joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b780
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c4
push ebx
mov dword [ebp - 0x18], ecx
xor ebx, ebx
lea ecx, [ebp - 0x9c4]
mov dword [ebp - 0x1c], ebx
call fcn.0040a89d
lea eax, [ebp - 0x1c]
push ebx
push eax
push ebx
push 0x59
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
je 0x44b93f
cmp dword [ebp - 0x1c], ebx
je 0x44b93f
push edi
push 0x31
pop ecx
xor eax, eax
lea edi, [ebp - 0xf6]
mov word [ebp - 0xf8], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xf8]
push 0x63
push eax
push 0x59
movzx eax, word [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea eax, [ebp - 0xf8]
lea ecx, [ebp - 8]
push eax
call fcn.004064a9
mov eax, dword [ebp - 8]
pop edi
mov eax, dword [eax - 8]
cmp eax, ebx
je 0x44b853
cmp eax, 2
jle 0x44b827
lea eax, [ebp - 0xc]
push 2
push eax
lea ecx, [ebp - 8]
call fcn.0040694d
push eax
lea ecx, [ebp - 8]
call fcn.004065e8
lea ecx, [ebp - 0xc]
call fcn.00401085
lea eax, [ebp - 0x11]
lea ecx, [ebp - 0x30]
push eax
call fcn.004061ff
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.0046f184
pop ecx
pop ecx
lea ecx, [ebp - 0x30]
call fcn.0040624a
test eax, eax
jne 0x44b85b
lea ecx, [ebp - 0x30]
call fcn.00406217
lea ecx, [ebp - 8]
jmp 0x44b956
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.00411413
mov esi, dword [ebp - 0x2c]
pop ecx
cmp esi, dword [ebp - 0x28]
je 0x44b918
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jl 0x44b888
mov dword [ebp - 4], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x44b89a
mov ecx, dword [0x4a9450]
push eax
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
call fcn.00406638
mov eax, dword [ebp - 4]
cmp dword [eax - 8], ebx
je 0x44b8e1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040665f
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.0043b9eb
push dword [ebp - 8]
push dword [ebp - 0x10]
call fcn.00491db7
add esp, 0x10
test eax, eax
je 0x44b8f1
lea ecx, [ebp - 0x10]
call fcn.00401085
lea ecx, [ebp - 0xc]
call fcn.00401085
lea ecx, [ebp - 4]
call fcn.00401085
add esi, 4
jmp 0x44b869
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [eax + 0x24]
call fcn.004065e8
lea ecx, [ebp - 0x10]
call fcn.00401085
lea ecx, [ebp - 0xc]
call fcn.00401085
lea ecx, [ebp - 4]
call fcn.00401085
lea ecx, [ebp - 0x20]
call fcn.00401085
lea ecx, [ebp - 0x30]
call fcn.00406217
lea ecx, [ebp - 8]
call fcn.00401085
push dword [ebp - 0xfc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
jmp 0x44b967
lea ecx, [ebp - 0x9c4]
call fcn.0040a8db
push eax
lea ecx, [ebp - 0x18]
call fcn.004064a9
lea ecx, [ebp - 0x18]
call fcn.00401085
push dword [ebp - 0xfc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
leave
ret
Function at 0x44bb53
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 1
push esi
push str.SoftwareGG_SoftwareTwinkiePaste
push 0x80000001
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44bbe6
push edi
push 0x31
pop ecx
lea edi, [ebp - 0xd2]
mov word [ebp - 0xd4], si
mov dword [ebp - 0xc], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x63
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str.FromInstaller
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
pop edi
jne 0x44bbdd
cmp dword [ebp - 8], esi
jbe 0x44bbdd
lea eax, [ebp - 0xd4]
push eax
call fcn.00491136
pop ecx
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
neg esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x44bdd8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
and dword [ebp - 0x64], 0
push esi
push edi
mov esi, ecx
push 0x16
xor eax, eax
pop ecx
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
call fcn.0044c460
lea eax, [ebp - 8]
push eax
call fcn.0044c884
pop ecx
mov eax, dword [eax]
pop ecx
push dword [ebp - 4]
lea ecx, [ebp - 0x64]
push 0x5c
push ecx
push str.FontForMenu
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
lea ecx, [ebp - 8]
mov edi, eax
call fcn.00401085
test edi, edi
jne 0x44be2d
xor esi, esi
jmp 0x44be45
lea eax, [ebp - 0x64]
push 0x5c
add esi, 0xa4
push eax
push esi
call fcn.00490dc0
add esp, 0xc
push 1
pop esi
lea ecx, [ebp - 4]
call fcn.00401085
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x44c9d3
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x44c9ff
mov ecx, dword [ebp + 8]
push 0x4bf5f0
call fcn.004064a9
jmp 0x44ca93
push edi
mov ecx, 0x8a
xor eax, eax
lea edi, [ebp - 0x22c]
rep stosd dword es:[edi], eax
mov eax, dword [0x4a9450]
mov dword [ebp - 0x230], 0x22c
mov dword [ebp - 4], eax
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
pop edi
test eax, eax
je 0x44ca74
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x228]
je 0x44ca4d
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
jmp 0x44ca2f
lea eax, [ebp - 0x20c]
test eax, eax
je 0x44ca64
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x20c]
push ecx
push eax
lea ecx, [ebp - 4]
call fcn.00406586
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.00406383
lea ecx, [ebp - 4]
call fcn.00401085
test esi, esi
je 0x44ca93
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
pop esi
leave
ret
Function at 0x44cb7a
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push dword [esi + 8]
push dword [esi + 4]
call fcn.00409b05
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44cbac
xor eax, eax
jmp 0x44ccf1
push edi
mov ecx, 0x8a
xor eax, eax
lea edi, [ebp - 0x240]
rep stosd dword es:[edi], eax
lea eax, [ebp + 0xb]
xor edi, edi
push eax
lea eax, [ebp - 1]
push edi
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x244], 0x22c
call fcn.004203c3
lea eax, [ebp - 0x244]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x44cc32
lea eax, [ebp - 0x23c]
lea ecx, [ebp - 0x18]
push eax
call fcn.004200b2
mov dword [ebp + 8], eax
lea eax, [ebp - 0x220]
test eax, eax
je 0x44cc13
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [ebp + 8]
push eax
call fcn.00406586
lea eax, [ebp - 0x244]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
jmp 0x44cbe6
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], edi
je 0x44cc92
lea eax, [ebp + 8]
lea ecx, [ebp - 0x18]
push eax
call fcn.0044ced6
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp eax, dword [ebp - 0x14]
je 0x44cc92
push dword [eax + 0xc]
push dword [eax + 0x10]
lea eax, [ebp + 8]
push eax
call fcn.0044ccf5
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax - 8], edi
je 0x44cc7d
lea eax, [ebp + 8]
mov ecx, esi
push eax
push dword [esi + 8]
call fcn.004144fe
lea ecx, [ebp + 8]
call fcn.00401085
lea ecx, [ebp - 8]
call fcn.00421ea3
mov eax, dword [ebp - 8]
jmp 0x44cc50
cmp dword [ebp + 0xc], edi
je 0x44cce5
push edi
push 0x46f40c
push dword [esi + 8]
push dword [esi + 4]
call fcn.0044cf2c
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0x44ce5c
push eax
push ecx
call fcn.0044cee4
add esp, 0x1c
cmp eax, dword [esi + 8]
je 0x44cce5
mov ecx, dword [0x4a9450]
sub eax, dword [esi + 4]
mov dword [ebp + 8], ecx
lea ecx, [ebp + 8]
sar eax, 2
push ecx
push eax
mov ecx, esi
call fcn.0044ce77
lea ecx, [ebp + 8]
call fcn.00401085
lea ecx, [ebp - 0x18]
call fcn.00420115
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44ccf5
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
push dword [ebp + 0x10]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44cd22
mov ecx, dword [ebp + 8]
push 0x4bf5f0
call fcn.004064a9
jmp 0x44ce56
push dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
call fcn.004064a9
mov eax, dword [ebp + 0x10]
cmp dword [eax - 8], 0
jne 0x44cd4f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
push 0x4bf5f0
call fcn.004064a9
jmp 0x44ce4e
push esi
push edi
lea ecx, [ebp + 0x10]
call fcn.00406433
push dword [ebp + 0x10]
mov esi, dword [sym.imp.USER32.dll_CharUpperW]
call esi
mov ecx, 0x109
xor eax, eax
lea edi, [ebp - 0x428]
rep stosd dword es:[edi], eax
mov eax, dword [0x4a9450]
mov dword [ebp - 0x42c], 0x428
mov dword [ebp - 4], eax
lea eax, [ebp - 0x42c]
push eax
push ebx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x44ce0f
lea eax, [ebp - 0x20c]
lea ecx, [ebp + 0xc]
push eax
call fcn.004064a9
lea ecx, [ebp + 0xc]
call fcn.00406433
push dword [ebp + 0xc]
call esi
push 0
lea ecx, [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.004069b6
test eax, eax
jg 0x44cde0
lea eax, [ebp - 0x42c]
push eax
push ebx
call sub.KERNEL32.dll_Module32NextW
lea ecx, [ebp + 0xc]
mov edi, eax
call fcn.00401085
test edi, edi
jne 0x44cd96
jmp 0x44ce0f
lea eax, [ebp - 0x20c]
test eax, eax
je 0x44cdf7
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x20c]
push ecx
push eax
lea ecx, [ebp - 4]
call fcn.00406586
lea ecx, [ebp + 0xc]
call fcn.00401085
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x4a9890
lea ecx, [ebp - 4]
call fcn.004069b6
pop edi
pop esi
test eax, eax
jge 0x44ce3a
mov ecx, dword [ebp + 8]
push 0x4bf5f0
call fcn.004064a9
jmp 0x44ce46
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.00406383
lea ecx, [ebp - 4]
call fcn.00401085
lea ecx, [ebp + 0x10]
call fcn.00401085
mov eax, dword [ebp + 8]
pop ebx
leave
ret

Function at 0x44e554
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ax, word [ebp + 8]
xor ebx, ebx
mov word [ebp - 2], ax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], ebx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x44e5d5
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push 0x10
push eax
push 3
push ebx
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
mov dword [ebp + 8], eax
je 0x44e5bf
push edi
call esi
xor edi, edi
cmp dword [ebp + 8], ebx
sete byte [ebp + 0xb]
cmp edi, ebx
je 0x44e5cd
push edi
call esi
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebx
leave
ret
xor al, al
jmp 0x44e5d2
Function at 0x44e614
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push 1
push dword [ebp + 8]
xor esi, esi
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
push 0x80000001
call fcn.0040754d
test eax, eax
je 0x44e646
cmp dword [ebp - 4], esi
je 0x44e694
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44e694
lea eax, [ebp + 8]
push ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp - 8], 3
mov dword [ebp + 8], 0x10
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 4], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
je 0x44e684
push dword [ebp - 4]
call esi
and dword [ebp - 4], 0
test ebx, ebx
pop ebx
je 0x44e698
cmp dword [ebp - 4], 0
je 0x44e694
push dword [ebp - 4]
call esi
xor al, al
jmp 0x44e6b6
lea eax, [ebp - 0x18]
push 0x10
push eax
push dword [ebp + 0x10]
call fcn.00490dc0
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x44e6b4
push dword [ebp - 4]
call esi
mov al, 1
pop esi
leave
ret

Function at 0x44f7c7
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a1d68
push 0x4921d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x27], bl
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x23], 5
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x44f83b
push dword [ebp + 8]
push dword [ebp - 0x1c]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov dword [ebp - 0x20], eax
or dword [ebp - 4], 0xffffffff
call fcn.0044f858
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44f9c9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, dword [ebp - 0x1c]
cmp esi, 0x20
jg 0x44fa41
cmp dword [ebp + 0x24], 0
je 0x44fa41
lea eax, [ebp + 8]
push esi
push eax
call fcn.0044f957
pop ecx
pop ecx
mov ecx, dword [ebp + 0x24]
push eax
call fcn.004065e8
lea ecx, [ebp + 8]
call fcn.00401085
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x44fbd4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea ecx, [ebp - 4]
push dword [ebp + 0xc]
call fcn.004064a9
push eax
lea eax, [ebp + 0xc]
push str.shell32.dll_OpenAs_RunDLL
push eax
call fcn.0040673f
lea ecx, [ebp - 4]
call fcn.00401085
push 5
push 0
push dword [ebp + 0xc]
push str.Rundll32.exe
push str.open
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
lea ecx, [ebp + 0xc]
setg bl
call fcn.00401085
mov al, bl
pop ebx
leave
ret
Function at 0x451ee7
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
and dword [ebp - 0x2b4], 0
push edi
mov ecx, 0xac
xor eax, eax
lea edi, [ebp - 0x2b0]
rep stosd dword es:[edi], eax
mov al, byte [ebp + 0xc]
neg al
sbb eax, eax
and al, 0
add eax, 0x100
push eax
lea eax, [ebp - 0x2b4]
push 0x2b4
push eax
push 0
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2b4]
pop edi
leave
ret

Function at 0x451f46
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push ebx
push esi
push edi
push 0x4b473c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
and dword [ebp - 0x2b4], 0
mov ebx, eax
mov ecx, 0xac
xor eax, eax
cmp byte [ebp + 0xc], 0
lea edi, [ebp - 0x2b0]
rep stosd dword es:[edi], eax
mov eax, pe_nt_image_headers32
jne 0x451f81
inc eax
push eax
lea eax, [ebp - 0x2b4]
push 0x2b4
push eax
push 0x80
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esi, dword [ebp - 0x2b4]
test ebx, ebx
je 0x451fad
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x452031
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
mov edi, 0x4b473c
push edi
call esi
mov ebx, eax
test ebx, ebx
jne 0x452054
push edi
call esi
and dword [ebp - 0x2b4], 0
mov ecx, 0xac
xor eax, eax
cmp byte [ebp + 8], 0
lea edi, [ebp - 0x2b0]
rep stosd dword es:[edi], eax
mov eax, pe_nt_image_headers32
je 0x452078
add eax, 2
cmp byte [ebp + 0xc], 0
jne 0x452080
or al, 1
push eax
lea eax, [ebp - 0x2b4]
push 0x2b4
push eax
push 0x10
push dword [ebp + 0x10]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esi, dword [ebp - 0x2b4]
test ebx, ebx
je 0x4520a9
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x45218c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push edi
xor edx, edx
mov ecx, 0xac
xor eax, eax
cmp byte [ebp + 0xc], dl
lea edi, [ebp - 0x2b0]
mov dword [ebp - 0x2b4], edx
rep stosd dword es:[edi], eax
mov eax, 0x100
pop edi
jne 0x4521b9
inc eax
push eax
lea eax, [ebp - 0x2b4]
push 0x2b4
push eax
push edx
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2b4]
leave
ret
Function at 0x452485
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 0xc]
mov ebx, 0x84
mov eax, dword [esi + 0x10]
mov edi, dword [sym.imp.USER32.dll_CallWindowProcW]
push dword [ebp + 8]
push ebx
push dword [eax]
push dword [esi + 0xc]
call edi
cmp eax, 1
mov dword [ebp - 0xc], eax
jne 0x452593
push 0x40000
mov ecx, esi
call fcn.00452627
test eax, eax
jne 0x45258a
mov eax, dword [ebp + 0xc]
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [esi + 0x10]
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowRect]
movsx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
push ecx
call fcn.004931e0
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
movsx eax, word [ebp + 0xc]
sub ecx, eax
push ecx
call fcn.004931e0
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
cmp ecx, eax
mov dword [ebp - 4], ecx
jl 0x452517
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x10]
push eax
call fcn.004931e0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x10]
push eax
call fcn.004931e0
cmp dword [ebp - 8], eax
pop ecx
pop ecx
jge 0x45253c
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], eax
jge 0x452544
mov eax, dword [ebp - 4]
cmp eax, 1
jg 0x452593
mov ecx, esi
call fcn.00452446
push dword [ebp + 0xc]
mov eax, dword [esi + 0x10]
push dword [ebp + 8]
push ebx
push dword [eax]
push dword [esi + 0xc]
call edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x10]
xor edi, edi
push edi
push dword [eax]
push 0x45259d
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
je 0x452593
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x452593
push 0
mov ecx, esi
call fcn.0045268a
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x456c8e
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
push 0
push ecx
push 0x456cbe
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x456cb4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test esi, esi
setne al
pop esi
pop ecx
ret
Function at 0x457d1b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xc
mov word [ebp - 0x18], 0x20
mov word [ebp - 0x16], 9
mov word [ebp - 0x14], 0xa
mov word [ebp - 0x12], 0xd
mov word [ebp - 0x10], 0x3f
mov word [ebp - 0xe], 0x2c
mov word [ebp - 0xc], 0x2e
mov word [ebp - 0xa], 0x5c
mov word [ebp - 8], 0x2f
mov word [ebp - 6], 0x21
mov word [ebp - 4], 0x28
mov word [ebp - 2], 0x29
or edi, 0xffffffff
lea esi, [ebp - 0x18]
pop ebx
push dword [ebp + 0xc]
mov ax, word [esi]
mov ecx, dword [ebp + 8]
push eax
call fcn.00409ea3
test eax, eax
jle 0x457d93
cmp eax, dword [ebp + 0x10]
jge 0x457d93
cmp eax, edi
jle 0x457d93
mov edi, eax
inc esi
inc esi
dec ebx
jne 0x457d75
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x458cde
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x458d0d
mov edi, dword [ebp + 8]
mov al, byte [ebp + 0xb]
jmp 0x458d48
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
jne 0x458d2a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 8]
mov al, byte [ebp + 0xb]
jmp 0x458d48
lea eax, [edi + 1]
push eax
call fcn.00490944
cmp eax, ebx
pop ecx
mov dword [ebp - 4], eax
jne 0x458d6e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 8]
mov al, byte [ebp + 0xb]
push ebx
mov ecx, edi
mov byte [edi], al
call fcn.00409ac9
mov esi, 0x4bf60c
push esi
call fcn.004916e0
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00409b5b
mov eax, edi
jmp 0x458e14
lea ecx, [ebp + 0xc]
push ebx
push ecx
push edi
push eax
push esi
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], ebx
je 0x458d98
cmp edi, dword [ebp + 0xc]
jne 0x458d98
push 1
pop edi
jmp 0x458d9a
xor edi, edi
mov al, byte [ebp + 0xb]
push ebx
lea ecx, [ebp - 0x18]
mov byte [ebp - 0x18], al
call fcn.00409ac9
mov esi, 0x4bf60c
push esi
call fcn.004916e0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x18]
call fcn.00409b5b
cmp edi, ebx
je 0x458ddd
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp - 4]
push esi
mov byte [eax + esi], bl
call fcn.004916e0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x18]
call fcn.00409b5b
push dword [ebp - 4]
call fcn.0048e18e
mov esi, dword [ebp + 8]
mov al, byte [ebp - 0x18]
pop ecx
push ebx
mov ecx, esi
mov byte [esi], al
call fcn.00409ac9
push dword [0x4a17b8]
lea eax, [ebp - 0x18]
mov ecx, esi
push ebx
push eax
call fcn.004099fb
push 1
lea ecx, [ebp - 0x18]
call fcn.00409ac9
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret