joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451dd0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451d84
test al, al
jne 0x451df1
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x451e3f
xor eax, eax
push ebp
push 0x451e2f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_CreateDirectoryA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451e36
lea eax, [ebp - 0xc]
call fcn.00451dc0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x451e48
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451d84
test al, al
jne 0x451e6c
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x451ed2
xor eax, eax
push ebp
push 0x451ec2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x24]
push eax
push edi
push esi
call sub.kernel32.dll_CreateProcessA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451ec9
lea eax, [ebp - 0xc]
call fcn.00451dc0
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x451ee0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451d84
test al, al
jne 0x451f04
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x451f5c
xor eax, eax
push ebp
push 0x451f4c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.00403738
push eax
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_CopyFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451f53
lea eax, [ebp - 0xc]
call fcn.00451dc0
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x451f68
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451d84
test al, al
jne 0x451f89
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x451fd5
xor eax, eax
push ebp
push 0x451fc5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451fcc
lea eax, [ebp - 0xc]
call fcn.00451dc0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x452140
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451d84
test al, al
jne 0x452163
mov dword [ebp - 4], 0xffffffff
jmp 0x4521af
xor eax, eax
push ebp
push 0x45219f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4521a6
lea eax, [ebp - 0xc]
call fcn.00451dc0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4522e0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451d84
test al, al
jne 0x452304
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x452358
xor eax, eax
push ebp
push 0x452348
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403738
push eax
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_MoveFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45234f
lea eax, [ebp - 0xc]
call fcn.00451dc0
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x452364
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 8]
test edi, edi
jne 0x452387
test esi, 4
je 0x452387
xor edi, edi
jmp 0x452390
mov eax, edi
call fcn.00403738
mov edi, eax
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00451d84
test al, al
jne 0x4523a5
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4523f4
xor eax, eax
push ebp
push 0x4523e4
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
push edi
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_MoveFileExA
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4523eb
lea eax, [ebp - 0x10]
call fcn.00451dc0
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x452470
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451d84
test al, al
jne 0x452491
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4524dd
xor eax, eax
push ebp
push 0x4524cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_RemoveDirectoryA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4524d4
lea eax, [ebp - 0xc]
call fcn.00451dc0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4524e8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00451d84
test al, al
jne 0x45250c
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x452559
xor eax, eax
push ebp
push 0x452549
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
mov eax, esi
call fcn.00403738
push eax
call sub.kernel32.dll_SetFileAttributesA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452550
lea eax, [ebp - 0xc]
call fcn.00451dc0
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x453084
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x453173
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0042d940
mov edx, dword [ebp - 8]
mov ecx, 0x45318c
xor eax, eax
call fcn.00452e10
push 0
mov eax, dword [ebp - 4]
call fcn.00403738
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x453141
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x4530a4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00450ab8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00406d70
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0042e73c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.00450a88
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x406408
call fcn.00408c14
call fcn.0040311c
jmp 0x4530a4
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403494
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45317a
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403420
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403420
ret
Function at 0x4547ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
call fcn.00403728
xor eax, eax
push ebp
push 0x454891
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x18], 0
jne 0x4547f3
lea edx, [ebp + 0x18]
mov eax, edi
call fcn.0042c870
cmp dword [ebp + 0x18], 0
jne 0x4547f3
lea eax, [ebp + 0x18]
call fcn.0042d890
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402934
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x540
test ebx, ebx
je 0x45481e
mov eax, ebx
call fcn.00403738
mov dword [ebp - 0x34], eax
mov eax, edi
call fcn.00403738
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.00403738
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
call fcn.00403738
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x454862
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
jmp 0x45487b
mov dword [esi], 0x103
mov eax, dword [ebp - 8]
test eax, eax
je 0x45487b
push esi
mov ecx, dword [ebp + 0xc]
mov dl, byte [ebp + 0x14]
call fcn.00454498
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454898
lea eax, [ebp + 0x18]
call fcn.00403400
ret

Function at 0x454a7c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x454aaa
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.0040355c
jmp 0x454ab1
mov eax, ebx
call fcn.00403400
add esp, 0x14
pop ebx
ret

Function at 0x454ab8
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x454ae9
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.0040355c
jmp 0x454af0
mov eax, ebx
call fcn.00403400
add esp, 0x108
pop ebx
ret

Function at 0x454b00
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x4980dc], 2
jne 0x454b67
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x454b22
xor eax, eax
jmp 0x454b76
lea eax, [esp + 8]
push eax
push 0x454b7c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x454b67
xor eax, eax
jmp 0x454b76
push 0
push 2
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x454b90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x454bea
inc esi
xor edi, edi
cmp edi, 1
jne 0x454bb6
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x454bc4
cmp edi, 1
jle 0x454bc4
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00451f68
test eax, eax
jne 0x454bea
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x454bea
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x454bea
inc edi
dec esi
jne 0x454ba6
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4552b8
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
push 0
push 2
lea eax, [esp + 8]
push eax
call fcn.0042db1c
and eax, 0x7f
mov ecx, dword [eax*4 + 0x498a50]
mov edx, 0x80000002
xor eax, eax
call fcn.0042dd44
test eax, eax
jne 0x455302
mov eax, esi
call fcn.00403738
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
call fcn.00403738
push eax
call sub.gdi32.dll_RemoveFontResourceA
test eax, eax
je 0x455323
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageA
pop edx
pop esi
pop ebx
ret
Function at 0x455328
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov edi, ecx
mov esi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x455467
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x45547c
push 0x455490
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
lea edx, [ebp - 0xc]
mov al, byte [ebp - 1]
call fcn.00451d84
test al, al
jne 0x45537d
mov byte [ebp - 2], 0
jmp 0x45544c
xor eax, eax
push ebp
push 0x455445
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4553c1
push 0
mov eax, dword [ebp + 8]
push eax
push edi
lea edx, [ebp - 0x24]
mov eax, esi
call fcn.0042c7d0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0042c40c
mov eax, dword [ebp - 0x20]
call fcn.00403738
push eax
call ebx
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
jmp 0x45542f
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.0042c7d0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x24]
call fcn.0042c898
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0042c40c
mov eax, dword [ebp - 0x20]
call fcn.00403738
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 2], al
cmp byte [ebp - 2], 0
je 0x45542f
mov ecx, edi
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
call fcn.00430a50
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
imul dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.00430a50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45544c
lea eax, [ebp - 0xc]
call fcn.00451dc0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45546e
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00403420
ret
Function at 0x455610
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x45565d
xor ebx, ebx
jmp 0x455652
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00406acc
test eax, eax
jne 0x455651
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x45570d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x455633
mov al, byte [ebp - 1]
sub al, 1
jb 0x455668
je 0x455671
jmp 0x45567a
call fcn.0042e340
mov edi, eax
jmp 0x45567c
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x45567c
xor edi, edi
test di, di
je 0x45570d
xor ebx, ebx
jmp 0x4556b8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x4556b7
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4556ac
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x4556b7
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x45570d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x455689
xor ebx, ebx
jmp 0x455702
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x455701
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x4556f6
call sub.kernel32.dll_GetACP
mov edx, dword [ebp - 8]
cmp eax, dword [edx + 0x2c]
jne 0x455701
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x45570d
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4556c7
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x458254
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov ebx, edx
mov esi, eax
cmp byte [esi + 4], 0
je 0x45832e
mov byte [esi + 5], 1
mov eax, dword [esi + 0x10]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x45833c
call fcn.00457204
mov eax, dword [esi + 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4582ac
mov eax, 0x458370
call fcn.00456ff8
push 1
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_TerminateProcess
push 0x2710
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x458297
push esp
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
je 0x4582ff
cmp dword [esp], 0
jne 0x4582e1
mov eax, 0x4583a0
call fcn.00456ff8
jmp 0x458309
mov eax, dword [esp]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x4583c0
call fcn.00457204
jmp 0x458309
mov eax, 0x4583f8
call fcn.00456ff8
mov eax, dword [esi + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 4], 0
test bl, bl
je 0x45832e
push 0xfa
call sub.kernel32.dll_Sleep
add esp, 0xc
pop esi
pop ebx
ret
Function at 0x45842c
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45866e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
inc dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], ecx
xor eax, eax
lea ebx, [eax + 0xc]
add ebx, ecx
xor edx, edx
push ebp
push 0x45860b
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 1
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4584a1
mov eax, 0x458688
call fcn.00452afc
xor edx, edx
push ebp
push 0x4585a0
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x14
call fcn.00402934
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push 0x14
mov eax, dword [ebp - 4]
add eax, 0x4034
push eax
push ebx
mov eax, dword [ebp - 4]
add eax, 0x20
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_TransactNamedPipe
test eax, eax
jne 0x458589
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x458509
mov eax, 0x45869c
call fcn.00452afc
xor edx, edx
push ebp
push 0x458572
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp + 8], 0
je 0x458547
mov eax, dword [ebp - 4]
cmp word [eax + 0x1a], 0
je 0x458547
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
call dword [edx + 0x18]
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x458527
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458579
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
call sub.kernel32.dll_GetOverlappedResult
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4585a7
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x45bf58
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffe14
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x11e8], ebx
mov dword [ebp - 0x11ec], ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x11cc], edx
mov dword [ebp - 0x11d0], eax
lea esi, [ebp - 0x11e0]
lea edi, [ebp - 0x11d0]
xor eax, eax
push ebp
push 0x45c141
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x11d4], eax
xor eax, eax
mov dword [ebp - 0x11c8], eax
mov eax, dword [edi]
add eax, 0x10
push eax
lea ecx, [ebp - 0x11c4]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x11cc]
call fcn.004593b8
cmp dword [ebp - 0x1084], 0x30
jle 0x45bffc
lea ecx, [ebp - 0x11e8]
mov edx, dword [ebp - 4]
mov al, 0xb7
call fcn.00450ab8
mov ecx, dword [ebp - 0x11e8]
mov dl, 1
mov eax, 0x406408
call fcn.00408c14
call fcn.0040311c
lea eax, [ebp - 0x11ec]
lea edx, [ebp - 0x1184]
mov ecx, 0x80
call fcn.0040355c
mov edx, dword [ebp - 0x11ec]
lea ecx, [ebp - 0x11e8]
mov eax, dword [edi]
mov eax, dword [eax]
call fcn.0045b964
mov edx, dword [ebp - 0x11e8]
mov eax, dword [edi]
add eax, 0x14
call fcn.00403450
lea eax, [ebp - 0x11ec]
lea edx, [ebp - 0x1104]
mov ecx, 0x80
call fcn.0040355c
mov edx, dword [ebp - 0x11ec]
lea ecx, [ebp - 0x11e8]
mov eax, dword [edi]
mov eax, dword [eax]
call fcn.0045b964
mov edx, dword [ebp - 0x11e8]
mov eax, dword [edi]
add eax, 0x18
call fcn.00403450
lea eax, [ebp - 0x1078]
mov al, byte [eax]
mov edx, dword [edi]
mov byte [edx + 0x1d], al
mov ebx, dword [ebp - 0x1080]
test ebx, ebx
jle 0x45c123
push ebp
mov eax, esi
mov edx, 0xa
call fcn.0045bee0
pop ecx
mov eax, dword [esi + 6]
push eax
mov eax, dword [edi]
mov eax, dword [eax]
mov ecx, dword [esi + 2]
mov dx, word [esi]
call fcn.004599b8
mov dword [ebp - 0x11e4], eax
cmp dword [ebp - 0x11e4], 0
jne 0x45c0c4
push ebp
call fcn.0045bd34
pop ecx
xor eax, eax
push ebp
push 0x45c0f5
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x11e4]
add eax, 0x12
mov edx, dword [ebp - 0x11e4]
mov edx, dword [edx + 0xc]
call fcn.0045bee0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45c10f
mov edx, dword [ebp - 0x11e4]
mov eax, dword [edi]
call fcn.004599f4
dec ebx
jne 0x45c08d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c148
lea eax, [ebp - 0x11ec]
mov edx, 2
call fcn.00403420
ret