joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438d70
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.0043c523
push str.2a99a3435953f253239d9145e
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.0043c75a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.059752b9c1f72a31220f31b1027b6
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x438de8
add edi, 0x1000
push edi
push esi
call fcn.0043c8db
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.3fd7179149dd7b752e9dd92539f17
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x438db5
test eax, eax
jne 0x438dff
push edi
push str.0775e6a56e2b502f_d
call fcn.0043c75a
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.fcd72023685512db3dd__d_
call fcn.0043c75a
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x438f00
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
sub esp, 0x30
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.24b166fdc433ab1b3a2b8385fe
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x438fe4
push ebx
push ebp
push edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x38]
xor edx, edx
mov eax, 0xb9
div ecx
xor edx, edx
mov edi, ecx
mov dword [esp + 0x10], 0
mov ebp, eax
mov eax, 0x5d
imul ebp, ecx
div ecx
mov ebx, edx
add ebx, 0xd1
mov dword [esp + 0x14], ebx
test ecx, ecx
jle 0x438f97
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, edi
mov dword [esp + 0x10], eax
jl 0x438f75
mov ebx, dword [esp + 0x14]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0x95
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x438fe1
push ebx
push ebp
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x438fe1
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret
Function at 0x4390d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00444d20
add esp, 0xc
xor esi, esi
call fcn.0043c831
cdq
mov ecx, 0x83
idiv ecx
inc esi
add dl, 0x47
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x439106
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x439187
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x439187
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x270
ret

Function at 0x4391a0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.0c7bbdcdaddd59fbc79df4252c
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x439247
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x439247
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x439260
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x439247
test al, 1
jne 0x439225
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4391f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x439247
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043c2d9
add esp, 0x254
ret
push str.18f7489b7a17b74dd20bb48ff72b69
call fcn.0043c75a
add esp, 4
jmp 0x439247
Function at 0x439270
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
sub esp, 0x30
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.a42dc5952747c35bf2fd02537b
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x439354
push ebx
push ebp
push edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x38]
xor edx, edx
mov eax, 0xad
div ecx
xor edx, edx
mov edi, ecx
mov dword [esp + 0x10], 0
mov ebp, eax
mov eax, 0x4d
imul ebp, ecx
div ecx
mov ebx, edx
add ebx, 0xa0
mov dword [esp + 0x14], ebx
test ecx, ecx
jle 0x439307
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, edi
mov dword [esp + 0x10], eax
jl 0x4392e5
mov ebx, dword [esp + 0x14]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0x17d
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x439351
push ebx
push ebp
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x439351
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret

Function at 0x439360
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
sub esp, 0x30
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.dbab9d8d570b7407ec1994ad
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x439444
push ebx
push ebp
push edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x38]
xor edx, edx
mov eax, 0xe1
div ecx
xor edx, edx
mov edi, ecx
mov dword [esp + 0x10], 0
mov ebp, eax
mov eax, 0xf8
imul ebp, ecx
div ecx
mov ebx, edx
add ebx, 0xc3
mov dword [esp + 0x14], ebx
test ecx, ecx
jle 0x4393f7
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, edi
mov dword [esp + 0x10], eax
jl 0x4393d5
mov ebx, dword [esp + 0x14]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0x14f
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x439441
push ebx
push ebp
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x439441
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret
Function at 0x439530
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4395b1
cmp eax, 0x15
jbe 0x439573
push eax
push str.2e4f185db273924f43bdaa4b3
call fcn.0043c75a
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.6f2917c1c64599337eeb449f57c91
call esi
test eax, eax
jne 0x4395a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.0043c75a
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret

Function at 0x4395c0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
sub esp, 0x30
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.250b772b69ff18c72dfbe39
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4396a1
push ebx
push ebp
push edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x38]
xor edx, edx
mov eax, 0xef
div ecx
xor edx, edx
mov edi, ecx
mov dword [esp + 0x10], 0
mov ebp, eax
mov eax, 0xc4
imul ebp, ecx
div ecx
mov ebx, edx
add ebx, 0x1f
mov dword [esp + 0x14], ebx
test ecx, ecx
jle 0x439654
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, edi
mov dword [esp + 0x10], eax
jl 0x439632
mov ebx, dword [esp + 0x14]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0x162
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x43969e
push ebx
push ebp
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x43969e
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret
Function at 0x439720
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
sub esp, 0x30
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.3765f8833d4117994c43ab1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4397fe
push ebx
push ebp
push edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x38]
xor edx, edx
mov eax, 0xe1
div ecx
xor edx, edx
mov edi, ecx
mov dword [esp + 0x10], 0
mov ebp, eax
mov eax, 0x47
imul ebp, ecx
div ecx
mov ebx, edx
add ebx, 0x7e
mov dword [esp + 0x14], ebx
test ecx, ecx
jle 0x4397b4
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, edi
mov dword [esp + 0x10], eax
jl 0x439792
mov ebx, dword [esp + 0x14]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0x60
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x4397fb
push ebx
push ebp
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x4397fb
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret

Function at 0x4398e0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.4a55f141a595313128f134dd6f0580a
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x439987
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x439987
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x4399a0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x439987
test al, 1
jne 0x439965
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x439932
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x439987
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043c2d9
add esp, 0x254
ret
push str.9583a6cb8d01fb138
call fcn.0043c75a
add esp, 4
jmp 0x439987
Function at 0x4399b0
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x4c
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x44], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea edx, [esp]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
call fcn.0043c831
call fcn.0043c831
call fcn.0043c831
lea eax, [esp]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x4c
ret

Function at 0x439a20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00444d20
add esp, 0xc
xor esi, esi
call fcn.0043c831
cdq
mov ecx, 0xa8
idiv ecx
inc esi
add dl, 0x1b
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x439a56
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x439ad7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x439ad7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x270
ret

Function at 0x439af0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x453d93
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x467334]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.0042a300
xor ebx, ebx
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], ebx
mov byte [esi + 0x20], bl
push ebx
mov dword [esi + 0x18], ebx
call fcn.0043cb47
mov dword [esp + 0x18], 1
mov dword [esi + 0x38], ebx
add esp, 4
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
call fcn.00403c90
test eax, eax
je 0x439b59
call fcn.00438a50
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x43c2d9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x467334]
jne 0x43c2e3
repz ret
jmp fcn.0044378e

Function at 0x44b885
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00444e0c
and dword [ebp - 4], 0
cmp dword [0x469848], 0
mov ebx, eax
jne 0x44b936
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44b9e7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x459f1c
push edi
call esi
test eax, eax
je 0x44b9e7
push eax
call fcn.00444d9a
mov dword [esp], 0x459f0c
push edi
mov dword [0x469848], eax
call esi
push eax
call fcn.00444d9a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x46984c], eax
call esi
push eax
call fcn.00444d9a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x469850], eax
call esi
push eax
call fcn.00444d9a
pop ecx
mov dword [0x469858], eax
test eax, eax
je 0x44b936
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00444d9a
pop ecx
mov dword [0x469854], eax
mov eax, dword [0x469854]
cmp eax, ebx
je 0x44b98e
cmp dword [0x469858], ebx
je 0x44b98e
push eax
call fcn.00444e15
push dword [0x469858]
mov esi, eax
call fcn.00444e15
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44b98e
test edi, edi
je 0x44b98e
call esi
test eax, eax
je 0x44b985
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44b985
test byte [ebp - 0xc], 1
jne 0x44b98e
or dword [ebp + 0x10], 0x200000
jmp 0x44b9c7
mov eax, dword [0x46984c]
cmp eax, ebx
je 0x44b9c7
push eax
call fcn.00444e15
pop ecx
test eax, eax
je 0x44b9c7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44b9c7
mov eax, dword [0x469850]
cmp eax, ebx
je 0x44b9c7
push eax
call fcn.00444e15
pop ecx
test eax, eax
je 0x44b9c7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x469848]
call fcn.00444e15
pop ecx
test eax, eax
je 0x44b9e7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44b9e9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret

Function at 0x411014
Capabilities:
Terminate process

Disassembly:
jmp 0x411530
jmp fcn.00411c90
cmp ecx, dword [section..data]
jne 0x41153a
repz ret
jmp 0x411082
Function at 0x40289f
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x402903
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x4028ec
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x4028db
xor ecx, eax
xor edx, ebx
dec edi
jne 0x4028cc
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x41db96
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
push eax
push ecx
push edx
push ebx
push esi
push edi
nop
nop
nop
push ebx
push ecx
push edx
mov eax, reloc.OLEAUT32.dll_SysStringLen
cpuid
shr ecx, 0x10
mov esi, ecx
nop
pop edx
pop ecx
pop ebx
nop
push ebx
push ecx
push edx
mov eax, reloc.WS2_32.dll_getpeername
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x64]
add esi, eax
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, al
add esi, ebx
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, cl
add esi, ebx
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, dl
add esi, ebx
nop
imul esi, esi, 0x666
mov dword [ebp - 4], esi
nop
pop edi
pop esi
pop ebx
pop edx
pop ecx
pop eax
mov eax, dword [ebp - 4]
jmp 0x41dc33
mov esp, ebp
pop ebp
ret