joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ed1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404914
mov edi, dword [ebp + 8]
add edi, 0xffffff00
xor eax, eax
push ebp
push 0x44ee2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x83
xor ebx, ebx
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.00404724
test eax, eax
jle 0x44edfd
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x18]
add eax, 0x7d
xor edx, edx
push edx
push eax
lea eax, [ebx + 1]
cdq
call fcn.00405250
mov ebx, eax
mov eax, dword [ebp - 0x18]
add eax, 0x7d
xor edx, edx
push edx
push eax
xor eax, eax
mov al, byte [edi + ebx]
add eax, esi
cdq
call fcn.00405250
mov esi, eax
mov al, byte [edi + ebx]
mov dl, byte [edi + esi]
mov byte [edi + ebx], dl
mov byte [edi + esi], al
xor eax, eax
mov al, byte [edi + ebx]
xor edx, edx
mov dl, byte [edi + esi]
add eax, edx
mov edx, dword [ebp - 0x18]
add edx, 0x7d
mov ecx, edx
xor edx, edx
div ecx
mov al, byte [edi + edx]
mov byte [ebp - 0xd], al
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dl, byte [edx + ecx - 1]
mov cl, byte [ebp - 0xd]
xor dl, cl
call fcn.0040464c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
call fcn.0040472c
inc dword [ebp - 0xc]
dec dword [ebp - 0x1c]
jne 0x44ed77
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.004044b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ee35
lea eax, [ebp - 0x20]
call fcn.00404464
lea eax, [ebp - 0x14]
call fcn.00404464
lea eax, [ebp - 4]
call fcn.00404464
ret

Function at 0x44fc20
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404b44
test esi, esi
jne 0x44fc57
push 0x20a
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00404c30
jmp 0x44fc7e
call sub.kernel32.dll_GetCommandLineW
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.0044f9f0
mov dword [esp], eax
test esi, esi
je 0x44fc7e
mov eax, dword [ebx]
xor edx, edx
call fcn.00404cbc
je 0x44fc7e
dec esi
jmp 0x44fc5f
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x10002b2e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x20
pop ebp
jmp fcn.100016da

Function at 0x10006590
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [section..data]
cmp esi, 0xffffffff
jne 0x100065b3
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
mov dword [section..data], eax
cmp eax, 0xffffffff
je 0x100065f6
push esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
push eax
call fcn.10033f0b
add esp, 4
mov ebx, dword [sym.imp.kernel32.dll_TlsSetValue]
push 0
push esi
call ebx
push 0x14
call fcn.10033f0b
add esp, 4
mov edi, eax
push eax
push esi
call ebx
movaps xmm0, xmmword [0x10040c10]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret
xor edi, edi
jmp 0x100065de

Function at 0x100065fa
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
xorps xmm0, xmm0
movups xmmword [esp], xmm0
call fcn.10005b20
sub esp, 0x10
mov esi, dword [section..data]
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_TlsGetValue]
sub esp, 4
mov dword [esp], eax
call fcn.10033f0b
mov dword [esp], esi
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_TlsSetValue]
add esp, 8
pop esi
pop ebp
ret

Function at 0x100066a2
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [section..data]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x100066b7
pop ebp
ret
pop ebp
jmp fcn.10006590

Function at 0x10008df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008e1f
shl eax, 4
movsx esi, byte [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
inc edx
cmp ecx, edx
jne 0x10008e01
pop esi
pop edi
pop ebp
ret 8

Function at 0x10008f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
cmp edx, ecx
je 0x10008f61
shl eax, 4
movzx esi, word [edx]
add esi, eax
mov edi, esi
and edi, 0xf0000000
mov eax, edi
shr eax, 0x18
or eax, edi
xor eax, esi
add edx, 2
cmp ecx, edx
jne 0x10008f41
pop esi
pop edi
pop ebp
ret 8
Function at 0x10033f0b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10033f1a
pop dword [ebp - 0x48]
mov eax, 0x10033f1a
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x4b69a325
sub dword [ebp - 0x58], 0xfd175dda
mov dword [ebp - 0x54], 0x73145d31
add dword [ebp - 0x54], 0xbf1eef14
mov dword [ebp - 0x50], 0x29598b8e
add dword [ebp - 0x50], 0x22f2b8a0
mov dword [ebp - 0x4c], 0x65eb19b
add dword [ebp - 0x4c], 0xf9a14e65
lea eax, [ebp - 0x58]
push eax
mov eax, 0x5d3b90ba
add eax, 0xb2c93e26
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x1dc14ae2
add dword [ebp - 0x58], 0x56b11e74
mov dword [ebp - 0x54], 0xcd96e393
add dword [ebp - 0x54], 0x73d57de2
mov dword [ebp - 0x50], 0x495cfe8e
sub dword [ebp - 0x50], 0xe5ed9222
mov dword [ebp - 0x4c], 0xc36abf1e
sub dword [ebp - 0x4c], 0xc36abf1e
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x926c531c
sub eax, 0x82678498
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3cf45
push 0
call eax
mov ecx, 0xf5e19949
sub ecx, 0xf5e15c29
mov esi, eax
mov edi, 0xa7c94ff4
sub edi, 0x97c39bf4
add edi, dword [ebp - 0x48]
mov ebx, 0x905aed59
sub dword [ebp - 0x10], 0x2e32f7ca
mov edx, dword [edi]
mov dword [ebp - 0x10], 0xcd772c03
xor edx, ebx
sub dword [ebp - 0x10], edi
mov dword [esi], edx
add dword [ebp - 0x10], edi
add esi, 0x6a8bc750
add esi, 0x957438b4
add edi, 0x6eb7894d
sub edi, 0x6eb78949
loop 0x10034031
add eax, 0x780fee86
sub eax, 0x780f0733
mov ebx, eax
add eax, 0x2c39f889
sub eax, 0x2c39f884
mov ecx, 0xf73c5549
sub ecx, 0xe73c5549
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x5347f34
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
mov ecx, 0x2e0b4e5f
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x41c3f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41c41d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41c41d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x41b934
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.004ad8b0
mov dword [esp], 0xc8
mov dword [esp + 4], 0x96
push 0
call fcn.004987a1
mov ebx, eax
push 0
call fcn.00498ab8
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 8], ebx
push 0
call fcn.00498810
mov ebx, eax
push 0
call fcn.00498b35
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp + 4]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 0xc], ebx
push 0x80000004
push dword [0x15b6fb4]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x60
call fcn.004981ec
push 0xb
push 0x67
call fcn.004a6866
push eax
push 0x1a
push 0xaa
push 0xf
push 0xf
push 0x63
call fcn.00492810
push 0xb
push 0x65
call fcn.004a6866
push eax
push 0x1a
push 0xaa
push 0x2d
push 0xf
push 0x61
call fcn.00492810
push 0xb
push 0x66
call fcn.004a6866
push eax
push 0x1a
push 0xaa
push 0x4b
push 0xf
push 0x62
call fcn.00492810
push dword [0x15b70f0]
push 0x14
push 0xaa
push 0x78
push 0xf
push 0x64
call fcn.00490076
call fcn.0044063c
call fcn.004981e4
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x41bb28
call fcn.0049bc65
push eax
mov ebx, 0x60
cmp ebx, dword [esp]
jne 0x41bb25
push dword [esp + 0x20]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x41bb24
call fcn.0049bc56
push eax
mov ebx, 0x63
cmp ebx, dword [esp]
jne 0x41baf2
mov eax, 0x53bc6e
push eax
call fcn.0046eb32
add esp, 0xc
jmp 0x41bb7f
mov ebx, 0x61
cmp ebx, dword [esp]
jne 0x41bb03
add esp, 0xc
jmp 0x41bb7f
mov ebx, 0x62
cmp ebx, dword [esp]
jne 0x41bb14
add esp, 0xc
jmp 0x41bb7f
mov ebx, 0x64
cmp ebx, dword [esp]
jne 0x41bb23
add esp, 0xc
jmp 0x41bb7f
pop eax
pop eax
pop eax
jmp 0x41bb32
push 0x60
call fcn.004981c6
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x41bb56
call fcn.00498b43
mov ebx, eax
cmp ebx, 0x60
jne 0x41bb56
call fcn.0044063c
jmp 0x41bb7f
push 0xd
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x41bb7a
call fcn.00498b43
mov ebx, eax
cmp ebx, 0x60
jne 0x41bb7a
call fcn.0044063c
jmp 0x41bb7f
jmp 0x41ba9f
push 0x60
call fcn.00497f76
xor eax, eax
add esp, 0x10
pop edi
pop ebx
ret 4
Function at 0x44b86d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.004ad8b0
mov dword [esp], 0
jmp 0x44b880
mov eax, dword [esp + 0x10]
cmp eax, dword [esp]
jl 0x44b939
push 0
call fcn.004980a7
and eax, eax
je 0x44b930
mov dword [esp + 4], 0xffffffff
call fcn.004518f8
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
and ebx, ebx
jle 0x44b8ff
call fcn.0049bc65
push eax
mov ebx, dword [0x15b7110]
cmp ebx, dword [esp]
jne 0x44b8da
push dword [esp + 8]
call fcn.0044a3e4
mov ebx, eax
and ebx, ebx
jne 0x44b8d8
jmp 0x44b8fc
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x44b8f2
push dword [esp + 8]
call fcn.0043cfbd
mov ebx, eax
and ebx, ebx
jne 0x44b8f0
jmp 0x44b8fc
push 3
call fcn.00497d8b
pop eax
jmp 0x44b909
push 5
call fcn.00497d8b
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x44b926
mov dword [0x15b70c4], 1
jmp 0x44b930
mov dword [0x15b70c4], 0
inc dword [esp]
jno 0x44b880
xor eax, eax
add esp, 8
pop ebx
ret 4
Function at 0x450cf5
Capabilities:
Query environment variable

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.004ad8b0
push dword [esp + 0x1c]
call fcn.00453470
mov edx, dword [esp + 0x18]
lea ecx, [esp]
call fcn.00453000
push edx
call fcn.004ad710
pop edx
push eax
push edx
call fcn.004ad710
pop edx
push eax
push 0x3e8
call fcn.004ab170
call fcn.004ad840
lea eax, [esp + 8]
push eax
call fcn.004ad750
push 0x3e8
mov eax, dword [esp + 8]
push eax
mov eax, 0x54787e
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov edx, 0x5370c4
lea ecx, [esp + 8]
call fcn.00453008
push edx
call fcn.004ad710
pop edx
push eax
push 0xe
mov edx, dword [esp + 0xc]
push edx
call fcn.004ad710
pop edx
push eax
push edx
call fcn.004ad7e0
mov edx, 0x544660
push edx
call fcn.004ad7e0
call fcn.004ad840
push edx
call fcn.004ad710
pop edx
push eax
mov edx, 0x53e66a
push edx
call fcn.004ad7e0
mov edx, dword [esp + 0x10]
push edx
call fcn.004ad7e0
call fcn.004ad840
mov edx, dword [esp + 0x14]
push edx
call fcn.004ad710
pop edx
push eax
push edx
call fcn.004ad7e0
mov edx, 0x53cbb8
push edx
call fcn.004ad7e0
call fcn.00453452
add dword [esp], edx
call fcn.00453452
add dword [esp + 4], edx
call fcn.00453452
add dword [esp + 8], edx
call fcn.0046e5e4
call fcn.00453470
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x450e83
push dword [esp + 0xc]
call fcn.0046ed10
and eax, eax
je 0x450e7a
push dword [esp + 0xc]
call fcn.0046ed57
and eax, eax
je 0x450e78
mov edx, dword [esp + 8]
push edx
call fcn.004ad710
pop edx
push eax
push edx
call fcn.004ad7e0
push edx
call fcn.004ad710
pop edx
push eax
push edx
call fcn.004ad710
pop edx
push eax
push edx
call fcn.004ad710
pop edx
push eax
push 0x18
push dword [esp + 0x20]
call fcn.0046ed7d
call fcn.00453452
add dword [esp], edx
call fcn.0042a8ae
pop eax
mov edx, 0x54d788
push edx
call fcn.004ad7e0
lea eax, [esp + 0xc]
push eax
call fcn.004ad750
jmp 0x450e03
push dword [esp + 0xc]
call fcn.0046edb6
mov edx, dword [esp + 8]
push edx
call fcn.004ad710
pop edx
push eax
push edx
call fcn.004ad7e0
pop eax
push eax
call fcn.00453440
pop edx
add eax, edx
jmp 0x450eab
push dword [esp]
call fcn.004ad910
push dword [esp + 4]
call fcn.004ad910
push dword [esp + 8]
call fcn.004ad910
add esp, 0x10
pop ebx
ret 4
Function at 0x4519c8
Capabilities:
Delete registry key

Disassembly:
push ebx
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4519ce
call fcn.004ad8b0
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.00453000
mov edx, dword [esp + 0x28]
lea ecx, [esp + 4]
call fcn.00453000
push dword [esp]
call fcn.00451b4f
push dword [esp + 4]
mov edx, 0x538660
pop ecx
call fcn.00453400
je 0x451a9d
cmp dword [0x15b71f0], 0
je 0x451a83
mov eax, 0x537cbc
push eax
push 0xffffffff
call fcn.0048f5e0
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x451a81
mov eax, 0x5476a8
push eax
push dword [esp + 0xc]
call fcn.0048f63a
mov dword [esp + 0xc], eax
push 0
mov ebx, dword [0x15b71f4]
or ebx, 0xf003f
push ebx
mov eax, dword [0x15b71e4]
push eax
push dword [0x15b71ec]
push dword [esp + 0x1c]
call fcn.0048f696
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.0048f520
jmp 0x451a98
mov eax, dword [0x15b71e4]
push eax
push dword [0x15b71ec]
call sub.ADVAPI32.dll_RegDeleteKeyW
mov dword [esp + 0x10], eax
jmp 0x451b26
lea eax, [esp + 0x18]
push eax
push dword [0x15b71ec]
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x15b71f0], 0
je 0x451b13
mov eax, 0x537cbc
push eax
push 0xffffffff
call fcn.0048f5e0
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x451b11
push 0
mov ebx, dword [0x15b71f4]
or ebx, 0xf003f
push ebx
mov eax, dword [0x15b71e4]
push eax
push dword [esp + 0x24]
mov eax, 0x5476a8
push eax
push dword [esp + 0x1c]
call fcn.0048f6f3
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.0048f520
jmp 0x451b26
mov eax, dword [0x15b71e4]
push eax
push dword [esp + 0x1c]
call sub.ADVAPI32.dll_RegDeleteKeyW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x451b35
mov eax, 1
jmp 0x451b37
xor eax, eax
push dword [esp + 4]
call fcn.004ad910
push dword [esp]
call fcn.004ad910
add esp, 0x1c
pop ebx
ret 8
Function at 0x451d51
Capabilities:
Get graphical window text

Disassembly:
push ebx
xor eax, eax
push eax
call fcn.004ad8b0
push dword [esp + 0xc]
call fcn.00453470
mov ebx, dword [0x15b722c]
and ebx, ebx
jne 0x451d8d
push 0
push 0
call sub.USER32.dll_FindWindowW
mov dword [0x15b7230], eax
mov dword [0x15b722c], 1
jmp 0x451da2
push 2
push dword [0x15b7230]
call sub.USER32.dll_GetWindow
mov dword [0x15b7230], eax
mov ebx, dword [0x15b7230]
and ebx, ebx
je 0x451e3c
push 0xfffffff0
push dword [0x15b7230]
call sub.USER32.dll_GetWindowLongW
mov ebx, eax
and ebx, 0x10000000
cmp ebx, 0x10000000
jne 0x451e3a
push 0xffffffec
push dword [0x15b7230]
call sub.USER32.dll_GetWindowLongW
mov ebx, eax
and ebx, 0x80
cmp ebx, 0x80
je 0x451e3a
push edx
call fcn.004ad710
pop edx
push eax
push edx
call fcn.004ad710
pop edx
push eax
push 0x100
call fcn.004ab170
lea eax, [esp + 4]
push eax
call fcn.004ad750
push 0x100
push dword [esp + 4]
push dword [0x15b7230]
call sub.USER32.dll_GetWindowTextW
push dword [esp]
mov edx, 0x5370c4
pop ecx
call fcn.00453400
jne 0x451e3a
jmp 0x451e54
jmp 0x451e46
mov dword [0x15b722c], 0
mov ebx, dword [0x15b7230]
and ebx, ebx
jne 0x451d63
mov edx, dword [esp]
push edx
call fcn.004ad710
pop edx
push eax
push edx
call fcn.004ad7e0
pop eax
push eax
call fcn.00453440
pop edx
add eax, edx
jmp 0x451e7b
push dword [esp]
call fcn.004ad910
add esp, 4
pop ebx
ret

Function at 0x451e88
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
mov edx, 0x19
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x451e8f
call fcn.004ad8b0
mov edx, dword [esp + 0x70]
lea ecx, [esp]
call fcn.00453000
lea eax, [esp + 4]
lea eax, [esp + 0x48]
lea ebp, [esp + 4]
mov dword [ebp], 0x44
mov dword [ebp + 0x2c], 1
mov ebx, dword [esp + 0x74]
and ebx, 2
and ebx, ebx
je 0x451ede
lea ebp, [esp + 4]
mov word [ebp + 0x30], 0
jmp 0x451ee8
lea ebp, [esp + 4]
mov word [ebp + 0x30], 1
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
push 0
call sub.KERNEL32.dll_CreateProcessW
mov dword [esp + 0x58], eax
cmp dword [esp + 0x58], 0
je 0x451f71
mov ebx, dword [esp + 0x74]
and ebx, 1
and ebx, ebx
je 0x451f68
lea ebp, [esp + 0x48]
push dword [ebp + 4]
pop eax
mov dword [esp + 0x5c], eax
push 1
call fcn.00497d8b
lea eax, [esp + 0x60]
push eax
push dword [esp + 0x60]
call sub.KERNEL32.dll_GetExitCodeThread
mov ebx, dword [esp + 0x60]
cmp ebx, 0x103
je 0x451f66
jmp 0x451f68
jmp 0x451f40
lea ebp, [esp + 0x48]
mov eax, dword [ebp]
jmp 0x451f73
xor eax, eax
push dword [esp]
call fcn.004ad910
add esp, 0x64
pop ebx
pop ebp
ret 8
Function at 0x451f9c
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
push ebx
mov edx, 0xd
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x451fa3
call fcn.004ad8b0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.dll_OpenProcessToken
and eax, eax
je 0x45205d
lea eax, [esp + 8]
lea eax, [esp + 8]
push eax
mov eax, 0x53f536
push eax
push 0
call sub.ADVAPI32.dll_LookupPrivilegeValueW
and eax, eax
je 0x452054
lea eax, [esp + 0x10]
lea ebp, [esp + 0x10]
mov dword [ebp], 1
lea ebp, [esp + 8]
push dword [ebp]
lea ebp, [esp + 0x14]
push ebp
pop ebp
pop eax
mov dword [ebp + 4], eax
lea ebp, [esp + 8]
push dword [ebp + 4]
lea ebp, [esp + 0x14]
push ebp
pop ebp
pop eax
mov dword [ebp + 8], eax
push ebp
pop ebp
mov dword [ebp + 0xc], 2
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x24]
push eax
push 0x10
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x18]
call sub.ADVAPI32.dll_AdjustTokenPrivileges
push eax
pop eax
mov byte [esp], al
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
movsx eax, byte [esp]
movsx eax, al
jmp 0x452068
add esp, 0x34
pop ebx
pop ebp
ret

Function at 0x453db4
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x453e4c
push edi
push 0x1630994
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x15b730c]
test edi, edi
je 0x453e20
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x453e19
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x15b730c
call fcn.004ad631
pop ecx
pop ecx
jmp 0x453e1b
mov edi, dword [edi]
test edi, edi
jne 0x453df0
pop ebx
mov eax, dword [0x15b340c]
mov esi, eax
inc eax
push 0x10
push 0x15b730c
mov dword [0x15b340c], eax
call fcn.004ad671
pop ecx
pop ecx
push 0x1630994
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x453e54
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push edi
call fcn.00453c58
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, 0x1630994
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x15b730c]
jmp 0x453e85
cmp dword [esi + 0xc], edi
je 0x453e8b
mov esi, dword [esi]
test esi, esi
jne 0x453e7e
jmp 0x453ea3
add esi, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0x15b730c
call fcn.004ad631
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret 4
Function at 0x4541a3
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x4541f8
push dword [esp + 0x10]
push 0x454122
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x15b7318]
test esi, esi
je 0x454251
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x4541f0
cmp byte [esi + 0x10], 0
je 0x4541f0
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x4541cc
jmp 0x454251
mov esi, dword [0x15b7318]
test esi, esi
je 0x454251
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x45424a
cmp byte [esi + 0x11], 0
je 0x454226
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x45423d
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x15b7318
call fcn.004ad631
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x454205
pop ebp
pop edi
pop esi
pop ebx
ret 4