joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d600
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x41d619
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x41d62a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ebp, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41d60e
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x41d60e
mov eax, dword [esp + 0x18]
push ebp
push eax
mov ecx, esi
call fcn.0041d560
test eax, eax
jg 0x41d68c
push 1
call edi
call ebx
mov ecx, dword [esi + 0x74]
test ecx, ecx
jbe 0x41d640
mov edx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
sub eax, edx
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
shl ecx, 3
cmp eax, ecx
jb 0x41d640
or eax, 0xffffffff
mov dword [esi + 0x1c], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x420c30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xa4
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
call fcn.00417540
lea eax, [esp + 0xb4]
lea ecx, [esp + 0x14]
lea ebx, [esi + 4]
push eax
push ecx
mov ecx, ebx
call fcn.00421580
mov eax, dword [eax]
mov ecx, dword [ebx + 4]
cmp eax, ecx
mov dword [esp + 0x10], eax
je 0x420c7c
mov edx, dword [esp + 0xb4]
mov edi, dword [eax + 0xc]
cmp edx, edi
jb 0x420c7c
lea eax, [esp + 0x10]
jmp 0x420c84
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x14]
mov eax, dword [eax]
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x420dbf
push ebp
push 0
call dword [sym.imp.MSVCRT.dll_time]
mov edx, dword [esp + 0xbc]
mov esi, dword [esp + 0xc8]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0xc0]
mov ecx, 8
lea edi, [esp + 0x48]
mov dword [esp + 0x2c], edx
mov ebp, dword [0x46765c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x30], ecx
lea esi, [esp + 0x2c]
mov ecx, dword [eax]
lea edi, [esp + 0x7c]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x78], edx
mov ecx, dword [eax + 4]
add esp, 4
mov dword [esp + 0x34], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x38], ecx
mov ecx, 0xf
mov eax, dword [eax + 0xc]
mov dword [esp + 0x3c], eax
mov al, 1
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 4]
mov edi, ecx
mov esi, dword [ecx + 4]
cmp esi, ebp
je 0x420d2d
mov eax, dword [esi + 0xc]
mov edi, esi
cmp edx, eax
setb al
test al, al
je 0x420d26
mov esi, dword [esi]
jmp 0x420d29
mov esi, dword [esi + 8]
cmp esi, ebp
jne 0x420d14
mov dl, byte [ebx + 8]
pop ebp
test dl, dl
je 0x420d4a
lea ecx, [esp + 0x70]
lea edx, [esp + 0x14]
push ecx
push edi
push esi
push edx
mov ecx, ebx
call fcn.00421600
jmp 0x420dbf
test al, al
mov dword [esp + 0x10], edi
je 0x420d74
cmp edi, dword [ecx]
jne 0x420d6b
lea eax, [esp + 0x70]
lea ecx, [esp + 0x1c]
push eax
push edi
push esi
push ecx
mov ecx, ebx
call fcn.00421600
jmp 0x420dbf
lea ecx, [esp + 0x10]
call fcn.00421ba0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x70]
mov eax, dword [edx + 0xc]
cmp eax, ecx
jae 0x420da7
lea ecx, [esp + 0xe]
lea edx, [esp + 0x70]
push ecx
push edx
push edi
lea eax, [esp + 0x2c]
push esi
push eax
mov ecx, ebx
mov byte [esp + 0x22], 1
call fcn.00421600
push eax
lea ecx, [esp + 0x70]
jmp 0x420dba
lea ecx, [esp + 0xf]
lea edx, [esp + 0x10]
push ecx
mov byte [esp + 0x13], 0
push edx
lea ecx, [esp + 0x68]
call fcn.00414af0
mov ecx, dword [esp + 0x18]
call fcn.00417550
pop edi
pop esi
pop ebx
add esp, 0xa4
ret 0x10
Function at 0x420f10
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x2c
mov cl, byte [0x46444e]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
lea eax, [esp + 0xc]
push edi
push eax
lea edx, [ebp + 0x1c]
xor ebx, ebx
push ecx
push edx
mov dword [esp + 0x1c], ebx
call fcn.00422350
mov edi, eax
add esp, 0xc
cmp edi, ebx
jne 0x420f49
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c
ret
mov al, byte [0x4676a4]
mov esi, 1
cmp al, 0xfb
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x1c], al
jne 0x420f7e
push ebx
jmp 0x420f93
cmp al, 0xfc
jne 0x420f85
push esi
jmp 0x420f93
cmp al, 0xfd
jne 0x420f8d
push 2
jmp 0x420f93
cmp al, 0xfe
jne 0x420f9f
push 3
call fcn.004233a0
add esp, 4
mov byte [esp + 0x1c], al
mov ax, word [0x46444c]
push eax
call fcn.004233d0
mov cx, word [0x467694]
mov word [esp + 0x1e], ax
mov eax, dword [esp + 0x14]
push 0x464420
mov dword [esp + 0x3c], eax
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x48]
push 2
lea eax, [esp + 0x20]
push edx
push eax
mov word [esp + 0x2c], cx
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], ebx
mov dword [esp + 0x4c], edi
mov byte [esp + 0x31], bl
mov dword [esp + 0x54], ebx
call fcn.00423b10
push edi
mov esi, eax
call sub.MFC42.DLL_operatordelete
add esp, 0x18
cmp esi, ebx
jne 0x42100b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c
ret
mov edx, dword [esp + 0x40]
mov eax, dword [ebp + 4]
lea ecx, [ebp + 8]
push 0x10
push ecx
push ebx
push edx
push esi
push eax
xor edi, edi
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jle 0x42102d
mov edi, 1
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret

Function at 0x421d20
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor esi, esi
test edi, edi
jle 0x421d53
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov eax, edi
push 0
sub eax, esi
lea ecx, [esi + ebx]
push eax
push ecx
push ebp
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x421d5a
add esi, eax
cmp esi, edi
jl 0x421d36
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret

Function at 0x421d70
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
ret
Function at 0x422890
Capabilities:
Create thread

Disassembly:
mov al, byte [esp + 0x14]
mov byte [0x46444e], 5
mov byte [0x464454], al
mov eax, dword [0x4676d8]
test eax, eax
je 0x4228b2
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esp + 8]
push esi
push edi
push eax
mov dword [0x4676a8], eax
call sub.MFC42.DLL_operatornew
mov ecx, dword [0x4676a8]
mov esi, dword [esp + 0x10]
mov edx, ecx
mov edi, eax
shr ecx, 2
mov dword [0x4676d8], eax
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x18]
and ecx, 3
add esp, 4
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x20
mov ecx, 8
jae 0x422927
mov edi, 0x4676b0
mov esi, edx
rep stosd dword es:[edi], eax
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x4676b0
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x422930
mov esi, edx
mov edi, 0x4676b0
rep movsd dword es:[edi], dword [esi]
push 4
push 0x467694
push edx
mov byte [0x4676d0], 0
call fcn.004187a0
mov al, byte [esp + 0x24]
add esp, 0xc
test al, al
pop edi
pop esi
jne 0x422955
mov al, 0xfe
jmp 0x42295b
cmp al, 1
jne 0x42295b
mov al, 0xfd
push 0
push 0
push 0
push 0x421040
push 0
push 0
mov byte [0x4676a4], al
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00418830
mov byte [0x464455], al
ret

Function at 0x422d40
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
mov ecx, 0x4675e8
xor esi, esi
call fcn.004195f0
test eax, eax
jne 0x422d58
pop esi
ret
mov ecx, dword [eax + 0x44]
test ecx, ecx
je 0x422d76
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
push edx
push eax
call fcn.0041a400
add esp, 0xc
mov esi, eax
pop esi
ret
mov ecx, dword [esp + 0x10]
mov eax, dword [eax + 0x30]
test ecx, ecx
jne 0x422d9d
lea ecx, [esp + 0xc]
push 4
push ecx
push 0x1005
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, eax
pop esi
ret
cmp ecx, 1
jne 0x422dbc
lea edx, [esp + 0xc]
push 4
push edx
push 0x1006
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, eax
mov eax, esi
pop esi
ret
Function at 0x4248a0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
mov byte [esi + 0x14], 0
test eax, eax
je 0x424878
cmp eax, 0xffffffff
je 0x424878
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0x18]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x18]
push ecx
call dword [0x467338]
mov dword [esi + 0x18], 0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x42488f
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esi + 0x10], 0
mov al, 1
pop esi
ret
call fcn.004241b0
mov ecx, eax
jmp 0x424840
Function at 0x428e30
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0
push 0
push 0x428cc0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x428e65
cmp eax, 0xffffffff
je 0x428e65
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret
xor al, al
pop ecx
ret
Function at 0x42ef40
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0
push 0
push 0x42ea70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x42ef75
cmp eax, 0xffffffff
je 0x42ef75
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret
xor al, al
pop ecx
ret

Function at 0x432b20
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0
push 0
push 0x432b00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x432b55
cmp eax, 0xffffffff
je 0x432b55
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret
xor al, al
pop ecx
ret
Function at 0x436640
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x188
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x98]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x51]
mov esi, 0x464a0c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 9
lea edi, [esp + 0x50]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 1
lea eax, [esp + 0x54]
push 0x27
push eax
mov dword [esp + 0x24], 0xff
mov dword [esp + 0x20], 7
movsb byte es:[edi], byte [esi]
call fcn.0040c5e0
add esp, 0xc
lea ecx, [esp + 0x10]
lea edx, [esp + 0x50]
push ecx
push 0xf013f
push 0
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4367da
mov ecx, 0xc
lea edi, [esp + 0x1d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 5
mov esi, 0x4649f4
lea edi, [esp + 0x1c]
push 1
lea eax, [esp + 0x20]
push 0x14
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0040c5e0
add esp, 0xc
lea ecx, [esp + 0x18]
lea edx, [esp + 0x98]
lea eax, [esp + 0x14]
push ecx
push edx
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4367da
lea edi, [esp + 0x98]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebp, [ebx + 0x94]
mov ebx, ecx
cmp ebx, 0xfffffffd
jbe 0x436743
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
mov ecx, dword [ebp + 4]
xor edx, edx
cmp ecx, edx
je 0x436779
mov al, byte [ecx - 1]
test al, al
je 0x436779
cmp al, 0xff
je 0x436779
cmp ebx, edx
jne 0x4367ad
dec al
pop edi
mov byte [ecx - 1], al
mov dword [ebp + 4], edx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], edx
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x188
ret
cmp ebx, edx
jne 0x436797
push 1
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x188
ret
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
ja 0x4367a3
cmp eax, ebx
jae 0x4367b6
push 1
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push ebx
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Copy_unsigned_int_]
mov edi, dword [ebp + 4]
mov ecx, ebx
mov eax, ecx
lea esi, [esp + 0x98]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 4]
mov dword [ebp + 8], ebx
mov byte [ecx + ebx], 0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x188
ret
Function at 0x436f20
Capabilities:
Get common file path

Disassembly:
sub esp, 0x74c
xor eax, eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x19
lea edi, [esp + 0x10]
push 0x64
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x178]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x78]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x278]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x274]
lea edx, [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x178]
push edx
push eax
push ecx
call fcn.00409fe0
lea edx, [esp + 0x284]
lea eax, [esp + 0x84]
push edx
lea ecx, [esp + 0x188]
push eax
push ecx
lea edx, [esp + 0x390]
push str._s_t_s_t_s
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x398]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x24
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebp, [esi + 0xb4]
mov ebx, ecx
cmp ebx, 0xfffffffd
jbe 0x436fde
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
mov ecx, dword [ebp + 4]
xor edx, edx
cmp ecx, edx
je 0x437014
mov al, byte [ecx - 1]
test al, al
je 0x437014
cmp al, 0xff
je 0x437014
cmp ebx, edx
jne 0x437048
dec al
pop edi
mov byte [ecx - 1], al
mov dword [ebp + 4], edx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], edx
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x74c
ret
cmp ebx, edx
jne 0x437032
push 1
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x74c
ret
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
ja 0x43703e
cmp eax, ebx
jae 0x437051
push 1
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push ebx
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Copy_unsigned_int_]
mov edi, dword [ebp + 4]
mov ecx, ebx
mov eax, ecx
lea esi, [esp + 0x374]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 4]
pop edi
mov dword [ebp + 8], ebx
pop esi
mov byte [ecx + ebx], 0
pop ebp
pop ebx
add esp, 0x74c
ret
Function at 0x438920
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x200
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
push eax
call fcn.00409410
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
mov dx, word [0x466400]
mov cx, word [0x466412]
mov word [esp + eax*2 + 0x18], dx
mov dx, word [0x46641c]
inc eax
push 0x462230
mov word [esp + eax*2 + 0x1e], cx
mov word [esp + eax*2 + 0x1c], 0x2e
mov word [esp + eax*2 + 0x20], dx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov ebp, eax
add esp, 0x10
cmp ebp, ebx
je 0x438a09
xor edi, edi
mov eax, dword [esi + 0x20]
test eax, eax
je 0x4389f2
mov ecx, dword [esi + 0x24]
sub ecx, eax
mov eax, 0x7be2f6cf
imul ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
cmp edi, edx
jae 0x4389f2
mov edx, dword [esi + 0x20]
mov eax, dword [edx + ebx + 0x840]
lea ecx, [edx + ebx]
test eax, eax
je 0x4389e9
mov ecx, dword [ecx + 0x83c]
cmp ecx, 4
jle 0x4389e9
push ebp
push ecx
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
inc edi
add ebx, 0x844
jmp 0x43899e
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x200
ret

Function at 0x43a780
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0
push 0
push 0x43a640
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x43a7b5
cmp eax, 0xffffffff
je 0x43a7b5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret
xor al, al
pop ecx
ret
Function at 0x43a840
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x404
push esi
mov esi, dword [esp + 0x410]
test esi, esi
jne 0x43a85c
xor al, al
pop esi
add esp, 0x404
ret
push ebp
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov ebp, dword [sym.imp.MSVCRT.dll_wcscpy]
push esi
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push eax
call ebp
mov edi, dword [esp + 0x41c]
add esp, 8
cmp edi, 2
mov byte [esp + 0xf], 0
je 0x43a8c3
mov ecx, dword [esp + 0x424]
lea edx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 8
test eax, eax
je 0x43a8c3
mov byte [esp + 0xf], 1
pop edi
mov al, byte [esp + 0xb]
pop ebp
pop esi
add esp, 0x404
ret
cmp edi, 1
je 0x43aa77
mov eax, dword [esi + 0x20a]
test eax, eax
je 0x43aa77
mov ecx, dword [esi + 0x212]
lea eax, [esi + 0x20e]
test ecx, ecx
ja 0x43aa77
jb 0x43a8fc
cmp dword [eax], 0x1400000
jae 0x43aa77
lea eax, [esp + 0x10]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
mov esi, eax
add esp, 8
test esi, esi
je 0x43aa77
add esi, 2
push esi
call dword [sym.imp.MSVCRT.dll__wcslwr]
push 0x464b90
push esi
mov word [esp + 0x1c], 0
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 0xc
test eax, eax
jne 0x43a94c
mov ecx, dword [esp + 0x420]
lea edx, [esp + 0x10]
push ecx
push edx
call ebp
add esp, 8
cmp word [esp + 0x10], 0
je 0x43aa77
lea eax, [esp + 0x10]
push 0x462258
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x43aa77
mov ebp, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push esi
call ebp
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push esi
mov edi, eax
call ebp
add esp, 0x1c
xor ebp, ebp
test edi, edi
jle 0x43a9c7
cmp edi, 0x1400000
jge 0x43a9c7
lea ecx, [edi + 1]
push ecx
call sub.MFC42.DLL_operatornew
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x43a9c7
push esi
push edi
push 1
push ebp
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov byte [edi + ebp], 0
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
test ebp, ebp
je 0x43aa77
mov ecx, 2
mov edi, 0x464b8c
mov esi, ebp
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x43a9f0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x43aa0c
mov edx, dword [esp + 0x424]
push edx
push ebp
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 8
test eax, eax
je 0x43aa6e
jmp 0x43aa69
mov ecx, 3
mov edi, 0x464b88
mov esi, ebp
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x43aa23
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x43aa3f
mov eax, dword [esp + 0x42c]
push eax
push ebp
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x43aa6e
jmp 0x43aa69
mov ecx, dword [esp + 0x428]
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
push ecx
push ebp
call esi
add esp, 8
test eax, eax
jne 0x43aa69
mov edx, dword [esp + 0x42c]
push edx
push ebp
call esi
add esp, 8
test eax, eax
je 0x43aa6e
mov byte [esp + 0xf], 1
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
mov al, byte [esp + 0xf]
pop edi
pop ebp
pop esi
add esp, 0x404
ret
Function at 0x43ab50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
xor eax, eax
push ebx
mov ebx, dword [esp + 0x2c]
push esi
mov esi, ecx
push edi
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x43ab73
pop edi
pop esi
pop ebx
add esp, 0x24
ret 4
cmp dword [esi], 0
je 0x43ab83
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 4
lea eax, [esp + 0x34]
push eax
push ebx
call dword [0x467490]
mov edi, eax
test edi, edi
jne 0x43ab9e
pop edi
pop esi
pop ebx
add esp, 0x24
ret 4
push edi
call sub.MFC42.DLL_operatornew
mov ecx, dword [esp + 0x38]
add esp, 4
mov dword [esi], eax
push eax
push edi
push ecx
push ebx
call dword [0x46748c]
test eax, eax
jne 0x43abcd
mov ecx, esi
call fcn.0043ab30
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 4
mov dl, 0x6f
mov al, 0x6e
mov cl, 0x61
mov byte [esp + 0x1f], dl
mov byte [esp + 0x2a], dl
mov byte [esp + 0x1d], al
mov byte [esp + 0x24], al
mov byte [esp + 0x2b], al
lea edx, [esp + 0x10]
mov byte [esp + 0x16], cl
mov byte [esp + 0x23], cl
mov byte [esp + 0x27], cl
lea eax, [esp + 0xc]
push edx
mov edx, dword [esi]
lea ecx, [esp + 0x18]
push eax
mov bl, 0x6c
push ecx
push edx
mov byte [esp + 0x24], 0x5c
mov byte [esp + 0x25], 0x56
mov byte [esp + 0x27], 0x72
mov byte [esp + 0x28], 0x46
mov byte [esp + 0x29], 0x69
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], 0x65
mov byte [esp + 0x2c], 0x49
mov byte [esp + 0x2e], 0x66
mov byte [esp + 0x30], 0x5c
mov byte [esp + 0x31], 0x54
mov byte [esp + 0x32], 0x72
mov byte [esp + 0x35], 0x73
mov byte [esp + 0x36], bl
mov byte [esp + 0x38], 0x74
mov byte [esp + 0x39], 0x69
mov byte [esp + 0x3c], 0
call dword [0x467494]
test eax, eax
jne 0x43ac7c
call dword [0x467340]
mov ecx, esi
call fcn.0043ab30
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 4
mov eax, dword [esp + 0xc]
xor edx, edx
pop edi
mov ecx, dword [eax]
mov dx, word [eax]
shr ecx, 0x10
shl edx, 0x10
or ecx, edx
mov eax, 1
mov dword [esi + 4], ecx
pop esi
pop ebx
add esp, 0x24
ret 4