joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421150
Capabilities:
Read data from internet
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x4551b0
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x46f7c0]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
mov eax, dword [0x46f7c0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edx, dword [esp + 0x88]
or eax, 0xffffffff
cmp dword [esp + 0x8c], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
ja 0x4211a2
lea eax, [esp + 0x8c]
mov eax, dword [eax]
mov ecx, dword [ecx + 0x10]
lea esi, [esp + 0xc]
push esi
push eax
push edx
xor ebx, ebx
push ecx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x42123d
push 0x17
push str.InternetReadFile_failed
lea ecx, [esp + 0x34]
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
call fcn.00405990
mov dword [esp + 0x80], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x24]
call fcn.00420190
lea ecx, [esp + 0x10]
push ecx
push eax
lea edx, [esp + 0x50]
push edx
mov byte [esp + 0x8c], 1
mov dword [esp + 0x1c], 0x460190
mov dword [esp + 0x20], str.HttpConnection::Response::readContent
mov dword [esp + 0x24], 0x127
call fcn.0041ec60
add esp, 0xc
push 0x46a5c8
lea eax, [esp + 0x4c]
push eax
call fcn.0043be1d
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0043b8c7
add esp, 0x78
ret 8

Function at 0x421f90
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor eax, eax
cmp word [esp], 9
sete al
add esp, 0x24
ret

Function at 0x421fe0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x455429
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x46f7c0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [esp + 0x2c]
cmp dword [eax + 0x14], 0x10
jb 0x422018
mov eax, dword [eax]
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], eax
call fcn.0043afd2
mov dword [esp + 0xc], vtable.std::runtime_error.0
mov esi, dword [esp + 0x28]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
mov dword [esp + 0x24], 1
call fcn.0043b057
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esi + 0xc]
push edx
mov byte [esp + 0x2c], 2
mov dword [esi], vtable.JdsError_class_std::runtime_error_.0
call fcn.00421bf0
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x20], 0
call fcn.0043b02e
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret
Function at 0x422350
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x28
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 4]
push eax
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [esp + 4], 9
mov edx, str.amd64
je 0x42239e
mov edx, str.i586
push esi
mov esi, dword [esp + 0x30]
mov eax, edx
push edi
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4223c0
sub eax, edi
push eax
push edx
mov ecx, esi
call fcn.00405990
pop edi
mov eax, esi
pop esi
add esp, 0x28
ret

Function at 0x4225a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x455510
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x46f7c0]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46f7c0]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x5c]
xor ebx, ebx
push 0x104
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.0040f2e0
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push esi
sub edi, esi
push edi
mov dword [esp + 0x5c], ebx
call ebp
cmp eax, edi
jbe 0x42262e
push eax
lea ecx, [esp + 0x18]
call fcn.0040f2e0
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push esi
sub ecx, esi
push ecx
call ebp
mov ebp, 0xf
mov eax, esi
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x422644
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x34]
call fcn.00405990
mov edi, dword [esp + 0x24]
lea edx, [esp + 0x2c]
push edx
push edi
mov byte [esp + 0x5c], 1
call fcn.00427330
add esp, 8
cmp dword [esp + 0x40], 0x10
jb 0x422683
mov eax, dword [esp + 0x2c]
push eax
call fcn.0043a71e
add esp, 4
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp esi, ebx
je 0x42269c
push esi
call fcn.0043a71e
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0043b8c7
add esp, 0x44
ret
Function at 0x426a30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x455942
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x46f7c0]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46f7c0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, dword [esp + 0x78]
mov edi, ecx
xor ebp, ebp
lea eax, [esp + 0x18]
mov dword [esp + 0x14], ebp
mov ecx, dword [edi]
push eax
call ecx
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [esp + 0x30], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x34], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0x10]
add esp, 4
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], eax
cmp ecx, ebp
je 0x426ad5
mov eax, ecx
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x2c], 0
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x426ab2
sub eax, edi
push eax
push ecx
lea ecx, [esp + 0x34]
call fcn.00405990
lea eax, [esp + 0x2c]
mov dword [esp + 0x70], ebp
mov ebx, 1
jmp 0x426aee
lea ecx, [esp + 0x48]
push ecx
mov ecx, edi
call fcn.004266f0
mov dword [esp + 0x70], 1
mov ebx, 2
mov edi, 0xf
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebp
push eax
mov ecx, esi
mov dword [esp + 0x18], ebx
mov byte [esi], 0
call fcn.00406af0
or ebx, 4
test bl, 2
je 0x426b34
and ebx, 0xfffffffd
cmp dword [esp + 0x5c], 0x10
jb 0x426b27
mov edx, dword [esp + 0x48]
push edx
call fcn.0043a71e
add esp, 4
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], ebp
mov byte [esp + 0x48], 0
test bl, 1
je 0x426b4d
cmp dword [esp + 0x40], 0x10
jb 0x426b4d
mov eax, dword [esp + 0x2c]
push eax
call fcn.0043a71e
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0043b8c7
add esp, 0x60
ret 4
Function at 0x4279e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x455b59
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x46f7c0]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46f7c0]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov eax, dword [esp + 0x8c]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x88]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], ebx
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x24], 1
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, edx
sub eax, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
sub eax, edx
neg eax
sbb eax, eax
and eax, ecx
cmp dword [ebx + 0x14], 0x10
jb 0x427a72
mov edx, dword [ebx]
jmp 0x427a74
mov edx, ebx
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx]
lea edi, [esp + 0x18]
push edi
push eax
mov eax, dword [esp + 0x28]
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [esp + 0x18]
mov edi, eax
cmp edi, 0xea
je 0x427ab8
mov ecx, dword [esi]
cmp ecx, dword [esi + 4]
jne 0x427b50
test edi, edi
jne 0x427b54
test ebp, ebp
je 0x427bce
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov edi, ecx
sub edi, edx
cmp edi, ebp
jbe 0x427ae4
add ebp, edx
cmp ebp, ecx
je 0x427a51
mov edi, ecx
sub edi, ecx
push edi
push ecx
push ebp
call fcn.0043b490
add esp, 0xc
add edi, ebp
mov dword [esi + 4], edi
jmp 0x427a51
jae 0x427a51
mov eax, edx
sub eax, ecx
add eax, ebp
or ecx, 0xffffffff
sub ecx, eax
cmp ecx, edi
jb 0x427bf9
add edi, eax
mov eax, dword [esi + 8]
sub eax, edx
cmp edi, eax
jbe 0x427b29
mov ecx, eax
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
cmp edx, eax
jae 0x427b19
xor eax, eax
jmp 0x427b1b
add eax, ecx
cmp eax, edi
jae 0x427b21
mov eax, edi
push eax
mov ecx, esi
call fcn.0040a7c0
mov ecx, dword [esi + 4]
mov eax, dword [esi]
sub eax, ecx
add eax, ebp
je 0x427b40
push eax
push 0
push ecx
call fcn.0043b8e0
add esp, 0xc
mov eax, dword [esi]
mov ebx, dword [esp + 0x1c]
add eax, ebp
mov dword [esi + 4], eax
jmp 0x427a51
test edi, edi
je 0x427bce
push 0xb
push str.query_value
lea ecx, [esp + 0x40]
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
call fcn.00405990
push edi
push ebx
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x60]
push edx
mov dword [esp + 0x8c], 1
call fcn.004277f0
add esp, 0x10
cmp dword [eax + 0x14], 0x10
mov byte [esp + 0x7c], 2
jb 0x427ba5
mov eax, dword [eax]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], eax
call fcn.0043afd2
push 0x467f84
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x34], vtable.std::runtime_error.0
call fcn.0043be1d
push ebp
mov ecx, esi
call fcn.0040f2e0
mov eax, esi
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0043b8c7
add esp, 0x6c
ret 0xc
push str.vector_T__too_long
call fcn.00428a68
int3
Function at 0x427c10
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x455ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x46f7c0]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
push edi
mov eax, dword [0x46f7c0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov edi, dword [esp + 0x68]
cmp dword [edi + 0x14], 0x10
mov eax, ecx
jb 0x427c50
mov ecx, dword [edi]
jmp 0x427c52
mov ecx, edi
mov eax, dword [eax]
push 4
lea edx, [esp + 0x70]
push edx
push 4
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x427cea
push 0xf
push str.set_dword_value
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.00405990
push esi
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x70], 0
call fcn.004277f0
add esp, 0x10
cmp dword [eax + 0x14], 0x10
mov byte [esp + 0x60], 1
jb 0x427cc1
mov edx, dword [eax]
mov dword [esp + 0xc], edx
jmp 0x427cc5
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
call fcn.0043afd2
push 0x467f84
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], vtable.std::runtime_error.0
call fcn.0043be1d
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0043b8c7
add esp, 0x58
ret 8

Function at 0x427d10
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x455ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x46f7c0]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
push edi
mov eax, dword [0x46f7c0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6c]
cmp dword [eax + 0x14], 0x10
mov edi, dword [esp + 0x68]
mov esi, dword [eax + 0x10]
jb 0x427d53
mov eax, dword [eax]
cmp dword [edi + 0x14], 0x10
jb 0x427d5d
mov edx, dword [edi]
jmp 0x427d5f
mov edx, edi
mov ecx, dword [ecx]
inc esi
push esi
push eax
push 1
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x427df3
push 0x10
push str.set_string_value
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.00405990
push esi
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x70], 0
call fcn.004277f0
add esp, 0x10
cmp dword [eax + 0x14], 0x10
mov byte [esp + 0x60], 1
jb 0x427dca
mov edx, dword [eax]
mov dword [esp + 0xc], edx
jmp 0x427dce
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
call fcn.0043afd2
push 0x467f84
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], vtable.std::runtime_error.0
call fcn.0043be1d
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0043b8c7
add esp, 0x58
ret 8
Function at 0x427e20
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x455ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x46f7c0]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
push edi
mov eax, dword [0x46f7c0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov edi, dword [esp + 0x68]
cmp dword [edi + 0x14], 0x10
mov edx, dword [esp + 0x6c]
mov eax, ecx
jb 0x427e64
mov ecx, dword [edi]
jmp 0x427e66
mov ecx, edi
mov esi, dword [esp + 0x70]
mov eax, dword [eax]
push esi
push edx
push 3
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x427efd
push 0x10
push str.set_binary_value
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.00405990
push esi
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x70], 0
call fcn.004277f0
add esp, 0x10
cmp dword [eax + 0x14], 0x10
mov byte [esp + 0x60], 1
jb 0x427ed4
mov edx, dword [eax]
mov dword [esp + 0xc], edx
jmp 0x427ed8
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
call fcn.0043afd2
push 0x467f84
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], vtable.std::runtime_error.0
call fcn.0043be1d
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0043b8c7
add esp, 0x58
ret 0xc
Function at 0x428640
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x455dbe
mov eax, dword fs:[0]
push eax
mov eax, 0x8090
call fcn.0043c050
mov eax, dword [0x46f7c0]
xor eax, esp
mov dword [esp + 0x808c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46f7c0]
xor eax, esp
push eax
lea eax, [esp + 0x80a4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x80b4]
xor ebx, ebx
push 0x7fff
lea eax, [esp + 0xa4]
push ebx
push eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x24], ebx
call fcn.0043b8e0
add esp, 0xc
xor edi, edi
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [esp + 0x80ac], ebx
mov dword [esp + 0x18], 1
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0xb4]
push ecx
push edi
push eax
mov dword [esp + 0x3c], 0x7fff
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, eax
inc edi
cmp esi, ebx
jne 0x428766
lea eax, [esp + 0xa0]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x428710
sub eax, edx
push eax
lea edx, [esp + 0xa4]
push edx
lea ecx, [esp + 0x38]
call fcn.00405990
lea eax, [esp + 0x30]
push eax
mov ecx, ebp
mov dword [esp + 0x80b0], 1
call fcn.00428560
cmp dword [esp + 0x44], 0x10
mov byte [esp + 0x80ac], bl
jb 0x4286c4
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0043a71e
add esp, 4
jmp 0x4286c4
cmp esi, 0x103
je 0x4287fe
push 0xb
push str.enum_values
lea ecx, [esp + 0x54]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
call fcn.00405990
lea edx, [esp + 0x84]
push edi
push edx
mov dword [esp + 0x80b4], 2
call fcn.0041c3b0
push esi
push eax
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x7c]
push ecx
call fcn.004277f0
add esp, 0x18
cmp dword [eax + 0x14], 0x10
mov byte [esp + 0x80ac], 4
jb 0x4287d5
mov edx, dword [eax]
mov dword [esp + 0x14], edx
jmp 0x4287d9
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
call fcn.0043afd2
push 0x467f84
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], vtable.std::runtime_error.0
call fcn.0043be1d
mov eax, ebp
mov ecx, dword [esp + 0x80a4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x808c]
xor ecx, esp
call fcn.0043b8c7
add esp, 0x809c
ret 4

Function at 0x43b8c7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46f7c0]
jne 0x43b8d1
repz ret
jmp fcn.00445c06
Function at 0x44f286
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46f7c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00445dc6
and dword [ebp - 0x14], 0
cmp dword [0x472044], 0
mov dword [ebp - 0x18], eax
jne 0x44f339
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x44f3e1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x44f3e1
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x472044], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x472048], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x47204c], eax
call edi
push eax
call esi
mov dword [0x472054], eax
test eax, eax
je 0x44f339
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x472050], eax
mov eax, dword [0x472050]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x44f392
cmp dword [0x472054], ecx
je 0x44f392
push eax
call esi
push dword [0x472054]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x44f392
test ebx, ebx
je 0x44f392
call edi
test eax, eax
je 0x44f389
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x44f389
test byte [ebp - 8], 1
jne 0x44f392
or dword [ebp + 0x10], 0x200000
jmp 0x44f3c5
mov eax, dword [0x472048]
cmp eax, dword [ebp - 0x18]
je 0x44f3c5
push eax
call esi
test eax, eax
je 0x44f3c5
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x44f3c5
mov eax, dword [0x47204c]
cmp eax, dword [ebp - 0x18]
je 0x44f3c5
push eax
call esi
test eax, eax
je 0x44f3c5
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x472044]
call esi
test eax, eax
je 0x44f3e1
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x44f3e3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b8c7
leave
ret
Function at 0x401610
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x19c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x414bf8], eax
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x402670
mov dword [0x415ec8], 0
push 0
mov dword [0x415ec4], 0
mov dword [0x415ec0], 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x415ebc], 0
call fcn.00404690
int3

Function at 0x402510
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov dword [0x415ec4], ebx
jmp 0x402530
xor eax, eax
cmp ebx, 1
sete al
xor edx, edx
xor ebx, ebx
xor edi, edi
xor esi, esi
mov dword [0x415ebc], eax
mov eax, dword [0x415ec8]
test eax, eax
je 0x4025a1
mov edi, edi
inc edx
cmp byte [eax + 8], 0
jne 0x402566
inc ebx
test esi, esi
je 0x402564
mov cl, byte [esi + 9]
cmp cl, byte [eax + 9]
jle 0x402566
mov esi, eax
cmp dword [eax + 4], edi
cmovae edi, dword [eax + 4]
mov eax, dword [eax]
test eax, eax
jne 0x402550
mov dword [ebp - 0x10], edx
cmp edx, 0x1000
jl 0x4025a1
call fcn.004024a0
mov edx, dword [ebp - 0x10]
cmp ebx, 0x200
jle 0x4025a1
mov dword [ebp - 0xc], 1
mov dword [0x415ebc], 1
jmp 0x4025a6
xor eax, eax
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x40261e
test esi, esi
je 0x40261e
cmp dword [0x415ec4], 8
jb 0x4025ca
push 0x100
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebp - 0xc]
jmp 0x402530
lea eax, [ebp - 8]
push eax
push 0
push esi
push 0x402450
push 0
push 0
mov byte [esi + 8], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x402607
cmp eax, 0xffffffff
je 0x402607
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x100
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebp - 0xc]
jmp 0x402530
push 0x400
mov byte [esi + 8], 2
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [ebp - 0xc]
jmp 0x402530
mov ebx, 2
mov dword [0x415ebc], 0
cmp edx, 3
jl 0x40265a
test edi, edi
je 0x40265a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x1770
jb 0x40265a
call fcn.004020e0
push 0x80
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402530
push 0x400
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402530