joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484b40
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
lea ebx, [ebp + 8]
mov eax, 0x4a7fe8
call fcn.0048a884
mov word [ebp - 0x18], 0xc
mov edx, 0x4a8370
mov ecx, dword [ebx]
mov dword [ecx], edx
push 0x10
call fcn.00484038
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x484b8d
mov word [ebp - 0x18], 0x30
mov edx, dword [ebp - 4]
push edx
call fcn.004827f4
pop ecx
mov word [ebp - 0x18], 0x24
mov ecx, dword [ebp - 4]
jmp 0x484b90
mov ecx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [eax + 0x3c], ecx
mov word [ebp - 0x18], 0x18
mov eax, dword [ebx]
mov edx, dword [ebx]
add edx, 0xc
mov dword [eax + 0x14], edx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x10
mov dword [ecx + 0x18], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x1c
mov dword [edx + 0x24], eax
mov eax, dword [ebx]
mov ecx, dword [ebx]
add ecx, 0x20
mov dword [eax + 0x28], ecx
mov ecx, dword [ebx]
mov edx, dword [ebx]
add edx, 0x2c
mov dword [ecx + 0x34], edx
mov edx, dword [ebx]
mov eax, dword [ebx]
add eax, 0x30
mov dword [edx + 0x38], eax
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x18]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x28]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x38]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x14]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x24]
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x34]
mov dword [eax], edx
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, dword [ebx]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48b708
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x48b724
call fcn.0048d02c
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x48b743
test bl, 1
je 0x48b743
call fcn.00493c74
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x48b924
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0048cba8
test byte [ebp + 0xd], 0xc0
jne 0x48b948
mov eax, dword [0x4a98b8]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x48b955
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x48b982
je 0x48b994
sub ecx, 0x100
je 0x48b9a2
sub ecx, 0x100
je 0x48b9a9
sub ecx, 0x100
je 0x48b99b
jmp 0x48b9b0
sub ecx, 0x600
je 0x48b9a9
sub ecx, 0x100
je 0x48b994
jmp 0x48b9b0
mov edi, 1
jmp 0x48b9b5
mov edi, 2
jmp 0x48b9b5
mov edi, 4
jmp 0x48b9b5
mov edi, 5
jmp 0x48b9b5
mov edi, 3
test byte [ebp + 0xd], 1
je 0x48b9dc
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4a9330]
test al, 0x80
je 0x48b9d5
mov ebx, 0x80
jmp 0x48b9ee
mov ebx, 1
jmp 0x48b9ee
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x48b9ee
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x48ba00
je 0x48ba09
dec eax
je 0x48ba12
jmp 0x48ba1b
mov dword [ebp - 4], SysStringLen
jmp 0x48ba2a
mov dword [ebp - 4], 0x40000000
jmp 0x48ba2a
mov dword [ebp - 4], 0xc0000000
jmp 0x48ba2a
push 1
call fcn.0048cfc0
pop ecx
mov ebx, eax
jmp 0x48bb1a
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x48ba46
sub eax, 0x10
je 0x48ba4d
sub eax, 0x10
je 0x48ba56
sub eax, 0x10
je 0x48ba5f
jmp 0x48ba5f
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x48ba66
mov dword [ebp - 8], 1
jmp 0x48ba66
mov dword [ebp - 8], 2
jmp 0x48ba66
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x48bad3
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x48bac8
test byte [ebp + 0xd], 1
je 0x48bac3
mov ebx, 0x50
jmp 0x48bac8
mov ebx, 2
push ebx
call fcn.0048cfc0
pop ecx
mov ebx, eax
jmp 0x48bb1a
mov edi, esi
push edi
call fcn.0048b888
pop ecx
test eax, eax
je 0x48bae7
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x48baf3
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0048cce8
add esp, 8
mov ebx, eax
inc eax
jne 0x48bb1a
push 4
call fcn.0048cfc0
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0048cbdc
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48ca84
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.0048a08c
pop ecx
mov ebx, eax
test eax, eax
jne 0x48caa8
xor eax, eax
jmp 0x48cb58
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
mov esi, eax
test esi, esi
je 0x48cac9
cmp esi, 0x104
jb 0x48cad7
push ebx
call fcn.0048a09c
pop ecx
xor eax, eax
jmp 0x48cb58
cmp byte [ebx + 1], 0x3a
jne 0x48cb07
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jae 0x48cb07
push ebx
call fcn.0048a09c
pop ecx
xor eax, eax
jmp 0x48cb58
inc esi
test edi, edi
je 0x48cb4e
cmp esi, dword [ebp + 0x10]
jbe 0x48cb1e
push ebx
call fcn.0048a09c
pop ecx
xor eax, eax
jmp 0x48cb58
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.0048a09c
pop ecx
mov eax, edi
jmp 0x48cb58
push esi
push ebx
call fcn.0048a0ac
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x48ff68
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x4aa583
lea ecx, [ebp - 0x200]
push ecx
call fcn.0048a458
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0048a570
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.0048a570
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x4aa585
lea ecx, [ebp - 0x200]
push ecx
call fcn.0048a458
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.0048a570
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.00491304
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x490079
push esi
call fcn.0048a570
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.0048a570
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.0048a08c
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x490050
xor eax, eax
jmp 0x490100
push esi
call fcn.0048a570
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.0048a570
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.0048a3b0
add esp, 0xc
jmp 0x4900b9
mov edi, dword [ebx + 0x24]
push edi
call fcn.0048a570
pop ecx
push eax
push esi
call fcn.0048a570
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.0048a570
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.0048a0ac
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x4900b9
xor eax, eax
jmp 0x490100
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.0048a458
add esp, 8
push 0x4aa587
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.0048a458
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.0048a458
add esp, 8
push 0x4aa589
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.0048a458
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x493c08
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x493c35
jmp 0x493c6c
call fcn.00493bb8
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0048a570
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0048a570
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x493cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4aac94], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x493dca
cmp dword [0x4aac90], 0
jne 0x493dca
cmp dword [0x4aadf4], 0
je 0x493d84
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00493a98
add esp, 8
mov ebx, eax
test eax, eax
jne 0x493d6a
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00493a98
add esp, 8
mov ebx, eax
test eax, eax
jne 0x493d6a
lea ebx, [ebp - 0x84]
jmp 0x493d6b
inc ebx
call fcn.00493ca8
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x493e05
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4aac98
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0048a570
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4aac9b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x493e05
cmp dword [0x4aac90], 0
je 0x493de4
cmp dword [0x4aac90], 0xffffffff
je 0x493e05
push esi
call dword [0x4aac90]
pop ecx
mov eax, dword [0x4aac94]
test eax, eax
je 0x493e05
cmp dword [0x4aac94], 0xffffffff
je 0x493e05
cmp byte [eax], 0
je 0x493e05
push esi
push eax
call fcn.00493c08
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x494408
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4ba16c], 0
jne 0x494489
cmp dword [0x4ba190], 0
jne 0x494438
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4ba190], eax
test eax, eax
jne 0x494438
push 0x4aad2c
call fcn.00493e1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4ba190]
jmp 0x49444c
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0048a570
pop ecx
mov edi, eax
test eax, eax
jne 0x494444
lea edi, [ebp + 1]
push edi
call fcn.0048a08c
pop ecx
mov ebx, eax
mov dword [0x4ba170], ebx
test ebx, ebx
jne 0x494476
xor eax, eax
jmp 0x49454c
push edi
mov edx, dword [0x4ba190]
push edx
push ebx
call fcn.0048a31c
add esp, 0xc
jmp 0x4944a9
xor esi, esi
mov ebx, dword [0x4ba16c]
jmp 0x4944a3
push eax
call fcn.0048a570
pop ecx
test eax, eax
jne 0x49449f
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x494493
lea ebx, [esi + 4]
push 4
mov dword [0x4ba174], ebx
inc ebx
push ebx
call fcn.00489a28
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4944cc
xor eax, eax
jmp 0x49454c
cmp dword [0x4ba16c], 0
jne 0x4944fd
xor esi, esi
mov ebx, dword [0x4ba170]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4944ee
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0048a570
pop ecx
mov edi, eax
test eax, eax
jne 0x4944e4
jmp 0x49452e
xor esi, esi
mov ebx, dword [0x4ba16c]
mov eax, dword [esp]
mov edi, eax
jmp 0x494528
push eax
call fcn.0048a570
pop ecx
test eax, eax
je 0x49451d
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x494521
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x49450c
mov eax, dword [0x4ba16c]
test eax, eax
je 0x49453e
push eax
call fcn.0048a09c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4ba16c], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x494aa0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov dword [ebp - 8], 1
mov dword [ebp - 4], esi
cmp edi, 1
jne 0x494b26
mov eax, dword [0x4ba1c4]
inc dword [0x4ba1c4]
test eax, eax
jne 0x494b26
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4ba190], eax
mov edx, dword [ebp + 0x10]
mov dword [0x49b07b], edx
mov ecx, dword [esi + 0x44]
push ecx
call fcn.0048c474
pop ecx
cmp dword [0x4aacd0], 0
je 0x494b11
call fcn.00494924
mov ebx, eax
test eax, eax
je 0x494b11
mov edx, dword [ebx]
cmp dword [ebx + edx*4 + 4], 0xffffffff
je 0x494b11
mov ecx, dword [ebx]
inc dword [ebx]
mov dword [ebx + ecx*4 + 4], esi
jmp 0x494b26
xor eax, eax
lea edx, [ebp - 8]
push 0
push edx
mov dword [0x4aacd0], eax
call fcn.0049492c
add esp, 8
mov ecx, dword [ebp + 0x18]
push ecx
push edi
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [esi + 0x18]
push edx
call fcn.00494c34
mov ebx, eax
test edi, edi
jne 0x494b95
test edi, edi
jne 0x494b66
dec dword [0x4ba1c4]
jne 0x494b66
cmp dword [0x4ba190], 0
je 0x494b66
mov eax, dword [0x4ba190]
push eax
call sub.KERNEL32.DLL_FreeEnvironmentStringsA
xor edx, edx
mov dword [0x4ba190], edx
cmp dword [0x4ba1c4], 0
jne 0x494b95
cmp dword [0x4aacd0], 0
jne 0x494b95
cmp dword [0x4aacc0], 0
je 0x494b87
call dword [0x4aacc0]
push 1
lea ecx, [ebp - 8]
push ecx
call fcn.0049492c
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x42b370
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a000]
push edi
or ebp, 0xffffffff
jmp 0x42b392
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42b399
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42b388
mov eax, 1
add ebx, ebx
jne 0x42b3ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42b3a0
jne 0x42b3bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42b3a0
xor ecx, ecx
sub eax, 3
jb 0x42b3d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42b442
mov ebp, eax
add ebx, ebx
jne 0x42b3db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42b3e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42b40c
inc ecx
add ebx, ebx
jne 0x42b3f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42b3ed
jne 0x42b409
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42b3ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42b42c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42b41d
jmp 0x42b38e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42b42c
add edi, ecx
jmp 0x42b38e
pop esi
mov edi, esi
mov ecx, 0xa85
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42b44a
cmp byte [edi], 6
jne 0x42b44a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42b44f
lea edi, [esi + 0x29000]
mov eax, dword [edi]
or eax, eax
je 0x42b4c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x33ab0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x33b28]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42b47c
mov ecx, edi
jns 0x42b4ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x33b2c]
or eax, eax
je 0x42b4c1
mov dword [ebx], eax
add ebx, 4
jmp 0x42b499
call dword [esi + 0x33b3c]
mov ebp, dword [esi + 0x33b30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42b4fb
sub esp, 0xffffff80
jmp 0x4167d2
Function at 0x445580
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, 1
mov dword [esp + 0xc], eax
mov eax, dword [0x4a3054]
imul eax, eax, 0xabfcbc18
mov dword [0x4a3054], eax
mov eax, dword [0x4b62a0]
mov edx, esp
mov dword [edx], eax
mov dword [esp + 8], ecx
call fcn.00448310
mov ecx, dword [0x49f860]
add ecx, 0x5d416c47
mov edx, dword [0x499d08]
or edx, ecx
mov dword [0x499d08], edx
mov dword [esp], 1
mov byte [esp + 7], al
call fcn.00455ad5
int3

Function at 0x4477f0
Capabilities:
Hash data with md5

Disassembly:
push edi
push esi
sub esp, 8
mov eax, 0x2afaa7df
mov dword [esp + 4], ecx
mov edx, dword [0x4a2900]
xor edx, 0xffffffff
or edx, 0xe2749110
cmp eax, edx
mov dword [esp], ecx
jle 0x447827
mov eax, dword [0x49c3dc]
add eax, 0x525b3cb8
mov dword [0x49c3dc], eax
mov eax, 0x52302500
mov ecx, dword [esp]
mov dword [ecx], 0
mov edx, dword [0x4a8044]
sar edx, 1
mov esi, dword [0x4a9d88]
xor edx, esi
xor edx, 0x6d801d21
mov dword [0x4a9d88], edx
mov dword [ecx + 4], 0
mov edx, dword [0x4a1a34]
add edx, 0xff77df70
mov dword [0x4a1a34], edx
mov dword [ecx + 8], 0x67452301
mov edx, dword [0x4a2cc8]
cmp eax, edx
jge 0x4478fd
mov eax, 0x77ba63f3
mov cx, word [0x4b560c]
mov dx, cx
dec edx
mov si, dx
mov word [0x4b560c], si
movsx edx, cx
cmp eax, edx
je 0x4478c9
mov ax, word [0x4ab952]
movsx ecx, ax
xor ecx, 0x3e0328fe
cmp ecx, 0x2d15d143
jl 0x4478c4
jmp 0x4478c4
jmp 0x4478f8
mov eax, dword [0x4a1374]
mov ecx, eax
dec ecx
mov dword [0x4a1374], ecx
imul eax, eax, 0x7185acfe
mov dx, word [0x4b111a]
mov cx, dx
and eax, ecx
and eax, 0x6f16
mov dx, ax
mov word [0x4b111a], dx
jmp 0x4478fd
mov eax, 0x8ae3d8f7
mov ecx, dword [esp]
mov dword [ecx + 0xc], 0xefcdab89
mov edx, dword [0x4a0d90]
add edx, 0x587b6045
mov dword [0x4a0d90], edx
mov dword [ecx + 0x10], 0x98badcfe
mov edx, dword [0x49c498]
mov esi, dword [0x49e730]
sub edx, esi
mov di, word [0x4b0ab8]
mov si, di
add esi, edx
mov di, si
mov word [0x4b0ab8], di
mov dword [ecx + 0x14], 0x10325476
mov di, word [0x4b232c]
movsx edx, di
cmp eax, edx
jge 0x447982
mov eax, dword [0x4a7fe0]
mov ecx, eax
dec ecx
mov dword [0x4a7fe0], ecx
mov ecx, dword [0x499034]
lea eax, [eax + ecx + 0x2b0be180]
mov dword [0x499034], eax
add esp, 8
pop esi
pop edi
ret
Function at 0x472181
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x491250]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0045d707
mov dword [ebp - 0x14], eax
cmp dword [0x4b7694], esi
jne 0x472274
push 0x800
push esi
push 0x486ca0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x472201
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x472354
push esi
push esi
push 0x486ca0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x472354
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x472354
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4b7694], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4b7698], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4b769c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b76a4], eax
test eax, eax
je 0x472271
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b76a0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x472299
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x47228c
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4722ae
push 4
pop eax
jmp 0x472356
cmp dword [ebp - 0x14], esi
je 0x4722ae
push dword [0x4b7694]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x472293
mov eax, dword [0x4b76a0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x47230c
cmp dword [0x4b76a4], edi
je 0x47230c
push eax
call ebx
push dword [0x4b76a4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x47230c
test eax, eax
je 0x47230c
call ecx
test eax, eax
je 0x472301
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x472301
test byte [ebp - 8], 1
jne 0x47230c
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x47233c
mov eax, dword [0x4b7698]
cmp eax, edi
je 0x472339
push eax
call ebx
test eax, eax
je 0x472339
call eax
mov esi, eax
test esi, esi
je 0x472339
mov eax, dword [0x4b769c]
cmp eax, edi
je 0x472339
push eax
call ebx
test eax, eax
je 0x472339
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4b7694]
call ebx
test eax, eax
je 0x472354
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x472356
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00467a15
mov esp, ebp
pop ebp
ret