joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e120
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
cmp dword [0x5193b0], esi
je 0x44e15c
push str.CreateLogFile
push 0x291
push str..LogFile.cpp
push str.INT3_in__S_line__u__function__S
push 1
call fcn.0044def7
add esp, 0x14
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44e265
push ebx
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
xor ebx, ebx
push eax
inc ebx
push ebx
push str.D:_A_OICI_GA___WD_
mov dword [0x5193b0], ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA
cmp eax, esi
je 0x44e1c3
cmp dword [ebp - 4], esi
je 0x44e197
cmp dword [ebp - 0xc], esi
je 0x44e197
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_IsValidSecurityDescriptor]
cmp eax, esi
je 0x44e1c3
mov eax, dword [ebp - 4]
mov dword [0x5178c8], 0xc
mov dword [0x5178cc], eax
mov dword [0x5178d0], esi
mov dword [0x5178d4], 0x5178c8
mov dword [0x5178d8], ebx
mov dword [ebp - 8], esi
push esi
push esi
push 2
push dword [0x5178d4]
push 3
push 0x40000000
push 0x517938
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x44e207
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x44e236
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x64
jl 0x44e1c6
jmp 0x44e236
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push 2
lea eax, [ebp - 8]
push eax
push 0x9c040
push edi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
lea eax, [ebp - 0x14]
push eax
push 2
push 0x457598
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0xffffffff
je 0x44e24a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44e25d
cmp dword [0x517b44], esi
je 0x44e25d
push str.UsbTreeView:_error_creating_the_log_file_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
mov dword [0x5193b0], esi
pop ebx
pop esi
leave
ret
Function at 0x44e268
Capabilities:
Check if file exists
Create thread
Delete file
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
push ebx
push 0x51790c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ebx, ebx
cmp dword [0x517b40], ebx
je 0x44e3b5
cmp word [0x517938], bx
je 0x44e3b5
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, 0x517938
push esi
lea eax, [ebp - 0x210]
push eax
call edi
push 0x104
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
push esi
call fcn.00427e3d
test eax, eax
je 0x44e330
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44e330
push 0x2e
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov ebx, eax
test ebx, ebx
je 0x44e32e
xor eax, eax
mov word [ebx], ax
push esi
lea eax, [ebp - 0x620]
push eax
call edi
add ebx, 2
push ebx
lea eax, [ebp - 0x418]
push eax
call edi
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x620]
push eax
push str._s__u._s
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
xor ebx, ebx
cmp dword [0x517b40], ebx
je 0x44e380
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44e349
call fcn.0044e120
cmp dword [0x517b48], ebx
je 0x44e380
mov al, byte [0x517938]
push ebx
mov esi, str..X:
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
push ebx
push 3
movsw word es:[edi], word [esi]
push ebx
push 3
movsb byte es:[edi], byte [esi]
mov byte [ebp - 4], al
push 0xc0000000
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x4a3fd8], eax
pop edi
pop esi
cmp dword [0x5178f8], ebx
jne 0x44e3b5
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x5178f8], eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x44e04e
push ebx
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x5178f4], eax
mov dword [0x517b4c], 1
pop ebx
leave
ret

Function at 0x44fdee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push 0x5c
push 0
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
test esi, esi
jne 0x44fe0e
mov esi, dword [ebp + 8]
push str.api_ms_win_
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp eax, esi
jne 0x44fe23
xor eax, eax
inc eax
jmp 0x44fe6c
push 0x104
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x44fe6a
test esi, esi
je 0x44fe6a
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push 0x4532dc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x410]
push eax
call fcn.00427e3d
test eax, eax
jne 0x44fe1e
xor eax, eax
pop esi
leave
ret 4
Function at 0x44fe72
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x6a8
push esi
push edi
mov esi, str.psapi.dll
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
jne 0x44fec4
push esi
call fcn.00428ecd
mov edi, eax
test edi, edi
jne 0x44fec4
cmp dword [0x50ac10], 0x500
jbe 0x44febd
push 0x10
push dword [0x4a2ab4]
push str.Error:_psapi.dll_not_loaded
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x450067
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push str.EnumProcessModules
push edi
call esi
push str.GetModuleFileNameExW
push edi
mov ebx, eax
call esi
xor esi, esi
mov dword [ebp + 0x68], eax
cmp ebx, esi
je 0x450052
cmp eax, esi
je 0x450052
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp + 0x74], eax
cmp eax, esi
je 0x450064
push 0x18c
xor edi, edi
lea eax, [ebp - 0x42c]
push esi
inc edi
push eax
mov dword [ebp + 0x6c], edi
mov dword [ebp - 0x430], esi
call fcn.00448216
add esp, 0xc
push 0x40
lea eax, [ebp - 0x2a0]
push eax
mov dword [ebp + 0x70], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x40
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp + 0x70]
push eax
push 0x190
lea eax, [ebp - 0x430]
push eax
push dword [ebp + 0x74]
call ebx
test eax, eax
je 0x450044
mov esi, dword [ebp + 0x70]
shr esi, 2
cmp esi, edi
jle 0x450044
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x104
lea eax, [ebp - 0x220]
push eax
push dword [ebp + edi*4 - 0x430]
push dword [ebp + 0x74]
call dword [ebp + 0x68]
test eax, eax
je 0x44ffd6
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x220]
push eax
call ebx
lea ecx, [ebp - 0x220]
cmp ecx, eax
je 0x44ffd6
lea eax, [ebp - 0x18]
push eax
mov eax, ecx
push eax
call ebx
lea ecx, [ebp - 0x220]
cmp ecx, eax
je 0x44ffd6
mov eax, ecx
push eax
call fcn.0044fdee
test eax, eax
jne 0x44ffdd
inc edi
cmp edi, esi
jl 0x44ff80
jmp 0x450044
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x450004
test al, 6
je 0x450004
and eax, 0xfffffff9
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x630]
push str.ERROR:_System_DLL_was_not_loaded_from__S:_r_n_r_n_S_r_n_r_nProbably_it_is_Malware_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x10
push dword [0x4a2ab4]
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
and dword [ebp + 0x6c], 0
push dword [ebp + 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x6c]
jmp 0x450066
push esi
push 0x481f58
push 0x481f54
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebx
pop edi
pop esi
add ebp, 0x78
leave
ret
Function at 0x450201
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
mov ebx, 0x50adb0
push ebx
lea eax, [ebp - 0x664]
push str.__s.dll
push eax
call esi
and dword [ebp - 0x254], 0
push 0x24c
lea eax, [ebp - 0x250]
push 0
push eax
call fcn.00448216
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add esp, 0x18
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x664]
push eax
call edi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x450295
push ebx
lea eax, [ebp - 0x664]
push str._s.dll
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x664]
push eax
call edi
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x450295
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
test byte [ebp - 0x254], 0x10
jne 0x4502df
lea eax, [ebp - 0x228]
push eax
call fcn.0044fdee
test eax, eax
je 0x4502be
lea eax, [ebp - 0x228]
push eax
call fcn.0045006e
test eax, eax
je 0x4502f7
cmp word [ebp - 0x20], 0
je 0x4502df
lea eax, [ebp - 0x20]
push eax
call fcn.0044fdee
test eax, eax
je 0x4502df
lea eax, [ebp - 0x20]
push eax
call fcn.0045006e
test eax, eax
je 0x450318
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x450295
xor esi, esi
jmp 0x450328
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
jmp 0x45028e
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
jmp 0x45028e

Function at 0x450338
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
sub esp, 0x810
cmp dword [0x50b21c], eax
je 0x45034e
inc eax
leave
ret
push esi
push edi
mov edi, 0x206
push edi
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push 0
push eax
call fcn.00448216
add esp, 0xc
push 0x50a800
mov esi, 0x50adb0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x450426
lea eax, [ebp - 0x410]
push eax
call fcn.00450201
test eax, eax
je 0x450426
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x810]
push str.Suspicious_System_DLL___S__found_in_UsbTreeViews_folder____abort_for_safety
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
push edi
push eax
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push eax
call fcn.00448216
add esp, 0x18
push 0x104
lea eax, [ebp - 0x208]
push eax
push str._TEMP_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp eax, esi
jne 0x450409
push str._n_nHint:_Starting_applications_from_TEMP_folder_is_risky.
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x10
push 0x45759c
lea eax, [ebp - 0x810]
push eax
push dword [0x50b228]
call fcn.0044f594
xor eax, eax
jmp 0x450429
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x7733c45a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x7733c3a3
add ebx, 0
push ecx
call 0x7733c3b8
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x736b6245
sub ebx, dword [0x736d5a84]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x736d5a74
call fcn.77337e82
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.77337390
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x7733c516
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x7733c516
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x7733c4cd
mov eax, 1
lock xchg dword [0x736d5a80], eax
push 0x3dd1fc71
call 0x7733c45a
push esi
add esp, 8
cmp eax, 0
jne 0x7733c443
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x7733c469
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x7733c47e
cmp ecx, edx
cmp eax, 0
je 0x7733c4a3
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x7733c48d
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.7733c4bc
dec eax
loope 0x7733c4bf
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x736d5a80], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x7733c4f3
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x7733c508
jmp 0x7733c513
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x7733c401
Function at 0x7734357b
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x77343851
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x736c26f8
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x736b96be
push 0xffffffffffffffff
call fcn.7733a77b
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x773435e5
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.773435fd
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x77343845
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x77343819
Function at 0x401cc5
Capabilities:
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x401cda
or eax, 0xffffffff
jmp 0x401d72
push esi
push edi
push 0x40119c
push 5
call fcn.00402bda
pop ecx
xor edi, edi
cmp dword [0x409004], ebx
pop ecx
jle 0x401d38
lea esi, [edi*4 + 0x446908]
mov eax, dword [esi]
cmp eax, ebx
je 0x401d2f
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x401d1d
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
push 0x40118c
push 5
call fcn.00402bda
add esp, 0xc
mov dword [esi], ebx
inc edi
cmp edi, dword [0x409004]
jl 0x401cf4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x401d4a
push eax
call esi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp eax, ebx
je 0x401d57
push eax
call esi
mov eax, dword [0x4aed40]
cmp eax, ebx
pop edi
pop esi
je 0x401d70
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov dword [0x4aed40], ebx
xor eax, eax
pop ebx
pop ebp
ret 4

Function at 0x401f95
Capabilities:
Enumerate processes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x40f070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
cmp esi, ebx
jne 0x401fb9
xor eax, eax
jmp 0x402022
push edi
push ebx
push 0xa
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x40201f
lea eax, [ebp - 0x230]
push eax
push edi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x401ffa
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp + 8]
je 0x402000
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x401fe2
jmp 0x402018
lea eax, [ebp - 0x20c]
push eax
push 0x104
push esi
call fcn.00406065
xor ebx, ebx
add esp, 0xc
inc ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00405a18
leave
ret 8

Function at 0x40218c
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.004020f7
test eax, eax
je 0x4021be
push dword [ebp + 8]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4021ba
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
jmp 0x4021d1
cmp dword [ebp + 0xc], 0
jne 0x4021ce
push dword [ebp + 8]
call fcn.00402037
jmp 0x4021d1
xor eax, eax
inc eax
pop ebp
ret 8
Function at 0x40284b
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x40173c
push 5
pop edi
push edi
call fcn.00402bda
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push 0x401720
call sub.FLTLIB.DLL_FilterConnectCommunicationPort
mov esi, eax
mov eax, 0x80000000
mov ecx, esi
and ecx, eax
cmp ecx, eax
mov dword [ebp - 0xc], esi
jne 0x4028a7
push esi
push 0x4016f4
push edi
call fcn.00402bda
mov eax, esi
add esp, 0xc
and eax, 0xffff
jmp 0x4029e9
movzx eax, word [0x40f030]
push eax
push dword [ebp - 8]
call fcn.004021da
call fcn.00401eaa
push dword [0x409004]
push ebx
push ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x18], esi
jne 0x4028fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4016d0
push edi
call fcn.00402bda
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
pop eax
jmp 0x4029e9
mov eax, dword [ebp - 8]
push esi
push eax
push 0x4113a0
push 0x4016a0
push edi
mov dword [0x4113a0], eax
mov dword [0x4113a4], esi
call fcn.00402bda
add esp, 0x14
cmp dword [0x409004], ebx
mov dword [ebp - 4], ebx
jbe 0x4029dc
mov edi, 0x6044
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x4113a0
push 0x40236f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
shl ecx, 2
cmp eax, ebx
mov dword [ecx + 0x446908], eax
je 0x4029f0
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], 0x4aed40
push edi
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
mov eax, dword [ebp - 0x14]
push edi
push esi
push 0x40167c
push 5
mov dword [eax], esi
call fcn.00402bda
add esp, 0x14
cmp esi, ebx
je 0x402a08
push edi
push ebx
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esi + 0x6030]
push eax
push 0x6030
push esi
push dword [ebp - 8]
call sub.FLTLIB.DLL_FilterGetMessage
cmp eax, 0x800703e5
mov dword [ebp - 0xc], eax
jne 0x402a11
mov eax, dword [ebp - 4]
inc dword [ebp - 0x10]
shl eax, 2
add dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 1
jb 0x402968
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [0x409004]
jb 0x402933
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov dword [eax + 4], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x401660
push 5
call fcn.00402bda
add esp, 0xc
jmp 0x402a39
mov dword [ebp - 0xc], 8
jmp 0x402a39
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.msvcrt.dll_free]
push dword [ebp - 4]
push dword [ebp - 0x10]
push edi
push dword [ebp - 0xc]
push 0x401610
push 5
call fcn.00402bda
add esp, 0x1c
push dword [ebp - 0xc]
push 0x4015f0
push 5
call fcn.00402bda
mov eax, dword [ebp - 0xc]
add esp, 0xc
jmp 0x4029e9
Function at 0x402bda
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x5304
call fcn.00405a40
mov eax, dword [0x40f070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, dword [0x409008]
jb 0x402c91
push esi
push edi
mov edi, 0x2a00
push edi
lea eax, [ebp - 0x5304]
push 0
push eax
call sub.msvcrt.dll_memset
mov esi, 0x2900
push esi
lea eax, [ebp - 0x2904]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x401824
push 0x40181c
push esi
lea eax, [ebp - 0x5304]
push edi
push eax
call fcn.00405d86
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
mov edi, 0x2800
push edi
lea eax, [ebp - 0x2904]
push esi
push eax
call fcn.00405cc7
add esp, 0x40
push esi
lea eax, [ebp - 0x2904]
push eax
lea eax, [ebp - 0x5304]
push edi
push eax
call fcn.00405e8e
add esp, 0x10
cmp dword [0x446a08], 0
pop edi
pop esi
jne 0x402c91
lea eax, [ebp - 0x5304]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a18
leave
ret

Function at 0x402ca2
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0xa604
call fcn.00405a40
mov eax, dword [0x40f070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, dword [0x409008]
jb 0x402d60
push esi
push edi
push 0x5400
lea eax, [ebp - 0xa604]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x5200
lea eax, [ebp - 0x5204]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x401838
push 0x40182c
mov esi, 0x2900
push esi
lea eax, [ebp - 0xa604]
push 0x2a00
push eax
call fcn.00405e6a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
mov edi, 0x2800
push edi
lea eax, [ebp - 0x5204]
push esi
push eax
call fcn.00405daa
add esp, 0x40
push esi
lea eax, [ebp - 0x5204]
push eax
lea eax, [ebp - 0xa604]
push edi
push eax
call fcn.004060d9
add esp, 0x10
cmp dword [0x446a08], 0
pop edi
pop esi
jne 0x402d60
lea eax, [ebp - 0xa604]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405a18
leave
ret