joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c764
Capabilities:
Get disk information

Disassembly:
mov eax, 0x4546ec
call fcn.00452450
sub esp, 0x20
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, edx
push edi
mov dword [ebp - 0x10], ecx
cmp byte [esi + 0x10], 0
mov ebx, dword [esi]
je 0x41c7cb
mov ecx, dword [ebp + 8]
push 1
pop ebx
lea eax, [ebp - 0x20]
push 3
push eax
call fcn.00402ebd
mov eax, dword [ebp - 0x20]
cmp word [eax + 2], 0x3a
jne 0x41c7c2
cmp word [eax + 4], 0x5c
jne 0x41c7c2
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
je 0x41c7c0
cmp eax, 2
jne 0x41c7c2
mov ebx, dword [esi]
push dword [ebp - 0x20]
call fcn.004026ee
pop ecx
mov ecx, dword [ebp + 8]
call fcn.00402386
mov edi, eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
inc edi
mov eax, dword [eax]
lea eax, [eax + edi*2]
push eax
call fcn.0040201d
dec ebx
je 0x41c85d
dec ebx
je 0x41c82e
lea ecx, [ebp - 0x2c]
call fcn.00401f28
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 1
call fcn.0040495c
test al, al
jne 0x41c81d
lea eax, [ebp + 8]
push 0x45fea0
push eax
mov dword [ebp + 8], 0x22995
call sub.MSVCRT.dll__CxxThrowException
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.00401faf
push dword [ebp - 0x2c]
jmp 0x41c855
add esi, 4
lea ecx, [ebp - 0x20]
push esi
call fcn.00401faf
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0040658c
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
call fcn.00401faf
push dword [ebp - 0x20]
call fcn.004026ee
pop ecx
jmp 0x41c869
mov ecx, dword [ebp + 8]
push edi
push dword [ebp - 0x10]
call fcn.00402ebd
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x41d1ab
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x45489b
call fcn.00452450
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x45cc54
mov dword [esi + 4], 0x45cc3c
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov dword [ebp - 4], ebx
call fcn.00401f28
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov byte [esi + 0x58], bl
mov byte [esi + 0x59], bl
mov dword [esi], 0x45cc20
mov dword [esi + 4], 0x45cc08
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41fb6c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x454aee
call fcn.00452450
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], al
mov byte [esi + 0x21], al
call fcn.00401f28
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00418902
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41fbc6
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x454b21
call fcn.00452450
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.004181a1
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00418954
push dword [esi + 0x24]
call fcn.004026ee
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.00410316
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00420a4f
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x41fbd1
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x454b21
call fcn.00452450
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 3
call fcn.004181a1
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.00418954
push dword [esi + 0x24]
call fcn.004026ee
and byte [ebp - 4], 0
pop ecx
lea ecx, [esi + 0xc]
call fcn.00410316
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00420a4f
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x425350
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4553e3
call fcn.00452450
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ebx
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.00401f28
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], bl
mov byte [esi + 0x3d], bl
push 0x46fabc
mov dword [esi], 0x45d514
mov dword [esi + 4], 0x45d504
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0xbe
push dword [0x46fa30]
call dword [sym.imp.USER32.dll_LoadBitmapW]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x38], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x428d3b
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x455ac5
call fcn.00452450
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x45d960
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
call fcn.00401f28
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00401f28
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00401f28
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.00401f28
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi], 0x45d930
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x428dce
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x455b04
call fcn.00452450
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x3c]
mov dword [ebp - 4], 4
call fcn.00410316
push dword [esi + 0x30]
call fcn.004026ee
push dword [esi + 0x24]
call fcn.004026ee
push dword [esi + 0x18]
call fcn.004026ee
push dword [esi + 0xc]
call fcn.004026ee
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword [esi], 0x45d990
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x4296ee
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2b4
lea eax, [esp]
neg cl
sbb ecx, ecx
and cl, 1
add ecx, 0x100
or cx, 0x4010
push ecx
push 0x2b4
push eax
push 0x90
push 0x45b648
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
add esp, 0x2b4
ret
Function at 0x42ad0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc esp
add ebx, esp
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00429899
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x42ad35
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x42ad7e
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x42ad28
call fcn.00429928
inc ebx
push es
ficomp dword [eax]
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
invalid
Function at 0x42e3cf
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x42e3f7
xor al, al
leave
ret
cmp dword [ebp - 0x104], 2
jne 0x42e3f3
cmp dword [ebp - 0x110], 5
jb 0x42e3f3
jbe 0x42e40f
mov al, 1
leave
ret
cmp dword [ebp - 0x10c], 1
jb 0x42e3f3
seta al
leave
ret
Function at 0x42e594
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x456688
call fcn.00452450
sub esp, 0x58
mov ecx, 0x46fa38
call fcn.004087ce
mov byte [0x46fa40], al
call fcn.0042e7b1
test al, al
jne 0x42e5cb
mov ecx, str.Unsupported_Windows_version
call fcn.0042e583
push 1
pop eax
jmp 0x42e7a3
push esi
call fcn.00451f70
call fcn.004327f0
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov ecx, str.comctl32.dll
call fcn.0042e7e7
cmp eax, 0x40047
mov dword [0x46fa0c], eax
sbb al, al
inc al
mov byte [0x46f204], al
call fcn.0042ea1c
mov ecx, 0xc8
mov edx, ecx
call fcn.00408a3b
neg al
sbb al, al
xor esi, esi
inc al
push esi
mov byte [0x46fa43], al
call dword [sym.imp.ole32.dll_OleInitialize]
lea ecx, [ebp - 0x30]
call fcn.00401f28
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], esi
call fcn.00401f28
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00401f6c
lea eax, [ebp - 0x30]
lea edx, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.00448290
push dword [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.004026ee
pop ecx
lea ecx, [ebp - 0x30]
call fcn.004023fe
lea ecx, [ebp - 0x30]
call fcn.004023b3
lea ecx, [ebp - 0x24]
call fcn.00401f28
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.00401f28
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.00448290
lea ecx, [ebp - 0x24]
call fcn.004023fe
lea ecx, [ebp - 0x24]
call fcn.004023b3
lea ecx, [ebp - 0x18]
call fcn.004023fe
lea ecx, [ebp - 0x18]
call fcn.004023b3
mov ecx, dword [ebp - 0x18]
mov edx, 0x45e1d4
call fcn.004017df
test al, al
je 0x42e6dd
mov eax, dword [ebp - 0x18]
mov ecx, 0x46fa10
add eax, 4
push eax
call fcn.0040201d
cmp dword [ebp - 0x20], esi
je 0x42e6f0
lea eax, [ebp - 0x24]
mov ecx, 0x46fa20
push eax
call fcn.00402081
call fcn.0042ea65
call fcn.0042ea89
mov ecx, 0x46f690
call fcn.004276b6
mov ecx, dword [ebp + 8]
call fcn.0042e84d
test eax, eax
je 0x42e77d
push ebx
push edi
push 0x48
push dword [0x46fa30]
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
mov ebx, eax
push esi
push esi
lea eax, [ebp - 0x64]
push esi
push eax
call edi
test eax, eax
je 0x42e767
lea eax, [ebp - 0x64]
push eax
push ebx
push dword [0x46fa2c]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x42e75e
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
lea eax, [ebp - 0x64]
push esi
push eax
jmp 0x42e72f
call fcn.0041d04b
mov dword [0x46fa2c], esi
call dword [sym.imp.ole32.dll_OleUninitialize]
mov esi, dword [ebp - 0x5c]
pop edi
pop ebx
push dword [ebp - 0x18]
call fcn.004026ee
push dword [ebp - 0x24]
call fcn.004026ee
push dword [ebp - 0x48]
call fcn.004026ee
push dword [ebp - 0x30]
call fcn.004026ee
add esp, 0x10
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42ea89
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
and byte [0x46fa4e], 0
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42ead2
cmp dword [ebp - 0x104], 2
jne 0x42ead2
cmp dword [ebp - 0x110], 6
jb 0x42ead2
mov byte [0x46fa4e], 1
call fcn.0042ead4
leave
ret

Function at 0x42ef37
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x456706
call fcn.00452450
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
or dword [esi + 0x18], 0xffffffff
or dword [esi + 0x20], 0xffffffff
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
mov byte [esi + 0x1c], bl
mov byte [esi + 0x1d], bl
call fcn.00401f28
or dword [esi + 0x3c], 0xffffffff
or dword [esi + 0x40], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], ebx
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov dword [esi + 0x38], ebx
mov dword [esi], 0x45e2b4
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x432af2
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x456da4
call fcn.00452450
sub esp, 0x38
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp si, ax
jne 0x432be5
mov ecx, eax
xor ebx, ebx
shr ax, 0xa
and ecx, 0x3ff
mov esi, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
movzx ecx, cx
lea edx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.00432bf4
lea ecx, [ebp - 0x2c]
call fcn.004327aa
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], ebx
movzx edi, si
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
not eax
and eax, edi
cmp eax, dword [ebp - 0x1c]
jae 0x432bba
mov ecx, dword [ebp - 0x20]
mov esi, dword [ecx + eax*4]
cmp dword [esi + 4], ebx
je 0x432bba
push esi
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x44]
call fcn.00401e90
push 0x45e82c
mov edx, eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.00401eb4
mov edx, dword [eax]
mov ecx, 0x46fa68
mov byte [ebp - 4], 3
call fcn.0043279e
mov byte [ebp - 0xd], al
push dword [ebp - 0x38]
call fcn.004026ee
push dword [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.004026ee
cmp byte [ebp - 0xd], bl
pop ecx
pop ecx
jne 0x432bc5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jb 0x432b52
jmp 0x432bd0
push esi
mov ecx, 0x46fa88
call fcn.00402081
push dword [ebp - 0x2c]
call fcn.004026ee
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x20]
call fcn.00410316
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x43685e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x457413
call fcn.00452450
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x45ed38
mov dword [esi + 4], 0x45ed24
mov dword [esi + 8], 0x45ed14
mov dword [esi + 0xc], 0x45ecf0
mov dword [esi + 0x10], 0x45ecd4
mov dword [esi + 0x14], 0x45b974
mov dword [esi + 0x18], 0x45b984
lea ecx, [esi + 0x20]
mov dword [esi + 0x1c], ebx
call fcn.00401f28
lea ecx, [esi + 0x30]
mov dword [ebp - 4], ebx
call fcn.00401f28
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.00401f28
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x6c], ebx
lea ecx, [esi + 0x9c]
mov byte [ebp - 4], 4
mov byte [esi + 0x70], 1
mov byte [esi + 0x71], bl
mov dword [esi + 0x94], ebx
mov byte [esi + 0x98], bl
mov byte [esi + 0x99], bl
call fcn.00401f28
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 5
call fcn.00401f28
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 6
call fcn.00401f28
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 7
call fcn.00401f28
lea ecx, [esi + 0xcc]
mov byte [ebp - 4], 8
call fcn.00401f28
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0xd8], bl
mov byte [esi + 0xd9], bl
mov byte [esi + 0xda], bl
mov dword [esi], 0x45df74
mov dword [esi + 4], 0x45df60
mov dword [esi + 8], 0x45df50
mov dword [esi + 0xc], 0x45df2c
mov dword [esi + 0x10], 0x45df10
mov dword [esi + 0x14], 0x45df00
mov dword [esi + 0x18], 0x45def0
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x43706e
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x4575fa
call fcn.00452450
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.00401f28
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00401f28
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
mov byte [esi + 0x24], bl
mov byte [esi + 0x25], bl
mov dword [esi + 0x2c], ebx
call fcn.00401f28
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x43c303
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x458058
call fcn.00452450
sub esp, 0x60
push ebx
push esi
push edi
mov edi, ecx
push edx
lea ecx, [ebp - 0x18]
call fcn.00401faf
xor ebx, ebx
push 0x2e
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.0040235b
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00402386
cmp esi, ebx
jl 0x43c33f
cmp esi, eax
jge 0x43c349
push 0x2e
lea ecx, [ebp - 0x18]
call fcn.00402134
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x30]
push eax
mov dword [ebp - 0x6c], 0x3c
mov dword [ebp - 0x68], 0x140
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
call fcn.00401faf
push edi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.00401faf
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
mov dword [ebp - 0x50], 1
and eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x34]
push dword [ebp - 0x24]
mov esi, dword [ebp - 0x4c]
mov dword [eax], ecx
call fcn.004026ee
push dword [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.004026ee
pop ecx
cmp esi, 0x20
pop ecx
ja 0x43c3fa
cmp esi, 0x1f
jne 0x43c3f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00403e80
push 0x10
push 0x45bb68
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x30]
call fcn.004026ee
pop ecx
mov ebx, 0x80004005
push dword [ebp - 0x18]
call fcn.004026ee
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x43e59c
Capabilities:
Enumerate processes

Disassembly:
mov eax, 0x458508
call fcn.00452450
sub esp, 0x248
push edi
mov dword [ebp - 0x10], ecx
call fcn.0043e894
and dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x28], edi
je 0x43e659
lea ecx, [ebp - 0x1c]
call fcn.00401f28
push 0x22c
lea eax, [ebp - 0x254]
push 0
push eax
mov byte [ebp - 4], 1
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x43e649
mov eax, dword [ebp - 0x24c]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x230]
push eax
call fcn.0040201d
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
call fcn.0043e837
lea eax, [ebp - 0x254]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
jmp 0x43e609
push dword [ebp - 0x1c]
call fcn.004026ee
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
leave
ret
Function at 0x445894
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x458fa3
call fcn.00452450
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x45d960
mov dword [esi + 8], edi
lea ecx, [esi + 0x10]
mov dword [ebp - 4], edi
mov dword [esi + 0xc], edi
call fcn.00401f28
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 1
call fcn.00401f28
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi], 0x45f240
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x447466
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x459374
call fcn.00452450
sub esp, 0x18
push esi
mov esi, ecx
lea ecx, [ebp - 0x18]
lea edx, [esi + 0x3c]
call fcn.004473ee
and dword [ebp - 4], 0
push eax
lea ecx, [esi + 0xc]
call fcn.00402081
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.004026ee
pop ecx
lea edx, [esi + 0x40]
lea ecx, [ebp - 0x18]
call fcn.0044743e
push eax
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 1
call fcn.00402081
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.004026ee
pop ecx
lea edx, [esi + 0x44]
lea ecx, [ebp - 0x24]
call fcn.00447416
push eax
lea ecx, [esi + 0x24]
mov dword [ebp - 4], 2
call fcn.00402081
push dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
call fcn.004026ee
pop ecx
push dword [0x46f2e4]
lea ecx, [esi + 0x30]
call fcn.0040201d
push 0x11
pop ecx
call fcn.0044839b
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x48], eax
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x44839b
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp dword [ebp - 4], 0
je 0x448405
push 0x4008
lea eax, [ebp - 0x2bc]
push 0x2b4
push eax
push 0x80
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 8]
test eax, eax
je 0x4483fd
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x2b8]
leave
ret
xor eax, eax
leave
ret

Function at 0x44843a
Capabilities:
Get file system object information

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push edx
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
ret 0xc
Function at 0x44aaee
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x459860
call fcn.00452450
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
or eax, 0xffffffff
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x38]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
call fcn.00401f28
lea ecx, [esi + 0x44]
mov dword [ebp - 4], ebx
call fcn.00401f28
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 1
call fcn.00401f28
mov byte [esi + 0x5c], bl
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 3
call fcn.00436ab5
lea ecx, [esi + 0x9c]
call fcn.00452190
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret