joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446ca4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
push 0x456d90
push dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 4], edi
call dword [sym.imp.MSVCR90.dll__wfopen]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x446ce8
push ebx
push 1
push 2
push 0x456d48
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
cmp eax, 1
je 0x446cf1
push ebx
call dword [sym.imp.MSVCR90.dll_fclose]
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
lea esi, [edi + 4]
push esi
push dword [esi + 0xc]
lea ecx, [ebp - 0x14]
call fcn.00446246
push esi
push dword [esi + 0x10]
lea ecx, [ebp - 0x24]
call fcn.00446246
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
call fcn.00439aad
test al, al
jne 0x446ded
mov edi, dword [sym.imp.MSVCR90.dll_fwprintf]
lea ecx, [ebp - 0x14]
call fcn.0044594d
mov esi, eax
cmp dword [esi + 0x18], 8
jb 0x446d3b
mov eax, dword [esi + 4]
jmp 0x446d3e
lea eax, [esi + 4]
push eax
push str.__s__r_n
push ebx
call edi
add esp, 0xc
test eax, eax
jl 0x446ce0
add esi, 0x1c
push esi
push dword [esi + 0xc]
lea ecx, [ebp - 0xc]
call fcn.00446246
push esi
push dword [esi + 0x10]
lea ecx, [ebp - 0x1c]
call fcn.00446246
jmp 0x446dac
lea ecx, [ebp - 0xc]
call fcn.0044594d
cmp dword [eax + 0x34], 8
jb 0x446d7e
mov ecx, dword [eax + 0x20]
jmp 0x446d81
lea ecx, [eax + 0x20]
cmp dword [eax + 0x18], 8
jb 0x446d8c
mov eax, dword [eax + 4]
jmp 0x446d8f
add eax, 4
push ecx
push eax
push str._s_s_r_n
push ebx
call edi
add esp, 0x10
test eax, eax
jl 0x446ce0
lea ecx, [ebp - 0xc]
call fcn.00445a21
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xc]
call fcn.00439aad
test al, al
je 0x446d6b
push 0x456d68
push ebx
call edi
pop ecx
pop ecx
test eax, eax
jl 0x446ce0
lea ecx, [ebp - 0x14]
call fcn.0044597b
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
call fcn.00439aad
test al, al
je 0x446d26
mov edi, dword [ebp - 4]
push ebx
call dword [sym.imp.MSVCR90.dll_fclose]
pop ecx
mov byte [edi + 0x3c], 0
mov al, 1
jmp 0x446cea
Function at 0x448f95
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
call fcn.004485a8
push 0x457bb0
push dword [ebp + 8]
call dword [sym.imp.MSVCR90.dll__wfopen]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x449013
and dword [ebp - 4], 0
push edi
push esi
push 1
lea eax, [ebp - 4]
push 2
push eax
call dword [sym.imp.MSVCR90.dll_fread]
push esi
mov edi, eax
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 0x14
cmp edi, 1
pop edi
jne 0x44900f
mov eax, 0xfeff
cmp word [ebp - 4], ax
je 0x449003
cmp word [ebp - 4], 0x5b
je 0x449003
cmp word [ebp - 4], 0x7f
jbe 0x449003
push dword [ebp + 8]
mov ecx, ebx
call fcn.00448843
jmp 0x449015
push dword [ebp + 8]
mov ecx, ebx
call fcn.00448bc9
jmp 0x449015
mov al, 1
jmp 0x449015
xor al, al
pop esi
pop ebx
leave
ret 4

Function at 0x4492cf
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x468110]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x10
pop edi
xor ebx, ebx
push edi
lea eax, [ebp - 0x24]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
call sub.MSVCR90.dll_memset
push edi
lea eax, [ebp - 0x14]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0x18
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x10]
mov dword [ebp - 0x28], edi
call sub.WS2_32.dll_getpeername
test eax, eax
jne 0x449333
push dword [ebp - 0x12]
call sub.WS2_32.dll_ntohs
movzx eax, ax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0x10]
mov dword [ebp - 0x28], edi
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x44935a
push dword [ebp - 0x22]
call sub.WS2_32.dll_ntohs
mov edi, dword [ebp - 0x20]
movzx ebx, ax
jmp 0x44935c
mov edi, ebx
push dword [esi + 0x478]
mov ecx, esi
mov dword [esi + 4], 3
call fcn.00449186
push dword [ebp - 0x30]
mov ecx, dword [esi + 8]
push dword [ebp - 0x2c]
mov eax, dword [ecx]
push ebx
push edi
call dword [eax + 4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00436772
leave
ret

Function at 0x4494a0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x468110]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x10
lea eax, [ebp - 0x14]
push 0
push eax
mov esi, ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 2
pop eax
mov word [ebp - 0x14], ax
mov eax, dword [esi + 0x70]
mov dword [ebp - 0x10], eax
movzx eax, word [esi + 0x6c]
push eax
call sub.WS2_32.dll_htons
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x10]
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
jne 0x449509
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x449509
push 1
push eax
mov ecx, esi
call fcn.0044938f
jmp 0x449510
mov dword [esi + 4], 2
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00436772
leave
ret
Function at 0x44951d
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
test eax, eax
je 0x4495b7
push ebx
lea ebx, [esi + 0x14]
push edi
mov ecx, dword [esi + 0x30]
sub eax, ecx
cmp eax, 0x2000
jb 0x449541
mov eax, 0x2000
cmp dword [ebx + 0x18], 0x10
jb 0x44954c
mov edx, dword [ebx + 4]
jmp 0x44954f
lea edx, [ebx + 4]
push 0
push eax
add ecx, edx
push ecx
push dword [esi + 0x10]
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x44958f
add dword [esi + 0x30], eax
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x28]
cmp edi, eax
jne 0x449530
mov eax, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
push dword [eax]
mov ecx, ebx
push 0
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_int__unsigned_int_]
mov ecx, dword [esi + 8]
and dword [esi + 0x30], 0
mov eax, dword [ecx]
push edi
call dword [eax + 8]
jmp 0x4495b5
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4495ab
push dword [esi + 0x28]
mov ecx, dword [esi + 8]
push dword [esi + 0x30]
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x4495b5
push 0
push eax
mov ecx, esi
call fcn.0044938f
pop edi
pop ebx
pop esi
ret
Function at 0x4495b9
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
lea ebp, [esp - 0x9f8c]
mov eax, 0xa00c
call fcn.00436dc0
mov eax, dword [0x468110]
xor eax, ebp
mov dword [ebp + 0x9f88], eax
push ebx
push esi
push 0
push 0xa000
lea eax, [ebp - 0x78]
mov esi, ecx
push eax
push dword [esi + 0x10]
call sub.WS2_32.dll_recv
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x449615
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x44969c
push 0
push eax
mov ecx, esi
call fcn.0044938f
jmp 0x44969c
mov ecx, esi
test ebx, ebx
jne 0x44962a
call fcn.0044924b
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax + 0x18]
jmp 0x44969c
push edi
push dword [esi + 0x478]
call fcn.00449186
push ebx
lea eax, [ebp - 0x78]
lea edi, [esi + 0x34]
push eax
mov ecx, edi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_char_const___unsigned_int_]
cmp dword [edi + 0x18], 0x10
mov eax, dword [esi + 0x48]
mov dword [ebp - 0x7c], eax
jb 0x449657
mov ecx, dword [edi + 4]
jmp 0x44965a
lea ecx, [edi + 4]
lea ebx, [ebp - 0x7c]
push ebx
mov dword [ebp - 0x80], ecx
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
push eax
push dword [ebp - 0x80]
call dword [edx + 0x10]
test eax, eax
jne 0x44969b
push esi
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
jne 0x44969b
cmp dword [esi + 0x10], 0xffffffff
je 0x44969b
cmp dword [esi + 4], 3
jne 0x44969b
mov eax, dword [ebp - 0x7c]
cmp dword [esi + 0x48], eax
jb 0x44969b
push eax
push 0
mov ecx, edi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_int__unsigned_int_]
pop edi
mov ecx, dword [ebp + 0x9f88]
pop esi
xor ecx, ebp
pop ebx
call fcn.00436772
add ebp, 0x9f8c
leave
ret
Function at 0x4497ab
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x68], 0x10
jb 0x44945f
mov eax, dword [esi + 0x54]
jmp 0x449462
lea eax, [esi + 0x54]
push 0x400
lea ecx, [esi + 0x74]
push ecx
push eax
mov eax, dword [esi + 0xc]
push 0x402
push dword [eax + 4]
call sub.WS2_32.dll_WSAAsyncGetHostByName
mov dword [esi + 0x474], eax
test eax, eax
jne 0x449497
call sub.WS2_32.dll_WSAGetLastError
push 1
push eax
mov ecx, esi
call fcn.0044938f
pop esi
ret
mov dword [esi + 4], 1
pop esi
ret
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x449819
push eax
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi + 0x10], eax
cmp eax, 0xffffffff
jne 0x4497d8
call sub.WS2_32.dll_WSAGetLastError
push 1
push eax
mov ecx, esi
call fcn.0044938f
pop esi
ret
mov ecx, dword [esi + 0xc]
push 0x3f
push 0x401
push dword [ecx + 4]
push eax
call sub.WS2_32.dll_WSAAsyncSelect
cmp eax, 0xffffffff
je 0x4497c7
cmp dword [esi + 0x68], 0x10
jb 0x4497fb
mov eax, dword [esi + 0x54]
jmp 0x4497fe
lea eax, [esi + 0x54]
push eax
call sub.WS2_32.dll_inet_addr
mov dword [esi + 0x70], eax
mov ecx, esi
pop esi
cmp eax, 0xffffffff
jne 0x449814
jmp 0x449451
jmp fcn.004494a0
cmp eax, 3
jne 0x4497d6
pop esi
jmp fcn.0044951d
Function at 0x41804e
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x418155
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x4180a1
push 0x3123
push 0x543a
push 1
call fcn.0041816b
add esp, 0xc
jmp 0x418153
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x418108
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x4180e5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xffffffed
jg 0x418106
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x418104
push 0x1122
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x4180da
jmp 0x418153
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x418136
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x418153
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x40]
call fcn.0042bf2c
mov dword [eax], 0xd3f46721
jmp 0x41812b
jmp 0x418167
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x44]
push 0
call fcn.004082c8
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42188e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 8]
test eax, eax
je 0x4218be
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 1
push dword [ebp - 4]
push 0x46cd
push 0x36f7
call fcn.00421963
add esp, 0x10
jmp 0x42195f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x421945
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x421925
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x421923
push 0x36e
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
jmp 0x421943
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x421943
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x42195f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 1
push 1
push 0x1ed5
push dword [ebp - 0x38]
call fcn.0040911a
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4369b9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x436a6b
mov eax, dword [ebp + 0x24]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x436a07
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0x39b6
push dword [ebp - 0xc]
push 1
call fcn.00436aab
add esp, 0xc
jmp 0x436a69
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x436a3f
push 0
push 0x1e71
push 0x1ba3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
jmp 0x436a69
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x436a69
push 0x12f5
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x436aa7
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
push eax
push 0x211c
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x5875
push dword [ebp - 0x34]
push 0
call fcn.004471d7
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x43dd95
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x43de55
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43ddf3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push 1
push dword [ebp - 0x18]
call fcn.0043df1c
add esp, 0xc
jmp 0x43de50
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x43de20
push 0x14a8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x43de50
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push 0xf
push 5
call fcn.0042e0d5
pop ecx
pop ecx
mov ecx, dword [ebp - 0x3c]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx]
mov dword [ecx + 4], eax
jmp 0x43df18
lea eax, [ebp + 0x30]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x43df10
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x43def0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x43ded1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x43deee
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x6c]
call fcn.0042bf2c
mov dword [eax], 0xdfc9b996
jmp 0x43dec6
jmp 0x43df0e
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
movzx eax, byte [eax]
test eax, eax
je 0x43df0e
push 0
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x43df18
push 0
call fcn.00432f58
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x43f93e
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x43fa58
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x43f9f3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x43f9ca
push 1
lea ecx, [ebp - 0x50]
call fcn.0042be3e
push 0x6966
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
call fcn.00449cf2
add esp, 0x10
push 1
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x54ae
call fcn.00441ee2
add esp, 0x14
lea ecx, [ebp - 0x50]
call fcn.0042bf10
jmp 0x43f9f1
mov byte [ebp - 1], 0
push 0
push 0x5549
push 0
push 1
push 1
lea eax, [ebp - 1]
push eax
push 0x50ae
push 0xc00
call fcn.0043f93e
add esp, 0x20
jmp 0x43fa56
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x43fa36
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jge 0x43fa34
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, 0x100
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x43fa1b
jmp 0x43fa56
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x43fa56
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x43fa76
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x3c]
push 1
push dword [ebp - 0x40]
push 0
call fcn.00432db2
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x440915
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x440956
mov eax, dword [ebp + 0x28]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
push 0x4be5
push 1
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x10]
call fcn.00440a41
add esp, 0x14
jmp 0x440a3d
lea eax, [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x440a1a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x4409fa
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4409de
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x4409f8
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.0042bf2c
and dword [eax], 0
jmp 0x4409d3
jmp 0x440a18
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x440a18
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x440a3d
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
push 0
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push 0
push 0x61b7
call fcn.0044687a
add esp, 0x14
mov esp, ebp
pop ebp
ret