joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439a80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x5655bc]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x228], 0
mov word [ebp - 0x440], 0
push 0x206
push 0
lea eax, [ebp - 0x43e]
push eax
call fcn.00463a20
add esp, 0xc
mov word [ebp - 0x220], 0
push 0x206
push 0
lea ecx, [ebp - 0x21e]
push ecx
call fcn.00463a20
add esp, 0xc
mov dword [ebp - 0x10], 0x104
mov dword [ebp - 0x444], 1
lea edx, [ebp - 0x14]
push edx
push 0x20019
push 0
push str.htmlfile
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x439b53
xor eax, eax
jmp 0x439c47
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push 0
push str.shell
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x439b86
xor eax, eax
jmp 0x439c47
lea edx, [ebp - 0x234]
push edx
push 0x20019
push 0
push str.opencommand
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x439bbc
xor eax, eax
jmp 0x439c47
mov dword [ebp - 0x228], 0x104
mov dword [ebp - 0xc], 1
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x440]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x517a84
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x440]
push ecx
call fcn.0046911b
add esp, 4
mov dword [ebp - 0x224], eax
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x224]
push eax
call fcn.00414ea0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x439c42
xor eax, eax
jmp 0x439c47
mov eax, 1
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00463a0b
mov esp, ebp
pop ebp
ret

Function at 0x439da0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfe0
mov eax, dword [0x5655bc]
xor eax, ebp
mov dword [ebp - 0x40], eax
push 0x7d0
lea eax, [ebp - 0xfe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Program_FilesInternet_Exploreriexplore.exe
lea ecx, [ebp - 0xfd4]
push ecx
call fcn.0046587f
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0xfe0]
push eax
call fcn.00465855
add esp, 8
push 0x3c
push 0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00463a20
add esp, 0xc
mov dword [ebp - 0x30], 0x517b30
mov dword [ebp - 0x38], 0x200
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 1
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x517b3c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x439e42
lea ecx, [ebp - 0xfe0]
push ecx
call fcn.00439ef0
add esp, 4
mov ecx, dword [ebp - 0x40]
xor ecx, ebp
call fcn.00463a0b
mov esp, ebp
pop ebp
ret
Function at 0x439e80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 8]
push eax
call fcn.00463db7
add esp, 4
test eax, eax
jne 0x439e98
jmp 0x439eeb
push 0x3c
push 0
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00463a20
add esp, 0xc
mov dword [ebp - 0x30], 0x517b48
mov dword [ebp - 0x38], 0x200
mov edx, dword [ebp + 8]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 1
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x439eeb
mov ecx, dword [ebp + 8]
push ecx
call fcn.00439ef0
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x439ef0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x5655bc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
push 0
lea eax, [ebp - 0x830]
push eax
call fcn.00463a20
add esp, 0xc
mov dword [ebp - 0x830], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x7e8]
push ecx
call fcn.00463a20
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x517b60
lea eax, [ebp - 0x7d8]
push eax
call fcn.00466a1b
add esp, 0xc
lea ecx, [ebp - 0x7e8]
push ecx
lea edx, [ebp - 0x830]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x7d8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x439f7a
jmp 0x439f94
mov ecx, dword [ebp - 0x7e8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x7e4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00463a0b
mov esp, ebp
pop ebp
ret

Function at 0x439fb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x5655bc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
push 0
lea eax, [ebp - 0x830]
push eax
call fcn.00463a20
add esp, 0xc
mov dword [ebp - 0x830], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x7e8]
push ecx
call fcn.00463a20
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x517b68
lea eax, [ebp - 0x7d8]
push eax
call fcn.00466a1b
add esp, 0xc
lea ecx, [ebp - 0x7e8]
push ecx
lea edx, [ebp - 0x830]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x7d8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x43a03c
xor al, al
jmp 0x43a058
mov ecx, dword [ebp - 0x7e8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x7e4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00463a0b
mov esp, ebp
pop ebp
ret
Function at 0x43a230
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x65c
mov eax, dword [0x5655bc]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jne 0x43a250
xor eax, eax
jmp 0x43a3a7
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00463a20
add esp, 0xc
mov word [ebp - 0x420], 0
push 0x206
push 0
lea ecx, [ebp - 0x41e]
push ecx
call fcn.00463a20
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.0046587f
add esp, 8
lea ecx, [ebp - 0x210]
push ecx
call fcn.0046933e
add esp, 4
mov dword [ebp - 0x424], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x658], 0
push 0x228
push 0
lea edx, [ebp - 0x654]
push edx
call fcn.00463a20
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x43a306
xor eax, eax
jmp 0x43a3a7
mov dword [ebp - 0x658], 0x22c
lea eax, [ebp - 0x658]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x43a398
lea edx, [ebp - 0x634]
push edx
lea eax, [ebp - 0x420]
push eax
call fcn.0046587f
add esp, 8
lea ecx, [ebp - 0x420]
push ecx
call fcn.0046933e
add esp, 4
mov dword [ebp - 0x65c], eax
mov edx, dword [ebp - 0x424]
push edx
mov eax, dword [ebp - 0x65c]
push eax
call fcn.00466b39
add esp, 8
test eax, eax
jne 0x43a381
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x650]
jmp 0x43a3a7
lea edx, [ebp - 0x658]
push edx
mov eax, dword [ebp - 0x214]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43a327
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00463a0b
mov esp, ebp
pop ebp
ret
Function at 0x43ac50
Capabilities:
Check if file exists
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x5655bc]
xor eax, ebp
mov dword [ebp - 8], eax
mov word [ebp - 0x418], 0
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00463a20
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00463a20
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.0046587f
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x210]
push edx
call fcn.0046587f
add esp, 8
lea eax, [ebp - 0x418]
push eax
call fcn.0046911b
add esp, 4
lea ecx, [ebp - 0x210]
push ecx
call fcn.0046911b
add esp, 4
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.00466b39
add esp, 8
test eax, eax
jne 0x43ad04
jmp 0x43ae2b
mov dword [ebp - 4], 0
mov dword [ebp - 0x41c], 0
mov ecx, 1
test ecx, ecx
je 0x43ae1d
mov word [ebp - 0x628], 0
push 0x206
push 0
lea edx, [ebp - 0x626]
push edx
call fcn.00463a20
add esp, 0xc
cmp dword [ebp - 0x41c], 0
jne 0x43ad64
mov eax, dword [ebp + 0xc]
push eax
push str._s.bak
lea ecx, [ebp - 0x628]
push ecx
call fcn.00466a1b
add esp, 0xc
jmp 0x43ad83
mov edx, dword [ebp - 0x41c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x517bd8
lea ecx, [ebp - 0x628]
push ecx
call fcn.00466a1b
add esp, 0x10
lea edx, [ebp - 0x628]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43ada1
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x628]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004693a7
add esp, 8
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43aded
push 5
push 0
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x43ae1d
push 5
push 0
lea ecx, [ebp - 0x628]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [ebp - 0x41c], 0xa
jl 0x43ae09
jmp 0x43ae2b
mov edx, dword [ebp - 0x41c]
add edx, 1
mov dword [ebp - 0x41c], edx
jmp 0x43ad15
push 5
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00463a0b
mov esp, ebp
pop ebp
ret
Function at 0x43af90
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x5655bc]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43afb6
jmp 0x43b148
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43afce
jmp 0x43b148
mov word [ebp - 0x210], 0
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.00463a20
add esp, 0xc
mov word [ebp - 0x420], 0
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.00463a20
add esp, 0xc
lea ecx, [ebp - 0x420]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0043a6b0
add esp, 8
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x424], 0
mov ecx, 1
test ecx, ecx
je 0x43b148
mov dword [ebp - 0x428], 1
mov word [ebp - 0x630], 0
push 0x206
push 0
lea edx, [ebp - 0x62e]
push edx
call fcn.00463a20
add esp, 0xc
cmp dword [ebp - 0x424], 0
jne 0x43b0a8
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x420]
push ecx
push str._s_s.del
lea edx, [ebp - 0x630]
push edx
call fcn.00466a1b
add esp, 0x10
jmp 0x43b0d1
mov eax, dword [ebp - 0x424]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x420]
push edx
push str._s_s.del_d
lea eax, [ebp - 0x630]
push eax
call fcn.00466a1b
add esp, 0x14
lea ecx, [ebp - 0x630]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43b0f5
lea edx, [ebp - 0x630]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x43b11d
cmp dword [ebp - 0x424], 0xa
jl 0x43b109
jmp 0x43b148
mov eax, dword [ebp - 0x424]
add eax, 1
mov dword [ebp - 0x424], eax
jmp 0x43b045
lea ecx, [ebp - 0x630]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004693a7
add esp, 8
push 5
push 0
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x43b148
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00463a0b
mov esp, ebp
pop ebp
ret
Function at 0x43b4c0
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x5655bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x600], 0
push 0x206
push 0
lea eax, [ebp - 0x5fe]
push eax
call fcn.00463a20
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x600]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea edx, [ebp - 0x600]
push edx
call fcn.0040cc70
add esp, 8
mov word [eax + 2], 0
mov dword [ebp - 0x814], 0x1f4
mov word [ebp - 0x3f0], 0
push 0x3e6
push 0
lea eax, [ebp - 0x3ee]
push eax
call fcn.00463a20
add esp, 0xc
lea ecx, [ebp - 0x600]
push ecx
push str._sxxxx.log
lea edx, [ebp - 0x808]
push edx
call fcn.00466a1b
add esp, 0xc
push str.c:log_
push str._slog.txt
lea eax, [ebp - 0x808]
push eax
call fcn.00466a1b
add esp, 0xc
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x80c], ecx
mov edx, dword [ebp - 0x80c]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x814]
sub ecx, 1
push ecx
lea edx, [ebp - 0x3f0]
push edx
call fcn.00469580
add esp, 0x10
mov eax, dword [ebp - 0x814]
mov word [ebp + eax*2 - 0x3f2], 0
mov dword [ebp - 0x810], 0
lea ecx, [ebp - 0x808]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43b5dc
mov dword [ebp - 0x810], 1
push 0x517d10
lea edx, [ebp - 0x808]
push edx
call fcn.0046949b
add esp, 8
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0
je 0x43b6ba
cmp dword [ebp - 0x810], 0
jne 0x43b62f
mov word [ebp - 0x820], 0xfeff
mov eax, dword [ebp - 0x3f4]
push eax
push 2
push 1
lea ecx, [ebp - 0x820]
push ecx
call fcn.00465a10
add esp, 0x10
lea edx, [ebp - 0x3f0]
push edx
call fcn.00463db7
add esp, 4
mov dword [ebp - 0x818], eax
mov eax, dword [ebp - 0x3f4]
push eax
mov ecx, dword [ebp - 0x818]
shl ecx, 1
push ecx
push 1
lea edx, [ebp - 0x3f0]
push edx
call fcn.00465a10
add esp, 0x10
mov word [ebp - 0x81c], 0xd
mov eax, dword [ebp - 0x3f4]
push eax
push 2
push 1
lea ecx, [ebp - 0x81c]
push ecx
call fcn.00465a10
add esp, 0x10
mov word [ebp - 0x81c], 0xa
mov edx, dword [ebp - 0x3f4]
push edx
push 2
push 1
lea eax, [ebp - 0x81c]
push eax
call fcn.00465a10
add esp, 0x10
mov ecx, dword [ebp - 0x3f4]
push ecx
call fcn.0046639b
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00463a0b
mov esp, ebp
pop ebp
ret

Function at 0x43cca0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x68], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x43e130
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
cmp eax, 0xb7
setne dl
mov eax, dword [ebp - 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x43e420
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add eax, 0x14
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x43e780
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x43e456
jmp 0x43e473
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 0xffffffff
jne 0x43e461
jmp 0x43e473
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
mov esp, ebp
pop ebp
ret

Function at 0x43e480
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add eax, 0x14
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x43e7a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x18], 0
jne 0x43e4b6
jmp 0x43e4d3
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x18], 0xffffffff
jne 0x43e4c1
jmp 0x43e4d3
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
mov esp, ebp
pop ebp
ret

Function at 0x463a0b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5655bc]
jne 0x463a15
repz ret
jmp fcn.0046e13c
Function at 0x472c63
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x565d30]
je 0x472c7e
inc edi
cmp edi, 0x17
jb 0x472c6f
cmp edi, 0x17
jae 0x472dfe
push ebp
push 3
call fcn.0047a0d8
cmp eax, 1
pop ecx
je 0x472dca
push 3
call fcn.0047a0d8
test eax, eax
pop ecx
jne 0x472cb2
cmp dword [0x565768], 1
je 0x472dca
cmp ebx, 0xfc
je 0x472dfd
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x56b280
push ebp
call fcn.0046e3b2
add esp, 0xc
test eax, eax
je 0x472ce8
push esi
push esi
push esi
push esi
push esi
call fcn.00463aee
add esp, 0x14
push 0x104
mov esi, 0x56b299
push esi
push 0
mov byte [0x56b39d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x472d2c
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0046e3b2
add esp, 0xc
test eax, eax
je 0x472d2c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00463aee
add esp, 0x14
push esi
call fcn.00463e30
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x472d71
push esi
call fcn.00463e30
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x56b594
push 0x51afe4
sub ecx, eax
push ecx
push eax
call fcn.004778dc
add esp, 0x14
test eax, eax
je 0x472d71
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00463aee
add esp, 0x14
jmp 0x472d73
xor esi, esi
push 0x51b678
push ebx
push ebp
call fcn.0047786b
add esp, 0xc
test eax, eax
je 0x472d93
push esi
push esi
push esi
push esi
push esi
call fcn.00463aee
add esp, 0x14
push dword [edi*8 + 0x565d34]
push ebx
push ebp
call fcn.0047786b
add esp, 0xc
test eax, eax
je 0x472db5
push esi
push esi
push esi
push esi
push esi
call fcn.00463aee
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0047e49c
add esp, 0xc
jmp 0x472dfd
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x472dfd
cmp ebp, 0xffffffff
je 0x472dfd
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x565d34]
push dword [esi]
call fcn.00463e30
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x479e3a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0046dad0
xor ebx, ebx
cmp dword [0x56b6bc], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x479f10
push 0x51c868
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x479ff0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x51c85c
push edi
call esi
cmp eax, ebx
je 0x479ff0
push eax
call fcn.0046da62
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x56b6bc], eax
call esi
push eax
call fcn.0046da62
mov dword [esp], 0x51c838
push edi
mov dword [0x56b6c0], eax
call esi
push eax
call fcn.0046da62
mov dword [0x56b6c4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0046ca6c
test eax, eax
pop ecx
pop ecx
je 0x479ede
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00463aee
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x479f10
push str.GetUserObjectInformationW
push edi
call esi
push eax
call fcn.0046da62
cmp eax, ebx
pop ecx
mov dword [0x56b6cc], eax
je 0x479f10
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0046da62
pop ecx
mov dword [0x56b6c8], eax
mov eax, dword [0x56b6c8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x479f95
cmp dword [0x56b6cc], ecx
je 0x479f95
push eax
call fcn.0046dad9
push dword [0x56b6cc]
mov esi, eax
call fcn.0046dad9
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x479f95
cmp edi, ebx
je 0x479f95
call esi
cmp eax, ebx
je 0x479f62
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x479f62
test byte [ebp - 0x18], 1
jne 0x479f95
lea eax, [ebp - 0x10]
push eax
call fcn.0046caa3
test eax, eax
pop ecx
je 0x479f7d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00463aee
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x479f8c
or dword [ebp + 0x10], 0x200000
jmp 0x479fd0
or dword [ebp + 0x10], 0x40000
jmp 0x479fd0
mov eax, dword [0x56b6c0]
cmp eax, dword [ebp - 8]
je 0x479fd0
push eax
call fcn.0046dad9
cmp eax, ebx
pop ecx
je 0x479fd0
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x479fd0
mov eax, dword [0x56b6c4]
cmp eax, dword [ebp - 8]
je 0x479fd0
push eax
call fcn.0046dad9
cmp eax, ebx
pop ecx
je 0x479fd0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x56b6bc]
call fcn.0046dad9
cmp eax, ebx
pop ecx
je 0x479ff0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x479ff2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret