joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b892
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
je 0x45ba96
and dword [ebp - 4], 0
mov ebx, dword [ebp + 0x10]
test bl, 4
je 0x45b8c3
mov dword [ebp - 4], edi
test bl, 8
jne 0x45b8c3
mov ecx, edi
call fcn.004266a4
mov eax, dword [ebp + 0xc]
dec eax
cmp eax, 0xfffff
ja 0x45ba96
mov eax, dword [esi + 0xc]
shr eax, 1
test al, 1
jne 0x45b8eb
test byte [esi + 0x10], 1
jne 0x45b8eb
push 0x2749
jmp 0x45ba9b
and dword [esi + 0x14], 0
and dword [ebp - 0xc], 0
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 0x10], eax
mov ecx, esi
mov al, bl
and al, 1
mov byte [ebp + 0xb], al
mov eax, ebx
shr eax, 1
and eax, 0xffffff01
mov dword [ebp - 0x20], eax
call fcn.0045bafd
mov dword [ebp - 0x14], eax
mov eax, ebx
shr eax, 3
and eax, 2
mov dword [ebp + 0x10], 0xa
mov ecx, eax
or ecx, 1
and bl, 0x20
mov ebx, dword [ebp - 0xc]
cmove ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, esi
call fcn.0045baab
mov dword [ebp - 0xc], eax
test eax, eax
jg 0x45b9b5
js 0x45ba8e
cmp byte [ebp + 0xb], 0
jne 0x45ba8e
push dword [ebp - 0x10]
call fcn.004590eb
pop ecx
cmp eax, dword [esi + 0x30]
jae 0x45ba82
mov eax, dword [esi + 0xc]
shr eax, 1
test al, 1
jne 0x45b97b
test byte [esi + 0x10], 1
je 0x45ba6e
mov ecx, esi
call fcn.0045acd2
test al, al
jne 0x45ba7b
push dword [ebp + 0x10]
call fcn.00458e0a
add dword [ebp + 0x10], 5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], 0x3c
push eax
call fcn.004018bc
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebp + 0x10], eax
jmp 0x45b938
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004234e3
mov ecx, eax
add esp, 0xc
mov eax, dword [ebp - 4]
mov dword [ebp + 0x10], ecx
test eax, eax
jne 0x45b9d9
mov eax, edi
jmp 0x45b9ec
push ecx
mov ecx, eax
call fcn.00428952
test eax, eax
je 0x45ba92
mov ecx, dword [ebp + 0x10]
push 0
push 0
push dword [ebp - 0x18]
push ecx
push eax
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x45ba0d
mov ecx, esi
call fcn.0045c3f1
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x45ba38
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00402d9d
pop ecx
pop ecx
mov ecx, dword [ebp + 0x10]
sub ecx, eax
push ecx
mov ecx, dword [ebp - 4]
call fcn.00426ad4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
test eax, eax
jle 0x45ba8e
add ebx, eax
cmp byte [ebp - 0x20], 0
jne 0x45ba4c
cmp eax, dword [ebp - 0xc]
jge 0x45ba8e
mov edx, dword [ebp + 0xc]
sub edx, eax
mov dword [ebp + 0xc], edx
test edx, edx
jle 0x45ba8e
mov dword [ebp + 0x10], 0xa
test ecx, ecx
jne 0x45b938
add edi, eax
jmp 0x45b938
cmp dword [esi + 0x14], 0
jne 0x45ba8e
push 0x2749
jmp 0x45ba87
push 0x2746
jmp 0x45ba87
push 0x274c
mov ecx, esi
call fcn.0045c403
mov eax, ebx
jmp 0x45baa4
push 8
jmp 0x45ba87
push 0x2726
mov ecx, esi
call fcn.0045c403
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x45baab
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
shr eax, 1
test al, 1
jne 0x45bad0
test byte [esi + 0x10], 1
jne 0x45bad0
push 0x2749
call fcn.0045c403
or eax, 0xffffffff
jmp 0x45bafa
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x4004667f
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x45baf7
mov ecx, esi
call fcn.0045c3f1
and dword [esi + 0x10], 0xfffffffe
jmp 0x45bacb
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x45c169
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
test ebx, ebx
je 0x45c2de
mov edi, dword [ebp + 0xc]
cmp edi, 0x7fffffff
jne 0x45c196
push ebx
call fcn.004314ba
mov edi, eax
pop ecx
mov dword [ebp + 0xc], edi
test edi, edi
jle 0x45c2de
mov ecx, dword [esi + 0xc]
shr ecx, 1
test cl, 1
jne 0x45c1bb
mov eax, dword [esi + 0x10]
shr eax, 1
test al, 1
jne 0x45c1bb
push 0x2749
jmp 0x45c2e3
mov ecx, esi
call fcn.0045c2f3
mov ecx, dword [esi + 0xc]
shr ecx, 1
mov dword [ebp - 8], eax
test cl, 1
je 0x45c1da
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.0045b098
mov byte [ebp - 1], 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.004018e2
pop ecx
pop ecx
mov ecx, dword [esi + 0xc]
shr ecx, 1
test cl, 1
je 0x45c20c
push 0x10
lea ecx, [ebp - 0x18]
push ecx
push 0
push eax
push ebx
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_sendto]
jmp 0x45c219
push 0
push eax
push ebx
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x45c284
mov ecx, esi
call fcn.0045c3f1
cmp dword [esi + 0x14], 0x2733
jne 0x45c242
mov ecx, esi
call fcn.0045b03d
test al, al
jne 0x45c297
push 0xa
call fcn.00458e0a
pop ecx
jmp 0x45c1de
cmp dword [esi + 0x14], 0x2747
jne 0x45c297
cmp byte [ebp - 1], 0
jne 0x45c297
mov eax, 0x1000
cmp dword [ebp - 8], eax
jle 0x45c297
push eax
mov ecx, esi
mov byte [ebp - 1], 1
mov dword [ebp - 8], eax
call fcn.0045c31b
push 0x2747
mov ecx, esi
mov bl, al
call fcn.0045c403
test bl, bl
je 0x45c297
mov ebx, dword [ebp + 8]
jmp 0x45c1de
sub edi, eax
mov dword [ebp + 0xc], edi
test edi, edi
jle 0x45c2da
add ebx, eax
mov dword [ebp + 8], ebx
jmp 0x45c1de
mov eax, dword [esi + 0x14]
cmp eax, 0x2746
jg 0x45c2bf
cmp eax, 0x2744
jge 0x45c2d1
sub eax, 0x271e
je 0x45c2b9
sub eax, 0x15
je 0x45c2da
sub eax, 0xf
je 0x45c2d1
and dword [esi + 0x10], 0xfffffffd
jmp 0x45c2ea
sub eax, 0x274a
je 0x45c2b9
dec eax
sub eax, 1
je 0x45c2d1
sub eax, 5
jne 0x45c2b9
mov ecx, esi
call fcn.0045a551
jmp 0x45c2ea
mov al, 1
jmp 0x45c2ec
push 0x2726
mov ecx, esi
call fcn.0045c403
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x45c363
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
je 0x45c3eb
push 0x4e0e3c
xor ebx, ebx
mov dword [ebp - 0x100], esi
push ebx
push ebx
lea eax, [ebp - 0x104]
mov dword [ebp - 0x104], 1
push eax
push ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x45c3e7
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.0047bfcd
test eax, eax
je 0x45c3e7
push 2
push 1
lea eax, [ebp + 0xb]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x45c3e7
je 0x45c3eb
call sub.WS2_32.dll_WSAGetLastError
mov esi, eax
push esi
call fcn.0045c9f4
pop ecx
test al, al
jne 0x45c3e1
cmp esi, 0x2726
jne 0x45c3e3
mov bl, 1
mov al, bl
jmp 0x45c3ed
xor al, al
jmp 0x45c3ed
mov al, 1
pop esi
pop ebx
leave
ret

Function at 0x45d689
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 0
jne 0x45d69a
push 2
jmp 0x45d6a3
mov edi, dword [ebp + 8]
test edi, edi
jne 0x45d6ad
push 5
pop esi
call fcn.00458e01
mov eax, esi
jmp 0x45d70c
test byte [ebp + 0xc], 0x20
push dword [ebp + 0x10]
je 0x45d6cf
push edi
call fcn.0045e683
test al, al
jne 0x45d6dc
push 0x91
call fcn.00458df3
pop ecx
push 4
jmp 0x45d70b
mov eax, dword [ebp + 0xc]
and eax, 0xffffffef
push eax
push edi
call fcn.0045d793
push edi
push dword [esi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
push edi
call fcn.00458df3
pop ecx
push 2
pop eax
cmp edi, eax
je 0x45d70c
test edi, edi
jne 0x45d6ff
xor eax, eax
inc eax
jmp 0x45d70c
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0045efdc
push 3
pop eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x45d7e2
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x45d7f9
push 6
call fcn.00458df3
pop ecx
push 2
pop eax
jmp 0x45d820
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, eax
test esi, esi
jne 0x45d80d
inc eax
jmp 0x45d81f
push esi
call fcn.00458df3
xor eax, eax
cmp esi, 2
pop ecx
setne al
add eax, 2
pop esi
pop ebp
ret 4

Function at 0x45da1f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push edi
or eax, 0x3000f
mov edi, ecx
push eax
push 0x40
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045ea24
test eax, eax
jne 0x45da51
call sub.KERNEL32.dll_GetLastError
xor ecx, ecx
cmp eax, 2
setne cl
lea eax, [ecx + 2]
jmp 0x45da68
push esi
push dword [ebp + 0x10]
mov ecx, edi
call fcn.0045da6d
mov ecx, edi
mov esi, eax
call fcn.0045d0db
mov eax, esi
pop esi
pop edi
pop ebp
ret 0x10

Function at 0x45da6d
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x45da84
push 6
call fcn.00458df3
pop ecx
push 2
pop eax
jmp 0x45daab
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
jne 0x45da98
inc eax
jmp 0x45daaa
push esi
call fcn.00458df3
xor eax, eax
cmp esi, 2
pop ecx
setne al
add eax, 2
pop esi
pop ebp
ret 4
Function at 0x45db07
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 0
jne 0x45db28
push 6
call fcn.00458df3
pop ecx
xor eax, eax
jmp 0x45dbaa
push edi
push 0xc7
lea eax, [ebp - 0xd4]
xor edi, edi
push eax
push edi
push dword [ebx + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x45db96
push esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
call fcn.00428d6d
push closesocket
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0xc]
call fcn.0042f9a7
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call esi
lea ecx, [ebp - 0xc]
call fcn.004266a4
push 0xc7
lea eax, [ebp - 0xd4]
inc edi
push eax
push edi
push dword [ebx + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x45db46
pop esi
xor ecx, ecx
cmp eax, 0x103
cmovne ecx, eax
push ecx
call fcn.00458df3
pop ecx
mov eax, edi
pop edi
pop ebx
leave
ret 4

Function at 0x45dbaf
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 0
jne 0x45dbd0
push 6
call fcn.00458df3
pop ecx
xor eax, eax
jmp 0x45dc52
push edi
push 0xc7
lea eax, [ebp - 0x19c]
xor edi, edi
push eax
push edi
push dword [ebx + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x45dc3e
push esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
call fcn.00428d6d
push closesocket
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0xc]
call fcn.0042fefd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call esi
lea ecx, [ebp - 0xc]
call fcn.004266a4
push 0xc7
lea eax, [ebp - 0x19c]
inc edi
push eax
push edi
push dword [ebx + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x45dbee
pop esi
xor ecx, ecx
cmp eax, 0x103
cmovne ecx, eax
push ecx
call fcn.00458df3
pop ecx
mov eax, edi
pop edi
pop ebx
leave
ret 4
Function at 0x45e4a2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 0
jne 0x45e4bd
push 6
call fcn.00458df3
pop ecx
xor al, al
jmp 0x45e506
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x20
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [ebx + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
cmp ecx, 0x100000
ja 0x45e502
sub eax, 0
je 0x45e558
dec eax
sub eax, 1
je 0x45e502
sub eax, 0xe8
je 0x45e50b
sub eax, 0x308
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.0046b4a5
cmp dword [ebp - 4], 0
mov edi, eax
jle 0x45e5dd
push dword [ebp - 4]
mov ecx, edi
call fcn.00423d6c
cmp dword [edi], 0
lea ecx, [ebp - 4]
push ecx
mov eax, 0x49cb70
cmovne eax, dword [edi]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [ebx + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x45e5b3
mov ecx, edi
call fcn.004266a4
jmp 0x45e502
mov eax, dword [ebp - 8]
test eax, eax
je 0x45e502
cmp eax, 3
jbe 0x45e5a2
cmp eax, 4
je 0x45e58a
cmp eax, 7
je 0x45e5a2
cmp eax, 0xb
jne 0x45e502
cmp ecx, 8
jne 0x45e502
push dword [ebp - 0x28]
mov esi, dword [ebp + 0xc]
mov ecx, esi
push dword [ebp - 0x2c]
call fcn.0046b3bf
jmp 0x45e5b3
cmp ecx, 4
jne 0x45e502
push dword [ebp - 0x2c]
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.0046b3e1
jmp 0x45e5b3
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
shr ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.0046b46b
cmp dword [ebp - 8], 1
je 0x45e5bf
cmp dword [ebp - 8], 2
jne 0x45e5dd
test dword [ebp + 0x10], 0x2000
jne 0x45e5dd
mov ecx, esi
call fcn.0046b17f
push 2
push 0x4b3d88
mov ecx, eax
call fcn.00427075
mov al, 1
jmp 0x45e504

Function at 0x45f771
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
test byte [ebp + 0x10], 8
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
je 0x45f798
cmp dword [edi + 4], 0
jg 0x45f798
push dword [ebp + 8]
call fcn.0045da6d
dec eax
neg eax
sbb al, al
inc al
jmp 0x45f809
test dword [ebp + 0x10], 0x8000
je 0x45f7b1
push dword [ebp + 8]
call fcn.0045fa52
test al, al
je 0x45f7b1
mov al, 1
jmp 0x45f809
xor ecx, ecx
inc ecx
test byte [ebp + 0x10], 0x80
je 0x45f7bf
push 3
pop ecx
jmp 0x45f7cc
test dword [ebp + 0x10], 0x100
push 2
pop eax
cmovne ecx, eax
cmp dword [esi + 0x14], 0
jne 0x45f7dd
push 6
call fcn.00458df3
xor al, al
jmp 0x45f808
push dword [edi + 4]
cmp dword [edi], 0
mov eax, 0x49cb74
cmovne eax, dword [edi]
push eax
push ecx
push 0
push dword [ebp + 8]
push dword [esi + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
push esi
call fcn.00458df3
test esi, esi
sete al
pop ecx
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x460ddc
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.00458dea
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
and eax, 1
push 0x10
pop esi
push 4
mov dword [ebp - 4], eax
pop eax
cmovne esi, eax
test edi, edi
je 0x460e7a
cmp edi, 1
je 0x460e75
push 2
pop ebx
cmp edi, ebx
je 0x460e2b
cmp edi, 3
je 0x460e7d
jle 0x460e6e
cmp edi, 5
jle 0x460e2f
cmp edi, 6
jne 0x460e6e
call fcn.00457b8b
push 0x40
test al, al
pop ecx
cmovne ebx, ecx
or esi, ebx
jmp 0x460e7d
call fcn.004606d2
test al, al
jne 0x460e3c
xor al, al
jmp 0x460ead
mov ecx, dword [0x4e0f00]
test ecx, ecx
jne 0x460e50
push 0x78
call fcn.00458df3
pop ecx
jmp 0x460e38
mov eax, dword [ebp + 0xc]
shr eax, 1
and eax, 1
push eax
push dword [ebp - 4]
xor eax, eax
cmp edi, 5
sete al
push eax
call ecx
test al, al
setne al
jmp 0x460ead
call fcn.00458e01
jmp 0x460e38
or esi, 8
jmp 0x460e7d
or esi, 1
push 0
push 1
mov edi, str.SeShutdownPrivilege
push edi
call fcn.0046070b
add esp, 0xc
push dword [ebp + 0x10]
push esi
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
test eax, eax
push 0
push edi
setne bl
call fcn.0046070b
add esp, 0xc
mov al, bl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x462389
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0xc], 0
je 0x462445
mov eax, dword [ebp + 0x10]
and eax, 2
mov dword [ebp - 8], eax
jne 0x4623b0
call fcn.00462353
test al, al
je 0x462445
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov esi, dword [esi + 4]
sub eax, 1
je 0x4623cf
sub eax, 6
je 0x4623cf
sub eax, 6
jne 0x4623d0
add esi, 2
jmp 0x4623d0
inc esi
and dword [ebp - 4], 0
push esi
call fcn.00457665
mov edi, eax
pop ecx
test edi, edi
je 0x462426
push edi
call fcn.004576c4
pop ecx
mov ecx, eax
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x462426
mov edx, dword [ebp + 8]
mov eax, 0x49cb70
push esi
cmp dword [edx], 0
cmovne eax, dword [edx]
push eax
push ecx
call fcn.00480400
push edi
call fcn.004576ff
add esp, 0x10
test byte [ebp + 0x10], 1
jne 0x46241c
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetClipboardData]
cmp dword [ebp - 8], 0
jne 0x462431
call sub.USER32.dll_CloseClipboard
test edi, edi
pop edi
pop esi
je 0x462441
cmp dword [ebp - 4], 0
je 0x462441
mov al, 1
leave
ret
xor eax, eax
leave
ret
xor al, al
leave
ret

Function at 0x4640bf
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.00428d6d
cmp dword [ebp + 0xc], 0
je 0x4640f8
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, eax
test ecx, ecx
jle 0x4640f8
lea eax, [ecx + 1]
add ecx, ecx
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423d6c
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [ebp + 8]
pop ebp
ret
Function at 0x465ad3
Capabilities:
Get common file path

Disassembly:
mov eax, 0x49ad49
call fcn.0046c220
sub esp, 0x250
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x14]
or ecx, 0x100000
mov dword [ebx + 0x14], ecx
or edi, 0xffffffff
mov dword [ebp - 0x18], edi
movzx eax, cx
sub eax, 1
je 0x465b18
sub eax, 1
je 0x465b14
sub eax, 1
jne 0x465b1e
push 0x17
jmp 0x465b1a
push 2
jmp 0x465b1a
push 0x11
pop edi
mov dword [ebp - 0x18], edi
and dword [ebp - 0x20], 0
test edi, edi
js 0x465b36
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebx]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [ebx + 0x14]
test ecx, 0x80000
je 0x465b79
push edi
lea eax, [ebp - 0x2c]
push eax
call fcn.00466754
pop ecx
pop ecx
push 0
sub esp, 0xc
mov esi, esp
mov ecx, esi
call fcn.00428d6d
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.0042f989
lea esi, [ebx + 0x18]
push esi
call fcn.00445e0c
add esp, 0x14
lea ecx, [ebp - 0x2c]
call fcn.004266a4
jmp 0x465b7c
lea esi, [ebx + 0x18]
push esi
call fcn.00442346
push 0
push 0x20
lea eax, [ebp - 0x4c]
push eax
call fcn.0042a591
add esp, 0x10
mov eax, dword [ebx]
mov dword [ebp - 0x4c], eax
mov eax, 0x49cb74
cmp dword [ebx + 8], 0
cmovne eax, dword [ebx + 8]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 0x461e99
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
push 0x41
pop eax
test dword [ebx + 0x14], 0x20000
mov ecx, 0x8041
cmove eax, ecx
mov dword [ebp - 0x3c], eax
test dword [ebx + 0x14], 0x40000
je 0x465bdb
or eax, 0x10
mov dword [ebp - 0x3c], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov esi, eax
mov dword [ebp - 0x50], esi
test esi, esi
je 0x465cc1
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
setne byte [ebp - 0x11]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 2
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x465c40
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x465c40
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x14]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x465c47
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
or dword [ebp - 4], 0xffffffff
jmp 0x465c5d
cmp byte [ebp - 0x11], 0
je 0x465cc1
push closesocket
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebx + 0x24]
call fcn.0042fefd
test dword [ebx + 0x14], 0x80000
je 0x465cb3
push edi
lea eax, [ebp - 0x2c]
push eax
call fcn.00466754
push ecx
mov esi, esp
mov ecx, esi
call fcn.00428d6d
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.0042f989
lea eax, [ebx + 0x24]
push eax
call fcn.004453d5
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.004266a4
mov al, 1
jmp 0x465cc3
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4663c7
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x49ad5d
call fcn.0046c220
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
push esi
call fcn.00432400
pop ecx
test al, al
je 0x4663f6
push 0x7b
call fcn.00458df3
pop ecx
xor al, al
jmp 0x46649f
call fcn.00458dea
and dword [ebp - 4], 0
mov ebx, dword [ebp + 0x18]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
mov edi, dword [ebp + 0x14]
push edi
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x14], eax
or dword [ebp - 4], 0xffffffff
jmp 0x46643c
cmp eax, 5
jne 0x46648f
test edi, edi
je 0x466456
push 0x49cf40
push edi
call fcn.004324c5
pop ecx
pop ecx
test al, al
je 0x4663ef
mov dword [ebp - 4], 2
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x14], eax
or dword [ebp - 4], 0xffffffff
jmp 0x46648f
cmp eax, 0x20
jle 0x4663ef
call fcn.00458dea
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x467e57
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp word [ebp - 0x218], 0
je 0x467ea3
mov ecx, dword [ebp + 8]
call fcn.00428d6d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push closesocket
push eax
call fcn.0042fefd
jmp 0x467ee9
call fcn.00457b7e
test al, al
lea eax, [ebp - 0xc]
push eax
je 0x467ebe
call fcn.00459237
mov dword [esp], str.System32
jmp 0x467eca
call fcn.00459237
mov dword [esp], str.System
cmp dword [eax], 0
mov ecx, 0x49cb74
cmovne ecx, dword [eax]
push ecx
push dword [ebp + 8]
call fcn.004451df
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.004266a4
mov eax, dword [ebp + 8]
leave
ret

Function at 0x468656
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.004310cc
pop ecx
test al, al
je 0x468672
call fcn.00458e01
xor al, al
jmp 0x4686b5
push ebx
mov ecx, esi
call fcn.0046879b
call fcn.00458dea
push dword [ebp + 8]
mov bl, byte [ebp + 0xc]
invalid
invalid

Function at 0x469766
Capabilities:
Terminate thread

Disassembly:
mov eax, 0x49adad
call fcn.0046c220
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
test esi, esi
jne 0x469783
xor al, al
jmp 0x4697b7
and dword [ebp - 4], 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
setne bl
mov byte [ebp - 0x11], bl
or dword [ebp - 4], 0xffffffff
jmp 0x4697ae
push esi
call fcn.004696d7
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x469817
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x469829
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop ebp
ret