joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471f50
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [ebp + 8]
mov dword [ebp - 8], ecx
test eax, eax
je 0x472154
cmp word [eax], 0
je 0x472154
push edi
push eax
lea eax, [ebp - 0x668]
push eax
call fcn.00412a30
add esp, 8
lea ecx, [ebp - 0x668]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 - 0x66a], 0x5c
lea edi, [ebp + eax*2 - 0x668]
mov dword [ebp + 8], edi
jne 0x471faa
add edi, 0xfffffffe
mov dword [ebp + 8], edi
lea eax, [ebp - 0x668]
mov edx, edi
sub edx, eax
sar edx, 1
mov eax, 0x208
sub eax, edx
cmp eax, 0x208
ja 0x471fd0
push str..
push eax
push edi
call fcn.00401730
lea ecx, [ebp - 0x258]
push ecx
lea edx, [ebp - 0x668]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x472153
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push esi
jmp 0x472000
test byte [ebp - 0x258], 0x10
jne 0x47212e
lea ecx, [ebp - 0x22c]
xor eax, eax
push 0x2e
push ecx
mov word [edi + 2], ax
call fcn.004ca94c
mov esi, eax
add esp, 8
test esi, esi
je 0x47212e
push str..ttf
push esi
call ebx
test eax, eax
je 0x472056
push str..otf
push esi
call ebx
test eax, eax
je 0x472056
push str..bdf
push esi
call ebx
test eax, eax
jne 0x47212e
lea eax, [ebp - 0x22c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x472060
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [ebp - 0x668]
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x472080
sub eax, esi
sar eax, 1
add eax, edx
cmp eax, 0x104
lea eax, [ebp - 0x22c]
jb 0x472107
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4720a1
sub eax, edx
sar eax, 1
lea edi, [eax + 0x64]
push 2
push edi
call fcn.0044c490
add esp, 8
push str.Too_long_full_pathname_for_font:_n
mov esi, eax
push edi
push esi
call fcn.00401730
lea edx, [ebp - 0x22c]
push edx
push edi
push esi
call fcn.004017b0
mov ecx, dword [0x52fe2c]
push 1
push 0xffffffffffffffff
call fcn.00409d20
push eax
push 0x11
push esi
call fcn.004262f0
push esi
mov edi, eax
call fcn.0044c4f0
add esp, 0x18
cmp edi, 2
je 0x472147
mov edi, dword [ebp + 8]
jmp 0x47212e
push eax
push 0x208
lea ecx, [ebp - 0x668]
push ecx
call fcn.004017b0
mov ecx, dword [ebp - 8]
push 0
lea edx, [ebp - 0x668]
push edx
call fcn.004717b0
test eax, eax
je 0x472147
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x258]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x472000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4771e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x52fe30]
sub esp, 0x20c
cmp byte [eax + 0xee1], 0
push edi
mov edi, ecx
je 0x4772c3
mov eax, dword [0x52fe2c]
cmp byte [eax + 0x4139], 0
jne 0x4772c3
add eax, 0x3be
push eax
call fcn.00471f50
mov eax, dword [0x52fe2c]
lea ecx, [eax + 0x5c8]
push ecx
add eax, 0x3be
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x47724b
mov edx, dword [0x52fe2c]
add edx, 0x5c8
push edx
mov ecx, edi
call fcn.00471f50
mov ecx, dword [0x52fe2c]
push esi
push 0
call fcn.00408f30
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push eax
mov eax, dword [0x52fe2c]
add eax, 0x3be
push eax
call esi
test eax, eax
je 0x4772c2
mov edx, dword [0x52fe14]
push 0
push 0x14
lea ecx, [ebp - 0x20c]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4772ad
mov ecx, dword [0x52fe2c]
push 0
call fcn.00408f30
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
neg eax
sbb eax, eax
add eax, 1
jne 0x4772c2
mov ecx, dword [0x52fe2c]
push 0
call fcn.00408f30
push eax
mov ecx, edi
call fcn.00471f50
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x477e10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4fd290]
mov ecx, dword [0x4fd294]
push ebx
mov ebx, dword [ebp + 0xc]
push 0x25
push edi
mov byte [ebp - 1], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
mov byte [ebx], 0
call fcn.004c9bca
add esp, 8
test eax, eax
je 0x477e8f
push edi
call fcn.004c6380
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x477e87
push 0
push ebx
call fcn.004c5850
add esp, 8
test al, al
je 0x477e7e
push ebx
call fcn.004c5de0
mov edx, dword [ebp + 0xc]
add esp, 4
push 0x105
push edi
push esi
mov byte [edx], al
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov byte [ebp - 1], 1
push ebx
call fcn.0044c4f0
add esp, 4
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5c
push edi
call fcn.004c9bca
add esp, 8
test eax, eax
jne 0x477ed8
push eax
push esi
push 0x105
push eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x477e87
cmp eax, 0x105
jae 0x477e87
push edi
call fcn.004c5de0
add esp, 4
push 0x105
push edi
push esi
mov byte [ebx], al
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
test edx, edx
je 0x477f45
cmp word [edx], 0
je 0x477f45
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp - 8], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x477ef3
sub eax, dword [ebp - 8]
push 0x105
push edx
sar eax, 1
push esi
mov dword [ebp - 8], eax
call ebx
mov eax, dword [ebp - 8]
mov edx, 0x105
sub edx, eax
push edx
push edi
lea eax, [esi + eax*2]
push eax
call ebx
push 0
push esi
call fcn.004c5850
add esp, 8
test al, al
je 0x477f45
push esi
call fcn.004c5de0
mov ecx, dword [ebp + 0xc]
add esp, 4
mov byte [ecx], al
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0x43
mov word [ebp - 0x10], dx
mov edi, edi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x477f86
push 0x105
lea ecx, [ebp - 0x10]
push ecx
push esi
call ebx
push 0x103
push edi
lea edx, [esi + 4]
push edx
call ebx
push 0
push esi
call fcn.004c5850
add esp, 8
test al, al
jne 0x477f30
mov ax, word [ebp - 0x10]
inc ax
mov word [ebp - 0x10], ax
cmp ax, 0x5a
jbe 0x477f50
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x478f60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x52fe2c]
sub esp, 0x14
push ebx
call fcn.00408fe0
xor ebx, ebx
test al, al
je 0x478f91
mov ecx, dword [0x52fe2c]
push 1
push 1
push str.CheckOptionsFast_was_skipped_due_to__basic_or__resetdefault_switch
call fcn.00409280
jmp 0x4790df
mov al, byte [ebp + 0xc]
mov ecx, dword [0x52fe30]
and al, 1
cmp byte [ecx + 0x1126e], bl
mov byte [0x53297b], al
sete byte [0x53297d]
cmp byte [ecx + 0x11863], bl
mov byte [0x53297c], bl
sete byte [0x53297a]
cmp dword [0x52fe5c], 6
jne 0x4790a6
cmp dword [0x52fe60], ebx
jne 0x4790a6
push esi
push ebx
mov dword [ebp - 4], ebx
call fcn.00450160
mov esi, eax
cmp esi, ebx
je 0x479030
mov edx, dword [esi]
mov eax, dword [edx]
push ebx
push 0x20019
push str.SoftwareConEmu
mov ecx, esi
call eax
test al, al
je 0x479025
mov edx, dword [esi]
mov edx, dword [edx + 0xc]
push 4
lea eax, [ebp - 4]
push eax
push str.StopWarningConIme
mov ecx, esi
call edx
test al, al
jne 0x47901c
mov dword [ebp - 4], ebx
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
push 1
mov ecx, esi
call edx
cmp dword [ebp - 4], ebx
jne 0x4790a5
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push str.Console
mov esi, 1
push SysReAllocString
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47909e
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x14]
push eax
push ebx
push str.LoadConIme
push ecx
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x47908f
mov dword [ebp - 0xc], esi
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
je 0x4790a5
mov byte [0x53297c], 1
pop esi
cmp byte [0x53297d], bl
jne 0x4790be
cmp byte [0x53297a], bl
jne 0x4790be
cmp byte [0x53297c], bl
je 0x4790df
call fcn.00426000
mov eax, dword [ebp + 8]
mov ecx, dword [0x52fe10]
push eax
push 0x477fa0
push ebx
push 0xd7
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
push ebx
call fcn.00478860
add esp, 4
test byte [ebp + 0xc], 0x10
je 0x4790fa
mov ecx, dword [0x52fe30]
push ebx
call fcn.0044dd30
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4798a0
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ecx + 0x244], 2
mov dword [ebp - 4], 0
jne 0x4798b8
xor eax, eax
jmp 0x4798bb
lea eax, [ecx + 0x3c]
lea edx, [ebp - 4]
push edx
push 0
push 2
push eax
mov eax, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x34]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
je 0x4798dd
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4798df
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x47a420
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x34]
xor ebx, ebx
mov dword [esi + 0x244], ebx
cmp eax, ebx
je 0x47a4db
cmp word [eax], bx
je 0x47a4db
mov eax, dword [ebp + 8]
push edi
push 0x103
lea edi, [esi + 0x3c]
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x47a46c
xor ecx, ecx
mov word [edi], cx
mov dword [esi + 0x244], 2
jmp 0x47a476
mov dword [esi + 0x244], 1
mov eax, dword [esi + 0x38]
pop edi
cmp eax, ebx
je 0x47a48a
push eax
call fcn.0044c4f0
add esp, 4
mov dword [esi + 0x38], ebx
mov eax, dword [esi + 0x34]
push 0x5c
push eax
call fcn.004c9bca
add esp, 8
cmp eax, ebx
je 0x47a4b7
mov edx, dword [esi + 0x34]
xor ecx, ecx
mov dword [esi + 0x38], edx
mov word [eax], cx
add eax, 2
push ebx
push eax
call fcn.0044c570
add esp, 8
mov dword [esi + 0x34], eax
mov ecx, esi
call fcn.004798a0
cmp eax, ebx
setne bl
test eax, eax
je 0x47a4d3
cmp eax, 0xffffffff
je 0x47a4d3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
pop ebp
ret 4
pop esi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x47adf0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8869
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x54]
mov dword [ebp - 0x10], esi
call fcn.0049e390
xor ebx, ebx
lea ecx, [esi + 0x1a2c]
mov dword [ebp - 4], ebx
call fcn.004c6600
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push 0xdc
lea edx, [esi + 0x1ac0]
push ebx
push edx
mov byte [ebp - 4], 1
mov dword [esi + 0x50], eax
mov dword [esi], ecx
mov dword [esi + 0x1a00], 0xffffffff
call fcn.004c9b50
add esp, 0xc
push ebx
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0xffffffffffffffff
push 0xffffffffffffffff
mov dword [esi + 0x1b70], eax
mov dword [esi + 0x1a04], ebx
call fcn.00425040
push 0xffffffffffffffff
mov dword [esi + 0x1a08], eax
lea eax, [ebp - 0x20]
push 0xffffffffffffffff
push eax
call fcn.00425070
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esi + 8], ecx
mov dword [esi + 0x28], ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 0xc], edx
mov dword [esi + 0x2c], edx
mov dword [esi + 0x1c], edx
mov dword [esi + 0x10], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x24], eax
xor eax, eax
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x1b9c], eax
mov dword [esi + 0x1ba0], eax
mov dword [esi + 0x1ba4], eax
mov dword [esi + 0x1ba8], eax
mov dword [esi + 0x1bac], eax
add esp, 0x14
mov dword [esi + 0x1bb0], eax
lea ecx, [esi + 0x1a0c]
mov dword [esi + 0x1bb4], eax
push ecx
mov dword [esi + 0x1bb8], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x1a24], ebx
mov dword [esi + 0x1a28], ebx
mov dword [esi + 4], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4824c0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x482503
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4824df
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x4824ee
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x110], ebx
xor ecx, ecx
lea edi, [esi + 0x10]
lea eax, [esi + 0x114]
mov dword [esi + 0x110], ebx
mov word [eax], cx
cmp word [edi], bx
jne 0x482533
push str.Internal_error._Mapping_file_name_was_not_specified.
push eax
call fcn.00412a30
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jg 0x48253f
mov eax, 0xce
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
cmp edx, ebx
jne 0x482552
cmp dword [ebp + 0xc], ebx
jne 0x482552
xor ecx, ecx
jmp 0x482557
mov ecx, 1
mov dword [esi + 8], ecx
push edi
cmp edx, ebx
je 0x482573
push eax
push ebx
push 4
call fcn.0044cf40
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
jmp 0x48257c
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, eax
mov dword [esi], eax
cmp ecx, ebx
jne 0x4825a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.create
cmp dword [ebp + 8], ebx
jne 0x48259f
mov ecx, str.open
push edi
push eax
push ecx
push str.Cant__s_console_data_file_mapping._ErrCode0x_08X_n_s
jmp 0x4825ed
mov eax, dword [esi + 8]
neg eax
push ebx
sbb eax, eax
push ebx
and eax, 0xf001b
push ebx
add eax, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x482601
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.ReadWrite
cmp dword [esi + 8], ebx
jne 0x4825e5
mov ecx, 0x4e93f8
push edi
push eax
push ecx
push str.Cant_map_console_info___s_._ErrCode0x_08X_n_s
lea eax, [esi + 0x114]
push 0x208
push eax
call fcn.0044cff0
add esp, 0x18
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x482610
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x482653
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x48262f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x48263e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x110], ebx
xor ecx, ecx
lea edi, [esi + 0x10]
lea eax, [esi + 0x114]
mov dword [esi + 0x110], ebx
mov word [eax], cx
cmp word [edi], bx
jne 0x482683
push str.Internal_error._Mapping_file_name_was_not_specified.
push eax
call fcn.00412a30
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jg 0x48268f
mov eax, 0x56
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
cmp edx, ebx
jne 0x4826a2
cmp dword [ebp + 0xc], ebx
jne 0x4826a2
xor ecx, ecx
jmp 0x4826a7
mov ecx, 1
mov dword [esi + 8], ecx
push edi
cmp edx, ebx
je 0x4826c3
push eax
push ebx
push 4
call fcn.0044cf40
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
jmp 0x4826cc
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, eax
mov dword [esi], eax
cmp ecx, ebx
jne 0x4826f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.create
cmp dword [ebp + 8], ebx
jne 0x4826ef
mov ecx, str.open
push edi
push eax
push ecx
push str.Cant__s_console_data_file_mapping._ErrCode0x_08X_n_s
jmp 0x48273d
mov eax, dword [esi + 8]
neg eax
push ebx
sbb eax, eax
push ebx
and eax, 0xf001b
push ebx
add eax, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x482751
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.ReadWrite
cmp dword [esi + 8], ebx
jne 0x482735
mov ecx, 0x4e93f8
push edi
push eax
push ecx
push str.Cant_map_console_info___s_._ErrCode0x_08X_n_s
lea eax, [esi + 0x114]
push 0x208
push eax
call fcn.0044cff0
add esp, 0x18
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x486be0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0x41f0]
pop ebp
jmp fcn.0047b0f0

Function at 0x487310
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0
call ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
cmp esi, 0x2710
jbe 0x48733f
mov esi, 0x2710
jmp 0x487348
test esi, esi
jne 0x487348
mov esi, 0x64
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [edi + 0x3d00]
jne 0x487361
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
test esi, esi
jbe 0x4873a6
mov ecx, dword [edi + 0x41e4]
call fcn.0047b550
cmp dword [ebp + 8], eax
je 0x48739f
mov eax, dword [edi + 0x3d08]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
sub eax, dword [ebp - 8]
cmp eax, esi
jb 0x487365
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x487b40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
test ecx, ecx
je 0x487b63
cmp byte [ecx + 0x41f4], 0
je 0x487b57
mov byte [ecx + 0x41f4], 0
mov ecx, dword [ecx + 0x41f0]
pop ebp
jmp fcn.004835d0
pop ebp
ret 0x14

Function at 0x488280
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push esi
mov esi, ecx
cmp dword [esi + 0x4914], 0
jle 0x4882ed
cmp byte [esi + 0x491c], 1
jne 0x4882ed
mov ecx, dword [esi + 4]
push 0x3ff
lea eax, [ebp - 0x800]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x4882c6
xor edx, edx
mov word [esi + 0x34e0], dx
pop esi
mov esp, ebp
pop ebp
ret
mov ax, word [ebp - 0x800]
cmp ax, 0x7b
je 0x4882d9
cmp ax, 0x28
jne 0x4882ed
lea eax, [ebp - 0x800]
push eax
add esi, 0x34e0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x488320
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push edi
lea eax, [ebp - 0x190]
push eax
push 0xc8
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x488393
push esi
mov esi, dword [ebp + 8]
push esi
push edi
push 0x4ffdf4
lea ecx, [ebp - 0x190]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x488389
push edi
push 0x80
push 2
push edi
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x488381
xor edx, edx
mov word [esi], dx
xor eax, eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4883a0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [0x52fe2c]
push esi
call fcn.0040aa30
test al, al
je 0x4883fa
mov eax, dword [esi + 0x4200]
test eax, eax
je 0x4883fe
cmp eax, dword [esi + 0x940]
jne 0x4883fe
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x4204]
cmp eax, 0x7d0
jb 0x4883fe
mov eax, dword [esi + 0x944]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4883fa
mov ecx, dword [esi + 0x944]
push 0x64
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov al, 1
pop esi
ret
cmp dword [esi + 4], 0
je 0x4883fa
cmp dword [esi + 0x4958], 0
jne 0x4883fa
xor al, al
pop esi
ret

Function at 0x4897d0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
test edi, edi
je 0x489898
mov eax, dword [edi + 0x728]
test eax, eax
je 0x48982a
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x48980e
mov eax, dword [edi + 0x728]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x728], 0
jmp 0x48982a
mov ecx, dword [edi + 0x728]
push 0x64
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [edi + 0x728]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
lea eax, [ebx + 0x14]
push eax
push 1
call fcn.0044c490
mov ecx, dword [ebp + 8]
mov esi, eax
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [esi], edi
mov dword [esi + 4], 1
mov dword [esi + 0xc], ecx
mov dword [esi + 8], ebx
test eax, eax
je 0x48986a
test ebx, ebx
je 0x48986a
push ebx
push eax
lea edx, [esi + 0x10]
push edx
call fcn.004c9f70
add esp, 0xc
lea eax, [edi + 0x72c]
push eax
push 0
push esi
push 0x4896d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x728], eax
test eax, eax
jne 0x489896
push esi
call fcn.0044c4f0
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
ret 0xc

Function at 0x489900
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
mov ebx, ecx
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x4899b1
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowExW]
push 0
push 0x8002
push 0
push 0
call edi
mov esi, eax
test esi, esi
je 0x489999
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x489940
push 0xff
lea eax, [ebp - 0x204]
push eax
push esi
call ebx
test eax, eax
je 0x489984
mov eax, 0x22
cmp word [ebp - 0x204], ax
jne 0x489984
cmp word [ebp - 0x1f6], ax
jne 0x489984
push 6
lea ecx, [ebp - 0x202]
push 0x4e5ea4
push ecx
call fcn.00443dd0
add esp, 0xc
test eax, eax
je 0x4899b6
push 0
push 0x8002
push esi
push 0
call edi
mov esi, eax
test esi, esi
jne 0x489940
mov ebx, dword [ebp - 4]
mov edx, dword [ebx + 4]
push 0
push 0xfff7
push 0x112
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.004c57c0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48a050
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
mov esi, ecx
test esi, esi
je 0x48a16c
cmp dword [esi + 0x950], 0
je 0x48a16c
mov ecx, dword [esi + 0x4964]
test ecx, ecx
je 0x48a08b
push 1
push 0
push 1
push str.Prepare_searching_for_conhost
call fcn.004c77f0
mov eax, dword [esi + 0x950]
mov ecx, dword [eax]
test ecx, ecx
je 0x48a0b1
mov eax, dword [eax + 4]
test eax, eax
je 0x48a0b1
lea eax, [eax + eax*2]
add eax, eax
add eax, eax
push eax
push 0
push ecx
call fcn.004c9b50
add esp, 0xc
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
test edi, edi
je 0x48a151
cmp edi, 0xffffffff
je 0x48a151
push 0x228
lea ecx, [ebp - 0x22c]
push 0
push ecx
mov dword [ebp - 0x230], 0x22c
call fcn.004c9b50
add esp, 0xc
lea edx, [ebp - 0x230]
push edx
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x48a14a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov dword [ebp - 4], 1
lea ecx, [ecx]
push str.conhost.exe
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
jne 0x48a138
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [esi + 0x950]
lea edx, [ebp - 0x228]
push edx
call fcn.0040d260
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x48a110
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x4964]
pop edi
test ecx, ecx
je 0x48a16c
push 1
push 0
push 1
push str.Prepare_searching_for_conhost___Done
call fcn.004c77f0
pop esi
mov esp, ebp
pop ebp
ret