joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b22d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x41b332
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41b2c8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41b2b5
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [eax], 1
mov eax, dword [ebp - 0x30]
mov dword [eax], 1
jmp 0x41b2c6
push 0
push 0x18e3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x41b330
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x41b310
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x41b30e
push 0x7b2
push 0
push 1
push 0x16a1
push 1
push 1
call fcn.0041e4f5
add esp, 0x18
jmp 0x41b330
mov byte [ebp - 1], 0
push 0x33c1
push 1
push 0x3729
lea eax, [ebp - 1]
push eax
push 0
push 0
call fcn.0040dbcd
add esp, 0x18
jmp 0x41b35b
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push 0
call fcn.0041db79
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x41dada
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x41db00
push 1
push 0x697e
push 0x34ed
push 1
call fcn.0041db79
add esp, 0x10
jmp 0x41db75
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x41db26
push 1
call fcn.0041d4cf
pop ecx
jmp 0x41db75
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x41db5e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x41db5c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x41db75
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x41db75
push 0
push 1
call fcn.0041dd58
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42caa4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x42cb2f
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x42cb1a
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x42cb09
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x42cb07
push 0x20c1
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x42cb18
push 0
push 0x1687
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
jmp 0x42cb2d
push 0
push 1
push 1
push 0xe9f
call fcn.00433eba
add esp, 0x10
jmp 0x42cb43
push 1
push 0x648c
push 0xec
call fcn.0042b7ef
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x43193f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4319d8
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x4319ce
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4319a5
push 0x4a4
push 0x8d9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x4319cc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4319cc
push 0
push 0x18e3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x4319d6
push 0
call fcn.00432734
pop ecx
jmp 0x431a06
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
push 0x87a
push dword [ebp - 0x20]
push 1
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x28]
call fcn.0042f469
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x432768
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x432797
lea eax, [ebp + 0x2c]
mov dword [ebp - 4], eax
push 0x7942
push 0
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
push eax
call fcn.0043688c
add esp, 0xc
jmp 0x432874
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x432835
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x432812
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x432810
push 0x20c1
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x432833
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x432833
push 0x1546
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x432874
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x44]
push 0
push 0x5380
push 1
push 0x1e0b
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push 0x3a85
push dword [ebp - 0x50]
call fcn.0042b83b
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x433bc2
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x433c30
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x433c00
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 1
call fcn.00433c54
pop ecx
pop ecx
jmp 0x433c2e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x433c1a
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x433c2e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x433c2e
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
jmp 0x433c50
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x1c]
push 0
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
push eax
call fcn.0042d464
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x437626
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x437727
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4376d8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4376c9
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4376c7
push 0x5e3
push 0
push 0x3054
push 0x641f
push 1
push 1
push 1
push 0x72a2
push 1
push 0x4d85
push 0x7cf4
push 0x2900
push 0
push 0x213c
push 0x749d
push 0xab2
push 0x6b52
call fcn.0043a431
add esp, 0x44
jmp 0x4376d6
push 0x1d52
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x437725
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x43771d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x38]
add eax, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x437725
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
jmp 0x437738
push 0x66b2
push 1
push 1
call fcn.00431c45
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x437abb
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x437b13
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x437ae9
push 1
call fcn.00437b64
pop ecx
jmp 0x437b11
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x437b06
push 0x254f
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x437b11
push 0x18ca
call dword [sym.imp.USER32.dll_GetKeyboardType]
jmp 0x437b60
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
push 0x5f17
push dword [ebp - 0x14]
push 0x74c1
push 0x4076
push 0x5cad
push 0x548
push 1
push 0x568b
push 0x1537
push 0x6088
push dword [ebp - 0x18]
call fcn.0042c6d3
add esp, 0x30
mov esp, ebp
pop ebp
ret

Function at 0x43ba9e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x43bb3c
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x43badc
push 1
push 0x2fa3
call fcn.0043bbe3
pop ecx
pop ecx
jmp 0x43bb37
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43bb24
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43bb22
push 0x5b8e
push 0
push 1
push 0
push 1
push 0x5d98
call fcn.00437626
add esp, 0x18
jmp 0x43bb37
push 0
push 0x2137
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x43bbdf
lea eax, [ebp + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43bb62
push 1
call fcn.00431c66
pop ecx
jmp 0x43bbdf
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x43bbd2
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x43bbd0
push 0x5816
push 0x61a1
push 0x492b
push 0
push 0x4dba
push 1
push 0x5068
push 0x4f11
push 1
push 0x214e
push 0x1998
push 0x1556
push 0x747b
push 0
call fcn.0042f22d
add esp, 0x38
jmp 0x43bbdf
push 0x19ed
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x43c565
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x43c629
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43c5a6
push 1
push 0x4359
call fcn.0043c64d
pop ecx
pop ecx
jmp 0x43c627
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43c61f
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffea
jmp 0x43c5de
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffe7
jle 0x43c61d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43c61b
push 0x495a
push 1
push 0x6f58
push 1
push 1
push 0
push 0x3c67
push 0x3780
push 0x3b0c
call fcn.0042e0f9
add esp, 0x24
jmp 0x43c5d3
jmp 0x43c627
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x43c649
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
push eax
push 0
call fcn.0043c546
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x43caf8
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x43cbd3
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43cb39
push 0x2692
push 1
call fcn.0043cc64
pop ecx
pop ecx
jmp 0x43cbce
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43cbb8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43cbb6
push 0x50fb
push 0x2f45
push 0x1dd8
push 0x766a
push 0
push 1
push 0x39b7
push 0x78e5
push 0x6a22
push 0x1bf3
push 0x205
push 0x1dd9
push 1
push 0x4843
push 1
push 0x2adc
push 0x6bc0
call fcn.0043083c
add esp, 0x44
jmp 0x43cbce
mov byte [ebp - 1], 0
push 1
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.0042caa4
add esp, 0x10
jmp 0x43cc60
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x43cc27
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x43cc0f
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x43cc25
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x43cc25
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x43cc60
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x38]
push 0
push 0x7cb5
push 1
push 0x513f
push dword [ebp - 0x3c]
push 0x37ea
push 0x2595
push 1
push 0x2680
call fcn.00434ab2
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x469f31
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x477fb0
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48b484]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00467dd4
mov dword [ebp - 0x14], eax
cmp dword [0xa85170], esi
jne 0x4780a3
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x478030
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x478183
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x478183
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x478183
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xa85170], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xa85174], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xa85178], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xa85180], eax
test eax, eax
je 0x4780a0
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xa8517c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4780c8
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4780bb
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4780dd
push 4
pop eax
jmp 0x478185
cmp dword [ebp - 0x14], esi
je 0x4780dd
push dword [0xa85170]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4780c2
mov eax, dword [0xa8517c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x47813b
cmp dword [0xa85180], edi
je 0x47813b
push eax
call ebx
push dword [0xa85180]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x47813b
test eax, eax
je 0x47813b
call ecx
test eax, eax
je 0x478130
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x478130
test byte [ebp - 8], 1
jne 0x47813b
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x47816b
mov eax, dword [0xa85174]
cmp eax, edi
je 0x478168
push eax
call ebx
test eax, eax
je 0x478168
call eax
mov esi, eax
test esi, esi
je 0x478168
mov eax, dword [0xa85178]
cmp eax, edi
je 0x478168
push eax
call ebx
test eax, eax
je 0x478168
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xa85170]
call ebx
test eax, eax
je 0x478183
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x478185
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046727b
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x4013e0
Capabilities:
Connect pipe

Disassembly:
push esi
push edi
push ebx
sub esi, esi
call dword [sym.imp.kernel32.dll_ConnectNamedPipe]
or eax, eax
jne 0x40142a
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x217
je 0x40140a
cmp eax, 0x3e5
jne 0x40142a
pushfd
xor esi, esi
inc esi
popfd
jmp 0x401418
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.kernel32.dll_SetEvent]
or eax, eax
je 0x40142a
push ebx
push str.du6b4lrshe9sfpzixdtnsrc5
call fcn.0040100f
add esp, 8
push esi
pop eax
pop esi
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.00401f90
push eax
push str.4j3t6szdjkho35amqpd50wua91q9b
call fcn.0040100f
add esp, 0xc
sub eax, eax
pop esi
ret

Function at 0x401470
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push 0x40
push eax
pop esi
lea eax, [ebp - 0x50]
push 0
push eax
call sub.msvcr90.dll_memset
mov ecx, dword [ebp + 8]
mov ebx, dword [sym.imp.msvcr90.dll__wcsdup]
sub eax, eax
push ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x54], 0x44
call ebx
push esi
push eax
pop edi
call ebx
push esi
push eax
pop ebx
call fcn.00402110
push eax
pop esi
add esp, 0x18
or esi, esi
jne 0x4014d2
push str.e8f9jmhgitzkzbg77epij16loo6zyp9gw8cu6nqe
call fcn.0040100f
add esp, 4
jmp 0x401548
push edi
push ebx
push str.kzfd4nosihj0cs5obtk12a2xuqdx2ncgedt83e5r2bp15mqhsklx6wqn7lgvs1uvio
call fcn.0040100f
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
push eax
pop esi
or esi, esi
jne 0x40151f
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.00401f90
push eax
push str.j0ymu4q8cvapw3u40ok1gfqyxx
call fcn.0040100f
add esp, 0xc
jmp 0x401548
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov dword [edx], ecx
mov ecx, dword [0x407138]
push eax
push ecx
call fcn.00401014
mov edx, dword [ebp - 8]
push edx
push str.Created_process_with_ID__ld_n
call fcn.0040100f
add esp, 0x10
push ebx
mov ebx, dword [sym.imp.msvcr90.dll_free]
call ebx
push edi
call ebx
add esp, 8
pop edi
push esi
pop eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret