joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444e20
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov ecx, 0x67b5d0
call fcn.0059f048
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x444eb3
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [ebp + 8]
call fcn.004063c0
add eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x444ead
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x444ead
mov ecx, dword [ebp + 8]
call fcn.0040d5e0
push eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.005a7e71
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 8]
push eax
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x445770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, 0x67b5d0
call fcn.0059f048
push 0x14
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.005a41c0
add esp, 0xc
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0xc], ecx
mov eax, dword [ebp + 8]
add eax, 4
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
push 0
call fcn.005adc18
add esp, 0x18
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44f9e0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov ecx, 0x67b5d0
call fcn.0059f048
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
call fcn.0040d5e0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x44fa17
mov eax, dword [ebp - 4]
jmp 0x44fa53
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0xc], 0
je 0x44fa2f
mov eax, dword [ebp - 8]
or eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x44fa3a
mov eax, dword [ebp - 0xc]
not eax
and eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040d5e0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452c00
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d2efe
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x651da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x67b5d0
call fcn.0059f048
mov ecx, dword [ebp + 8]
call fcn.0040d5e0
push eax
call fcn.0044f8c0
add esp, 4
test eax, eax
jne 0x452c57
mov eax, 1
jmp 0x452e40
mov ecx, dword [ebp + 8]
call fcn.0040d5e0
push eax
push 0x5ff1c4
call fcn.004787b0
add esp, 8
mov dword [ebp - 0x14], 1
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0044f9e0
add esp, 8
test eax, eax
je 0x452c9d
mov ecx, dword [ebp + 8]
call fcn.0040d5e0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x452e3d
mov ecx, dword [ebp + 8]
call fcn.0040d5e0
push eax
push 0x5ff1d4
call fcn.004787b0
add esp, 8
mov eax, 1
test eax, eax
je 0x452e3d
push str..adk
push 8
push 5
lea eax, [ebp - 0x84]
push eax
call fcn.0046a270
add esp, 0xc
mov dword [ebp - 0xb8], eax
mov ecx, dword [ebp - 0xb8]
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0xbc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x9c]
push ecx
call fcn.0044f7c0
add esp, 8
mov dword [ebp - 0xc0], eax
mov edx, dword [ebp - 0xc0]
mov dword [ebp - 0xc4], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xc4]
push eax
lea ecx, [ebp - 0xb4]
push ecx
call fcn.004367c0
add esp, 0xc
mov dword [ebp - 0xc8], eax
mov edx, dword [ebp - 0xc8]
mov dword [ebp - 0xcc], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00427a50
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xb4]
call fcn.00404fb0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9c]
call fcn.00404fb0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x84]
call fcn.00404fb0
lea ecx, [ebp - 0x2c]
call fcn.0040d5e0
push eax
call fcn.0044f8c0
add esp, 4
test eax, eax
jne 0x452e29
lea ecx, [ebp - 0x2c]
call fcn.0040d5e0
push eax
mov ecx, dword [ebp + 8]
call fcn.0040d5e0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x452df9
push 2
lea ecx, [ebp - 0x2c]
call fcn.0040d5e0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x2c]
call fcn.0040d5e0
push eax
mov ecx, dword [ebp + 8]
call fcn.0040d5e0
push eax
push 0x5ff1f4
call fcn.004787b0
add esp, 0xc
jmp 0x452e18
lea ecx, [ebp - 0x2c]
call fcn.0040d5e0
push eax
mov ecx, dword [ebp + 8]
call fcn.0040d5e0
push eax
push 0x5ff208
call fcn.004787b0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404fb0
jmp 0x452e3d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00404fb0
jmp 0x452cb3
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059f07a
mov esp, ebp
pop ebp
ret
Function at 0x452e60
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d2f72
mov eax, dword fs:[0]
push eax
sub esp, 0x98
push ebx
push esi
push edi
mov eax, dword [0x651da0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 4], 0
mov ecx, 0x67b5d0
call fcn.0059f048
mov dword [ebp - 0x10], 1
lea ecx, [ebp + 8]
call fcn.0040e960
movzx eax, al
test eax, eax
je 0x452ed9
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404fb0
mov eax, dword [ebp - 0x54]
jmp 0x45308b
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x6c]
push ecx
call fcn.0044f5f0
add esp, 8
mov dword [ebp - 0x9c], eax
mov edx, dword [ebp - 0x9c]
mov dword [ebp - 0xa0], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xa0]
push eax
lea ecx, [ebp + 8]
call fcn.00409dd0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6c]
call fcn.00404fb0
lea ecx, [ebp + 8]
call fcn.00429730
cmp eax, 3
jb 0x452f9a
lea ecx, [ebp + 8]
call fcn.0040d5e0
push eax
call fcn.00447dd0
add esp, 4
test eax, eax
jne 0x452f9a
lea eax, [ebp + 8]
push eax
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x88]
push edx
call fcn.0044f7c0
add esp, 8
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x98]
or ecx, 1
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0xa0]
push edx
call fcn.00436740
add esp, 8
movzx eax, al
test eax, eax
jne 0x452f9a
mov dword [ebp - 0xa4], 0
jmp 0x452fa4
mov dword [ebp - 0xa4], 1
mov cl, byte [ebp - 0xa4]
mov byte [ebp - 0x6d], cl
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x98]
and edx, 1
je 0x452fd1
and dword [ebp - 0x98], 0xfffffffe
lea ecx, [ebp - 0x88]
call fcn.00404fb0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x452ffc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404fb0
mov eax, dword [ebp - 0x8c]
jmp 0x45308b
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x90], esp
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.0044f7c0
add esp, 8
mov dword [ebp - 0x9c], eax
mov byte [ebp - 4], 3
mov byte [ebp - 4], 0
call fcn.00452e60
add esp, 0x18
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
je 0x45305a
push 0
lea ecx, [ebp + 8]
call fcn.0040d5e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x45305a
mov dword [ebp - 0xa4], 1
jmp 0x453064
mov dword [ebp - 0xa4], 0
mov edx, dword [ebp - 0xa4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x94], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00404fb0
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4533c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d307a
mov eax, dword fs:[0]
push eax
sub esp, 0x170
mov eax, dword [0x651da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x174], 0
mov ecx, 0x67b5d0
call fcn.0059f048
push 0x104
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.005a41c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x114]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0x6014dc
lea eax, [ebp - 0x114]
push eax
call fcn.0043c660
add esp, 8
push 0
lea eax, [ebp - 0x16c]
push eax
call fcn.00457b80
add esp, 8
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x178]
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x17c]
call fcn.0040d5e0
push eax
lea edx, [ebp - 0x114]
push edx
call fcn.0043c660
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x16c]
call fcn.00404fb0
push 0x6014dc
lea eax, [ebp - 0x114]
push eax
call fcn.0043c660
add esp, 8
lea eax, [ebp - 0x114]
push eax
call fcn.00447dd0
add esp, 4
test eax, eax
jne 0x4534ee
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x170], esp
lea eax, [ebp - 0x114]
push eax
call fcn.00404ad0
mov dword [ebp - 0x178], eax
mov dword [ebp - 4], 2
mov byte [ebp - 4], 0
call fcn.00452e60
add esp, 0x18
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404ad0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x174]
or ecx, 1
mov dword [ebp - 0x174], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059f07a
mov esp, ebp
pop ebp
ret

Function at 0x454670
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5d0
mov eax, dword [0x651da0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x67b5d0
call fcn.0059f048
mov dword [0x6796e8], 0
push 0x400
push 0
lea eax, [ebp - 0x404]
push eax
call fcn.005a41c0
add esp, 0xc
mov dword [ebp - 0x408], 0x61
jmp 0x4546cb
mov eax, dword [ebp - 0x408]
add eax, 1
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x408], 0x7a
jg 0x454794
push 0x400
push 0
lea eax, [ebp - 0x404]
push eax
call fcn.005a41c0
add esp, 0xc
mov al, byte [ebp - 0x408]
mov byte [ebp - 0x50c], al
mov byte [ebp - 0x50b], 0x3a
mov byte [ebp - 0x50a], 0
push 0x101
push 0
lea eax, [ebp - 0x509]
push eax
call fcn.005a41c0
add esp, 0xc
push 0x400
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x50c]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov dword [ebp - 0x510], eax
cmp dword [ebp - 0x510], 0
jle 0x45478f
mov eax, dword [0x6796e8]
add eax, 1
mov dword [0x6796e8], eax
lea eax, [ebp - 0x50c]
push eax
mov ecx, dword [0x6796e8]
sub ecx, 1
imul ecx, ecx, 0x18
add ecx, 0x678fe8
call fcn.00428360
lea eax, [ebp - 0x404]
push eax
mov ecx, dword [0x6796e8]
sub ecx, 1
imul ecx, ecx, 0x18
add ecx, 0x6793b0
call fcn.00428360
jmp 0x4546bc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0059f07a
mov esp, ebp
pop ebp
ret
Function at 0x454d10
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d358c
mov eax, dword fs:[0]
push eax
sub esp, 0xbdc
mov eax, dword [0x651da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xbe8], 0
mov ecx, 0x67b5d0
call fcn.0059f048
push 0x5f1ab4
lea ecx, [ebp - 0x28]
call fcn.00408330
mov dword [ebp - 4], 1
cmp dword [ebp + 0xc], 0
jne 0x454d9b
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.0043db90
mov ecx, dword [ebp - 0xbe8]
or ecx, 1
mov dword [ebp - 0xbe8], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004095d0
mov eax, dword [ebp + 8]
jmp 0x454eda
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x454eb0
mov eax, dword [ebp - 0x30]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x454eb0
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x454ea6
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x38]
push ecx
push 0x6014dc
mov edx, dword [ebp - 0x34]
push edx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x454ea6
cmp dword [ebp - 0x3c], 0
je 0x454ea6
push 0xa28
push 0
lea eax, [ebp - 0xa64]
push eax
call fcn.005a41c0
add esp, 0xc
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0xc]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 8]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 8]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
push str._d._d._d._d
lea eax, [ebp - 0xa64]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0xa64]
push eax
lea ecx, [ebp - 0x28]
call fcn.00409e20
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.0043db90
mov ecx, dword [ebp - 0xbe8]
or ecx, 1
mov dword [ebp - 0xbe8], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004095d0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059f07a
mov esp, ebp
pop ebp
ret
Function at 0x455070
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d35e6
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x651da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x78], 0
mov ecx, 0x67b5d0
call fcn.0059f048
lea ecx, [ebp - 0x28]
call fcn.00404b80
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
call fcn.0040e960
movzx eax, al
test eax, eax
je 0x4550f3
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404a30
mov ecx, dword [ebp - 0x78]
or ecx, 1
mov dword [ebp - 0x78], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00404fb0
mov eax, dword [ebp + 8]
jmp 0x4551c8
mov dword [ebp - 0x2c], 0
push 0x288
call fcn.005a7ffc
add esp, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0x288
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x45513f
mov eax, dword [ebp - 0x30]
push eax
call fcn.005a7fe1
add esp, 4
mov eax, dword [ebp - 0x34]
push eax
call fcn.005a7ffc
add esp, 4
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x455198
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x455198
mov ecx, dword [ebp + 0xc]
call fcn.0040d5e0
push eax
mov eax, dword [ebp - 0x2c]
add eax, 0x1b0
push eax
call fcn.005ae270
add esp, 8
test eax, eax
jne 0x45518e
mov eax, dword [ebp - 0x2c]
add eax, 0x1d8
push eax
lea ecx, [ebp - 0x28]
call fcn.00428360
jmp 0x455198
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
jmp 0x455157
mov eax, dword [ebp - 0x30]
push eax
call fcn.005a7fe1
add esp, 4
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404a30
mov ecx, dword [ebp - 0x78]
or ecx, 1
mov dword [ebp - 0x78], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00404fb0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059f07a
mov esp, ebp
pop ebp
ret
Function at 0x457750
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d3f52
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x651da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1a0], 0
mov ecx, 0x67b5d0
call fcn.0059f048
lea ecx, [ebp - 0x28]
call fcn.00404b80
mov dword [ebp - 4], 1
call fcn.0046e130
test eax, eax
jne 0x4577d9
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404a30
mov ecx, dword [ebp - 0x1a0]
or ecx, 1
mov dword [ebp - 0x1a0], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00404fb0
mov eax, dword [ebp + 8]
jmp 0x4578a3
push 0x104
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.005a41c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x457874
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x184]
call fcn.00404ad0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x184]
push ecx
lea edx, [ebp - 0x19c]
push edx
call fcn.0046f650
add esp, 8
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1a8], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1a8]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00409dd0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x19c]
call fcn.00404fb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x184]
call fcn.00404fb0
call fcn.0046e450
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404a30
mov ecx, dword [ebp - 0x1a0]
or ecx, 1
mov dword [ebp - 0x1a0], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00404fb0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059f07a
mov esp, ebp
pop ebp
ret
Function at 0x4580c0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d41bd
mov eax, dword fs:[0]
push eax
sub esp, 0x1b8
mov eax, dword [0x651da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1bc], 0
mov ecx, 0x67b5d0
call fcn.0059f048
lea ecx, [ebp - 0x28]
call fcn.00404b80
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jbe 0x458227
push 0x104
push 0
lea eax, [ebp - 0x130]
push eax
call fcn.005a41c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call sub.KERNEL32.dll_K32GetProcessImageFileNameA
movzx eax, byte [ebp + 0x10]
test eax, eax
jne 0x4581d3
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x188]
call fcn.00404ad0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x188]
push ecx
lea edx, [ebp - 0x1a0]
push edx
call fcn.0046fca0
add esp, 8
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1c4], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c4]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00409dd0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1a0]
call fcn.00404fb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x188]
call fcn.00404fb0
jmp 0x45821d
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x1b8]
push ecx
call fcn.00454490
add esp, 8
mov dword [ebp - 0x1c0], eax
mov edx, dword [ebp - 0x1c0]
mov dword [ebp - 0x1c4], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x28]
call fcn.00409dd0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1b8]
call fcn.00404fb0
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404a30
mov ecx, dword [ebp - 0x1bc]
or ecx, 1
mov dword [ebp - 0x1bc], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00404fb0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059f07a
mov esp, ebp
pop ebp
ret
Function at 0x459210
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d44e6
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x651da0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74], 0
mov ecx, 0x67b5d0
call fcn.0059f048
push 0x5f1960
lea ecx, [ebp - 0x28]
call fcn.00404ad0
mov dword [ebp - 4], 1
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4592ac
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x4592a6
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4592a6
mov eax, dword [ebp - 0x30]
push eax
lea ecx, [ebp - 0x28]
call fcn.00428360
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.00404a30
mov ecx, dword [ebp - 0x74]
or ecx, 1
mov dword [ebp - 0x74], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00404fb0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0059f07a
mov esp, ebp
pop ebp
ret
Function at 0x45fe00
Capabilities:
Suspend thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, 0x67b5d0
call fcn.0059f048
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
push 0
push 0x12
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
cmp dword [ebp + 0xc], 0
je 0x45fe4c
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x45fe92
push 0x7530
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x45fe92
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
push str._____FreeThread_TimeOut_TerminateThread:_d
call fcn.004787b0
add esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x14
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.005a41c0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x460000
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, 0x67b5d0
call fcn.0059f048
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x14
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.005a41c0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4