joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4340bc
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004340bc
xor esi, esi
xor edi, edi
mov ecx, 0x52
push esi
dec ecx
jne 0x4340d8
lea ebx, [ebp + 8]
call fcn.0045ce8d
xor eax, eax
call fcn.00452fc5
lea ebx, [ebp + 8]
mov ecx, 0x104
call fcn.0045ced6
push 0
mov eax, 2
mov ecx, 1
add eax, ecx
mov ecx, 4
add eax, ecx
mov ecx, 8
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
jne 0x43412a
jmp 0x4341ba
mov eax, 0x128
mov dword [ebp - 0x1c0], eax
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32First]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
nop
nop
cmp dword [ebp - 0x1cc], 0
je 0x4341ae
lea ebx, [ebp - 0x19c]
call fcn.0045ce8d
xor eax, eax
call fcn.00452fc5
lea ebx, [ebp + 8]
call fcn.0045ce8d
call fcn.0045c602
jne 0x434193
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x98], eax
jmp 0x4341ae
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32Next]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
jmp 0x434150
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104
Function at 0x43728f
Capabilities:
List tcp connections and listeners

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0043728f
xor esi, esi
xor edi, edi
mov ecx, 0x11
push esi
dec ecx
jne 0x4372ab
fild dword [0x186cd70]
mov edx, 1
call fcn.0045c92e
push 0
push 4
push 2
push 1
lea ebx, [ebp - 0xa0]
mov dword [ebx], esi
push ebx
push 0
call dword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
mov esi, dword [ebp - 0xa0]
mov ebx, 0x4001
call fcn.0045c8f6
call fcn.0045c27b
fcompp
fnstsw ax
sahf
jne 0x437474
mov eax, esi
call fcn.00456d47
lea ebx, [ebp - 0xa8]
call fcn.0045c2a9
fild dword [0x186cd68]
mov edx, 1
call fcn.0045c92e
push 0
push 4
push 2
push 1
lea ebx, [ebp - 0xa0]
mov dword [ebx], esi
push ebx
lea ebx, [ebp - 0xa8]
call fcn.0045d1af
push ebx
call dword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
mov esi, dword [ebp - 0xa0]
mov ebx, 0x4001
call fcn.0045c8f6
call fcn.0045c27b
fcompp
fnstsw ax
sahf
jne 0x437474
mov eax, 4
lea ebx, [ebp - 0xa8]
call fcn.0045d1af
mov dword [ebp - 0x30], eax
mov eax, ebx
mov ecx, dword [ebp - 0x30]
add eax, ecx
mov dword [ebp - 0x9c], eax
lea ebx, [ebp - 0xa8]
call fcn.0045d1af
mov eax, ebx
mov edi, dword [eax]
mov eax, edi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xac], 1
jmp 0x437462
fild dword [0x186d150]
mov ebx, dword [ebp - 0x9c]
mov eax, dword [ebx]
call fcn.0045c27b
fcompp
fnstsw ax
sahf
jne 0x437449
push 0x7f9c
mov ebx, dword [ebp - 0x9c]
push dword [ebx + 0x10]
call dword [sym.imp.WS2_32.DLL_htons]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
movzx eax, ax
cmp eax, dword [ebp - 0x30]
jne 0x437449
mov ebx, dword [ebp - 0x9c]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x98], eax
mov ebx, dword [ebp - 0x9c]
mov eax, dword [ebx + 4]
mov dword [ebp - 0xc4], eax
mov ebx, dword [ebp - 0x9c]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0xbc], eax
mov ebx, dword [ebp - 0x9c]
mov eax, dword [ebx + 8]
mov dword [ebp - 0xc0], eax
mov ebx, dword [ebp - 0x9c]
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xc8], 0xc
mov eax, 0x18
mov ecx, dword [ebp - 0x9c]
add eax, ecx
mov dword [ebp - 0x9c], eax
inc dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xb4]
jle 0x4373b0
call fcn.0045cf2c
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x437494
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00437494
xor esi, esi
push esi
push esi
push esi
push esi
mov edx, 0x1867624
call fcn.0045d0ba
mov eax, 0x80000080
call fcn.00454915
call fcn.00423931
mov edx, 0x1867638
call fcn.0045d0ba
mov eax, 0x80000080
call fcn.00454915
call fcn.00423931
mov edx, 0x1867648
call fcn.0045d0ba
mov eax, 0x80000080
call fcn.00454915
call fcn.00423931
mov edx, 0x186765c
call fcn.0045d0ba
mov eax, 0x80000080
call fcn.00454915
call fcn.00423931
mov eax, dword [0x45fb18]
test eax, eax
je 0x437537
mov edx, 0x1867670
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
mov eax, 0x3e8
call fcn.00457053
push 0
mov edx, 0x1867684
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x43b346
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0043b346
xor esi, esi
xor edi, edi
mov ecx, 0x54
push esi
dec ecx
jne 0x43b362
push 0
push dword [0x186028c]
call dword [sym.imp.USER32.DLL_ShowWindow]
fldcw word [ebp - 0x10]
call fcn.0043ae43
test eax, eax
je 0x43b551
lea ebx, [ebp - 0xb8]
push ebx
lea ebx, [ebp - 0xb4]
push ebx
call fcn.0043b15a
push 0
push 0
push 0x1004
push dword [0x186028c]
call dword [sym.imp.USER32.DLL_SendMessageA]
fldcw word [ebp - 0x10]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
sub eax, 1
mov dword [ebp - 0x1cc], eax
mov esi, 0
jmp 0x43b543
mov eax, esi
push eax
call fcn.0043b04a
call fcn.0045d0d1
lea ebx, [ebp - 0x1bc]
mov ecx, 0x104
call fcn.0045ced6
mov edi, 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edi
sub eax, dword [0x1860738]
imul eax, eax, 0x88
add eax, dword [0x1860720]
mov ebx, eax
lea ebx, [ebx + 8]
call fcn.0045ce8d
lea ebx, [ebp - 0x1bc]
call fcn.0045ce8d
call fcn.0045c602
jne 0x43b533
lea ebx, [ebp - 0x1c4]
push ebx
mov eax, esi
push eax
call fcn.0043b0db
mov eax, dword [ebp - 0x1c4]
cdq
idiv dword [ebp - 0xb4]
add eax, 1
mov ecx, edi
sub ecx, dword [0x1860738]
imul ecx, ecx, 0x88
add ecx, dword [0x1860720]
cmp eax, dword [ecx]
jne 0x43b49c
mov eax, dword [ebp - 0x1c0]
cdq
idiv dword [ebp - 0xb8]
add eax, 1
mov ecx, edi
sub ecx, dword [0x1860738]
imul ecx, ecx, 0x88
add ecx, dword [0x1860720]
cmp eax, dword [ecx + 4]
je 0x43b528
mov eax, dword [ebp - 0xb4]
mov ecx, 1
mov dword [ebp - 0x30], eax
mov eax, edi
sub eax, dword [0x1860738]
imul eax, eax, 0x88
add eax, dword [0x1860720]
neg ecx
add ecx, dword [eax]
mov eax, ecx
imul dword [ebp - 0x30]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xb8]
mov ecx, 1
mov dword [ebp - 0x30], eax
mov eax, edi
sub eax, dword [0x1860738]
imul eax, eax, 0x88
add eax, dword [0x1860720]
neg ecx
add ecx, dword [eax + 4]
mov eax, ecx
imul dword [ebp - 0x30]
mov dword [ebp - 0xa8], eax
push dword [ebp - 0xa8]
push dword [ebp - 0xa4]
call fcn.0043b58e
push eax
mov eax, esi
push eax
push 0x100f
push dword [0x186028c]
call dword [sym.imp.USER32.DLL_SendMessageA]
fldcw word [ebp - 0x10]
inc dword [ebp - 0xb0]
jmp 0x43b541
inc edi
cmp edi, 0xc8
jle 0x43b400
inc esi
mov eax, esi
cmp eax, dword [ebp - 0x1cc]
jle 0x43b3d0
call fcn.0043afd5
push 5
push dword [0x186028c]
call dword [sym.imp.USER32.DLL_ShowWindow]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x43d108
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0043d108
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push 0
push 0
push 0
xor eax, eax
lea ebx, [esp + 4]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x98]
mov dword [ebx], esi
push ebx
push 0
fild dword [0x186d63c]
fild dword [0x186cde8]
call fcn.0045c11c
call fcn.0045c2a2
push eax
push 0
push 0
push 0
mov edx, 0x1868488
call fcn.0045d0ba
lea ebx, [esp + 0x1c]
call fcn.0045c36b
fild qword [0x186d0cc]
call fcn.0045c2a2
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 8
mov esi, dword [ebp - 0x98]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
je 0x43d1a7
jmp 0x43d1e3
push 0
mov edx, 0x1868498
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4467b2
Capabilities:
Enumerate gui resources
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004467b2
xor esi, esi
xor edi, edi
mov ecx, 0x98
push esi
dec ecx
jne 0x4467ce
fild dword [0x186d6e4]
mov eax, dword [0x45f838]
call fcn.0045c27b
fcompp
fnstsw ax
sahf
jae 0x4467f3
jmp 0x4469db
push 0
mov eax, 2
mov ecx, 1
add eax, ecx
mov ecx, 4
add eax, ecx
mov ecx, 8
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
fldcw word [ebp - 0x10]
mov edi, eax
cmp edi, 0
jne 0x446825
jmp 0x4469db
mov eax, 0x128
mov dword [ebp - 0x1c0], eax
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32First]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp - 0x1cc], 0
jne 0x44685e
jmp 0x4469a7
push dword [ebp - 0x1b8]
call fcn.0041ed45
call fcn.0045d0d1
lea ebx, [ebp - 0x2dc]
mov ecx, 0x104
call fcn.0045ced6
lea ebx, [ebp - 0x2dc]
call fcn.0045ce8d
mov edx, 0x18609c8
call fcn.0045d0ba
call fcn.0045c602
jne 0x4468b5
lea ebx, [ebp - 0x19c]
call fcn.0045ce8d
lea ebx, [ebp - 0x2dc]
mov ecx, 0x104
call fcn.0045ced6
mov eax, dword [0x45f838]
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x1d0], 1
jmp 0x446977
mov eax, dword [ebp - 0x1d0]
sub eax, dword [0x18605dc]
imul eax, eax, 0xcc
add eax, dword [0x18605c4]
mov ebx, eax
push ebx
lea ebx, [ebp - 0x2dc]
push ebx
call dword [sym.imp.SHLWAPI.DLL_PathMatchSpecA]
fldcw word [ebp - 0x10]
test eax, eax
je 0x446971
inc dword [ebp - 0x1d4]
cmp dword [ebp - 0x1d4], 0x12c
jle 0x44691a
jmp 0x4469a7
mov eax, dword [ebp - 0x1d4]
sub eax, dword [0x1860650]
imul eax, eax, 0x108
add eax, dword [0x1860638]
mov ebx, dword [ebp - 0x1b8]
mov dword [eax], ebx
lea ebx, [ebp - 0x2dc]
call fcn.0045ce8d
mov eax, dword [ebp - 0x1d4]
sub eax, dword [0x1860650]
imul eax, eax, 0x108
add eax, dword [0x1860638]
mov ebx, eax
lea ebx, [ebx + 4]
mov ecx, 0x104
call fcn.0045ced6
jmp 0x446971
inc dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x1d0]
cmp eax, dword [ebp - 0x2e4]
jle 0x4468d0
lea ebx, [ebp - 0x1c0]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32Next]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x1cc], eax
jmp 0x446850
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x1d4]
test eax, eax
je 0x4469db
push dword [ebp - 0x1d4]
mov eax, 0x4469f6
push eax
call dword [sym.imp.USER32.DLL_EnumWindows]
fldcw word [ebp - 0x10]
jmp 0x4469db
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x448903
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00448903
xor esi, esi
mov ecx, 0x6e
push esi
dec ecx
jne 0x44891d
push 0
lea ebx, [ebp - 0x22c]
push ebx
mov ecx, 2
mov eax, 1
movzx eax, al
shl eax, 8
mov al, cl
push eax
call dword [sym.imp.WS2_32.DLL_WSAStartup]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x4489da
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.WS2_32.DLL_gethostbyname]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x4489d1
mov ebx, dword [ebp - 0x230]
mov ebx, dword [ebx + 0xc]
mov eax, esi
shl eax, 2
add ebx, eax
mov eax, dword [ebx]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x4489d1
mov ebx, dword [ebp - 0x234]
push dword [ebx]
call dword [sym.imp.WS2_32.DLL_inet_ntoa]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x238], eax
mov ebx, dword [ebp - 0x238]
call fcn.0045ce8d
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
call fcn.0045ced6
mov dword [ebp - 0x98], 1
inc esi
call dword [sym.imp.WS2_32.DLL_WSACleanup]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x449240
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00449240
xor esi, esi
mov ecx, 0x6e
push esi
dec ecx
jne 0x44925a
push 0
lea ebx, [ebp - 0x22c]
push ebx
mov ecx, 2
mov eax, 1
movzx eax, al
shl eax, 8
mov al, cl
push eax
call dword [sym.imp.WS2_32.DLL_WSAStartup]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x44932f
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.WS2_32.DLL_gethostbyname]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x449326
mov ebx, dword [ebp - 0x230]
mov ebx, dword [ebx + 0xc]
mov eax, esi
shl eax, 2
add ebx, eax
mov eax, dword [ebx]
mov dword [ebp - 0x234], eax
fild dword [0x186d6a4]
mov eax, dword [ebp - 0x234]
call fcn.0045c27b
fcompp
fnstsw ax
sahf
jne 0x4492e5
jmp 0x449326
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x449324
mov ebx, dword [ebp - 0x234]
push dword [ebx]
call dword [sym.imp.WS2_32.DLL_inet_ntoa]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x238], eax
mov ebx, str.SYSTEMCurrentControlSetServicesTPMODUID
push ebx
mov ebx, dword [ebp - 0x238]
push ebx
call fcn.004489fb
mov dword [ebp - 0x98], eax
inc esi
jmp 0x4492b0
call dword [sym.imp.WS2_32.DLL_WSACleanup]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x449ad0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00449ad0
xor esi, esi
mov ecx, 0x9a
push esi
dec ecx
jne 0x449aea
lea ebx, [ebp + 8]
call fcn.0045ce8d
mov edx, 0x1862af8
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [ebp - 0x2ec]
mov ecx, 0x104
call fcn.0045ced6
lea ebx, [ebp - 0x1e8]
push ebx
lea ebx, [ebp - 0x2ec]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
fldcw word [ebp - 0x10]
mov esi, eax
fild qword [0x186cd80]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
je 0x449d37
nop
nop
nop
nop
fild dword [0x186cd30]
fild dword [0x186cd30]
mov eax, dword [ebp - 0x1e8]
call fcn.0045c27b
call fcn.0045c106
fcompp
fnstsw ax
sahf
je 0x449b7c
jmp 0x449d10
lea ebx, [ebp - 0x1bc]
call fcn.0045ce8d
mov edx, 0x1860a3c
call fcn.0045d0ba
call fcn.0045c602
je 0x449d10
lea ebx, [ebp - 0x1bc]
call fcn.0045ce8d
mov edx, 0x1862b08
call fcn.0045d0ba
call fcn.0045c602
je 0x449d10
push 0
lea ebx, [ebp + 8]
call fcn.0045ce8d
lea ebx, [ebp - 0x1bc]
call fcn.0045ce8d
call fcn.0045c56d
mov edx, 0x186a978
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call fcn.00419351
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
test eax, eax
je 0x449c66
mov edx, 0x186a9a4
call fcn.0045d0ba
lea ebx, [ebp + 8]
call fcn.0045ce8d
call fcn.0045c56d
lea ebx, [ebp - 0x1bc]
call fcn.0045ce8d
call fcn.0045c56d
push 0
mov ebx, esp
call fcn.0045c2a9
mov eax, 4
call fcn.0045a309
mov edx, 0x186a990
call fcn.0045d0ba
call fcn.0045c56d
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.0044976d
jmp 0x449d10
lea ebx, [ebp - 0x1bc]
call fcn.0045ce8d
mov eax, 1
mov edx, 0x186a9c8
call fcn.0045d0ba
call fcn.004512ed
test eax, eax
je 0x449ce9
mov edx, 0x186a9d4
call fcn.0045d0ba
lea ebx, [ebp + 8]
call fcn.0045ce8d
call fcn.0045c56d
lea ebx, [ebp - 0x1bc]
call fcn.0045ce8d
call fcn.0045c56d
push 0
mov ebx, esp
call fcn.0045c2a9
mov eax, 4
call fcn.0045a309
mov edx, 0x186a990
call fcn.0045d0ba
call fcn.0045c56d
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.0044976d
jmp 0x449d10
lea ebx, [ebp + 8]
call fcn.0045ce8d
lea ebx, [ebp - 0x1bc]
call fcn.0045ce8d
call fcn.0045c56d
mov eax, 0x80000104
call fcn.00454915
call fcn.00449d4e
lea ebx, [ebp - 0x1e8]
push ebx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
fldcw word [ebp - 0x10]
test eax, eax
jne 0x449b50
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104
Function at 0x44a317
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0044a317
xor esi, esi
mov ecx, 0x9a
push esi
dec ecx
jne 0x44a331
lea ebx, [ebp + 8]
call fcn.0045ce8d
mov edx, 0x1862af8
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [ebp - 0x2ec]
mov ecx, 0x104
call fcn.0045ced6
lea ebx, [ebp - 0x1e8]
push ebx
lea ebx, [ebp - 0x2ec]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
fldcw word [ebp - 0x10]
mov esi, eax
fild qword [0x186cd80]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
je 0x44a596
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
fild dword [0x186cd30]
fild dword [0x186cd30]
mov eax, dword [ebp - 0x1e8]
call fcn.0045c27b
call fcn.0045c106
fcompp
fnstsw ax
sahf
je 0x44a3cc
jmp 0x44a56f
lea ebx, [ebp - 0x1bc]
call fcn.0045ce8d
mov edx, 0x1860a3c
call fcn.0045d0ba
call fcn.0045c602
je 0x44a56f
lea ebx, [ebp - 0x1bc]
call fcn.0045ce8d
mov edx, 0x1862b08
call fcn.0045d0ba
call fcn.0045c602
je 0x44a56f
push 0
lea ebx, [ebp + 8]
call fcn.0045ce8d
lea ebx, [ebp - 0x1bc]
call fcn.0045ce8d
call fcn.0045c56d
mov edx, 0x186a978
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call fcn.00419351
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
test eax, eax
je 0x44a4b6
mov edx, 0x186a9a4
call fcn.0045d0ba
lea ebx, [ebp + 8]
call fcn.0045ce8d
call fcn.0045c56d
lea ebx, [ebp - 0x1bc]
call fcn.0045ce8d
call fcn.0045c56d
push 0
mov ebx, esp
call fcn.0045c2a9
mov eax, 4
call fcn.0045a309
mov edx, 0x186a990
call fcn.0045d0ba
call fcn.0045c56d
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.0044976d
jmp 0x44a56f
lea ebx, [ebp - 0x1bc]
call fcn.0045ce8d
mov eax, 1
mov edx, 0x186a9c8
call fcn.0045d0ba
call fcn.004512ed
test eax, eax
je 0x44a539
mov edx, 0x186a9d4
call fcn.0045d0ba
lea ebx, [ebp + 8]
call fcn.0045ce8d
call fcn.0045c56d
lea ebx, [ebp - 0x1bc]
call fcn.0045ce8d
call fcn.0045c56d
push 0
mov ebx, esp
call fcn.0045c2a9
mov eax, 4
call fcn.0045a309
mov edx, 0x186a990
call fcn.0045d0ba
call fcn.0045c56d
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.0044976d
jmp 0x44a56f
lea ebx, [ebp + 8]
call fcn.0045ce8d
lea ebx, [ebp - 0x1bc]
call fcn.0045ce8d
call fcn.0045c56d
mov edx, 0x186aa70
call fcn.0045d0ba
call fcn.0045c56d
mov eax, 0x80000104
call fcn.00454915
call fcn.0044a5ad
lea ebx, [ebp - 0x1e8]
push ebx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
fldcw word [ebp - 0x10]
test eax, eax
jne 0x44a3a0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104
Function at 0x44f8d2
Capabilities:
Accept command line arguments
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..data
test word [0x44f8b4], 4
jne 0x44f8ed
jmp 0x44fd1c
jmp fcn.0044fb1f
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.0044fa1b
mov dword [ebx + 0x3f0], 1
lea eax, [ebx + 0x5c4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, 0xa
test dword [esp + 0x2c], 1
je 0x44fd6d
movzx eax, word [esp + 0x30]
add esp, 0x44
mov dword [ebx + 0x3e4], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.0044fac1
mov dword [ebx + 0x3e0], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebx + 0x3ec], eax
call fcn.0044f8f2
push 0xff
jb 0x44fdec
pop eax
movzx ecx, word [0x44f8b2]
jecxz 0x44fdb7
push ecx
push 8
push esp
call dword [sym.imp.COMCTL32.DLL_InitCommonControlsEx]
pop eax
pop eax
call fcn.0044f967
push eax
mov ebx, section..data
mov ecx, dword [ebx + 0xd8]
call fcn.0044fdf8
mov ecx, dword [ebx + 0xb4]
jecxz 0x44fddc
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov edi, dword [ebx + 0x428]
call fcn.0044f96c
call fcn.0044f953
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x44f8f2
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x44f952
mov dword [ebx + 0x3d0], eax
mov dword [ebx + 0x3d8], 0
mov dword [ebx + 0x3d4], 0
call fcn.0044fbfe
jb 0x44f952
mov dword [ebx + 0x3d4], eax
mov word [eax + 0xac], 8
call fcn.0044f941
dec ebp
push ebx
and byte [ebx + 0x61], dl
outsb dx, byte [esi]
jae 0x44f95b
push ebx
jb 0x44f9a8
add byte [esi - 4], bl
mov bl, 0xd0
add eax, dword [eax]
add bh, bh
adc eax, sym.imp.KERNEL32.DLL_TlsFree
ret

Function at 0x44fe34
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push esi
push edi
sub esp, 0x20
call fcn.0044ff1b
mov edi, esp
mov cl, 4
call fcn.0044fe55
call fcn.0044fe55
mov edx, 8
jmp 0x44feae
or esi, esi
jne 0x44feb6
mov byte [edi], 0x30
inc esi
mov ecx, dword [esp + 0x2c]
jecxz 0x44fec4
cmp ecx, edx
jbe 0x44fec6
mov ecx, edx
jmp 0x44fec6
mov ecx, esi
cmp ecx, esi
ja 0x44fed0
add esi, esp
sub esi, ecx
jmp 0x44feee
mov edx, esi
lea edi, [esp + ecx - 1]
lea esi, [esp + esi - 1]
push ecx
mov ebx, ecx
sub ebx, edx
mov ecx, edx
std
rep movsb byte es:[edi], byte [esi]
mov al, 0x30
mov ecx, ebx
rep stosb byte es:[edi], al
cld
pop ecx
mov esi, esp
call fcn.0045d17e
jb 0x44fefd
add esp, 0x20
pop edi
pop esi
pop ebx
pop eax
ret
add esp, 0x20
pop edi
pop esi
pop ebx
pop edx
jmp fcn.0044fb36
Function at 0x44ff23
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
sub esp, 0x170
mov dword [esp], eax
mov dword [esp + 4], ecx
and eax, 0x7fff
mov esi, eax
cld
xor eax, eax
mov ecx, 4
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov ecx, 0x11
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x5c]
call fcn.0045c528
mov dword [esp + 0x18], 0x44
mov dword [esp + 0x44], 1
mov word [esp + 0x48], si
lea eax, [esp + 8]
lea ebx, [esp + 0x18]
mov edi, dword [esp + 4]
push edi
push 0
push 0xc
mov ecx, esp
push eax
push ebx
push 0
push 0
push 0x20
push edi
push ecx
push ecx
push edx
push 0
mov edx, dword [sym.imp.KERNEL32.DLL_CreateProcessA]
call fcn.0045d694
pop ecx
pop ecx
pop ecx
jae 0x44ffa6
test eax, eax
je 0x44ffed
mov ebx, dword [esp + 0x10]
test dword [esp], 0x8000
je 0x44ffcd
push 0xffffffffffffffff
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [esp + 8]
push eax
push esp
push eax
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
pop ebx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, ebx
add esp, 0x170
pop edi
pop esi
pop ebx
ret
add esp, 0x170
pop edi
pop esi
pop ebx
xor eax, eax
jmp fcn.0044fb2b

Function at 0x44fffd
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
lea esi, [esp + 0x18]
mov ecx, dword [esi - 4]
push ecx
call fcn.00457330
jb 0x450033
jecxz 0x450020
lea esi, [esi + ecx*4 - 4]
mov eax, dword [esi]
mov byte [edi], al
sub esi, 4
inc edi
loop 0x450016
call fcn.0045d137
pop edx
pop edi
pop esi
pop ecx
pop eax
shl edx, 2
pop dword [esp + edx]
add esp, edx
ret
call fcn.0045d135
pop edx
pop edi
pop esi
pop ecx
add esp, 4
shl edx, 2
pop dword [esp + edx]
add esp, edx
jmp fcn.0044fb36