joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a6aa
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov eax, 0x4a0c86
call fcn.0049e6bc
sub esp, 0x22c
push esi
push edi
xor edi, edi
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x2c], edi
mov esi, ecx
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x234]
mov dword [ebp - 4], edi
push eax
push edi
push edi
push edi
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x45a6f9
push 0x4ca9a8
mov ecx, esi
call fcn.0041eeaf
jmp 0x45a734
cmp word [ebp - 0x234], 0
jne 0x45a707
mov eax, edi
jmp 0x45a714
lea eax, [ebp - 0x234]
push eax
call fcn.00438238
pop ecx
push eax
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041fba8
push 0x4ca9ac
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00425d3a
pop ecx
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.0041f6b8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45a751
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4a0ca5
call fcn.0049e6bc
sub esp, 0x210
push esi
mov esi, ecx
xor eax, eax
push edi
xor edi, edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], edi
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov word [esi], ax
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], edi
push eax
push 0x104
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp word [ebp - 0x21c], di
je 0x45a7b0
lea eax, [ebp - 0x21c]
push eax
call fcn.00438238
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call fcn.004232bf
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x45a7d1
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov eax, 0x4a0d11
call fcn.0049e6bc
sub esp, 0x2e0
push ebx
mov ebx, ecx
xor eax, eax
push esi
xor esi, esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x14], esi
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], esi
push edi
mov word [ebx], ax
lea eax, [ebp - 0x2ec]
mov dword [ebp - 4], esi
push eax
push esi
push esi
xor edi, edi
push 0x1a
inc edi
push esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x45a84f
lea ecx, [ebp - 0x2c]
call fcn.0045ac18
push eax
mov ecx, ebx
call fcn.0041eed4
push esi
push edi
lea ecx, [ebp - 0x2c]
call fcn.0041f6b8
push 0xffffffffffffffff
push ecx
push 0x4ca924
mov ecx, ebx
call fcn.00424d49
push eax
mov ecx, ebx
call fcn.0041f444
jmp 0x45a88e
cmp word [ebp - 0x2ec], 0
jne 0x45a85d
mov eax, esi
jmp 0x45a86a
lea eax, [ebp - 0x2ec]
push eax
call fcn.00438238
pop ecx
push eax
lea eax, [ebp - 0x2ec]
mov ecx, ebx
push eax
call fcn.0041fba8
mov esi, 0x4ca918
push esi
call fcn.00438238
pop ecx
push eax
push esi
mov ecx, ebx
call fcn.004232bf
push 5
pop edx
lea ecx, [ebp - 0x98]
call fcn.0045c729
mov edi, eax
push 3
pop edx
lea ecx, [ebp - 0x80]
mov dword [ebp - 4], 1
call fcn.0045c729
mov esi, eax
mov byte [ebp - 4], 2
xor eax, eax
and dword [ebp - 0x1c], 0
push 0x4ca948
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
call fcn.00438238
pop ecx
push eax
push 0x4ca948
lea ecx, [ebp - 0x2c]
call fcn.0041fba8
push esi
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb0]
call fcn.0042338a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xe0]
mov edx, eax
mov dword [esp], 0x4ca944
call fcn.00425d16
pop ecx
push edi
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x68]
call fcn.0042338a
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x50]
mov edx, eax
mov dword [esp], 0x4ca91c
call fcn.00425d16
pop ecx
xor edi, edi
lea ecx, [ebp - 0x68]
xor esi, esi
push edi
inc esi
push esi
call fcn.0041f6b8
push edi
push esi
lea ecx, [ebp - 0xe0]
call fcn.0041f6b8
push edi
push esi
lea ecx, [ebp - 0xb0]
call fcn.0041f6b8
push edi
push esi
lea ecx, [ebp - 0x2c]
call fcn.0041f6b8
push edi
push esi
lea ecx, [ebp - 0x80]
call fcn.0041f6b8
push edi
push esi
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0xd
call fcn.0041f6b8
sub esp, 0x18
lea eax, [ebp - 0x50]
mov ecx, esp
mov dword [ebp - 0x30], esp
push eax
call fcn.0041ee74
sub esp, 0x18
mov byte [ebp - 4], 0xe
mov ecx, esp
push ebx
call fcn.0041ee74
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0xd
call fcn.00458f58
add esp, 0x30
lea ecx, [ebp - 0xc8]
push edi
push esi
call fcn.0041f6b8
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x50]
mov ecx, ebx
push eax
call fcn.00423219
mov esi, 0x4ca928
push esi
call fcn.00438238
pop ecx
push eax
push esi
mov ecx, ebx
call fcn.004232bf
push edi
push 1
lea ecx, [ebp - 0x50]
call fcn.0041f6b8
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a9ff
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4a0d64
call fcn.0049e6bc
sub esp, 0x280
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x28c]
push 0x104
mov esi, ecx
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
cmp word [ebp - 0x28c], ax
je 0x45aa57
lea eax, [ebp - 0x28c]
push eax
call fcn.00438238
pop ecx
push eax
lea eax, [ebp - 0x28c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041fba8
xor ebx, ebx
mov edi, 0x4ca914
inc ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00438238
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2c]
call fcn.004232bf
and dword [ebp - 0x34], 0
xor eax, eax
mov edi, str.Temp_
mov dword [ebp - 0x30], 7
push edi
mov word [ebp - 0x44], ax
call fcn.00438238
pop ecx
push eax
push edi
lea ecx, [ebp - 0x44]
call fcn.0041fba8
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x80]
call fcn.0041ee74
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 3
push ecx
mov edx, eax
lea ecx, [ebp - 0x68]
call fcn.00423362
mov byte [ebp - 4], 4
mov edx, eax
mov ecx, esi
mov dword [esp], str.sdrecord.ini
call fcn.00425d16
pop ecx
xor edi, edi
mov dword [ebp - 0x14], ebx
push edi
push ebx
lea ecx, [ebp - 0x68]
call fcn.0041f6b8
push edi
push ebx
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.0041f6b8
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
mov dword [ebp - 0x48], esp
push eax
call fcn.0041ee74
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x68]
call fcn.0041ee74
sub esp, 0x18
mov byte [ebp - 4], 6
mov ecx, esp
mov edx, eax
push 0x4ca920
call fcn.00425d16
pop ecx
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 7
call fcn.00458f58
add esp, 0x30
lea ecx, [ebp - 0x80]
push edi
push ebx
call fcn.0041f6b8
push edi
push ebx
lea ecx, [ebp - 0x68]
call fcn.0041f6b8
push edi
push ebx
lea ecx, [ebp - 0x44]
call fcn.0041f6b8
push edi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0041f6b8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45abd2
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push esi
cmovae eax, dword [ebp + 8]
push edi
xor edi, edi
push edi
push edi
push 3
push edi
push 1
push 8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x45ac05
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
jmp 0x45ac07
mov esi, edi
push edi
push 1
lea ecx, [ebp + 8]
call fcn.0041f6b8
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x45acc2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ebx
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
lea ecx, [ebp + 8]
push 0
push 1
setne bl
call fcn.0041f6b8
mov al, bl
pop ebx
pop ebp
ret
Function at 0x45aef6
Capabilities:
Get number of processors
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a0df8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
push edi
xor eax, eax
mov dword [esp + 0x10], 0x32
xor edi, edi
mov word [esp + 0x34], ax
push 0x30
lea eax, [esp + 0x3a]
mov dword [esp + 0x18], edi
push edi
push eax
call fcn.00438560
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0x4ca840
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push str.svcVersion
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 0x18
lea eax, [esp + 0x4c]
mov ecx, esp
push eax
call fcn.0041eeaf
lea ecx, [esp + 0x34]
call fcn.0045e1cb
mov esi, 0x4ca838
mov dword [esp + 0x8c], edi
push esi
call fcn.004380e0
add esp, 0x1c
lea ecx, [esp + 0x1c]
push eax
push edi
push esi
call fcn.0042537f
cmp eax, 0xffffffff
je 0x45afdb
mov esi, 0x4ca83c
push esi
call fcn.004380e0
pop ecx
push 0xffffffffffffffff
push eax
push edi
push esi
lea ecx, [esp + 0x2c]
call fcn.0042537f
push eax
lea ecx, [esp + 0x24]
call fcn.0041fa88
cmp dword [esp + 0x30], 0x10
lea eax, [esp + 0x1c]
cmovae eax, dword [esp + 0x1c]
push eax
call fcn.00438fbd
pop ecx
push 7
pop esi
cmp eax, esi
lea ecx, [esp + 0x1c]
push edi
push 1
cmovg esi, eax
call fcn.0041f358
mov ecx, dword [esp + 0x6c]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45c403
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x4a10bc
call fcn.0049e6bc
sub esp, 0x84
xorps xmm0, xmm0
mov dword [ebp - 0x10], ecx
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
movdqu xmmword [ebp - 0x90], xmm0
push esi
movdqu xmmword [ebp - 0x80], xmm0
mov esi, edx
mov dword [ecx + 0x14], 0xf
movdqa xmm0, xmmword [0x503d10]
movdqu xmmword [ebp - 0x70], xmm0
mov dword [ecx + 0x10], ebx
movdqa xmm0, xmmword [str.456789:__]
movdqu xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x20], 0x2c2b2a29
movdqa xmm0, xmmword [0x503cf0]
movdqu xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x1c], 0x302f2e2d
movdqa xmm0, xmmword [0x503c40]
movdqu xmmword [ebp - 0x40], xmm0
mov word [ebp - 0x18], 0x3231
movdqa xmm0, xmmword [0x503d00]
movdqu xmmword [ebp - 0x30], xmm0
mov byte [ebp - 0x16], 0x33
mov byte [ecx], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
cmp dword [ebp + 8], ebx
jle 0x45c552
push edi
mov al, byte [esi]
cmp al, 0xd
je 0x45c546
cmp al, 0xa
je 0x45c546
movsx eax, al
movsx edi, byte [ebp + eax - 0x90]
movsx eax, byte [esi + 1]
add esi, 2
shl edi, 0x12
movsx eax, byte [ebp + eax - 0x90]
shl eax, 0xc
add edi, eax
mov eax, edi
sar eax, 0x10
push eax
push 1
call fcn.004252f2
mov eax, dword [ebp + 0xc]
inc dword [eax]
mov al, byte [esi]
cmp al, 0x3d
je 0x45c53e
mov ecx, dword [ebp - 0x10]
movsx eax, al
movsx eax, byte [ebp + eax - 0x90]
shl eax, 6
add edi, eax
inc esi
mov eax, edi
sar eax, 8
push eax
push 1
call fcn.004252f2
mov eax, dword [ebp + 0xc]
inc dword [eax]
mov al, byte [esi]
cmp al, 0x3d
je 0x45c53e
mov ecx, dword [ebp - 0x10]
movsx eax, al
movsx eax, byte [ebp + eax - 0x90]
add edi, eax
inc esi
push edi
push 1
call fcn.004252f2
mov eax, dword [ebp + 0xc]
inc dword [eax]
mov ecx, dword [ebp - 0x10]
add ebx, 4
jmp 0x45c548
inc esi
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x45c4a8
pop edi
mov eax, ecx
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x45c972
Capabilities:
Terminate thread

Disassembly:
push 8
push 0x50e200
call fcn.0049e6e0
mov esi, ecx
and dword [ebp - 4], 0
cmp dword [esi + 4], 0
jne 0x45c99b
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call fcn.0044d2d5
pop ecx
pop ecx
mov al, 1
jmp 0x45c9c7
push 1
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
setne bl
test bl, bl
je 0x45c9b3
and dword [esi + 4], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call fcn.0044d2d5
pop ecx
pop ecx
mov al, bl
jmp 0x45c9c7
call fcn.0049e71b
ret
Function at 0x45caf7
Capabilities:
Get common file path
Get startup folder

Disassembly:
mov eax, 0x4a1147
call fcn.0049e6bc
sub esp, 0x2b0
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
xor eax, eax
mov dword [ebp - 0x38], edi
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], ebx
mov word [edi], ax
lea eax, [ebp - 0x2bc]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
xor esi, esi
push 0x1a
inc esi
push ebx
mov dword [ebp - 0x14], esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x45cb75
lea ecx, [ebp - 0x2c]
call fcn.0045ac18
push eax
mov ecx, edi
call fcn.0041eed4
push ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.0041f6b8
push 0xffffffffffffffff
push ecx
push 0x4ca940
mov ecx, edi
call fcn.00424d49
push eax
mov ecx, edi
call fcn.0041f444
jmp 0x45cbb4
cmp word [ebp - 0x2bc], 0
jne 0x45cb83
mov eax, ebx
jmp 0x45cb90
lea eax, [ebp - 0x2bc]
push eax
call fcn.00438238
pop ecx
push eax
lea eax, [ebp - 0x2bc]
mov ecx, edi
push eax
call fcn.0041fba8
mov esi, 0x4ca994
push esi
call fcn.00438238
pop ecx
push eax
push esi
mov ecx, edi
call fcn.004232bf
xor eax, eax
mov dword [ebp - 0x18], 7
mov esi, 0x4ca970
mov dword [ebp - 0x1c], ebx
push esi
mov word [ebp - 0x2c], ax
call fcn.00438238
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.0041fba8
mov dword [ebp - 4], 1
call fcn.0041e77e
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x68]
mov eax, dword [eax + 0x38]
add eax, 0x3c
push eax
call fcn.00423362
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb0]
mov edx, eax
mov dword [esp], 0x4ca96c
call fcn.00425d16
pop ecx
mov esi, eax
mov byte [ebp - 4], 3
call fcn.0041e77e
mov edx, esi
mov ecx, dword [eax + 0x38]
add ecx, 0xe4
push ecx
lea ecx, [ebp - 0x80]
call fcn.00423362
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x50]
mov edx, eax
mov dword [esp], 0x4ca998
call fcn.00425d16
pop ecx
xor esi, esi
lea ecx, [ebp - 0x80]
push ebx
inc esi
push esi
call fcn.0041f6b8
push ebx
push esi
lea ecx, [ebp - 0xb0]
call fcn.0041f6b8
push ebx
push esi
lea ecx, [ebp - 0x68]
call fcn.0041f6b8
push ebx
push esi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 9
call fcn.0041f6b8
sub esp, 0x18
lea eax, [ebp - 0x50]
mov ecx, esp
mov dword [ebp - 0x30], esp
push eax
call fcn.0041ee74
sub esp, 0x18
mov byte [ebp - 4], 0xa
mov ecx, esp
push edi
call fcn.0041ee74
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 9
call fcn.00458f58
add esp, 0x30
lea ecx, [ebp - 0x98]
push ebx
push esi
call fcn.0041f6b8
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x50]
mov ecx, edi
push eax
call fcn.00423219
push ebx
push esi
lea ecx, [ebp - 0x50]
call fcn.0041f6b8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45d156
Capabilities:
Create thread

Disassembly:
push 8
push 0x50e2e0
call fcn.0049e6e0
mov esi, ecx
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 4], edi
je 0x45d180
push 1
call fcn.0045c91b
test al, al
jne 0x45d180
mov ecx, esi
call fcn.0045c972
lea eax, [esi + 0xc]
push eax
push edi
push esi
push 0x45c8d7
push edi
push edi
call fcn.00439167
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
jne 0x45d1ad
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call fcn.0044d2d5
pop ecx
pop ecx
xor al, al
jmp 0x45d1b8
or dword [ebp - 4], 0xffffffff
call fcn.0045d1be
mov al, 1
call fcn.0049e71b
ret

Function at 0x45d286
Capabilities:
Capture screenshot

Disassembly:
mov eax, 0x4a119e
call fcn.0049e6bc
sub esp, 0x130
push ebx
push esi
mov ebx, ecx
mov esi, edx
push edi
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x14], ebx
call fcn.0045a6aa
and dword [ebp - 4], 0
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0x13c], ax
lea eax, [ebp - 0x13a]
push eax
call fcn.00438560
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
call fcn.004396a5
pop ecx
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00438b99
push dword [ebp - 0x70]
mov eax, dword [ebp - 0x60]
push dword [ebp - 0x6c]
inc eax
push dword [ebp - 0x68]
push dword [ebp - 0x64]
push eax
mov eax, dword [ebp - 0x5c]
push 0x64
add eax, 0x76c
pop ecx
cdq
idiv ecx
lea eax, [ebp - 0x13c]
push edx
push esi
push str._s_02d_02d_02d_02d_02d_02d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x2c
cmp word [ebp - 0x13c], 0
jne 0x45d325
xor eax, eax
jmp 0x45d332
lea eax, [ebp - 0x13c]
push eax
call fcn.00438238
pop ecx
push eax
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x44]
call fcn.004232bf
mov esi, str..jpeg
push esi
call fcn.00438238
pop ecx
push eax
push esi
lea ecx, [ebp - 0x44]
call fcn.004232bf
lea eax, [ebp - 0x2c]
xorps xmm0, xmm0
push eax
push ebx
movdqu xmmword [ebp - 0x2c], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [ebp - 0x24]
sub edi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x20]
push dword [ebp - 0x14]
sub ebx, dword [ebp - 0x28]
mov dword [ebp - 0x1c], edi
call dword [sym.imp.USER32.dll_GetDC]
push ebx
mov esi, eax
push edi
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov edi, eax
push esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push edi
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
mov edi, eax
xor eax, eax
push eax
push eax
push esi
push ebx
push dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
push eax
push eax
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
cmp dword [ebp - 0x30], 8
lea edx, [ebp - 0x44]
push ecx
cmovae edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x14]
call fcn.00457d93
pop ecx
push edi
push ebx
mov esi, eax
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.0041f6b8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45d4e5
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov eax, 0x4a11da
call fcn.0049e6bc
sub esp, 0x270
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x278]
push 0x228
push edi
push eax
mov dword [ebp - 0x27c], edi
call fcn.00438560
add esp, 0xc
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x45d666
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x27c], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x45d65f
push 8
pop ebx
lea ecx, [ebp - 0x40]
call fcn.0045ab7f
mov dword [ebp - 4], edi
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], ax
cmp word [ebp - 0x258], ax
jne 0x45d574
mov eax, edi
jmp 0x45d581
lea eax, [ebp - 0x258]
push eax
call fcn.00438238
pop ecx
push eax
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041fba8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], ebx
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
push edx
mov edx, 0x439679
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push eax
push ecx
lea ecx, [ebp - 0x44]
call fcn.00425dba
cmp dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0x40]
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x40]
cmovae edx, dword [ebp - 0x40]
push edx
mov edx, 0x439679
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x40]
push eax
push ecx
lea ecx, [ebp - 0x48]
call fcn.00425dba
add esp, 0x18
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.00425e23
test al, al
je 0x45d62f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [ebp - 0x274]
je 0x45d62f
push dword [ebp - 0x274]
push edi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x45d62f
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.0041f6b8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
push edi
push 1
call fcn.0041f6b8
lea eax, [ebp - 0x27c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x45d54c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45dc4d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [0x52e140]
push edx
movzx ebx, cx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x45dc81
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x45dc81
xor eax, eax
jmp 0x45dcea
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x45dc7d
mov esi, dword [ebp - 8]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push ebx
push eax
call fcn.00435be0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [ebp - 4]
call fcn.0042411f
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45dcf1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4a12e1
call fcn.0049e6bc
sub esp, 0x38
push ebx
push esi
push edi
mov esi, ecx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x45dda9
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push edi
push eax
call fcn.00435be0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [ebp - 0x10]
call fcn.0042411f
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 0x44]
call fcn.00424161
xor ebx, ebx
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
call fcn.004242f4
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esi, dword [ebp - 0x40]
lea ecx, [ebp - 0x44]
or dword [ebp - 0x24], 0xffffffff
xorps xmm0, xmm0
or dword [ebp - 0x20], 0xffffffff
movdqu xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x28], bx
call fcn.004241d5
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret