joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440b92
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
imul eax, edx, 0x3e8
mov esi, ecx
or ecx, 0xffffffff
xor ebx, ebx
test edx, edx
cmove eax, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x440bcc
cmp dword [ebp + 8], 0
mov bl, 1
je 0x440bd9
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x440bd9
cmp byte [ebp + 0xc], bl
je 0x440bd9
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
mov al, bl
pop ebx
pop ebp
ret

Function at 0x440bdf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
cmp byte [0x4e1c00], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
je 0x440c2c
call fcn.004154f6
cmp eax, 5
jg 0x440c2c
push 0x4bbff4
xor esi, esi
push esi
call fcn.00443f03
pop ecx
pop ecx
push dword [ebp + 0x14]
push esi
push edi
push ebx
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, eax
xor ebx, ebx
cmp esi, 0x20
setg bl
jmp 0x440c74
mov eax, dword [ebp + 0x14]
xor esi, esi
mov dword [ebp - 0x20], eax
xor eax, eax
push 7
mov dword [ebp - 0x28], edi
lea edi, [ebp - 0x1c]
pop ecx
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], str.runas
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, dword [ebp - 4]
lea ebx, [eax - 1]
neg ebx
sbb ebx, ebx
inc ebx
test ebx, ebx
je 0x440c96
mov edx, dword [ebp + 8]
test edx, edx
je 0x440c8f
mov edx, dword [edx]
mov ecx, esi
push 1
push dword [ebp + 0x10]
call fcn.00440b92
pop ecx
pop ecx
mov ecx, esi
call fcn.00443166
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x443208
Capabilities:
Set file attributes

Disassembly:
mov edx, dword [0x4defc8]
test edx, edx
je 0x44322b
cmp dword [edx + 0x90], 0
je 0x44322b
mov eax, dword [edx]
push 0x80
push ecx
push edx
call dword [eax + 0x90]
ret
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret

Function at 0x4436e2
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push 0x64c
mov eax, 0x4a1620
call fcn.0045cd4f
push 0x20a
xor ebx, ebx
lea eax, [ebp - 0x224]
push ebx
push eax
call fcn.0045e560
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x64c]
call fcn.00410936
lea eax, [ebp - 0x224]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x64c]
push eax
call fcn.004108ce
lea eax, [ebp - 0x64c]
push str.SESelfCleaning.exe
push eax
call fcn.004108ce
add esp, 0x10
lea ecx, [ebp - 0x64c]
call fcn.00410b38
push eax
lea ecx, [ebp - 0x23c]
call fcn.00408923
lea ecx, [ebp - 0x64c]
call fcn.00410913
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x23c]
mov esi, dword [0x4e1ed0]
call fcn.00408b05
push ebx
push 0x80
push 2
push ebx
push 2
mov edx, 0x40000000
mov ecx, eax
call fcn.004430c2
mov dword [ebp - 0x658], eax
cmp eax, 0xffffffff
je 0x443866
push 0x4bc7e8
movzx eax, si
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ecx
lea ecx, [ebp - 0x654]
mov dword [ebp - 0x654], ebx
push ecx
mov ecx, dword [ebp - 0x658]
mov edx, edi
push eax
call fcn.0044310b
mov ecx, dword [ebp - 0x658]
call fcn.00443166
lea ecx, [ebp - 0x23c]
call fcn.00408b05
mov ecx, eax
call fcn.00443238
test eax, eax
je 0x443866
push ebx
lea eax, [ebp - 0x650]
mov dword [ebp - 0x650], 1
push eax
push ecx
push 0x4b5698
lea ecx, [ebp - 0x23c]
call fcn.00408b05
xor edx, edx
mov ecx, eax
call fcn.00440bdf
lea ecx, [ebp - 0x23c]
call fcn.00448022
push dword [ebp - 0x650]
push str.Called_Bypass_EXE__Ret__d
push ebx
call fcn.00443f03
add esp, 0x1c
cmp dword [ebp - 0x650], ebx
sete bl
jmp 0x443881
lea ecx, [ebp - 0x23c]
call fcn.00408b05
push eax
push str.Release_force_exe_failed__s
push 2
call fcn.00443f03
add esp, 0xc
lea ecx, [ebp - 0x23c]
call fcn.00408cf0
mov al, bl
call fcn.0045ccf9
ret
Function at 0x444556
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, 0xffff
mov esi, ecx
cmp di, bx
jne 0x44457f
xor eax, eax
jmp 0x44464a
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x4445ab
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x4445ab
dec dword [edx]
mov ax, bx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], bx
jmp 0x44464a
cmp dword [esi + 0x4c], 0
je 0x444647
mov ecx, esi
call fcn.00444c09
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4445d8
push dword [esi + 0x4c]
push ebx
call fcn.00467f6e
pop ecx
pop ecx
cmp ax, di
je 0x444647
movzx edi, bx
jmp 0x444647
movzx eax, bx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x444647
cmp eax, 1
jle 0x444615
cmp eax, 3
jne 0x444647
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x4445c7
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x444638
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.00468f14
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x444647
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x34], eax
mov ax, bx
jne 0x44464a
mov ax, di
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045c170
leave
ret 4

Function at 0x444c93
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x444d19
cmp byte [esi + 0x3e], 0
je 0x444d19
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
cmp di, ax
je 0x444ceb
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x444cef
sub eax, 1
je 0x444cf3
dec eax
sub eax, 1
je 0x444d19
xor al, al
jmp 0x444d1b
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x444d10
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00468f14
add esp, 0x10
cmp edi, eax
jne 0x444ceb
cmp byte [esi + 0x3e], 0
sete al
jmp 0x444d1b
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045c170
leave
ret

Function at 0x44609b
Capabilities:
Query environment variable

Disassembly:
call fcn.004460c3
test al, al
jne 0x4460c2
push 0x30
push 0x4bcaec
push 0x4bcb08
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, str.http:__ie.sogou.com_bbs_forum.php_modforumdisplayfid33
jmp fcn.00448bf8
ret
Function at 0x446485
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 8
mov eax, 0x4a1a06
call fcn.0045cd1b
mov esi, ecx
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [esi], edi
movzx eax, word [ebp + 8]
lea ebx, [esi + 8]
push 0x4bcb2c
mov dword [ebp - 4], edi
push eax
mov dword [esi + 4], edi
push edi
mov dword [ebx], edi
mov dword [ebx + 4], edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x4464f4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4464f4
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4464f4
mov edx, dword [ebp - 0x10]
push ecx
push ecx
mov ecx, eax
call fcn.0041d902
pop ecx
pop ecx
mov edi, eax
push edi
mov ecx, esi
call fcn.004210c1
push ebx
mov ecx, esi
call fcn.0043a08b
cmp byte [ebp + 0xc], 0
je 0x446513
mov dword [esi + 4], 1
jmp 0x446526
mov eax, dword [ebx]
test eax, eax
jle 0x446526
cmp dword [esi + 0xc], 0
jle 0x446526
cdq
idiv dword [esi + 0xc]
mov dword [esi + 4], eax
mov eax, esi
call fcn.0045cce4
ret 8

Function at 0x447189
Capabilities:
Check mutex on windows

Disassembly:
push 0x414
mov eax, 0x4a05cc
call fcn.0045cd4f
mov esi, ecx
test dl, dl
je 0x447213
lea eax, [ebp - 0x210]
mov dword [ebp - 0x218], 0x200
xor ebx, ebx
mov dword [ebp - 0x214], eax
mov edx, esi
mov dword [ebp - 0x21c], ebx
lea ecx, [ebp - 0x21c]
call fcn.00415f57
mov dl, 0x20
mov ecx, eax
call fcn.0041cf6b
mov ecx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x21c]
mov byte [ecx + eax], bl
push dword [ebp - 0x214]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x420], esi
cmp dword [ebp - 0x214], eax
je 0x44726a
push dword [ebp - 0x214]
call fcn.00461d54
pop ecx
jmp 0x44726a
lea ecx, [ebp - 0x41c]
call fcn.00410936
push esi
lea eax, [ebp - 0x41c]
xor ebx, ebx
push 0x4bcb7c
push eax
mov dword [ebp - 4], ebx
call fcn.004108ce
pop ecx
pop ecx
push eax
call fcn.004108ce
pop ecx
pop ecx
lea ecx, [ebp - 0x41c]
call fcn.00410b38
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x41c]
mov esi, eax
mov dword [ebp - 0x420], esi
call fcn.00410913
test esi, esi
je 0x447287
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x447287
mov ecx, esi
call fcn.00443166
xor eax, eax
inc eax
jmp 0x4472a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x447282
lea eax, [ebp - 0x420]
mov ecx, 0x4e1d68
push eax
call fcn.00440c9d
xor eax, eax
call fcn.0045ccf9
ret
Function at 0x447722
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x4d406c]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 8]
mov edx, 0x19a
push ebx
push esi
push edi
test eax, eax
mov edi, ecx
mov ecx, dword [ebp + 0xc]
cmovne edx, eax
mov dword [esp + 0x1c], edi
test ecx, ecx
mov dword [esp + 0x18], edx
mov eax, 0x23c
cmovne eax, ecx
xor ebx, ebx
push eax
push edx
push ebx
push ebx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x24], eax
call fcn.004097e6
mov edx, eax
lea ecx, [esp + 0x3c]
call fcn.004468cd
push ebx
lea ecx, [esp + 0x24]
mov esi, eax
call fcn.0040898f
cmp dword [0x4d8bd8], 0
lea ebx, [edi + 0x160]
mov dword [esp + 0x10], ebx
jne 0x4477a4
call fcn.0041407d
mov dword [0x4d8bd8], eax
lea eax, [ebx + 0x20]
mov ecx, 0x4d8ba8
push eax
call fcn.00414e21
push 0x86000000
movzx ebx, ax
call fcn.0041409c
mov edi, eax
mov dword [esp], 0x40008
call fcn.0041408e
pop ecx
xor ecx, ecx
push ecx
push ebx
push dword [esp + 0x28]
push eax
push edi
push ecx
push esi
push ecx
mov ecx, dword [esp + 0x30]
call fcn.004140aa
mov ebx, dword [esp + 0x1c]
push ecx
lea edi, [ebx + 0x164]
mov ecx, edi
call fcn.00447d9a
push 5
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebx + 0x34c]
lea ecx, [esp + 0x24]
cdq
sub eax, edx
sar eax, 1
push eax
push eax
call fcn.00409d74
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x3c]
add eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x28]
add eax, dword [esp + 0x1c]
push eax
push 0
push 0
call fcn.004097e6
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.004468cd
push 0
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.0040898f
mov eax, dword [edi]
add ebx, 0x300
cmp dword [0x4d8c68], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
jne 0x447870
call fcn.0041407d
mov dword [0x4d8c68], eax
lea eax, [ebx + 0x20]
mov ecx, 0x4d8c38
push eax
call fcn.00414e21
push 0x96000000
movzx ebx, ax
call fcn.0041409c
mov edi, eax
mov dword [esp], 0x80800a0
call fcn.0041408e
pop ecx
mov ecx, dword [esp + 0x10]
push 0
push ebx
push dword [esp + 0x20]
push eax
push edi
push str.SEInstallerBorder
push esi
push dword [esp + 0x30]
call fcn.004140aa
mov ecx, dword [esp + 0x1c]
call fcn.004478e9
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045c170
mov esp, ebp
pop ebp
ret 8
Function at 0x448022
Capabilities:
Move file

Disassembly:
push 0x42c
mov eax, 0x4a1d1d
call fcn.0045cd4f
mov esi, ecx
call fcn.00408b05
mov ecx, eax
call fcn.00443238
test eax, eax
jne 0x44804a
mov al, 1
jmp 0x44817a
mov ecx, esi
call fcn.00408b05
mov ecx, eax
call fcn.00443146
test eax, eax
jne 0x448043
mov ecx, esi
call fcn.00408b05
mov edi, eax
push 0x5c
push edi
call fcn.0045f90b
pop ecx
pop ecx
test eax, eax
je 0x448078
add eax, 2
jmp 0x44807a
mov eax, edi
push 0x4bcd98
push eax
call fcn.0045f68f
pop ecx
pop ecx
test eax, eax
je 0x4480bc
mov ecx, eax
call fcn.00447ffc
test al, al
je 0x4480bc
mov ecx, esi
call fcn.00408b05
mov ecx, eax
call fcn.00443146
test eax, eax
jne 0x448043
push 4
mov ecx, esi
call fcn.00408b05
xor edx, edx
mov ecx, eax
call fcn.004431d1
jmp 0x448043
lea ecx, [ebp - 0x438]
call fcn.00410936
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004097a0
xor ebx, ebx
lea ecx, [ebp - 0x28]
inc ebx
mov byte [ebp - 4], bl
call fcn.00448b0d
lea eax, [ebp - 0x28]
push eax
push 0x4b8988
lea eax, [ebp - 0x438]
push esi
push eax
call fcn.0040f2fd
pop ecx
pop ecx
push eax
call fcn.004108ce
pop ecx
pop ecx
push eax
call fcn.0040f2fd
pop ecx
pop ecx
mov ecx, esi
call fcn.00408b05
mov ecx, eax
call fcn.00443208
lea ecx, [ebp - 0x438]
call fcn.00410b38
push eax
mov ecx, esi
call fcn.00408b05
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x448163
lea ecx, [ebp - 0x438]
call fcn.00410b38
mov ecx, eax
call fcn.00443146
test eax, eax
jne 0x448165
push 4
lea ecx, [ebp - 0x438]
call fcn.00410b38
xor edx, edx
mov ecx, eax
call fcn.004431d1
jmp 0x448165
xor bl, bl
lea ecx, [ebp - 0x28]
call fcn.00408cf0
lea ecx, [ebp - 0x438]
call fcn.00410913
mov al, bl
call fcn.0045ccf9
ret
Function at 0x448bf8
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4d406c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor eax, eax
cmp ax, word [esi]
jne 0x448c19
xor al, al
jmp 0x448c80
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0045e560
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push str._ProgramFiles_Internet_ExplorerIExplore.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x448c68
lea ecx, [ebp - 0x20c]
call fcn.00443238
test eax, eax
je 0x448c68
push 5
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
jmp 0x448c6d
push 5
push edi
push edi
push esi
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
pop edi
setg al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0045c170
leave
ret

Function at 0x449b73
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x4d406c]
xor eax, esp
mov dword [esp + 0x20], eax
cmp byte [0x4e1f78], 0
push ebx
push esi
push edi
mov ebx, 0x4e1f78
jne 0x449c70
and dword [esp + 0x10], 0
lea ecx, [esp + 0x14]
push 0xfde9
push 0xffffffffffffffff
mov edx, 0x4bc078
mov dword [esp + 0x14], 0x40
call fcn.0041a8aa
pop ecx
pop ecx
lea eax, [esp + 0xc]
push eax
push ebx
lea eax, [esp + 0x18]
push eax
push 0x4bcee0
lea ecx, [esp + 0x24]
call fcn.0041321d
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.004134bc
test esi, esi
je 0x449c70
xor eax, eax
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
push ecx
lea ecx, [esp + 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00454b9d
pop ecx
test al, al
je 0x449c2b
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push str._08X_08X_08X_08X
push ebx
call fcn.0044a317
add esp, 0x18
push 0xfde9
push 0xffffffffffffffff
mov edx, 0x4bc078
lea ecx, [esp + 0x1c]
call fcn.0041a8aa
push ebx
call fcn.004622d0
add esp, 0xc
lea ecx, [esp + 0x14]
push eax
push ebx
push 1
push 0x4bcee0
call fcn.0041321d
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [esp + 0x14]
call fcn.004134bc
mov ecx, dword [esp + 0x2c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0045c170
mov esp, ebp
pop ebp
ret
Function at 0x44b678
Capabilities:
Create process on windows

Disassembly:
push 0x50
mov eax, 0x4a23af
call fcn.0045cd1b
mov esi, dword [0x4dd884]
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov ecx, edi
call fcn.0040f3b1
test al, al
je 0x44b6a9
push edi
call fcn.0044b784
test al, al
je 0x44b77c
xor ebx, ebx
mov dword [ebp - 0x58], 0x3c
mov ecx, edi
mov dword [ebp - 0x54], 0x100000
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], str.open
call fcn.00408b05
mov dword [ebp - 0x48], eax
lea edi, [ebp - 0x38]
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], 5
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x44b779
push 0x30
call fcn.0045c429
mov ebx, eax
pop ecx
mov dword [ebp - 0x18], ebx
xor eax, eax
mov dword [ebp - 4], eax
mov edi, dword [esi + 0x1c]
lea esi, [ebx + 0x20]
mov dword [ebx], eax
mov byte [ebx + 4], al
mov byte [ebx + 0x18], al
mov dword [ebx + 0x1c], eax
mov dword [ebp - 0x1c], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.0042d462
or dword [ebp - 4], 0xffffffff
mov dword [esi], eax
mov esi, dword [ebp - 0x10]
mov dword [ebx + 0x28], edi
mov dword [ebx + 0x2c], esi
mov edi, dword [esi]
mov dword [esi], ebx
test edi, edi
je 0x44b752
lea ecx, [edi + 0x20]
call 0x44ba88
push 0x30
push edi
call fcn.0045c181
pop ecx
pop ecx
mov esi, dword [esi]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [esi + 0x28]
push dword [esi + 0x2c]
mov dword [esi], eax
mov byte [esi + 0x18], 1
mov eax, dword [ecx]
push 0x3e8
push 0x7512
call dword [eax]
mov eax, dword [ebp - 0x14]
test eax, eax
setne al
call fcn.0045cce4
ret 4
Function at 0x44cadc
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x4cd800
call fcn.0045d310
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x44cb43
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x44cb43
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x44cb43
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x44cb43
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x44cb4c
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44cbff
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x4e1eec]
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x4e1ef4]
test edx, edx
jne 0x44cc4d
test eax, eax
je 0x44cc60
mov edx, eax
mov dword [0x4e1eec], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x44cc60
cmp ecx, ebx
jb 0x44cc60
cmp ecx, edi
jbe 0x44cd3b
mov edx, eax
test eax, eax
jmp 0x44cc82
test edx, edx
je 0x44cc7d
mov eax, dword [edx + 8]
test eax, eax
je 0x44cc7d
cmp eax, ebx
jb 0x44cc7d
cmp eax, edi
jbe 0x44cd3b
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x4e1eec], edx
jne 0x44cc66
and esi, 0xffff0000
mov ecx, esi
cmp esi, ebx
jbe 0x44cddb
lea eax, [ecx - 0x70000000]
mov edx, 0x6fff0000
cmp eax, 0x10000000
lea eax, [ebp - 0x3c]
push 0x1c
cmovbe ecx, edx
push eax
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x44cddb
mov eax, 0x10000
cmp dword [ebp - 0x2c], eax
jne 0x44ccd4
cmp dword [ebp - 0x30], eax
jae 0x44cce6
mov ecx, dword [ebp - 0x38]
add ecx, 0xffff0000
cmp ecx, ebx
ja 0x44cc9a
jmp 0x44cddb
push 0x40
push 0x3000
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [0x4e1eec], edx
test edx, edx
je 0x44cddb
mov eax, dword [0x4e1ef4]
xor ecx, ecx
mov dword [edx + 4], eax
mov esi, 0x7fd
mov dword [edx], 0x52727464
lea eax, [edx + 0xffe0]
mov dword [edx + 8], ecx
mov dword [0x4e1ef4], edx
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
sub esi, 1
jne 0x44cd2b
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x44cddf
cmp esi, edi
ja 0x44cddf
mov ecx, dword [esi + 0x18]
mov eax, 0xcccccccc
mov dword [edx + 8], ecx
mov edi, esi
push 8
pop ecx
rep stosd dword es:[edi], eax
mov eax, esi
jmp 0x44cde1
lea eax, [esi - 0x70000000]
mov ecx, 0x80010000
cmp eax, 0x10000000
lea eax, [ebp - 0x20]
push 0x1c
cmovbe esi, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x44cddf
mov eax, 0x10000
cmp dword [ebp - 0x10], eax
jne 0x44cdd3
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
jb 0x44cdd6
movzx edx, si
test edx, edx
je 0x44cdb4
mov esi, dword [ebp - 0x20]
sub eax, edx
sub ecx, eax
add esi, eax
mov dword [ebp - 0x14], ecx
mov eax, 0x10000
mov dword [ebp - 0x20], esi
push 0x40
push 0x3000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [0x4e1eec], edx
test edx, edx
jne 0x44cd07
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
add esi, ecx
cmp esi, edi
jb 0x44cd64
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44ceb8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x4e1ee8], 0
push esi
jne 0x44cf22
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x4e1ee8
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x44cf22
mov dword [0x4e1efc], esi
mov dword [0x4e1f00], esi
mov dword [0x4e1ef8], esi
mov dword [0x4e1ee4], esi
mov dword [0x4e1ef0], esi
mov esi, dword [0x4e1ef4]
jmp 0x44cf1a
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
test esi, esi
jne 0x44cf05
xor eax, eax
jmp 0x44cf27
mov eax, 0x10dd
pop esi
leave
ret