joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cae8
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
xor ebx, ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41cd25
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.00407aec
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ebx, eax
test ebx, ebx
jne 0x41cbbf
cmp dword [ebp - 0x14], 0
jne 0x41cbbf
xor edx, edx
mov eax, 6
call fcn.00424870
test al, al
je 0x41cbbf
push 2
push 0x104
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFinalPathNameByHandleW
test eax, eax
jbe 0x41cbbf
lea eax, [ebp - 0x22c]
lea edx, [ebp - 0x224]
mov ecx, 0x106
call fcn.00408a2c
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x228]
call fcn.0041c8cc
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp - 8]
call fcn.00407ecc
mov byte [ebp - 9], 1
jmp 0x41cd07
test ebx, ebx
jne 0x41cbcd
cmp dword [ebp - 0x14], 0
je 0x41ccbb
push 0
push 1
push 0
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3ee
je 0x41ccbb
xor eax, eax
push ebp
push 0x41ccb4
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41cc9d
xor eax, eax
push ebp
push 0x41cc96
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
call sub.kernel32.dll_GetCurrentProcess
lea ecx, [ebp - 0x224]
mov edx, dword [ebp - 0x18]
call fcn.0040ef14
test eax, eax
jbe 0x41cc7f
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x224]
mov ecx, 0x106
call fcn.00408a2c
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x230]
call fcn.0041c8cc
mov edx, dword [ebp - 0x230]
mov eax, dword [ebp - 8]
call fcn.00407ecc
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cc9d
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ccbb
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
cmp byte [ebp - 9], 0
jne 0x41cd07
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 4]
call fcn.0041ca04
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 8]
call fcn.00407ecc
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x41cd07
lea edx, [ebp - 0x23c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0041c8cc
mov edx, dword [ebp - 0x23c]
mov eax, dword [ebp - 8]
call fcn.00407ecc
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cd2c
lea eax, [ebp - 0x23c]
mov edx, 6
call fcn.00407b4c
ret
Function at 0x41cd38
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov byte [ebp - 1], 0
xor edx, edx
mov eax, 6
call fcn.00424870
test al, al
je 0x41ce00
xor edx, edx
mov eax, ebx
call fcn.0041e4e4
test al, al
je 0x41ce00
mov eax, ebx
call fcn.0041e2b4
test al, 0x20
je 0x41ce00
mov eax, ebx
call fcn.00408980
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x41ce00
test ah, 4
je 0x41ce00
test al, 0x10
je 0x41cd9f
mov edi, 0x2000000
jmp 0x41cda1
xor edi, edi
push 0
push edi
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.00408980
push eax
call sub.kernel32.dll_CreateFileW_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x41ce00
xor eax, eax
push ebp
push 0x41cdf9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, esi
mov ecx, edi
mov eax, dword [ebp - 8]
call fcn.0041cae8
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ce00
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x41d1ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x41d205
test eax, edx
je 0x41d208
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41d1c3
movzx eax, word [eax]
sub eax, ecx
jmp 0x41d1ea
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x41d1eb
add ecx, 4
js 0x41d1db
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x41d1e8
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x41d1ea
xor eax, eax
ret
test eax, eax
je 0x41d214
test edx, edx
jne 0x41d1b4
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x41e2b4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x41e3e8
push dword fs:[eax]
mov dword fs:[eax], esp
movzx ebx, byte [0x41e3f8]
mov dl, 1
mov eax, esi
call fcn.0041e57c
test al, al
jne 0x41e305
mov dl, 1
mov eax, esi
call fcn.0041e4e4
test al, al
je 0x41e39b
lea edx, [ebp - 0x424]
mov eax, esi
call fcn.0041ed0c
mov eax, dword [ebp - 0x424]
lea edx, [ebp - 4]
call fcn.00424d38
push 0x104
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 4]
call fcn.00408980
mov esi, eax
push esi
call sub.kernel32.dll_GetVolumeInformationW
test eax, eax
je 0x41e396
test byte [ebp - 0xc], 1
je 0x41e361
or bl, 1
test byte [ebp - 0xc], 2
je 0x41e36a
or bl, 2
test byte [ebp - 0xc], 0x80
je 0x41e373
or bl, 0x20
push esi
call sub.kernel32.dll_GetDriveTypeW
sub eax, 2
je 0x41e387
dec eax
je 0x41e38c
dec eax
je 0x41e391
dec eax
jne 0x41e3c2
or bl, 0x10
jmp 0x41e3c2
or bl, 4
jmp 0x41e3c2
or bl, 8
jmp 0x41e3c2
call fcn.004256dc
lea edx, [ebp - 0x428]
mov eax, dword [0x50abf0]
call fcn.0040bda0
mov ecx, dword [ebp - 0x428]
mov dl, 1
mov eax, dword [0x419608]
call fcn.00423c18
call fcn.004071e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e3ef
lea eax, [ebp - 0x428]
mov edx, 2
call fcn.00407b4c
lea eax, [ebp - 4]
call fcn.00407aec
ret

Function at 0x41e4e4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.00408980
mov edi, eax
push edi
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x41e54e
test ah, 4
je 0x41e547
test bl, bl
jne 0x41e50c
mov al, 1
jmp 0x41e575
test al, 0x10
je 0x41e514
xor eax, eax
jmp 0x41e575
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push edi
call sub.kernel32.dll_CreateFileW_1
cmp eax, 0xffffffff
je 0x41e538
push eax
call sub.kernel32.dll_CloseHandle_1
mov al, 1
jmp 0x41e575
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 0x20
sete al
jmp 0x41e575
test al, 0x10
sete al
jmp 0x41e575
call sub.kernel32.dll_GetLastError_2
mov ebx, eax
cmp ebx, 2
je 0x41e56f
cmp ebx, 3
je 0x41e56f
cmp ebx, 0x7b
je 0x41e56f
mov eax, esi
call fcn.0041e4a4
test al, al
jne 0x41e573
xor eax, eax
jmp 0x41e575
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x41e57c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], dl
mov edi, eax
xor ebx, ebx
mov eax, edi
call fcn.00408980
mov ebp, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x41e623
test esi, 0x400
jne 0x41e5b8
test esi, 0x10
setne bl
jmp 0x41e642
cmp byte [esp], 0
je 0x41e5ec
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.kernel32.dll_CreateFileW_1
cmp eax, 0xffffffff
je 0x41e642
push eax
call sub.kernel32.dll_CloseHandle_1
test esi, 0x10
setne bl
jmp 0x41e642
test esi, 0x10
je 0x41e5f8
mov bl, 1
jmp 0x41e642
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
push ebp
call sub.kernel32.dll_CreateFileW_1
cmp eax, 0xffffffff
je 0x41e61f
push eax
call sub.kernel32.dll_CloseHandle_1
xor ebx, ebx
jmp 0x41e642
mov bl, 1
jmp 0x41e642
call sub.kernel32.dll_GetLastError_2
cmp eax, 2
je 0x41e63c
cmp eax, 3
je 0x41e63c
cmp eax, 0x7b
je 0x41e63c
cmp eax, 0x35
jne 0x41e640
xor ebx, ebx
jmp 0x41e642
mov bl, 1
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41e7ac
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x41e851
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00408980
push eax
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
test edi, 0x400
setne al
test al, bl
je 0x41e836
or edi, 0xffffffff
lea edx, [ebp - 4]
mov eax, esi
call fcn.0041cd38
test al, al
je 0x41e836
mov eax, dword [ebp - 4]
call fcn.0041eef0
test al, al
je 0x41e826
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.0041ec70
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00424d38
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.00408bdc
mov eax, dword [ebp - 4]
call fcn.00408980
push eax
call sub.kernel32.dll_GetFileAttributesW
mov edi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e858
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407b4c
ret
Function at 0x41e864
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41e937
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00407f14
cmp byte [ebp - 9], 0
je 0x41e8f5
mov eax, ebx
call fcn.00408980
push eax
call sub.kernel32.dll_GetFileAttributesW
test ah, 4
je 0x41e8f5
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0041cd38
test al, al
je 0x41e8f5
mov eax, dword [ebp - 8]
call fcn.0041eef0
test al, al
je 0x41e8ea
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0041ec70
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00424d38
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
call fcn.00408bdc
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00407f14
push edi
mov eax, dword [ebp - 4]
call fcn.00408980
push eax
call sub.kernel32.dll_SetFileAttributesW
test eax, eax
jne 0x41e90f
call sub.kernel32.dll_GetLastError_2
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e93e
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407b4c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407b4c
ret

Function at 0x41ea60
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.00408980
mov ebp, eax
push ebp
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x41eab5
call sub.kernel32.dll_GetLastError_2
mov edi, eax
push ebp
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x41eaaf
test ah, 4
je 0x41eaaf
test al, 0x10
je 0x41eaaf
mov eax, esi
call fcn.00408980
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x41eab5
push edi
call sub.kernel32.dll_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x422d94
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x422dcd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.00407c74
jmp 0x422dd6
mov eax, ebx
mov edx, esi
call fcn.00407ecc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x422de0
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x422e02
movzx eax, word [esp]
jmp 0x422e04
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x423ac8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x423bed
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.004238d0
mov esi, eax
mov eax, dword [0x50ab54]
cmp byte [eax], 0
je 0x423b95
mov eax, dword [0x50a8a8]
call fcn.00404fa4
call fcn.00404710
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x423a98]
call fcn.00409f44
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x423c08
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x423bd1
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x50a844]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x50dc50]
call fcn.0040a260
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423bf4
lea eax, [ebp - 4]
mov edx, dword [0x423a98]
call fcn.0040a068
ret

Function at 0x425dac
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00408a2c
add esp, 0x800
pop ebx
ret

Function at 0x44c0e0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x44c17e
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xc]
je 0x44c142
cmp byte [ebx + 0x10], 0
jne 0x44c142
cmp byte [ebx + 0x3c], 0
jne 0x44c142
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xc], 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x44c163
lea edx, [ebp - 4]
mov eax, dword [0x50aadc]
call fcn.0040bda0
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x43dfd8]
call fcn.00423c18
call fcn.004071e4
jmp 0x44c163
lea edx, [ebp - 8]
mov eax, dword [0x50aadc]
call fcn.0040bda0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x43dfd8]
call fcn.00423c18
call fcn.004071e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c185
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407b4c
ret
Function at 0x44c4a4
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xe]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x44c4f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0044c018
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44c50b
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x44c514
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0044c018
dec esi
jne 0x44c536
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x44da04
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x510010
cmp dword [edi], 0
jne 0x44da80
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x51000c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x508960
mov ecx, 2
call fcn.00404798
mov edx, 0x44d9dc
lea eax, [esi + 5]
call fcn.0044d9fc
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0044d9fc
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x44da55
mov dword [0x51000c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x45dd8c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
lea eax, [ebp - 8]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
xor eax, eax
push ebp
push 0x45ddda
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x45ddf8
mov eax, dword [ebp - 8]
call fcn.0045dce8
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45dde1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret

Function at 0x45df6c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45e09f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x45e077
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00405008
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
movzx eax, word [ebx + 0x18]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 4]
mov edx, dword [ebx + 8]
call fcn.00407f14
lea eax, [ebp - 0x60]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00408d4c
mov eax, dword [ebp - 0x60]
mov edx, 0x45e0c0
call fcn.00408d14
je 0x45e00e
push 0x45e0c0
push dword [ebp - 4]
push 0x45e0c0
lea eax, [ebp - 4]
mov edx, 3
call fcn.00408c64
cmp dword [ebx + 0x14], 0
je 0x45e02c
push dword [ebp - 4]
push 0x45e0d0
push dword [ebx + 0x14]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00408c64
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00408980
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x45e06d
mov eax, dword [ebp - 0x58]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebx + 0xc], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45e081
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e0a6
lea eax, [ebp - 0x60]
call fcn.00407aec
lea eax, [ebp - 4]
call fcn.00407aec
ret
Function at 0x45e5f0
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov edi, 0x5100cc
mov byte [ebp - 1], 0
xor edx, edx
push ebp
push 0x45e769
push dword fs:[edx]
mov dword fs:[edx], esp
test esi, esi
jne 0x45e625
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45e773
call fcn.0045dd8c
push esi
push 0
push 0x100001
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45e64d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45e773
xor edx, edx
push ebp
push 0x45e758
push dword fs:[edx]
mov dword fs:[edx], esp
test bl, bl
je 0x45e726
push 0x64
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitForInputIdle
push 0
mov eax, edi
mov ecx, 1
mov edx, dword [0x45e558]
call fcn.00409f44
add esp, 4
push esi
push 0x45e580
call sub.user32.dll_EnumWindows
mov dword [ebp - 0xc], 0x79
mov eax, dword [edi]
call fcn.00409d90
test eax, eax
je 0x45e726
mov eax, dword [edi]
call fcn.00409d90
mov esi, eax
dec esi
test esi, esi
jl 0x45e6ee
inc esi
xor ebx, ebx
push 0
push 0
push 0x10
mov eax, dword [edi]
mov eax, dword [eax + ebx*4]
push eax
call sub.user32.dll_PostMessageW
push 0
push 0
push 0x11
mov eax, dword [edi]
mov eax, dword [eax + ebx*4]
push eax
call sub.user32.dll_PostMessageW
push 0
push 1
push 0x16
mov eax, dword [edi]
mov eax, dword [eax + ebx*4]
push eax
call sub.user32.dll_PostMessageW
inc ebx
dec esi
jne 0x45e6b7
push 0x19
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WaitForSingleObject
push 1
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x45e71d
mov byte [ebp - 1], 1
call fcn.004072d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45e773
dec dword [ebp - 0xc]
jne 0x45e697
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e75f
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret