joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456d9e
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, 1
call fcn.00457330
jb 0x456d79
mov byte [edi], 0
call fcn.0045d137
pop edi
pop ecx
ret

Function at 0x456df8
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov ax, word [ebp - 0x46]
call fcn.00457442
jb 0x456e1d
mov esi, dword [ebp + esi - 0x6c]
call fcn.0045738c
jecxz 0x456e1d
mov edx, ecx
call fcn.0045cd54
pushfd
call fcn.0045d67b
popfd
jb 0x456e91
pop edi
pop esi
ret
pop edi
pop esi
jmp fcn.0044fb36

Function at 0x456eea
Capabilities:
Terminate process

Disassembly:
push edi
xchg ecx, ebx
call fcn.00457330
jb 0x456f0a
call fcn.0045d137
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
ret
call fcn.0045d135
pop edi
jmp fcn.0044fb36

Function at 0x457142
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov ax, word [ebp - 0x46]
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0045738c
call fcn.00457442
jb 0x45719e
mov al, byte [edi + 0xc]
test al, 0x20
je 0x4571a2
push 0
lea edx, [edi + 0x3c]
push edx
push ecx
push esi
push dword [edi + 6]
mov edx, dword [sym.imp.KERNEL32.DLL_WriteFile]
call fcn.0045d694
jb 0x45719a
test byte [edi + 0xc], 4
jne 0x45718d
mov eax, dword [edi + 0x3c]
add dword [edi + 0x14], eax
adc dword [edi + 0x18], 0
and word [edi + 0x2c], 0xfffd
call fcn.0045d67b
pop edi
pop esi
ret
mov al, dl
mov dx, 0x34b0
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x3db0
mov dx, 0x3fb0
call fcn.0045d67b
pop edi
pop esi
jmp fcn.0044fb36

Function at 0x457e4c
Capabilities:
Terminate process

Disassembly:
call fcn.0045d229
jb 0x457e54
ret
jmp fcn.0044fb36

Function at 0x4584d0
Capabilities:
Terminate process

Disassembly:
fldcw word [0x44f84e]
mov edx, eax
call fcn.0044fbfe
jb 0x4584e2
mov dword [eax + 0x38], edx
mov eax, edx
test eax, eax
js 0x4584e9
ret
mov edx, 0x63
jmp fcn.0044fb2b
Function at 0x4592e5
Capabilities:
Terminate process

Disassembly:
sub esp, 0x330
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push ebx
push ebp
push esi
push edi
mov ebp, esp
call fcn.00459407
call fcn.00459654
test ebx, ebx
je 0x4593e5
lea eax, [ebp + 0x6c]
push eax
push 0x800
mov eax, dword [ebp + 0x64]
inc eax
push eax
lea eax, [ebp + 0x300]
push eax
lea eax, [ebp + 0x20]
push eax
push ebx
mov ebx, dword [ebx]
call dword [ebx + 0x14]
call fcn.00459730
js 0x4593e5
mov eax, 0xfffffffd
xchg dword [ebp + 0x6c], eax
mov dword [ebp + 0x68], eax
cmp dword [ebp + 0x390], 2
jbe 0x45938f
sub dword [ebp + 0x5c], 4
inc dword [ebp + 0x60]
inc dword [ebp + 0x64]
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x30]
push eax
push 0
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x390]
push 0x800
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x68]
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebx]
call dword [ebx + 0x18]
dec dword [ebp + 0x64]
dec dword [ebp + 0x60]
jmp 0x4593c2
mov ecx, dword [ebp + 0x388]
jecxz 0x45939a
lea ecx, [ebp + 0x10]
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x30]
push eax
push ecx
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x390]
push 0x800
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x68]
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebx]
call dword [ebx + 0x18]
call fcn.00459730
js 0x4593e5
call fcn.00459520
call fcn.0045966c
mov ecx, dword [ebp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x374
pop edx
add esp, ecx
jmp edx
call fcn.00459520
call fcn.0045966c
mov al, 0x63
mov ecx, dword [ebp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x374
pop edx
add esp, ecx
push edx
jmp fcn.0044fb36

Function at 0x459abb
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push ecx
mov esi, edx
mov ecx, dword [esi - 4]
shl ecx, 1
je 0x459ad8
call fcn.00457330
jb 0x459adc
cld
xor eax, eax
shr ecx, 1
lodsb al, byte [esi]
stosw word es:[edi], ax
loop 0x459ad3
pop ecx
pop edi
pop esi
ret
pop ecx
pop edi
pop esi
jmp fcn.0044fb36

Function at 0x45a290
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, dword [0x45f3e0]
mov ecx, eax
jecxz 0x45a2ea
cld
lodsb al, byte [esi]
test al, al
je 0x45a2e6
cmp al, 0x20
je 0x45a29e
cmp al, 0x22
je 0x45a2c6
lea edi, [esi - 1]
lodsb al, byte [esi]
test al, al
je 0x45a2bb
cmp al, 0x20
jne 0x45a2ae
loop 0x45a29e
jmp 0x45a2bd
loop 0x45a2e6
lea ecx, [esi - 1]
mov esi, edi
sub ecx, esi
jmp 0x45a2f9
mov edi, esi
lodsb al, byte [esi]
test al, al
je 0x45a2db
cmp al, 0x22
jne 0x45a2c8
cmp byte [esi - 2], 0x22
je 0x45a29e
loop 0x45a29e
jmp 0x45a2dd
loop 0x45a2e6
lea ecx, [esi - 1]
mov esi, edi
sub ecx, esi
jmp 0x45a2f9
xor ecx, ecx
jmp 0x45a2f9
push esi
mov ecx, 0xffffffff
dec esi
inc ecx
inc esi
test byte [esi], 0xff
jne 0x45a2f1
pop esi
call fcn.0045d17e
pop edi
pop esi
pop ecx
jb 0x45a304
ret
jmp fcn.0044fb36
Function at 0x45a3e4
Capabilities:
Terminate process

Disassembly:
xor edx, edx
jmp 0x45a439
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x68]
call fcn.0045738c
mov edi, dword [ebp + edi - 0x6c]
call fcn.0045739f
jecxz 0x45a3e0
test eax, eax
je 0x45a3e0
jns 0x45a40b
add eax, ecx
inc eax
dec eax
sub ecx, eax
jbe 0x45a3e0
push eax
add esi, eax
call fcn.0045b0a3
pop edx
jae 0x45a41f
test edx, edx
je 0x45a452
mov ecx, esi
mov esi, eax
sub ecx, eax
call fcn.00457330
jb 0x45a459
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0045d67b
call fcn.00457d76
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.0045d67b
jmp 0x45a44d
call fcn.0045d67b
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.0044fb2b

Function at 0x45a529
Capabilities:
Terminate process

Disassembly:
mov edx, 0x34
jmp fcn.0044fb2b
push esi
or eax, eax
je 0x45a592
dec eax
je 0x45a5a1
dec eax
je 0x45a5ae
dec eax
je 0x45a5ba
cmp eax, 0xfffffffc
je 0x45a586
cmp eax, 0xfffffffb
je 0x45a579
cmp eax, 0xfffffffa
je 0x45a56c
cmp eax, 0xfffffff9
je 0x45a560
cmp eax, 0xfffffff8
jne 0x45a592
call fcn.0045a5c3
jb 0x45a5ca
mov eax, dword [esi + 0x34]
jmp 0x45a5c1
call fcn.0045a5c3
jb 0x45a5ca
mov eax, dword [esi + 0x30]
jmp 0x45a5c1
call fcn.0045a5c3
jb 0x45a5ca
movzx eax, word [esi + 0xa]
jmp 0x45a5c1
call fcn.0045a5c3
jb 0x45a5ca
movzx eax, word [esi + 0x2e]
jmp 0x45a5c1
call fcn.0045a5c3
jb 0x45a5ca
mov eax, dword [esi + 0x1c]
jmp 0x45a5c1
call fcn.0045a5c3
mov eax, 0
jb 0x45a5c1
dec eax
jmp 0x45a5c1
call fcn.0045a5c3
jb 0x45a5ca
movzx eax, word [esi + 0xc]
jmp 0x45a5c1
call fcn.0045a5c3
jb 0x45a5ca
mov eax, dword [esi + 6]
jmp 0x45a5c1
mov eax, ecx
call fcn.00457520
pop esi
ret
pop esi
xor eax, eax
jmp 0x44fb11

Function at 0x45a5d2
Capabilities:
Terminate process

Disassembly:
mov ecx, eax
sub esp, 0x114
mov edx, esp
call fcn.00453e90
or ah, ah
jne 0x45a5fe
and ecx, 0x27
push ecx
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
call fcn.0045d694
jb 0x45a603
add esp, 0x114
ret
mov edx, 0x40
jmp 0x45a633
add esp, 0x114
xor eax, eax
jmp fcn.0044fb2b

Function at 0x45a77f
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0045738c
je 0x45a7c6
mov al, 0x20
cmp byte [esi], al
je 0x45a7a0
jmp 0x45a7c6
cmp byte [esi], al
jne 0x45a7a3
inc esi
loop 0x45a79c
call fcn.00457330
jb 0x45a7cb
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00457d76
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
pop eax
ret
mov edx, eax
pop edi
pop esi
pop ecx
pop eax
jmp fcn.0044fb2b
Function at 0x45a7d6
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0045738c
je 0x45a7c6
lea edi, [esi - 1]
add edi, ecx
mov al, 0x20
cmp byte [edi], al
je 0x45a7fc
jmp 0x45a7c6
cmp byte [edi], al
jne 0x45a7a3
dec edi
loop 0x45a7f8
jmp 0x45a7a3

Function at 0x45a86f
Capabilities:
Terminate process

Disassembly:
or edx, edx
jns 0x45a829
xor edx, edx
mov esi, eax
mov ecx, edx
pop ebp
call fcn.00457330
jb 0x45a863
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0045d67b
call fcn.00457d76
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
pop ebp
call fcn.0045d67b
jmp 0x45a855
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.0044fb2b
push eax
call fcn.0045a8e3
jb 0x45a85b
cmp ecx, edx
ja 0x45a85b
mov eax, esi
add esi, edx
sub esi, ecx
mov ebx, ecx
mov ebp, edi
repe cmpsb byte [esi], byte es:[edi]
jne 0x45a823
sub esi, ebx
sub esi, ebx
sub edx, ebx
jl 0x45a823
mov ecx, ebx
mov edi, ebp
jmp 0x45a885
Function at 0x45ab3c
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0045739f
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edx
push dword [ebp + esi - 0x6c]
mov esi, dword [ebp + esi - 0x64]
call fcn.0045738c
pop edi
call fcn.0045739f
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x64], edx
jecxz 0x45ab70
jne 0x45abc3
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
call fcn.00457330
jb 0x45aba8
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0045d67b
call fcn.0045d67b
call fcn.00457d76
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
ret
mov al, 5
pop edi
pop esi
call fcn.0045d67b
call fcn.0045d67b
call fcn.0045d67b
call fcn.0045d135
jmp fcn.0044fb36
mov ebx, edi
mov dword [ebp - 0x54], ecx
sub edx, ecx
jb 0x45ab70
add ebx, edx
inc ebx
mov edx, esi
mov dword [ebp - 0x58], 0
cld
call fcn.0045ac7f
jb 0x45abec
inc dword [ebp - 0x58]
add edi, dword [ebp - 0x54]
mov esi, edx
cmp edi, ebx
jb 0x45abd9
mov ecx, dword [ebp - 0x58]
test ecx, ecx
je 0x45ab70
mov esi, edx
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x54]
imul ecx
jno 0x45ac05
jmp 0x45aba6
mov ecx, dword [ebp - 0x64]
add ecx, eax
js 0x45ac03
mov eax, dword [ebp - 0x6c]
add dword [ebp - 0x64], eax
call fcn.00457330
jb 0x45aba8
mov dword [ebp - 0x68], edi
push edx
mov edi, dword [ebp - 0x6c]
mov edx, esi
call fcn.0045ac7f
jb 0x45ac62
mov esi, dword [ebp - 0x6c]
mov ecx, edi
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push esi
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov dword [ebp - 0x68], edi
mov edi, dword [ebp - 0x54]
add edi, esi
mov dword [ebp - 0x6c], edi
mov esi, edx
jmp 0x45ac22
mov ecx, dword [ebp - 0x64]
mov esi, dword [ebp - 0x6c]
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edx
jmp 0x45ab8a

Function at 0x45ad27
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 0xf
xor edx, edx
call fcn.0045ad84
pop ecx
jb 0x45ad7f
ret
jmp fcn.0044fb2b
Function at 0x45b331
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov ebx, eax
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0045739f
mov esi, dword [ebp + esi - 0x6c]
call fcn.0045738c
jecxz 0x45b36c
test ebx, ebx
jns 0x45b365
push edx
push edi
push ebx
call fcn.0045af69
pop ebx
add ebx, eax
add ebx, 2
pop edi
pop edx
call fcn.0045b469
jmp 0x45b3c2
test ebx, ebx
jns 0x45b380
push ecx
push edi
push ebx
call fcn.0045b307
pop eax
add ebx, eax
add ebx, 2
pop edi
pop ecx
call fcn.0045b409
jmp 0x45b3c2
call fcn.00457330
jb 0x45b3f9
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0045d67b
call fcn.00457d76
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.0045d67b
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.0044fb2b

Function at 0x45b77c
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov eax, dword [ebx]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x68], eax
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0045739f
mov esi, dword [ebp + esi - 0x6c]
call fcn.0045738c
jecxz 0x45b7c6
push ebx
push ecx
push esi
push edi
call fcn.0045af92
pop eax
pop esi
pop ecx
pop ebx
add edi, ecx
sub edx, ecx
jae 0x45b7b8
xor edx, edx
push edx
push edi
push ecx
push esi
sub edi, ecx
mov ecx, edi
sub ecx, eax
mov esi, eax
jmp 0x45b7d0
call fcn.0045b250
push edx
push edi
push 0
push esi
mov edx, dword [ebx + 0x14]
mov edi, dword [ebp - 0x6c]
add dword [ebp - 0x6c], edx
mov al, byte [ebx + 6]
cmp al, 0x2c
je 0x45b7fe
cmp al, 0x2e
je 0x45b826
ja 0x45b82f
dec edx
cmp ecx, edx
jb 0x45b7ed
mov ecx, edx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [edi], cl
jmp 0x45b836
cmp ecx, edx
jb 0x45b804
mov ecx, edx
sub edx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov eax, 0x20202020
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
jmp 0x45b836
call fcn.0045b6da
jae 0x45b836
jmp 0x45b850
call fcn.0045b6fa
jb 0x45b850
pop esi
pop ecx
pop edi
pop edx
dec dword [ebp - 0x68]
jne 0x45b7a1
call fcn.0045d67b
call fcn.0045d67b
pop edi
pop esi
ret
pop esi
pop ecx
pop edi
pop edx
call fcn.0045d67b
call fcn.0045d67b
pop edi
pop esi
jmp fcn.0044fb36
Function at 0x45bdaf
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0045739f
je 0x45be81
mov esi, dword [ebp + esi - 0x6c]
call fcn.0045738c
je 0x45be81
cmp edx, ecx
jb 0x45be81
push edx
push edi
call fcn.0045af69
pop edi
pop edx
mov ebx, eax
test ebx, ebx
je 0x45be81
push edx
mov dword [ebp - 0x60], edx
mov eax, ecx
mul ebx
mov ebx, ecx
pop ecx
sub ecx, eax
push edi
push dword [ebp - 0x60]
call fcn.00457330
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edx
pop edx
pop edi
jb 0x45be8c
mov dword [ebp - 0x64], edi
mov ecx, ebx
push ebx
push esi
push edi
call fcn.0045af92
pop eax
pop esi
pop ebx
jae 0x45be2f
mov edx, dword [ebp - 0x64]
add edx, dword [ebp - 0x60]
sub edx, eax
jmp 0x45be55
push esi
push edi
mov esi, eax
mov ecx, edi
sub ecx, eax
mov edi, dword [ebp - 0x6c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x6c], edi
pop edi
pop esi
add edi, ebx
sub edx, ebx
cmp edx, ebx
jae 0x45be16
mov eax, edi
mov ecx, edx
mov esi, eax
mov edi, dword [ebp - 0x6c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x68]
call fcn.0045d67b
call fcn.00457d76
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
jmp 0x45be86
call fcn.0045d67b
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
call fcn.0045d67b
call fcn.0045d67b
call fcn.0045d135
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.0044fb2b

Function at 0x45c23f
Capabilities:
Terminate process

Disassembly:
pop esi
jmp fcn.0044fb36
push esi
call fcn.00457404
jb 0x45c239
cmp word [esi + 0xa], 1
mov al, 0x36
jne 0x45c263
fild qword [esi + 0x14]
test word [esi + 0xc], 1
je 0x45c25e
fiadd dword [esi + 0x24]
fiadd word [esi + 0x2e]
pop esi
ret
fldz
jmp 0x45c239

Function at 0x45c2a9
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
test esi, 1
je 0x45c2c9
and esi, 0xfffffffe
jne 0x45c2d3
xchg dword [ebx], esi
call fcn.00457364
pop edi
pop esi
ret
call fcn.0045738c
mov edi, dword [ebx]
or edi, edi
je 0x45c2e3
cmp ecx, dword [edi - 4]
je 0x45c303
call fcn.00457330
jb 0x45c313
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xchg dword [ebx], edx
mov esi, edx
call fcn.00457364
pop edi
pop esi
ret
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xchg dword [ebx], edx
mov esi, edx
call fcn.00457364
pop edi
pop esi
jmp fcn.0044fb36
Function at 0x45c323
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x45c340
mov dword [ebx], eax
ret
push esi
push edi
mov esi, eax
call fcn.0045738c
call fcn.00457330
jb 0x45c362
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx], edx
pop edi
pop esi
ret
mov dword [ebx], edx
pop edi
pop esi
jmp fcn.0044fb36

Function at 0x45c36b
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x45c38b
mov dword [ebx], eax
pop edx
push eax
push edx
ret
push esi
push edi
mov esi, eax
call fcn.0045738c
call fcn.00457330
jb 0x45c3b0
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx], edx
pop eax
push edx
push eax
ret
pop edi
pop esi
mov dword [ebx], edx
pop ebx
push edx
push ebx
jmp fcn.0044fb36

Function at 0x45c56d
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x6c]
call fcn.0045738c
mov ebx, ecx
push esi
mov esi, dword [ebp + edi - 0x68]
call fcn.0045738c
jecxz 0x45c5e3
test ebx, ebx
je 0x45c5eb
add ebx, ecx
xchg ecx, ebx
call fcn.00457330
jb 0x45c5f8
xchg ecx, ebx
sub ebx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x88]
mov esi, edx
xchg dword [ebp + edi - 0x68], esi
call fcn.00457364
mov esi, dword [ebp + edi - 0x6c]
call fcn.00457364
add dword [ebp - 0x88], 4
pop edi
pop esi
pop ecx
pop ebx
ret
mov esi, dword [ebp + edi - 0x6c]
mov dword [ebp + edi - 0x68], esi
add dword [ebp - 0x88], 4
pop esi
pop edi
pop esi
pop ecx
pop ebx
ret
pop esi
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.0044fb36

Function at 0x45c81f
Capabilities:
Terminate process

Disassembly:
mov edx, eax
call fcn.0044fbfe
jb 0x45c82c
mov eax, dword [eax + edx]
ret
jmp fcn.0044fb36

Function at 0x45cf2c
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push esi
mov ebx, dword [ebp - 0x84]
sub ebx, 0xa
mov esi, dword [ebx]
sub ebx, 4
shr esi, 1
jb 0x45cf59
je 0x45cf55
shr esi, 1
jae 0x45cf7a
shl esi, 2
mov esi, dword [ebp + esi]
call fcn.00457364
jmp 0x45cf38
pop esi
pop edx
pop eax
ret
shr esi, 1
jb 0x45cf8b
push ebx
shl esi, 2
lea ebx, [ebp + esi]
mov eax, 1
call fcn.00450542
pop ebx
jae 0x45cf38
pop esi
pop edx
pop eax
jmp fcn.0044fb36
shl esi, 2
mov ecx, dword [ebp + esi]
jecxz 0x45cf38
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
jmp 0x45cf38
lea ecx, [ebp + esi*4]
push ecx
call dword [sym.imp.OLEAUT32.DLL_VariantClear]
jmp 0x45cf38
Function at 0x45d787
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x6c], edi
call fcn.0045e0ea
jb 0x45d7dc
call fcn.0045d8a4
jb 0x45d7dc
call fcn.0045d8dd
mov eax, dword [ebp - 0xc]
cmp eax, 0x80000
ja 0x45d7d0
call fcn.0045a75e
mov dword [ebp - 0x180], esp
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0x1c]
dec edx
imul edx, dword [ebp - 0xc]
add edx, ecx
call fcn.0045d7ef
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x6c]
mov esp, ebp
pop ebp
ret 0x3c
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x6c]
mov esp, ebp
pop ebp
pop edx
add esp, 0x3c
push edx
jmp fcn.0044fb36

Function at 0x45e2a9
Capabilities:
Terminate process

Disassembly:
mov edx, 5
jmp fcn.0044fb2b
push esi
push edi
mov edi, dword [ebp - 0x88]
mov edi, dword [ebp + edi - 0x6c]
call fcn.0045739f
push ebp
mov ebp, esp
cmp edx, 0x1f
jb 0x45e2c7
mov edx, 0x1f
push edx
push edi
xor eax, eax
mov ecx, 0xf
push eax
loop 0x45e2d0
cld
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
lea edi, [ebp - 0x28]
rep movsb byte es:[edi], byte [esi]
xor al, al
stosb byte es:[edi], al
mov eax, dword [ebp + 0x14]
mov byte [ebp - 0x29], al
mov eax, dword [ebp + 0x18]
mov byte [ebp - 0x2d], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
test eax, eax
jne 0x45e303
mov eax, 0x41000000
mov dword [ebp + 0x20], eax
mov dword [ebp - 0x34], 0x190
mov edx, dword [ebp + 0x1c]
test edx, 1
je 0x45e31f
mov dword [ebp - 0x34], 0x2bc
test edx, 2
je 0x45e32b
mov byte [ebp - 0x30], 1
test edx, 4
je 0x45e337
mov byte [ebp - 0x2f], 1
test edx, 8
je 0x45e343
mov byte [ebp - 0x2e], 1
call fcn.00457a90
jb 0x45e373
mov edi, eax
inc dword [edi + 4]
mov edx, dword [ebp + 0x20]
mov dword [edi + 0x18], edx
cld
mov ecx, 0xf
lea esi, [ebp - 0x44]
lea edi, [edi + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0xc]
mov esp, ebp
pop ebp
call fcn.0045d67b
pop edi
pop esi
ret 0x14
mov esp, ebp
pop ebp
call fcn.0045d67b
pop edi
pop esi
pop eax
add esp, 0x14
push eax
xor eax, eax
jmp 0x44fb18
Function at 0x4027e0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46a0cc]
jne 0x4027ea
repz ret
jmp fcn.00407560
Function at 0xc03570
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0xc35010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0xc03608
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0xc035e8
xor eax, eax
push ebp
push 0xc035e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0xc03624
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc035e8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0xc35010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0xc35010], ax
mov esp, ebp
pop ebp
ret

Function at 0xc04358
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0xc37044], 0
je 0xc043b9
cmp word [0xc37218], 0xd7b2
jne 0xc04381
cmp dword [0xc37220], 0
jbe 0xc04381
mov eax, 0xc37214
call dword [0xc37230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0xc35058
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0xc043e0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0xc35020], 0
jne 0xc043d5
push 0
push 0xc35078
push 0xc35058
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0xc0450c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00c02700
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0xc37045], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0xc044d4
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc