joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a9e4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x43ab98
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.0043a918
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x43ab76
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [0x605eb8], 0
jne 0x43ab4a
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x14]
call fcn.0043629c
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040dc20
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x43abb8
call fcn.00405efc
mov eax, dword [ebp - 0x2c]
call fcn.004061fc
push eax
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov edi, eax
test edi, edi
sete bl
test bl, bl
je 0x43aabe
lea eax, [ebp - 0x38]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0040dc20
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x43abb8
call fcn.00405efc
mov eax, dword [ebp - 0x34]
call fcn.004061fc
push eax
push 4
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
test edi, edi
jne 0x43aad9
xor esi, esi
push 0
push 0x43abd0
push 0x43abdc
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x43ab39
test bl, bl
je 0x43ab20
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push 4
push 0x1000
push 0x28
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov dword [esi], ebx
mov eax, ebx
mov edx, 0x28
call fcn.0040ad00
mov eax, dword [esi]
mov dword [eax + 4], edi
add eax, 8
push eax
call sub.kernel32.dll_InitializeCriticalSection
jmp 0x43ab39
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push edi
call sub.kernel32.dll_CloseHandle_1
test esi, esi
je 0x43ab4a
mov eax, esi
call fcn.00469090
mov dword [0x605eb8], esi
cmp dword [0x605eb8], 0
je 0x43ab60
mov eax, dword [0x605eb8]
mov eax, dword [eax]
inc dword [eax]
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ab7d
mov eax, dword [ebp - 8]
call fcn.0043a9d0
ret

Function at 0x43ebec
Capabilities:
Create thread
Resume thread

Disassembly:
cmp dword [0x605ee4], 0
jne 0x43ec7f
xor eax, eax
call fcn.00419f2c
mov dword [0x605ee4], eax
cmp dword [0x605ee4], 0
je 0x43ec7f
mov eax, 0x43ea50
xor ecx, ecx
xor edx, edx
call fcn.0041a430
mov dword [0x605ee8], eax
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x605ef8], eax
push 0x605edc
push 4
push 0
push 0x43ea98
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x605ee0], eax
cmp dword [0x605ee0], 0
je 0x43ec7f
mov edx, 0x43ec8c
mov eax, dword [0x605edc]
call fcn.00436ef8
push 2
mov eax, dword [0x605ee0]
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, dword [0x605ee0]
push eax
call sub.kernel32.dll_ResumeThread
ret
Function at 0x43ecc8
Capabilities:
Terminate thread

Disassembly:
push ebx
cmp dword [0x605ee4], 0
je 0x43ed99
mov ebx, dword [0x605ef8]
xor eax, eax
mov dword [0x605ef8], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
cmp dword [0x605ef4], 0
je 0x43ed11
mov ebx, dword [0x605ef4]
xor eax, eax
mov dword [0x605ef4], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
mov dword [0x605ef0], 0xffffffff
mov eax, 0x43ea50
xor ecx, ecx
xor edx, edx
call fcn.0041a65c
push 0x1f4
mov eax, dword [0x605ee0]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x43ed5e
push 0
mov eax, dword [0x605ee0]
push eax
call sub.kernel32.dll_TerminateThread
cmp dword [0x605efc], 0
je 0x43ed5e
mov eax, dword [0x605efc]
push eax
call sub.kernel32.dll_LocalFree
xor eax, eax
mov dword [0x605efc], eax
mov eax, dword [0x605ee0]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [0x605edc]
call fcn.00436c6c
xor eax, eax
mov dword [0x605ee0], eax
xor eax, eax
mov dword [0x605edc], eax
xor eax, eax
mov dword [0x605ee4], eax
pop ebx
ret
Function at 0x446d00
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.004061fc
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x446d2c
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x446d2c
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x448928
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
or dword [ebp + 0xc], 0xc11c
cmp byte [0x605580], 0
je 0x44894e
or dword [ebp + 0xc], 0x80000
push 1
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 1
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
push eax
push 1
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0x11
lea eax, [ebp - 0x3c]
push eax
push 1
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004488c0
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x18]
mov esi, eax
mov eax, esi
call fcn.004345c4
test al, al
jne 0x4489ce
cmp esi, 0x80090318
jne 0x4489d6
test edi, edi
je 0x4489d6
mov byte [ebx + 0x5c], 1
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x448a06
cmp dword [ebp - 0x24], 0
je 0x448a06
push 0
mov eax, dword [ebp - 0x24]
push eax
push edi
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x4489fc
mov esi, 0x80090304
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x448a1a
cmp dword [ebp - 0x18], 0
je 0x448a1a
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x448a28
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeac
mov edi, edx
mov ebx, eax
mov byte [esp], 0
xor esi, esi
xor eax, eax
mov dword [esp + 8], eax
test edi, edi
je 0x448aad
mov dword [esp + 0x38], 1
mov eax, dword [ebx + 0x50]
mov dword [esp + 0x3c], eax
mov eax, dword [0x6055a0]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
lea eax, [esp + 0x44]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
jle 0x448be7
push 0
mov eax, dword [ebx + 0x74]
sub eax, esi
push eax
mov eax, dword [ebx + 0x78]
add eax, esi
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_recv
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x448be7
mov eax, dword [esp + 4]
add esi, eax
test esi, esi
sete al
neg al
sbb edi, edi
push 1
mov eax, dword [ebx + 0x78]
mov dword [esp + 0x140], eax
xor eax, eax
mov dword [esp + 0x144], eax
lea eax, [esp + 0x140]
push eax
push 1
mov dword [esp + 0x150], esi
xor eax, eax
mov dword [esp + 0x154], eax
lea eax, [esp + 0x150]
push eax
push 1
mov dword [esp + 0x160], 2
xor eax, eax
mov dword [esp + 0x164], eax
lea eax, [esp + 0x160]
push eax
push 1
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.004488c0
push 0
mov eax, dword [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
lea edx, [ebx + 0x54]
xor ecx, ecx
mov eax, ebx
call fcn.00448928
mov ebp, eax
sub ebp, 0x80090318
je 0x448bdf
sub ebp, 0x7ff6fce8
je 0x448b5c
sub ebp, 0x90312
je 0x448ba4
sub ebp, 0xe
je 0x448bd0
jmp 0x448be7
cmp dword [esp + 0x30], 5
jne 0x448b9e
mov eax, dword [esp + 0x2c]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebx + 0x84], eax
mov edx, dword [ebx + 0x84]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.004032cc
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], 2
mov byte [esp], 1
jmp 0x448be7
cmp dword [esp + 0x30], 5
jne 0x448bc9
mov edx, dword [ebx + 0x78]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.004032cc
mov esi, dword [esp + 0x2c]
jmp 0x448a42
xor esi, esi
jmp 0x448a42
or dword [esp + 8], 0x80
xor edi, edi
jmp 0x448a42
or edi, 0xffffffff
jmp 0x448a42
movzx eax, byte [esp]
add esp, 0x154
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x448bf8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004061ec
xor eax, eax
push ebp
push 0x448d75
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
call fcn.004061fc
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405c68
call fcn.00405e00
mov edi, eax
mov dword [ebp - 0x10], 0x400
cmp dword [ebx + 8], 0
je 0x448d51
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx + 0x68]
jbe 0x448d51
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0x10], eax
jmp 0x448d51
cmp edi, dword [ebp - 0x10]
jbe 0x448c6e
mov esi, dword [ebp - 0x10]
jmp 0x448c70
mov esi, edi
cmp dword [ebx + 8], 0
je 0x448d36
mov edx, dword [ebx + 0x78]
add edx, dword [ebx + 0x60]
mov eax, dword [ebp - 0xc]
mov ecx, esi
call fcn.004032cc
push 3
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebx + 0x78]
add eax, dword [ebx + 0x60]
mov dword [ebp - 0x58], eax
mov eax, dword [ebx + 0x78]
add eax, dword [ebx + 0x60]
add eax, esi
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x5c]
push eax
push 3
mov eax, dword [ebx + 0x60]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], esi
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x6c]
push eax
push 3
mov dword [ebp - 0x7c], 7
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x74], 6
xor eax, eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x7c]
push eax
push 3
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.004488c0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebx + 0x54]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x64]
test eax, eax
jne 0x448d2b
push 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x78]
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x448d2f
xor eax, eax
jmp 0x448d31
mov al, 1
mov byte [ebp - 5], al
jmp 0x448d4c
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
setg byte [ebp - 5]
add dword [ebp - 0xc], esi
sub edi, esi
cmp byte [ebp - 5], 0
je 0x448d5f
test edi, edi
ja 0x448c64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448d7c
lea eax, [ebp - 4]
call fcn.00405a3c
ret
Function at 0x449ae8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x449d4f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
movzx eax, byte [edi + 0x8f]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x449d0b
cmp byte [0x605588], 0
jne 0x449b73
mov eax, ebx
call fcn.00436970
test al, al
je 0x449bb0
push 0x449d70
lea edx, [ebp - 0x220]
mov eax, ebx
call fcn.0040f1e0
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.0041c2a8
push dword [ebp - 0x21c]
push 0x449d88
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405fec
jmp 0x449bbf
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0
call fcn.00406c4c
push 0x449d98
lea eax, [ebp - 0x228]
mov edx, dword [0x605f6c]
mov ecx, 0
call fcn.00405d20
push dword [ebp - 0x228]
push 0x449da8
push 0x449db8
lea edx, [ebp - 0x230]
mov eax, ebx
call fcn.00447748
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x22c]
mov ecx, 0
call fcn.00406c4c
push dword [ebp - 0x22c]
push 0x449dd4
push dword [ebp - 4]
push 0x449dec
push 0x449da8
push 0x449dfc
push 0x449da8
push 0x449e2c
push dword [ebp - 4]
push 0x449dec
push 0x449da8
push 0x449da8
lea eax, [ebp - 0x224]
mov edx, 0x10
call fcn.00405fec
mov edx, dword [ebp - 0x224]
mov eax, edi
call fcn.00448bf8
mov esi, dword [ebp - 0xc]
test esi, esi
jbe 0x449d0b
cmp esi, 0xff
jbe 0x449c7d
mov ebx, 0xff
jmp 0x449c7f
mov ebx, esi
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x215]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x449c9f
cmp ebx, dword [ebp - 0x14]
je 0x449cb1
mov edx, 0x449da8
mov eax, edi
call fcn.00448bf8
mov byte [ebp - 0xd], 0
jmp 0x449d0b
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x215]
mov edx, ebx
call fcn.0041c170
lea eax, [ebp - 0x234]
mov edx, 0x449da8
call fcn.00405e34
mov edx, dword [ebp - 0x234]
mov eax, edi
call fcn.00448bf8
sub esi, ebx
cmp dword [ebp + 8], 0
je 0x449d03
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x18]
test esi, esi
ja 0x449c6e
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449d56
lea eax, [ebp - 0x234]
call fcn.00405a3c
lea eax, [ebp - 0x230]
call fcn.004069f8
lea eax, [ebp - 0x22c]
mov edx, 5
call fcn.00405a60
lea eax, [ebp - 4]
call fcn.00405a3c
ret
Function at 0x44bf14
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x44c03b
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov esi, dword [ebp - 0xc]
cmp byte [ebp + 8], 0
je 0x44bf5e
mov dword [ebp - 0x10], 0x600
jmp 0x44bf65
mov dword [ebp - 0x10], 0x800
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.0040639c
test esi, esi
jbe 0x44c01d
cmp esi, dword [ebp - 0x10]
jae 0x44bf8b
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, esi
call fcn.0040639c
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405c68
call fcn.00405e00
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x44bfc6
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405c68
call fcn.00405e00
cmp eax, dword [ebp - 0x14]
je 0x44bfca
xor ebx, ebx
jmp 0x44c01d
cmp byte [ebp + 8], 0
je 0x44bfe9
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0041c2a8
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.0044b258
mov ebx, eax
jmp 0x44bff5
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0044b258
mov ebx, eax
test bl, bl
je 0x44c01d
sub esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, edi
call fcn.0044b7ec
test esi, esi
ja 0x44bf7a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c042
lea eax, [ebp - 0x18]
call fcn.00405a3c
lea eax, [ebp - 4]
call fcn.00405a3c
ret
Function at 0x451838
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004069f0
xor eax, eax
push ebp
push 0x45198c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040f4f0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00406a5c
cmp dword [ebp - 4], 0
je 0x451962
lea eax, [ebp - 4]
call fcn.00405c38
call fcn.00406d78
mov ebx, eax
lea eax, [ebp - 4]
call fcn.00405c38
cmp word [eax + ebx*2 - 2], 0x5c
jne 0x4518b6
lea eax, [ebp - 4]
call fcn.00405c38
call fcn.00406d78
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.00407284
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x451902
mov eax, dword [ebp - 4]
call fcn.00406a94
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x4518fe
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00451838
pop ecx
test al, al
je 0x4518fa
push 0
mov eax, dword [ebp - 4]
call fcn.00406a94
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4518fe
xor ebx, ebx
jmp 0x451964
mov bl, 1
jmp 0x451964
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406c4c
mov eax, dword [ebp - 0xc]
call fcn.004061fc
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x45195e
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00451838
pop ecx
test al, al
je 0x45195a
push 0
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406c4c
mov eax, dword [ebp - 0x10]
call fcn.004061fc
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x45195e
xor ebx, ebx
jmp 0x451964
mov bl, 1
jmp 0x451964
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451993
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00405a60
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406a00
ret
Function at 0x454404
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Get common file path
Read file via mapping
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x290], ecx
mov dword [ebp - 0x294], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov byte [ebp - 9], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x45461e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x70]
mov edx, 0x44
call fcn.0040ad00
mov dword [ebp - 0x70], 0x44
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4544b7
test ebx, ebx
jne 0x45446b
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.00406bb4
jmp 0x454475
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406a5c
lea eax, [ebp - 0x28a]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28a]
push eax
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00406a94
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x454520
test ebx, ebx
jne 0x4544d1
call sub.kernel32.dll_GetCommandLineA
mov edx, eax
lea eax, [ebp - 8]
mov ecx, 0
call fcn.00405d20
jmp 0x4544e0
lea eax, [ebp - 8]
mov edx, ebx
mov ecx, 0
call fcn.00406c4c
lea eax, [ebp - 0x28a]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28a]
push eax
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004061fc
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4545d1
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x18]
call fcn.0043629c
lea eax, [ebp - 0x294]
push eax
mov cl, 0x30
mov edx, 1
mov eax, dword [ebp - 0x78]
call fcn.0040dc20
mov ecx, dword [ebp - 0x294]
lea eax, [ebp - 0x290]
mov edx, 0x454638
call fcn.00405efc
mov eax, dword [ebp - 0x290]
call fcn.004061fc
push eax
push 0x58
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
push 0
push 0
push 0
push 0xf001f
push esi
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
test ebx, ebx
je 0x4545c8
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebx], eax
push 2
push 0
push 0
lea eax, [ebx + 4]
push eax
mov eax, dword [ebp - 0x80]
push eax
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
lea edx, [ebx + 8]
mov eax, 0x6056d8
mov ecx, 0x50
call fcn.004032cc
mov eax, dword [ebp - 0x7c]
push eax
call sub.kernel32.dll_ResumeThread
cmp byte [ebp - 9], 0
je 0x4545e6
push 2
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x4545f0
mov eax, 2
call fcn.00405950
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454625
lea eax, [ebp - 0x294]
mov edx, 2
call fcn.00405a60
lea eax, [ebp - 8]
call fcn.00405a3c
lea eax, [ebp - 4]
call fcn.004069f8
ret
Function at 0x45d3d4
Capabilities:
Create pipe
Create thread

Disassembly:
push 0
push 0
push 0x605fd0
push 0x605fcc
call sub.kernel32.dll_CreatePipe
test eax, eax
je 0x45d42c
push 0x605fc4
push 0
push 0
push 0x45d358
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x605fc8], eax
cmp dword [0x605fc8], 0
je 0x45d42c
mov edx, 0x45d43c
mov eax, dword [0x605fc4]
call fcn.00436ef8
push 2
mov eax, dword [0x605fc8]
push eax
call sub.kernel32.dll_SetThreadPriority
ret

Function at 0x45d480
Capabilities:
Resume thread
Terminate thread
Write file on windows

Disassembly:
add esp, 0xffffff6c
cmp dword [0x605fc4], 0xffffffff
je 0x45d568
mov eax, dword [0x605fc8]
push eax
call sub.kernel32.dll_ResumeThread
xor eax, eax
call fcn.0043741c
test al, al
jne 0x45d4f0
lea eax, [esp + 4]
mov edx, 0x90
call fcn.0040ad00
push 0
lea eax, [esp + 4]
push eax
push 0x90
lea eax, [esp + 0x10]
push eax
mov eax, dword [0x605fd0]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [0x605fd0]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0x1f4
mov eax, dword [0x605fc8]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x45d4fb
mov eax, dword [0x605fd0]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x605fcc]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0x32
mov eax, dword [0x605fc8]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x45d538
push 0
mov eax, dword [0x605fc8]
push eax
call sub.kernel32.dll_TerminateThread
cmp dword [0x605fd4], 0
je 0x45d538
mov eax, dword [0x605fd4]
push eax
call sub.kernel32.dll_LocalFree
xor eax, eax
mov dword [0x605fd4], eax
mov eax, dword [0x605fc8]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [0x605fc4]
call fcn.00436c6c
mov dword [0x605fc4], 0xffffffff
add esp, 0x94
ret