joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f71c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d4c
xor eax, eax
push ebp
push 0x43f859
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004048cc
lea eax, [ebp - 0x1c]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x43f870
call fcn.00404e4c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404dc4
mov eax, dword [ebp - 0x1c]
call fcn.0043f118
mov esi, eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x43f78d
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0xc]
push eax
push 8
push 0
lea eax, [ebp - 0x20]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x43f870
call fcn.00404e4c
mov edx, eax
inc edx
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.00404dc4
mov eax, dword [ebp - 0x20]
call fcn.00404d5c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0x10], 0xff
mov eax, dword [ebp - 0x10]
call fcn.00402e30
mov ebx, eax
xor esi, esi
jmp 0x43f801
push dword [ebp - 8]
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.00404ac4
push dword [ebp - 0x24]
push 0x43f87c
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404c60
inc esi
mov dword [ebp - 0x10], 0xff
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
je 0x43f7d7
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.00404920
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f860
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004048f0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048f0
ret
Function at 0x4401a0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x44032c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 4]
mov edx, 0x200
call fcn.00404f90
mov eax, 0x2000
call fcn.00440180
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x44030f
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
mov dword [ebp - 0x10], 0x200
mov dword [ebp - 0x14], 0x2000
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d5c
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
test ebx, ebx
jne 0x440256
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404d5c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404d5c
push eax
push esi
call sub.advapi32.dll_RegDeleteValueA
test ebx, ebx
je 0x4401ef
xor edi, edi
mov dword [ebp - 0x10], 0x200
mov dword [ebp - 0x14], 0x2000
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d5c
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x4402f1
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d5c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCreateKeyA
mov ebx, eax
test ebx, ebx
jne 0x4402f1
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d5c
push eax
push esi
call sub.advapi32.dll_RegCreateKeyA
mov ebx, eax
test ebx, ebx
jne 0x4402e8
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
call fcn.004401a0
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 4]
call fcn.00404d5c
push eax
push esi
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x44025c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440316
mov eax, dword [ebp - 0x1c]
call fcn.00402e4c
ret
Function at 0x4403b0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404d4c
mov eax, dword [ebp - 8]
call fcn.00404d4c
xor eax, eax
push ebp
push 0x44044d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d5c
mov esi, eax
push esi
push ebx
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x440432
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.00404d5c
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyA
test eax, eax
jne 0x440419
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004401a0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440454
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048f0
ret

Function at 0x440aac
Capabilities:
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d4c
xor eax, eax
push ebp
push 0x440b83
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0xc], eax
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jbe 0x440b62
cmp edi, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x440aff
mov esi, 0x10
jmp 0x440b04
mov esi, 0x20
or esi, 4
push esi
mov eax, dword [ebp - 4]
call fcn.00404d5c
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
jbe 0x440b5c
cmp dword [ebp - 8], 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x440b4c
cmp edi, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x440b40
lea eax, [ebp - 0xc]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceA
jmp 0x440b4c
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
lea eax, [ebp - 0x28]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x24]
call fcn.004408c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440b8a
lea eax, [ebp - 4]
call fcn.004048cc
ret
Function at 0x440b94
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x440b9d
mov eax, dword [ebp - 4]
add esp, 0xfffff7dc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x4824], edx
mov dword [ebp - 0x4828], edx
mov dword [ebp - 0x481c], edx
mov dword [ebp - 0x4820], edx
mov dword [ebp - 0x4818], edx
mov esi, eax
xor eax, eax
push ebp
push 0x440d15
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004048cc
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x440cf7
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4800
lea eax, [ebp - 0x4814]
push eax
push 3
push 0x30
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_EnumServicesStatusA
mov edi, dword [ebp - 0x10]
dec edi
test edi, edi
jl 0x440cde
inc edi
lea ebx, [ebp - 0x4814]
lea eax, [ebp - 0x4818]
mov edx, dword [ebx]
call fcn.00404ac4
mov edx, dword [ebp - 0x4818]
mov eax, esi
call fcn.00404b98
push dword [esi]
push 0x440d2c
lea eax, [ebp - 0x4820]
mov edx, dword [ebx]
call fcn.00404ac4
mov eax, dword [ebp - 0x4820]
lea edx, [ebp - 0x481c]
call fcn.004409f4
push dword [ebp - 0x481c]
mov eax, esi
mov edx, 3
call fcn.00404c60
push dword [esi]
push 0x440d2c
lea eax, [ebp - 0x4824]
push eax
lea eax, [ebp - 0x4828]
mov edx, dword [ebx]
call fcn.00404ac4
mov eax, dword [ebp - 0x4828]
xor ecx, ecx
xor edx, edx
call fcn.00440aac
push dword [ebp - 0x4824]
push 0x440d38
mov eax, esi
mov edx, 4
call fcn.00404c60
add ebx, 0x24
dec edi
jne 0x440c42
cmp dword [ebp - 0xc], 0
jne 0x440c0a
cmp dword [ebp - 8], 0
jbe 0x440cf7
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440d1c
lea eax, [ebp - 0x4828]
mov edx, 5
call fcn.004048f0
ret

Function at 0x4439c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d4c
xor eax, eax
push ebp
push 0x443a81
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x443a5f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403460
lea eax, [ebp - 0x122]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403460
lea eax, [ebp - 0x122]
mov edx, dword [ebp - 4]
call fcn.00408d18
xor eax, eax
mov dword [ebp - 0x22], eax
lea eax, [ebp - 0x122]
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x40
or word [ebp - 0x12], 0x10
or word [ebp - 0x12], 4
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x443a6b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443a88
lea eax, [ebp - 4]
call fcn.004048cc
ret
Function at 0x443a94
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d4c
xor eax, eax
push ebp
push 0x443b11
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
xor ecx, ecx
mov edx, 0x160
call fcn.00403460
push 0x400
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404d5c
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, ebx
lea edx, [ebp - 0x54]
mov ecx, 0x50
call fcn.00404b3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443b18
lea eax, [ebp - 4]
call fcn.004048cc
ret

Function at 0x443e84
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x88], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x443f64
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004048cc
lea eax, [ebp - 0x81]
push eax
push 0x81
call sub.kernel32.dll_GetLogicalDriveStringsA
test eax, eax
je 0x443f4b
lea esi, [ebp - 0x81]
jmp 0x443f46
lea eax, [ebp - 0x88]
mov edx, esi
call fcn.00404ac4
mov edx, dword [ebp - 0x88]
mov eax, ebx
call fcn.00404b98
push esi
call sub.kernel32.dll_GetDriveTypeA
sub eax, 2
je 0x443eff
dec eax
je 0x443f0d
dec eax
je 0x443f1b
dec eax
je 0x443f29
jmp 0x443f37
mov eax, ebx
mov edx, 0x443f7c
call fcn.00404b98
jmp 0x443f43
mov eax, ebx
mov edx, 0x443f88
call fcn.00404b98
jmp 0x443f43
mov eax, ebx
mov edx, 0x443f94
call fcn.00404b98
jmp 0x443f43
mov eax, ebx
mov edx, 0x443fa0
call fcn.00404b98
jmp 0x443f43
mov eax, ebx
mov edx, 0x443f88
call fcn.00404b98
add esi, 4
cmp byte [esi], 0
jne 0x443ecf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443f6b
lea eax, [ebp - 0x88]
call fcn.004048cc
ret

Function at 0x44459c
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x4445b1
or edx, 0x200
test eax, 0x20000000
je 0x4445e4
test eax, 0x40000000
je 0x4445d0
test eax, 0x80000000
je 0x4445cb
or edx, 0x40
jmp 0x44460b
or edx, 0x20
jmp 0x44460b
test eax, 0x80000000
je 0x4445df
or edx, 0x80
jmp 0x44460b
or edx, 0x10
jmp 0x44460b
test eax, 0x40000000
je 0x4445fc
test eax, 0x80000000
je 0x4445f7
or edx, 4
jmp 0x44460b
or edx, 2
jmp 0x44460b
test eax, 0x80000000
je 0x444608
or edx, 8
jmp 0x44460b
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x44505c
Capabilities:
Allocate or change rwx memory
Delete file
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x445209
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004048cc
mov dl, 1
mov eax, dword [0x414bb0]
call fcn.00403a64
mov ebx, eax
mov dl, 1
mov eax, dword [0x414bb0]
call fcn.00403a64
mov esi, eax
mov edx, dword [0x44e28c]
mov ecx, 0x69a
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x10]
push 0
push 0
mov eax, ebx
call fcn.00417208
mov edx, esi
mov eax, ebx
call fcn.00443838
mov eax, ebx
call fcn.00403a94
push 0
push 0
mov eax, esi
call fcn.00417208
push 0x40
push 0x1000
mov eax, esi
mov edx, dword [eax]
call dword [edx]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov edi, eax
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [esi + 4]
mov eax, edi
call fcn.00407064
mov eax, esi
call fcn.00403a94
mov dl, 1
mov eax, dword [0x414bb0]
call fcn.00403a64
mov ebx, eax
mov dl, 1
mov eax, dword [0x414bb0]
call fcn.00403a64
mov esi, eax
mov edx, 0x445220
mov eax, ebx
call fcn.00417978
push 0
push 0
mov eax, ebx
call fcn.00417208
mov edx, esi
mov eax, ebx
call fcn.00443838
mov eax, ebx
call fcn.00403a94
push 0
push 0
mov eax, esi
call fcn.00417208
mov ebx, edi
mov eax, dword [esi + 4]
push eax
push 0x44522c
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.0040321c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00405198
mov eax, dword [ebp - 8]
call fcn.004051a8
push eax
call ebx
push 0x7530
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, esi
call fcn.00403a94
mov dl, 1
mov eax, dword [0x414bb0]
call fcn.00403a64
mov ebx, eax
mov eax, 0x445254
call fcn.00408a64
test al, al
je 0x4451e4
mov edx, 0x445254
mov eax, ebx
call fcn.00417978
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov eax, dword [ebp - 4]
mov edx, dword [ebx + 4]
call fcn.004049bc
mov eax, ebx
call fcn.00403a94
mov eax, 0x445254
call fcn.00404d5c
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x4451eb
mov eax, ebx
call fcn.00403a94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445210
lea eax, [ebp - 0xc]
call fcn.004048cc
lea eax, [ebp - 8]
call fcn.00405024
ret
Function at 0x4452a4
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d4c
xor eax, eax
push ebp
push 0x44533e
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov word [ebp - 0x14], 2
push esi
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 4]
call fcn.00404d5c
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov esi, eax
mov dword [ebp - 0x10], esi
inc esi
jne 0x445316
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x44530c
or ebx, 0xffffffff
jmp 0x445328
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.wsock32.dll_connect
inc eax
jne 0x445328
or ebx, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445345
lea eax, [ebp - 4]
call fcn.004048cc
ret

Function at 0x4458ac
Capabilities:
Create thread

Disassembly:
mov dword [0x455524], eax
mov dl, 1
mov eax, dword [0x414bb0]
call fcn.00403a64
mov dword [0x455528], eax
mov eax, dword [0x455528]
call fcn.00417928
push 0x45552c
push 0
push 0
push 0x445634
push 0
push 0
call sub.kernel32.dll_CreateThread_1
ret

Function at 0x445988
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 1
mov dword [ebx], 0
mov dword [ebx + 4], 0
push esi
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x445a3c
xor eax, eax
push ebp
push 0x445a35
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xd
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x445a1e
xor eax, eax
push ebp
push 0x445a17
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [edi], eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalSize
sub eax, 2
xor edx, edx
mov dword [ebx], eax
mov dword [ebx + 4], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445a22
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445a40
call sub.user32.dll_CloseClipboard
ret
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x446f8c
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffbfc
mov ebx, eax
mov eax, ebx
call fcn.00405024
call sub.user32.dll_GetForegroundWindow
test eax, eax
je 0x446fc3
push 0x402
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetWindowTextW
mov eax, ebx
mov edx, esp
mov ecx, 0x201
call fcn.0040517c
add esp, 0x404
pop ebx
ret

Function at 0x447758
Capabilities:
Get file size
Hide graphical window
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x447868
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, dword [0x44e3cc]
mov edx, dword [edx]
call fcn.00405198
mov eax, dword [ebp - 0xc]
call fcn.004051a8
mov ebx, eax
call fcn.00446eec
mov byte [0x455659], 1
mov esi, 0x447878
cmp dword [0x44e198], 0
ja 0x4477b8
mov edx, 0x446fcc
mov eax, esi
call fcn.004476c0
mov dword [0x44e198], eax
push 0
mov eax, dword [0x44e198]
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
push 4
push 0
push 1
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileW
mov dword [0x455548], eax
cmp dword [0x455548], 0xffffffff
je 0x447852
push 6
push ebx
call sub.kernel32.dll_SetFileAttributesW
push 0
mov eax, dword [0x455548]
push eax
call sub.kernel32.dll_GetFileSize
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jne 0x44781a
cmp dword [ebp - 8], 0
jne 0x44781a
mov byte [0x455658], 1
jmp 0x447821
mov byte [0x455658], 0
push 2
push 0
push 0
mov eax, dword [0x455548]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
push 0
mov eax, dword [0x455538]
push eax
mov eax, dword [0x44e198]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [0x44e198]
push eax
call sub.user32.dll_SetClipboardViewer
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44786f
lea eax, [ebp - 0xc]
call fcn.00405024
ret

Function at 0x448558
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x4485c6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
xor eax, eax
call fcn.0040321c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00408b10
mov edx, dword [ebp - 4]
mov eax, 0x45565c
mov ecx, 0x4485dc
call fcn.00404be4
push 0x455668
push 0
push 0
push 0x448550
push 0
push 0
call sub.kernel32.dll_CreateThread_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4485cd
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048f0
ret
Function at 0x448b50
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x448bca
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404f90
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d5c
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x448ba8
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404dc4
jmp 0x448bb4
mov eax, ebx
mov edx, 0x448be0
call fcn.00404920
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448bd1
lea eax, [ebp - 4]
call fcn.004048cc
ret

Function at 0x448be8
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, eax
mov eax, ebx
mov edx, 0x448d2c
call fcn.00404920
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x448d1b
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
dec ecx
je 0x448cc1
dec ecx
jne 0x448d1b
cmp eax, 4
jg 0x448c42
mov eax, ebx
mov edx, 0x448d3c
call fcn.00404920
jmp 0x448d1b
cmp eax, 5
jne 0x448c5c
test edx, edx
jne 0x448c5c
mov eax, ebx
mov edx, 0x448d50
call fcn.00404920
jmp 0x448d1b
cmp eax, 5
jne 0x448c77
cmp edx, 1
jne 0x448c77
mov eax, ebx
mov edx, 0x448d68
call fcn.00404920
jmp 0x448d1b
cmp eax, 6
jne 0x448c91
test edx, edx
jne 0x448c91
mov eax, ebx
mov edx, 0x448d7c
call fcn.00404920
jmp 0x448d1b
cmp eax, 6
jne 0x448ca9
cmp edx, 1
jne 0x448ca9
mov eax, ebx
mov edx, 0x448d94
call fcn.00404920
jmp 0x448d1b
cmp eax, 6
jne 0x448d1b
cmp edx, 2
jne 0x448d1b
mov eax, ebx
mov edx, 0x448da8
call fcn.00404920
jmp 0x448d1b
cmp eax, 4
jne 0x448cd8
test edx, edx
jne 0x448cd8
mov eax, ebx
mov edx, 0x448dbc
call fcn.00404920
jmp 0x448d1b
cmp eax, 4
jne 0x448d05
cmp edx, 0xa
jne 0x448d05
cmp byte [esp + 0x15], 0x41
jne 0x448cf7
mov eax, ebx
mov edx, 0x448dd0
call fcn.00404920
jmp 0x448d1b
mov eax, ebx
mov edx, 0x448de8
call fcn.00404920
jmp 0x448d1b
cmp eax, 4
jne 0x448d1b
cmp edx, 0x5a
jne 0x448d1b
mov eax, ebx
mov edx, 0x448dfc
call fcn.00404920
add esp, 0x94
pop ebx
ret

Function at 0x448e08
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x448e39
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00404b3c
jmp 0x448e40
mov eax, ebx
call fcn.004048cc
add esp, 0x104
pop ebx
ret

Function at 0x448e48
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x105
lea eax, [esp + 4]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404b3c
add esp, 0x108
pop ebx
ret