joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456c54
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x456c71
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x456d83
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x456ca4
je 0x456cf0
sub ecx, 0x2b
je 0x456ce6
sub ecx, 4
je 0x456ceb
dec ecx
sub ecx, 0xa
jb 0x456cd5
jmp 0x456cf3
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x456cb6
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x456cc4
jmp 0x456cf3
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x456cf3
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x456cf3
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x456cf3
mov byte [eax], 0x3e
jmp 0x456cf3
mov byte [eax], 0x3f
jmp 0x456cf3
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x456c83
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x456d43
cmp byte [esp + 3], 0xff
jne 0x456d43
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x456d7b
cmp dl, 0xff
je 0x456d7b
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x456c7c
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x456e28
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040499c
mov eax, dword [ebp - 8]
call fcn.0040499c
xor eax, eax
push ebp
push 0x456ed8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x456eb3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20106
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004049ac
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.0045db0c
test eax, eax
jne 0x456ea1
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.004049ac
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0xc]
call fcn.0045da94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x456ebd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456edf
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044f4
ret
Function at 0x457a18
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, 0x457a70
call fcn.004579f8
call fcn.0045c22c
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
mov eax, 0x457a70
call fcn.004579f8
cdq
push edx
push eax
mov eax, esi
sub eax, ebx
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x457a59
cmp eax, dword [esp]
pop edx
pop eax
jae 0x457a62
jmp 0x457a5d
pop edx
pop eax
jge 0x457a62
mov al, 1
pop esi
pop ebx
ret
xor eax, eax
pop esi
pop ebx
ret
Function at 0x45867c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040499c
mov eax, dword [ebp - 8]
call fcn.0040499c
mov eax, dword [ebp - 0xc]
call fcn.0040499c
xor eax, eax
push ebp
push 0x458862
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 0x6c]
mov edx, 0x44
call fcn.00433ad4
lea eax, [ebp - 0x28]
mov edx, 0x10
call fcn.00433ad4
mov dword [ebp - 0x6c], 0x44
mov word [ebp - 0x3c], 0
mov dword [ebp - 0x40], 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004049ac
push eax
mov eax, dword [ebp - 4]
call fcn.004049ac
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x45876f
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0x70]
push eax
xor ecx, ecx
mov edx, 0x45887c
mov eax, dword [ebp - 8]
call fcn.0045716c
mov eax, dword [ebp - 0x70]
call fcn.004049ac
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x45876f
lea edx, [ebp - 0x74]
mov eax, 0x458888
call fcn.00457a04
mov eax, dword [ebp - 0x74]
call fcn.0044a21c
jmp 0x45883a
mov ebx, dword [ebp - 0x28]
push 0x40
push 0x1000
mov eax, dword [ebp - 0xc]
call fcn.004047ac
push eax
push 0
push ebx
call fcn.00457ef8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4587b0
push 0x1000
push 0x40
mov eax, dword [ebp - 0xc]
call fcn.004047ac
mov ecx, eax
xor edx, edx
mov eax, ebx
call fcn.0045e474
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x45883a
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004047ac
push eax
lea eax, [ebp - 0xc]
call fcn.00404a04
push eax
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.00457fd4
mov eax, dword [ebp - 0xc]
call fcn.004047ac
sub eax, 2
cdq
push edx
push eax
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x4587fc
cmp eax, dword [esp]
pop edx
pop eax
jae 0x458821
jmp 0x458800
pop edx
pop eax
jge 0x458821
mov eax, dword [ebp - 0xc]
call fcn.004047ac
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
call fcn.00404a04
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.0045d7c8
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0045e7e0
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458869
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004044f4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004044f4
ret
Function at 0x4588c0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x6c], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040499c
mov eax, dword [ebp - 8]
call fcn.0040499c
xor eax, eax
push ebp
push 0x458ae2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 8], 0
je 0x4589eb
cmp dword [ebp - 4], 0
jne 0x458910
lea edx, [ebp - 4]
mov eax, 0x458afc
call fcn.00457a04
lea eax, [ebp - 0x68]
mov edx, 0x44
call fcn.00433ad4
lea eax, [ebp - 0x24]
mov edx, 0x10
call fcn.00433ad4
mov dword [ebp - 0x68], 0x44
mov word [ebp - 0x38], 0
mov dword [ebp - 0x3c], 1
lea edx, [ebp - 0x6c]
mov eax, 0x458afc
call fcn.00457a04
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 4]
call fcn.004048f8
jne 0x4589a0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004049ac
mov esi, eax
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4589e6
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call sub.kernel32.dll_CreateProcessA
jmp 0x4589e6
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004049ac
mov esi, eax
push esi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4589e6
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push esi
call sub.kernel32.dll_CreateProcessA
mov esi, dword [ebp - 0x24]
jmp 0x458a03
mov ecx, esi
xor edx, edx
mov eax, 0x1f0fff
call fcn.0045c760
mov esi, eax
test esi, esi
je 0x458abf
push 0x40
push 0x1000
mov eax, dword [ebp - 8]
call fcn.004047ac
push eax
push 0
push esi
call fcn.00457ef8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x458a41
push 0x1000
push 0x40
mov eax, dword [ebp - 8]
call fcn.004047ac
mov ecx, eax
xor edx, edx
mov eax, esi
call fcn.0045e474
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.004047ac
push eax
lea eax, [ebp - 8]
call fcn.00404a04
push eax
mov eax, dword [ebp - 0xc]
push eax
push esi
call fcn.00457fd4
mov eax, dword [ebp - 8]
call fcn.004047ac
sub eax, 2
cdq
push edx
push eax
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x458a83
cmp eax, dword [esp]
pop edx
pop eax
jae 0x458aa8
jmp 0x458a87
pop edx
pop eax
jge 0x458aa8
mov eax, dword [ebp - 8]
call fcn.004047ac
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
call fcn.00404a04
mov ecx, eax
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0045d7c8
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x14]
push eax
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.0045e7e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458ae9
lea eax, [ebp - 0x6c]
call fcn.004044d0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004044f4
ret
Function at 0x459c48
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040499c
mov eax, dword [ebp - 8]
call fcn.0040499c
mov eax, dword [ebp - 0xc]
call fcn.0040499c
xor eax, eax
push ebp
push 0x459d5d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x472f24], eax
mov eax, 0x472f38
mov edx, dword [ebp - 4]
call fcn.00404524
mov eax, 0x472f34
mov edx, dword [ebp - 0xc]
call fcn.00404524
lea eax, [ebp - 0x10]
call fcn.0045e88c
mov eax, dword [ebp - 8]
call fcn.004049ac
call fcn.0045c908
mov eax, 0x64
call fcn.0045c22c
push 0
push 0
push 0x472f28
mov ecx, 0x457b10
xor edx, edx
xor eax, eax
call fcn.00404484
mov edi, eax
xor ebx, ebx
xor esi, esi
cmp dword [0x472f24], 0
jne 0x459d2f
mov eax, 0x64
call fcn.0045c22c
inc ebx
cmp bx, 0x64
jle 0x459d26
cmp si, 2
je 0x459d2f
inc esi
push 0
push edi
call sub.kernel32.dll_TerminateThread_1
push 0
push 0
push 0x472f28
mov ecx, 0x457b10
xor edx, edx
xor eax, eax
call fcn.00404484
mov edi, eax
xor ebx, ebx
cmp dword [0x472f24], 0
je 0x459ceb
mov ebx, dword [0x472f24]
mov eax, dword [ebp - 0x10]
call fcn.004049ac
call fcn.0045c908
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459d64
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004044f4
ret

Function at 0x45a114
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040499c
xor eax, eax
push ebp
push 0x45a228
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, 0x45a23c
mov eax, dword [ebp - 4]
call fcn.004578f0
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 4]
call fcn.00404568
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call fcn.00404568
mov eax, dword [ebp - 0x10]
call fcn.004047ac
mov edx, dword [0x471480]
mov dword [edx], eax
mov eax, dword [0x471480]
mov eax, dword [eax]
call fcn.00402a48
mov edx, dword [0x4714b4]
mov dword [edx], eax
lea eax, [ebp - 0x10]
call fcn.00404a04
mov edx, eax
mov ecx, dword [0x471480]
mov ecx, dword [ecx]
mov eax, dword [0x4714b4]
mov eax, dword [eax]
call fcn.00433ac8
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.0044852c
lea eax, [ebp - 0xc]
call fcn.00404a04
call fcn.00457c08
mov ebx, eax
mov eax, 0x7d0
call fcn.0045c22c
push 0
push ebx
call sub.kernel32.dll_TerminateThread_1
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.00448518
mov edx, dword [0x471480]
mov edx, dword [edx]
mov eax, dword [0x4714b4]
mov eax, dword [eax]
call fcn.00402a78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a22f
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004044f4
lea eax, [ebp - 8]
mov edx, dword [0x454798]
call fcn.00405a34
lea eax, [ebp - 4]
call fcn.004044d0
ret
Function at 0x45a7ac
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
xor edx, edx
mov dword [esp], edx
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x45a7e7
push 0
push 0x45a8e4
push 0x45a8e8
push 0
call sub.user32.dll_MessageBoxA_1
xor edx, edx
mov eax, ebp
call fcn.0045e514
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
call fcn.00402a48
mov ebx, eax
lea eax, [esp + 8]
push eax
push 0
mov edx, ebx
mov ecx, dword [esp + 0xc]
mov eax, ebp
call fcn.0045e62c
test eax, eax
jne 0x45a82a
push 0
push 0x45a8e4
push 0x45a8ec
push 0
call sub.user32.dll_MessageBoxA_1
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x3c]
add eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x50]
call fcn.00402a48
mov dword [esp], eax
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x50]
mov eax, dword [esp]
call fcn.00407064
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x54]
push eax
push ebx
mov eax, dword [esp + 8]
push eax
call fcn.0045c210
mov eax, dword [esp + 0x10]
mov si, word [eax + 6]
dec esi
test si, si
jb 0x45a8c6
inc esi
xor edi, edi
mov edx, dword [esp + 0xc]
mov edx, dword [edx + 0x3c]
mov eax, ebx
add edx, eax
add edx, 0xf8
movzx ecx, di
shl ecx, 3
lea ecx, [ecx + ecx*4]
add edx, ecx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x14]
mov edx, dword [edx + 0x10]
push edx
mov edx, dword [esp + 0x18]
mov edx, dword [edx + 0x14]
add edx, eax
push edx
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0xc]
add eax, dword [esp + 8]
push eax
call fcn.0045c210
inc edi
dec si
jne 0x45a87d
mov edx, dword [esp + 4]
mov eax, ebx
call fcn.00402a78
mov eax, ebp
call fcn.0045ccf4
mov eax, dword [esp]
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45a95c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov dword [esp], edx
mov esi, eax
xor eax, eax
mov dword [esp + 4], eax
mov edx, dword [esi + 0x3c]
mov eax, esi
add edx, eax
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
add edx, 0x78
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
mov edx, dword [edx]
add edx, eax
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x1c]
add edx, eax
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x20]
add edx, eax
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 0x24]
add edx, eax
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov ebx, dword [eax + 0x18]
dec ebx
test ebx, ebx
jb 0x45aa46
inc ebx
mov eax, dword [esp + 0x20]
movzx edx, word [eax]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
cmp edx, eax
jbe 0x45a9e9
add dword [esp + 0x18], 4
inc eax
cmp edx, eax
ja 0x45a9df
mov edx, dword [esp + 0xc]
mov edx, dword [edx]
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
cmp edx, eax
ja 0x45aa04
mov ecx, dword [esp + 0xc]
add edx, dword [ecx + 4]
cmp eax, edx
jb 0x45aa39
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
add eax, esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
call fcn.0045a698
mov ecx, eax
mov edx, dword [esp + 0x24]
xor eax, eax
call fcn.0045a6ac
cmp eax, dword [esp]
jne 0x45aa39
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
add eax, esi
mov dword [esp + 4], eax
jmp 0x45aa46
add dword [esp + 0x20], 2
add dword [esp + 0x1c], 4
dec ebx
jne 0x45a9ca
mov eax, dword [esp + 4]
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x45fb34
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x45fc3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, 1
call fcn.0043f8e8
mov dl, 1
mov eax, dword [0x434c4c]
call fcn.0043827c
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x45fc28
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0045ff58
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, esi
mov eax, ebx
call fcn.0043f550
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x58]
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4714e0]
cmp byte [eax], 0
jne 0x45fb9e
mov eax, dword [0x471608]
mov byte [eax], 1
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x43f5cc
xor edx, edx
xor eax, eax
call fcn.00404484
mov ebx, eax
push 0x1770
push ebx
call sub.kernel32.dll_WaitForSingleObject
mov edx, dword [0x471608]
mov byte [edx], 0
sub eax, 1
jae 0x45fc02
mov ebx, dword [ebp - 0x24]
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [ebx + 4]
mov eax, dword [ebp + 8]
call fcn.004045c0
jmp 0x45fc0a
push 0
push ebx
call sub.kernel32.dll_TerminateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45fc2f
mov eax, dword [ebp - 4]
call fcn.004036fc
mov eax, dword [ebp - 0x24]
call fcn.004036fc
ret
Function at 0x45fd48
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45ff23
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x415ef0]
call fcn.004036cc
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x415ef0]
call fcn.004036cc
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
xor eax, eax
push ebp
push 0x45fefe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push 0x45fd30
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x45fedc
inc esi
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004173b4
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00417418
inc eax
jne 0x45fed4
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004173b4
push eax
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.00404740
mov eax, dword [ebp - 0x120]
mov edx, 0x45ff3c
call fcn.004048f8
jne 0x45fe36
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004173b4
mov dword [ebp - 8], eax
lea eax, [ebp - 0x124]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.00404740
mov edx, dword [ebp - 0x124]
mov eax, 0x45ff4c
call fcn.00404a94
test eax, eax
jle 0x45fe6d
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004173b4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x45fed4
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45fed4
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetWindowRect
test eax, eax
je 0x45fed4
mov dl, 1
mov eax, dword [0x434c4c]
call fcn.0043827c
mov edi, eax
mov cl, 1
mov edx, edi
mov eax, dword [ebp - 8]
call fcn.0045fc50
push edi
mov eax, dword [ebp - 4]
call fcn.004387d8
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp - 0x11c]
call fcn.00436300
mov eax, edi
call fcn.004036fc
xor eax, eax
mov dword [ebp - 8], eax
inc ebx
dec esi
jne 0x45fdc7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ff05
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004036fc
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax - 4], edx
ret

Function at 0x46034c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040499c
xor eax, eax
push ebp
push 0x4603af
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x4603c4
call fcn.004047b4
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004047ac
push eax
lea eax, [ebp - 4]
call fcn.00404a04
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4603b6
lea eax, [ebp - 4]
call fcn.004044d0
ret
Function at 0x4603c8
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x4603d1
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46048e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004044d0
mov dword [ebp - 0xc], 0x7fff
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push ebx
call sub.kernel32.dll_PeekNamedPipe
cmp dword [ebp - 8], 0
jbe 0x460478
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x800b]
push eax
push ebx
call sub.kernel32.dll_ReadFile
lea eax, [ebp - 0x800b]
push eax
lea eax, [ebp - 0x800b]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 4]
lea edx, [ebp - 0x800b]
mov ecx, 0x7fff
call fcn.004045c0
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404adc
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460495
lea eax, [ebp - 4]
call fcn.004044d0
ret
Function at 0x461dc8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x461e5f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, 0x461e74
call fcn.00457a04
push 0
push 0
lea edx, [ebp - 8]
mov eax, 0x461f78
call fcn.00457a04
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004047b4
mov eax, dword [ebp - 8]
call fcn.004049ac
push eax
lea edx, [ebp - 0xc]
mov eax, 0x461f88
call fcn.00457a04
mov eax, dword [ebp - 0xc]
call fcn.004049ac
push eax
lea edx, [ebp - 0x10]
mov eax, 0x461f9c
call fcn.00457a04
mov eax, dword [ebp - 0x10]
call fcn.004049ac
push eax
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461e66
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004044f4
ret