joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450d38
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x450d70]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x450d51
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x450d60
or bl, 4
test esi, 0x20000000
je 0x450d6b
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x457418
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45742a
add esp, 0xfffffff0
call fcn.004034dc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a8a4
mov eax, dword [0x478a70]
mov dword [eax + 4], ebx
mov dword [eax], 0x4577bc
mov eax, dword [0x478a80]
mov dword [eax + 4], ebx
mov dword [eax], 0x4577c8
mov eax, ebx
call fcn.004577d4
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4120d4]
call fcn.00403188
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4120d4]
call fcn.00403188
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4120d4]
call fcn.00403188
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4120d4]
call fcn.00403188
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4120d4]
call fcn.00403188
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x453bf0
push eax
push 0
push 0
mov eax, dword [0x478c74]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41c314]
call fcn.0041d9b0
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41c314]
call fcn.0041d9b0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41c314]
call fcn.0041d9b0
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00457bf4
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x457ad0
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x457ad0
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x457ad0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x457567
call fcn.00403534
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4578b4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x457a5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x457a40
mov dl, 1
mov eax, dword [0x4125a8]
call fcn.00403188
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403f8c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x457a2f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044589c
test al, al
je 0x457a22
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x457a70
lea eax, [ebp - 0x254]
call fcn.00408d50
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x457a22
xor eax, eax
push ebp
push 0x457a1b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x457aa8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x457a04
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004041fc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x457a04
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004041fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457a22
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x457925
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00416508
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457a66
lea eax, [ebp - 0x260]
call fcn.00403f8c
ret

Function at 0x458394
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x479bb4]
cmp byte [eax + 0xa5], 0
jne 0x458405
cmp dword [0x479bcc], 0
jne 0x4583c6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x458350
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x479bcc], eax
cmp dword [0x479bc8], 0
jne 0x4583e1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x479bc8], eax
cmp dword [0x479bd0], 0
jne 0x458405
push esp
push 0
push 0
push 0x4582f4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x479bd0], eax
pop edx
ret
Function at 0x4584fc
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x458513
add esp, 0xfffffff0
call fcn.004034dc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a8a4
mov eax, dword [0x478c54]
cmp word [eax + 2], 0
jne 0x45853b
mov eax, dword [0x478c54]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00459c64
mov eax, dword [0x478d60]
cmp word [eax + 2], 0
jne 0x458555
mov eax, dword [0x478d60]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00459e5c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4120d4]
call fcn.00403188
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4120d4]
call fcn.00403188
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41cd1c]
call fcn.00423f64
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x4586dc
mov eax, dword [0x478b0c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00424334
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45a3fc
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x478b0c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c52c
test eax, eax
je 0x45864a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408744
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c554
test eax, eax
je 0x45865e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004041fc
mov eax, dword [0x478948]
cmp byte [eax], 0
jne 0x458692
mov eax, ebx
call fcn.00458804
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045a5d8
mov eax, ebx
call fcn.0045af9c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4586d2
call fcn.00403534
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458a84
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x479bb4]
cmp dword [eax + 0x30], 0
je 0x458b2e
cmp dword [ebx + 0x94], 0
jne 0x458b28
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x458a14
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x458b28
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x458aee
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x458b28
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414574
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x458afd
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x459690
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4596c5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040407c
jmp 0x4596d2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403fe0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45a7b4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45a7f5
mov eax, esi
call fcn.00440e84
test al, al
je 0x45a7f5
mov eax, dword [ebx + 0x84]
call fcn.00440b80
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45a7f5
push 0
mov eax, dword [ebx + 0x84]
call fcn.00440b80
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45c1b8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45c418
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x45c21b
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0045be98
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040c0a4
cmp al, 1
jne 0x45c21b
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0045c160
test al, al
je 0x45c3a7
cmp dword [ebp - 8], 0
jge 0x45c239
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0045be98
mov eax, dword [ebp - 0x210]
call fcn.0040424c
cmp ebx, eax
jge 0x45c283
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0045be98
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x478f14]
and eax, 0xff
bt dword [edx], eax
jae 0x45c283
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x45c297
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0045c194
cmp ebx, dword [ebp - 8]
je 0x45c399
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x45c2c3
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004033b4
and eax, 0x7f
movzx eax, word [eax*2 + 0x477e30]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x45c386
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004033b4
and eax, 0x7f
movzx eax, word [eax*2 + 0x477e30]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00440b80
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004033b4
and eax, 0x7f
movzx eax, word [eax*2 + 0x477e30]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00440b80
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c38d
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x45c3fa
cmp dword [ebp - 8], 0
jge 0x45c3b2
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0045be98
mov eax, dword [ebp - 0x218]
call fcn.0040424c
cmp eax, dword [ebp - 8]
jg 0x45c3ec
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0045be98
mov eax, dword [ebp - 0x21c]
call fcn.0040424c
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0045c194
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c41f
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00403fb0
ret
Function at 0x40d553
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_TabbedTextOutA]
mov ecx, dword [ebp + 8]
movsx edx, ax
shr eax, 0x10
movsx eax, ax
mov dword [ecx + 4], eax
mov dword [ecx], edx
mov eax, ecx
pop ebp
ret 0x20

Function at 0x40eb95
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
lea edx, [ebp + 8]
push edx
push dword [ebp + 8]
call dword [eax + 0x70]
push dword [ebp + 8]
call fcn.0042a3e9
pop ebp
ret 4

Function at 0x417156
Capabilities:
Get system information on windows

Disassembly:
mov ecx, dword [esp + 8]
push edi
push ebx
push esi
mov dl, byte [ecx]
mov edi, dword [esp + 0x10]
test dl, dl
je 0x417190
mov dh, byte [ecx + 1]
test dh, dh
je 0x41717d
mov esi, edi
mov ecx, dword [esp + 0x14]
mov al, byte [edi]
add esi, 1
cmp al, dl
je 0x41714e
test al, al
je 0x417148
mov al, byte [esi]
add esi, 1
cmp al, dl
je 0x41714e
test al, al
jne 0x41713b
pop esi
pop ebx
pop edi
xor eax, eax
ret
mov al, byte [esi]
add esi, 1
cmp al, dh
jne 0x417140
lea edi, [esi - 1]
mov ah, byte [ecx + 2]
test ah, ah
je 0x417189
mov al, byte [esi]
add esi, 2
cmp al, ah
jne 0x417128
mov al, byte [ecx + 3]
test al, al
je 0x417189
mov ah, byte [esi - 1]
add ecx, 2
cmp al, ah
je 0x41715a
jmp 0x417128
xor eax, eax
pop esi
pop ebx
pop edi
mov al, dl
jmp 0x41c2b6
lea eax, [edi - 1]
pop esi
pop ebx
pop edi
ret
mov eax, edi
pop esi
pop ebx
pop edi
ret
lea eax, [edx - 1]
pop ebx
ret
push ebx
mov ebx, eax
shl eax, 8
mov edx, dword [esp + 8]
test edx, 3
je 0x41c2dd
mov cl, byte [edx]
add edx, 1
cmp cl, bl
je 0x41c2a0
test cl, cl
je 0x41c326
test edx, 3
jne 0x41c2c8
or ebx, eax
push edi
mov eax, ebx
shl ebx, 0x10
push esi
or ebx, eax
mov ecx, dword [edx]
mov edi, 0x7efefeff
mov eax, ecx
mov esi, edi
xor ecx, ebx
add esi, eax
add edi, ecx
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, edi
xor eax, esi
add edx, 4
and ecx, 0x81010100
jne 0x41c32a
and eax, 0x81010100
je 0x41c2e8
and eax, 0x1010100
jne 0x41c324
and esi, 0x80000000
jne 0x41c2e8
pop esi
pop edi
pop ebx
xor eax, eax
ret
mov eax, dword [edx - 4]
cmp al, bl
je 0x41c367
test al, al
je 0x41c324
cmp ah, bl
je 0x41c360
test ah, ah
je 0x41c324
shr eax, 0x10
cmp al, bl
je 0x41c359
test al, al
je 0x41c324
cmp ah, bl
je 0x41c352
test ah, ah
je 0x41c324
jmp 0x41c2e8
pop esi
pop edi
lea eax, [edx - 1]
pop ebx
ret
lea eax, [edx - 2]
pop esi
pop edi
pop ebx
ret
lea eax, [edx - 3]
pop esi
pop edi
pop ebx
ret
lea eax, [edx - 4]
pop esi
pop edi
pop ebx
ret
Function at 0x4186cb
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x518
mov eax, dword [0x447d10]
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
push eax
push dword [0x44d604]
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
cmp eax, 1
mov esi, 0x100
jne 0x4187ef
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, esi
jb 0x4186e4
mov al, byte [ebp - 0x12]
test al, al
mov byte [ebp - 0x118], 0x20
je 0x418734
push ebx
lea edx, [ebp - 0x11]
push edi
movzx ecx, byte [edx]
movzx eax, al
cmp eax, ecx
ja 0x41872a
sub ecx, eax
inc ecx
mov ebx, ecx
shr ecx, 2
lea edi, [ebp + eax - 0x118]
mov eax, 0x20202020
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
rep stosb byte es:[edi], al
inc edx
mov al, byte [edx]
inc edx
test al, al
jne 0x418703
pop edi
pop ebx
push 0
push dword [0x44d4e8]
lea eax, [ebp - 0x518]
push dword [0x44d604]
push eax
push esi
lea eax, [ebp - 0x118]
push eax
push 1
call fcn.0041f6a4
push 0
push dword [0x44d604]
lea eax, [ebp - 0x218]
push esi
push eax
push esi
lea eax, [ebp - 0x118]
push eax
push esi
push dword [0x44d4e8]
call fcn.0041f2e8
push 0
push dword [0x44d604]
lea eax, [ebp - 0x318]
push esi
push eax
push esi
lea eax, [ebp - 0x118]
push eax
push 0x200
push dword [0x44d4e8]
call fcn.0041f2e8
add esp, 0x5c
xor eax, eax
mov cx, word [ebp + eax*2 - 0x518]
test cl, 1
je 0x4187cc
or byte [eax + 0x44d501], 0x10
mov cl, byte [ebp + eax - 0x218]
mov byte [eax + 0x44d620], cl
jmp 0x4187e8
test cl, 2
je 0x4187e1
or byte [eax + 0x44d501], 0x20
mov cl, byte [ebp + eax - 0x318]
jmp 0x4187c4
mov byte [eax + 0x44d620], 0
inc eax
cmp eax, esi
jb 0x4187a9
jmp 0x418833
xor eax, eax
cmp eax, 0x41
jb 0x41880f
cmp eax, 0x5a
ja 0x41880f
or byte [eax + 0x44d501], 0x10
mov cl, al
add cl, 0x20
mov byte [eax + 0x44d620], cl
jmp 0x41882e
cmp eax, 0x61
jb 0x418827
cmp eax, 0x7a
ja 0x418827
or byte [eax + 0x44d501], 0x20
mov cl, al
sub cl, 0x20
jmp 0x418807
mov byte [eax + 0x44d620], 0
inc eax
cmp eax, esi
jb 0x4187f1
mov ecx, dword [ebp - 4]
pop esi
call fcn.004164ae
leave
ret
Function at 0x41b25e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push ecx
mov eax, dword [ebp + 0xc]
add eax, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebp
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0x10]
mov ebp, dword [ebp - 4]
call fcn.00416309
push esi
push edi
call eax
pop edi
pop esi
mov ebx, ebp
pop ebp
mov ecx, dword [ebp + 0x10]
push ebp
mov ebp, ebx
cmp ecx, 0x100
jne 0x41b26f
mov ecx, 2
push ecx
call fcn.00416309
pop ebp
pop ecx
pop ebx
leave
ret 0xc
Function at 0x41d862
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x48
push ebx
mov ebx, 0x480
push ebx
call fcn.004160d3
test eax, eax
pop ecx
jne 0x41d76f
or eax, 0xffffffff
jmp 0x41d94c
mov dword [0x44c3a0], eax
mov dword [0x44c390], 0x20
lea ecx, [eax + 0x480]
jmp 0x41d7a4
or dword [eax], 0xffffffff
and dword [eax + 8], 0
mov byte [eax + 4], 0
mov byte [eax + 5], 0xa
mov ecx, dword [0x44c3a0]
add eax, 0x24
add ecx, 0x480
cmp eax, ecx
jb 0x41d786
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp word [esp + 0x46], 0
je 0x41d8ab
mov eax, dword [esp + 0x48]
test eax, eax
je 0x41d8ab
mov edi, dword [eax]
lea ebp, [eax + 4]
lea eax, [edi + ebp]
mov dword [esp + 0x10], eax
mov eax, 0x800
cmp edi, eax
jl 0x41d7e5
mov edi, eax
cmp dword [0x44c390], edi
jge 0x41d83b
mov esi, 0x44c3a4
push ebx
call fcn.004160d3
test eax, eax
pop ecx
je 0x41d835
add dword [0x44c390], 0x20
mov dword [esi], eax
lea ecx, [eax + 0x480]
jmp 0x41d824
or dword [eax], 0xffffffff
and dword [eax + 8], 0
mov byte [eax + 4], 0
mov byte [eax + 5], 0xa
mov ecx, dword [esi]
add eax, 0x24
add ecx, ebx
cmp eax, ecx
jb 0x41d80e
add esi, 4
cmp dword [0x44c390], edi
jl 0x41d7f2
jmp 0x41d83b
mov edi, dword [0x44c390]
xor ebx, ebx
test edi, edi
jle 0x41d8ab
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x41d8a0
mov cl, byte [ebp]
test cl, 1
je 0x41d8a0
test cl, 8
jne 0x41d864
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x41d8a0
mov ecx, ebx
mov eax, ebx
and eax, 0x1f
lea eax, [eax + eax*8]
sar ecx, 5
mov ecx, dword [ecx*4 + 0x44c3a0]
lea esi, [ecx + eax*4]
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [esi], eax
mov al, byte [ebp]
mov byte [esi + 4], al
lea eax, [esi + 0xc]
push 0xfa0
push eax
call fcn.004204e0
test eax, eax
pop ecx
pop ecx
je 0x41d8cb
inc dword [esi + 8]
add dword [esp + 0x10], 4
inc ebx
inc ebp
cmp ebx, edi
jl 0x41d841
xor ebx, ebx
mov ecx, dword [0x44c3a0]
lea eax, [ebx + ebx*8]
lea esi, [ecx + eax*4]
cmp dword [esi], 0xffffffff
jne 0x41d92d
test ebx, ebx
mov byte [esi + 4], 0x81
jne 0x41d8d0
push 0xfffffffffffffff6
pop eax
jmp 0x41d8da
or eax, 0xffffffff
jmp 0x41d949
mov eax, ebx
dec eax
neg eax
sbb eax, eax
add eax, 0xfffffff5
push eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, 0xffffffff
je 0x41d927
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x41d927
and eax, 0xff
cmp eax, 2
mov dword [esi], edi
jne 0x41d905
or byte [esi + 4], 0x40
jmp 0x41d90e
cmp eax, 3
jne 0x41d90e
or byte [esi + 4], 8
lea eax, [esi + 0xc]
push 0xfa0
push eax
call fcn.004204e0
test eax, eax
pop ecx
pop ecx
je 0x41d8cb
inc dword [esi + 8]
jmp 0x41d931
or byte [esi + 4], 0x40
jmp 0x41d931
or byte [esi + 4], 0x80
inc ebx
cmp ebx, 3
jl 0x41d8ad
push dword [0x44c390]
call dword [sym.imp.KERNEL32.dll_SetHandleCount]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret
Function at 0x424cf9
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x424bd8
or eax, 0xffffffff
jmp 0x424c39
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x424c35
push 0x3d
push esi
call fcn.004183ec
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x424c35
cmp esi, eax
je 0x424c35
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x44bd54]
sete cl
cmp eax, dword [0x44bd58]
mov dword [ebp - 8], ecx
jne 0x424c1b
mov edi, eax
call fcn.00424b5e
mov dword [0x44bd54], eax
cmp eax, ebx
jne 0x424c74
cmp dword [ebp + 0xc], ebx
je 0x424c3d
cmp dword [0x44bd5c], ebx
je 0x424c3d
call fcn.004240eb
test eax, eax
je 0x424c74
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x424c46
xor eax, eax
jmp 0x424c38
push 4
call fcn.004160d3
cmp eax, ebx
pop ecx
mov dword [0x44bd54], eax
je 0x424c35
mov dword [eax], ebx
cmp dword [0x44bd5c], ebx
jne 0x424c74
push 4
call fcn.004160d3
cmp eax, ebx
pop ecx
mov dword [0x44bd5c], eax
je 0x424c35
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x44bd54]
call fcn.00424b11
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x424cd5
cmp dword [esi], ebx
je 0x424cd5
lea esi, [esi + edi*4]
push dword [esi]
call fcn.004160e5
cmp dword [ebp - 8], ebx
pop ecx
jne 0x424cb8
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x424d16
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x424caf
mov eax, edi
shl eax, 2
push eax
push dword [0x44bd54]
call fcn.00417e48
cmp eax, ebx
pop ecx
pop ecx
je 0x424d16
jmp 0x424d11
cmp dword [ebp - 8], ebx
jne 0x424d81
cmp edi, ebx
jge 0x424ce4
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x44bd54]
call fcn.00417e48
cmp eax, ebx
pop ecx
pop ecx
je 0x424c35
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x44bd54], eax
cmp dword [ebp + 0xc], ebx
je 0x424d6b
push dword [ebp - 4]
call fcn.00417d00
inc eax
inc eax
push eax
call fcn.004160d3
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x424d6b
push dword [ebp - 4]
push esi
call fcn.0041b280
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x424d64
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.004160e5
pop ecx
cmp dword [ebp - 8], ebx
je 0x424d79
push dword [ebp - 4]
call fcn.004160e5
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x424c38
push dword [ebp - 4]
call fcn.004160e5
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x424c42