joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c16d
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x41c244
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41c1e9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x41c1dd
mov byte [ebp - 1], 0
push 0x7717
push 0
push 1
lea eax, [ebp - 1]
push eax
push 0x338f
push 0x54b
push 0x5be4
push 1
call fcn.0041d474
add esp, 0x20
jmp 0x41c1e7
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x41c242
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x41c221
push 0
push 0x148d
push 0x1bfa
push 0
push 0x107f
push 0x2146
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
jmp 0x41c242
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x41c242
push 1
push 0
call fcn.00418026
pop ecx
pop ecx
jmp 0x41c290
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x41c26a
push 1
push 0x5695
call fcn.0041bef3
pop ecx
pop ecx
jmp 0x41c290
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 0x2cd8
push 1
push 0
push dword [ebp - 0x34]
push 0x424b
push 1
push 0x9cb
call fcn.004205c7
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x41ee42
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x41eedd
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x41eed0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x41ee90
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
jmp 0x41eece
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x41eece
push 0
push 0xffb
push 0x17aa
push 0xc41
push 0x227d
push 0x1085
push 0xf24
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x41eedb
push 0
push 1
call fcn.0041792c
pop ecx
pop ecx
jmp 0x41eef2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
push 1
push dword [ebp - 0x20]
push 1
call fcn.00413fb9
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x41fa10
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x41fb90
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41fac6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41fa91
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov eax, dword [eax]
and dword [eax + 0x10], 0
jmp 0x41fac1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x41fac1
push 0x7823
push 1
push 1
push 1
push 0
push 0x3229
call fcn.00413f14
add esp, 0x18
jmp 0x41fb8e
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x41fb12
push 0
push 0xffb
push 0x17aa
push 0xc41
push 0x227d
push 0x1085
push 0xf24
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x41fb8e
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x41fb4c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xf
jg 0x41fb8e
mov dword [ebp - 0x68], 0xeec7
push 0x1754
push 0x5ccb
push 0
push 0x4eb4
push 0x232f
push 0x26dc
push dword [ebp - 0x60]
push dword [ebp - 0x64]
call fcn.00420e42
add esp, 0x20
cmp dword [ebp - 0x68], 0
je 0x41fb8c
jmp 0x41fb8e
jmp 0x41fb41
jmp 0x41fb9e
push 0x65e8
push 0
call fcn.0041f249
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42ffb5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 8]
test eax, eax
je 0x43000c
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x1c]
call fcn.004300ae
add esp, 0x1c
jmp 0x4300aa
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x430072
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x430052
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
jmp 0x430070
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x430070
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4300aa
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x430091
push 0x1cd7
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x4300aa
mov byte [ebp - 1], 0
push 0
push 0
lea eax, [ebp - 1]
push eax
push 0x2208
call fcn.004321ac
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x43085d
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x430916
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4308ab
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 0x4ac4
push 1
call fcn.00430970
add esp, 0xc
jmp 0x430914
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4308ec
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x4308ea
push 1
push 0x5dff
push 1
push 0
call fcn.00437618
add esp, 0x10
jmp 0x430914
push 0
push 0xffb
push 0x17aa
push 0xc41
push 0x227d
push 0x1085
push 0xf24
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x43096c
lea eax, [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push 0
push dword [ebp - 0x28]
push 1
push 0x5c7
push 0x4dc
push dword [ebp - 0x2c]
push 0x20e7
push 0x7a97
push dword [ebp - 0x30]
push 0x4c61
push dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
push eax
call fcn.00434517
add esp, 0x30
mov esp, ebp
pop ebp
ret
Function at 0x431621
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4316cd
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4316ab
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x431694
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x431692
push 0x2429
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x4316a9
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [eax], 0x27
jmp 0x4316c8
push 1
push 0x3612
push 0x545
push 0x4617
push 1
push 1
call fcn.0042d0b6
add esp, 0x18
jmp 0x431791
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x43177e
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x43174e
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x43174c
push 1
push 0x7915
push 1
push 0x47ff
push 0
push 0x7cf6
push 0x183e
push 0x2a89
call fcn.0042e123
add esp, 0x20
jmp 0x43177c
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x43177c
push 0
push 0x5da8
push 0x5262
push 1
push 0
call fcn.00432809
add esp, 0x14
jmp 0x431791
push 0x29ea
push 0
push 0
push 1
call fcn.0042c8e4
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x43194f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x43197f
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
push 0x7a60
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
push eax
push 1
call fcn.00431a1c
add esp, 0xc
jmp 0x431a17
lea eax, [ebp + 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4319bb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 1
push dword [ebp - 0x10]
call fcn.0042fac9
pop ecx
pop ecx
jmp 0x431a17
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4319e3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x431a17
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
call fcn.004649f2
mov esi, eax
mov ecx, dword [ebp - 0x34]
call fcn.004043d2
mov ecx, eax
mov eax, esi
xor edx, edx
div ecx
mov eax, dword [ebp - 0x38]
mov dword [eax], edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4334b1
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x4334eb
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push 1
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
call fcn.00433574
add esp, 0x14
jmp 0x433570
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43351d
push 0x7dd2
push 1
call fcn.00428607
pop ecx
pop ecx
jmp 0x433570
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x433550
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [eax], 0xfffffff8
jmp 0x433570
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x433570
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret
Function at 0x437644
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x437761
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43773a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43772e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4376b8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xb
jl 0x43772c
mov dword [ebp - 0xc], 0xfffffffb
mov byte [ebp - 1], 0
push 0x1f8a
push 0x335a
push 1
push 1
push 0
push 0x3029
lea eax, [ebp - 1]
push eax
push 1
push 0x8cd
push 0x2542
push 0x3ea5
call fcn.004339ce
add esp, 0x2c
mov dword [ebp - 0xc], 0
jmp 0x43770d
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x43772a
push 0
push 0
push 0x4ba6
push 1
push 1
call fcn.00438048
add esp, 0x14
jmp 0x437706
jmp 0x4376ad
jmp 0x437738
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
jmp 0x43775f
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x437759
push 0x1cd7
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x43775f
call dword [sym.imp.USER32.dll_CreatePopupMenu]
jmp 0x437798
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x34]
push 0x50e4
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 1
call fcn.0043369a
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x43c91d
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x43ca1c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43c9f9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43c9c3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 3
jmp 0x43c98d
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x43c9c1
mov dword [ebp - 0x24], 0x8144ad72
push 1
push 0x279d
push 0x2179
push 1
push 0
push 0x266d
lea eax, [ebp - 0x24]
push eax
push 1
call fcn.00437c91
add esp, 0x20
jmp 0x43c982
jmp 0x43c9f7
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43c9f7
push 0
push 0xffb
push 0x17aa
push 0xc41
push 0x227d
push 0x1085
push 0xf24
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x43ca1a
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
push 0x77af
push dword [ebp - 0x2c]
push 0x5a3c
push 0
push 0
push 1
call fcn.00439096
add esp, 0x18
jmp 0x43ca35
push 0x3091
push 1
push 0x5917
push 0x1c85
call fcn.0042e7f7
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x468053
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x47602f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x489484]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00465ec4
mov dword [ebp - 0x14], eax
cmp dword [0xa83df0], esi
jne 0x476122
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4760af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x476202
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x476202
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x476202
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xa83df0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xa83df4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xa83df8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xa83e00], eax
test eax, eax
je 0x47611f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xa83dfc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x476147
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x47613a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x47615c
push 4
pop eax
jmp 0x476204
cmp dword [ebp - 0x14], esi
je 0x47615c
push dword [0xa83df0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x476141
mov eax, dword [0xa83dfc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4761ba
cmp dword [0xa83e00], edi
je 0x4761ba
push eax
call ebx
push dword [0xa83e00]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4761ba
test eax, eax
je 0x4761ba
call ecx
test eax, eax
je 0x4761af
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4761af
test byte [ebp - 8], 1
jne 0x4761ba
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4761ea
mov eax, dword [0xa83df4]
cmp eax, edi
je 0x4761e7
push eax
call ebx
test eax, eax
je 0x4761e7
call eax
mov esi, eax
test esi, esi
je 0x4761e7
mov eax, dword [0xa83df8]
cmp eax, edi
je 0x4761e7
push eax
call ebx
test eax, eax
je 0x4761e7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xa83df0]
call ebx
test eax, eax
je 0x476202
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x476204
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046536b
mov esp, ebp
pop ebp
ret
Function at 0x44f769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x453190
cmp edx, dword [eax]
je 0x44f78b
add eax, 8
inc ecx
cmp eax, 0x453220
jl 0x44f77c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x453190]
jne 0x44f8b9
mov eax, dword [0x453bb0]
cmp eax, 1
je 0x44f893
test eax, eax
jne 0x44f7bc
cmp dword [0x4530e4], 1
je 0x44f893
cmp edx, 0xfc
je 0x44f8b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x44f7f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00450670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00450490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x44f836
lea eax, [ebp - 0x1a4]
push eax
call fcn.00450490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x45245c
push edi
call fcn.00450f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00450670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00450680
lea eax, [ebp - 0xa0]
push 0x45243c
push eax
call fcn.00450680
push dword [esi + 0x453194]
lea eax, [ebp - 0xa0]
push eax
call fcn.00450680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00450e75
add esp, 0x2c
pop edi
jmp 0x44f8b9
lea eax, [ebp + 8]
lea esi, [esi + 0x453194]
push 0
push eax
push dword [esi]
call fcn.00450490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x409f2ad0
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x6ee33cc0
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219