joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438028
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x28
call fcn.00433d92
cmp eax, 0x3e8
je 0x43806c
push 0
push 0
push 0x64
push str.......SharedFileCommonECDirectory.cpp
lea eax, [ebp - 0x14]
push 0x49d1dc
push eax
call fcn.004064c7
add esp, 0x14
mov ecx, dword [ebp + 8]
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x14]
call fcn.0042f60f
jmp 0x4380d8
mov ecx, dword [ebp + 0xc]
call fcn.0043a30e
push eax
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test eax, eax
jne 0x4380cb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push eax
lea eax, [ebp - 0x28]
push str.RemoveDirectory__
push eax
call fcn.0042fd05
add esp, 0xc
lea ecx, [ebp - 0x14]
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x28]
call fcn.0042f60f
mov ecx, dword [ebp + 0xc]
call fcn.0043a30e
push eax
lea eax, [ebp - 0x14]
push str.Unable_to_remove_directory___s_
push eax
call fcn.0042f93d
add esp, 0xc
lea eax, [ebp - 0x14]
push 0
jmp 0x438059
mov ecx, dword [ebp + 8]
push 0x498580
call fcn.0042f5ab
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x43855c
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x14
call fcn.0043a30e
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
test eax, eax
jne 0x4385a2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push eax
lea eax, [ebp - 0x14]
push str.SetCurrentDirectory__
push eax
call fcn.0042fd05
mov ecx, dword [ebp + 8]
add esp, 0xc
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x14]
call fcn.0042f60f
jmp 0x4385af
mov ecx, dword [ebp + 8]
push 0x498580
call fcn.0042f5ab
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x43b235
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4b3270]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
je 0x43b297
push edi
lea ecx, [ebp - 0x2c]
call fcn.004319eb
mov eax, dword [esi]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, esi
call dword [eax + 8]
lea ecx, [ebp - 0x2c]
call fcn.00431bf9
push edi
lea ecx, [ebp - 0x18]
call fcn.004319eb
push 0x48c588
lea ecx, [ebp - 0x18]
call fcn.00431e92
lea ecx, [esi + 0x64]
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push edx
call dword [eax + 8]
lea ecx, [ebp - 0x18]
call fcn.00431bf9
lea eax, [esi + 0xc]
push eax
push 4
push esi
push 0x43afff
push 0
push 0
call fcn.00463460
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x43b318
call fcn.00462434
cmp dword [eax], 0xb
jne 0x43b2c6
mov edi, str.__too_many_threads_
jmp 0x43b2db
call fcn.00462434
mov edi, str.__invalid_parameter_
mov ecx, 0x497afc
cmp dword [eax], 0x16
cmovne edi, ecx
call fcn.00462434
push edi
push dword [eax]
lea eax, [ebp - 0x10]
push 0xa8
push str.......SharedThreadsWin32ECThread.cpp
push 0
push eax
call fcn.00425dcd
add esp, 0x10
mov ecx, eax
call fcn.0043a30e
push eax
push str.Thread_was_not_created__errno___d_s.
call fcn.00439ef6
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.0043a00a
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 4], ebx
xor ecx, ebp
pop esi
pop ebx
call fcn.0045eff4
mov esp, ebp
pop ebp
ret 4
Function at 0x43b7a5
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x64]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0043adba
cmp dword [ebp - 8], 0
pop ecx
pop ecx
je 0x43b932
mov ecx, esi
call fcn.0043b1a2
cmp eax, 1
je 0x43b830
push eax
push dword [esi + 8]
lea eax, [ebp - 0x14]
push 0x142
push str.......SharedThreadsWin32ECThread.cpp
push 0
push eax
call fcn.00425dcd
add esp, 0x10
mov ecx, eax
call fcn.0043a30e
push eax
push str.Thread___s__was_not_ready_to_run__state_d
call fcn.00439ef6
add esp, 0x10
lea ecx, [ebp - 0x14]
call fcn.0043a00a
mov ecx, dword [ebp + 8]
push 0x48c554
call fcn.0042f5ab
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x43b94b
call fcn.00406862
jmp 0x43b94b
xor edi, edi
mov ebx, str.......SharedThreadsWin32ECThread.cpp
cmp dword [esi + 4], edi
jne 0x43b8a3
push dword [esi + 8]
lea eax, [ebp - 0x14]
push 0x147
push ebx
push edi
push eax
call fcn.00425dcd
add esp, 0x10
mov ecx, eax
call fcn.0043a30e
push eax
push str.Thread___s__handle_is_NULL
call fcn.00439ef6
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.0043a00a
cmp dword [esi + 4], edi
jne 0x43b8a3
push edi
push edi
push 0x149
push ebx
push 0x48c54c
lea eax, [ebp - 0x1c]
push eax
call fcn.004064c7
add esp, 0x14
mov ecx, dword [ebp + 8]
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x1c]
call fcn.0042f60f
jmp 0x43b81b
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
test eax, eax
jne 0x43b8bf
push edi
push edi
push 0x14f
push ebx
push 0x48c550
jmp 0x43b881
cmp eax, 0xffffffff
jne 0x43b92b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push edi
push eax
lea eax, [ebp - 0x30]
push 0x48c868
push eax
call fcn.0042fd05
add esp, 0xc
lea ecx, [ebp - 0x1c]
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x30]
call fcn.0042f60f
lea ecx, [ebp - 0x1c]
call fcn.00438d6f
cmp eax, 0x7d1
lea eax, [ebp - 0x1c]
push edi
jl 0x43b88d
push edi
push 0x151
push ebx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00413c09
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x30]
call fcn.0042f60f
jmp 0x43b896
mov dword [esi + 0x18], 2
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x43b93e
call fcn.00406862
mov ecx, dword [ebp + 8]
push 0x498580
call fcn.0042f5ab
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43b957
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
call fcn.0043b1a2
xor ebx, ebx
cmp eax, 2
jne 0x43b976
mov ecx, esi
call fcn.0043b6e2
jmp 0x43b989
push dword [esi + 8]
push str.Thread___s__is_being_terminated__but_has_not_been_started.
push ebx
push ebx
push ebx
call fcn.004043b9
add esp, 0x14
push dword [ebp + 0xc]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
test eax, eax
je 0x43ba17
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x43b9b4
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.0043ba1f
lea ecx, [ebp - 0x14]
call fcn.0042f60f
push 0x7530
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
je 0x43b9ff
push str.Waiting_on_terminated_thread_failed
push 0x2c9
push str.......SharedThreadsWin32ECThread.cpp
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.00425dcd
add esp, 0x10
mov ecx, eax
call fcn.0043a30e
push eax
push 0x4982a4
call fcn.00439ef6
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.0043a00a
test edi, edi
je 0x43ba16
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.0043b6aa
lea ecx, [ebp - 0x14]
call fcn.0042f60f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43ca1f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x14
call fcn.00433d92
cmp eax, 0x3e8
je 0x43ca66
push 0
push 0
push 0x409
push str.......SharedFileCommonECFile.cpp
lea eax, [ebp - 0x14]
push 0x49d1dc
push eax
call fcn.004064c7
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x14]
call fcn.0042f60f
jmp 0x43cac5
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
and dword [esi], 0
call fcn.0043a30e
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43caae
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push eax
lea eax, [ebp - 0x14]
push str.GetFileAttributes__
push eax
call fcn.0042fd05
mov ecx, dword [ebp + 8]
add esp, 0xc
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x14]
call fcn.0042f60f
jmp 0x43cac4
push esi
push eax
call fcn.0043c9bb
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push 0x498580
call fcn.0042f5ab
pop esi
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x43cbd7
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
call fcn.00433d92
mov edi, 0x3e8
cmp eax, edi
jne 0x43ccb8
mov ecx, dword [ebp + 0x10]
call fcn.00433d92
cmp eax, edi
jne 0x43ccb8
mov ecx, dword [ebp + 0x10]
call fcn.0043a30e
mov ecx, dword [ebp + 0xc]
push eax
call fcn.0043a30e
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
jne 0x43ccb1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
cmp edi, 3
jne 0x43cc51
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
inc ebx
push eax
call fcn.0043c873
pop ecx
pop ecx
mov byte [ebp - 1], bl
cmp dword [eax + 0xc], 0x3e9
je 0x43cc55
mov byte [ebp - 1], 0
test bl, 1
je 0x43cc62
lea ecx, [ebp - 0x1c]
call fcn.0042f60f
cmp byte [ebp - 1], 0
je 0x43cc9b
mov ecx, dword [ebp + 0x10]
push 0x48cf50
call fcn.00434579
cmp eax, 0x3e8
jne 0x43cc9b
mov ecx, dword [ebp + 0x10]
call fcn.00433f56
inc eax
cmp eax, 0x104
jbe 0x43cc9b
push 0x4a0000
mov ecx, dword [ebp + 8]
call fcn.0042f5ab
jmp 0x43cce8
push 0
push edi
lea eax, [ebp - 0x1c]
push str.MoveFile__
push eax
call fcn.0042fd05
add esp, 0xc
jmp 0x43ccd7
push 0x498580
jmp 0x43cc91
push 0
push 0
push 0x374
push str.......SharedFileCommonECFile.cpp
lea eax, [ebp - 0x1c]
push 0x49d1dc
push eax
call fcn.004064c7
add esp, 0x14
mov ecx, dword [ebp + 8]
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x1c]
call fcn.0042f60f
mov eax, dword [ebp + 8]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43ce7f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x14
call fcn.00433d92
cmp eax, 0x3e8
je 0x43cec6
push 0
push 0
push 0x354
push str.......SharedFileCommonECFile.cpp
lea eax, [ebp - 0x14]
push 0x49d1dc
push eax
call fcn.004064c7
add esp, 0x14
mov ecx, dword [ebp + 8]
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x14]
call fcn.0042f60f
jmp 0x43cf02
mov ecx, dword [ebp + 0xc]
call fcn.0043a30e
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x43cef5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push eax
lea eax, [ebp - 0x14]
push str.DeleteFile__
push eax
call fcn.0042fd05
add esp, 0xc
jmp 0x43ceb3
mov ecx, dword [ebp + 8]
push 0x498580
call fcn.0042f5ab
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x43d04a
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x14]
push ebx
push esi
push edi
push eax
mov edi, ecx
call fcn.0043cba6
lea ecx, [ebp - 0x14]
cmp dword [eax + 0xc], 0x3e9
setne bl
call fcn.0042f60f
xor esi, esi
push esi
push esi
test bl, bl
je 0x43d0a9
push 0x2e3
push str.......SharedFileCommonECFile.cpp
lea eax, [ebp - 0x14]
push 0x49d1dc
push eax
call fcn.004064c7
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x14]
call fcn.0042f60f
jmp 0x43d154
push dword [ebp + 0x10]
lea eax, [ebp - 0x28]
mov ecx, edi
push dword [ebp + 0xc]
push eax
call fcn.0043cf09
push eax
lea ecx, [ebp - 0x14]
call fcn.0042f5cb
lea ecx, [ebp - 0x28]
call fcn.0042f60f
lea ecx, [ebp - 0x14]
call fcn.00438d6f
cmp eax, 0x7d1
jl 0x43d109
push esi
push esi
push 0x2e7
push str.......SharedFileCommonECFile.cpp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00413c09
mov ecx, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x28]
call fcn.0042f60f
jmp 0x43d09c
lea ecx, [ebp - 0x14]
call fcn.0042f60f
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
jne 0x43d147
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push esi
push eax
lea eax, [ebp - 0x28]
push str.SetEndOfFile__
push eax
call fcn.0042fd05
mov ecx, dword [ebp + 8]
add esp, 0xc
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x28]
jmp 0x43d09f
mov ecx, dword [ebp + 8]
push 0x498580
call fcn.0042f5ab
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x43d160
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0x18]
push ebx
push edi
push eax
mov edi, ecx
call fcn.0043cba6
lea ecx, [ebp - 0x18]
cmp dword [eax + 0xc], 0x3e9
setne bl
call fcn.0042f60f
push 0
test bl, bl
je 0x43d1bb
push 0
push 0x1ec
push str.......SharedFileCommonECFile.cpp
lea eax, [ebp - 0x18]
push 0x49d1dc
push eax
call fcn.004064c7
add esp, 0x14
mov ecx, dword [ebp + 8]
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x18]
call fcn.0042f60f
jmp 0x43d219
cmp dword [ebp + 0x10], 0xffffffff
jbe 0x43d1ca
push 0
push 0x1f2
jmp 0x43d192
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x43d200
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push eax
lea eax, [ebp - 0x18]
push str.WriteFile__
push eax
call fcn.0042fd05
add esp, 0xc
jmp 0x43d1a8
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x43d20c
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov ecx, dword [ebp + 8]
push 0x498580
call fcn.0042f5ab
mov eax, dword [ebp + 8]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43d9e4
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4b3270]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
test edi, edi
jne 0x43da09
xor al, al
jmp 0x43dbed
push ebx
push esi
lea ecx, [ebp - 0x18]
mov esi, 0x80000001
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.00431a38
mov eax, dword [ebp + 8]
and eax, 0xffff00ff
cmp eax, 0x15
jg 0x43daee
je 0x43dae4
cmp eax, 0xb
jg 0x43da9a
je 0x43da90
dec eax
dec eax
je 0x43da86
sub eax, 3
je 0x43da7c
dec eax
je 0x43da72
dec eax
je 0x43da68
dec eax
je 0x43da5e
dec eax
jne 0x43db47
push str.SendTo
jmp 0x43db79
push str.Recent
jmp 0x43db79
push str.Start_Up
jmp 0x43db79
push str.Favorites
jmp 0x43db79
push str.Personal
jmp 0x43db79
push str.Programs
jmp 0x43db79
push str.Start_Menu
jmp 0x43db79
sub eax, 0xd
je 0x43dada
dec eax
je 0x43dad0
dec eax
dec eax
je 0x43dac6
sub eax, 3
je 0x43dabc
dec eax
jne 0x43db47
push str.Fonts
jmp 0x43db79
push str.NetHood
jmp 0x43db79
push str.Desktop
jmp 0x43db79
push str.My_Video
jmp 0x43db79
push str.My_Music
jmp 0x43db79
push str.Templates
jmp 0x43db79
cmp eax, 0x22
jg 0x43db32
je 0x43db2b
sub eax, 0x1a
je 0x43db24
dec eax
je 0x43db1d
dec eax
je 0x43db16
sub eax, 4
je 0x43db0f
dec eax
jne 0x43db47
push str.Cookies
jmp 0x43db79
push str.Cache
jmp 0x43db79
push str.Local_AppData
jmp 0x43db79
push str.PrintHood
jmp 0x43db79
push str.AppData
jmp 0x43db79
push str.History
jmp 0x43db79
sub eax, 0x26
je 0x43db6a
dec eax
je 0x43db63
sub eax, 9
je 0x43db5c
sub eax, 0xa
je 0x43db55
dec eax
je 0x43db4e
xor bl, bl
jmp 0x43dbe1
push str.CD_Burning
jmp 0x43db79
push str.OEM_Links
jmp 0x43db74
push str.Administrative_Tools
jmp 0x43db79
push str.My_Pictures
jmp 0x43db79
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersion
push str.ProgramFilesDir
mov esi, 0x80000002
lea ecx, [ebp - 0x18]
call fcn.00431c89
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43dba0
xor bl, bl
jmp 0x43dbce
mov esi, dword [ebp - 0x1c]
lea eax, [edi + edi]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x28]
push eax
push 0
call fcn.0043a30e
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
cmp dword [ebp - 0x1c], 0
je 0x43dbe1
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x18]
call fcn.00431bf9
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0045eff4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43f249
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4b3270]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
push 0x228
mov dword [ebp - 0x248], eax
xor edi, edi
lea eax, [ebp - 0x240]
mov dword [ebp - 0x244], 0x22c
push edi
push eax
call fcn.00462b30
add esp, 0xc
push edi
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x244]
push eax
push esi
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x43f344
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebp - 0x23c], ebx
je 0x43f2c6
lea eax, [ebp - 0x244]
push eax
push esi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x43f2ab
jmp 0x43f343
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x18]
call fcn.004319eb
lea eax, [ebp - 0x25c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00433e03
lea ecx, [ebp - 0x25c]
call fcn.0042f60f
push dword [ebp - 0x248]
lea ecx, [ebp - 0x18]
call fcn.00434521
cmp eax, 0x3e9
jne 0x43f33b
lea ecx, [ebp - 0x18]
call fcn.0043a30e
push eax
push str.findOSDParent__
push str._s___found_a_parent__s
push edi
push edi
push 6
call fcn.004043b9
push dword [ebp - 0x248]
push dword [ebp - 0x22c]
call fcn.0043f249
add esp, 0x20
mov edi, ebx
test eax, eax
cmovne edi, eax
lea ecx, [ebp - 0x18]
call fcn.00431bf9
pop ebx
test esi, esi
je 0x43f34f
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0045eff4
mov esp, ebp
pop ebp
ret
Function at 0x441d80
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4b3270]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x28], esi
push edi
push str.Progman
mov dword [esi], edi
mov dword [ebp - 0x20], edi
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x441dcb
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x441dcb
mov dword [esi], eax
xor eax, eax
inc eax
jmp 0x441e9f
push ebx
lea eax, [ebp - 0x24]
push eax
push 1
push str.explorer.exe
lea ecx, [ebp - 0x18]
call fcn.004319eb
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00445286
add esp, 0x10
lea ecx, [ebp - 0x3c]
cmp dword [eax + 0xc], 0x7d0
sete bl
call fcn.0042f60f
lea ecx, [ebp - 0x18]
call fcn.00431bf9
test bl, bl
je 0x441e15
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x441e15
mov dword [esi], ecx
jmp 0x441e3d
lea eax, [ebp - 0x18]
push eax
call fcn.004454a7
pop ecx
lea ecx, [ebp - 0x18]
cmp dword [eax + 0xc], 0x3e9
setne bl
call fcn.0042f60f
test bl, bl
je 0x441e42
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [esi], eax
xor eax, eax
inc eax
jmp 0x441e9e
push 1
push edi
push str.WinSta0
mov dword [ebp - 0x1c], edi
call dword [sym.imp.USER32.dll_OpenWindowStationW]
mov esi, eax
test esi, esi
jne 0x441e72
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Failed_to_open_WinSta0__last_error___d
push edi
push edi
push edi
call fcn.004043b9
add esp, 0x14
jmp 0x441e91
lea eax, [ebp - 0x1c]
push eax
push 0x441cea
push esi
call dword [sym.imp.USER32.dll_EnumDesktopsW]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x441e91
mov ecx, dword [ebp - 0x28]
xor edi, edi
inc edi
mov dword [ecx], eax
test esi, esi
je 0x441e9c
push esi
call dword [sym.imp.USER32.dll_CloseWindowStation]
mov eax, edi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0045eff4
mov esp, ebp
pop ebp
ret
Function at 0x442472
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x4b3270]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x244]
push ebx
push esi
mov esi, dword [ebp + 8]
push ecx
push 0x200
lea ecx, [ebp - 0x204]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x442547
call dword [sym.imp.KERNEL32.DLL_GetLastError]
xor ebx, ebx
push ebx
push eax
lea eax, [ebp - 0x23c]
push 0x4a1844
push eax
call fcn.0042fd05
add esp, 0xc
lea ecx, [ebp - 0x224]
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x23c]
call fcn.0042f60f
lea ecx, [ebp - 0x224]
call fcn.00438d6f
cmp eax, 0x7d1
lea eax, [ebp - 0x224]
push ebx
jl 0x44253d
push ebx
push 0x5cf
push 0x48e328
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.00413c09
add esp, 0x14
mov ecx, esi
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x23c]
call fcn.0042f60f
lea ecx, [ebp - 0x224]
call fcn.0042f60f
jmp 0x4426be
push eax
mov ecx, esi
call fcn.0042f5cb
jmp 0x44252d
xor ebx, ebx
mov word [ebp - 0x208], 0x500
lea eax, [ebp - 0x228]
mov dword [ebp - 0x20c], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x4425d6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push ebx
push eax
lea eax, [ebp - 0x23c]
push 0x48eaa8
push eax
call fcn.0042fd05
add esp, 0xc
lea ecx, [ebp - 0x224]
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x23c]
call fcn.0042f60f
lea ecx, [ebp - 0x224]
call fcn.00438d6f
cmp eax, 0x7d1
lea eax, [ebp - 0x224]
push ebx
jl 0x44253d
push ebx
push 0x5e1
jmp 0x442505
push edi
push dword [ebp - 0x228]
push dword [ebp - 0x204]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne byte [ebp - 0x20d]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x228]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
test edi, edi
je 0x442699
push ebx
push edi
lea eax, [ebp - 0x23c]
push 0x48eadc
push eax
call fcn.0042fd05
add esp, 0xc
lea ecx, [ebp - 0x224]
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x23c]
call fcn.0042f60f
lea ecx, [ebp - 0x224]
call fcn.00438d6f
cmp eax, 0x7d1
lea eax, [ebp - 0x224]
push ebx
jl 0x44268f
push ebx
push 0x5ea
push 0x48e328
push eax
lea eax, [ebp - 0x23c]
push eax
call fcn.00413c09
add esp, 0x14
mov ecx, esi
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x23c]
call fcn.0042f60f
lea ecx, [ebp - 0x224]
call fcn.0042f60f
jmp 0x4426bd
push eax
mov ecx, esi
call fcn.0042f5cb
jmp 0x442682
xor eax, eax
mov ecx, esi
cmp byte [ebp - 0x20d], al
setne al
add eax, 0x3e8
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x240]
push eax
call fcn.0042f5ab
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045eff4
mov esp, ebp
pop ebp
ret
Function at 0x445f01
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, 0x400
mov esi, 0x1000
and dword [ebx], 0
and dword [ebp + 0x10], 0
xor ecx, ecx
mov eax, edi
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044721c
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
push ecx
mov dword [edx], eax
call fcn.0045fb1d
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
cmp dword [eax], 0
je 0x445fad
lea ecx, [ebp + 0x10]
mov dword [ebp - 4], esi
push ecx
push esi
push dword [eax]
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
je 0x445f91
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x445f8a
add edi, 0x400
add esi, 0x1000
cmp dword [ebp - 4], eax
je 0x445f1e
shr eax, 2
mov dword [ebx], eax
push 0x498580
mov ecx, dword [ebp + 8]
call fcn.0042f5ab
jmp 0x445fda
push 0x49b5ac
jmp 0x445f80
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0
push eax
lea eax, [ebp - 0x18]
push 0x48f06c
push eax
call fcn.0042fd05
add esp, 0xc
jmp 0x445fc9
push 0
push 0
push 0x71
push str.....CodeWin32ECProcessFinder.cpp
lea eax, [ebp - 0x18]
push 0x498584
push eax
call fcn.004064c7
add esp, 0x14
mov ecx, dword [ebp + 8]
push eax
call fcn.0042f5cb
lea ecx, [ebp - 0x18]
call fcn.0042f60f
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret