joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426d81
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x56c4f7
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
lea ecx, [esi + 0xa8]
call fcn.00426e28
lea ecx, [esi + 0x78]
call fcn.00426e28
push dword [esi + 0x30]
call fcn.00566e0e
push dword [esi + 0x24]
call fcn.00566e0e
push dword [esi + 0x18]
call fcn.00566e0e
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x426ddb
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 8]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x426def
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 4]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x426e03
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x426e16
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x426e7a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x56b000
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
call fcn.004329f0
lea ecx, [esi + 0x30]
call fcn.00426e28
push dword [esi + 0x24]
call fcn.00566e0e
pop ecx
lea ecx, [esi + 0xc]
call fcn.004058c1
mov ecx, esi
call fcn.00426d47
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x428284
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x56c645
call fcn.00566e38
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [esi]
mov dword [edi], eax
lea ecx, [edi + 0x10]
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
lea eax, [esi + 0x10]
push eax
call fcn.004024ee
and dword [ebp - 4], 0
lea eax, [esi + 0x1c]
push eax
lea ecx, [edi + 0x1c]
call fcn.004281d6
mov eax, dword [esi + 0x28]
lea ecx, [edi + 0x34]
mov dword [edi + 0x28], eax
mov al, byte [esi + 0x2c]
mov byte [edi + 0x2c], al
mov al, byte [esi + 0x2d]
mov byte [edi + 0x2d], al
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
lea eax, [esi + 0x34]
push eax
mov byte [ebp - 4], 1
call fcn.0042822d
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x428475
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56c6ba
call fcn.00566e38
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
xor edi, edi
mov dword [esi], fcn.0042a9ea
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
lea ecx, [esi + 0x48]
mov dword [ebp - 4], edi
call fcn.004025e6
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.004025e6
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x42ce6c
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x56cb66
call fcn.00566e38
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push edi
mov ecx, dword [esi]
mov dword [ebx], ecx
test ecx, ecx
je 0x42ce90
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [esi + 4]
and dword [ebp - 4], 0
mov dword [ebx + 4], ecx
test ecx, ecx
je 0x42cea4
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [esi + 8]
mov byte [ebp - 4], 1
mov dword [ebx + 8], ecx
test ecx, ecx
je 0x42ceb8
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [esi + 0xc]
mov byte [ebp - 4], 2
mov dword [ebx + 0xc], ecx
test ecx, ecx
je 0x42cecc
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov al, byte [esi + 0x10]
lea ecx, [ebx + 0x18]
mov byte [ebx + 0x10], al
mov al, byte [esi + 0x11]
mov byte [ebx + 0x11], al
mov al, byte [esi + 0x12]
mov byte [ebx + 0x12], al
mov al, byte [esi + 0x13]
mov byte [ebx + 0x13], al
mov al, byte [esi + 0x14]
mov byte [ebx + 0x14], al
mov al, byte [esi + 0x15]
mov byte [ebx + 0x15], al
mov al, byte [esi + 0x16]
mov byte [ebx + 0x16], al
mov al, byte [esi + 0x17]
mov byte [ebx + 0x17], al
lea eax, [esi + 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.004024ee
lea eax, [esi + 0x24]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebx + 0x24]
call fcn.004024ee
lea eax, [esi + 0x30]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebx + 0x30]
call fcn.004024ee
mov eax, dword [esi + 0x3c]
lea edi, [ebx + 0x44]
mov dword [ebx + 0x3c], eax
mov eax, dword [esi + 0x40]
add esi, 0x44
mov dword [ebx + 0x40], eax
mov byte [ebp - 4], 6
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], ecx
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], ecx
mov al, byte [esi + 0x60]
mov byte [ebx + 0x60], al
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x6c]
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], ecx
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x74]
mov dword [ebx + 0x70], eax
lea eax, [esi + 0x78]
mov dword [ebx + 0x74], ecx
lea ecx, [ebx + 0x78]
push eax
call fcn.0042d051
lea eax, [esi + 0xa8]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebx + 0xa8]
call fcn.0042d051
mov eax, dword [esi + 0xd8]
mov ecx, dword [esi + 0xdc]
pop edi
mov dword [ebx + 0xd8], eax
mov eax, ebx
mov dword [ebx + 0xdc], ecx
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42cfcb
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56cb66
call fcn.00566e38
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 3
mov dword [esi + 0x11], ebx
mov word [esi + 0x15], bx
mov byte [esi + 0x17], bl
call fcn.004025e6
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 4
call fcn.004025e6
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 5
call fcn.004025e6
xor eax, eax
mov byte [ebp - 4], 6
lea ecx, [esi + 0x78]
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], eax
call fcn.00426c6e
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 7
call fcn.00426c6e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42d159
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56cbb9
call fcn.00566e38
push ecx
push ecx
push esi
push edi
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x10], edi
mov dword [edi + 0x14], eax
mov dword [edi], 0x57b14c
mov dword [edi + 4], 0x57b160
mov dword [edi + 8], 0x57b174
mov dword [edi + 0xc], 0x57b184
mov dword [edi + 0x10], 0x57b194
mov word [edi + 0x18], ax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], eax
mov dword [ebp - 4], eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 2
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], eax
call fcn.004025e6
lea ecx, [edi + 0x54]
mov byte [ebp - 4], 3
call fcn.004025e6
lea esi, [edi + 0x60]
mov byte [ebp - 4], 4
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00407f6f
lea ecx, [esi + 0x28]
call fcn.004025e6
lea ecx, [edi + 0x98]
mov byte [ebp - 4], 5
call fcn.0041b398
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x42d20b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x56cbeb
call fcn.00566e38
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [edi], eax
lea ecx, [edi + 0x10]
mov dword [edi + 4], edx
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [edi + 8], eax
lea eax, [esi + 0x10]
push eax
mov dword [edi + 0xc], edx
call fcn.004024ee
and dword [ebp - 4], 0
lea eax, [esi + 0x1c]
push eax
lea ecx, [edi + 0x1c]
call fcn.004024ee
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov dword [edi + 0x28], eax
lea eax, [esi + 0x30]
mov dword [edi + 0x2c], ecx
lea ecx, [edi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.004024ee
lea eax, [esi + 0x3c]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x3c]
call fcn.004024ee
mov al, byte [esi + 0x48]
mov byte [edi + 0x48], al
mov al, byte [esi + 0x49]
mov byte [edi + 0x49], al
mov al, byte [esi + 0x4a]
mov byte [edi + 0x4a], al
mov al, byte [esi + 0x4b]
mov byte [edi + 0x4b], al
mov al, byte [esi + 0x4c]
mov byte [edi + 0x4c], al
mov al, byte [esi + 0x4d]
mov byte [edi + 0x4d], al
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
mov dword [edi + 0x50], eax
mov dword [edi + 0x54], ecx
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], ecx
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 0x64]
mov dword [edi + 0x60], eax
mov dword [edi + 0x64], ecx
mov eax, dword [esi + 0x68]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x68], eax
mov al, byte [esi + 0x6c]
mov byte [edi + 0x6c], al
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x446346
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x56e622
call fcn.00566e38
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x57cee8
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
call fcn.004025e6
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004025e6
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.004025e6
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.004025e6
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x44804c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56e815
call fcn.00566e38
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x57cfc8
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 2
mov byte [esi + 0x45], bl
call fcn.004025e6
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
call fcn.004025e6
or dword [esi + 0x64], 0xffffffff
mov word [esi + 0x60], bx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 5
call fcn.004025e6
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 6
call fcn.004025e6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x448127
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x56e85d
call fcn.00566e38
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x57cf90
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
call fcn.004025e6
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004025e6
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.004025e6
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4493cb
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 0x11
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [esp + 8]
shr eax, 0xf
and al, 1
movzx ecx, word [edx + 0xc]
mov edx, ecx
cmp edx, 8
je 0x44940e
cmp edx, 0x52
je 0x4493fd
cmp ecx, 0x76
jne 0x44940a
mov ecx, esi
call fcn.00448e60
jmp 0x449415
test al, al
je 0x44940a
mov ecx, esi
call fcn.00449c9b
jmp 0x449415
xor al, al
jmp 0x449417
mov ecx, esi
call fcn.0044969b
mov al, 1
pop esi
ret 4
Function at 0x449e44
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x56ea58
call fcn.00566e38
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov dword [esi], 0x57d0f8
mov dword [ebp - 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], eax
lea ecx, [esi + 0x5c]
mov byte [ebp - 4], 3
mov byte [esi + 0x59], al
call fcn.004025e6
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 4
call fcn.004025e6
lea ecx, [esi + 0x74]
mov byte [ebp - 4], 5
call fcn.004025e6
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 6
call fcn.004025e6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x44b1cb
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x56ec06
call fcn.00566e38
sub esp, 0x2c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x12
mov edi, ecx
call esi
movzx ebx, ax
shr ebx, 0xf
push 0x11
and bl, 1
call esi
shr eax, 0xf
and eax, 0xffffff01
push 0x10
mov dword [ebp - 0x14], eax
call esi
push 2
push 0xffffffffffffffff
shr eax, 0xf
push 0x100c
push dword [edi + 0x20]
and eax, 0xffffff01
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
test esi, esi
js 0x44b342
push 2
push esi
push 0x100c
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jns 0x44b342
push esi
mov ecx, edi
call fcn.0044a560
cmp eax, 0xffffffff
jne 0x44b25c
mov ecx, edi
call fcn.0044b61c
jmp 0x44b342
shl eax, 5
add eax, dword [edi + 8]
mov ecx, dword [eax]
mov eax, dword [edi + 0x14]
mov edx, dword [eax + ecx*4]
test bl, bl
je 0x44b27b
push edx
mov ecx, edi
call fcn.0044c552
jmp 0x44b342
mov ecx, dword [edx + 0x20]
mov eax, ecx
shr eax, 0xa
test al, 1
je 0x44b29a
mov edx, dword [str.link_openning_was_blocked_by_7_Zip]
mov ecx, dword [edi + 4]
call fcn.00445eb8
jmp 0x44b342
mov bl, 1
shr ecx, 4
test bl, cl
je 0x44b2b1
cmp byte [ebp - 0x10], 0
je 0x44b2af
cmp byte [ebp - 0x14], 0
je 0x44b2b1
xor bl, bl
lea eax, [edx + 0x28]
push eax
lea edx, [edi + 0x68]
lea ecx, [ebp - 0x2c]
call fcn.00402947
and dword [ebp - 4], 0
test bl, bl
je 0x44b2e0
push dword [edi + 4]
lea edx, [ebp - 0x2c]
lea ecx, [edi + 0x68]
call fcn.0044c6b1
push dword [ebp - 0x2c]
call fcn.00566e0e
jmp 0x44b341
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x20]
call fcn.004024ee
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.00405ff2
lea ecx, [ebp - 0x38]
call fcn.004025e6
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 2
push eax
mov ecx, edi
call fcn.0044b9e9
push dword [ebp - 0x38]
mov esi, eax
mov byte [ebp - 4], 1
call fcn.00566e0e
pop ecx
test esi, esi
je 0x44b330
push dword [ebp - 0x20]
mov ecx, dword [edi + 4]
mov edx, esi
call fcn.0044a5c8
push dword [ebp - 0x20]
call fcn.00566e0e
push dword [ebp - 0x2c]
call fcn.00566e0e
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x44b351
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
push 0x11
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esp + 0xc]
shr eax, 0xf
and al, 1
movzx edx, word [ecx + 0xc]
mov ecx, edx
sub ecx, 8
je 0x44b3d5
sub ecx, 0x26
je 0x44b3cc
sub ecx, 0x13
je 0x44b3be
sub ecx, 0x11
je 0x44b3b6
push 2
pop edi
sub ecx, 0x20
je 0x44b391
sub ecx, edi
je 0x44b391
sub ecx, 1
jne 0x44b3ba
test al, al
je 0x44b3ba
xor eax, eax
cmp edx, 0x74
jne 0x44b39f
inc eax
jmp 0x44b3a5
cmp edx, 0x75
cmove eax, edi
push eax
mov ecx, esi
call fcn.0044a0df
mov ecx, esi
call fcn.0044c4a8
jmp 0x44b3dc
test al, al
jne 0x44b3ad
xor al, al
jmp 0x44b3de
test al, al
je 0x44b3ba
lea ecx, [esi + 0x20]
call fcn.0044c507
jmp 0x44b3dc
mov ecx, esi
call fcn.0044abd8
jmp 0x44b3dc
mov ecx, esi
call fcn.0044b61c
mov al, 1
pop edi
pop esi
ret 4
Function at 0x44c5ba
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x56ed37
call fcn.00566e38
sub esp, 0x60
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x18]
push edx
call fcn.004024ee
xor ebx, ebx
lea ecx, [ebp - 0x18]
push 0x2e
mov dword [ebp - 4], ebx
call fcn.004039a5
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.004039d0
test esi, esi
js 0x44c5f6
cmp esi, eax
jge 0x44c5fe
lea ecx, [ebp - 0x18]
call fcn.00402c37
lea eax, [ebp - 0x18]
mov dword [ebp - 0x6c], 0x3c
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x68], 0x140
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
call fcn.004024ee
push edi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.004024ee
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp dword [ebp - 0x20], ecx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x24]
cmove eax, ecx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x6c]
push eax
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x34], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x34]
push dword [ebp - 0x24]
mov esi, dword [ebp - 0x4c]
mov dword [ecx], eax
call fcn.00566e0e
push dword [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.00566e0e
pop ecx
pop ecx
cmp esi, 0x20
ja 0x44c695
cmp esi, 0x1f
jne 0x44c690
push ebx
call fcn.00409191
mov ecx, dword [ebp + 8]
mov edx, eax
call fcn.0044a5c8
mov ebx, 0x80004005
push dword [ebp - 0x18]
call fcn.00566e0e
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x44e857
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x56efbe
call fcn.00566e38
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call fcn.004024ee
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [edi + 0xc]
call fcn.004024ee
lea eax, [esi + 0x18]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x18]
call fcn.004024ee
lea eax, [esi + 0x24]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x24]
call fcn.004024ee
lea eax, [esi + 0x30]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x30]
call fcn.004024ee
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x44e8c4
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x56efbe
call fcn.00566e38
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004025e6
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.004025e6
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004025e6
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.004025e6
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.004025e6
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x44fe28
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
sub esp, 0x60
mov eax, 0x56f345
call fcn.00566e38
sub esp, 0x2c
push ebx
push esi
push edi
mov ebx, ecx
lea ecx, [ebp]
push 0x57cb54
call fcn.0040256d
xor eax, eax
mov dword [ebp + 0x10], 0x450520
xor esi, esi
mov dword [ebp - 4], eax
inc esi
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x18], eax
mov eax, dword [0x5b3870]
push esi
push eax
mov dword [ebp + 0x1c], eax
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x7f84
push 0
mov dword [ebp + 0x20], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp + 0x24], eax
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0x28], 0x10
mov dword [ebp + 0x2c], 0x47
mov dword [ebp + 0x30], 0x57da28
call dword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x44ffcf
push 0x5b3c50
lea eax, [ebp + 0x63]
mov byte [ebp + 0x44], 0
mov edi, SysReAllocString
lea ecx, [ebp + 0x34]
push eax
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x5c], edi
call fcn.0046c1b2
cmp byte [ebp + 0x63], 0
je 0x44feec
mov ecx, dword [ebp + 0x34]
mov edx, dword [ebp + 0x3c]
mov eax, dword [ebp + 0x38]
sub edx, ecx
mov edi, dword [ebp + 0x40]
mov dword [ebp + 0x5c], ecx
sub edi, eax
mov dword [ebp + 0x54], eax
jmp 0x44feee
mov edx, edi
cmp byte [0x5b3c50], 0
je 0x44ff1a
mov eax, dword [ebp + 0x50]
mov dword [0x5b3c40], eax
mov eax, dword [ebp + 0x48]
cmp eax, esi
jb 0x44ff0b
cmp eax, 2
jbe 0x44ff10
mov eax, esi
mov dword [ebp + 0x48], eax
mov ecx, dword [ebp + 0x4c]
cmp ecx, 2
jb 0x44ff24
jmp 0x44ff1f
mov eax, esi
mov dword [ebp + 0x48], eax
xor ecx, ecx
mov dword [ebp + 0x4c], ecx
mov dword [0x5b3898], eax
xor eax, eax
push eax
push dword [0x5b3870]
mov dword [0x5b389c], ecx
push eax
push eax
push edi
push edx
push dword [ebp + 0x54]
push dword [ebp + 0x5c]
push 0xcf0000
push dword [ebp]
push 0x57da28
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
mov dword [ebp + 0x58], esi
test esi, esi
je 0x44ffcf
xor eax, eax
inc eax
cmp ebx, eax
je 0x44ff77
cmp ebx, 5
je 0x44ff77
cmp ebx, 0xa
je 0x44ff77
cmp ebx, 3
jne 0x44ff89
jmp 0x44ff80
cmp byte [ebp + 0x44], 0
je 0x44ff87
push 3
pop ebx
mov byte [0x5b3876], al
jmp 0x44ff89
mov ebx, eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x2c
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x44ffc2
cmp byte [ebp + 0x63], 0
je 0x44ffb2
lea esi, [ebp + 0x34]
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x58]
lea eax, [ebp - 0x38]
mov dword [ebp - 0x30], ebx
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowPlacement]
jmp 0x44ffca
push ebx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor esi, esi
inc esi
jmp 0x44ffd1
xor esi, esi
push dword [ebp]
call fcn.00566e0e
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add ebp, 0x64
leave
ret