joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4381e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x438365
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
xor edx, edx
call fcn.00406ddc
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x438339
lea eax, [ebp - 8]
push eax
push esi
push 0xffffffffffffffff
call sub.shell32.dll_SHGetSpecialFolderLocation_1
test eax, eax
jne 0x438339
cmp dword [0x738ce0], 0
jne 0x438262
push 0x438374
push 0x4383a0
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.0040a3ec
mov dword [0x738ce0], eax
cmp dword [0x738ce0], 0
je 0x438294
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x738ce0]
test eax, eax
je 0x438294
mov eax, edi
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.00406fdc
jmp 0x4382cb
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4382cb
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x212]
mov ecx, 0
call fcn.00406060
mov edx, dword [ebp - 0x218]
mov eax, edi
call fcn.00406ff8
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
cmp dword [edi], 0
jne 0x4382f7
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.00435b68
mov eax, dword [ebp - 0x21c]
mov edx, edi
call fcn.0040fa6c
cmp dword [edi], 0
je 0x438339
mov eax, dword [edi]
call fcn.0040708c
mov edx, dword [edi]
cmp word [edx + eax*2 - 2], 0x5c
sete al
cmp bl, al
je 0x438339
test bl, bl
je 0x438324
mov eax, edi
mov edx, 0x4383c4
call fcn.00407130
jmp 0x438339
mov eax, dword [edi]
call fcn.0040708c
mov edx, eax
mov eax, edi
mov ecx, 1
call fcn.00407500
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43836c
lea eax, [ebp - 0x21c]
call fcn.00406dcc
lea eax, [ebp - 0x218]
call fcn.00405dac
lea eax, [ebp - 4]
call fcn.00409124
ret
Function at 0x438e10
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406dc4
xor eax, eax
push ebp
push 0x438ec6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x438e44
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x438eb0
lea eax, [ebp - 4]
call fcn.00405f8c
call fcn.0040708c
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
je 0x438eab
lea eax, [ebp - 4]
call fcn.00405f8c
call fcn.0040708c
add eax, eax
add eax, 2
push eax
mov eax, dword [ebp - 4]
call fcn.00406e68
mov edx, esi
pop ecx
call fcn.0040343c
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 0xd
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438ecd
lea eax, [ebp - 4]
call fcn.00406dcc
ret
Function at 0x447380
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.00406468
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4473ac
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4473ac
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x448fa8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
or dword [ebp + 0xc], 0xc11c
cmp byte [0x7125ac], 0
je 0x448fce
or dword [ebp + 0xc], 0x80000
push 1
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 1
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 1
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0x11
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00448f40
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x18]
mov esi, eax
mov eax, esi
call fcn.00434bd4
test al, al
jne 0x44904e
cmp esi, 0x80090318
jne 0x449056
test edi, edi
je 0x449056
mov byte [ebx + 0x5c], 1
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x449086
cmp dword [ebp - 0x24], 0
je 0x449086
push 0
mov eax, dword [ebp - 0x24]
push eax
push edi
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x44907c
mov esi, 0x80090304
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x44909a
cmp dword [ebp - 0x18], 0
je 0x44909a
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x449278
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406458
xor eax, eax
push ebp
push 0x4493f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
call fcn.00406468
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405fbc
call fcn.00406140
mov edi, eax
mov dword [ebp - 0x10], 0x400
cmp dword [ebx + 8], 0
je 0x4493d1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx + 0x68]
jbe 0x4493d1
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0x10], eax
jmp 0x4493d1
cmp edi, dword [ebp - 0x10]
jbe 0x4492ee
mov esi, dword [ebp - 0x10]
jmp 0x4492f0
mov esi, edi
cmp dword [ebx + 8], 0
je 0x4493b6
mov edx, dword [ebx + 0x78]
add edx, dword [ebx + 0x60]
mov eax, dword [ebp - 0xc]
mov ecx, esi
call fcn.0040343c
push 3
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebx + 0x78]
add eax, dword [ebx + 0x60]
mov dword [ebp - 0x58], eax
mov eax, dword [ebx + 0x78]
add eax, dword [ebx + 0x60]
add eax, esi
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x5c]
push eax
push 3
mov eax, dword [ebx + 0x60]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], esi
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x6c]
push eax
push 3
mov dword [ebp - 0x7c], 7
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x74], 6
xor eax, eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x7c]
push eax
push 3
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00448f40
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebx + 0x54]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x64]
test eax, eax
jne 0x4493ab
push 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x78]
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x4493af
xor eax, eax
jmp 0x4493b1
mov al, 1
mov byte [ebp - 5], al
jmp 0x4493cc
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
setg byte [ebp - 5]
add dword [ebp - 0xc], esi
sub edi, esi
cmp byte [ebp - 5], 0
je 0x4493df
test edi, edi
ja 0x4492e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4493fc
lea eax, [ebp - 4]
call fcn.00405dac
ret
Function at 0x44c594
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x44c6bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov esi, dword [ebp - 0xc]
cmp byte [ebp + 8], 0
je 0x44c5de
mov dword [ebp - 0x10], 0x600
jmp 0x44c5e5
mov dword [ebp - 0x10], 0x800
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.0040674c
test esi, esi
jbe 0x44c69d
cmp esi, dword [ebp - 0x10]
jae 0x44c60b
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, esi
call fcn.0040674c
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405fbc
call fcn.00406140
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x44c646
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405fbc
call fcn.00406140
cmp eax, dword [ebp - 0x14]
je 0x44c64a
xor ebx, ebx
jmp 0x44c69d
cmp byte [ebp + 8], 0
je 0x44c669
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0041c824
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.0044b8d8
mov ebx, eax
jmp 0x44c675
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0044b8d8
mov ebx, eax
test bl, bl
je 0x44c69d
sub esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, edi
call fcn.0044be6c
test esi, esi
ja 0x44c5fa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c6c2
lea eax, [ebp - 0x18]
call fcn.00405dac
lea eax, [ebp - 4]
call fcn.00405dac
ret
Function at 0x451eb8
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406dc4
xor eax, eax
push ebp
push 0x45200c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040fa6c
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00406e30
cmp dword [ebp - 4], 0
je 0x451fe2
lea eax, [ebp - 4]
call fcn.00405f8c
call fcn.0040708c
mov ebx, eax
lea eax, [ebp - 4]
call fcn.00405f8c
cmp word [eax + ebx*2 - 2], 0x5c
jne 0x451f36
lea eax, [ebp - 4]
call fcn.00405f8c
call fcn.0040708c
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.00407500
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x451f82
mov eax, dword [ebp - 4]
call fcn.00406e68
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x451f7e
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00451eb8
pop ecx
test al, al
je 0x451f7a
push 0
mov eax, dword [ebp - 4]
call fcn.00406e68
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x451f7e
xor ebx, ebx
jmp 0x451fe4
mov bl, 1
jmp 0x451fe4
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00407020
mov eax, dword [ebp - 0xc]
call fcn.00406468
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x451fde
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00451eb8
pop ecx
test al, al
je 0x451fda
push 0
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00407020
mov eax, dword [ebp - 0x10]
call fcn.00406468
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x451fde
xor ebx, ebx
jmp 0x451fe4
mov bl, 1
jmp 0x451fe4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452013
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405dd0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406dd4
ret
Function at 0x454a84
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x290], ecx
mov dword [ebp - 0x294], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov byte [ebp - 9], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x454c9e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x70]
mov edx, 0x44
call fcn.0040b250
mov dword [ebp - 0x70], 0x44
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x454b37
test ebx, ebx
jne 0x454aeb
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.00406f88
jmp 0x454af5
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406e30
lea eax, [ebp - 0x28a]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW_1
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28a]
push eax
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406e68
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x454ba0
test ebx, ebx
jne 0x454b51
call sub.kernel32.dll_GetCommandLineA
mov edx, eax
lea eax, [ebp - 8]
mov ecx, 0
call fcn.00406060
jmp 0x454b60
lea eax, [ebp - 8]
mov edx, ebx
mov ecx, 0
call fcn.00407020
lea eax, [ebp - 0x28a]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28a]
push eax
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00406468
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x454c51
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x18]
call fcn.0043691c
lea eax, [ebp - 0x294]
push eax
mov cl, 0x30
mov edx, 1
mov eax, dword [ebp - 0x78]
call fcn.0040e19c
mov ecx, dword [ebp - 0x294]
lea eax, [ebp - 0x290]
mov edx, 0x454cb8
call fcn.004061f0
mov eax, dword [ebp - 0x290]
call fcn.00406468
push eax
push 0x58
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
push 0
push 0
push 0
push 0xf001f
push esi
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
test ebx, ebx
je 0x454c48
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebx], eax
push 2
push 0
push 0
lea eax, [ebx + 4]
push eax
mov eax, dword [ebp - 0x80]
push eax
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
lea edx, [ebx + 8]
mov eax, 0x712704
mov ecx, 0x50
call fcn.0040343c
mov eax, dword [ebp - 0x7c]
push eax
call sub.kernel32.dll_ResumeThread
cmp byte [ebp - 9], 0
je 0x454c66
push 2
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x454c70
mov eax, 2
call fcn.00405cc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454ca5
lea eax, [ebp - 0x294]
mov edx, 2
call fcn.00405dd0
lea eax, [ebp - 8]
call fcn.00405dac
lea eax, [ebp - 4]
call fcn.00406dcc
ret
Function at 0x45eae4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor edx, edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45eba9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor edx, edx
call fcn.00406ddc
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x45eb4e
push 0x104
lea eax, [ebp - 0x20a]
push eax
push 0x1001
push 0x800
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x45eb90
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00406fdc
jmp 0x45eb90
push 0x104
lea eax, [ebp - 0x20a]
push eax
push 0x1001
push 0x800
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x45eb90
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0
call fcn.00406060
mov edx, dword [ebp - 0x210]
mov eax, ebx
call fcn.00406ff8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ebb0
lea eax, [ebp - 0x210]
call fcn.00405dac
ret

Function at 0x45fb90
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45fcd0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x45fcec
call fcn.00406450
je 0x45fc9d
mov eax, dword [ebp + 8]
cmp dword [eax - 8], 0
je 0x45fc05
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
mov ecx, 0x45fcfc
mov edx, ebx
call fcn.004061f0
mov eax, dword [ebp - 0x2c]
call fcn.00406468
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call eax
jmp 0x45fc59
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
mov ecx, 0x45fcfc
mov edx, ebx
call fcn.004061f0
mov eax, dword [ebp - 0x30]
call fcn.00406468
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x45fc59
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.00407f80
call fcn.00407f80
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0x45fd0c
mov edi, dword [0x733d4c]
mov edi, dword [edi]
lea edx, [ebp - 0x38]
mov eax, ebx
call edi
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
call fcn.00406ff8
push dword [ebp - 0x34]
push 0x45fd1c
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x3c]
call fcn.0040ee4c
push dword [ebp - 0x3c]
mov eax, esi
mov edx, 4
call fcn.00407280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45fcd7
lea eax, [ebp - 0x3c]
call fcn.00406dcc
lea eax, [ebp - 0x38]
call fcn.00405dac
lea eax, [ebp - 0x34]
call fcn.00406dcc
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00405dd0
ret
Function at 0x462db4
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor ebx, ebx
call sub.kernel32.dll_GetCurrentThreadId_1
cmp esi, eax
je 0x462dde
push edi
call sub.kernel32.dll_SuspendThread
mov esi, eax
cmp esi, 0xffffffff
je 0x462dde
push edi
call sub.kernel32.dll_ResumeThread
test esi, esi
setg bl
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4676ec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x4677fc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [edi], 0
jne 0x4677dc
mov eax, ebx
call fcn.00406468
push eax
call sub.kernel32.dll_GetModuleHandleA
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.0041afe0
mov dword [edi], eax
test esi, esi
je 0x46774a
cmp word [esi], 0x25ff
jne 0x46774a
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x46774c
xor ebx, ebx
cmp byte [ebp + 8], 0
jne 0x46776a
push 0
call sub.kernel32.dll_GetModuleHandleW_2
cmp eax, dword [0x7126a4]
je 0x46776a
cmp byte [0x7126b0], 0
je 0x467781
lea eax, [ebp - 0x10]
call fcn.00436b44
mov eax, dword [ebp - 0x10]
mov edx, dword [edi]
mov ecx, dword [ebp + 0xc]
call fcn.00436f98
jmp 0x467790
mov edx, dword [edi]
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x7126a4]
call fcn.00436ee0
test ebx, ebx
je 0x46779f
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
je 0x4677a3
xor eax, eax
jmp 0x4677a5
mov al, 1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4677e0
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4677e0
mov eax, dword [ebp + 0xc]
mov dword [ebx], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
jmp 0x4677e0
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467803
lea eax, [ebp - 0x10]
mov edx, dword [0x436b18]
call fcn.00408914
ret
Function at 0x467810
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4678eb
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
je 0x4678cf
test esi, esi
je 0x467851
cmp word [esi], 0x25ff
jne 0x467851
mov eax, esi
add eax, 2
mov eax, dword [eax]
mov ebx, dword [eax]
jmp 0x467853
xor ebx, ebx
cmp byte [ebp + 8], 0
jne 0x467871
push 0
call sub.kernel32.dll_GetModuleHandleW_2
cmp eax, dword [0x7126a4]
je 0x467871
cmp byte [0x7126b0], 0
je 0x467888
lea eax, [ebp - 0xc]
call fcn.00436b44
mov eax, dword [ebp - 0xc]
mov ecx, edi
mov edx, dword [ebp - 4]
call fcn.00436f98
jmp 0x467897
mov ecx, edi
mov edx, dword [ebp - 4]
mov eax, dword [0x7126a4]
call fcn.00436ee0
test ebx, ebx
je 0x4678cf
mov eax, esi
add eax, 2
mov eax, dword [eax]
cmp ebx, dword [eax]
jne 0x4678cf
add esi, 2
mov ebx, dword [esi]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4678cf
mov dword [ebx], edi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
push eax
push 4
push ebx
call sub.kernel32.dll_VirtualProtect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4678f2
lea eax, [ebp - 0xc]
mov edx, dword [0x436b18]
call fcn.00408914
ret

Function at 0x468b78
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov esi, eax
lea eax, [ebp - 8]
mov edx, dword [0x468a48]
call fcn.00407868
xor eax, eax
push ebp
push 0x468c57
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x468c64
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x468c2e
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040e19c
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x468c7c
call fcn.004061f0
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0040f75c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00405e5c
lea eax, [ebp - 4]
mov edx, 0x468ca4
call fcn.00406174
mov eax, dword [ebp - 4]
call fcn.00406140
cmp eax, 0x104
jge 0x468c20
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, 0x104
call fcn.0040674c
lea eax, [ebp - 8]
push eax
push 0x468a80
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468c5e
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405dd0
lea eax, [ebp - 8]
mov edx, dword [0x468a48]
call fcn.00407940
ret
Function at 0x469570
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x469645
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040e19c
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x469660
call fcn.004061f0
mov eax, dword [ebp - 4]
call fcn.00406468
push eax
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
mov ebx, eax
test ebx, ebx
je 0x46962a
mov byte [0x7125e4], 1
push 0
push 0
push 0
push 4
push ebx
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
test esi, esi
je 0x469624
mov eax, dword [esi + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esi]
push eax
push 0
push 0x100000
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x46960c
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
push edi
call sub.kernel32.dll_CloseHandle_1
mov edx, 0x712704
lea eax, [esi + 8]
mov ecx, 0x50
call fcn.0040343c
push esi
call sub.kernel32.dll_UnmapViewOfFile
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46964c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405dd0
ret