joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4675cf
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ecx + 0x113e8], 0
push esi
push edi
je 0x46772a
mov ecx, dword [0x5a22a0]
call fcn.0040fa57
test al, al
jne 0x46772a
mov eax, dword [0x5a22a0]
mov esi, 0x122
add eax, 0xea4
push eax
push esi
lea eax, [ebp - 0x250]
push eax
call fcn.00401a0b
push str.clinkclink_dll_x86.dll
push esi
lea eax, [ebp - 0x250]
push eax
call fcn.004019cd
xor edi, edi
lea eax, [ebp - 0x250]
push edi
push eax
call fcn.004e2e74
pop ecx
pop ecx
test al, al
jne 0x467653
xor eax, eax
mov word [ebp - 0x250], ax
jmp 0x46765a
mov ax, word [ebp - 0x250]
test ax, ax
je 0x46772a
mov eax, dword [0x5a2c54]
test eax, eax
jne 0x467720
lea eax, [ebp - 0x258]
mov dword [ebp - 0x258], edi
push eax
lea eax, [ebp - 0x250]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jne 0x46769a
inc eax
mov dword [0x5a2c54], eax
jmp 0x46772c
push ebx
push 1
push esi
call fcn.004e1c42
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x46771a
push ebx
push esi
push edi
lea eax, [ebp - 0x250]
mov dword [ebp - 0x254], edi
push eax
mov dword [ebp - 0x25c], 4
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x467713
push 0x524e5c
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x467713
mov esi, dword [ebp - 0x254]
mov edi, 0x5a2c58
push 0xd
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [0x5a2c54], 2
push ebx
call fcn.004e1bea
pop ecx
mov eax, dword [0x5a2c54]
pop ebx
cmp eax, 1
je 0x46772c
cmp eax, 2
je 0x46772c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004f4166
leave
ret 4

Function at 0x467cc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push esi
push 0x40
pop esi
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x467d24
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
push 0
push 0
push str.EnableBalloonTips
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x467d1b
cmp dword [ebp - 4], eax
cmove esi, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x468855
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x25c], edi
call fcn.004e3cd3
movzx eax, al
lea ecx, [ebp - 0x250]
neg eax
push ecx
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionConsoleTrueTypeFont
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x468a61
push esi
push 0x40
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.004f5a90
add esp, 0xc
cmp byte [0x5a22be], bl
je 0x4689d1
lea eax, [ebp - 0x24c]
mov esi, ebx
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x254]
push eax
push ebx
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
jmp 0x4689a9
push 0x1f
pop eax
inc esi
cmp dword [ebp - 0x248], eax
cmovb eax, dword [ebp - 0x248]
add eax, eax
cmp eax, 0x40
jae 0x468a71
xor ecx, ecx
mov word [ebp + eax - 0x44], cx
mov ecx, 0xfe
mov eax, dword [ebp - 0x24c]
shr eax, 1
cmp eax, ecx
cmovb ecx, eax
add ecx, ecx
cmp ecx, 0x1fe
jae 0x468a71
xor eax, eax
mov word [ebp + ecx - 0x244], ax
lea eax, [ebp - 0x260]
push 0xa
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004fe324
add esp, 0xc
test eax, eax
je 0x468987
cmp word [ebp - 0x244], bx
je 0x468987
cmp word [ebp - 0x244], 0x2a
lea ecx, [ebp - 0x244]
lea eax, [ebp - 0x242]
push edi
cmovne eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x468a52
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x254]
push eax
push ebx
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x44]
push eax
push esi
push dword [ebp - 0x250]
mov dword [ebp - 0x248], 0x20
mov dword [ebp - 0x24c], 0x1fc
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x4688f1
mov esi, ebx
push 0x30
pop eax
mov word [ebp + esi*2 - 0x44], ax
lea eax, [esi*2 + 2]
cmp eax, 0x40
jae 0x468a71
push 0x7f
xor eax, eax
mov dword [ebp - 0x258], 0x1fe
pop ecx
mov word [ebp + esi*2 - 0x42], ax
lea edi, [ebp - 0x244]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x254]
push eax
push ebx
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x468a54
push dword [ebp - 0x25c]
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x468a52
inc esi
cmp esi, 0x14
jb 0x4689d3
jmp 0x468a54
mov bl, 1
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret
call fcn.004f4963
int3
Function at 0x46e101
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test eax, eax
je 0x46e155
cmp word [eax], 0
je 0x46e155
push ebx
mov ecx, 0xf0
lea edi, [esi + 0x1187c]
push ecx
push eax
push ecx
push edi
call fcn.0046eb38
xor eax, eax
mov ebx, 0x104
push str.SoftwareConEmu_
mov word [esi + 0x11a5a], ax
add esi, 0x11674
push ebx
push esi
call fcn.00401a0b
push edi
push ebx
push esi
call fcn.004019cd
pop ebx
jmp 0x46e176
push 0x54e9f8
push 0x104
lea eax, [esi + 0x11674]
push eax
call fcn.00401a0b
lea edi, [esi + 0x1187c]
xor eax, eax
mov word [edi], ax
push edi
push str.ConEmuConfig
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop edi
pop esi
pop ebp
ret 4
Function at 0x4732ce
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x20], ebx
mov ebx, eax
mov byte [ebp - 0xd], al
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], edi
test esi, esi
je 0x4732fe
mov word [esi], ax
test edi, edi
je 0x473424
cmp word [edi], ax
je 0x473424
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4733f2
push 1
push eax
call fcn.004e1c42
mov dword [ebp - 0x1c], eax
pop ecx
pop ecx
test eax, eax
je 0x4733d3
push eax
push dword [ebp - 0xc]
xor ecx, ecx
push ecx
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
call sub.VERSION.dll_GetFileVersionInfoW
mov edi, dword [ebp + 0x14]
test eax, eax
je 0x4733b0
push 0x524e5c
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x1c]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x47339d
mov eax, dword [ebp - 0x14]
push 0x34
pop ecx
cmp eax, ecx
cmova eax, ecx
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call fcn.004f5d30
add esp, 0xc
mov byte [ebp - 0xd], 1
jmp 0x4733c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x4733c8
push 0x54ff70
jmp 0x4733c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x4733c8
push str.LoadAppVersion.GetFileVersionInfo___failed__n
push edi
push esi
call fcn.00401a0b
push dword [ebp - 0x1c]
call fcn.004e1bea
pop ecx
jmp 0x47340d
test esi, esi
je 0x473471
push dword [ebp - 0xc]
mov edi, dword [ebp + 0x14]
push str.LoadAppVersion_failed__Cant_allocate__n_bytes__n
push edi
push esi
call fcn.004e22e7
add esp, 0x10
jmp 0x47340d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test esi, esi
je 0x47346e
mov edi, dword [ebp + 0x14]
push str.LoadAppVersion.GetFileVersionInfoSize___failed__n
push edi
push esi
call fcn.00401a0b
test esi, esi
je 0x473460
xor eax, eax
cmp word [esi], ax
je 0x47343b
push dword [ebp - 0x28]
push edi
push esi
call fcn.004019cd
jmp 0x473439
mov ebx, eax
test esi, esi
je 0x473469
mov edi, dword [ebp + 0x14]
push str.Invalid_asModulePath_was_specified
push edi
push esi
call fcn.00401a0b
xor eax, eax
test ebx, ebx
je 0x473460
cmp word [esi], ax
je 0x473460
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
sub edi, eax
push str._nErrCode0x_08X
lea eax, [esi + eax*2]
push edi
push eax
call fcn.004e22e7
add esp, 0x10
mov bl, byte [ebp - 0xd]
test bl, bl
jne 0x473483
jmp 0x473471
mov bl, byte [ebp - 0xd]
jmp 0x473473
mov bl, byte [ebp - 0xd]
xor eax, eax
push 0x34
pop esi
push esi
push eax
push dword [ebp - 0x20]
call fcn.004f5a90
add esp, 0xc
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret
Function at 0x4750d6
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x475114
cmp dword [eax + 0x20], 0
je 0x475114
push esi
push 1
xor esi, esi
push esi
push esi
push dword [eax + 0x20]
push str.open
push dword [0x5a22a4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x475113
push esi
push esi
push esi
push eax
push str.ShellExecute_failed
call fcn.00420ad9
add esp, 0x14
pop esi
ret
Function at 0x47d60c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor edx, edx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0x10]
cmp esi, 0x100
jne 0x47d6ea
cmp dword [ebx + 0x1ab4], edx
je 0x47d6a2
cmp edi, 0x1b
je 0x47d687
cmp edi, 0xd
je 0x47d687
cmp edi, 0x25
je 0x47d658
cmp edi, 0x27
je 0x47d658
cmp edi, 0x26
je 0x47d658
cmp edi, 0x28
je 0x47d658
cmp edi, 0x24
je 0x47d658
cmp edi, 0x23
jne 0x47d6a2
cmp edi, 0xd
je 0x47d687
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x11
call esi
shr eax, 0xf
mov ecx, ebx
and al, 1
movzx eax, al
push eax
push edi
call fcn.00477f7e
jmp 0x47d69b
push edx
cmp edi, 0x1b
push edi
setne cl
movzx ecx, cl
push edx
push ecx
mov ecx, ebx
call fcn.004799b5
mov al, 1
jmp 0x47d7ce
mov ecx, dword [0x5a23ec]
cmp byte [ecx + 0x10fd4], dl
je 0x47d6d3
push edx
push 0x7da
call fcn.0045edf1
push eax
push edi
call fcn.00424470
pop ecx
pop ecx
test al, al
je 0x47d6d1
push 1
mov ecx, ebx
call fcn.0047fa6c
xor edx, edx
mov eax, dword [ebx + 0x4c]
cmp word [eax + 0x4a92], dx
je 0x47d750
xor ecx, ecx
mov word [eax + 0x4a92], cx
jmp 0x47d750
cmp esi, 0x101
jne 0x47d750
mov ecx, dword [ebx + 0x4c]
movzx eax, word [ecx + 0x4a92]
cmp edi, eax
jne 0x47d70b
xor eax, eax
mov word [ecx + 0x4a92], ax
jmp 0x47d69b
mov ecx, dword [0x5a23ec]
cmp byte [ecx + 0x10fd4], dl
je 0x47d750
push edx
push 0x7da
call fcn.0045edf1
push eax
push edi
call fcn.00424470
pop ecx
pop ecx
test al, al
je 0x47d74e
cmp dword [ebx + 0x1ba8], 0
je 0x47d74e
push 0
mov ecx, ebx
call fcn.00481256
test al, al
je 0x47d74e
mov ecx, ebx
call fcn.00481a96
xor edx, edx
mov ecx, dword [ebx]
lea eax, [ecx - 2]
cmp eax, 3
ja 0x47d7cc
cmp esi, 0x101
jne 0x47d797
cmp edi, 0x1b
jne 0x47d7cc
cmp ecx, 4
jne 0x47d788
mov eax, dword [0x5a22a0]
mov eax, dword [eax + 0x3e80]
cmp dword [eax], 0
je 0x47d788
push dword [eax]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x47d7cc
mov ecx, dword [ebx + 0x4c]
push 1
call fcn.00491c09
jmp 0x47d69b
cmp esi, 0x100
jne 0x47d7cc
cmp edi, 0x22
je 0x47d7bd
cmp edi, 0x21
je 0x47d7bd
cmp ecx, 3
je 0x47d7cc
cmp ecx, 4
je 0x47d7cc
cmp edi, 0x26
je 0x47d7bd
cmp edi, 0x28
jne 0x47d7cc
push dword [ebx + 0x4c]
push edi
push edx
call fcn.00426587
jmp 0x47d69b
xor al, al
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x482d59
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa4
call edi
mov esi, dword [ebp + 8]
mov ebx, 0x8000
test bx, ax
je 0x482d7c
or dword [esi], 2
push 0xa5
call edi
test bx, ax
je 0x482d8b
or dword [esi], 1
push 0xa2
call edi
test bx, ax
je 0x482d9a
or dword [esi], 8
push 0xa3
call edi
test bx, ax
je 0x482da9
or dword [esi], 4
push 0x10
call edi
test bx, ax
je 0x482db5
or dword [esi], 0x10
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x483050
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
test esi, esi
jne 0x483062
xor eax, eax
jmp 0x4831ce
push ebx
push edi
xor ebx, ebx
push ebx
call fcn.00487c63
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jne 0x48308d
push str.Far_was_not_found_in_console
push 0x80
lea edi, [esi + 0x4984]
push edi
call fcn.00401a0b
jmp 0x4830cb
mov eax, dword [ebp + 8]
test eax, eax
jns 0x4830ae
push eax
lea edi, [esi + 0x4984]
push str.Bad_anWndIndex_i_was_requested
push edi
call fcn.00401133
add esp, 0xc
jmp 0x4831be
cmp dword [esi + 0x4978], eax
jne 0x4830d3
push eax
lea edi, [esi + 0x4984]
push str.Far_window__i_is_already_active
push edi
call fcn.00401133
add esp, 0xc
or ebx, 0xffffffff
jmp 0x4831be
push 1
mov ecx, esi
call fcn.004976f8
test eax, eax
je 0x4830f0
push dword [ebp + 8]
push dword [ebp - 4]
push str.PicView_was_found_r_nPID_u__anWndIndex_i
jmp 0x4831af
push 0x3ff
lea eax, [esi + 0x1648]
push eax
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x483110
mov word [esi + 0x1648], ax
push ebx
push ebx
mov ecx, esi
call fcn.0048834e
test ax, ax
js 0x48312e
push dword [ebp + 8]
push dword [ebp - 4]
push str.Progress_was_detected_r_nPID_u__anWndIndex_i
jmp 0x4831af
mov ecx, dword [esi + 0x4288]
call fcn.00481d36
test al, al
jne 0x48314a
push dword [ebp + 8]
push dword [ebp - 4]
push str.Buffer_not_initialized_r_nPID_u__anWndIndex_i
jmp 0x4831af
mov ecx, dword [esi + 0x4288]
cmp ecx, dword [esi + 0x4294]
je 0x483165
push dword [ebp + 8]
push dword [ebp - 4]
push str.Alternative_buffer_is_active_r_nPID_u__anWndIndex_i
jmp 0x4831af
cmp byte [esi + 0x4970], 1
jne 0x483187
call fcn.00481bed
movzx eax, al
test eax, eax
je 0x483187
push dword [ebp + 8]
push dword [ebp - 4]
push str.Menu_or_macro_was_detected_r_nPID_u__anWndIndex_i
jmp 0x4831af
mov ecx, dword [esi + 0x4294]
test ecx, ecx
je 0x4831ca
call fcn.0047b359
mov ecx, eax
call fcn.004f293e
test eax, 0xff00
je 0x4831ca
push dword [ebp + 8]
push dword [ebp - 4]
push str.Dialog_was_detected_r_nPID_u__anWndIndex_i
lea edi, [esi + 0x4984]
push edi
call fcn.00401133
add esp, 0x10
push edi
mov ecx, esi
call fcn.0048a02d
mov eax, ebx
jmp 0x4831cc
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x483813
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x4968], 0
jle 0x483885
cmp byte [esi + 0x4970], 1
jne 0x483885
push 0x3ff
lea eax, [ebp - 0x804]
push eax
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x48385d
mov word [esi + 0x318c], ax
jmp 0x483885
cmp word [ebp - 0x804], 0x7b
je 0x483871
cmp word [ebp - 0x804], 0x28
jne 0x483885
lea eax, [ebp - 0x804]
push eax
lea eax, [esi + 0x318c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004f4166
leave
ret
Function at 0x484069
Capabilities:
Enumerate processes

Disassembly:
push 0x324
mov eax, 0x51051c
call fcn.004f41e2
mov esi, ecx
mov dword [ebp - 0x310], esi
push dword [esi + 0x5fc]
lea ecx, [ebp - 0x330]
call fcn.004821dd
mov edi, dword [ebp - 0x32c]
xor ebx, ebx
mov dword [ebp - 4], ebx
test edi, edi
je 0x48428b
cmp dword [esi + 0x5f4], ebx
jne 0x4840b2
mov dword [esi + 0x5f4], ebx
push str.Searching_for_conhost
mov ecx, esi
call fcn.0048a02d
mov dword [ebp - 0x30c], ebx
movaps xmm0, xmmword [0x55a290]
mov dword [ebp - 0x314], ebx
movups xmmword [ebp - 0x324], xmm0
push ebx
push 2
mov byte [ebp - 4], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x308], eax
test eax, eax
je 0x484217
cmp eax, 0xffffffff
je 0x484217
push 0x228
lea eax, [ebp - 0x300]
mov dword [ebp - 0x304], 0x22c
push ebx
push eax
call fcn.004f5a90
add esp, 0xc
lea eax, [ebp - 0x304]
push eax
push dword [ebp - 0x308]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x48418a
mov esi, dword [ebp - 0x308]
push str.conhost.exe
lea eax, [ebp - 0x2e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x484173
push ebx
push ebx
lea eax, [ebp - 0x2fc]
push eax
lea ecx, [edi + 8]
call fcn.0040eeeb
test al, al
jne 0x484173
lea eax, [ebp - 0x304]
push eax
lea ecx, [ebp - 0x324]
call fcn.00497f1f
lea eax, [ebp - 0x304]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x484136
mov esi, dword [ebp - 0x310]
push dword [ebp - 0x308]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x320], 0
jle 0x484217
cmp dword [ebp - 0x320], 1
jle 0x4841e9
push str.More_than_one_created_conhost.exe_was_found_
mov ecx, esi
call fcn.0048a02d
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x324]
mov byte [ebp - 4], 4
call fcn.0040635a
mov eax, dword [ebp - 0x30c]
inc eax
mov byte [ebp - 4], bl
mov dword [ebp - 0x30c], eax
cmp eax, 1
jle 0x4840c4
jmp 0x484229
mov eax, dword [ebp - 0x314]
mov eax, dword [eax + 8]
mov dword [esi + 0x5f4], eax
test eax, eax
je 0x484211
push eax
lea eax, [ebp - 0xd8]
push str.ConEmu:_ConHost_was_created_PID_u_n
push eax
call fcn.00409b7d
add esp, 0xc
mov byte [ebp - 4], 5
jmp 0x48421b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x324]
call fcn.0040635a
mov byte [ebp - 4], bl
cmp byte [ebp + 8], 0
je 0x48423a
lea ecx, [esi + 0x5f8]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [0x5a23ec]
push 1
call fcn.004673c5
test eax, eax
je 0x484273
push dword [esi + 0x5f4]
lea eax, [ebp - 0xd8]
push str.ConHostPID_u
push eax
call fcn.00409b7d
add esp, 0xc
lea eax, [ebp - 0xd8]
mov ecx, esi
push eax
call fcn.0048a02d
mov ebx, dword [esi + 0x5f4]
test ebx, ebx
je 0x48428b
mov ecx, dword [esi + 4]
call fcn.00419bbf
mov ebx, dword [esi + 0x5f4]
mov dword [ebp - 4], 7
test edi, edi
je 0x48429d
mov ecx, edi
call fcn.0040771d
mov eax, ebx
call fcn.004f418c
ret 4
Function at 0x4842a7
Capabilities:
Enumerate processes

Disassembly:
push 0x244
mov eax, 0x51054f
call fcn.004f41e2
mov ebx, ecx
push dword [ebx + 0x5fc]
lea ecx, [ebp - 0x250]
call fcn.004821dd
and dword [ebp - 4], 0
mov edi, dword [ebp - 0x24c]
test edi, edi
je 0x4843a9
push str.Prepare_searching_for_conhost
mov ecx, ebx
call fcn.0048a02d
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0x240], eax
call fcn.004919f2
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x48439d
cmp esi, 0xffffffff
je 0x48439d
push 0x228
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 0x22c
push 0
push eax
call fcn.004f5a90
add esp, 0xc
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x484396
mov edi, dword [ebp - 0x240]
mov dword [ebp - 0x244], 1
push str.conhost.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x48437f
lea eax, [ebp - 0x244]
mov ecx, edi
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0041a8f9
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x484354
mov edi, dword [ebp - 0x24c]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Prepare_searching_for_conhost___Done
mov ecx, ebx
call fcn.0048a02d
mov dword [ebp - 4], 2
test edi, edi
je 0x4843bb
mov ecx, edi
call fcn.0040771d
call fcn.004f418c
ret
Function at 0x4855f3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x48563b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x5a4f60]
sub edx, eax
cmp edx, 0x3e8
jae 0x485627
push 1
push 0xffffffffffffffff
push 0
push 0x40
push str.Space_bounce_received_from_unknown_window
call fcn.00421ef1
add esp, 0x14
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0xffffffffffffffff
mov ecx, esi
mov dword [0x5a4f60], eax
call fcn.004937ec
pop esi
ret

Function at 0x4861f9
Capabilities:
Write file on windows

Disassembly:
push 0x1c
mov eax, 0x50ff98
call fcn.004f41ae
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
call fcn.00477032
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.0047b27c
test al, al
je 0x479b06
lea ecx, [ebp - 0x28]
call fcn.004404f9
push 0xffffffffffffffff
push ebx
lea eax, [esi + 0x1a10]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x28]
call fcn.004e6dba
mov edi, dword [esi + 0x1b60]
lea ecx, [ebp - 0x10]
imul edi, dword [esi + 0x1b5c]
mov eax, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
push ecx
cmp dword [eax + 0xc], edi
cmovb edi, dword [eax + 0xc]
add edi, edi
push edi
push dword [eax + 0x18]
push dword [ebp + 8]
call esi
push ebx
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push edi
push dword [eax + 0x1c]
push dword [ebp + 8]
call esi
lea ecx, [ebp - 0x28]
call fcn.004e6c72
lea ecx, [ebp - 0x1c]
call fcn.00477212
call fcn.004f4177
ret 4
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0x4294]
pop ebp
jmp 0x479a75