joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44009c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4684c0]
cmp byte [eax + 0xc], 0
je 0x440209
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x440202
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x469b68], 0
jne 0x4400f0
push 0x440210
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x440218
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x469b68], eax
cmp dword [0x467cb0], 0
jne 0x4401eb
push 0x440228
call sub.kernel32.dll_LoadLibraryA
mov dword [0x467cb0], eax
cmp dword [0x467cb0], 0
je 0x4401eb
push 0x440234
mov eax, dword [0x467cb0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x469b6c], eax
push 0x440244
mov eax, dword [0x467cb0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x469b70], eax
push 0x440258
mov eax, dword [0x467cb0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x469b74], eax
push 0x440270
mov eax, dword [0x467cb0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x469b78], eax
push 0x440288
mov eax, dword [0x467cb0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x469b7c], eax
push 0x44029c
mov eax, dword [0x467cb0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x469b80], eax
push 0x4402b4
mov eax, dword [0x467cb0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x469b84], eax
push 0x4402cc
mov eax, dword [0x467cb0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x469b88], eax
push 0x4402e8
mov eax, dword [0x467cb0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x469b8c], eax
push 0x4402f4
mov eax, dword [0x467cb0]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x469b90], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440209
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x444094
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403ec4
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x4440e3
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404134
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44b8a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44b8f0]
test si, 4
je 0x44b8b4
or bl, 1
test si, 8
je 0x44b8be
or bl, 4
test si, 1
je 0x44b8c8
or bl, 8
test si, 2
je 0x44b8d2
or bl, 0x10
test si, 0x10
je 0x44b8dc
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44b8eb
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x44b8f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44b92c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44b90d
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44b91c
or bl, 4
test esi, 0x20000000
je 0x44b927
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x451fd4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x451fe6
add esp, 0xfffffff0
call fcn.00403498
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041f2cc
mov eax, dword [0x468144]
mov dword [eax + 4], ebx
mov dword [eax], 0x452378
mov eax, dword [0x468150]
mov dword [eax + 4], ebx
mov dword [eax], 0x452384
mov eax, ebx
call fcn.00452390
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x417344]
call fcn.00403144
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x417344]
call fcn.00403144
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x417344]
call fcn.00403144
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x417344]
call fcn.00403144
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x417344]
call fcn.00403144
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44e7ac
push eax
push 0
push 0
mov eax, dword [0x4682b4]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x420d20]
call fcn.0042245c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x420d20]
call fcn.0042245c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x420d20]
call fcn.0042245c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004527b0
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45268c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45268c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x45268c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x452123
call fcn.004034f0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x452470
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45261b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4525fc
mov dl, 1
mov eax, dword [0x417760]
call fcn.00403144
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403ec4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4525eb
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004403fc
test al, al
je 0x4525de
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45262c
lea eax, [ebp - 0x254]
call fcn.00409310
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4525de
xor eax, eax
push ebp
push 0x4525d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x452664
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4525c0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404134
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4525c0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404134
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4525de
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4524e1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041b428
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452622
lea eax, [ebp - 0x260]
call fcn.00403ec4
ret

Function at 0x452f50
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x469bb4]
cmp byte [eax + 0xa5], 0
jne 0x452fc1
cmp dword [0x469bcc], 0
jne 0x452f82
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x452f0c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x469bcc], eax
cmp dword [0x469bc8], 0
jne 0x452f9d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x469bc8], eax
cmp dword [0x469bd0], 0
jne 0x452fc1
push esp
push 0
push 0
push 0x452eb0
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x469bd0], eax
pop edx
ret
Function at 0x4530b8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4530cf
add esp, 0xfffffff0
call fcn.00403498
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041f2cc
mov eax, dword [0x4682a0]
cmp word [eax + 2], 0
jne 0x4530f7
mov eax, dword [0x4682a0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045463c
mov eax, dword [0x468354]
cmp word [eax + 2], 0
jne 0x453111
mov eax, dword [0x468354]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00454834
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x417344]
call fcn.00403144
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x417344]
call fcn.00403144
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4217c8]
call fcn.00429094
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x453298
mov eax, dword [0x4681ac]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00429464
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x454dd4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4681ac]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040cbf0
test eax, eax
je 0x453206
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408d04
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cc18
test eax, eax
je 0x45321a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404134
mov eax, dword [0x468074]
cmp byte [eax], 0
jne 0x45324e
mov eax, ebx
call fcn.004533c0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00454fb0
mov eax, ebx
call fcn.00455974
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45328e
call fcn.004034f0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453640
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x469bb4]
cmp dword [eax + 0x30], 0
je 0x4536ea
cmp dword [ebx + 0x94], 0
jne 0x4536e4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4535d0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4536e4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4536aa
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4536e4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004196ac
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4536b9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45424c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x454281
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403fb4
jmp 0x45428e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403f18
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45518c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4551cd
mov eax, esi
call fcn.0043bc04
test al, al
je 0x4551cd
mov eax, dword [ebx + 0x84]
call fcn.0043b944
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4551cd
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043b944
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x455ec4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x416930]
call fcn.00404900
xor eax, eax
push ebp
push 0x456008
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x467ee4], 0
jne 0x455f17
mov ecx, dword [0x468084]
mov dl, 1
mov eax, dword [0x40741c]
call fcn.0040be14
call fcn.00403900
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402b88
mov eax, ebx
call fcn.00404700
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x456018
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405ad8
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404710
test eax, eax
jle 0x455faf
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x455fa8
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.0040414c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404134
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004081f8
test eax, eax
jne 0x455fa8
mov ebx, 0x15
jmp 0x455fb4
mov ebx, 0x10
jmp 0x455fb4
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x467ee4]
call fcn.00455e1c
mov eax, dword [ebp - 8]
call fcn.00455e1c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405af0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45600f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00403ee8
lea eax, [ebp - 0x10]
mov edx, dword [0x416930]
call fcn.004049d0
ret

Function at 0x45e004
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404374
xor eax, eax
push ebp
push 0x45e0b8
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x45e090
push dword fs:[edx]
mov dword fs:[edx], esp
push 5
push 0
lea ecx, [ebp - 0xc]
mov dl, 0x22
mov eax, dword [ebp - 4]
call fcn.00408308
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x45e0d0
call fcn.004041d0
mov eax, dword [ebp - 8]
call fcn.00404384
push eax
push 0x45e0e0
push 0x45e0ec
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
ja 0x45e084
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45e09d
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45e09d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e0bf
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403ee8
ret
Function at 0x464250
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4642ce
push dword fs:[edx]
mov dword fs:[edx], esp
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
je 0x46429d
push 0
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov esi, eax
push 0
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov edi, eax
push 0xffffffffffffffff
push esi
push edi
call sub.user32.dll_AttachThreadInput
push ebx
call sub.user32.dll_SetForegroundWindow
push 0
push esi
push edi
call sub.user32.dll_AttachThreadInput
jmp 0x4642a3
push ebx
call sub.user32.dll_SetForegroundWindow
mov eax, dword [0x468338]
mov eax, dword [eax]
call fcn.004544fc
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x468338]
mov eax, dword [eax]
call fcn.004544fc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4642db
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x464f14
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404374
xor eax, eax
push ebp
push 0x4650b7
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x465078
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0xc], 0xffffffff
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4650d0
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00464874
push 0xffffffffffffffff
mov ecx, 0x4650e4
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0046491c
mov ebx, eax
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00408268
cmp dword [ebp - 0x18], 0
jne 0x464fa1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x465089
cmp ebx, 0xffffffff
jne 0x464fb3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x465089
call sub.kernel32.dll_GetTickCount
mov esi, eax
jmp 0x465053
mov eax, dword [0x468338]
mov eax, dword [eax]
call fcn.004544fc
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x468338]
mov eax, dword [eax]
call fcn.004544fc
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, dword [ebp - 0x10]
call fcn.0045e0f4
sub al, 0xff
je 0x465049
dec al
je 0x464ff9
dec al
je 0x465025
jmp 0x465053
mov eax, dword [0x468294]
mov edx, dword [ebp - 4]
call fcn.00403f18
mov eax, dword [0x468294]
add eax, 4
mov edx, dword [ebp - 0x14]
call fcn.00405af0
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x465089
mov eax, dword [0x468338]
mov eax, dword [eax]
call fcn.004544fc
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x468338]
mov eax, dword [eax]
call fcn.004544fc
jmp 0x465053
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x465089
call sub.kernel32.dll_GetTickCount
sub eax, esi
cmp eax, dword [ebp - 8]
jbe 0x464fbf
mov eax, dword [0x46828c]
mov dword [eax], 5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x465089
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4650be
lea eax, [ebp - 0x18]
call fcn.00403ec4
lea eax, [ebp - 0x14]
call fcn.00405ad8
lea eax, [ebp - 0x10]
call fcn.00403ec4
lea eax, [ebp - 4]
call fcn.00403ec4
ret
Function at 0x4667ac
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov eax, 0x466564
call fcn.00406270
xor eax, eax
push ebp
push 0x4668c5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x46689e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x46828c]
mov dword [eax], 0xffffffff
push 0x4668d4
push 0
push 0x1f0001
call sub.kernel32.dll_OpenMutexA
mov dword [0x469cdc], eax
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
mov eax, 0x469ce0
call fcn.004040bc
cmp dword [0x469cdc], 0
je 0x46682e
mov eax, dword [0x468054]
mov dword [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4668b7
xor eax, eax
push ebp
push 0x46688d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x468338]
mov eax, dword [eax]
call fcn.00454610
push 0x4668d4
push 0
push 0
call fcn.00406470
mov dword [0x469cdc], eax
mov eax, dword [0x469ce0]
call fcn.00462abc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466894
mov eax, dword [0x469cdc]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, dword [0x46828c]
mov eax, dword [eax]
mov edx, dword [0x468054]
mov dword [edx], eax
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4668cc
ret
Function at 0x10017f02
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
mov bh, 0x71
push es

Function at 0x10017f7f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ecx
adc al, 0xf
jl 0x10017f0c
jge 0x10017f8b
mov esi, dword [edi + 0x3c]
add esi, edi
mov ebx, dword [esi + 0x78]
call fcn.10017ec2
lahf
leave
cld
dec esp
push esi
push ebx
call fcn.10017f02
pop ecx
test eax, eax
pop ecx
je 0x10018055
push edi
push esi
push ebx
call fcn.10017f42
add esp, 0xc
call fcn.10017ec2
cld
inc ebx
add ch, dh
mov esi, dword [esi + 0x78]
test esi, esi
je 0x10018055
mov ebx, dword [esi + edi + 0x24]
add esi, edi
add ebx, edi
call fcn.10017ec2
dec ebp
xchg ebp, eax
salc
mov edx, 0x320468b
invalid

Function at 0x100182f9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x1001835d
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10017ed2
push eax
push esi
push dword [ebp + 8]
call fcn.10017e87
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10017ec2
mov dword [0x8859db04], eax
popfd
jl 0x10018347
invalid
invalid
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.10017ec2
dec ecx
sbb al, 0xe8
in al, 0x8d
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid