joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4576b9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
call fcn.0045818f
test al, al
jne 0x4576d6
xor al, al
leave
ret
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x457707
push 0x10
push 0xfffe
push str.Install_Error
push str.To_install_software_you_must_be_logged_on_as_this_computers_Administrator._If_you_are_not_able_to_do_this__ask_your_computer_Administrator_to_log_in_and_run_the_setup_file_again.
push 0
mov ecx, str.Continue
call fcn.0046eae8
jmp 0x4576d2
call fcn.00443827
test al, al
je 0x4576d2
push 0xfffffffffffffffe
call fcn.00454cc8
mov al, 1
leave
ret

Function at 0x457bda
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x108c
call fcn.0052d050
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x45c]
push eax
push edi
push edi
push 0x26
push edi
mov word [ebp - 0x45c], di
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x53ec98
push 0x548c40
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x108c]
push eax
call fcn.0044a0d6
push str.NCH_Swift_Sound
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0xe84]
push eax
call fcn.00401dde
lea eax, [ebp - 0x664]
call fcn.00449281
push str.NCH_SoftwareProgram_Files
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0xc7c]
push eax
call fcn.00401dde
push str.NCH_Swift_SoundProgram_Files
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0xa74]
push eax
call fcn.00401dde
xor ebx, ebx
cmp word [ebp - 0x108c], di
mov word [ebp - 0x86c], di
je 0x457cf8
lea eax, [ebp - 0x108c]
mov ecx, 0x548c7c
lea esi, [ebp - 0x254]
call fcn.00401d5c
jmp 0x457cda
lea eax, [ebp - 0x254]
call fcn.00401dba
test al, al
jne 0x457ccf
mov eax, dword [ebp - 0x250]
shr eax, 4
test al, 1
je 0x457ccf
mov ecx, str.Components
lea eax, [ebp - 0x224]
call fcn.00401031
test eax, eax
jne 0x457cff
lea esi, [ebp - 0x254]
call fcn.00401d99
cmp dword [ebp - 0x254], 0xffffffff
jne 0x457c9f
inc ebx
mov eax, ebx
imul eax, eax, 0x208
lea eax, [ebp + eax - 0x108c]
cmp word [eax], di
jne 0x457c8d
xor al, al
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp - 0x254], 0xffffffff
je 0x457d14
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
jmp 0x457cfa
Function at 0x45818f
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc30
cmp word [0x5a9a38], 0
je 0x4581b4
push dword [ebp + 8]
mov eax, 0x5a9a38
call fcn.00401016
jmp 0x4582d0
push ebx
push esi
push edi
lea eax, [ebp - 0xa28]
push eax
call fcn.004582d6
mov esi, 0x53ec98
push esi
mov ebx, 0x548bf4
push ebx
lea eax, [ebp - 0xa28]
push eax
mov edi, 0x5a9a38
push edi
call fcn.0044a0d6
push dword [ebp + 8]
mov eax, edi
call fcn.00401016
push str.InstalledByAdmin
push str.Settings
call fcn.00444b52
lea eax, [ebp - 0x410]
call fcn.00449281
push esi
push 0x548c40
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x618]
push eax
call fcn.0044a0d6
push esi
push str.Program_Files
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x820]
push eax
call fcn.0044a0d6
push esi
push ebx
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0xc30]
push eax
call fcn.0044a0d6
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push edi
call ebx
push esi
push str.testfolder
push edi
lea eax, [ebp - 0x208]
push eax
call fcn.0044a0d6
push 0
lea eax, [ebp - 0x208]
push eax
call ebx
test eax, eax
je 0x458299
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 1
push str.InstalledByAdmin
push str.Settings
call fcn.004014b9
jmp 0x4582cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x4582a9
cmp eax, 5
jne 0x4582cd
push edi
lea eax, [ebp - 0xc30]
call fcn.00401016
mov ecx, edi
call fcn.0044a4b7
push dword [ebp + 8]
mov eax, edi
call fcn.00401016
mov byte [0x5a9c9a], 1
pop edi
pop esi
pop ebx
mov al, 1
leave
ret 4

Function at 0x4582d6
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
xor eax, eax
lea ecx, [ebp - 0x208]
push ecx
push eax
push eax
push 0x26
push eax
mov word [ebp - 0x208], ax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x548c40
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call fcn.00401dde
push dword [ebp + 8]
call fcn.00401d29
test al, al
jne 0x458322
push dword [ebp + 8]
call fcn.00401d14
leave
ret 4

Function at 0x4585e5
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
lea eax, [ebp - 0x208]
call fcn.0044936f
cmp word [ebp - 0x208], 0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, str..lnk
mov edi, 0x549180
je 0x458634
push ebx
push edi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.0044a0d6
lea eax, [ebp - 0x410]
push eax
call esi
lea eax, [ebp - 0x208]
call fcn.00449381
cmp word [ebp - 0x208], 0
je 0x458667
push ebx
push edi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.0044a0d6
lea eax, [ebp - 0x410]
push eax
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x458926
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
push ebx
push esi
mov esi, dword [ebp + 0x10]
push 0xd
push str.Applications_
push dword [ebp + 0xc]
xor ebx, ebx
mov word [esi], bx
call fcn.0052094c
add esp, 0xc
test eax, eax
jne 0x45896d
push 0x53ec98
push ebx
push dword [ebp + 0xc]
mov eax, esi
push SysReAllocString
call fcn.004010db
cmp word [esi], bx
jne 0x458a87
lea eax, [ebp - 0x10]
push eax
push 1
push ebx
push str.SoftwareRegisteredApplications
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x458a87
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
push dword [ebp - 0x10]
mov esi, 0x104
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x458a7e
push edi
lea eax, [ebp - 0x220]
push eax
push str._sFileAssociations
lea edi, [ebp - 0x838]
call fcn.0044b138
pop ecx
pop ecx
lea eax, [ebp - 0x14]
push eax
push 1
push ebx
mov eax, edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x458a38
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x630]
push eax
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x18], esi
push dword [ebp - 0x14]
mov word [ebp - 0x630], bx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x630]
push eax
push dword [ebp + 0xc]
call fcn.00535c2f
test eax, eax
pop ecx
pop ecx
je 0x458a6f
inc dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
push dword [ebp - 0x10]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x4589c5
jmp 0x458a7d
push dword [ebp + 0x10]
lea eax, [ebp - 0x428]
call fcn.00401016
pop edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
leave
ret 0xc
Function at 0x458a8d
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe40
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, 0x104
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_s
lea edi, [ebp - 0x418]
call fcn.0044b138
pop ecx
pop ecx
push 0x53ec98
mov esi, str.ExpressBurn.BAK
push esi
mov eax, edi
push eax
mov ebx, SysReAllocString
push ebx
lea eax, [ebp - 0x210]
call fcn.004010db
push esi
mov eax, edi
push eax
push ebx
call fcn.00401128
push dword [ebp + 8]
lea edi, [ebp - 0x620]
call fcn.00458711
lea ecx, [ebp - 0x210]
mov eax, edi
call fcn.00401031
xor edi, edi
test eax, eax
jne 0x458b04
mov word [ebp - 0x210], di
call fcn.004012f6
test al, al
je 0x458c18
cmp word [ebp - 0x210], di
je 0x458bb7
lea esi, [ebp - 1]
call fcn.00424032
lea eax, [ebp - 8]
push eax
push str._n_vSN
push 1
push edi
push 0x57cb44
mov dword [ebp - 8], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [ebp - 8], edi
je 0x458bab
lea eax, [ebp - 0xc38]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call fcn.00458926
cmp word [ebp - 0xc38], di
je 0x458b9e
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push edi
push dword [ebp + 8]
lea edx, [ebp - 0xc38]
push edx
push eax
call dword [ecx + 0x18]
cmp eax, edi
jne 0x458b9e
mov eax, dword [ebp - 8]
cmp eax, edi
je 0x458b89
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp - 1], 0
je 0x458c82
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x458c82
mov eax, dword [ebp - 8]
cmp eax, edi
je 0x458bab
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp - 1], 0
je 0x458bb7
call dword [sym.imp.ole32.dll_CoUninitialize]
push str.UserChoice
lea eax, [ebp - 0x418]
push eax
push 0x548be0
mov esi, 0x104
lea edi, [ebp - 0x828]
call fcn.0044b138
add esp, 0xc
push 0x53ec98
mov esi, str.Progid
push esi
mov eax, edi
push eax
push ebx
lea eax, [ebp - 0xe40]
call fcn.004010db
lea ecx, [ebp - 0x620]
lea eax, [ebp - 0xe40]
call fcn.00401031
test eax, eax
jne 0x458c14
mov eax, edi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor edi, edi
jmp 0x458c1d
mov esi, str.Progid
push 0x53ec98
push esi
lea eax, [ebp - 0x418]
push eax
push ebx
lea eax, [ebp - 0xa30]
call fcn.004010db
cmp word [ebp - 0xa30], di
je 0x458c82
lea ecx, [ebp - 0x620]
lea eax, [ebp - 0xa30]
call fcn.00401031
test eax, eax
jne 0x458c82
cmp word [ebp - 0x210], di
jne 0x458c6d
push esi
lea eax, [ebp - 0x418]
push eax
push ebx
call fcn.00401128
jmp 0x458c82
lea eax, [ebp - 0x210]
push eax
push esi
lea eax, [ebp - 0x418]
push eax
push ebx
call fcn.00423784
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x458c89
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.005251f0
add esp, 0xc
cmp byte [ebp + 8], 0
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x30], str.runas
jne 0x458cc1
mov dword [ebp - 0x30], 0x5675cc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0x4e20
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret 0xc
Function at 0x45928d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0x53ec98
xor ebx, ebx
push ebx
push dword [ebp + 8]
mov eax, esi
push SysReAllocString
call fcn.004010db
cmp word [esi], bx
jne 0x45938b
push edi
push dword [ebp + 8]
mov esi, 0x104
push str._sOpenWithProgIds
lea edi, [ebp - 0x418]
call fcn.0044b138
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
mov eax, edi
push eax
push SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x459329
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 8], esi
jmp 0x459316
mov eax, dword [ebp + 0xc]
cmp word [eax], bx
jne 0x459320
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 8]
push ecx
push eax
push ebx
push dword [ebp - 4]
call edi
test eax, eax
je 0x459305
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
cmp word [eax], bx
jne 0x45938a
push dword [ebp + 8]
lea edi, [ebp - 0x210]
push str.softwareclasses_s
call fcn.0044b138
pop ecx
pop ecx
push 0x53ec98
push ebx
mov eax, edi
mov edi, dword [ebp + 0xc]
push eax
mov esi, SysReAllocString
push esi
mov eax, edi
call fcn.004010db
cmp word [edi], bx
jne 0x45937b
push dword [ebp + 8]
call fcn.00458711
push edi
push ebx
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.00423784
push edi
push ebx
push dword [ebp + 8]
push SysReAllocString
call fcn.00423784
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4599c0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc30
push ebx
push esi
push edi
push dword [ebp + 0x10]
mov esi, 0x30c
push dword [ebp + 0xc]
lea edi, [ebp - 0x618]
push str._sShell_scommand
call fcn.0044b138
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0xc
mov eax, edi
push eax
push SysReAllocString
call ebx
mov eax, edi
push eax
push str.softwareclasses_s
lea edi, [ebp - 0xc30]
call fcn.0044b138
pop ecx
pop ecx
mov eax, edi
push eax
push SysReAllocString
call ebx
push dword [ebp + 0x10]
lea edi, [ebp - 0x618]
push dword [ebp + 8]
push str.SystemFileAssociations_sShell_scommand
call fcn.0044b138
add esp, 0xc
mov eax, edi
push eax
push SysReAllocString
call ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
push str.SoftwareClassesSystemFileAssociations_sShell_scommand
call fcn.0044b138
add esp, 0xc
mov eax, edi
push eax
push SysReAllocString
call ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str._sShell_s
call fcn.0044b138
add esp, 0xc
mov eax, edi
push eax
push SysReAllocString
call ebx
mov eax, edi
push eax
push str.softwareclasses_s
lea edi, [ebp - 0xc30]
call fcn.0044b138
pop ecx
pop ecx
mov eax, edi
push eax
push SysReAllocString
call ebx
push dword [ebp + 0x10]
lea edi, [ebp - 0x618]
push dword [ebp + 8]
push str.SystemFileAssociations_sShell_s
call fcn.0044b138
add esp, 0xc
mov eax, edi
push eax
push SysReAllocString
call ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
push str.SoftwareClassesSystemFileAssociations_sShell_s
call fcn.0044b138
add esp, 0xc
mov eax, edi
push eax
push SysReAllocString
call ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x45a34a
Capabilities:
Hide graphical window

Disassembly:
push edi
push 0x70
mov edi, eax
call fcn.00403143
test eax, eax
jg 0x45a37e
push 0
push 0x74
push edi
push 0x71
pop eax
call fcn.0047a5d0
push 0
push 0x190
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
ret
push ebx
push esi
dec eax
mov esi, eax
imul esi, esi, 0x19
cmp dword [esi + 0x5a5484], 0
sete bl
test bl, bl
setne al
push eax
push 0x72
push edi
push 0x71
pop eax
call fcn.0047a5d0
test bl, bl
sete al
push eax
push 0x74
push edi
push 0x73
pop eax
call fcn.0047a5d0
push 0x190
push edi
mov al, bl
call fcn.00402b8f
test bl, bl
jne 0x45a3f7
push dword [esi + 0x5a5484]
push 0x73
call fcn.0047aac6
mov eax, dword [esi + 0x5a5474]
push str.Expired
push eax
call fcn.0052eef7
test eax, eax
pop ecx
pop ecx
jne 0x45a3f0
push str.Check_for_special_discount
push 0x74
jmp 0x45a3ff
push str.NCH_Software_home_page
jmp 0x45a3ec
push dword [esi + 0x5a547c]
push 0x72
call fcn.0047aac6
mov esi, dword [esi + 0x5a5480]
test esi, esi
jne 0x45a413
mov esi, str._Type_any_comments_here_
push esi
push 0x71
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
call fcn.004262ff
pop esi
pop ebx
pop edi
ret
Function at 0x45a81a
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push eax
call ebx
test eax, eax
je 0x45a8c2
push esi
push edi
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x45a856
xor eax, eax
jmp 0x45a8c0
lea eax, [ebp - 0x234]
push eax
push esi
mov dword [ebp - 0x234], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x45a8ab
lea eax, [ebp - 0x210]
push str.explorer.exe
push eax
call fcn.00535c2f
test eax, eax
pop ecx
pop ecx
jne 0x45a89e
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x22c]
call ebx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
je 0x45a8b1
lea eax, [ebp - 0x234]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x45a86f
jmp 0x45a8b7
mov edi, dword [ebp - 0x22c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45a8c5
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x2ac
push dword [ebp + 0x74]
call fcn.00401d29
test al, al
je 0x45aa7b
push ebx
xor ebx, ebx
cmp dword [0x5a9cc8], ebx
jne 0x45a8fb
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x5a9cc8], eax
push esi
lea eax, [ebp + 0x58]
push eax
call fcn.004e6b79
test al, al
je 0x45aa29
mov byte [ebp + 0x6b], bl
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x64], ebx
call fcn.0045a81a
cmp eax, ebx
je 0x45aa0b
push eax
push ebx
mov esi, 0x2000000
push esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp + 0x5c], eax
je 0x45aa0b
lea eax, [ebp + 0x60]
push eax
push 0xf
push dword [ebp + 0x5c]
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x45aa0b
lea eax, [ebp + 0x64]
push eax
push 1
push 2
push ebx
push esi
push dword [ebp + 0x60]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x45aa0b
push edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x38]
push ebx
push eax
call fcn.005251f0
xor eax, eax
lea edi, [ebp + 0x48]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x78]
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], ebx
je 0x45a9ca
cmp word [eax], bx
je 0x45a9ca
push eax
push dword [ebp + 0x74]
mov esi, 0x104
push str.__s___s
lea edi, [ebp - 0x240]
call fcn.0044b138
add esp, 0xc
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
push ebx
push ebx
mov eax, edi
push eax
jmp 0x45a9d6
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0x74]
push ebx
push dword [ebp + 0x64]
call dword [ebp + 0x58]
test eax, eax
setne byte [ebp + 0x6b]
cmp byte [ebp + 0x6b], bl
pop edi
je 0x45a9fb
cmp dword [ebp + 0x7c], 1
jne 0x45a9fb
push dword [ebp + 0x48]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push dword [ebp + 0x48]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 0x4c]
call esi
push dword [ebp + 0x64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp + 0x60]
call esi
push dword [ebp + 0x5c]
call esi
cmp byte [ebp + 0x6b], bl
je 0x45aa29
mov al, 1
jmp 0x45aa79
push 0x3c
pop esi
push esi
lea eax, [ebp + 0xc]
push ebx
push eax
call fcn.005251f0
mov eax, dword [ebp + 0x74]
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x20], eax
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x28], eax
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x10], 0x40
mov dword [ebp + 0x18], 0x5675cc
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push dword [ebp + 0x44]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp + 0x2c], 0x20
setg al
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc
Function at 0x45ab7b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor esi, esi
xor edi, edi
cmp dword [ebp - 0x34], esi
jbe 0x45abc5
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jbe 0x45abbd
cmp dword [ebp - 0xc], 0x10000
jne 0x45abb8
cmp dword [ebp - 0x10], edi
jbe 0x45abb8
mov edi, dword [ebp - 0x10]
add esi, dword [ebp - 0x10]
jmp 0x45abc0
add esi, dword [ebp - 0x3c]
cmp esi, dword [ebp - 0x34]
jb 0x45ab96
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x45ad5f
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2064
call fcn.0052d050
mov eax, dword [ebp + 8]
or dword [eax], 0xffffffff
push ebx
push esi
push edi
push 0x44
pop esi
lea edi, [eax + 4]
or dword [edi], 0xffffffff
push esi
xor ebx, ebx
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.005251f0
add esp, 0xc
mov dword [ebp - 0x64], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xfffffffffffffff5
mov dword [ebp - 0x38], 0x101
mov word [ebp - 0x34], bx
call esi
push 0xfffffffffffffff4
mov dword [ebp - 0x28], eax
call esi
mov dword [ebp - 0x24], eax
push 0x10000
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x45ade3
xor al, al
jmp 0x45ae73
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push ebx
push ebx
push edi
call esi
push eax
push dword [ebp - 4]
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 0xc]
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x1000
lea esi, [ebp - 0x2064]
stosd dword es:[edi], eax
call fcn.0044b0f6
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push 0x10
push 1
push ebx
push ebx
mov eax, esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
call esi
cmp edi, ebx
je 0x45addc
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [ebp - 0x1c]
call esi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8