joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440577
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x44ce48
cmp edx, dword [eax]
je 0x440599
add eax, 8
inc ecx
cmp eax, 0x44ced8
jl 0x44058a
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x44ce48]
jne 0x4406c7
mov eax, dword [0x458800]
cmp eax, 1
je 0x4406a1
test eax, eax
jne 0x4405ca
cmp dword [0x44c45c], 1
je 0x4406a1
cmp edx, 0xfc
je 0x4406c7
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x440601
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0043eec0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0043ee40
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x440644
lea eax, [ebp - 0x1a4]
push eax
call fcn.0043ee40
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x445904
push edi
call fcn.0043a1c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0043eec0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0043eed0
lea eax, [ebp - 0xa0]
push 0x4458e4
push eax
call fcn.0043eed0
push dword [esi + 0x44ce4c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0043eed0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00442318
add esp, 0x2c
pop edi
jmp 0x4406c7
lea eax, [ebp + 8]
lea esi, [esi + 0x44ce4c]
push 0
push eax
push dword [esi]
call fcn.0043ee40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x431030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x41988e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.004a2de0
mov dword [esp], 0xc8
mov dword [esp + 4], 0x96
push 0
call fcn.0048d5c8
mov ebx, eax
push 0
call fcn.0048d8df
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 8], ebx
push 0
call fcn.0048d637
mov ebx, eax
push 0
call fcn.0048d95c
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp + 4]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 0xc], ebx
push 0x80000004
push dword [0x1df6908]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x5d
call fcn.0048d013
push 0xb
push 0x64
call fcn.0049b598
push eax
push 0x1a
push 0xaa
push 0xf
push 0xf
push 0x60
call fcn.00487741
push 0xb
push 0x62
call fcn.0049b598
push eax
push 0x1a
push 0xaa
push 0x2d
push 0xf
push 0x5e
call fcn.00487741
push 0xb
push 0x63
call fcn.0049b598
push eax
push 0x1a
push 0xaa
push 0x4b
push 0xf
push 0x5f
call fcn.00487741
push dword [0x1df6a30]
push 0x14
push 0xaa
push 0x78
push 0xf
push 0x61
call fcn.004850bf
call fcn.00435f6c
call fcn.0048d00b
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x419a82
call fcn.004909a5
push eax
mov ebx, 0x5d
cmp ebx, dword [esp]
jne 0x419a7f
push dword [esp + 0x20]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x419a7e
call fcn.00490996
push eax
mov ebx, 0x60
cmp ebx, dword [esp]
jne 0x419a4c
mov eax, 0x52a6da
push eax
call fcn.00463b1b
add esp, 0xc
jmp 0x419ad9
mov ebx, 0x5e
cmp ebx, dword [esp]
jne 0x419a5d
add esp, 0xc
jmp 0x419ad9
mov ebx, 0x5f
cmp ebx, dword [esp]
jne 0x419a6e
add esp, 0xc
jmp 0x419ad9
mov ebx, 0x61
cmp ebx, dword [esp]
jne 0x419a7d
add esp, 0xc
jmp 0x419ad9
pop eax
pop eax
pop eax
jmp 0x419a8c
push 0x5d
call fcn.0048cfed
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x419ab0
call fcn.0048d96a
mov ebx, eax
cmp ebx, 0x5d
jne 0x419ab0
call fcn.00435f6c
jmp 0x419ad9
push 0xd
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x419ad4
call fcn.0048d96a
mov ebx, eax
cmp ebx, 0x5d
jne 0x419ad4
call fcn.00435f6c
jmp 0x419ad9
jmp 0x4199f9
push 0x5d
call fcn.0048cd9d
xor eax, eax
add esp, 0x10
pop edi
pop ebx
ret 4
Function at 0x433ac1
Capabilities:
Get geographical location

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.004a2de0
mov ebx, dword [0x1df6ac8]
and ebx, ebx
jle 0x433add
jmp 0x433d2b
mov dword [0x1df6ac8], 1
push edx
call fcn.004a2c10
pop edx
push eax
mov eax, 0x527f9e
push eax
mov eax, 0x529c0a
push eax
mov eax, 0x529ec8
push eax
call fcn.0044662c
lea eax, [esp + 4]
push eax
call fcn.004a2c50
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2c10
pop edx
push eax
push dword [esp + 8]
call fcn.004a0f10
call fcn.004a2d40
mov edx, 0x52835a
pop ecx
push ecx
call fcn.00448480
mov ecx, eax
call fcn.00448400
je 0x433bb4
push edx
call fcn.004a2c10
pop edx
push eax
push 3
mov edx, dword [0x1df6828]
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2ce0
mov edx, 0x5308e0
push edx
call fcn.004a2ce0
call fcn.004a2d40
mov eax, 0x52a910
push eax
mov edx, dword [0x1df6abc]
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2ce0
mov edx, 0x538e40
push edx
call fcn.004a2ce0
call fcn.00448452
add dword [esp], edx
call fcn.00448452
add dword [esp + 8], edx
call fcn.004635d4
call fcn.00448470
push edx
call fcn.004a2c10
pop edx
push eax
call fcn.004172b5
lea eax, [esp + 8]
push eax
call fcn.004a2c50
mov edx, dword [0x1df6830]
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2ce0
lea eax, [esp + 0xc]
push eax
call fcn.004a2c50
push dword [esp + 4]
call fcn.004184ae
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x433c03
jmp 0x433cde
push 0xdc
push 0x18c
push 0
push 0
call fcn.00425ac2
push 1
push 9
call fcn.00486c19
push 0x70
call fcn.0048cd9d
push 1
push 0
call fcn.0048cfdb
push edx
call fcn.004a2c10
pop edx
push eax
mov edx, dword [esp + 8]
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2ce0
mov edx, 0x528640
push edx
call fcn.004a2ce0
call fcn.00448452
add dword [esp], edx
call fcn.0048e854
call fcn.00448470
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x433c8f
jl 0x433c8b
cmp ebx, 0
ja 0x433c8f
xor eax, eax
jmp 0x433c94
mov eax, 1
or eax, eax
je 0x433cde
push edx
call fcn.004a2c10
pop edx
push eax
push 3
push dword [esp + 0xc]
mov eax, 0x53a4b2
push eax
mov edx, dword [esp + 0x14]
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2ce0
mov edx, 0x528640
push edx
call fcn.004a2ce0
call fcn.00448452
add dword [esp], edx
call fcn.004635d4
call fcn.00448470
mov edx, dword [esp + 8]
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2ce0
lea eax, [0x1df6830]
push eax
call fcn.004a2c50
push 0
push 9
call fcn.00486c19
push 0
push 0
call fcn.0048cfdb
call fcn.00441cc1
mov dword [0x1df6ac8], 0
xor eax, eax
push dword [esp + 4]
call fcn.004a2e40
push dword [esp + 8]
call fcn.004a2e40
push dword [esp]
call fcn.004a2e40
add esp, 0x10
pop edi
pop ebx
ret 4
Function at 0x4409ac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.004a2de0
mov dword [esp], 0
jmp 0x4409bf
mov eax, dword [esp + 0x10]
cmp eax, dword [esp]
jl 0x440a78
push 0
call fcn.0048cece
and eax, eax
je 0x440a6f
mov dword [esp + 4], 0xffffffff
call fcn.00446a82
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
and ebx, ebx
jle 0x440a3e
call fcn.004909a5
push eax
mov ebx, dword [0x1df6a4c]
cmp ebx, dword [esp]
jne 0x440a19
push dword [esp + 8]
call fcn.0043f523
mov ebx, eax
and ebx, ebx
jne 0x440a17
jmp 0x440a3b
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x440a31
push dword [esp + 8]
call fcn.0043406d
mov ebx, eax
and ebx, ebx
jne 0x440a2f
jmp 0x440a3b
push 3
call fcn.0048cd7c
pop eax
jmp 0x440a48
push 5
call fcn.0048cd7c
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x440a65
mov dword [0x1df6a04], 1
jmp 0x440a6f
mov dword [0x1df6a04], 0
inc dword [esp]
jno 0x4409bf
xor eax, eax
add esp, 8
pop ebx
ret 4
Function at 0x445e7f
Capabilities:
Query environment variable

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.004a2de0
push dword [esp + 0x1c]
call fcn.00448470
mov edx, dword [esp + 0x18]
lea ecx, [esp]
call fcn.00448000
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2c10
pop edx
push eax
push 0x3e8
call fcn.004a07f0
call fcn.004a2d40
lea eax, [esp + 8]
push eax
call fcn.004a2c50
push 0x3e8
mov eax, dword [esp + 8]
push eax
mov eax, 0x5334aa
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov edx, 0x5270ba
lea ecx, [esp + 8]
call fcn.00448008
push edx
call fcn.004a2c10
pop edx
push eax
push 0xe
mov edx, dword [esp + 0xc]
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2ce0
mov edx, 0x5308e0
push edx
call fcn.004a2ce0
call fcn.004a2d40
push edx
call fcn.004a2c10
pop edx
push eax
mov edx, 0x52c3b0
push edx
call fcn.004a2ce0
mov edx, dword [esp + 0x10]
push edx
call fcn.004a2ce0
call fcn.004a2d40
mov edx, dword [esp + 0x14]
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2ce0
mov edx, 0x52b0d0
push edx
call fcn.004a2ce0
call fcn.00448452
add dword [esp], edx
call fcn.00448452
add dword [esp + 4], edx
call fcn.00448452
add dword [esp + 8], edx
call fcn.004635d4
call fcn.00448470
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x44600d
push dword [esp + 0xc]
call fcn.00463cf9
and eax, eax
je 0x446004
push dword [esp + 0xc]
call fcn.00463d40
and eax, eax
je 0x446002
mov edx, dword [esp + 8]
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2ce0
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2c10
pop edx
push eax
push 0x18
push dword [esp + 0x20]
call fcn.00463d66
call fcn.00448452
add dword [esp], edx
call fcn.00427134
pop eax
mov edx, 0x537766
push edx
call fcn.004a2ce0
lea eax, [esp + 0xc]
push eax
call fcn.004a2c50
jmp 0x445f8d
push dword [esp + 0xc]
call fcn.00463d9d
mov edx, dword [esp + 8]
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2ce0
pop eax
push eax
call fcn.00448440
pop edx
add eax, edx
jmp 0x446035
push dword [esp]
call fcn.004a2e40
push dword [esp + 4]
call fcn.004a2e40
push dword [esp + 8]
call fcn.004a2e40
add esp, 0x10
pop ebx
ret 4
Function at 0x446b52
Capabilities:
Delete registry key

Disassembly:
push ebx
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x446b58
call fcn.004a2de0
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.00448000
mov edx, dword [esp + 0x28]
lea ecx, [esp + 4]
call fcn.00448000
push dword [esp]
call fcn.00446cd9
push dword [esp + 4]
mov edx, 0x527f9e
pop ecx
call fcn.00448400
je 0x446c27
cmp dword [0x1df6b28], 0
je 0x446c0d
mov eax, 0x5278fc
push eax
push 0xffffffff
call fcn.00484576
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x446c0b
mov eax, 0x53333e
push eax
push dword [esp + 0xc]
call fcn.004845d0
mov dword [esp + 0xc], eax
push 0
mov ebx, dword [0x1df6b2c]
or ebx, 0xf003f
push ebx
mov eax, dword [0x1df6b1c]
push eax
push dword [0x1df6b24]
push dword [esp + 0x1c]
call fcn.0048462c
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.004844b6
jmp 0x446c22
mov eax, dword [0x1df6b1c]
push eax
push dword [0x1df6b24]
call sub.ADVAPI32.dll_RegDeleteKeyW
mov dword [esp + 0x10], eax
jmp 0x446cb0
lea eax, [esp + 0x18]
push eax
push dword [0x1df6b24]
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x1df6b28], 0
je 0x446c9d
mov eax, 0x5278fc
push eax
push 0xffffffff
call fcn.00484576
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x446c9b
push 0
mov ebx, dword [0x1df6b2c]
or ebx, 0xf003f
push ebx
mov eax, dword [0x1df6b1c]
push eax
push dword [esp + 0x24]
mov eax, 0x53333e
push eax
push dword [esp + 0x1c]
call fcn.00484689
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.004844b6
jmp 0x446cb0
mov eax, dword [0x1df6b1c]
push eax
push dword [esp + 0x1c]
call sub.ADVAPI32.dll_RegDeleteKeyW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x446cbf
mov eax, 1
jmp 0x446cc1
xor eax, eax
push dword [esp + 4]
call fcn.004a2e40
push dword [esp]
call fcn.004a2e40
add esp, 0x1c
pop ebx
ret 8
Function at 0x446edb
Capabilities:
Get graphical window text

Disassembly:
push ebx
xor eax, eax
push eax
call fcn.004a2de0
push dword [esp + 0xc]
call fcn.00448470
mov ebx, dword [0x1df6b64]
and ebx, ebx
jne 0x446f17
push 0
push 0
call sub.USER32.dll_FindWindowW
mov dword [0x1df6b68], eax
mov dword [0x1df6b64], 1
jmp 0x446f2c
push 2
push dword [0x1df6b68]
call sub.USER32.dll_GetWindow
mov dword [0x1df6b68], eax
mov ebx, dword [0x1df6b68]
and ebx, ebx
je 0x446fc6
push 0xfffffff0
push dword [0x1df6b68]
call sub.USER32.dll_GetWindowLongW
mov ebx, eax
and ebx, 0x10000000
cmp ebx, 0x10000000
jne 0x446fc4
push 0xffffffec
push dword [0x1df6b68]
call sub.USER32.dll_GetWindowLongW
mov ebx, eax
and ebx, 0x80
cmp ebx, 0x80
je 0x446fc4
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2c10
pop edx
push eax
push 0x100
call fcn.004a07f0
lea eax, [esp + 4]
push eax
call fcn.004a2c50
push 0x100
push dword [esp + 4]
push dword [0x1df6b68]
call sub.USER32.dll_GetWindowTextW
push dword [esp]
mov edx, 0x5270ba
pop ecx
call fcn.00448400
jne 0x446fc4
jmp 0x446fde
jmp 0x446fd0
mov dword [0x1df6b64], 0
mov ebx, dword [0x1df6b68]
and ebx, ebx
jne 0x446eed
mov edx, dword [esp]
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2ce0
pop eax
push eax
call fcn.00448440
pop edx
add eax, edx
jmp 0x447005
push dword [esp]
call fcn.004a2e40
add esp, 4
pop ebx
ret

Function at 0x447012
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
mov edx, 0x19
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x447019
call fcn.004a2de0
mov edx, dword [esp + 0x70]
lea ecx, [esp]
call fcn.00448000
lea eax, [esp + 4]
lea eax, [esp + 0x48]
lea ebp, [esp + 4]
mov dword [ebp], 0x44
mov dword [ebp + 0x2c], 1
mov ebx, dword [esp + 0x74]
and ebx, 2
and ebx, ebx
je 0x447068
lea ebp, [esp + 4]
mov word [ebp + 0x30], 0
jmp 0x447072
lea ebp, [esp + 4]
mov word [ebp + 0x30], 1
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
push 0
call sub.KERNEL32.dll_CreateProcessW
mov dword [esp + 0x58], eax
cmp dword [esp + 0x58], 0
je 0x4470fb
mov ebx, dword [esp + 0x74]
and ebx, 1
and ebx, ebx
je 0x4470f2
lea ebp, [esp + 0x48]
push dword [ebp + 4]
pop eax
mov dword [esp + 0x5c], eax
push 1
call fcn.0048cd7c
lea eax, [esp + 0x60]
push eax
push dword [esp + 0x60]
call sub.KERNEL32.dll_GetExitCodeThread
mov ebx, dword [esp + 0x60]
cmp ebx, 0x103
je 0x4470f0
jmp 0x4470f2
jmp 0x4470ca
lea ebp, [esp + 0x48]
mov eax, dword [ebp]
jmp 0x4470fd
xor eax, eax
push dword [esp]
call fcn.004a2e40
add esp, 0x64
pop ebx
pop ebp
ret 8
Function at 0x447126
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
push ebx
mov edx, 0xd
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x44712d
call fcn.004a2de0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.dll_OpenProcessToken
and eax, eax
je 0x4471e7
lea eax, [esp + 8]
lea eax, [esp + 8]
push eax
mov eax, 0x52cebc
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueW
and eax, eax
je 0x4471de
lea eax, [esp + 0x10]
lea ebp, [esp + 0x10]
mov dword [ebp], 1
lea ebp, [esp + 8]
push dword [ebp]
lea ebp, [esp + 0x14]
push ebp
pop ebp
pop eax
mov dword [ebp + 4], eax
lea ebp, [esp + 8]
push dword [ebp + 4]
lea ebp, [esp + 0x14]
push ebp
pop ebp
pop eax
mov dword [ebp + 8], eax
push ebp
pop ebp
mov dword [ebp + 0xc], 2
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x24]
push eax
push 0x10
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x18]
call sub.ADVAPI32.dll_AdjustTokenPrivileges
push eax
pop eax
mov byte [esp], al
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
movsx eax, byte [esp]
movsx eax, al
jmp 0x4471f2
add esp, 0x34
pop ebx
pop ebp
ret

Function at 0x448da8
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x448e40
push edi
push 0x1e70154
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x1df6c48]
test edi, edi
je 0x448e14
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x448e0d
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x1df6c48
call fcn.004a2b33
pop ecx
pop ecx
jmp 0x448e0f
mov edi, dword [edi]
test edi, edi
jne 0x448de4
pop ebx
mov eax, dword [0x1df2d7c]
mov esi, eax
inc eax
push 0x10
push 0x1df6c48
mov dword [0x1df2d7c], eax
call fcn.004a2b73
pop ecx
pop ecx
push 0x1e70154
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x448e48
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push edi
call fcn.00448c4c
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, 0x1e70154
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x1df6c48]
jmp 0x448e79
cmp dword [esi + 0xc], edi
je 0x448e7f
mov esi, dword [esi]
test esi, esi
jne 0x448e72
jmp 0x448e97
add esi, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x1df6c48
call fcn.004a2b33
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret 4
Function at 0x449197
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x4491ec
push dword [esp + 0x10]
push 0x449116
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x1df6c54]
test esi, esi
je 0x449245
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x4491e4
cmp byte [esi + 0x10], 0
je 0x4491e4
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x4491c0
jmp 0x449245
mov esi, dword [0x1df6c54]
test esi, esi
je 0x449245
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x44923e
cmp byte [esi + 0x11], 0
je 0x44921a
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x449231
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x1df6c54
call fcn.004a2b33
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x4491f9
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x463b73
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x1e70184]
call fcn.004a21f6
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x463c73
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x463bc9
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x463bc1
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x463c09
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x463c4b
push 0x22
pop edx
cmp cx, dx
je 0x463bfb
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x463beb
xor ecx, ecx
cmp word [eax], cx
je 0x463c4b
mov ecx, eax
add eax, 2
jmp 0x463c4d
test dx, dx
je 0x463c53
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x463bfb
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x463c41
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x463c4b
cmp cx, dx
je 0x463c3e
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x463c2e
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x463c13
jmp 0x463bfb
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x463c55
xor edx, edx
cmp dword [ebp], ebx
jne 0x463c5e
test edi, edi
jne 0x463c7b
test edx, edx
je 0x463c63
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x463bb7
test edi, edi
jne 0x463c8c
mov eax, ebx
jmp 0x463c90
test esi, esi
je 0x463c8c
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x463c90
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x463df3
Capabilities:
Read file on windows

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0x10], esi
jle 0x463e47
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push 0
push eax
mov eax, dword [esp + 0x20]
sub eax, esi
push eax
lea eax, [esi + ebp]
push eax
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x463e35
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x463e41
add esi, dword [esp + 0x10]
cmp esi, dword [esp + 0x18]
jl 0x463e06
jmp 0x463e45
add esi, dword [esp + 0x10]
pop ebp
pop ebx
mov eax, esi
pop esi
ret 0xc
Function at 0x463e4d
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebx, eax
cmp dword [esp + 0x24], 0x18
je 0x463efc
cmp dword [esp + 0x24], 2
je 0x463efc
push 0x2000
push edi
push dword [0x1df67e0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
jmp 0x463ecf
cmp dword [esp + 0x18], 2
jne 0x463ee7
test ebx, ebx
jne 0x463eb8
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0x1df67e0]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x463ee7
cmp ax, 0xd
je 0x463ecf
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call ebp
test eax, eax
jne 0x463e8f
push dword [esp + 0x28]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.004ec310
jmp 0x463f82
push eax
push 0
push dword [0x1df67e0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
jmp 0x463f4e
cmp dword [esp + 0x18], 1
jne 0x463f66
test ebx, ebx
jne 0x463f3d
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0x1df67e0]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x463f66
cmp al, 0xd
je 0x463f4e
mov byte [esi + edi], al
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call ebp
test eax, eax
jne 0x463f15
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x28]
mov byte [esi + edi], 0
push esi
jne 0x463f7d
call fcn.004ec360
jmp 0x463f82
call fcn.004ec2b0
push esi
push 0
push dword [0x1df67e0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc

Function at 0x4643ef
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
test esi, esi
je 0x464451
cmp word [esi], di
je 0x464451
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.004b4040
push dword [esp + 0x1c]
mov ebx, eax
push ebx
call dword [esp + 0x20]
push esi
push ebx
call fcn.004b42f0
add esp, 0x10
test eax, eax
jne 0x464450
push 0x24
push 8
push dword [0x1df67e0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword [esp + 0x10]
mov dword [ecx + 0x14], edi
mov edi, ecx
mov dword [ecx], ebx
mov dword [ecx + 8], 1
mov dword [ecx + 0x20], eax
mov dword [eax + 4], ecx
pop ebx
mov eax, edi
pop edi
pop esi
ret 0x10