joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b9a0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x46a164]
xor eax, esp
mov dword [esp + 0x210], eax
push ebp
mov ebp, dword [esp + 0x21c]
lea eax, [esp + 0xc]
push esi
mov esi, dword [esp + 0x224]
push edi
push 0x208
push 0
push eax
call fcn.0044da50
add esp, 0xc
lea eax, [esp + 0x14]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x44ba73
push ebx
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44ba35
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x44ba45
mov eax, dword [esp + 0x10]
xor ecx, ecx
add ecx, ebx
mov dword [esi], ecx
adc eax, 0
mov dword [esi + 4], eax
push dword [esi]
mov dword [esp + 0x18], 0
call fcn.0044c22d
add esp, 4
mov dword [ebp], eax
lea ecx, [esp + 0x14]
push 0
push ecx
push dword [esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0044c020
add esp, 0x214
ret 8

Function at 0x45454a
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x462000
push str.FlsAlloc
push 0x1e
call fcn.00454428
mov esi, eax
add esp, 0x10
test esi, esi
je 0x45457e
push dword [ebp + 8]
mov ecx, esi
call dword [0x45e2f8]
call esi
jmp 0x454584
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4545c8
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x462024
push str.FlsGetValue
push 0x20
call fcn.00454428
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4545ff
push dword [ebp + 8]
mov ecx, esi
call dword [0x45e2f8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x455bea
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x455c87
push ebx
push esi
call fcn.00455bb3
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0045414c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x455c34
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x455c86
push edi
push eax
call fcn.0045347f
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x455c54
call fcn.00453445
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x455c85
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0045414c
add esp, 0x20
test eax, eax
jne 0x455c73
push edi
call fcn.00453445
jmp 0x455c7b
push ebx
call fcn.00453445
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4b011b]
shl eax, 2
mov dword [0x4b011f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004a3508
pop edx
call fcn.004a28a4
call fcn.004a350c
push 0
call fcn.004a4438
pop ecx
push 0x4b00c4
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4b0123], eax
push 0
jmp fcn.004ad208
Function at 0x4089ec
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd28
cmp dword [0x4d375c], 0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
je 0x408a0d
test eax, eax
jl 0x408a0d
cmp eax, 4
jl 0x408a15
or eax, 0xffffffff
jmp 0x408bfe
mov edx, eax
xor ecx, ecx
shl edx, 3
sub edx, eax
xor eax, eax
mov dword [edx*4 + 0x4d8d70], ecx
xor ecx, ecx
mov dword [edx*4 + 0x4d8d74], ecx
mov dword [edx*4 + 0x4d8d78], eax
cmp dword [0x4d5a5c], 3
jne 0x408bfc
mov edx, dword [0x4d7db0]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jne 0x408a66
push 0x4b0d74
call sym.Cari___.exe__Error
pop ecx
or eax, 0xffffffff
jmp 0x408bfe
xor ebx, ebx
mov eax, dword [ebp - 8]
lea esi, [eax + 0xc]
jmp 0x408a7f
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_SuspendThread
inc ebx
add esi, 0x66c
cmp ebx, dword [0x4d7d98]
jl 0x408a70
xor ebx, ebx
mov eax, dword [ebp - 8]
lea edx, [eax + 0xc]
mov dword [ebp - 0xc], edx
jmp 0x408bcf
mov dword [ebp - 0x2d8], 0x10010
lea ecx, [ebp - 0x2d8]
push ecx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
push edx
call sub.KERNEL32.DLL_GetThreadContext
test eax, eax
je 0x408bc7
mov ecx, dword [0x4d8d70]
mov eax, dword [0x4d8d8c]
mov dword [ebp - 0x2d4], ecx
mov dword [ebp - 0x2d0], eax
mov edx, dword [0x4d8da8]
mov ecx, dword [0x4d8dc4]
mov eax, 0x4d8d78
mov dword [ebp - 0x2cc], edx
xor edx, edx
mov dword [ebp - 0x2c8], ecx
mov esi, 0x400
cmp dword [eax], 0
je 0x408ba2
mov ecx, edx
add ecx, ecx
mov edi, 1
shl edi, cl
or esi, edi
mov ecx, dword [eax]
cmp ecx, 7
ja case.0x408b13.0
jmp dword [ecx*4 + 0x408b1a]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [eax - 4], 1
jmp 0x408b7a
mov dword [ebp - 4], 3
or esi, 0x100
jmp 0x408b7a
mov dword [ebp - 4], 1
or esi, 0x100
jmp 0x408b7a
mov dword [ebp - 4], 2
or esi, 0x100
jmp 0x408b7a
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ecx, dword [eax - 4]
sub ecx, 2
je 0x408b89
sub ecx, 2
je 0x408b8f
jmp 0x408b93
or dword [ebp - 4], 4
jmp 0x408b93
or dword [ebp - 4], 0xc
mov ecx, edx
shl ecx, 2
add ecx, 0x10
mov edi, dword [ebp - 4]
shl edi, cl
or esi, edi
inc edx
add eax, 0x1c
cmp edx, 4
jl 0x408af6
mov dword [ebp - 0x2c0], esi
lea eax, [ebp - 0x2d8]
push eax
mov edx, dword [ebp - 0xc]
mov ecx, dword [edx]
push ecx
call sub.KERNEL32.DLL_SetThreadContext
inc ebx
add dword [ebp - 0xc], 0x66c
cmp ebx, dword [0x4d7d98]
jl 0x408a97
xor ebx, ebx
mov eax, dword [ebp - 8]
lea esi, [eax + 0xc]
jmp 0x408bf4
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_ResumeThread
inc ebx
add esi, 0x66c
cmp ebx, dword [0x4d7d98]
jl 0x408be5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40af44
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
call fcn.004092d4
push str.KNOWNRESTYPE
push str.RES_KNOWN
push 0
call sub.KERNEL32.DLL_FindResourceA
test eax, eax
je 0x40b0a3
push eax
push 0
call sub.KERNEL32.DLL_LoadResource
test eax, eax
je 0x40b0a3
push eax
call sub.KERNEL32.DLL_LockResource
mov ebx, eax
test ebx, ebx
je 0x40b0a3
mov eax, dword [ebx]
add ebx, 4
mov esi, eax
mov dword [0x4cd2fc], eax
add esi, 0x200
mov dword [0x4cd300], esi
shl esi, 2
push esi
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov edi, eax
mov dword [0x4cd2f8], edi
push ebx
mov eax, dword [0x4cd300]
shl eax, 2
push eax
push edi
call fcn.00408ffc
mov ebx, eax
add esp, 0xc
mov eax, dword [ebx]
add ebx, 4
mov esi, eax
mov dword [0x4cd2f0], eax
add esi, 0x8000
push esi
push 0
mov dword [0x4cd2f4], esi
call sub.KERNEL32.DLL_GlobalAlloc
mov edi, eax
mov dword [0x4cd2ec], edi
push ebx
mov eax, dword [0x4cd2f0]
push eax
push edi
call fcn.00408ffc
mov ebx, eax
add esp, 0xc
mov eax, dword [ebx]
add ebx, 4
mov esi, eax
mov dword [0x4cd314], eax
add esi, 0x80
mov dword [0x4cd318], esi
shl esi, 2
push esi
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov edi, eax
mov dword [0x4cd310], edi
push ebx
mov eax, dword [0x4cd318]
shl eax, 2
push eax
push edi
call fcn.00408ffc
mov ebx, eax
add esp, 0xc
mov eax, dword [ebx]
add ebx, 4
mov esi, eax
mov dword [0x4cd308], eax
add esi, 0x4000
push esi
push 0
mov dword [0x4cd30c], esi
call sub.KERNEL32.DLL_GlobalAlloc
mov edi, eax
mov dword [0x4cd304], edi
push ebx
mov eax, dword [0x4cd308]
push eax
push edi
call fcn.00408ffc
add esp, 0xc
cmp dword [0x4cd2f8], 0
je 0x40b092
cmp dword [0x4cd2ec], 0
je 0x40b092
cmp dword [0x4cd304], 0
jne 0x40b099
call fcn.004092d4
jmp 0x40b0a3
mov dword [0x4dcc48], 1
pop edi
pop esi
pop ebx
ret
Function at 0x40f070
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test eax, eax
je 0x40f08e
cmp byte [eax], 0
je 0x40f08e
test ebx, ebx
jl 0x40f08e
cmp ebx, 4
jl 0x40f096
or eax, 0xffffffff
jmp 0x40f18d
push str.KNOWNRESTYPE
push eax
push 0
call sub.KERNEL32.DLL_FindResourceA
test eax, eax
jne 0x40f0af
or eax, 0xffffffff
jmp 0x40f18d
push eax
push 0
call sub.KERNEL32.DLL_LoadResource
test eax, eax
jne 0x40f0c3
or eax, 0xffffffff
jmp 0x40f18d
push eax
call sub.KERNEL32.DLL_LockResource
mov esi, eax
test esi, esi
jne 0x40f0d7
or eax, 0xffffffff
jmp 0x40f18d
mov eax, dword [ebx*4 + 0x4dcea8]
test eax, eax
je 0x40f0f1
push eax
call sub.KERNEL32.DLL_GlobalFree
xor edx, edx
mov dword [ebx*4 + 0x4dcea8], edx
mov eax, dword [ebx*4 + 0x4dcec8]
test eax, eax
je 0x40f10b
push eax
call sub.KERNEL32.DLL_GlobalFree
xor edx, edx
mov dword [ebx*4 + 0x4dcec8], edx
xor ecx, ecx
mov dword [ebx*4 + 0x4dceb8], ecx
mov edi, dword [esi]
add esi, 4
test edi, edi
jbe 0x40f139
cmp edi, 0x8000
ja 0x40f139
mov eax, edi
shl eax, 3
push eax
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebx*4 + 0x4dcea8], eax
push esi
mov edx, edi
shl edx, 3
push edx
mov ecx, dword [ebx*4 + 0x4dcea8]
push ecx
call fcn.00408ffc
add esp, 0xc
mov esi, eax
mov dword [ebx*4 + 0x4dceb8], edi
mov edi, dword [esi]
add esi, 4
test edi, edi
jbe 0x40f179
cmp edi, 0x100000
ja 0x40f179
push edi
push 0
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebx*4 + 0x4dcec8], eax
push esi
push edi
mov eax, dword [ebx*4 + 0x4dcec8]
push eax
call fcn.00408ffc
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40f40c
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes

Disassembly:
push ebx
push esi
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x40f414
mov eax, dword [esp + 0x4000]
add esp, 0xfffffdfc
push 0x104
lea eax, [esp + 8]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
test eax, eax
jne 0x40f445
mov byte [esp + 4], 0
push 0
push 0
lea edx, [esp + 0x110]
push edx
lea ecx, [esp + 0xc]
push ecx
lea eax, [esp + 0x14]
push eax
call fcn.004a51bc
add esp, 0x14
push 0x4b1712
push str.loaddll
lea edx, [esp + 0x110]
push edx
lea ecx, [esp + 0xc]
push ecx
lea eax, [esp + 0x14]
push eax
call fcn.004a5198
add esp, 0x14
lea edx, [esp + 4]
push edx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40f49d
xor eax, eax
jmp 0x40f53b
push str.KNOWNRESTYPE
push str.RES_LOADDLL
push 0
call sub.KERNEL32.DLL_FindResourceA
test eax, eax
jne 0x40f4ba
or eax, 0xffffffff
jmp 0x40f53b
push eax
push 0
call sub.KERNEL32.DLL_LoadResource
test eax, eax
jne 0x40f4cb
or eax, 0xffffffff
jmp 0x40f53b
push eax
call sub.KERNEL32.DLL_LockResource
test eax, eax
jne 0x40f4da
or eax, 0xffffffff
jmp 0x40f53b
push 0x4000
lea edx, [esp + 0x20c]
push edx
mov ecx, dword [eax]
push ecx
add eax, 4
push eax
call sym.Cari___.exe__Decompress
add esp, 0x10
mov esi, eax
test esi, esi
jne 0x40f501
or eax, 0xffffffff
jmp 0x40f53b
push 0x4b1384
lea edx, [esp + 8]
push edx
call fcn.004a5374
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x40f51e
or eax, 0xffffffff
jmp 0x40f53b
push ebx
push esi
push 1
lea edx, [esp + 0x214]
push edx
call fcn.004a5744
add esp, 0x10
push ebx
call fcn.004a4ed8
pop ecx
xor eax, eax
add esp, 0x4208
pop esi
pop ebx
ret
Function at 0x41b5a4
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov edi, 0x4cd624
jmp 0x41b74a
dec dword [edi]
mov eax, dword [edi]
lea eax, [eax + eax*2]
mov edx, dword [eax*4 + 0x4cd628]
sub edx, 1
jb 0x41b74a
je 0x41b5da
dec edx
je 0x41b730
jmp 0x41b74a
mov eax, dword [edi]
lea eax, [eax + eax*2]
test byte [eax*4 + 0x4cd632], 1
mov ebp, dword [eax*4 + 0x4cd62c]
je 0x41b70e
push ebp
call sym.Cari___.exe__Findmodule
pop ecx
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x41b74a
mov eax, dword [esp + 4]
cmp dword [eax + 0x174], 0
je 0x41b74a
cmp dword [0x4d5a5c], 3
jne 0x41b64a
mov ebx, dword [0x4d7db0]
test ebx, ebx
je 0x41b64a
xor esi, esi
jmp 0x41b642
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_SuspendThread
inc esi
add ebx, 0x66c
cmp esi, dword [0x4d7d98]
jl 0x41b632
mov esi, dword [0x4d8134]
test esi, esi
je 0x41b659
call fcn.00418e24
push ebp
call sym.Cari___.exe__Getbreakpointtype
test ah, 1
pop ecx
jne 0x41b6d4
mov eax, dword [esp + 4]
mov edx, ebp
sub edx, dword [eax + 0xc]
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x174]
test byte [eax + edx], 2
jne 0x41b6d4
push 2
push 1
push ebp
mov ecx, ebp
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub ecx, dword [edx + 0xc]
add ecx, dword [eax + 0x178]
push ecx
call sym.Cari___.exe__Readmemory
add esp, 0x10
cmp eax, 1
jne 0x41b6d4
mov byte [esp], 0xcc
push 2
push 1
push ebp
lea edx, [esp + 0xc]
push edx
call sym.Cari___.exe__Writememory
add esp, 0x10
cmp eax, 1
jne 0x41b6d4
mov ecx, dword [esp + 4]
mov eax, dword [esp + 4]
sub ebp, dword [ecx + 0xc]
mov edx, dword [eax + 0x174]
or byte [edx + ebp], 2
cmp dword [0x4d5a5c], 3
jne 0x41b74a
mov ebx, dword [0x4d7db0]
test ebx, ebx
je 0x41b74a
test esi, esi
je 0x41b6f0
call fcn.00419034
xor esi, esi
jmp 0x41b704
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_ResumeThread
inc esi
add ebx, 0x66c
cmp esi, dword [0x4d7d98]
jl 0x41b6f4
jmp 0x41b74a
push 0
push 0
mov edx, dword [edi]
lea edx, [edx + edx*2]
mov ecx, dword [edx*4 + 0x4cd630]
or ecx, 0xc000
push ecx
push ebp
call sym.Cari___.exe__Setbreakpointext
add esp, 0x10
jmp 0x41b74a
push 0x4880
mov eax, dword [edi]
lea eax, [eax + eax*2]
mov edx, dword [eax*4 + 0x4cd62c]
push edx
call sym.Cari___.exe__Tempbreakpoint
add esp, 8
cmp dword [edi], 0
jg 0x41b5b5
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41e2b4
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffe00
cmp dword [0x4cd6a0], 0
je 0x41e3c2
push 6
push str.C_K__
lea eax, [esp + 8]
push eax
call fcn.004a3530
add esp, 0xc
cmp dword [0x4d3018], 0
je 0x41e317
mov ebx, dword [0x4cda51]
cmp ebx, 1
jne 0x41e2f7
mov eax, 0x4b3899
jmp 0x41e2fc
mov eax, 0x4b3904
push eax
push ebx
push 0x4b396a
lea edx, [esp + 0x12]
push edx
call fcn.004a6c2c
add esp, 0x10
add eax, 6
mov ebx, eax
jmp 0x41e344
push 0x804
mov ecx, dword [0x4cd8f9]
push ecx
lea eax, [esp + 0xe]
push eax
call sym.Cari___.exe__Decodethreadname
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x41e341
mov ebx, 3
mov byte [esp + ebx], 0
jmp 0x41e344
add ebx, 6
mov eax, dword [0x4cda1d]
push eax
call sym.Cari___.exe__Findmodule
pop ecx
test eax, eax
je 0x41e380
add eax, 0x48
push eax
push 8
cmp ebx, 3
jne 0x41e366
mov edx, 0x4b3966
jmp 0x41e36b
mov edx, 0x4b3992
push edx
push 0x4b3984
lea eax, [esp + 0x10]
add ebx, eax
push ebx
call fcn.004a6c2c
add esp, 0x14
push 0x100
lea ecx, [esp + 0x104]
push ecx
mov eax, dword [0x4cd6a0]
push eax
call sub.USER32.DLL_GetWindowTextA
push 0x100
lea edx, [esp + 0x104]
push edx
lea ecx, [esp + 8]
push ecx
call fcn.004a37a0
add esp, 0xc
test eax, eax
je 0x41e3c2
push esp
mov eax, dword [0x4cd6a0]
push eax
call sub.USER32.DLL_SetWindowTextA
add esp, 0x200
pop ebx
ret
Function at 0x42a714
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x42a71e
mov eax, dword [esp + 0x2000]
add esp, 0xfffffefc
xor ebx, ebx
xor eax, eax
mov dword [esp], eax
xor esi, esi
jmp 0x42a7a7
cmp esi, 9
je 0x42a7a6
cmp esi, 0x13
je 0x42a7a6
lea eax, [esi + 0x400]
push eax
push 0
lea edx, [esp + 8]
push edx
lea ecx, [esp + 0x2014]
push ecx
lea eax, [esp + 0x18]
add eax, ebx
push eax
call fcn.00428dc4
add esp, 0x14
mov edx, eax
lea ecx, [esp + edx + 8]
lea eax, [ecx + ebx - 1]
jmp 0x42a77d
dec edx
dec eax
test edx, edx
jle 0x42a794
mov cl, byte [eax]
mov edi, ecx
and edi, 0xff
cmp edi, 0x20
je 0x42a77b
test cl, cl
je 0x42a77b
test edx, edx
je 0x42a7a6
add ebx, edx
mov byte [esp + ebx + 8], 0xd
inc ebx
mov byte [esp + ebx + 8], 0xa
inc ebx
inc esi
cmp esi, 0x2b
jge 0x42a7b4
cmp ebx, 0x1e00
jl 0x42a740
mov byte [esp + ebx + 8], 0
inc ebx
mov edi, ebx
mov eax, edi
add eax, eax
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov esi, eax
push edi
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov edi, eax
test esi, esi
je 0x42a7e2
test edi, edi
jne 0x42a80b
test esi, esi
je 0x42a7ec
push esi
call sub.KERNEL32.DLL_GlobalFree
test edi, edi
je 0x42a7f6
push edi
call sub.KERNEL32.DLL_GlobalFree
add ebx, ebx
push ebx
push 0x4b493a
call sym.Cari___.exe__Error
add esp, 8
or eax, 0xffffffff
jmp 0x42a86c
push esi
call sub.KERNEL32.DLL_GlobalLock
mov dword [esp + 4], eax
push edi
call sub.KERNEL32.DLL_GlobalLock
mov ebp, eax
push ebx
lea eax, [esp + 0xc]
push eax
push ebp
call fcn.004a3530
add esp, 0xc
push ebx
mov edx, dword [esp + 8]
push edx
push ebx
push ebp
push 1
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push esi
call sub.KERNEL32.DLL_GlobalUnlock
push edi
call sub.KERNEL32.DLL_GlobalUnlock
push 0
call sub.USER32.DLL_OpenClipboard
call sub.USER32.DLL_EmptyClipboard
push esi
push 0xd
call sub.USER32.DLL_SetClipboardData
push edi
push 1
call sub.USER32.DLL_SetClipboardData
call sub.USER32.DLL_CloseClipboard
xor eax, eax
add esp, 0x2108
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x431820
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
lea esi, [ebp + 0x10]
cmp eax, dword [0x4e3918]
je 0x431925
xor edx, edx
mov dword [0x4e3a1c], edx
mov edx, eax
mov dword [0x4e3918], edx
test edx, edx
jle 0x4318f2
lea edx, [ebp - 0x100]
mov ebx, dword [ebp + 0xc]
jmp 0x431865
mov byte [edx], al
inc ebx
inc edx
mov al, byte [ebx]
xor ecx, ecx
mov cl, al
cmp ecx, 0x24
je 0x431874
test al, al
jne 0x431861
mov byte [edx], 0
xor edx, edx
mov dl, byte [ebx]
cmp edx, 0x24
jne 0x431881
inc ebx
push esi
lea eax, [ebp - 0x100]
push eax
push 0x4e3818
call fcn.004a6c54
mov esi, eax
mov edi, dword [0x4e3918]
mov eax, edi
mov ecx, 0xa
cdq
idiv ecx
add esp, 0xc
mov eax, edi
mov ecx, 0xa
push edx
cdq
idiv ecx
push eax
mov eax, 0x4e3818
add eax, esi
push str.____i._i__
push eax
call fcn.004a6c2c
add esp, 0x10
add esi, eax
cmp byte [ebx], 0
je 0x4318f9
mov edx, 0x100
push ebx
sub edx, esi
add edx, 0xfffffffc
add esi, 0x4e3818
push edx
push str.____.s
push esi
call fcn.004a6c2c
add esp, 0x10
jmp 0x4318f9
mov byte [0x4e3818], 0
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
mov eax, ebx
sub eax, dword [0x4e3b3c]
cmp eax, 0x14
jae 0x431917
push 0
call fcn.0042e07c
pop ecx
jmp 0x431925
push 1
call fcn.0042e07c
pop ecx
mov dword [0x4e3b3c], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43537c
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
push str.OpenProcessToken
mov eax, dword [0x4d5a08]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov ebx, eax
push str.LookupPrivilegeValueA
mov eax, dword [0x4d5a08]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov esi, eax
push str.AdjustTokenPrivileges
mov eax, dword [0x4d5a08]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov edi, eax
test ebx, ebx
je 0x4353c4
test esi, esi
je 0x4353c4
test edi, edi
jne 0x4353c9
or eax, 0xffffffff
jmp 0x435448
push 8
push 0
lea edx, [esp + 8]
push edx
call fcn.004a35a0
add esp, 0xc
call sub.KERNEL32.DLL_GetCurrentProcess
lea ecx, [esp + 8]
push ecx
push 0x28
push eax
call ebx
test eax, eax
jne 0x4353f2
or eax, 0xffffffff
jmp 0x435448
push esp
push str.SeDebugPrivilege
push 0
call esi
test eax, eax
jne 0x435405
or eax, 0xffffffff
jmp 0x435448
mov dword [esp + 0xc], 1
push 8
lea edx, [esp + 4]
push edx
lea ecx, [esp + 0x18]
push ecx
call fcn.004a3530
add esp, 0xc
mov dword [esp + 0x18], 2
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0
mov edx, dword [esp + 0x1c]
push edx
call edi
test eax, eax
jne 0x435446
or eax, 0xffffffff
jmp 0x435448
xor eax, eax
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x43c95c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9ec
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x4b9a93
push 0x80000000
call sub.ADVAPI32.DLL_RegOpenKeyA
test eax, eax
jne 0x43ca56
push 0x4d3764
push str.__s____1_
lea edx, [ebp - 0x20c]
push edx
call fcn.004a6c2c
add esp, 0xc
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0x204
push ecx
lea eax, [ebp - 0x410]
push eax
push 0
push 0
push 0x4b8e51
mov edx, dword [ebp - 8]
push edx
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x43ca0a
lea ecx, [ebp - 0x410]
push ecx
lea eax, [ebp - 0x20c]
push eax
call fcn.004a38bc
add esp, 8
test eax, eax
jne 0x43ca0a
push 0
push 0x157e
push ebx
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_EnableWindow
push 0x4b9ac6
lea edx, [ebp - 0x614]
push edx
call fcn.004a6c2c
add esp, 8
jmp 0x43ca38
push 1
push 0x157e
push ebx
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_EnableWindow
lea ecx, [ebp - 0x410]
lea eax, [ebp - 0x614]
push ecx
push 0x4b9ae8
push eax
call fcn.004a6c2c
add esp, 0xc
push 1
push 0x157f
push ebx
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_EnableWindow
mov edx, dword [ebp - 8]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x43ca91
mov esi, str.___Cari___
lea edi, [ebp - 0x614]
mov eax, edi
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 1
push 0x157e
push ebx
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_EnableWindow
push 0
push 0x157f
push ebx
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_EnableWindow
lea edx, [ebp - 0x614]
push edx
push 0x157d
push ebx
call sub.USER32.DLL_SetDlgItemTextA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ae5c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
cmp edx, eax
jbe 0x44aeaf
push edx
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00446618
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x44aeaf
push ebx
call fcn.00454068
pop ecx
mov esi, eax
mov eax, dword [ebp + 8]
push eax
call sub.USER32.DLL_OpenClipboard
call sub.USER32.DLL_EmptyClipboard
push ebx
push 0xd
call sub.USER32.DLL_SetClipboardData
test esi, esi
je 0x44aeaa
push esi
push 1
call sub.USER32.DLL_SetClipboardData
call sub.USER32.DLL_CloseClipboard
pop esi
pop ebx
pop ebp
ret
Function at 0x453dd8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp eax, 0xfffffffe
jne 0x453dfa
push edx
push esi
call fcn.004539e0
add esp, 8
mov ebx, eax
jmp 0x453e07
push eax
push edx
push esi
call fcn.004535f8
add esp, 0xc
mov ebx, eax
test ebx, ebx
je 0x453e38
push ebx
call fcn.00454068
pop ecx
mov edi, eax
push esi
call sub.USER32.DLL_OpenClipboard
call sub.USER32.DLL_EmptyClipboard
push ebx
push 0xd
call sub.USER32.DLL_SetClipboardData
test edi, edi
je 0x453e33
push edi
push 1
call sub.USER32.DLL_SetClipboardData
call sub.USER32.DLL_CloseClipboard
pop edi
pop esi
pop ebx
pop ebp
ret