joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4308e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
mov ebp, ecx
mov ecx, 8
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
xor ecx, ecx
xor eax, eax
lea esp, [esp]
cmp edi, 0xa
jg 0x430a3d
cmp eax, 4
jge 0x430956
mov edi, edi
cmp ecx, 4
jge 0x430959
mov bl, byte [esp + eax*4 + 0x10]
lea edx, [ecx + edi*4]
mov byte [ebp + edx*4 + 0x14], bl
lea edx, [ecx + edi*4]
lea esi, [ebp + edx*4]
movzx edx, byte [esp + eax*4 + 0x11]
mov byte [esi + 0x15], dl
movzx edx, byte [esp + eax*4 + 0x12]
mov byte [esi + 0x16], dl
movzx edx, byte [esp + eax*4 + 0x13]
inc eax
inc ecx
cmp eax, 4
mov byte [esi + 0x17], dl
jl 0x430920
cmp ecx, 4
jne 0x43095e
inc edi
xor ecx, ecx
cmp eax, 4
jl 0x430910
cmp edi, 0xa
jg 0x430a3d
mov edx, 0x462050
movzx esi, byte [esp + 0x1d]
mov al, byte [esp + 0x10]
xor al, byte [esi + 0x462170]
movzx esi, byte [esp + 0x1e]
movzx ebx, byte [esi + 0x462170]
movzx esi, byte [esp + 0x1f]
xor byte [esp + 0x11], bl
movzx ebx, byte [esi + 0x462170]
movzx esi, byte [esp + 0x1c]
xor byte [esp + 0x12], bl
movzx ebx, byte [esi + 0x462170]
xor al, byte [edx]
xor byte [esp + 0x13], bl
mov byte [esp + 0x10], al
inc edx
lea eax, [esp + 0x11]
mov esi, 3
movzx ebx, byte [eax - 1]
xor byte [eax + 3], bl
movzx ebx, byte [eax]
xor byte [eax + 4], bl
movzx ebx, byte [eax + 1]
xor byte [eax + 5], bl
movzx ebx, byte [eax + 2]
xor byte [eax + 6], bl
add eax, 4
sub esi, 1
jne 0x4309c0
xor eax, eax
cmp edi, 0xa
jg 0x430a3d
cmp eax, 4
jge 0x430a27
nop
cmp ecx, 4
jge 0x430a2a
movzx ebx, byte [esp + eax*4 + 0x10]
lea esi, [ecx + edi*4]
mov byte [ebp + esi*4 + 0x14], bl
movzx ebx, byte [esp + eax*4 + 0x11]
lea esi, [ecx + edi*4]
lea esi, [ebp + esi*4]
mov byte [esi + 0x15], bl
movzx ebx, byte [esp + eax*4 + 0x12]
mov byte [esi + 0x16], bl
movzx ebx, byte [esp + eax*4 + 0x13]
inc eax
inc ecx
cmp eax, 4
mov byte [esi + 0x17], bl
jl 0x4309f0
cmp ecx, 4
jne 0x430a2f
inc edi
xor ecx, ecx
cmp eax, 4
jl 0x4309e5
cmp edi, 0xa
jle 0x430971
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043e366
add esp, 0x24
ret 4
Function at 0x430a60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
mov eax, ecx
push edi
lea esi, [eax + 0x24]
lea ecx, [eax + 0x28]
mov edi, 9
mov edi, edi
xor eax, eax
jmp 0x430a90
movzx edx, byte [ecx - 1]
movzx edx, byte [eax + edx*4 + 0x45f050]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x45f450]
movzx ebx, byte [ecx - 3]
xor dl, byte [eax + ebx*4 + 0x45f850]
movzx ebx, byte [ecx - 4]
xor dl, byte [eax + ebx*4 + 0x45fc50]
movzx ebx, byte [ecx + 2]
mov byte [esp + eax + 0xc], dl
movzx edx, byte [ecx + 3]
movzx edx, byte [eax + edx*4 + 0x45f050]
xor dl, byte [eax + ebx*4 + 0x45f450]
movzx ebx, byte [ecx + 1]
xor dl, byte [eax + ebx*4 + 0x45f850]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x45fc50]
movzx ebx, byte [ecx + 6]
mov byte [esp + eax + 0x10], dl
movzx edx, byte [ecx + 7]
movzx edx, byte [eax + edx*4 + 0x45f050]
xor dl, byte [eax + ebx*4 + 0x45f450]
movzx ebx, byte [ecx + 5]
xor dl, byte [eax + ebx*4 + 0x45f850]
movzx ebx, byte [ecx + 4]
xor dl, byte [eax + ebx*4 + 0x45fc50]
movzx ebx, byte [ecx + 0xa]
mov byte [esp + eax + 0x14], dl
movzx edx, byte [ecx + 0xb]
movzx edx, byte [eax + edx*4 + 0x45f050]
xor dl, byte [eax + ebx*4 + 0x45f450]
movzx ebx, byte [ecx + 9]
xor dl, byte [eax + ebx*4 + 0x45f850]
movzx ebx, byte [ecx + 8]
xor dl, byte [eax + ebx*4 + 0x45fc50]
inc eax
cmp eax, 4
mov byte [esp + eax + 0x17], dl
jl 0x430a90
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esi], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
add ecx, 0x10
add esi, 0x10
sub edi, 1
jne 0x430a80
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043e366
add esp, 0x14
ret
Function at 0x431d40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
push ebx
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
mov ebx, ecx
test eax, eax
ja 0x431d79
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0043e366
add esp, 0x18
ret 0xc
mov ecx, dword [esi + 4]
xor ecx, dword [ebx + 8]
mov edx, dword [esi + 8]
xor edx, dword [ebx + 0xc]
shr eax, 4
push ebp
mov ebp, eax
mov eax, dword [esi]
xor eax, dword [ebx + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
xor eax, dword [ebx + 0x10]
push edi
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
call fcn.00430bb0
add esi, 0x10
add ebp, 0xffffffff
je 0x431dfe
nop
mov edx, dword [edi]
xor edx, dword [esi]
mov eax, dword [edi + 4]
xor eax, dword [esi + 4]
mov ecx, dword [edi + 8]
xor ecx, dword [esi + 8]
mov dword [esp + 0x14], edx
mov edx, dword [edi + 0xc]
xor edx, dword [esi + 0xc]
mov dword [esp + 0x18], eax
add edi, 0x10
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x20], ecx
push eax
mov ecx, ebx
mov dword [esp + 0x28], edx
call fcn.00430bb0
add esi, 0x10
sub ebp, 1
jne 0x431dc0
mov ecx, dword [edi]
mov dword [ebx + 4], ecx
mov edx, dword [edi + 4]
mov dword [ebx + 8], edx
mov eax, dword [edi + 8]
mov dword [ebx + 0xc], eax
mov ecx, dword [edi + 0xc]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [ebx + 0x10], ecx
mov ecx, dword [esp + 0x1c]
pop esi
pop ebx
xor ecx, esp
shl eax, 4
call fcn.0043e366
add esp, 0x18
ret 0xc
Function at 0x431e40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x4537b0]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
mov esi, dword [esp + 0x38]
push edi
mov edi, dword [esp + 0x44]
mov ebx, ecx
test esi, esi
je 0x431f35
mov eax, dword [esp + 0x40]
test eax, eax
jbe 0x431f35
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
shr eax, 4
mov dword [esp + 0x18], ecx
mov ecx, dword [ebx + 0x10]
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
test eax, eax
jbe 0x431f05
lea edx, [esp + 0x28]
push edx
push esi
mov ecx, ebx
call fcn.004312b0
mov edx, dword [esp + 0x20]
xor dword [esp + 0x30], edx
mov edx, dword [esp + 0x24]
xor dword [esp + 0x34], edx
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x2c]
xor ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
xor eax, ebp
mov ebp, dword [esi]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 8]
mov dword [esp + 0x20], edx
mov edx, dword [esi + 0xc]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x34]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
add esi, 0x10
add edi, 0x10
sub dword [esp + 0x10], 1
mov dword [esp + 0x24], edx
jne 0x431e97
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [ebx + 4], ebp
pop ebp
mov dword [ebx + 8], edx
mov edx, dword [esp + 0x20]
pop edi
mov dword [ebx + 0xc], ecx
pop esi
mov dword [ebx + 0x10], edx
shl eax, 4
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0043e366
add esp, 0x2c
ret 0xc
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0043e366
add esp, 0x2c
ret 0xc

Function at 0x434c10
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
ret 4

Function at 0x4359d0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x435a23
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x80000000
push 0xd
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
Function at 0x4393a0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x408
push ebx
push ebp
push esi
mov esi, dword [esp + 0x418]
push edi
mov ebx, ecx
movzx edi, word [ebx]
sub edi, dword [esi + 0x654]
mov dword [esp + 0x14], ebx
push edi
push esi
call fcn.00437550
mov dl, byte [esi + 0xa6c]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 4]
sub eax, 6
lea ebp, [esp + 0x18]
xor ecx, ecx
lea ecx, [ecx]
movzx ebx, byte [eax + 6]
add eax, 6
cmp byte [ebx + esi + 0x66c], dl
je 0x4393e0
movzx ebx, byte [eax + 1]
mov dword [ebp], eax
add ecx, ebx
add ebp, 4
sub edi, 1
jne 0x4393e0
add dword [esi + 0x4a84], ecx
mov eax, dword [esi + 0x4a78]
xor edx, edx
div dword [esi + 0x4a84]
xor edx, edx
mov edi, eax
mov eax, dword [esi + 0x4a74]
sub eax, dword [esi + 0x4a70]
mov dword [esi + 0x4a78], edi
div edi
mov ebx, dword [esi + 0x4a84]
cmp eax, ebx
jl 0x439446
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x408
ret 4
cmp eax, ecx
mov edx, dword [esp + 0x18]
lea edi, [esp + 0x18]
jge 0x4394c3
movzx ecx, byte [edx + 1]
cmp ecx, eax
jg 0x439470
lea ebx, [ebx]
mov edx, dword [edi + 4]
movzx ebx, byte [edx + 1]
add edi, 4
add ecx, ebx
cmp ecx, eax
jle 0x439460
mov edi, dword [esp + 0x10]
mov dword [esi + 0x4a80], ecx
movzx eax, byte [edx + 1]
sub ecx, eax
mov dword [esi + 0x4a7c], ecx
mov cl, byte [edi + 2]
cmp cl, 7
jae 0x4394a9
add byte [edi + 3], 0xff
jne 0x4394a9
mov ax, word [edi]
add ax, ax
mov word [edi], ax
mov al, 3
shl al, cl
inc cl
mov byte [edi + 2], cl
mov byte [edi + 3], al
mov ecx, dword [esp + 0x14]
push edx
push esi
call fcn.00439210
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x408
ret 4
mov edi, dword [esp + 0x14]
mov dword [esi + 0x4a7c], ecx
mov dword [esi + 0x4a80], ebx
movzx ecx, word [edi]
sub ecx, dword [esi + 0x654]
lea eax, [esp + 0x18]
sub eax, 4
mov edx, dword [eax + 4]
movzx edx, byte [edx]
mov bl, byte [esi + 0xa6c]
add eax, 4
sub ecx, 1
mov byte [edx + esi + 0x66c], bl
jne 0x4394e3
mov cx, word [esi + 0x4a84]
mov eax, dword [esp + 0x10]
add word [eax], cx
movzx edx, word [edi]
pop edi
mov dword [esi + 0x654], edx
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x408
ret 4

Function at 0x43e366
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4537b0]
jne 0x43e370
repz ret
jmp fcn.00441988
Function at 0x440a5f
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x44ffc8
call fcn.00441770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x44095f
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x44095f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x44095f
cmp dword [eax + 0x400074], 0xe
jbe 0x44095f
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x440963
and dword [ebp - 0x1c], 0
push 1
call fcn.00440ae8
pop ecx
test eax, eax
jne 0x440977
push 0x1c
call fcn.004408e9
pop ecx
call fcn.00443ca9
test eax, eax
jne 0x440988
push 0x10
call fcn.004408e9
pop ecx
call fcn.00445272
and dword [ebp - 4], 0
call fcn.0044613f
test eax, eax
jge 0x4409a2
push 0x1b
call fcn.0043faf2
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x464504], eax
call fcn.0044600a
mov dword [0x462938], eax
call fcn.00445f51
test eax, eax
jge 0x4409c8
push 8
call fcn.0043faf2
pop ecx
call fcn.00445d0d
test eax, eax
jge 0x4409d9
push 9
call fcn.0043faf2
pop ecx
push 1
call fcn.0043fb9b
pop ecx
test eax, eax
je 0x4409ec
push eax
call fcn.0043faf2
pop ecx
mov eax, dword [0x46290c]
mov dword [0x462910], eax
push eax
push dword [0x462904]
push dword [0x462900]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x440a1a
push eax
call fcn.0043fd59
call fcn.0043fd7b
jmp 0x440a4f
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004417b5
ret
call fcn.00446393
jmp 0x44090d

Function at 0x4425d9
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x4537b0]
xor eax, ebp
mov dword [ebp + 0x2a4], eax
and dword [ebp - 0x80], 0
push ebx
push 0x4c
lea eax, [ebp - 0x7c]
push 0
push eax
call fcn.0043e880
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp + 0x88], eax
mov dword [ebp + 0x84], ecx
mov dword [ebp + 0x80], edx
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x78], esi
mov dword [ebp + 0x74], edi
mov word [ebp + 0xa0], ss
mov word [ebp + 0x94], cs
mov word [ebp + 0x70], ds
mov word [ebp + 0x6c], es
mov word [ebp + 0x68], fs
mov word [ebp + 0x64], gs
pushfd
pop dword [ebp + 0x98]
mov eax, dword [ebp + 0x2ac]
lea ecx, [ebp + 0x2ac]
mov dword [ebp - 0x28], 0x10001
mov dword [ebp + 0x90], eax
mov dword [ebp + 0x9c], ecx
mov ecx, dword [ecx - 4]
mov dword [ebp + 0x8c], ecx
mov dword [ebp - 0x80], 0xc0000417
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x4426b8
test ebx, ebx
jne 0x4426b8
push 2
call fcn.0044657b
pop ecx
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
xor ecx, ebp
pop ebx
call fcn.0043e366
add ebp, 0x2a8
leave
ret
Function at 0x4426e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [0x462dcc]
call fcn.0044391d
pop ecx
test eax, eax
je 0x4426f6
pop ebp
jmp eax
push 2
call fcn.0044657b
pop ecx
pop ebp
jmp fcn.004425d9

Function at 0x442704
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x453ab8]
je 0x44271f
inc edi
cmp edi, 0x17
jb 0x442710
cmp edi, 0x17
jae 0x44289f
push ebp
push 3
call fcn.004473b0
pop ecx
cmp eax, 1
je 0x44286b
push 3
call fcn.004473b0
pop ecx
test eax, eax
jne 0x442753
cmp dword [0x453810], 1
je 0x44286b
cmp ebx, 0xfc
je 0x44289e
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x462dd0
push ebp
call fcn.00444d80
add esp, 0xc
test eax, eax
je 0x442789
push esi
push esi
push esi
push esi
push esi
call fcn.004425d9
add esp, 0x14
push 0x104
mov esi, 0x462de9
push esi
push 0
mov byte [0x462eed], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4427cd
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00444d80
add esp, 0xc
test eax, eax
je 0x4427cd
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004425d9
add esp, 0x14
push esi
call fcn.00444c60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x442812
push esi
call fcn.00444c60
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4630e4
push 0x44d334
sub ecx, eax
push ecx
push eax
call fcn.004472fd
add esp, 0x14
test eax, eax
je 0x442812
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004425d9
add esp, 0x14
jmp 0x442814
xor esi, esi
push 0x44d330
push ebx
push ebp
call fcn.0044728c
add esp, 0xc
test eax, eax
je 0x442834
push esi
push esi
push esi
push esi
push esi
call fcn.004425d9
add esp, 0x14
push dword [edi*8 + 0x453abc]
push ebx
push ebp
call fcn.0044728c
add esp, 0xc
test eax, eax
je 0x442856
push esi
push esi
push esi
push esi
push esi
call fcn.004425d9
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00447125
add esp, 0xc
jmp 0x44289e
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x44289e
cmp ebp, 0xffffffff
je 0x44289e
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x453abc]
push dword [esi]
call fcn.00444c60
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x443ca9
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
push edi
mov esi, str.KERNEL32.DLL
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x443cc2
push esi
call fcn.0043fa8d
pop ecx
mov edi, eax
test edi, edi
je 0x443e2a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.FlsAlloc
push edi
call esi
push str.FlsGetValue
push edi
mov dword [0x4630e4], eax
call esi
push str.FlsSetValue
push edi
mov dword [0x4630e8], eax
call esi
push str.FlsFree
push edi
mov dword [0x4630ec], eax
call esi
cmp dword [0x4630e4], 0
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x4630f0], eax
je 0x443d2b
cmp dword [0x4630e8], 0
je 0x443d2b
cmp dword [0x4630ec], 0
je 0x443d2b
test eax, eax
jne 0x443d4f
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x4630e8], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x4630e4], 0x44398c
mov dword [0x4630ec], esi
mov dword [0x4630f0], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x453b98], eax
cmp eax, 0xffffffff
je 0x443e2f
push dword [0x4630e8]
push eax
call esi
test eax, eax
je 0x443e2f
call fcn.0043fd99
push dword [0x4630e4]
call fcn.004438a5
push dword [0x4630e8]
mov dword [0x4630e4], eax
call fcn.004438a5
push dword [0x4630ec]
mov dword [0x4630e8], eax
call fcn.004438a5
push dword [0x4630f0]
mov dword [0x4630ec], eax
call fcn.004438a5
add esp, 0x10
mov dword [0x4630f0], eax
call fcn.00440b12
test eax, eax
je 0x443e2a
push 0x443b7a
push dword [0x4630e4]
call fcn.0044391d
pop ecx
call eax
mov dword [0x453b94], eax
cmp eax, 0xffffffff
je 0x443e2a
push 0x214
push 1
call fcn.004450ec
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x443e2a
push esi
push dword [0x453b94]
push dword [0x4630ec]
call fcn.0044391d
pop ecx
call eax
test eax, eax
je 0x443e2a
push 0
push esi
call fcn.00443a04
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
xor eax, eax
inc eax
jmp 0x443e31
call fcn.004439c7
xor eax, eax
pop edi
pop esi
ret

Function at 0x4452e0
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x4452f1
xor eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4452ee
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
ret

Function at 0x445310
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x44534a
mov edi, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x445342
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x44534c
inc edx
add eax, 0x28
cmp edx, esi
jb 0x445332
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x44600a
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x463278]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
xor esi, esi
push 2
pop ebp
cmp eax, ebx
jne 0x446053
call edi
mov esi, eax
cmp esi, ebx
je 0x44603a
mov dword [0x463278], 1
jmp 0x44605c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x44604e
mov eax, ebp
mov dword [0x463278], eax
jmp 0x446053
mov eax, dword [0x463278]
cmp eax, 1
jne 0x4460e0
cmp esi, ebx
jne 0x44606f
call edi
mov esi, eax
cmp esi, ebx
jne 0x44606f
xor eax, eax
jmp 0x446138
mov eax, esi
cmp word [esi], bx
je 0x446084
add eax, ebp
cmp word [eax], bx
jne 0x446076
add eax, ebp
cmp word [eax], bx
jne 0x446076
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x4460d5
push ebp
call fcn.004450ac
pop ecx
mov dword [esp + 0x10], eax
cmp eax, ebx
je 0x4460d5
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
jne 0x4460d1
push dword [esp + 0x10]
call fcn.0043e0bd
pop ecx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x446138
cmp eax, ebp
je 0x4460e8
cmp eax, ebx
jne 0x446068
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
je 0x446068
cmp byte [esi], bl
je 0x446106
inc eax
cmp byte [eax], bl
jne 0x4460fc
inc eax
cmp byte [eax], bl
jne 0x4460fc
sub eax, esi
inc eax
mov ebp, eax
push ebp
call fcn.004450ac
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x446124
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x446068
push ebp
push esi
push edi
call fcn.0043e510
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x447125
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00443914
and dword [ebp - 4], 0
cmp dword [0x463280], 0
mov ebx, eax
jne 0x4471d4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x447285
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x447285
push eax
call fcn.004438a5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x463280], eax
call esi
push eax
call fcn.004438a5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x463284], eax
call esi
push eax
call fcn.004438a5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x463288], eax
call esi
push eax
call fcn.004438a5
pop ecx
mov dword [0x463290], eax
test eax, eax
je 0x4471d4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004438a5
pop ecx
mov dword [0x46328c], eax
mov eax, dword [0x46328c]
cmp eax, ebx
je 0x44722c
cmp dword [0x463290], ebx
je 0x44722c
push eax
call fcn.0044391d
push dword [0x463290]
mov esi, eax
call fcn.0044391d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44722c
test edi, edi
je 0x44722c
call esi
test eax, eax
je 0x447223
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x447223
test byte [ebp - 0xc], 1
jne 0x44722c
or dword [ebp + 0x10], 0x200000
jmp 0x447265
mov eax, dword [0x463284]
cmp eax, ebx
je 0x447265
push eax
call fcn.0044391d
pop ecx
test eax, eax
je 0x447265
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x447265
mov eax, dword [0x463288]
cmp eax, ebx
je 0x447265
push eax
call fcn.0044391d
pop ecx
test eax, eax
je 0x447265
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x463280]
call fcn.0044391d
pop ecx
test eax, eax
je 0x447285
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x447287
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret