joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44939f
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
xor bl, bl
call fcn.004492be
mov edi, eax
test edi, edi
jne 0x4493c8
xor al, al
jmp 0x449463
xor ecx, ecx
lea eax, [ebp - 0x14]
push ecx
push ecx
push eax
push ecx
push ecx
push 4
mov dword [ebp - 0x14], ecx
mov ecx, esi
push 1
call fcn.00404e0f
push eax
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x449451
cmp dword [ebp - 0x14], eax
je 0x449451
push 2
push 0xc
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
je 0x449451
mov eax, dword [ebp - 0x10]
xor bl, bl
and dword [ebp - 0x18], 0
xor esi, esi
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
test eax, eax
je 0x449451
lea eax, [ebp - 0x18]
push eax
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x449444
mov eax, dword [ebp - 0x18]
cmp byte [eax], 1
jne 0x449444
add eax, 8
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x44944f
inc esi
cmp esi, dword [ebp - 0x1c]
jae 0x449451
mov ecx, dword [ebp - 0x20]
jmp 0x44941d
mov bl, 1
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00461014
leave
ret

Function at 0x44955d
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
je 0x4495e7
xor eax, eax
cmp ax, word [esi]
je 0x4495e7
push edi
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00464590
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push str._ProgramFiles_Internet_ExplorerIExplore.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4495cd
lea ecx, [ebp - 0x20c]
call fcn.0044b561
test eax, eax
je 0x4495cd
push 5
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
jmp 0x4495d2
push 5
push edi
push edi
push esi
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
pop edi
setg al
jmp 0x4495e9
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00461014
leave
ret
Function at 0x4498f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
mov esi, ecx
lea eax, [ebp - 0x20c]
push 0
mov dword [ebp - 0x210], esi
push eax
mov dword [ebp - 0x210], esi
call fcn.00464590
add esp, 0xc
mov dword [ebp - 0x214], 0x104
lea eax, [ebp - 0x214]
mov dword [ebp - 0x210], 1
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push str.Start_Page
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00404d2c
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00461014
leave
ret

Function at 0x449ff3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x44a049
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x44a049
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x44a03b
cmp esi, ecx
jae 0x44a049
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x44a029
cmp esi, ecx
jae 0x44a049
cmp word [esi], 0
je 0x44a049
mov eax, esi
jmp 0x44a04b
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x44a47b
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0x4c
mov eax, 0x4b5272
call fcn.00461a91
mov dword [ebp - 0x58], edx
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x50], eax
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x44a4ab
xor al, al
jmp 0x44a604
xor ecx, ecx
mov byte [ebp - 0x45], cl
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x4c], ecx
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 1
push eax
push 0x4c6a90
push 1
push ecx
push 0x4c6b10
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x44a503
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x44a4e9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x44a5fb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x44a5fb
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x4c]
push edx
push 0x4c6b20
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x44a4d8
mov esi, dword [ebp - 0x44]
mov ecx, ebx
mov edi, dword [esi]
call fcn.00404e0f
push eax
push esi
call dword [edi + 0x50]
test eax, eax
jne 0x44a4d8
mov esi, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x54]
mov edi, dword [esi]
call fcn.00404e0f
push eax
push esi
call dword [edi + 0x2c]
test eax, eax
jne 0x44a4d8
mov ecx, ebx
call fcn.00404e0f
push eax
lea ecx, [ebp - 0x40]
call fcn.00404d2c
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.004498a9
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 4
call fcn.00405118
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
mov edi, dword [esi]
call fcn.00404e0f
push eax
push esi
call dword [edi + 0x24]
test eax, eax
je 0x44a591
lea ecx, [ebp - 0x28]
call fcn.00405118
jmp 0x44a4d8
mov ecx, dword [ebp - 0x50]
call fcn.00405bc9
mov esi, dword [ebp - 0x44]
push dword [ebp + 0x10]
mov edi, dword [esi]
test al, al
jne 0x44a60a
mov ecx, dword [ebp - 0x50]
call fcn.00404e0f
push eax
push esi
call dword [edi + 0x44]
test eax, eax
jne 0x44a584
mov esi, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x58]
push eax
mov edi, dword [esi]
call fcn.00404e0f
push eax
push esi
call dword [edi + 0x18]
lea ecx, [ebp - 0x28]
test eax, eax
jne 0x44a587
mov byte [ebp - 0x45], 1
call fcn.00405118
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x44a5ea
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x44a5fb
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov al, byte [ebp - 0x45]
call fcn.00461a3b
ret
mov ecx, ebx
jmp 0x44a5a8
Function at 0x44b078
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
cmp dword [edi], esi
je 0x44b090
inc esi
jmp 0x44b0f1
lea eax, [ebp - 8]
push eax
push 0x4d34f8
push 1
push esi
push 0x4d34e8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x44b0b0
push 2
pop esi
jmp 0x44b0d7
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x44b0c5
push 3
jmp 0x44b0ad
mov eax, dword [ebp - 4]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push 4
test eax, eax
pop ecx
cmovs esi, ecx
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x44b0e4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x44b0f1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x44b531
Capabilities:
Set file attributes

Disassembly:
mov edx, dword [0x4f68dc]
test edx, edx
je 0x44b554
cmp dword [edx + 0x90], 0
je 0x44b554
mov eax, dword [edx]
push 0x80
push ecx
push edx
call dword [eax + 0x90]
ret
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret

Function at 0x44b64a
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x4ec06c]
xor eax, esp
mov dword [esp + 0x20], eax
cmp byte [0x4f7990], 0
push ebx
push esi
push edi
mov ebx, 0x4f7990
jne 0x44b74a
and dword [esp + 0x10], 0
lea ecx, [esp + 0x14]
push 0xfde9
push 0xffffffffffffffff
mov edx, 0x4d21f4
mov dword [esp + 0x14], 0x40
call fcn.00418c95
pop ecx
pop ecx
lea eax, [esp + 0xc]
push eax
push ebx
lea eax, [esp + 0x18]
push eax
push 0x4d351c
lea ecx, [esp + 0x24]
call fcn.0040a7fe
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.00404f45
test esi, esi
je 0x44b74a
xor eax, eax
lea edi, [esp + 0x14]
stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push 0
xor edx, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00421ac7
pop ecx
test al, al
je 0x44b705
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push str._08X_08X_08X_08X
push ebx
call fcn.00413ba4
add esp, 0x18
push 0xfde9
push 0xffffffffffffffff
mov edx, 0x4d21f4
lea ecx, [esp + 0x1c]
call fcn.00418c95
push ebx
call fcn.00466d90
add esp, 0xc
lea ecx, [esp + 0x14]
push eax
push ebx
push 1
push 0x4d351c
call fcn.0040a7fe
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [esp + 0x14]
call fcn.00404f45
mov ecx, dword [esp + 0x2c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00461014
mov esp, ebp
pop ebp
ret
Function at 0x44b75e
Capabilities:
Connect to http server
Create http request
Send data
Send http request

Disassembly:
push 0x490
mov eax, 0x4b54ff
call fcn.00461a91
mov edi, edx
mov esi, ecx
lea ecx, [ebp - 0x48c]
call fcn.0040a6f3
xor ebx, ebx
lea ecx, [ebp - 0x27c]
mov dword [ebp - 4], ebx
call fcn.0040a6f3
lea eax, [ebp - 0x27c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x48c]
mov ecx, esi
push eax
push dword [ebp + 8]
push edi
call fcn.00453605
add esp, 0x10
lea ecx, [ebp - 0x48c]
call fcn.00414c36
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404885
push ebx
push 0x4d3528
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00413776
or edi, 0xffffffff
cmp eax, edi
je 0x44b966
push edi
add eax, 3
lea ecx, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0041da03
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041dade
lea ecx, [ebp - 0x44]
call fcn.00404f45
push ebx
push 0x4d000c
lea ecx, [ebp - 0x2c]
call fcn.00413776
mov esi, eax
cmp esi, edi
je 0x44b966
push edi
push esi
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041da03
push esi
push ebx
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041da03
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041dade
lea ecx, [ebp - 0x44]
call fcn.00404f45
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
mov dword [ebp - 0x498], edi
test edi, edi
je 0x44b95e
push ebx
push ebx
push 3
mov eax, 0x4cf54a
lea ecx, [ebp - 0x2c]
push eax
push eax
push 0x50
call fcn.0040a7fe
push eax
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, eax
mov dword [ebp - 0x49c], esi
test esi, esi
je 0x44b95b
xor eax, eax
lea ecx, [ebp - 0x6c]
push eax
push eax
push eax
push eax
push eax
call fcn.0040a7fe
push eax
push 0x4d3520
push esi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
je 0x44b953
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x27c]
mov dword [ebp - 0x54], 0x28
call fcn.00405ae7
push 0
push 0
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x54]
push 0
push eax
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
test eax, eax
je 0x44b93d
lea ecx, [ebp - 0x27c]
call fcn.00405ae7
lea ecx, [ebp - 0x27c]
mov edi, eax
call fcn.00414c36
and dword [ebp - 0x490], 0
test edi, edi
je 0x44b93d
mov ebx, eax
lea eax, [ebp - 0x490]
push eax
push edi
push ebx
push esi
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x44b937
add ebx, dword [ebp - 0x490]
sub edi, dword [ebp - 0x490]
jne 0x44b915
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_HttpEndRequestW]
push esi
call ebx
mov edi, dword [ebp - 0x498]
push dword [ebp - 0x49c]
call ebx
push edi
call ebx
lea ecx, [ebp - 0x6c]
call fcn.00404f45
lea ecx, [ebp - 0x2c]
call fcn.00404f45
lea ecx, [ebp - 0x27c]
call fcn.0040a6d0
lea ecx, [ebp - 0x48c]
call fcn.0040a6d0
call fcn.00461a3b
ret
Function at 0x44c35d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
mov eax, dword [0x4ec06c]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 8]
mov edx, 0x19a
push ebx
push esi
push edi
test eax, eax
mov edi, ecx
mov ecx, dword [ebp + 0xc]
cmovne edx, eax
mov dword [esp + 0x1c], edi
test ecx, ecx
mov dword [esp + 0x18], edx
mov eax, 0x23c
cmovne eax, ecx
xor ebx, ebx
push eax
push edx
push ebx
push ebx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x24], eax
call fcn.0040e890
mov edx, eax
lea ecx, [esp + 0x3c]
call fcn.0044e0fd
push ebx
lea ecx, [esp + 0x24]
mov esi, eax
call fcn.0040c9b3
cmp dword [0x4f0bc8], 0
lea ebx, [edi + 0x160]
mov dword [esp + 0x10], ebx
jne 0x44c3df
call fcn.0040bb31
mov dword [0x4f0bc8], eax
lea eax, [ebx + 0x20]
mov ecx, 0x4f0b98
push eax
call fcn.0040c935
push 0x86000000
movzx ebx, ax
call fcn.0040bb50
mov edi, eax
mov dword [esp], 0x40008
call fcn.0040bb42
pop ecx
mov ecx, dword [esp + 0x10]
push 0
push ebx
push dword [esp + 0x28]
push eax
push edi
push 0
push esi
xor esi, esi
push esi
call fcn.0040bb5e
mov ebx, dword [esp + 0x1c]
push esi
lea edi, [ebx + 0x164]
mov ecx, edi
call fcn.00412b60
push 5
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebx + 0x34c]
lea ecx, [esp + 0x24]
cdq
sub eax, edx
sar eax, 1
push eax
push eax
call fcn.004052d0
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x3c]
add eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x28]
add eax, dword [esp + 0x1c]
push eax
push esi
push esi
call fcn.0040e890
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.0044e0fd
push 0
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.0040c9b3
mov eax, dword [edi]
add ebx, 0x300
cmp dword [0x4f0b38], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
jne 0x44c4ab
call fcn.0040bb31
mov dword [0x4f0b38], eax
lea eax, [ebx + 0x20]
mov ecx, 0x4f0b08
push eax
call fcn.0040c935
push 0x96000000
movzx ebx, ax
call fcn.0040bb50
mov edi, eax
mov dword [esp], 0x80800a0
call fcn.0040bb42
pop ecx
mov ecx, dword [esp + 0x10]
push 0
push ebx
push dword [esp + 0x20]
push eax
push edi
push str.SEInstallerBorder
push esi
push dword [esp + 0x30]
call fcn.0040bb5e
mov ecx, dword [esp + 0x1c]
call fcn.0044c50e
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00461014
mov esp, ebp
pop ebp
ret 8
Function at 0x44db51
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x4ec06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push dword [ebp - 0x190]
lea eax, [ebp - 0x84]
push dword [ebp - 0x194]
push str._I64d
push 0x80
push eax
call fcn.0042319c
lea eax, [ebp - 0x84]
push eax
call fcn.00466d90
movzx ecx, byte [ebp - 0x7d]
xor edx, edx
cmp eax, 7
lea eax, [ebp - 0x84]
push eax
cmova ecx, edx
mov byte [ebp - 0x7d], cl
call fcn.0046b3f5
mov ecx, eax
mov dword [ebp - 0x18c], 0x3e8
xor edx, edx
mov eax, esi
div dword [ebp - 0x18c]
xor edx, edx
sub ecx, eax
mov eax, ecx
mov ecx, 0xe10
div ecx
push esi
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x18c], eax
push ecx
push eax
push str.lotus::_starttime_is__d__filetime_is__s______d
lea eax, [ebp - 0x188]
push 0x104
push eax
call fcn.0042319c
add esp, 0x34
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x44dc87
push 0
push 0
lea eax, [ebp - 0x19c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x198]
push dword [ebp - 0x19c]
push dword [ebp - 0x18c]
push str.i_d_I64d
push 0x100
push ebx
call fcn.0042218b
push ebx
call fcn.00466aac
add esp, 0x1c
jmp 0x44dc89
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00461014
leave
ret
Function at 0x44df5e
Capabilities:
Reference public rsa key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x50
mov eax, dword [0x4ec06c]
xor eax, esp
mov dword [esp + 0x4c], eax
cmp dword [0x4f09c8], 0
push esi
push edi
jne 0x44df94
movsd xmm1, qword [0x4d4c80]
mov dword [0x4f09cc], 1
jmp 0x44e091
movsd xmm0, qword [0x4d4c68]
movsd xmm1, qword [0x4f09d0]
comisd xmm0, xmm1
jbe 0x44e099
push 1
push 0
call dword [sym.imp.USER32.dll_MonitorFromWindow]
mov edx, eax
test edx, edx
je 0x44e02f
push 9
pop ecx
xor eax, eax
mov dword [esp + 0x2c], 0x28
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
push edx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x20]
call fcn.0040f897
lea ecx, [esp + 0x1c]
call fcn.0040e8d6
lea ecx, [esp + 0x1c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x4d4cb8]
movsd qword [esp + 8], xmm0
call fcn.0040e8c1
movsd xmm1, qword [esp + 8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x4d4cb0]
minsd xmm1, xmm0
jmp 0x44e037
movsd xmm1, qword [0x4d4c80]
maxsd xmm1, qword [0x4d4c80]
mov eax, dword [0x4f09c8]
movsd qword [0x4f09d0], xmm1
cmp eax, 1
jne 0x44e05a
and dword [0x4f09cc], 0
jmp 0x44e099
cmp eax, 2
jne 0x44e099
mov eax, 0x4cca40
mov esi, eax
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
comisd xmm1, xmmword [esp + 0x10]
jae 0x44e082
add eax, 0x10
cmp eax, 0x4cca70
jne 0x44e064
jmp 0x44e099
mov eax, dword [esp + 8]
movsd xmm1, qword [esp + 0x10]
mov dword [0x4f09cc], eax
movsd qword [0x4f09d0], xmm1
mulsd xmm1, qword [0x4d4ca8]
mov ecx, dword [esp + 0x54]
pop edi
pop esi
xor ecx, esp
cvttsd2si eax, xmm1
mov dword [0x4f7404], eax
call fcn.00461014
mov esp, ebp
pop ebp
ret

Function at 0x44e0c9
Capabilities:
Reference public rsa key

Disassembly:
xorps xmm0, xmm0
mov dword [0x4f09c8], ecx
movsd qword [0x4f09d0], xmm0
jmp fcn.0044df5e

Function at 0x44e7c3
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov esi, ecx
call fcn.0044e813
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x44e807
lea ecx, [ebp - 8]
mov dword [ebp - 8], edi
push ecx
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push edi
push dword [ebp - 8]
push dword [ebp - 4]
push 2
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 4], eax
mov byte [esi + 8], 1
cmp dword [esi + 4], edi
pop edi
setne al
pop esi
leave
ret 8

Function at 0x44ee70
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x452cc9
Capabilities:
Create process on windows

Disassembly:
push 0x50
mov eax, 0x4b5dc5
call fcn.00461a5d
mov esi, dword [0x4f5194]
mov dword [ebp - 0x14], esi
lea edi, [esi + 4]
mov ecx, edi
call fcn.00405bc9
test al, al
je 0x452cfa
push edi
call fcn.00452de1
test al, al
je 0x452dd9
xor ebx, ebx
mov dword [ebp - 0x5c], 0x3c
mov ecx, edi
mov dword [ebp - 0x58], 0x100000
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], str.open
call fcn.00404e0f
mov dword [ebp - 0x4c], eax
lea edi, [ebp - 0x3c]
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], 5
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x452dd6
push 0x30
call fcn.004612cd
mov ebx, eax
pop ecx
mov dword [ebp - 0x1c], ebx
xor eax, eax
mov dword [ebp - 4], eax
mov edi, dword [esi + 0x1c]
lea esi, [ebx + 0x20]
mov dword [ebx], eax
mov byte [ebx + 4], al
mov byte [ebx + 0x18], al
mov dword [ebx + 0x1c], eax
lea eax, [ebp - 0xd]
push eax
mov dword [ebp - 0x20], esi
call fcn.00404348
and dword [esi], 0
and dword [esi + 4], 0
pop ecx
call fcn.004340d6
or dword [ebp - 4], 0xffffffff
mov dword [esi], eax
mov esi, dword [ebp - 0x14]
mov dword [ebx + 0x28], edi
mov dword [ebx + 0x2c], esi
mov edi, dword [esi]
mov dword [esi], ebx
test edi, edi
je 0x452daf
lea ecx, [edi + 0x20]
call 0x4530ca
push 0x30
push edi
call fcn.00461025
pop ecx
pop ecx
mov esi, dword [esi]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [esi + 0x28]
push dword [esi + 0x2c]
mov dword [esi], eax
mov byte [esi + 0x18], 1
mov eax, dword [ecx]
push 0x3e8
push 0x7512
call dword [eax]
mov eax, dword [ebp - 0x18]
test eax, eax
setne al
call fcn.00461a26
ret 4
Function at 0x453b5b
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x4e46a0
call fcn.00462050
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x453bc2
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x453bc2
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x453bc2
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x453bc2
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x453bcb
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4570f5
Capabilities:
Enumerate process modules

Disassembly:
push 0x434
mov eax, 0x4b5f8a
call fcn.00461a91
mov edi, edx
mov dword [ebp - 0x440], ecx
push 0x2801
mov dword [ebp - 0x43c], 0x2800
call fcn.0046142c
pop ecx
mov ecx, dword [ebp - 0x43c]
mov ebx, eax
lea eax, [ebp - 0x43c]
inc ecx
push eax
push ecx
push ebx
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x4571c8
xor esi, esi
test dword [ebp - 0x43c], 0xfffffffc
jbe 0x4571c8
push 0x208
lea eax, [ebp - 0x420]
push eax
push dword [ebx + esi*4]
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
cmp eax, 4
jbe 0x4571ba
lea eax, [ebp + eax*2 - 0x428]
push str..tmp
push eax
call fcn.00467153
pop ecx
pop ecx
test eax, eax
jne 0x4571ba
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x438]
call fcn.00404d2c
mov ecx, dword [ebp - 0x440]
lea eax, [ebp - 0x438]
and dword [ebp - 4], 0
push eax
call fcn.00405891
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x438]
call fcn.00405118
mov eax, dword [ebp - 0x43c]
inc esi
shr eax, 2
cmp esi, eax
jb 0x457150
push 1
push ebx
call fcn.00461025
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00461a3b
ret