joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov byte [ebp - 0x30], 0x4c
mov byte [ebp - 0x2f], 0x61
mov byte [ebp - 0x2e], 0x67
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x76
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0x77
mov byte [ebp - 0x27], 0x61
mov byte [ebp - 0x26], 0x6c
mov byte [ebp - 0x25], 0x74
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0
mov byte [ebp - 0x20], 0x44
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x70
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x1c], 0x63
mov byte [ebp - 0x1b], 0x75
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x64], 0x41
mov byte [ebp - 0x63], 0x6d
mov byte [ebp - 0x62], 0x6d
mov byte [ebp - 0x61], 0x69
mov byte [ebp - 0x60], 0x6e
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x20
mov byte [ebp - 0x5d], 0x4d
mov byte [ebp - 0x5c], 0x61
mov byte [ebp - 0x5b], 0x67
mov byte [ebp - 0x5a], 0x61
mov byte [ebp - 0x59], 0x7a
mov byte [ebp - 0x58], 0x7a
mov byte [ebp - 0x57], 0x69
mov byte [ebp - 0x56], 0x6e
mov byte [ebp - 0x55], 0x69
mov byte [ebp - 0x54], 0
mov byte [ebp - 0x3c], 0x4d
mov byte [ebp - 0x3b], 0x61
mov byte [ebp - 0x3a], 0x67
mov byte [ebp - 0x39], 0x61
mov byte [ebp - 0x38], 0x73
mov byte [ebp - 0x37], 0x69
mov byte [ebp - 0x36], 0x6e
mov byte [ebp - 0x35], 0x69
mov byte [ebp - 0x34], 0x65
mov byte [ebp - 0x33], 0x72
mov byte [ebp - 0x32], 0
mov byte [ebp - 0x18], 0x45
mov byte [ebp - 0x17], 0x6e
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x67
mov byte [ebp - 0x12], 0x61
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0xb], 0x20
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0x61
mov byte [ebp - 6], 0x63
mov byte [ebp - 5], 0xe9
mov byte [ebp - 4], 0x6e
mov byte [ebp - 3], 0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x4c], ecx
lea edx, [ebp - 0x64]
mov dword [ebp - 0x48], edx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x68], 0
jmp 0x436696
mov edx, dword [ebp - 0x68]
add edx, 1
mov dword [ebp - 0x68], edx
cmp dword [ebp - 0x68], 5
jae 0x4366bc
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp + eax*4 - 0x50]
push ecx
call fcn.0042bf10
add esp, 4
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x4366ba
mov eax, dword [ebp - 0x6c]
jmp 0x4366be
jmp 0x43668d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4366d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov byte [ebp - 0x114], 0x2f
mov byte [ebp - 0x113], 0x73
mov byte [ebp - 0x112], 0x61
mov byte [ebp - 0x111], 0x66
mov byte [ebp - 0x110], 0x65
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6f
mov byte [ebp - 0x10d], 0x78
mov byte [ebp - 0x10c], 0x5f
mov byte [ebp - 0x10b], 0x70
mov byte [ebp - 0x10a], 0x61
mov byte [ebp - 0x109], 0x73
mov byte [ebp - 0x108], 0x73
mov byte [ebp - 0x107], 0x77
mov byte [ebp - 0x106], 0x6f
mov byte [ebp - 0x105], 0x72
mov byte [ebp - 0x104], 0x64
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0
mov byte [ebp - 0x100], 3
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x17
mov word [ebp - 0xff], ax
mov byte [ebp - 0xfd], 0
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0xfc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xfc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
movzx edx, word [ebp - 0xff]
push edx
lea eax, [ebp - 0x100]
push eax
call fcn.00433540
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x4367f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 3
mov byte [ebp - 0x13], 0x13
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0x2f
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x78
mov byte [ebp - 8], 0x5f
mov byte [ebp - 7], 0x63
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x6f
mov byte [ebp - 4], 0x73
mov byte [ebp - 3], 0x65
mov byte [ebp - 2], 0
push 0x13
lea eax, [ebp - 0x14]
push eax
call fcn.00433540
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x437040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x71
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0x6b
mov byte [ebp - 0xb], 0x5f
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x74
mov byte [ebp - 6], 0x5f
mov byte [ebp - 5], 0x31
mov byte [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0
call fcn.00437090
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x437140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov byte [ebp - 0x10], 0x71
mov byte [ebp - 0xf], 0x75
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 0xc], 0x6b
mov byte [ebp - 0xb], 0x5f
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x74
mov byte [ebp - 6], 0x5f
mov byte [ebp - 5], 0x32
mov byte [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0
call fcn.00437090
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x438a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 3
mov byte [ebp - 0x13], 0x12
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0x2f
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x5f
mov byte [ebp - 7], 0x68
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x72
mov byte [ebp - 4], 0x65
mov byte [ebp - 3], 0
push 0x12
lea eax, [ebp - 0x14]
push eax
call fcn.00433540
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x438ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0x14], 3
mov byte [ebp - 0x13], 0x12
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0x2f
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x74
mov byte [ebp - 8], 0x5f
mov byte [ebp - 7], 0x74
mov byte [ebp - 6], 0x6f
mov byte [ebp - 5], 0x77
mov byte [ebp - 4], 0x6e
mov byte [ebp - 3], 0
push 0x12
lea eax, [ebp - 0x14]
push eax
call fcn.00433540
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x439000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x76
mov byte [ebp - 8], 0x65
mov byte [ebp - 7], 0x72
mov byte [ebp - 6], 0x4c
mov byte [ebp - 5], 0x69
mov byte [ebp - 4], 0x73
mov byte [ebp - 3], 0x74
mov byte [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
call fcn.00437090
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x439180
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x12345678
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4391d2
push 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
shl eax, 0x10
or eax, 1
push eax
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
push edx
push 0x102
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x596ac]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x43918b
mov esp, ebp
pop ebp
ret
Function at 0x439300
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0xc], 0x12345678
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
xor ecx, ecx
test eax, eax
setl cl
mov dword [ebp - 0x24], ecx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
xor eax, eax
test edx, edx
setl al
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0xc]
and ecx, 0x20000000
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp + 0xc]
and edx, 0x80000000
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x1c], edx
jne 0x439378
cmp dword [ebp - 0x24], 0
jne 0x439378
cmp dword [ebp - 0x18], 0
jne 0x439378
cmp dword [ebp - 0x28], 0
jne 0x439378
mov dword [ebp - 0x2c], 1
jmp 0x43937f
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x1c], 0
jne 0x4393a6
cmp dword [ebp - 0x24], 0
jne 0x4393a6
cmp dword [ebp - 0x18], 0
jne 0x4393a6
cmp dword [ebp - 0x28], 0
je 0x4393a6
mov dword [ebp - 0x30], 1
jmp 0x4393ad
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 8], ecx
cmp dword [ebp - 0x1c], 0
jne 0x4393d4
cmp dword [ebp - 0x24], 0
je 0x4393d4
cmp dword [ebp - 0x18], 0
jne 0x4393d4
cmp dword [ebp - 0x28], 0
je 0x4393d4
mov dword [ebp - 0x34], 1
jmp 0x4393db
mov dword [ebp - 0x34], 0
mov edx, dword [ebp - 0x34]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0xc]
and eax, 0x40000000
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x1599c4], 0
je 0x439433
cmp dword [ebp - 0x10], 0x24
jne 0x43941c
cmp dword [ebp - 0x14], 0
je 0x43941a
cmp dword [ebp - 0x20], 0
je 0x43941a
call fcn.004394b0
jmp 0x439433
cmp dword [ebp - 0x10], 0x4b
jne 0x439433
cmp dword [ebp - 8], 0
je 0x439433
cmp dword [ebp - 0x20], 0
je 0x439433
call fcn.00439460
cmp dword [ebp - 0x10], 0x2d
jne 0x43944a
cmp dword [ebp - 4], 0
je 0x43944a
cmp dword [ebp - 0x20], 0
je 0x43944a
call fcn.00439ba0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x439510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ec
push esi
push edi
mov dword [ebp - 8], 0x12345678
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 8]
add esi, 0x28354
mov ecx, 0xa0d5
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x188]
push eax
call fcn.004397a0
add esp, 4
lea ecx, [ebp - 0x158]
push ecx
call fcn.00439820
add esp, 4
lea edx, [ebp - 0x128]
push edx
call fcn.004398a0
add esp, 4
lea eax, [ebp - 0xf8]
push eax
call fcn.00439920
add esp, 4
lea ecx, [ebp - 0xc8]
push ecx
call fcn.004399a0
add esp, 4
lea edx, [ebp - 0x98]
push edx
call fcn.00439a20
add esp, 4
lea eax, [ebp - 0x68]
push eax
call fcn.00439aa0
add esp, 4
lea ecx, [ebp - 0x38]
push ecx
call fcn.00439b20
add esp, 4
mov dword [ebp - 0x1ec], 0x34
mov dword [ebp - 0x1e8], 0x588
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1e4], edx
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x1dc], 0
mov byte [ebp - 0x1b8], 0x43
mov byte [ebp - 0x1b7], 0x6f
mov byte [ebp - 0x1b6], 0x6e
mov byte [ebp - 0x1b5], 0x66
mov byte [ebp - 0x1b4], 0x69
mov byte [ebp - 0x1b3], 0x67
mov byte [ebp - 0x1b2], 0x75
mov byte [ebp - 0x1b1], 0x72
mov byte [ebp - 0x1b0], 0x61
mov byte [ebp - 0x1af], 0x74
mov byte [ebp - 0x1ae], 0x69
mov byte [ebp - 0x1ad], 0x6f
mov byte [ebp - 0x1ac], 0x6e
mov byte [ebp - 0x1ab], 0
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1d4], 8
mov dword [ebp - 0x1d0], 0
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x1cc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x15fd68]
mov dword [ebp - 0x1c8], eax
mov byte [ebp - 0x1a8], 0x43
mov byte [ebp - 0x1a7], 0x4f
mov byte [ebp - 0x1a6], 0x4d
mov byte [ebp - 0x1a5], 0x43
mov byte [ebp - 0x1a4], 0x54
mov byte [ebp - 0x1a3], 0x4c
mov byte [ebp - 0x1a2], 0x33
mov byte [ebp - 0x1a1], 0x32
mov byte [ebp - 0x1a0], 0x2e
mov byte [ebp - 0x19f], 0x44
mov byte [ebp - 0x19e], 0x4c
mov byte [ebp - 0x19d], 0x4c
mov byte [ebp - 0x19c], 0
mov byte [ebp - 0x198], 0x50
mov byte [ebp - 0x197], 0x72
mov byte [ebp - 0x196], 0x6f
mov byte [ebp - 0x195], 0x70
mov byte [ebp - 0x194], 0x65
mov byte [ebp - 0x193], 0x72
mov byte [ebp - 0x192], 0x74
mov byte [ebp - 0x191], 0x79
mov byte [ebp - 0x190], 0x53
mov byte [ebp - 0x18f], 0x68
mov byte [ebp - 0x18e], 0x65
mov byte [ebp - 0x18d], 0x65
mov byte [ebp - 0x18c], 0x74
mov byte [ebp - 0x18b], 0x41
mov byte [ebp - 0x18a], 0
lea ecx, [ebp - 0x198]
push ecx
lea edx, [ebp - 0x1a8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1ec]
push eax
call dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x596b0], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x15fd6c]
push eax
push 0xfffffffffffffffc
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x596b0]
push edx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x1599c8], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43a070
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x6e
mov byte [ebp - 8], 0x6e
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0x4c
mov byte [ebp - 4], 0x69
mov byte [ebp - 3], 0x73
mov byte [ebp - 2], 0x74
mov byte [ebp - 1], 0
lea eax, [ebp - 0xc]
push eax
push 0
call fcn.00437090
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x43a3c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x14], eax
push 0xa
push 0x13ba
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
add eax, 0x2dc
push eax
call fcn.00428e80
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x43b9f0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
or al, al
je 0x43ba0a
mov byte [ebp - 1], 1
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x43de60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov dword [ebp - 0x104], ecx
push 0x4db0a0
push str._sChargeTool.exe
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
call fcn.0043e840
add esp, 0x10
push 5
push 0
push 0
lea ecx, [ebp - 0x100]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x43eb10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0
je 0x43eb2a
mov eax, dword [ebp - 0x40]
sub eax, 0x20
mov dword [ebp - 0x44], eax
jmp 0x43eb31
mov dword [ebp - 0x44], 0
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 1
cmp dword [ebp + 0x14], 0
je 0x43ebbd
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.0040abb0
mov ecx, eax
call fcn.0040bbe0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0xffffffff
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.0043ec90
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43ebac
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.0043e6d0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jge 0x43ebbb
mov dword [ebp - 4], 0
jmp 0x43ebd8
mov ecx, dword [ebp + 0xc]
call fcn.0040bbe0
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.0043ec60
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43ebf3
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.0043ecd0
jmp 0x43ec56
cmp dword [ebp + 0x14], 0
je 0x43ec56
cmp dword [ebp + 0x18], 0
je 0x43ec56
mov ecx, dword [ebp + 0xc]
call fcn.0043e790
cmp eax, dword [ebp + 0x1c]
jle 0x43ec56
mov dword [ebp - 0x38], 1
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
call fcn.0043e790
mov dword [ebp - 0x30], eax
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.0043ed30
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x18
Function at 0x44b340
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x4dbaac]
push ecx
push str._s:__s_n
push 0x4716c8
call fcn.0045042e
add esp, 0x10
push 1
call fcn.0045189a
pop ebp
ret

Function at 0x44b370
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x400c
call fcn.0044f600
mov eax, dword [ebp + 8]
push eax
push 0x4000
push 1
lea ecx, [ebp - 0x4008]
push ecx
call fcn.00450ea9
add esp, 0x10
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
and eax, 0x20
je 0x44b3b9
push str.fread
call fcn.00451a3b
add esp, 4
push 1
call fcn.0045189a
cmp dword [ebp - 4], 0
jne 0x44b3c1
jmp 0x44b3fb
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x4008]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00445bc0
add esp, 0xc
cmp eax, dword [ebp - 4]
je 0x44b3f9
lea ecx, [ebp - 0x400c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004464b0
add esp, 8
push eax
call fcn.0044b340
add esp, 4
jmp 0x44b37d
mov eax, dword [ebp + 8]
push eax
call fcn.0045027d
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004463e0
add esp, 4
test eax, eax
je 0x44b424
push 0x471334
call fcn.0044b340
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x44b4f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x400]
push ecx
call fcn.0044f500
add esp, 8
push 0x471374
lea edx, [ebp - 0x400]
push edx
call fcn.0044f510
add esp, 8
push 0x471378
mov eax, dword [ebp + 8]
push eax
call fcn.0045037a
add esp, 8
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0
jne 0x44b553
mov ecx, dword [ebp + 8]
push ecx
call fcn.00451a3b
add esp, 4
push 1
call fcn.0045189a
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x400]
push eax
call fcn.00444d80
add esp, 8
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0
jne 0x44b59c
lea ecx, [ebp - 0x400]
push ecx
mov edx, dword [0x4dbaac]
push edx
push 0x47137c
push 0x4716c8
call fcn.0045042e
add esp, 0x10
push 1
call fcn.0045189a
mov eax, dword [ebp - 0x408]
push eax
mov ecx, dword [ebp - 0x404]
push ecx
call fcn.0044b370
add esp, 8
mov edx, dword [ebp + 8]
push edx
call fcn.0045f4e2
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x44b5d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [ebp + 8]
push eax
call fcn.0044f330
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x410]
push edx
call fcn.0044f500
add esp, 8
cmp dword [ebp - 0xc], 3
jbe 0x44b63b
push 0x471394
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax - 3]
push edx
call fcn.0044f3c0
add esp, 8
test eax, eax
jne 0x44b63b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x414], eax
lea ecx, [ebp - 0x410]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
mov byte [edx - 3], 0
jmp 0x44b661
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x410]
mov dword [ebp - 0x414], ecx
push 0x471398
mov edx, dword [ebp - 0x414]
push edx
call fcn.0044f510
add esp, 8
push 0x47139c
mov eax, dword [ebp - 0x414]
push eax
call fcn.00444d80
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44b6a5
mov ecx, dword [ebp - 0x414]
push ecx
mov edx, dword [0x4dbaac]
push edx
push str._s:_cant_gzopen__s_n
push 0x4716c8
call fcn.0045042e
add esp, 0x10
push 1
call fcn.0045189a
push 0x4713b8
mov eax, dword [ebp - 4]
push eax
call fcn.0045037a
add esp, 8
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
jne 0x44b6d8
mov ecx, dword [ebp + 8]
push ecx
call fcn.00451a3b
add esp, 4
push 1
call fcn.0045189a
mov edx, dword [ebp - 0x418]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.0044b430
add esp, 8
mov ecx, dword [ebp - 0x414]
push ecx
call fcn.0045f4e2
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x44fb9d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0044f600
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x44fc38
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4db5b4]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x44fc38
cmp eax, 1
je 0x44fc59
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x44fc38
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x44fc05
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x44fc34
xor eax, eax
inc eax
jmp 0x44fc78
cmp edi, eax
jae 0x44fc3c
xor eax, eax
jmp 0x44fc78
cmp eax, esi
jae 0x44fc43
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4db5b4]
jmp 0x44fc5c
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4517d7
Capabilities:
Terminate process

Disassembly:
push 8
push 0x465e38
call fcn.00451d48
push 8
call fcn.00452888
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x4db5f4], esi
jne 0x45180b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4db5f0], esi
mov al, byte [ebp + 0x10]
mov byte [0x4db5ec], al
cmp dword [ebp + 0xc], edi
jne 0x451855
cmp dword [0x4dce4c], edi
je 0x451845
mov eax, dword [0x4dce48]
sub eax, 4
mov dword [0x4dce48], eax
cmp eax, dword [0x4dce4c]
jb 0x451845
mov eax, dword [eax]
cmp eax, edi
je 0x451826
call eax
jmp 0x451826
push 0x46a044
mov eax, 0x46a03c
call fcn.00451755
pop ecx
push 0x46a050
mov eax, 0x46a048
call fcn.00451755
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x451886
cmp dword [ebp + 0x10], edi
jne 0x451894
mov dword [0x4db5f4], esi
push dword [ebp + 8]
call fcn.00451713
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x451893
push 8
call fcn.004527d3
pop ecx
ret
call fcn.00451d83
ret