joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d040
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [0x4fc060]
mov esi, dword [esp + 0x40]
test ebp, ebp
jne 0x41d068
mov eax, dword [esi + 8]
test eax, eax
je 0x41d0c0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [esi + 8]
test edi, edi
je 0x41d0d0
mov ebx, dword [0x4fca80]
call sym._GetLastError_0
mov dword [esp], ebx
mov ebp, eax
call sym._TlsGetValue_4
sub esp, 4
mov ebx, eax
mov dword [esp], ebp
call sym._SetLastError_4
sub esp, 4
test ebx, ebx
je 0x41d160
mov ebp, dword [ebx]
cmp ebp, edi
jb 0x41d1b0
lea ebx, [ebx + edi*4]
mov eax, dword [ebx]
test eax, eax
jne 0x41d05c
mov eax, esi
call sym._emutls_alloc
mov dword [ebx], eax
jmp 0x41d05c
mov eax, esi
call sym._emutls_alloc
mov dword [esi + 8], eax
jmp 0x41d05c
mov edi, dword [0x4fc060]
test edi, edi
je 0x41d238
mov ebx, dword [0x4b10a8]
test ebx, ebx
je 0x41d208
mov dword [esp], 0x4fca84
call sym._InterlockedIncrement_4
sub esp, 4
test eax, eax
jne 0x41d27b
mov edi, dword [esi + 8]
test edi, edi
je 0x41d243
mov eax, dword [0x4fc060]
test eax, eax
je 0x41d06f
mov dword [esp], 0x4fca84
call sym._InterlockedDecrement_4
sub esp, 4
test eax, eax
js 0x41d06f
mov eax, dword [0x4fca88]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._ReleaseSemaphore_12
sub esp, 0xc
jmp 0x41d06f
lea eax, [edi + 0x21]
mov dword [esp + 4], 4
lea ebp, [edi + 0x20]
mov dword [esp], eax
call sym._calloc
mov ebx, eax
test eax, eax
je sym.___emutls_get_address.cold
mov dword [eax], ebp
mov eax, dword [0x4fca80]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
jne 0x41d0a6
call sym._GetLastError_0
jmp 0x41d0a6
lea edx, [ebp + ebp]
cmp edi, edx
jbe 0x41d1bb
lea edx, [edi + 0x20]
lea eax, [edx*4 + 4]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 0x1c], edx
call sym.___mingw_realloc
mov ebx, eax
test eax, eax
je sym.___emutls_get_address.cold
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
sub edx, ebp
lea eax, [eax + ebp*4 + 4]
shl edx, 2
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [esp], eax
call sym._memset
jmp 0x41d182
mov dword [esp], 0x4b10ac
call sym._InterlockedIncrement_4
sub esp, 4
test eax, eax
jne 0x41d26f
call sym._emutls_init
mov dword [0x4b10a8], 1
mov edx, dword [0x4fc060]
test edx, edx
jne 0x41d0ec
mov edi, dword [esi + 8]
test edi, edi
jne 0x41d06f
mov eax, dword [0x4fca7c]
lea edi, [eax + 1]
mov dword [0x4fca7c], edi
mov dword [esi + 8], edi
jmp 0x41d10e
mov dword [esp], 0
call sym._Sleep_4
sub esp, 4
mov ecx, dword [0x4b10a8]
test ecx, ecx
je 0x41d260
jmp 0x41d22a
mov eax, dword [0x4fca88]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
test eax, eax
je 0x41d103
mov dword [esp], 0x4fca84
call sym._InterlockedDecrement_4
sub esp, 4
jmp 0x41d103
Function at 0x420240
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp byte [0x4b2b1c], 0
jne method.__gnu_cxx.__verbose_terminate_handler____clone_.cold_
mov byte [0x4b2b1c], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x4a942a
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym.___cxa_demangle
mov edi, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x30
mov dword [esp + 4], 1
mov esi, eax
lea ebp, [edi + 0x40]
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
mov dword [esp + 0xc], ebp
call sym._fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp + 4], ebp
test edx, edx
jne 0x420318
mov dword [esp], esi
call sym._fputs
lea eax, [edi + 0x40]
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4b5ef9
call sym._fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4a9425
mov dword [esp], esi
call sym.___mingw_aligned_free
jmp 0x4a9425
mov dword [esp], ebx
call sym._fputs
jmp 0x4202dc
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x402ee0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push 1
push 0
push eax
push str.iexplore.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 4]
jmp fcn.0049da16

Function at 0x4050a0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x4a5dd9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x150
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [0x4cd448]
mov dword [esp + 0x168], 0
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x170]
mov byte [esp + 0x168], 1
push ecx
lea ecx, [esp + 0x14]
call fcn.0049de2e
lea edx, [esp + 0x10]
push str..
lea eax, [esp + 0x18]
push edx
push eax
call fcn.0049dcab
mov eax, dword [eax]
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
lea ecx, [esp + 0x14]
cmp ebp, 0xffffffff
setne bl
call fcn.0049da16
test bl, bl
je 0x405261
lea edx, [esp + 0x20]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x405261
mov ebx, 2
mov eax, dword [esp + 0x20]
and eax, 0x10
cmp al, 0x10
jne 0x405204
mov esi, 0x4c284c
lea eax, [esp + 0x4c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40517c
test cl, cl
je 0x405178
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40517c
add eax, ebx
add esi, ebx
test cl, cl
jne 0x40515a
xor eax, eax
jmp 0x405181
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40524d
mov esi, 0x4c2848
lea eax, [esp + 0x4c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4051b4
test cl, cl
je 0x4051b0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4051b4
add eax, ebx
add esi, ebx
test cl, cl
jne 0x405192
xor eax, eax
jmp 0x4051b9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40524d
lea eax, [esp + 0x10]
push 0x4c2844
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.0049dcab
push ecx
lea ecx, [esp + 0x50]
mov edx, esp
mov dword [esp + 0x20], esp
push ecx
push eax
push edx
mov byte [esp + 0x178], bl
call fcn.0049dcab
mov ecx, edi
call fcn.004050a0
mov byte [esp + 0x168], 1
lea ecx, [esp + 0x14]
jmp 0x405248
push 1
lea edx, [esp + 0x14]
push 0x4c2844
lea eax, [esp + 0x20]
push edx
push eax
call fcn.0049dcab
push ecx
lea edx, [esp + 0x54]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
push eax
push ecx
mov byte [esp + 0x17c], 3
call fcn.0049dcab
mov ecx, edi
call fcn.00404ec0
mov byte [esp + 0x168], 1
lea ecx, [esp + 0x18]
call fcn.0049da16
lea eax, [esp + 0x20]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405142
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x10]
mov byte [esp + 0x168], 0
call fcn.0049da16
lea ecx, [esp + 0x170]
mov dword [esp + 0x168], 0xffffffff
call fcn.0049da16
mov ecx, dword [esp + 0x160]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x15c
ret 4
Function at 0x41c3b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x404
mov eax, dword [esp + 0x40c]
mov edx, dword [esp + 0x418]
push esi
push eax
mov eax, dword [esp + 0x41c]
lea ecx, [esp + 0xc]
push 0x400
push ecx
mov ecx, dword [esp + 0x420]
push edx
push eax
push ecx
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x41c410
mov esi, dword [esp + 0x40c]
push 0x4e2b80
mov ecx, esi
call fcn.0049d78b
mov eax, esi
pop esi
add esp, 0x404
ret
mov esi, dword [esp + 0x40c]
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.0049da84
mov eax, esi
pop esi
add esp, 0x404
ret

Function at 0x42a920
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a7288
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
call fcn.004a2a3c
mov ecx, dword [esp + 0x30]
mov eax, dword [eax + 8]
push 0x2000
push 0
push 0
push 0
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
test eax, eax
jne 0x42a970
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4ac088
push eax
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0
call fcn.004a0b06
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.0049a863
push eax
lea ecx, [esp + 0x10]
call fcn.004a085e
lea edx, [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x30], 1
call fcn.0042a6d0
lea ecx, [esp + 4]
mov esi, eax
call fcn.004a0b5d
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 0
call fcn.004a08d0
mov dword [esp + 4], vtable.CGdiObject.0
lea ecx, [esp + 4]
mov dword [esp + 0x28], 2
call fcn.004a0b5d
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x42c2e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a7478
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [esi + 0x1c]
push eax
call edi
push eax
call fcn.0049a863
push eax
lea ecx, [esp + 0x30]
call fcn.004a085e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0xc]
push ecx
push edx
mov dword [esp + 0x50], 0
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi + 0x1c]
push edx
call edi
push eax
call fcn.0049a863
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
call fcn.004a0714
mov eax, dword [esi + 0x120]
mov ebx, dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
jne 0x42c416
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x2c]
neg eax
sbb eax, eax
and eax, ecx
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esi + 0x11c]
call fcn.004a01bf
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [esp + 0x30]
sub eax, ecx
mov ecx, dword [esp + 0x14]
sub ecx, edi
push eax
push ecx
push edx
lea edi, [esi + 0x12c]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, edi
call fcn.004a0b06
test edi, edi
je 0x42c3c2
mov edi, dword [edi + 4]
mov eax, dword [esi + 0x120]
push edi
push eax
call fcn.004a0300
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esi + 0x134], eax
mov eax, dword [esp + 0xc]
sub ecx, edx
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x30]
sub edx, eax
lea eax, [esp + 0x2c]
push 0xcc0020
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x24]
push edi
push eax
push ecx
mov ecx, dword [esi + 0x120]
push edx
push 0
push 0
push ecx
call ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
sub eax, ecx
mov ecx, dword [esp + 0x14]
lea edx, [esi + 0x11c]
sub ecx, edi
test edx, edx
je 0x42c437
mov edx, dword [edx + 4]
push 0xcc0020
push 0
push 0
push edx
mov edx, dword [esp + 0x60]
push eax
push ecx
push 0
mov eax, dword [edx + 4]
push 0
push eax
call ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xffffffff
call fcn.004a08d0
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4

Function at 0x42f710
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x42f772
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x42f980
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
mov eax, dword [esp + 0x20c]
push ebx
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
push ebp
push 0
push 0
push eax
push str.open
mov edi, ecx
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x42fa72
lea ecx, [esp + 0x10]
push ecx
push str..htm
push bind
mov ecx, edi
call fcn.0042f710
test eax, eax
jne 0x42fa72
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push bind
mov ecx, edi
call fcn.0042f710
test eax, eax
jne 0x42fa72
lea edx, [esp + 0x10]
push 0x4c56a8
push edx
call fcn.00488d0f
mov esi, eax
add esp, 8
test esi, esi
jne 0x42fa43
lea eax, [esp + 0x10]
push 0x4c56a4
push eax
call fcn.00488d0f
mov esi, eax
add esp, 8
test esi, esi
jne 0x42fa43
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x42fa46
mov byte [esi], 0
push 0x4c56a0
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
Function at 0x42fea0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a7600
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], vtable.CPen.0
mov dword [esp + 0x50], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], vtable.CBrush.0
mov eax, dword [esi + 0x90]
mov byte [esp + 0x50], 1
push eax
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x28]
call fcn.004a0b06
mov eax, dword [esi + 0x8c]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x20]
call fcn.004a0b06
mov edi, dword [ebp + 8]
lea eax, [esp + 0x24]
push eax
mov ecx, edi
call fcn.004a0353
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], eax
push ecx
mov ecx, edi
call fcn.004a0353
fld qword [esi + 0x60]
mov dword [esp + 0x18], eax
mov dword [esp + 0x3c], ebx
call fcn.00488884
fld qword [esi + 0x68]
mov dword [esp + 0x44], eax
mov dword [esp + 0x38], ebx
call fcn.00488884
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0x3c]
xor ecx, ecx
cmp eax, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
jle 0x430065
mov eax, dword [esi + 0x7c]
test al, 1
je 0x42ffa9
mov eax, dword [esi + 0x44]
mov edx, dword [esi]
cmp ecx, eax
lea eax, [esp + 0x38]
push eax
push edi
mov ecx, esi
jne 0x42ffa1
call dword [edx + 0xc4]
jmp 0x430026
call dword [edx + 0xc0]
jmp 0x430026
test al, 2
je 0x430026
fild dword [esi + 0x80]
fiadd dword [esi + 0x44]
fidiv dword [esi + 0x84]
fimul dword [esp + 0x10]
fld st(0)
call fcn.00488884
fsub qword [0x4ad430]
mov ebx, eax
dec ebx
mov dword [esp + 0x10], ebx
fisub dword [esp + 0x10]
fmul qword [esi + 0x68]
call fcn.00488884
mov edx, dword [esi]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov ecx, esi
cmp eax, ebx
lea eax, [esp + 0x38]
push eax
push edi
jg 0x42fffe
call dword [edx + 0xc4]
jmp 0x430026
call dword [edx + 0xc0]
mov eax, dword [esp + 0xc]
inc ebx
cmp eax, ebx
jne 0x430026
mov eax, dword [esp + 0x10]
test eax, eax
je 0x430026
mov edx, dword [esi]
push eax
lea eax, [esp + 0x3c]
mov ecx, esi
push eax
push edi
call dword [edx + 0xc8]
fild dword [esi + 0x58]
fadd qword [esi + 0x68]
fadd qword [esp + 0x2c]
fst qword [esp + 0x2c]
call fcn.00488884
fld qword [esp + 0x2c]
fadd qword [esi + 0x68]
mov dword [esp + 0x38], eax
call fcn.00488884
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0x3c]
inc ecx
cmp ecx, eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
jl 0x42ff7e
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, edi
call fcn.004a0353
mov edx, dword [esp + 0x18]
mov ecx, edi
push edx
call fcn.004a0353
lea ecx, [esp + 0x24]
call fcn.004a0b5d
lea ecx, [esp + 0x1c]
call fcn.004a0b5d
mov esi, vtable.CGdiObject.0
mov dword [esp + 0x1c], esi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x50], 2
call fcn.004a0b5d
mov dword [esp + 0x24], esi
lea ecx, [esp + 0x24]
mov dword [esp + 0x50], 3
call fcn.004a0b5d
mov ecx, dword [esp + 0x48]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x434390
Capabilities:
Terminate process

Disassembly:
sub esp, 0x100
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push ebx
mov ebx, dword [esp + 0x108]
push ebp
push esi
push edi
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, dword [esp + 0x118]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push 0x4c5b14
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.error_message.txt
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004886c1
add esp, 8
mov esi, eax
push ebp
push ebx
push str._s_s
push esi
call fcn.00488f87
push esi
call fcn.004883d7
mov edx, dword [0x4da2bc]
add esp, 0x14
test edx, edx
je 0x43446d
mov edi, 0x4c5b20
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call edx
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
push 0x10
lea ecx, [esp + 0x14]
push str.message
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.00489285
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x436550
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a7847
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x4ad600
lea ecx, [esi + 0x48]
mov dword [esp + 0x1c], 4
call fcn.0049da16
lea ecx, [esi + 0x44]
mov byte [esp + 0x1c], 3
call fcn.0049da16
mov ebx, dword [esi + 0x3c]
mov edi, dword [esi + 0x38]
cmp edi, ebx
mov byte [esp + 0x1c], 2
je 0x4365b0
mov ecx, edi
call fcn.0049da16
add edi, 4
cmp edi, ebx
jne 0x4365a2
mov eax, dword [esi + 0x38]
push eax
call fcn.0049d780
xor ebx, ebx
add esp, 4
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov ebp, dword [esi + 0x2c]
mov edi, dword [esi + 0x28]
mov byte [esp + 0x1c], 1
cmp edi, ebp
je 0x4365e4
mov ecx, edi
call fcn.0049da16
add edi, 4
cmp edi, ebp
jne 0x4365d6
mov eax, dword [esi + 0x28]
push eax
call fcn.0049d780
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov eax, dword [esi + 0x18]
push eax
mov dword [esp + 0x18], eax
call fcn.0049d780
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov eax, dword [esi + 8]
push eax
mov dword [esp + 0x1c], eax
call fcn.0049d780
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x43ba00
Capabilities:
Access peb ldr_data
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4a7ad0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
lea ecx, [esp]
mov dword [esp + 0x28], 1
call fcn.0049df72
mov eax, dword [esp + 0x30]
push 0
push 0x3002
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 2
call fcn.0049e124
test eax, eax
je 0x43ba88
mov edx, dword [esp]
push 2
push 0
lea ecx, [esp + 8]
call dword [edx + 0x28]
lea ecx, [esp + 0x10]
call fcn.0049df72
mov eax, dword [esp + 0x34]
push 0
push 0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 3
call fcn.0049e124
test eax, eax
jne 0x43bac9
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.0049e067
lea ecx, [esp]
mov byte [esp + 0x28], 1
call fcn.0049e067
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.0049da16
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0xffffffff
call fcn.0049da16
or eax, 0xffffffff
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.0049e41e
mov esi, eax
push esi
call fcn.0049d757
add esp, 4
mov edi, eax
lea ecx, [esp + 0x18]
push esi
push edi
call fcn.0049e241
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.0049e27b
mov eax, dword [esp + 0x40]
test eax, eax
je 0x43bb0a
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 8]
call fcn.0049e41e
lea ecx, [esp + 0x18]
mov esi, eax
mov byte [esp + 0x30], 2
call fcn.0049e067
lea ecx, [esp + 8]
mov byte [esp + 0x30], 1
call fcn.0049e067
lea ecx, [esp + 0x38]
mov byte [esp + 0x30], 0
call fcn.0049da16
lea ecx, [esp + 0x3c]
mov dword [esp + 0x30], 0xffffffff
call fcn.0049da16
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc

Function at 0x441060
Capabilities:
Create thread

Disassembly:
call fcn.004545e0
mov ecx, eax
jmp 0x454630
push ecx
push 0
push 0x454660
call fcn.004897a2
add esp, 0xc
cmp eax, 0xffffffff
jne 0x454650
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
ret
mov eax, 1
ret