joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push esi
push edi
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0x53
mov esi, 0x46c73c
mov edi, 0x47303c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0043e900
push 0x64
lea ecx, [esp + 4]
push ecx
call fcn.0041f5d0
cmp eax, 0x32
jae 0x43ff0c
xor eax, eax
jmp 0x43ff7b
mov esi, 0x46c73c
mov edi, 0x47303c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
xor ecx, ecx
mov edx, 2
nop
mov esi, dword [esp + edx]
and esi, 0xff
cmp esi, 0x30
jae 0x43ff3a
xor esi, esi
jmp 0x43ff3d
add esi, 0xffffffd0
cmp esi, 9
jbe 0x43ff45
add esi, 0xfffffff9
mov edi, 4
jmp 0x43ff4e
mov edi, ebx
test esi, 1
je 0x43ff69
mov ebx, ecx
sar ebx, 5
mov ebp, ecx
and ebp, 0x1f
bts dword [ebx*4 + 0x47303c], ebp
inc eax
inc ecx
shr esi, 1
lea ebx, [edi - 1]
cmp edi, 1
jne 0x43ff4c
inc edx
cmp edx, 0x31
jbe 0x43ff28
test eax, eax
je 0x43ffad
mov byte [0x473039], 0x2a
mov byte [0x47303a], 0x20
mov dword [esp], 0x626d7953
mov dword [esp + 4], 0x46206c6f
mov dword [esp + 8], 0x65746c69
mov word [esp + 0xc], 0x72
jmp 0x43fff3
mov al, byte [esp]
xor ecx, ecx
mov cl, al
bt dword [0x46eb04], ecx
jb 0x43ffc6
mov byte [0x473039], 0
jmp 0x43ffd4
mov byte [0x473039], al
mov al, byte [esp + 1]
mov byte [0x47303a], al
mov dword [esp], 0x776f6853
mov dword [esp + 4], 0x656e4f20
mov dword [esp + 8], 0x6d795320
mov dword [esp + 0xc], 0x6c6f62
mov al, byte [esp + 0x78]
test al, al
jne 0x440002
mov byte [0x473039], 0
mov cl, byte [esp + 0x7c]
test cl, cl
je 0x440022
mov dl, byte [0x473039]
test dl, dl
setne bl
push ebx
push 0x64
lea edx, [esp + 8]
push edx
call fcn.0043e5a0
sub esp, 0xffffff9c
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4405f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push edi
add esp, 0xfffff800
mov al, byte [0x4955c5]
test al, al
je 0x440633
push 0x4955c0
call fcn.004599e0
mov al, byte [0x4955c5]
test al, al
je 0x440633
push 0x4955c0
call fcn.004599e0
mov al, byte [0x4955c5]
test al, al
je 0x440633
push 0x1a
push str.Check_Version_in_Progress
call fcn.0043d8a0
mov al, byte [0x4955c5]
test al, al
jne 0x4407fc
push 0xc
push str.chkvers.txt
mov byte [esp + 0x408], 0
call fcn.0043c040
mov edi, eax
push edi
call fcn.0043c670
test al, al
je 0x4406ac
push 0x400
push 0x400
lea eax, [esp + 0x408]
push eax
push edi
call fcn.0043c0b0
mov esi, eax
push edi
call fcn.0043c0a0
test esi, esi
jge 0x44069a
push 0x1b
push str.Can_not_read__chkvers.txt_
mov byte [esp + 0x408], 0
call fcn.0043d8a0
jmp 0x4406b8
cmp esi, 0x3ff
jg 0x4406b8
mov byte [esp + esi + 0x400], 0
jmp 0x4406b8
push 0x1d
push str.File__chkvers.txt__not_found
call fcn.0043d8a0
mov byte [esp], 0
mov al, byte [esp + 0x400]
test al, al
je 0x440716
xor edi, edi
jmp 0x4406d7
mov al, byte [esp + edi + 0x400]
test al, al
je 0x440716
lea eax, [esp + edi + 0x400]
cmp byte [eax], 0x24
je 0x4406f7
push 1
push eax
push 0x400
lea eax, [esp + 0xc]
push eax
call fcn.0041f450
jmp 0x44070d
push 5
push str.0.81
push 0x400
lea ecx, [esp + 0xc]
push ecx
call fcn.0041f450
inc edi
cmp edi, 0x3ff
jle 0x4406cc
push 0x4955c0
push 0x400
lea eax, [esp + 8]
push eax
call fcn.00459930
mov cl, byte [0x4955c5]
test cl, cl
je 0x4407fc
push 0x4955c0
call fcn.004599e0
mov eax, dword [0x4955c8]
test eax, eax
je 0x4407fc
push 0x400
lea eax, [esp + 4]
push eax
push 0x400
lea ecx, [esp + 0x40c]
push ecx
mov dword [esp + 0x410], 0x6e6e6143
mov dword [esp + 0x414], 0x5320746f
mov dword [esp + 0x418], 0x74726174
mov word [esp + 0x41c], 0x5b20
mov byte [esp + 0x41e], 0
call fcn.0041f450
push 0xd
push str.__exit_code:
push 0x400
lea eax, [esp + 0x40c]
push eax
call fcn.0041f450
push 0x400
lea ecx, [esp + 4]
push ecx
push 0
mov eax, dword [0x4955c8]
push eax
call fcn.0041f600
push 0x400
lea ecx, [esp + 4]
push ecx
push 0x400
lea eax, [esp + 0x40c]
push eax
call fcn.0041f450
push 0x400
lea ecx, [esp + 0x404]
push ecx
call fcn.0043d8a0
sub esp, 0xfffff800
pop edi
pop esi
ret
Function at 0x445f70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
add esp, 0xffffff38
mov edi, dword [esp + 0xd0]
push 0x2198
push 2
push 0x46eaec
push 0xa
push str._Show_All
push edi
mov dword [edi + 0x24], 0
call fcn.00442e50
push 0x219b
push 3
push 0x46eadc
push 0xa
push str._Show_POI
push edi
call fcn.00442e50
push 0x219d
push 2
push 0x46eaec
push 0xd
push str._WX_Stations
push edi
call fcn.00442e50
push 0x21a2
push 2
push 0x46eabc
push 0x10
push str._Temp_Colourmap
push edi
call fcn.00442e50
push 0x21a7
push 2
push 0x46eaa8
push 0x10
push str._Rain_Colourmap
push edi
call fcn.00442e50
push 0x21ac
push 2
push 0x46ea94
push 0xf
push str._Dimm_Notmover
push edi
call fcn.00442e50
push 0x64
lea eax, [esp + 0x68]
push eax
push 0x53
call fcn.0043e900
push 0x64
lea ecx, [esp + 0x68]
push ecx
push 0x64
lea eax, [esp + 0xc]
push eax
mov byte [esp + 0x76], 0
mov dword [esp + 0x10], 0x6d795320
mov dword [esp + 0x14], 0x206c6f62
mov word [esp + 0x18], 0x7c
call fcn.0041f450
push 0x21b1
push 3
push 0x46ea74
push 0x64
lea ecx, [esp + 0x10]
push ecx
push edi
call fcn.00442e50
mov al, byte [esp + 0x64]
xor ecx, ecx
mov cl, al
bt dword [0x46eb04], ecx
jae 0x4460b9
mov ecx, dword [edi + 0x24]
dec ecx
mov edx, dword [edi + 8]
imul ecx, edx
shr edx, 1
add ecx, edx
push ecx
mov ecx, dword [0x493dbc]
shr ecx, 1
mov edx, dword [edi + 0x14]
sub edx, ecx
mov ecx, dword [0x493dc0]
sub edx, ecx
add edx, 0xfffffff8
push edx
push dword [esp + 0x6d]
push eax
push dword [edi + 4]
call fcn.00445eb0
mov dword [edi + 0x50], fcn.00445f70
mov dword [edi + 0x28], 0
sub esp, 0xffffff38
pop edi
ret 4
Function at 0x4514d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push edi
add esp, 0xffffff38
mov edi, dword [esp + 0xd4]
push 0x26
mov dword [edi + 0x24], 0
call fcn.0043eae0
push eax
mov eax, dword [0x493dc0]
add eax, 2
push eax
push 0x1d15
push 2
push 0x46da24
push 0x16
push str.___Allow_Gate_Rf_Net
push edi
call fcn.00443630
push 0x25
call fcn.0043eae0
push eax
mov ecx, dword [0x493dc0]
add ecx, 2
push ecx
push 0x1d10
push 2
push 0x46da24
push 0x14
push str.____Allow_Tx_to_Net
push edi
call fcn.00443630
push 0x24
call fcn.0043eae0
push eax
mov eax, dword [0x493dc0]
add eax, 2
push eax
push 0x1d0b
push 2
push 0x46da24
push 0x13
push str.____Connect_Server
push edi
call fcn.00443630
push 0x1d06
push 2
push 0x46da24
push 0xe
push str._Serverfilter
push edi
call fcn.00442e50
push 0x1d01
push 2
push 0x46da24
push 0xc
push str._Server_url
push edi
call fcn.00442e50
push 0x1cfc
push 2
push 0x46da24
push 0xa
push str._Passcode
push edi
call fcn.00442e50
push 0x1cf7
push 2
push 0x46da24
push 0xf
push str._Netbeacontext
push edi
call fcn.00442e50
push 0x1cf2
push 2
push 0x46da24
push 0xd
push str._My_Position
push edi
call fcn.00442e50
push 0x64
lea ecx, [esp + 0x68]
push ecx
push 0xe
call fcn.0043e900
push 0x64
lea eax, [esp + 0x68]
push eax
push 0x64
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x20794d20
mov dword [esp + 0x14], 0x626d7953
mov dword [esp + 0x18], 0x206c6f
call fcn.0041f450
push 0x1ced
push 3
push 0x46d98c
push 0x64
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00442e50
mov ecx, dword [edi + 0x24]
dec ecx
mov eax, dword [edi + 8]
imul ecx, eax
shr eax, 1
add ecx, eax
push ecx
mov ecx, dword [0x493dbc]
shr ecx, 1
mov eax, dword [edi + 0x14]
sub eax, ecx
mov ecx, dword [0x493dc0]
sub eax, ecx
add eax, 0xfffffff8
push eax
push dword [esp + 0x6d]
push dword [esp + 0x70]
push dword [edi + 4]
call fcn.00445eb0
push 0x64
lea eax, [esp + 4]
push eax
push 9
call fcn.0043e900
mov byte [esp + 0x64], 0
mov al, byte [esp]
test al, al
je 0x4516cc
xor esi, esi
jmp 0x451693
mov al, byte [esp + esi]
test al, al
je 0x4516cc
lea eax, [esp + esi]
mov cl, byte [eax]
cmp cl, 0x20
jbe 0x4516b3
cmp cl, 0x7f
jae 0x4516b3
push 1
push eax
push 0x64
lea eax, [esp + 0x70]
push eax
call fcn.0041f450
jmp 0x4516c6
push 3
push 0x46d984
push 0x64
lea ecx, [esp + 0x70]
push ecx
call fcn.0041f450
inc esi
cmp esi, 0x63
jbe 0x45168c
push 0x64
lea eax, [esp + 0x68]
push eax
push 0x64
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x20794d20
mov dword [esp + 0x14], 0x6c6c6143
mov word [esp + 0x18], 0x20
call fcn.0041f450
push 0x1ce8
push 2
push 0x46da24
push 0x64
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00442e50
mov dword [edi + 0x50], fcn.004514d0
mov dword [edi + 0x28], 0
mov byte [edi + 0x58], 1
sub esp, 0xffffff38
pop edi
pop esi
ret 4
Function at 0x451e10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xffffffcc
push 0x5a
call fcn.00442390
push 0x5a
mov dword [esp + 4], 0x2070614d
mov dword [esp + 8], 0x6e776f64
mov dword [esp + 0xc], 0x64616f6c
mov word [esp + 0x10], 0x20
call fcn.0043eae0
test al, al
je 0x451e59
push 3
push 0x46d744
push 0x33
lea eax, [esp + 0xc]
push eax
call fcn.0041f450
jmp 0x451e6c
push 4
push 0x46d740
push 0x33
lea eax, [esp + 0xc]
push eax
call fcn.0041f450
push 0x33
lea eax, [esp + 4]
push eax
push 0x62
push 4
push 6
push 0
push 0
call fcn.0043cdc0
sub esp, 0xffffffcc
ret

Function at 0x451e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xffffffcc
push 0x44
call fcn.00442390
push 0x44
mov dword [esp + 4], 0x6f6c6c41
mov dword [esp + 8], 0x78452077
mov dword [esp + 0xc], 0x646e6170
mov dword [esp + 0x10], 0x70614d20
mov word [esp + 0x14], 0x2073
mov byte [esp + 0x16], 0
call fcn.0043eae0
test al, al
je 0x451ee6
push 3
push 0x46d728
push 0x33
lea eax, [esp + 0xc]
push eax
call fcn.0041f450
jmp 0x451ef9
push 4
push 0x46d724
push 0x33
lea eax, [esp + 0xc]
push eax
call fcn.0041f450
push 0x33
lea eax, [esp + 4]
push eax
push 0x62
push 4
push 6
push 0
push 0
call fcn.0043cdc0
sub esp, 0xffffffcc
ret
Function at 0x453a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push edi
add esp, 0xfffff7f8
mov edi, dword [esp + 0x814]
mov esi, dword [esp + 0x818]
lea eax, [esp + 0x804]
push eax
push 1
add edi, 0xfffffffe
lea ecx, [edi - 1]
push ecx
push 0xffffffffffffff89
call fcn.00442020
mov eax, dword [esp + 0x804]
test eax, eax
je 0x453cdd
cmp esi, 6
je 0x453adc
mov dword [0x5b0f78], 0
test esi, esi
je 0x453af5
cmp esi, 3
ja 0x453af5
dec esi
mov cl, byte [esi*4 + 0x471570]
xor byte [eax + 4], cl
jmp 0x453cdd
cmp esi, 4
je 0x453c7a
cmp esi, 5
je 0x453c6e
cmp esi, 6
jne 0x453cdd
cmp dword [0x5b0f78], edi
je 0x453b64
mov ecx, dword [0x5b0f78]
test ecx, ecx
je 0x453b41
push 0x72
push 4
push 0x14
push str.logfile_not_deleted
call fcn.0043ce00
mov dword [0x5b0f78], 0
jmp 0x453cdd
push edi
push 3
push 0xffffffffffffff89
mov dword [0x5b0f78], 0
call fcn.00441ea0
mov dword [0x5b0f78], 0
jmp 0x453cdd
push 0xc9
add eax, 5
push eax
push 0x400
lea eax, [esp + 0x410]
push eax
call fcn.0041f400
push 0x400
lea ecx, [esp + 0x408]
push ecx
call fcn.00404af0
mov al, byte [esp + 0x404]
test al, al
je 0x453bbc
lea ecx, [esp]
push ecx
push 0x400
lea edx, [esp + 0x40c]
push edx
mov byte [esp + 0xc], 0
call fcn.0045a720
mov cl, byte [esp]
jmp 0x453bbe
xor cl, cl
test cl, cl
je 0x453bfd
push 0x400
lea eax, [esp + 0x408]
push eax
push 0x400
lea ecx, [esp + 0x10]
push ecx
mov word [esp + 0x14], 0x5b
call fcn.0041f450
push 0xa
push str.__deleted
push 0x400
lea eax, [esp + 0x10]
push eax
call fcn.0041f450
jmp 0x453c4f
push 0x400
lea eax, [esp + 0x408]
push eax
push 0x400
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x6e6e6163
mov dword [esp + 0x18], 0x6420746f
mov dword [esp + 0x1c], 0x74656c65
mov dword [esp + 0x20], 0x5b2065
call fcn.0041f450
push 2
push 0x46cf50
push 0x400
lea eax, [esp + 0x10]
push eax
call fcn.0041f450
push 0x72
push 0
push 0x400
lea eax, [esp + 0x10]
push eax
call fcn.0043ce00
mov dword [0x5b0f78], 0
jmp 0x453cdd
push edi
push 2
push 0xffffffffffffff89
call fcn.00441ea0
jmp 0x453cdd
push 0xc9
add eax, 5
push eax
push 0x400
lea eax, [esp + 0x410]
push eax
call fcn.0041f400
push 0x400
lea ecx, [esp + 0x408]
push ecx
call fcn.00404af0
push 0x400
lea eax, [esp + 8]
push eax
push 0x400
lea ecx, [esp + 0x410]
push ecx
call fcn.0043f7f0
test eax, eax
jl 0x453cdd
push 0x72
push 0
push 0x20
push str.Delele_Logfile___Click_Delete
mov dword [0x5b0f78], edi
call fcn.0043ce00
mov byte [0x5b0f4b], 1
sub esp, 0xfffff7f8
pop edi
pop esi
ret 8
Function at 0x459520
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
push ebx
push esi
push edi
mov ecx, dword [0x5b361c]
mov eax, dword [0x5b3604]
cmp eax, 0
jbe 0x4595d7
test ecx, ecx
je 0x4595d7
push ecx
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x4595d7
call sub.USER32.DLL_EmptyClipboard
mov eax, dword [0x5b3604]
mov ecx, dword [0x5b3600]
mov edx, eax
xor ebp, ebp
xor ebx, ebx
jmp 0x45956a
mov edx, esi
cmp byte [ecx + ebp], 0xa
jne 0x459571
inc ebx
inc ebp
lea esi, [edx - 1]
cmp edx, 1
jne 0x459568
lea eax, [eax + ebx + 1]
push eax
push 2
call sub.KERNEL32.DLL_GlobalAlloc
mov edi, eax
test edi, edi
je 0x4595d2
push edi
call sub.KERNEL32.DLL_GlobalLock
mov esi, dword [0x5b3604]
mov ecx, dword [0x5b3600]
xor ebx, ebx
xor ebp, ebp
jmp 0x4595a6
mov esi, edx
mov dl, byte [ecx + ebp]
cmp dl, 0xa
jne 0x4595b3
mov byte [eax + ebx], 0xd
inc ebx
mov byte [eax + ebx], dl
inc ebp
inc ebx
lea edx, [esi - 1]
cmp esi, 1
jne 0x4595a4
mov byte [eax + ebx], 0
push edi
call sub.KERNEL32.DLL_GlobalUnlock
push edi
push 1
call sub.USER32.DLL_SetClipboardData
call sub.USER32.DLL_CloseClipboard
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4595e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push esi
push edi
mov eax, dword [0x5b361c]
test eax, eax
je 0x459635
push eax
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x459635
push 1
call sub.USER32.DLL_GetClipboardData
mov edi, eax
test edi, edi
je 0x459630
push edi
call sub.KERNEL32.DLL_GlobalLock
mov esi, eax
test esi, esi
je 0x459630
xor ebp, ebp
jmp 0x459627
cmp ebp, 0x2710
jae 0x459639
inc ebp
push 0
push 1
push eax
call fcn.0043da10
mov al, byte [esi + ebp]
test al, al
jne 0x459614
jmp 0x459639
call sub.USER32.DLL_CloseClipboard
pop edi
pop esi
pop ebp
ret
push edi
call sub.KERNEL32.DLL_GlobalUnlock
jmp 0x459630

Function at 0x459930
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
add esp, 0xffffffa8
mov dword [ebp - 0x60], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push eax
mov ecx, eax
cmp ecx, 0x1000
jb 0x45995b
sub esp, 0xffc
sub ecx, 0x1000
push eax
jmp 0x459944
lea edx, [ebp - 0x4c]
sub esp, ecx
mov ecx, eax
and esp, 0xfffffffc
mov esi, esp
push 0x44
shr ecx, 2
push 0
push edx
push esi
push edi
mov edi, esi
mov esi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
call fcn.0046896f
lea ecx, [ebp - 0x4c]
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x4c], 0x44
push eax
push ecx
mov word [ebp - 0x1c], 4
push 0
push 0
push 0x20
push 0
push 0
push 0
push esi
push 0
call sub.KERNEL32.DLL_CreateProcessA
mov byte [edi + 5], al
mov eax, dword [ebp - 0x5c]
push dword [ebp - 0x58]
mov dword [edi], eax
call sub.KERNEL32.DLL_CloseHandle
mov esp, dword [ebp - 0x60]
sub esp, 0xffffffa8
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x459a30
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov al, byte [edi + 5]
test al, al
je 0x459a60
xor esi, esi
jmp 0x459a49
cmp esi, 0x64
jae 0x459a60
inc esi
push 0
push dword [edi]
call sub.KERNEL32.DLL_TerminateProcess
push edi
call fcn.004599e0
mov al, byte [edi + 5]
test al, al
jne 0x459a44
pop edi
pop esi
ret 4

Function at 0x45baa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
push eax
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test ebx, ebx
setl byte [esp]
mov dword [ecx + 0x110], 0x100
mov dword [ecx + 0x114], 0x100
test byte [ecx + 0xc], 0x80
jne 0x45bad4
mov dword [ecx + 4], 1
mov eax, 0x100
sub eax, dword [ecx + 4]
jg 0x45bae5
mov dword [ecx + 4], 0xff
cmp ebx, 0x80000000
je 0x45bb6b
mov al, byte [esp]
test al, al
je 0x45bafd
mov edx, ebx
sar edx, 0x1f
xor ebx, edx
sub ebx, edx
test ebx, ebx
jne 0x45bb10
mov edx, dword [ecx + 4]
test edx, edx
jle 0x45bb80
jmp 0x45bb10
xor ebx, ebx
test esp, esp
mov eax, ebx
mov edx, ebx
sar edx, 0x1f
idiv dword [0x4700ec]
mov eax, edx
sar eax, 0x1f
and eax, 0xa
add edx, eax
mov eax, edx
sar eax, 0x1f
xor edx, eax
sub edx, eax
mov eax, dword [ecx + 0x114]
dec eax
mov dword [ecx + 0x114], eax
add edx, 0x30
mov byte [ecx + eax + 0xe], dl
mov ebp, ebx
sar ebp, 0x1f
xor ebx, ebp
mov eax, ebx
mul dword [str.gfffFormOut.mod]
shr edx, 2
mov ebx, edx
xor ebx, ebp
mov eax, dword [ecx + 4]
dec eax
mov dword [ecx + 4], eax
test ebx, ebx
jne 0x45bb10
test eax, eax
jg 0x45bb0c
jmp 0x45bb80
push 0xb
push str.2147483648
lea eax, [esp + 0x1c]
push eax
call fcn.0045ba20
mov ecx, dword [esp + 0x18]
mov ax, word [ecx + 0xc]
test al, 4
je 0x45bbcd
test al, 0x40
je 0x45bbcd
mov edx, dword [ecx + 0x110]
sub edx, dword [ecx]
jge 0x45bb98
xor edx, edx
test al, 0x12
jne 0x45bba3
mov al, byte [esp]
test al, al
je 0x45bba4
inc edx
cmp dword [ecx + 0x114], edx
jle 0x45bbcd
dec dword [ecx + 0x114]
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x114]
mov byte [ecx + eax + 0xe], 0x30
mov ecx, dword [esp + 0x18]
cmp dword [ecx + 0x114], edx
jg 0x45bbac
mov ax, word [ecx + 0xc]
test al, 0x10
je 0x45bc00
dec dword [ecx + 0x114]
mov ecx, dword [esp + 0x18]
mov dl, byte [esp]
test dl, dl
je 0x45bbf3
mov ebx, dword [ecx + 0x114]
mov byte [ebx + ecx + 0xe], 0x2d
jmp 0x45bc4b
mov ebx, dword [ecx + 0x114]
mov byte [ebx + ecx + 0xe], 0x20
jmp 0x45bc4b
test al, 2
je 0x45bc2f
dec dword [ecx + 0x114]
mov ecx, dword [esp + 0x18]
mov al, byte [esp]
test al, al
je 0x45bc22
mov edx, dword [ecx + 0x114]
mov byte [edx + ecx + 0xe], 0x2d
jmp 0x45bc4b
mov edx, dword [ecx + 0x114]
mov byte [edx + ecx + 0xe], 0x2b
jmp 0x45bc4b
mov al, byte [esp]
test al, al
je 0x45bc4b
dec dword [ecx + 0x114]
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x114]
mov byte [ecx + edx + 0xe], 0x2d
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x45bc60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push esi
add esp, 0xffffffec
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov al, byte [esp + 0x30]
mov dx, word [ecx + 0xc]
test dl, 0x20
je 0x45bca5
mov dword [esp], 0x33323130
mov dword [esp + 4], 0x37363534
mov dword [esp + 8], 0x42413938
mov dword [esp + 0xc], 0x46454443
mov byte [esp + 0x10], 0
jmp 0x45bcc9
mov dword [esp], 0x33323130
mov dword [esp + 4], 0x37363534
mov dword [esp + 8], 0x62613938
mov dword [esp + 0xc], 0x66656463
mov byte [esp + 0x10], 0
mov dword [ecx + 0x110], 0x100
mov dword [ecx + 0x114], 0x100
test dl, 8
je 0x45bcf6
test al, al
je 0x45bcf6
mov dword [ecx + 0x114], 0xff
mov byte [ecx + 0x10d], al
test dl, 0x80
jne 0x45bd02
mov dword [ecx + 4], 1
mov eax, dword [ecx + 0x114]
mov edx, eax
sub edx, dword [ecx + 4]
jg 0x45bd13
dec eax
mov dword [ecx + 4], eax
mov eax, dword [ecx + 4]
test eax, eax
jg 0x45bd20
test ebx, ebx
je 0x45bd51
test esp, esp
mov eax, dword [ecx + 0x114]
lea esi, [eax - 1]
mov dword [ecx + 0x114], esi
mov eax, ebx
xor edx, edx
div ebp
mov al, byte [esp + edx]
mov byte [ecx + esi + 0xe], al
mov eax, ebx
xor edx, edx
div ebp
mov ebx, eax
mov edx, dword [ecx + 4]
dec edx
mov dword [ecx + 4], edx
jg 0x45bd20
test ebx, ebx
jne 0x45bd20
mov ax, word [ecx + 0xc]
test al, 4
je 0x45bd8e
test al, 0x40
je 0x45bd8e
mov eax, dword [ecx + 0x110]
sub eax, dword [ecx]
jge 0x45bd69
xor eax, eax
cmp dword [ecx + 0x114], eax
jle 0x45bd8e
cmp esp, 0
mov edx, dword [ecx + 0x114]
dec edx
mov dword [ecx + 0x114], edx
mov byte [ecx + edx + 0xe], 0x30
cmp dword [ecx + 0x114], eax
jg 0x45bd74
sub esp, 0xffffffec
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x45dba0
Capabilities:
Manipulate console buffer

Disassembly:
push eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov dword [esp], ecx
push dword [esp]
push dword [esp + 0xc]
call sub.KERNEL32.DLL_SetConsoleCursorPosition
pop ecx
ret 8

Function at 0x45fc60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
ret

Function at 0x45fd40
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push 0
push eax
push dword [eax]
push dword [esp + 0x14]
push dword [esp + 0x14]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
sete al
and eax, 1
ret

Function at 0x45fd60
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov ecx, dword [0x5b3b60]
mov edx, dword [0x5b3f64]
test edi, edi
je 0x45fdc5
cmp ecx, 0xffffffff
je 0x45fd96
push 0
lea ebx, [esp + 0x14]
push ebx
push edi
push eax
push ecx
call sub.KERNEL32.DLL_WriteFile
mov edx, dword [0x5b3f64]
jmp 0x45fdc5
cmp edi, 0
jbe 0x45fdc5
cmp edx, 0x3ff
jae 0x45fdc5
xor ecx, ecx
jmp 0x45fdb0
cmp edx, 0x3ff
jae 0x45fdc5
mov dword [0x5b3f64], edx
mov bl, byte [eax + ecx]
mov byte [edx + 0x5b3b64], bl
inc edx
inc ecx
cmp ecx, edi
jb 0x45fda8
mov dword [0x5b3f64], edx
pop edi
pop ebx
ret
Function at 0x466580
Capabilities:
Parse pe header

Disassembly:
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
cmp word [eax], 0x5a4d
jne 0x466593
mov ecx, dword [eax + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
je 0x4665a0
xor ax, ax
jmp 0x4665b2
mov cx, word [eax + 0x14]
test cx, cx
je 0x4665af
mov ax, word [eax + 0x5c]
jmp 0x4665b2
xor ax, ax
ret

Function at 0x467ae0
Capabilities:
Create thread

Disassembly:
mov al, byte [0x471bf0]
test al, al
jne 0x467bb3
mov byte [0x471bf0], 1
call fcn.0045c120
call fcn.0045a4a0
call fcn.0045f630
call fcn.0045c0c0
call fcn.0045c470
call fcn.0045cd90
call fcn.00467c00
push 0x467ac0
call fcn.00467d3b
push 0x5ee49c
mov eax, dword [0x5ee5c4]
push eax
mov byte [0x5ee484], 0
mov dword [0x5ee4a0], 0
mov dword [0x5ee498], eax
call sub.KERNEL32.DLL_GetConsoleMode
pop ecx
test eax, eax
je 0x467b62
push 0x17
push dword [0x5ee498]
call sub.KERNEL32.DLL_SetConsoleMode
test eax, eax
je 0x467b62
call fcn.004679e0
push 0
push 1
push 1
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x5ee488], eax
push 0
push 0
push 1
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x5ee48c], eax
mov ecx, dword [0x5ee488]
test ecx, ecx
je 0x467bb3
test eax, eax
je 0x467bb3
push 0x5ee494
push 0
push 0
push 0x467120
push 0x7fff
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x5ee490], eax
ret

Function at 0x467cd0
Capabilities:
Accept command line arguments

Disassembly:
add esp, 0xfffffff4
call sub.KERNEL32.DLL_GetCommandLineA
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
push eax
call fcn.004661f0
mov eax, dword [esp + 4]
test eax, eax
jle 0x466043
push 0x104
lea ecx, [esp + 4]
push ecx
call fcn.004660b0
mov eax, dword [esp]
test eax, eax
je 0x466043
push 0x104
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov eax, dword [esp]
cmp ecx, 0
jbe 0x466043
mov ecx, dword [esp + 8]
mov dword [ecx], eax
push 1
call sub.KERNEL32.DLL_SetErrorMode
push fcn.00466290
call sub.KERNEL32.DLL_SetUnhandledExceptionFilter
call fcn.00466540
mov dword [0x5bc8a8], 0
mov dword [0x5bc8a4], 0
call fcn.00466580
cmp ax, 2
je 0x466088
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
push eax
call fcn.0045fe20
pop eax
jmp 0x466090
push 0xffffffffffffffff
call fcn.0045fe20
pop eax
push dword [esp + 8]
push dword [esp + 8]
call dword [0x5ede70]
call fcn.0045d3e0
sub esp, 0xffffffec
ret
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x472004], eax
push 0x41d200
call fcn.00465fe0
sub esp, 0xfffffffc
push 0x467d01
xor eax, eax
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x465ff0