joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439a2c
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x102c
call fcn.004203f0
push ebp
mov ebp, dword [esp + 0x103c]
lea eax, [esp + 4]
push eax
push 0x800
lea ecx, [esp + 0x838]
push ecx
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x439a63
xor al, al
pop ebp
add esp, 0x102c
ret
mov edx, dword [esp + 0x1034]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edx
shr esi, 2
mov byte [ebp], 0
call fcn.004399f0
add esp, 4
xor ebx, ebx
mov dword [esp + 0x14], eax
test esi, esi
jbe 0x439b77
push edi
cmp byte [ebp], 0
jne 0x439b76
mov eax, dword [esp + ebx*4 + 0x83c]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [esp + 0x10]
push ecx
push 4
lea edx, [esp + 0x1c]
mov edi, eax
push edx
push edi
call sub.PSAPI.DLL_EnumProcessModules
mov ecx, dword [esp + 0x14]
push 0x104
lea eax, [esp + 0x22c]
push eax
push ecx
push edi
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
je 0x439b66
lea edx, [esp + 0x434]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x640]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x238]
push eax
call fcn.00415b80
lea ecx, [esp + 0x448]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.00413197
mov eax, dword [esp + 0x105c]
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.00413104
add esp, 0x24
test eax, eax
jne 0x439b46
mov edx, dword [esp + ebx*4 + 0x83c]
mov eax, dword [esp + 0x1044]
mov dword [eax], edx
jmp 0x439b62
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x439b66
mov eax, dword [esp + ebx*4 + 0x83c]
cmp ecx, eax
jne 0x439b66
mov ecx, dword [esp + 0x1044]
mov dword [ecx], eax
mov byte [ebp], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, esi
jb 0x439a8f
pop edi
pop esi
pop ebx
mov al, 1
pop ebp
add esp, 0x102c
ret

Function at 0x439b83
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x840
push ebx
push ebp
mov ebp, dword [esp + 0x84c]
push esi
mov esi, dword [esp + 0x858]
push edi
push 0
push 2
mov dword [esp + 0x20], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [esp + 0x18]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
push ebp
mov byte [esi], 0
call fcn.004399f0
add esp, 4
cmp byte [esi], 0
mov ebx, eax
jne 0x439c68
lea ecx, [ecx]
lea ecx, [esp + 0x18]
push ecx
push edi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x439c68
lea edx, [esp + 0x448]
push edx
lea eax, [esp + 0x248]
push eax
lea ecx, [esp + 0x654]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.00415b80
lea ecx, [esp + 0x45c]
push ecx
lea edx, [esp + 0x25c]
push edx
call fcn.00413197
lea eax, [esp + 0x260]
push ebp
push eax
call fcn.00413104
add esp, 0x24
test eax, eax
jne 0x439c47
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x858]
mov dword [edx], ecx
jmp 0x439c5c
test ebx, ebx
je 0x439c5f
mov eax, dword [esp + 0x20]
cmp ebx, eax
jne 0x439c5f
mov ecx, dword [esp + 0x858]
mov dword [ecx], eax
mov byte [esi], 1
cmp byte [esi], 0
je 0x439bd3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x840
ret
Function at 0x439c7c
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [esp + 8]
push eax
push 0x1f4
push 2
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x439cde
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 4]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 8
ret

Function at 0x43a421
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push ecx
push ebp
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, dword [esp + 0x10]
mov esi, eax
cmp ebp, esi
jne 0x43a43f
pop esi
mov eax, 1
pop ebp
pop ecx
ret 4
test esi, esi
jne 0x43a451
push esi
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push ebp
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x43a465
push 9
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push ebp
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x43a558
push ebx
push edi
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push ebp
mov ebx, eax
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
mov ebp, eax
push ebp
push ebx
call esi
push 1
push edi
push ebx
call esi
push 1
push ebp
push edi
call esi
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x43a532
push eax
push eax
push eax
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
push 0
push 2
push 0
push 0x12
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x43a53a
mov dword [esp + 0x10], 4
jmp 0x43a53a
mov dword [esp + 0x10], 3
push 0
push ebp
push ebx
call esi
push 0
push edi
push ebx
call esi
push 0
push ebp
push edi
call esi
mov eax, dword [esp + 0x10]
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret 4
pop esi
mov eax, 2
pop ebp
pop ecx
ret 4
Function at 0x43a5ea
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x28
push esi
mov esi, dword [esp + 0x30]
push edi
test esi, esi
jl 0x43a69e
jne 0x43a60d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
add esp, 0x28
ret 4
cmp esi, 0xf
jae 0x43a697
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x18]
push eax
call edi
test eax, eax
je 0x43a697
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
call edi
fnstcw word [esp + 0x34]
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
sbb ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
fild qword [esp + 0x20]
movzx eax, word [esp + 0x34]
fild qword [esp + 0x28]
or eax, 0xc00
mov dword [esp + 8], eax
fdivp st(1)
fmul qword [0x48b538]
fldcw word [esp + 8]
fistp qword [esp + 8]
mov edx, dword [esp + 8]
fldcw word [esp + 0x34]
cmp edx, esi
jb 0x43a632
pop edi
pop esi
add esp, 0x28
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
add esp, 0x28
ret 4

Function at 0x43aab9
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x43aacd
mov dword [esp + 4], eax
jmp fcn.0043a5ea
ret 4

Function at 0x43aad0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
test eax, eax
je 0x43aae3
mov dword [esp + 4], eax
jmp fcn.0043a5ea
ret 4

Function at 0x43baee
Capabilities:
Hide graphical window

Disassembly:
cmp byte [esp + 8], 0
mov eax, dword [esp + 4]
je 0x43bb09
mov eax, dword [eax]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
ret 8
mov ecx, dword [eax]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
ret 8

Function at 0x43bbb7
Capabilities:
Log keystrokes

Disassembly:
cmp byte [esp + 8], 1
push esi
mov esi, dword [esp + 8]
jne 0x43bbe4
lea eax, [esp + 0xc]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
je 0x43bbfd
push 1
jmp 0x43bbe6
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
ret 8
Function at 0x43c24a
Capabilities:
Get token privileges

Disassembly:
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push ebp
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
push esi
push 0
push eax
push 3
push edi
call ebx
test eax, eax
jne 0x43c29b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x43c2a7
mov ecx, dword [esi]
push ecx
call fcn.0043c1a4
add esp, 4
mov dword [ebp], eax
test eax, eax
je 0x43c2a7
mov edx, dword [esi]
push esi
push edx
push eax
push 3
push edi
call ebx
test eax, eax
je 0x43c2a7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc

Function at 0x43c2f0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
call fcn.0043c1b9
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
mov esi, eax
push 0
push esi
call edi
push eax
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call ebx
push 2
push 0
push 0
lea edx, [esi + 8]
push edx
call edi
push eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push ecx
call edi
push eax
call ebx
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
push 0
push 0
push esi
push 0x43c2b0
push 0
push 0
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x43c358
Capabilities:
Impersonate user

Disassembly:
movsx eax, byte [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
and eax, 2
or eax, 4
push 0
shr eax, 1
push eax
mov eax, dword [esp + 0x14]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
neg eax
sbb eax, eax
neg eax
ret 0x14

Function at 0x43c514
Capabilities:
Create process on windows

Disassembly:
mov al, byte [esp + 0x10]
push ebx
push esi
mov esi, dword [esp + 0x20]
push edi
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x1c], ecx
test al, 1
je 0x43c530
lea edi, [ecx + 1]
jmp 0x43c539
test al, 2
je 0x43c539
mov edi, 2
xor bl, bl
test al, 4
je 0x43c57c
push ebp
lea eax, [esp + 0x28]
push eax
push 0xa
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ecx, dword [esp + 0x28]
push 1
push ecx
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov ebp, eax
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
pop ebp
je 0x43c5b9
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
or esi, 0x400
push esi
push edx
mov edx, dword [esp + 0x28]
push 0
push edi
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
setne bl
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x43c5c8
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
pop edi
pop esi
mov al, bl
pop ebx
ret 0x24
Function at 0x443c0a
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, dword [ebp + 0x180]
mov eax, dword [ebp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esp + 0x18], eax
cmp ecx, dword [esp + 0x1c]
je 0x443cc6
mov edi, 3
cmp dword [esi + 0x84], edi
jl 0x443cbc
mov edx, dword [esi + 0x74]
mov eax, dword [edx + edi*4]
cmp dword [eax], 0
je 0x443cb3
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
cmp dword [eax + 4], ecx
jne 0x443cb3
cmp byte [eax + 0x88], 0xb
je 0x443cb3
mov cl, byte [eax + 0x8b]
movzx edx, cl
cmp edx, dword [ebp + 0x180]
je 0x443c87
cmp byte [ebp + 0x188], 0
je 0x443cb3
cmp cl, 0xff
je 0x443cb3
cmp byte [eax + 0x88], 0xa
je 0x443cb3
mov eax, dword [eax]
push 0
push eax
call ebx
mov ecx, dword [esi + 0x74]
mov edx, dword [ecx + edi*4]
mov eax, dword [edx]
test byte [eax + 0x8a], 0x40
je 0x443cb3
cmp byte [eax + 0x88], 0x1a
jne 0x443cb3
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
inc edi
cmp edi, dword [esi + 0x84]
jle 0x443c40
mov ecx, dword [esp + 0x1c]
mov dword [ebp + 0x180], ecx
mov edi, 3
cmp dword [esi + 0x84], edi
jl 0x443d55
lea ecx, [ecx]
mov edx, dword [esi + 0x74]
mov eax, dword [edx + edi*4]
cmp dword [eax], 0
je 0x443d4c
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
cmp dword [eax + 4], ecx
jne 0x443d4c
cmp byte [eax + 0x88], 0xb
je 0x443d4c
movzx edx, byte [eax + 0x8b]
cmp edx, dword [ebp + 0x180]
jne 0x443d4c
test byte [eax + 0x8a], 0x20
jne 0x443d4c
mov eax, dword [eax]
push 0
push eax
call ebx
mov ecx, dword [esi + 0x74]
mov edx, dword [ecx + edi*4]
mov eax, dword [edx]
mov ecx, dword [eax]
push 4
push ecx
call ebx
mov edx, dword [esi + 0x74]
mov eax, dword [edx + edi*4]
mov eax, dword [eax]
test byte [eax + 0x8a], 0x40
je 0x443d4c
cmp byte [eax + 0x88], 0x1a
jne 0x443d4c
mov ecx, dword [eax]
push 1
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
inc edi
cmp edi, dword [esi + 0x84]
jle 0x443cda
mov edx, dword [esp + 0x1c]
mov eax, dword [ebp + 0x178]
push 0
push edx
push 0x130c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x444e5d
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x214
push ebx
push esi
mov esi, dword [esp + 0x220]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push esi
mov dword [esp + 0x30], 0xff
call edi
cmp eax, 0x103
je 0x444f27
mov ecx, dword [0x4a4c24]
xor eax, eax
cmp byte [ecx + 0x2a], al
je 0x444eb2
mov eax, 0x100
lea edx, [esp + 0x14]
push edx
or eax, 0x20019
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x444f33
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00444e5d
mov edx, dword [esp + 0x18]
add esp, 4
push edx
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x444f33
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x444f33
lea ecx, [esp + 0x18]
push ecx
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
push 0
push esi
mov dword [esp + 0x30], 0xff
call edi
cmp eax, 0x103
jne 0x444ea0
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0x214
ret
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x214
ret

Function at 0x44502a
Capabilities:
Set socket configuration

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov eax, 2
push edi
mov word [ebx], ax
push ebp
or eax, 0xffffffff
call fcn.00410940
add esp, 4
mov esi, eax
push esi
call sub.WSOCK32.dll_inet_addr
push esi
mov edi, eax
call fcn.00412f61
add esp, 4
cmp edi, 0xffffffff
jne 0x445097
push 0x489604
push ebp
call fcn.004151ce
add esp, 8
test eax, eax
je 0x445097
push 0
push 1
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
add eax, ecx
call fcn.00402050
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0x10
push 0
push 2
jmp 0x445078
mov eax, dword [esp + 0x20]
lea ecx, [eax - 1]
mov dword [ebx + 4], edi
cmp ecx, 0xfffe
ja 0x445091
push eax
call sub.WSOCK32.dll_htons
pop edi
pop esi
mov word [ebx + 2], ax
pop ebp
mov al, 1
pop ebx
ret 0x10

Function at 0x4452a2
Capabilities:
Create http request

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
cmp ecx, 1
jne 0x4452b9
movzx eax, word [esi + 0x7c]
jmp 0x4452bd
movzx eax, word [esi + 0x48]
cmp ecx, 1
movsx edx, ax
lea ecx, [esi + 0xa0]
je 0x4452ce
lea ecx, [esi + 0x6c]
mov eax, dword [esi + 0xb0]
push 0
cmp edx, 1
jne 0x4452e2
push 0
push 0
push edx
jmp 0x445322
cmp edx, 2
jne 0x44531c
mov ecx, dword [ecx]
push str._local_
push ecx
push 3
jmp 0x445322
push 8
lea eax, [esp + 4]
push eax
push 0x32
push 0
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov al, 1
add esp, 8
ret 8
push 0
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 4], eax
pop esi
test eax, eax
jne 0x4452f3
xor al, al
add esp, 8
ret 8
Function at 0x445382
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
sub esp, 0x254
push ebx
mov ebx, dword [esp + 0x25c]
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [esp + 0x10]
push eax
push ebx
mov ebp, ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x445413
jmp 0x4453b2
lea ecx, [esp + 0x3c]
push 0x485f34
push ecx
call fcn.004151ce
add esp, 8
test eax, eax
je 0x445403
lea edx, [esp + 0x3c]
push 0x488e38
push edx
call fcn.004151ce
add esp, 8
test eax, eax
je 0x445403
mov eax, dword [esp + 0x270]
mov ecx, dword [esp + 0x26c]
push eax
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.00439891
add esp, 0xc
test al, al
je 0x4454cd
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4453b2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [esp + 0x274], 0
je 0x4454be
lea ecx, [esp + 0x10]
push ecx
push 0x488e30
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4454b7
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
nop
test byte [esp + 0x10], 0x10
je 0x4454a7
lea edx, [esp + 0x3c]
push 0x485f34
push edx
call fcn.004151ce
add esp, 8
test eax, eax
je 0x4454a7
lea eax, [esp + 0x3c]
push 0x488e38
push eax
call fcn.004151ce
add esp, 8
test eax, eax
je 0x4454a7
lea ecx, [esp + 0x3c]
push ecx
call edi
mov edx, dword [esp + 0x274]
mov eax, dword [esp + 0x270]
mov ecx, dword [esp + 0x26c]
push edx
push eax
push ecx
push ebx
mov ecx, ebp
call fcn.00445382
test al, al
je 0x4454cd
push 0x488e38
call edi
lea edx, [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x445442
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x254
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x254
ret 0x10

Function at 0x445b76
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4a35c0], 0
push esi
push edi
mov esi, 0x4a2bf0
jne 0x445b96
push 0
call fcn.00417ad3
push eax
call fcn.00437a20
add esp, 8
mov dword [0x49121c], 0x270
mov dword [0x4a2bec], esi
mov edx, 0xe3
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi + 0x634]
add esi, 4
xor edi, eax
sub edx, 1
mov dword [esi - 4], edi
jne 0x445bab
mov edx, 0x18c
mov edi, edi
mov ecx, dword [esi + 4]
mov edi, dword [esi]
mov al, cl
and al, 1
movzx eax, al
neg eax
sbb eax, eax
xor edi, ecx
and edi, 0x7ffffffe
xor edi, dword [esi]
and eax, 0x9908b0df
shr edi, 1
xor edi, dword [esi - 0x38c]
add esi, 4
xor edi, eax
sub edx, 1
mov dword [esi - 4], edi
jne 0x445be6
mov ecx, dword [0x4a2bf0]
mov dl, cl
and dl, 1
movzx eax, dl
mov edx, dword [esi]
neg eax
sbb eax, eax
xor edx, ecx
and edx, 0x7ffffffe
xor edx, dword [esi]
and eax, 0x9908b0df
shr edx, 1
xor edx, dword [esi - 0x38c]
pop edi
xor edx, eax
mov dword [esi], edx
pop esi
ret
Function at 0x446201
Capabilities:
Create pipe

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
push esi
mov esi, dword [esp + 0x18]
mov dword [esp + 4], 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
test al, 0x10
je 0x4462e6
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x446253
push 1
push esi
push eax
call fcn.00437f8a
mov eax, dword [esi]
add esp, 0xc
pop esi
add esp, 0xc
ret 0xc
mov dword [esi], 0
mov eax, dword [esi]
pop esi
add esp, 0xc
ret 0xc
mov edx, dword [esp + 0x1c]
push 0
lea ecx, [esp + 8]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4462c1
or eax, 0xffffffff
pop esi
add esp, 0xc
ret 0xc
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
test eax, eax
je 0x446296
cmp eax, 0xffffffff
jne 0x44623e
push 0
push 0x80
push 3
lea eax, [esp + 0x10]
push eax
push 1
push accept
push 0x486370
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x446253
test eax, eax
je 0x446253
mov edx, dword [esi]
push 1
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.00437f8a
push esi
call fcn.00437fba
mov eax, dword [esp + 0x28]
add esp, 0x10
mov dword [esi], eax
pop esi
add esp, 0xc
ret 0xc
test al, 1
je 0x446283
mov eax, dword [esi]
test eax, eax
je 0x446262
pop esi
add esp, 0xc
ret 0xc

Function at 0x4462fb
Capabilities:
Create pipe

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov ecx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
test al, 0x10
je 0x4463e2
push ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x446350
push 1
push esi
push eax
call fcn.00437f8a
mov eax, dword [esi]
add esp, 0xc
pop esi
add esp, 0xc
ret 0x14
mov dword [esi], 0
mov eax, dword [esi]
pop esi
add esp, 0xc
ret 0x14
mov edx, dword [esp + 0x24]
push 0
lea ecx, [esp + 8]
push ecx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4463bd
or eax, 0xffffffff
pop esi
add esp, 0xc
ret 0x14
push ecx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi], eax
test eax, eax
je 0x446392
cmp eax, 0xffffffff
jne 0x44633b
push 0
push 0x80
push 3
lea eax, [esp + 0x10]
push eax
push 2
push 0x40000000
push 0x486370
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x446350
test eax, eax
je 0x446350
mov edx, dword [esi]
push 1
lea ecx, [esp + 0x24]
push ecx
push edx
call fcn.00437f8a
push esi
call fcn.00437fba
mov eax, dword [esp + 0x30]
add esp, 0x10
mov dword [esi], eax
pop esi
add esp, 0xc
ret 0x14
test dword [esp + 0x18], eax
je 0x446380
mov eax, dword [esi]
test eax, eax
je 0x44635f
pop esi
add esp, 0xc
ret 0x14

Function at 0x44640c
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
test eax, eax
je 0x44641e
push eax
call fcn.0044605b
mov eax, dword [esi + 0x24]
pop esi
test eax, eax
je 0x44642f
mov dword [esp + 4], eax
jmp fcn.0044605b
ret 4