joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bf20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x48bdd0
push 0x48bdd4
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41bf65
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x8c99e4]
push ecx
push 4
push 0x909188
call fcn.00473d90
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x41bf70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x48bde4
push 0x48bde8
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41bfb5
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x8c99e4]
push ecx
push 0x24
push 0x98a578
call fcn.00473d90
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x41bfc0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x48bdfc
push 0x48be00
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41c005
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x8c99e4]
push ecx
push 4
push 0x909a70
call fcn.00473d90
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x41c010
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x48be10
push 0x48be14
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41c053
mov eax, dword [ebp - 4]
push eax
push 0x100
push 4
push 0x8c83e0
call fcn.00473d90
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x41c060
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x48be24
push 0x48be28
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x41c08d
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x41c0b4
mov ecx, dword [ebp - 8]
mov edx, dword [0x8c83d8]
mov dword [ecx*8 + 0x90a240], edx
mov eax, dword [0x8c83dc]
mov dword [ecx*8 + 0x90a244], eax
jmp 0x41c084
cmp dword [ebp - 4], 0
je 0x41c0de
mov ecx, dword [ebp - 4]
push ecx
push 0x100
push 8
push 0x90a240
call fcn.00473d90
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x41c0f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x48be40
push 0x48be44
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41c130
mov eax, dword [ebp - 4]
push eax
push 1
push 4
push 0x8c87f4
call fcn.00473d90
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x41c140
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x48be5c
push 0x48be60
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x41c16d
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [0x8c99e4]
jge 0x41c196
mov edx, dword [ebp - 8]
mov eax, dword [0x8c83d8]
mov dword [edx*8 + 0xa0d560], eax
mov ecx, dword [0x8c83dc]
mov dword [edx*8 + 0xa0d564], ecx
jmp 0x41c164
cmp dword [ebp - 4], 0
je 0x41c1c1
mov edx, dword [ebp - 4]
push edx
mov eax, dword [0x8c99e4]
push eax
push 8
push 0xa0d560
call fcn.00473d90
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x41c1d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x48be78
push 0x48be7c
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41c217
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x8c99e4]
push ecx
push 4
push 0xa0e700
call fcn.00473d90
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.00473438
add esp, 4
mov dword [ebp - 8], 0
jmp 0x41c229
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [0x8c99e4]
jge 0x41c253
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0xa0e700]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.0041bd30
push eax
call fcn.00410d50
add esp, 0xc
jmp 0x41c220
mov esp, ebp
pop ebp
ret

Function at 0x41c260
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x48be94
push 0x48be98
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41c2a3
mov eax, dword [ebp - 4]
push eax
push 0x1f4
push 4
push 0xa4f838
call fcn.00473d90
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x41e2b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
test ecx, ecx
jne 0x41e3f4
cmp dword [0x8c87ec], 0
je 0x41e371
cmp dword [0x56e3f8], 0
je 0x41e311
cmp dword [0x56e3fc], 0
je 0x41e311
mov dword [ebp - 4], 0
jmp 0x41e2fb
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 2
jge 0x41e311
cmp dword [0x8c99e4], 0
jg 0x41e311
call fcn.00418650
jmp 0x41e2f2
cmp dword [0x8c99e4], 0
jle 0x41e371
cmp dword [0x90995c], 0
jl 0x41e330
mov eax, dword [0x90995c]
cmp eax, dword [0x8c99e4]
jl 0x41e371
mov dword [0x90995c], 0
mov ecx, dword [0x90995c]
push ecx
push 0x3f1
mov edx, dword [0x8c8800]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.00410fe0
add esp, 8
mov eax, dword [0x90995c]
push eax
mov ecx, dword [0x8c8800]
push ecx
call fcn.00410dc0
add esp, 8
cmp dword [0x8c99e4], 0
jg 0x41e38f
push 0x10
push 0
push 0x48c2c0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x41e3f4
cmp dword [0x90995c], 0
jl 0x41e3a5
mov eax, dword [0x90995c]
cmp eax, dword [0x8c99e4]
jl 0x41e3ba
push 0x10
push 0
push 0x48c2d4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x41e3f4
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_UnregisterHotKey]
push 0
push 0x407
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 7
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0xa0cb74], 1
mov esp, ebp
pop ebp
ret

Function at 0x41e600
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x104
push 0x909960
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x909960
call fcn.00474a10
add esp, 4
lea eax, [eax + 0x90995f]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x909960
jbe 0x41e64b
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x5c
je 0x41e64b
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x41e62c
cmp dword [ebp - 4], 0x909960
jb 0x41e668
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x41e668
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x909960
jb 0x41e684
push str.captcha
mov ecx, dword [ebp - 4]
push ecx
call fcn.004779b0
add esp, 8
jmp 0x41e696
push 0x48aab2
push 0x909960
call fcn.004779b0
add esp, 8
push 0x909960
call fcn.00410610
add esp, 4
test eax, eax
jne 0x41e6b4
push 0
push 0x909960
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str.captcha.gif
push 0x909960
call fcn.004779c0
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x4326c0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0x12345678
mov dword [ebp - 8], 0
jmp 0x4326df
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
jge 0x43274d
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0xfea68850
push 0x517c
push 0x2b17210
push 1
push 0xfddf5740
push 0
call fcn.0041ebb0
add esp, 0x10
push eax
push 2
push 0xfed739a0
push 0
call fcn.0041ebb0
add esp, 0x14
push eax
call fcn.0041ebb0
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43274b
mov edx, dword [ebp - 0xc]
add edx, 0x68
push edx
call fcn.00420130
add esp, 4
cmp eax, dword [ebp + 8]
jne 0x43274b
mov eax, dword [ebp - 8]
jmp 0x4327d0
jmp 0x4326d6
mov dword [ebp - 0x10], 0xc6
jmp 0x43275f
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xcc
jge 0x4327cd
mov ecx, dword [ebp - 0x10]
push ecx
push 1
push 0xfea68850
push 0x51bf
push 0x2b17468
push 1
push 0xfddf5740
push 0
call fcn.0041ebb0
add esp, 0x10
push eax
push 2
push 0xfed739a0
push 0
call fcn.0041ebb0
add esp, 0x14
push eax
call fcn.0041ebb0
add esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4327cb
mov edx, dword [ebp - 0x14]
add edx, 0x68
push edx
call fcn.00420130
add esp, 4
cmp eax, dword [ebp + 8]
jne 0x4327cb
mov eax, dword [ebp - 0x10]
jmp 0x4327d0
jmp 0x432756
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x43c330
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0x12345678
mov dword [ebp - 8], 0xc6
jmp 0x43c34f
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xcc
jge 0x43c3e1
mov ecx, dword [ebp - 8]
push ecx
push 1
push 0xfea68850
push 0x51bf
push 0x2b17468
push 1
push 0xfddf5740
push 0
call fcn.0041ebb0
add esp, 0x10
push eax
push 2
push 0xfed739a0
push 0
call fcn.0041ebb0
add esp, 0x14
push eax
call fcn.0041ebb0
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x43c3dc
mov edx, dword [ebp - 0xc]
add edx, 0x68
push edx
call fcn.00420130
add esp, 4
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 0x20]
jne 0x43c3dc
push 0
push 1
push 0xfea8ec80
mov edx, dword [ebp - 0xc]
push edx
call fcn.0041ebb0
add esp, 0x10
cmp eax, dword [ebp + 0xc]
jb 0x43c3dc
mov eax, dword [ebp - 8]
jmp 0x43c3e4
jmp 0x43c346
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x445b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 4], 0x12345678
mov eax, 0x54
mov word [ebp - 0x28], ax
mov ecx, 0x65
mov word [ebp - 0x26], cx
mov edx, 0x6e
mov word [ebp - 0x24], dx
mov eax, 0x43
mov word [ebp - 0x22], ax
mov ecx, 0x61
mov word [ebp - 0x20], cx
mov edx, 0x70
mov word [ebp - 0x1e], dx
mov eax, 0x74
mov word [ebp - 0x1c], ax
mov ecx, 0x63
mov word [ebp - 0x1a], cx
mov edx, 0x68
mov word [ebp - 0x18], dx
mov eax, 0x61
mov word [ebp - 0x16], ax
mov ecx, 0x2e
mov word [ebp - 0x14], cx
mov edx, 0x64
mov word [ebp - 0x12], dx
mov eax, 0x6c
mov word [ebp - 0x10], ax
mov ecx, 0x6c
mov word [ebp - 0xe], cx
xor edx, edx
mov word [ebp - 0xc], dx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xb0ecb0]
call edx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x445ceb
mov byte [ebp - 0x54], 0x8b
mov byte [ebp - 0x53], 0x45
mov byte [ebp - 0x52], 0xc
mov byte [ebp - 0x51], 0x8b
mov byte [ebp - 0x50], 0x4d
mov byte [ebp - 0x4f], 8
mov byte [ebp - 0x4e], 0x50
mov byte [ebp - 0x4d], 0x51
mov byte [ebp - 0x4c], 0x8d
mov byte [ebp - 0x4b], 0x4d
mov byte [ebp - 0x4a], 0xf3
mov byte [ebp - 0x49], 0xc7
mov byte [ebp - 0x48], 0x45
mov byte [ebp - 0x47], 0xfc
mov byte [ebp - 0x46], 0
mov byte [ebp - 0x45], 0
mov byte [ebp - 0x44], 0
mov byte [ebp - 0x43], 0
mov byte [ebp - 0x3c], 0x55
mov byte [ebp - 0x3b], 0x8b
mov byte [ebp - 0x3a], 0xec
mov byte [ebp - 0x39], 0x8b
mov byte [ebp - 0x38], 0x45
mov byte [ebp - 0x37], 8
mov byte [ebp - 0x36], 0x53
mov byte [ebp - 0x35], 0x56
mov byte [ebp - 0x34], 0x8b
mov byte [ebp - 0x33], 0x75
mov byte [ebp - 0x32], 0x10
mov byte [ebp - 0x31], 0x57
mov byte [ebp - 0x30], 0x8b
mov byte [ebp - 0x2f], 0x7d
mov byte [ebp - 0x2e], 0xc
mov byte [ebp - 0x2d], 0x56
mov byte [ebp - 0x2c], 0x57
mov byte [ebp - 0x2b], 0x50
mov eax, dword [ebp - 8]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [eax + 0x50]
mov dword [ebp - 0x58], ecx
push 0x12
lea edx, [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00445cf0
add esp, 0x10
mov edx, dword [ebp - 4]
mov dword [edx + 0xb0ec44], eax
push 0x12
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00445cf0
add esp, 0x10
add eax, 0x23
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0ec48], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xb0ec48]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xb0ec48]
mov ecx, dword [edx + 1]
mov edx, dword [ebp - 4]
mov eax, dword [eax + ecx + 0x2c]
mov dword [edx + 0xb0ec48], eax
mov esp, ebp
pop ebp
ret
Function at 0x449b6e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
jmp 0x449b90
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00465f29
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x449bc7
push ebx
call fcn.004651e2
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00465f29
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp + 0x14]
mov ebx, dword [ebx]
test ebx, ebx
je 0x449c04
push ebx
call fcn.004651e2
add esp, 4
pop eax
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
push 0x80000101
push 0
push 0x5c
push 1
mov ebx, 0x140
call fcn.00465e19
add esp, 0x10
mov dword [ebp - 8], eax
push dword [ebp - 8]
mov ebx, dword [ebp + 8]
push dword [ebx]
mov ecx, 2
call fcn.00448855
add esp, 8
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x449c53
push ebx
call fcn.004651e2
add esp, 4
mov dword [ebp - 0x10], esp
push 0xff
mov ebx, dword [ebp + 0x14]
push dword [ebx]
mov eax, 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, 0xff
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
push 0xff
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x449ca5
push 6
call fcn.004651e8
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x449cb8
push ebx
call fcn.004651e2
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x449cca
mov eax, dword [ebp - 4]
jmp 0x449ce4
mov eax, 0
jmp 0x449ce4
mov esp, ebp
pop ebp
ret 0x14

Function at 0x44bdaf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov ebx, dword [ebp + 0x14]
mov dword [ebx], 0
mov dword [ebp - 8], esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x44be01
push 6
call fcn.004651e8
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x44be35
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x44be30
push 6
call fcn.004651e8
add esp, 4
jmp 0x44be3d
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x44be4e
mov esp, ebp
pop ebp
ret 0x14
Function at 0x44e7e9
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
jmp 0x44e80b
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.00465f29
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x44e840
push ebx
call fcn.004651e2
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x44e857
mov eax, 0x87446c
push eax
push 1
mov ebx, 0x130
call fcn.00466059
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x44e893
push 6
call fcn.004651e8
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x44e8c1
mov eax, dword [ebp - 4]
test eax, eax
je 0x44e8bc
push eax
mov ebx, eax
call fcn.004487ea
inc eax
push eax
call fcn.004651dc
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x44e8fa
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00465e19
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x44e8fa
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x44e90b
push ebx
call fcn.004651e2
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x452dcb
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x452dfb
push 6
call fcn.004651e8
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x452e0f
mov esp, ebp
pop ebp
ret 4
Function at 0x4562b5
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x4562e4
push 6
call fcn.004651e8
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x456306
push 6
call fcn.004651e8
add esp, 4
mov dword [ebp - 0x14], eax
fild dword [ebp - 0x14]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fild dword [ebp - 4]
fstp qword [ebp - 0x1c]
fsub qword [ebp - 0x1c]
fstp qword [ebp - 0x24]
fild dword [ebp + 8]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x24]
fsub qword [ebp - 0x2c]
fcomp qword [0x875ea7]
fnstsw ax
test ah, 1
je 0x456376
mov dword [ebp - 8], esp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x45635f
push 6
call fcn.004651e8
add esp, 4
push 0
mov ebx, 0x350
call fcn.004685a9
add esp, 4
jmp 0x4562e7
jmp 0x45637b
mov esp, ebp
pop ebp
ret 4

Function at 0x465969
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.00465449
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x4659c0
push ebx
push edi
call fcn.004654d9
push esi
mov ebx, esi
call fcn.00465449
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x465997
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x465ed9
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x465ef7
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x465eec
pop esi
ret
Function at 0x47edd9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x887b40]
jne 0x47ede3
repz ret
jmp fcn.004853a7

Function at 0x483bb3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x887b40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0047c4b1
and dword [ebp - 0x14], 0
cmp dword [0xa672ec], 0
mov dword [ebp - 0x18], eax
jne 0x483c66
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x483d0e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x48eaa4
push ebx
call edi
test eax, eax
je 0x483d0e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0xa672ec], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0xa672f0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0xa672f4], eax
call edi
push eax
call esi
mov dword [0xa672fc], eax
test eax, eax
je 0x483c66
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0xa672f8], eax
mov eax, dword [0xa672f8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x483cbf
cmp dword [0xa672fc], ecx
je 0x483cbf
push eax
call esi
push dword [0xa672fc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x483cbf
test ebx, ebx
je 0x483cbf
call edi
test eax, eax
je 0x483cb6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x483cb6
test byte [ebp - 8], 1
jne 0x483cbf
or dword [ebp + 0x10], 0x200000
jmp 0x483cf2
mov eax, dword [0xa672f0]
cmp eax, dword [ebp - 0x18]
je 0x483cf2
push eax
call esi
test eax, eax
je 0x483cf2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x483cf2
mov eax, dword [0xa672f4]
cmp eax, dword [ebp - 0x18]
je 0x483cf2
push eax
call esi
test eax, eax
je 0x483cf2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0xa672ec]
call esi
test eax, eax
je 0x483d0e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x483d10
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047edd9
leave
ret
Function at 0x12af370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x12af38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x12d8074
push ecx
mov edi, eax
call fcn.012c3198
mov esi, eax
add esp, 8
test esi, esi
jne 0x12af3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.012c302e
push esi
call fcn.012c2fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret