
xor al, al
jmp 0x4383de
inc dword [esi + 0x1c]
fld qword [0x4778f0]
fst qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [ebp - 8]
fsub qword [0x4778e8]
fadd qword [ebp - 8]
fadd qword [ebp - 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fsub qword [ebp - 8]
fadd qword [0x477878]
fadd qword [ebp - 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4778e0]
fsub qword [ebp - 8]
fadd qword [0x4778d8]
fld qword [ebp - 8]
fmul qword [0x4778d0]
fdiv qword [0x477888]
faddp st(1)
fsub qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4778c8]
faddp st(1)
fstp qword [ebp - 8]
fld qword [ebp - 8]
fadd qword [ebp - 8]
fstp qword [ebp - 8]
fdivr qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [ebp - 8]
fsubp st(1)
fadd qword [0x4778c0]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [ebp - 8]
fld qword [ebp - 8]
fsub qword [ebp - 8]
faddp st(1)
fadd qword [ebp - 8]
cmp dword [esi + 0x14], 0
fstp qword [ebp - 8]
jne 0x43830c
push dword [esi + 0x10]
and dword [esi + 0x18], 0
call fcn.00441027
push esi
push 0x43825c
call fcn.0043f601
push eax
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
cmp dword [esi + 0x14], eax
setne al
pop esi
leave
ret

Function at 0x43c07b
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 8
mov ebx, eax
jb 0x43c08b
mov eax, dword [esi]
jmp 0x43c08d
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43c09c
xor al, al
jmp 0x43c0c6
test bl, 3
jne 0x43c0a5
mov al, 1
jmp 0x43c0c6
cmp dword [esi + 0x14], 8
jb 0x43c0ad
mov esi, dword [esi]
push esi
call fcn.004400d4
test eax, eax
je 0x43c0bc
and ebx, 2
jmp 0x43c0bf
and ebx, 1
xor eax, eax
test ebx, ebx
setne al
pop esi
pop ebx
ret
Function at 0x43f601
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push eax
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret 8

Function at 0x44239c
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
xor eax, eax
push esi
push edi
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea esi, [ebx + 0x10]
call fcn.0043f96e
push esi
call dword [eax + 0x24]
lea edi, [esi + 0x18]
lea esi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebx + 8]
push eax
movsd dword es:[edi], dword [esi]
call fcn.004132a1
mov dword [ebp - 4], 8
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x10], 0x50
mov dword [ebp - 0xc], 0x51
mov dword [ebp - 0x18], 0x1c
mov dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
imul eax, eax, 0xe
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
imul eax, ecx
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x166e
sub ecx, eax
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x14]
sub ecx, eax
add ecx, dword [ebp - 0xc]
push 0x1f
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
cdq
pop ecx
idiv ecx
mov dword [ebp - 0xc], eax
call fcn.0043f8da
push ebx
push 0x442107
mov dword [ebx], eax
call fcn.0043f601
push eax
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
mov eax, ebx
pop esi
leave
ret

Function at 0x442474
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
fld qword [0x4778f0]
mov eax, 0x5a4d
fst qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [ebp - 8]
fsub qword [0x4778e8]
fadd qword [ebp - 8]
fadd qword [ebp - 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fsub qword [ebp - 8]
fadd qword [0x477878]
fadd qword [ebp - 8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4778e0]
fsub qword [ebp - 8]
fadd qword [0x4778d8]
fld qword [ebp - 8]
fmul qword [0x4778d0]
fdiv qword [0x477888]
faddp st(1)
fsub qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4778c8]
faddp st(1)
fstp qword [ebp - 8]
fld qword [ebp - 8]
fadd qword [ebp - 8]
fstp qword [ebp - 8]
fdivr qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [ebp - 8]
fsubp st(1)
fadd qword [0x4778c0]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [ebp - 8]
fld qword [ebp - 8]
fsub qword [ebp - 8]
faddp st(1)
fadd qword [ebp - 8]
fstp qword [ebp - 8]
cmp word [ecx], ax
je 0x44251c
xor eax, eax
leave
ret
fld qword [0x477860]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fsub qword [ebp - 8]
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
fstp qword [ebp - 8]
jne 0x442518
mov eax, dword [eax + ecx + 0x98]
test eax, eax
je 0x442518
add eax, ecx
leave
ret