joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4424a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
and byte [ecx + 0xc], 0xfc
mov esi, ecx
add ecx, 0x10
call fcn.004520d0
mov edi, dword [esi + 0x34]
lea ecx, [esi + 0x34]
push dword [edi + 4]
push ecx
call fcn.00442760
mov dword [edi + 4], edi
mov dword [edi], edi
mov dword [edi + 8], edi
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], 0x400
mov eax, dword [ecx + 4]
mov dword [eax], 0
mov eax, dword [ecx]
test eax, eax
je 0x442523
nop dword [eax + eax]
mov edi, dword [eax]
push 0xc
push eax
call fcn.0047834a
add esp, 8
test edi, edi
mov eax, edi
jne 0x442510
mov eax, dword [esi + 0x50]
mov dword [eax], eax
mov eax, dword [esi + 0x50]
mov dword [eax + 4], eax
mov dword [esi + 0x54], 0
mov edx, dword [esi + 0x58]
mov eax, dword [esi + 0x5c]
cmp edx, eax
je 0x442599
mov ebx, eax
mov ecx, dword [esi + 0x50]
sub ebx, edx
add ebx, 0xfffffffc
shr ebx, 2
inc ebx
cmp ebx, 8
jae 0x442556
mov edi, edx
jmp 0x442590
movd xmm0, ecx
mov dword [ebp - 0x14], ebx
and ebx, 0xfffffff8
lea edi, [edx + ebx*4]
pshufd xmm0, xmm0, 0
add edx, 0x10
mov dword [ebp - 0x10], ebx
nop
movdqu xmmword [edx - 0x10], xmm0
movdqu xmmword [edx], xmm0
add edx, 0x20
add ebx, 0xfffffff8
jne 0x442570
mov edx, dword [ebp - 0x10]
cmp dword [ebp - 0x14], edx
je 0x442599
nop dword [eax]
mov dword [edi], ecx
add edi, 4
cmp eax, edi
jne 0x442590
lea ecx, [esi + 0x6c]
call fcn.004425c0
lea ecx, [esi + 0x78]
call fcn.00442660
add esi, 0x98
mov ecx, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00442660
Function at 0x444d10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [0x56600c]
mov ebx, dword [ebp + 8]
xor eax, ebp
cmp ebx, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x444de6
mov eax, dword [ecx + 0x20]
mov esi, ecx
cmp dword [eax], 0
je 0x444d56
mov eax, dword [esi + 0x30]
mov ecx, dword [eax]
test ecx, ecx
jle 0x444d56
dec ecx
mov dword [eax], ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
lea edx, [ecx + 1]
mov dword [eax], edx
mov byte [ecx], bl
jmp 0x444e35
cmp dword [esi + 0x4c], 0
je 0x444dea
mov eax, dword [esi + 0xc]
lea ecx, [esi + 0x3c]
cmp dword [eax], ecx
jne 0x444d7e
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x444df1
mov byte [ebp - 0x31], bl
lea edx, [ebp - 0x3c]
lea edi, [esi + 0x40]
mov eax, dword [ecx]
push edx
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp - 0x38]
push edx
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp - 0x31]
push edx
push edi
call dword [eax + 0x1c]
mov ecx, 0xffffffff
cmp eax, 2
jae 0x444e16
mov edi, dword [ebp - 0x3c]
lea eax, [ebp - 0x30]
sub edi, eax
je 0x444dd5
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004e0cf6
mov ecx, 0xffffffff
add esp, 0x10
cmp edi, eax
jne 0x444e33
mov byte [esi + 0x3d], 1
lea eax, [ebp - 0x31]
cmp dword [ebp - 0x38], eax
mov eax, 0xffffffff
jmp 0x444e2e
xor ebx, ebx
jmp 0x444e35
mov ebx, 0xffffffff
jmp 0x444e35
movsx eax, bl
push dword [esi + 0x4c]
push eax
call fcn.004e41c1
add esp, 8
mov ecx, dword [ebp - 0x10]
mov esi, eax
cmp eax, 0xffffffff
cmovne esi, ebx
xor ecx, ebp
call fcn.00478339
mov eax, esi
jmp 0x444e41
cmp eax, 3
jne 0x444e33
movsx eax, byte [ebp - 0x31]
push dword [esi + 0x4c]
push eax
call fcn.004e41c1
add esp, 8
cmp eax, 0xffffffff
cmove ebx, eax
mov ecx, ebx
mov ebx, ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00478339
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x445390
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
cmp dword [ecx + 0x38], 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], edx
je 0x44546a
cmp ebx, 1
mov eax, esi
mov edx, ebx
sbb eax, 0
jl 0x44550d
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp + 0x10]
mov edx, ebx
jmp 0x445412
mov dword [ebp - 0x1c], ebx
push edi
mov ebx, dword [ebp - 0x14]
push ebx
push eax
call fcn.004d3ae0
add esp, 0xc
mov ecx, dword [ebp - 0x10]
add ebx, edi
sub esi, edi
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x18]
mov edx, esi
mov eax, dword [ecx + 0x30]
sbb ebx, dword [ebp - 0x1c]
sub dword [eax], edi
mov eax, dword [ecx + 0x20]
mov esi, ebx
add dword [eax], edi
mov edi, ecx
mov eax, edx
neg eax
mov eax, 0
sbb eax, esi
jge 0x44550d
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x18], esi
mov eax, dword [eax]
test eax, eax
je 0x445440
mov ecx, dword [edi + 0x30]
mov ecx, dword [ecx]
test ecx, ecx
jle 0x445440
mov ebx, esi
mov esi, edx
mov edx, ecx
sar edx, 0x1f
cmp ecx, esi
mov edi, edx
sbb edi, ebx
mov edi, esi
jge 0x4453d0
mov ebx, edx
mov edi, ecx
jmp 0x4453d0
mov ebx, dword [ebp - 0x14]
mov esi, edx
mov edx, dword [edi]
mov ecx, edi
movzx eax, byte [ebx]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x445508
mov edx, esi
mov esi, dword [ebp - 0x18]
inc ebx
add edx, 0xffffffff
mov dword [ebp - 0x14], ebx
adc esi, 0xffffffff
jmp 0x445401
mov eax, dword [ecx + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x4454ce
cmp ebx, 1
mov ecx, esi
sbb ecx, 0
jl 0x4454ce
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx]
test ecx, ecx
jle 0x4454ce
mov edx, ecx
mov edi, ecx
sar edx, 0x1f
cmp ebx, ecx
mov ecx, esi
sbb ecx, edx
cmovl edi, ebx
cmovl edx, esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edi
push edi
mov edi, dword [ebp + 8]
push edi
push eax
call fcn.004d3ae0
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ecx + 0x30]
add edi, edx
sub ebx, edx
mov dword [ebp - 0x14], edi
mov edi, esi
sbb edi, dword [ebp - 0x18]
sub dword [eax], edx
mov eax, dword [ecx + 0x20]
add dword [eax], edx
jmp 0x4454d3
mov ecx, dword [ebp - 0x10]
mov edi, esi
cmp ebx, 1
mov eax, edi
mov esi, ebx
mov ebx, edi
sbb eax, 0
jl 0x445502
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x445502
push eax
push esi
push 1
push dword [ebp - 0x14]
call fcn.004e0cf6
mov edx, esi
add esp, 0x10
sub edx, eax
mov esi, ebx
sbb esi, 0
jmp 0x44550d
mov edx, esi
mov esi, ebx
jmp 0x44550d
mov edx, esi
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
sub eax, edx
mov edx, dword [ebp + 0x10]
sbb edx, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x445940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [0x56600c]
mov bl, 1
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx + 0x38], 0
je 0x4459c0
cmp byte [ecx + 0x3d], 0
mov esi, ecx
je 0x4459c0
mov eax, dword [esi]
mov ecx, esi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4459be
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x34]
lea edi, [ebp - 0x30]
lea edx, [esi + 0x40]
mov ebx, dword [ecx]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push edx
call dword [ebx + 0x20]
cmp eax, 3
je 0x4459d4
cmp eax, 1
je 0x44599b
test eax, eax
jne 0x4459be
mov byte [esi + 0x3d], 0
mov ebx, dword [ebp - 0x34]
sub ebx, edi
je 0x4459b5
push dword [esi + 0x4c]
push ebx
push 1
push edi
call fcn.004e0cf6
add esp, 0x10
cmp ebx, eax
jne 0x4459be
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x4459c0
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00478339
mov eax, ebx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov bl, 1
mov byte [esi + 0x3d], 0
jmp 0x4459c0
Function at 0x449bd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x449c06
mov edx, dword [ebp + 0xc]
nop word cs:[eax + eax]
nop dword [eax]
movzx edi, byte [edx]
movzx esi, al
shr eax, 8
inc edx
xor edi, esi
xor eax, dword [edi*4 + 0x51b5b4]
dec ecx
jne 0x449bf0
pop esi
pop edi
pop ebp
ret
Function at 0x44de7a
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
xor ebx, ebx
mov edi, edx
mov esi, ecx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
push ebx
push edx
push ebx
push 0x8000004
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, esi
push eax
call fcn.00401886
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x44debd
push edi
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x44fa30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x56600c]
xor eax, ebp
mov dword [esp + 0x20], eax
mov edi, dword [ecx + 0x30]
test edi, edi
jne 0x44faf9
mov esi, ecx
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], 9
mov dword [esp + 8], 0x63736964
mov dword [esp + 0xc], 0x65647261
mov word [esp + 0x10], 0x64
push 0x48
call fcn.00478358
add esp, 4
mov ebx, eax
lea eax, [esp + 8]
mov edi, esp
mov ecx, esi
push eax
push edi
call fcn.0044f8e0
mov ecx, ebx
push edi
push dword [esi + 0x20]
lea eax, [esp + 0x10]
push eax
call fcn.00450200
mov edi, dword [esi + 0x30]
mov dword [esi + 0x30], ebx
test edi, edi
je 0x44fac0
mov ecx, edi
call fcn.004502f0
push edi
call fcn.004783ab
add esp, 4
mov eax, dword [esp + 0x1c]
cmp eax, 0x10
jb 0x44faf6
mov ecx, dword [esp + 8]
lea edi, [eax + 1]
cmp edi, 0x1000
jb 0x44faec
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x44fb0e
add eax, 0x24
mov ecx, edx
mov edi, eax
push edi
push ecx
call fcn.0047834a
add esp, 8
mov edi, dword [esi + 0x30]
mov ecx, dword [esp + 0x20]
xor ecx, ebp
call fcn.00478339
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004d7bfa
int3

Function at 0x450cc0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x5684f8]
mov edx, dword fs:[0x2c]
mov eax, dword [0x569828]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x450ceb
mov ecx, 0x569820
pop ebp
jmp fcn.00431400
push 0x569828
call fcn.00478734
add esp, 4
cmp dword [0x569828], 0xffffffff
jne 0x450ce0
mov dword [0x569824], 0
mov dword [0x569820], 0
mov ecx, 0x569820
push 0
call fcn.00431470
push 0x569828
call fcn.004786ea
add esp, 4
jmp 0x450ce0
Function at 0x454c3b
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push str.Games_App_Patch_Mutex
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
jne 0x454c5a
xor al, al
jmp 0x454c92
push esi
lea ecx, [ebp - 4]
call fcn.0045c011
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x454c81
cmp eax, 0x80
je 0x454c81
cmp eax, 0x102
jne 0x454c88
mov bl, 1
jmp 0x454c88
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea ecx, [ebp - 4]
call fcn.004ac292
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x455fb0
Capabilities:
Check mutex on windows

Disassembly:
push 0x3c
mov eax, 0x4fe108
call fcn.004fb730
push str.WT334D6CA4_1A18_40FE_9D63_752C3045F9AD
xor ebx, ebx
push 1
mov dword [ebp - 0x44], ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x455fe2
push ebx
push 1
push ebx
call edi
jmp 0x456166
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x456164
push 7
pop edi
xor eax, eax
mov dword [ebp - 0x18], ebx
push 0x548010
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], edi
mov word [ebp - 0x28], ax
call fcn.00455536
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x44], 1
call fcn.004768df
test al, al
jne 0x456030
call fcn.00460c6f
test al, al
je 0x456030
mov bl, 1
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x456071
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
cmp eax, 0x1000
jb 0x456068
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00455f19
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.0047834a
pop ecx
pop ecx
test bl, bl
je 0x456083
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x456164
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x14], edi
mov ebx, 0x548010
mov word [ebp - 0x28], ax
push ebx
call fcn.00455536
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.00476802
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4560ee
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x4560e5
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00455f19
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0047834a
pop ecx
pop ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
and dword [ebp - 0x30], 0
lea ecx, [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x2c], edi
push ebx
mov word [ebp - 0x40], ax
call fcn.00455536
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 2
call fcn.00476802
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x456158
mov ecx, dword [ebp - 0x40]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
cmp eax, 0x1000
jb 0x45614f
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00455f19
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.0047834a
pop ecx
pop ecx
push 0x1f4
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, esi
call fcn.004fb6da
ret
Function at 0x45a9b7
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push 0xc0
mov eax, 0x4fed75
call fcn.004fb730
mov edi, ecx
lea ecx, [ebp - 0x40]
call fcn.004ad04b
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x30], ebx
je 0x45ab59
lea ecx, [ebp - 0x40]
call fcn.004ad51b
test al, al
je 0x45ab59
xor eax, eax
mov dword [ebp - 0xbc], 0x44
xorps xmm0, xmm0
mov dword [ebp - 0xb8], ebx
lea edx, [ebp - 0x40]
mov dword [ebp - 0xb4], ebx
lea ecx, [ebp - 0x58]
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], 0x40
mov dword [ebp - 0x8c], eax
movups xmmword [ebp - 0x88], xmm0
call fcn.004ad7c4
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x70]
call fcn.004556c1
mov byte [ebp - 4], 2
mov ecx, eax
mov dword [esp], str.___Hourglass
call fcn.0045adc8
mov byte [ebp - 0x74], bl
lea ecx, [ebp - 0x28]
push dword [ebp - 0x74]
mov dword [ebp - 0x18], ebx
push eax
mov dword [ebp - 0x14], ebx
call fcn.00455bd7
lea ecx, [ebp - 0x70]
call fcn.00455d7e
cmp dword [ebp - 0x44], 8
lea esi, [ebp - 0xcc]
push esi
lea edx, [ebp - 0x58]
cmovae edx, dword [ebp - 0x58]
lea esi, [ebp - 0xbc]
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push esi
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push edx
cmovae eax, dword [ebp - 0x40]
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x45ab04
push dword [ebp - 0xcc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc8]
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push edx
push eax
lea ecx, [edi + 0x90]
call fcn.0045ab67
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x45ab41
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ecx
cmp eax, 0x1000
jb 0x45ab38
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00455f19
mov eax, dword [ebp - 0x78]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x74]
push eax
push ecx
call fcn.0047834a
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00455d7e
lea ecx, [ebp - 0x40]
call fcn.00455d7e
call fcn.004fb6da
ret
Function at 0x45ae02
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [ebp + 0x1c]
push ebx
push esi
push edi
cmp dword [eax], 0x44
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
je 0x45ae28
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x45af52
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
push 1
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x45ae4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x45ae4d
push eax
jmp 0x45ae1b
mov esi, dword [ebp - 4]
mov eax, edi
mov dword [ebp - 8], eax
mov ebx, edi
test esi, esi
je 0x45ae90
cmp esi, 0x7fffffff
ja 0x45af57
push esi
cmp esi, 0x1000
jb 0x45ae77
call fcn.00455ec5
jmp 0x45ae7c
call fcn.00478358
pop ecx
push esi
mov ebx, eax
push edi
push ebx
call fcn.004d37c0
lea eax, [ebx + esi]
add esp, 0xc
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push edi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x45aeab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
jmp 0x45af16
mov eax, dword [ebp + 0x24]
push edi
push edi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
push 0x20002
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x45af06
push 0x11
pop ecx
push dword [ebp + 0x20]
mov esi, dword [ebp + 0x1c]
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x18]
xor eax, eax
lea edi, [ebp - 0x58]
push eax
push 0x80000
push 1
push eax
push eax
push dword [ebp - 0xc]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x58], 0x48
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x45af50
mov eax, dword [ebp - 8]
sub eax, ebx
mov dword [ebp - 8], ebx
mov dword [ebp + 0x1c], eax
cmp eax, 0x1000
jb 0x45af47
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00455f19
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp - 8]
pop ecx
pop ecx
push eax
push ebx
call fcn.0047834a
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
call fcn.00455a90
int3
Function at 0x45d456
Capabilities:
Get session user name

Disassembly:
push 0x464
mov eax, 0x4ff20a
call fcn.004fb730
mov esi, ecx
mov dword [ebp - 0x45c], esi
mov dword [ebp - 0x45c], esi
xor ebx, ebx
mov dword [ebp - 0x45c], 0x101
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], bl
lea eax, [ebp - 0x45c]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x45d505
push ecx
push ecx
lea eax, [ebp - 0x218]
mov edx, esp
mov ecx, eax
mov dword [edx], eax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x45d4c1
sub ecx, edi
sar ecx, 1
mov dword [edx + 4], ecx
lea ecx, [ebp - 0x450]
call fcn.004b757c
lea ecx, [ebp - 0x438]
cmp ecx, eax
je 0x45d4fa
mov byte [ebp - 0x454], bl
push dword [ebp - 0x454]
push eax
call fcn.0045dbdd
lea ecx, [ebp - 0x450]
call fcn.00455dac
push ebx
lea ecx, [ebp - 0x458]
call fcn.004b7766
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x458]
call fcn.004b78f9
lea ecx, [ebp - 0x470]
call fcn.004b7be4
lea ecx, [ebp - 0x470]
call fcn.004554c8
push eax
lea ecx, [ebp - 0x458]
call fcn.004b78cc
push 0x104
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x470]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x420]
mov ecx, esi
push eax
call fcn.00455432
lea ecx, [ebp - 0x458]
call fcn.004b7796
mov eax, dword [ebp - 0x424]
cmp eax, 0x10
jb 0x45d5ca
mov ecx, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x454], ecx
cmp eax, 0x1000
jb 0x45d5c1
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x454]
push eax
call fcn.00455f19
mov eax, dword [ebp - 0x460]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x454]
push eax
push ecx
call fcn.0047834a
pop ecx
pop ecx
mov eax, esi
call fcn.004fb6da
ret
Function at 0x45d5d2
Capabilities:
Get session user name

Disassembly:
push 0x3b4
mov eax, 0x4ff292
call fcn.004fb730
mov edi, ecx
mov dword [ebp - 0x3b8], edi
xor ebx, ebx
lea ecx, [ebp - 0x384]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x3bc], edi
mov dword [ebp - 0x3c0], ebx
call fcn.0045d3ba
push str.Downloads_
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.0045adc8
push eax
mov ecx, edi
call fcn.00455bff
lea ecx, [ebp - 0x384]
mov dword [ebp - 0x3c0], 3
mov byte [ebp - 4], bl
call fcn.00455d7e
lea eax, [ebp - 0x3b8]
mov dword [ebp - 0x3b8], 0x104
push eax
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x45d67e
push 0x103
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.004d8666
add esp, 0xc
cmp eax, 0xffffffff
jne 0x45d840
lea ecx, [ebp - 0x3b4]
call fcn.0045d456
mov esi, eax
lea ecx, [ebp - 0x39c]
mov dword [ebp - 4], 2
call fcn.0045d31e
push 0x548a84
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.0045adc8
mov byte [ebp - 0x3b8], bl
lea ecx, [ebp - 0x354]
push dword [ebp - 0x3b8]
mov dword [ebp - 0x344], ebx
push eax
mov dword [ebp - 0x340], ebx
call fcn.00455bd7
mov dword [ebp - 0x3c0], 7
push esi
lea eax, [ebp - 0x354]
mov byte [ebp - 4], 4
push eax
push dword [ebp - 0x3b8]
lea ecx, [ebp - 0x36c]
call fcn.0045b76a
mov dword [ebp - 0x3c0], 0xf
push str.Downloads_
lea ecx, [ebp - 0x36c]
mov byte [ebp - 4], 5
call fcn.0045adc8
mov byte [ebp - 0x3b8], bl
lea ecx, [ebp - 0x33c]
push dword [ebp - 0x3b8]
mov dword [ebp - 0x32c], ebx
push eax
mov dword [ebp - 0x328], ebx
call fcn.00455bd7
lea eax, [ebp - 0x33c]
mov ecx, edi
push eax
call fcn.00458756
mov eax, dword [ebp - 0x328]
cmp eax, 8
jb 0x45d79d
mov ecx, dword [ebp - 0x33c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x3b8], ecx
cmp eax, 0x1000
jb 0x45d794
lea eax, [ebp - 0x3bc]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.00455f19
mov eax, dword [ebp - 0x3bc]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x3b8]
push eax
push ecx
call fcn.0047834a
pop ecx
pop ecx
push 7
pop esi
xor eax, eax
mov dword [ebp - 0x32c], ebx
lea ecx, [ebp - 0x36c]
mov dword [ebp - 0x328], esi
mov word [ebp - 0x33c], ax
call fcn.00455d7e
mov eax, dword [ebp - 0x340]
cmp eax, 8
jb 0x45d815
mov ecx, dword [ebp - 0x354]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3bc], ecx
cmp eax, 0x1000
jb 0x45d80c
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x3bc]
push eax
call fcn.00455f19
mov eax, dword [ebp - 0x3b8]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x3bc]
push eax
push ecx
call fcn.0047834a
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x344], ebx
lea ecx, [ebp - 0x39c]
mov dword [ebp - 0x340], esi
mov word [ebp - 0x354], ax
call fcn.00455d7e
lea ecx, [ebp - 0x3b4]
call fcn.00455d7e
mov eax, edi
call fcn.004fb6da
ret