joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452510
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 0x70d], 0
je 0x452596
cmp dword [edi + 0x1b0], 0
je 0x45255d
push esi
push 1
push edi
call fcn.004457a0
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1b0]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.004457a0
add esp, 0x24
mov eax, esi
pop esi
pop edi
ret
mov eax, dword [esp + 0xc]
cmp eax, 2
ja 0x452596
push dword [edi + 0x148]
lea eax, [eax + eax*2]
push 1
add eax, 0x4a12b8
push 2
push eax
call fcn.0047dd05
push dword [edi + 0x148]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call fcn.0047dd05
add esp, 0x20
xor eax, eax
pop edi
ret

Function at 0x4528e0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x104
mov eax, dword [0x4c8044]
xor eax, esp
mov dword [esp + 0x100], eax
mov ecx, dword [esp + 0x10c]
push ebx
push ebp
mov ebp, dword [esp + 0x110]
push esi
mov esi, dword [esp + 0x124]
push edi
mov eax, dword [ebp + 0xc]
mov edi, dword [esp + 0x120]
push ecx
push eax
mov ebx, dword [eax + ecx*4 + 0x148]
push ebp
call fcn.00452d50
add esp, 0xc
test eax, eax
je 0x452938
mov dword [esi], 0x1b
or eax, 0xffffffff
jmp 0x45299d
push 0
push dword [esp + 0x128]
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov dword [esi], 0
cmp edi, 0xffffffff
jne 0x45299b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2733
jne 0x452970
xor edi, edi
mov dword [esi], 0x51
jmp 0x45299b
push 0x100
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00444770
push eax
push str.Send_failure:__s
push ebp
call fcn.004525a0
mov dword [ebp + 0x954], ebx
add esp, 0x18
mov dword [esi], 0x37
mov eax, edi
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004705e8
add esp, 0x104
ret

Function at 0x452d50
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push ebx
push esi
lea esi, [edx + 0x17]
mov eax, dword [ecx + 0x298]
mov ebx, dword [ecx + edx*4 + 0x148]
shl esi, 4
add esi, ecx
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x44], 3
je 0x452e05
cmp dword [ecx + edx*4 + 0x160], 0x452800
jne 0x452e05
cmp dword [esi], 0
je 0x452d96
test edi, edi
je 0x452e05
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.00460010
add esp, 0x14
cmp eax, 0xffffffff
je 0x452e05
test al, 1
je 0x452e05
cmp dword [esi], 0
jne 0x452dee
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x4e8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [section..data]
add esp, 4
mov dword [esi], eax
test eax, eax
jne 0x452ddd
pop edi
pop esi
mov eax, 0x1b
pop ebx
ret
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi]
add eax, dword [esi + 8]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x452e05
add dword [esi + 8], eax
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x4531b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x188
mov eax, dword [0x4c8044]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
mov ebx, dword [esp + 0x190]
lea eax, [esp + 8]
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [esp + 0x1a4]
push 0x80
push 0
push eax
mov dword [esp + 0x18], 0x80
call fcn.00471a50
add esp, 0xc
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x1a4]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x453237
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push esi
call fcn.00444770
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x453278
push edi
push esi
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
call fcn.00452e10
add esp, 0x10
test al, al
jne 0x453281
call fcn.00478641
mov esi, eax
call fcn.00478641
mov edi, eax
lea eax, [esp + 0x90]
push 0x100
push eax
push dword [esi]
call fcn.00444770
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.004525a0
add esp, 0x1c
mov ecx, dword [esp + 0x190]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004705e8
add esp, 0x188
ret

Function at 0x453a30
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
mov eax, dword [0x4ca124]
mov dword [esp + 4], 0x4020
mov dword [esp], 0
mov dword [esp + 8], 4
test eax, eax
jne 0x453a81
push 3
push 2
push eax
push eax
push 6
call fcn.00468550
add esp, 0x14
test al, al
je 0x453a75
mov dword [0x4ca124], 2
add esp, 0xc
ret
mov dword [0x4ca124], 1
jmp 0x453a86
cmp eax, 2
je 0x453acc
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x453ab1
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jg 0x453acc
push 4
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 0xc
ret
Function at 0x454740
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x18
mov eax, dword [0x4c8044]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
xor eax, eax
push edi
mov edi, dword [esp + 0x28]
push 4
cmp byte [esi + 0x71b], al
setne al
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4547a0
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d
push esi
call fcn.00452670
add esp, 0xc
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.004705e8
add esp, 0x18
ret
push dword [esi + 0x6b8]
mov dword [esp + 0x14], 1
call fcn.004549c0
push dword [esi + 0x6bc]
imul eax, eax, 0x3e8
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], eax
call fcn.004549c0
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0xc
lea eax, [esp + 0x28]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x454817
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d
push esi
call fcn.00452670
add esp, 0x10
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.004705e8
add esp, 0x18
ret

Function at 0x454830
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x108
mov eax, dword [0x4c8044]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
lea eax, [esp + 4]
push 4
push eax
push 1
push 6
push dword [esp + 0x124]
mov dword [esp + 0x18], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x454895
push 0x100
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00444770
push eax
push str.Could_not_set_TCP_NODELAY:__s
push esi
call fcn.00452670
add esp, 0x18
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.004705e8
add esp, 0x108
ret
Function at 0x454a00
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push 0x4a16e8
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x454a1a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x4a1704
push esi
call fcn.0047ed50
add esp, 8
test eax, eax
je 0x454a62
test ebp, ebp
je 0x454a53
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x454a88
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x454a88
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x454b3f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x454aa5
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x454b35
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x454b35
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x454ad7
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x454af0
sub ecx, edx
add ecx, ebx
sub ecx, esi
lea ecx, [ecx]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x454b00
test ebp, ebp
je 0x454b2c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x4c8004]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x4c8004]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x46a770
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x120
mov eax, dword [0x4c8044]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebx
push ebp
mov ebp, dword [esp + 0x134]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x138]
xor esi, esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], edi
call fcn.0048761d
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x46a7e8
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00444860
push eax
push edi
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push ebp
call fcn.004525a0
add esp, 0x1c
lea esi, [ebx + 0x4d]
jmp 0x46a927
push 0
push 0x80
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x18], eax
cmp eax, 0xffffffff
jne 0x46a83a
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00444860
push eax
push edi
push str.schannel:_failed_to_open_CA_file__s:__s
push ebp
call fcn.004525a0
add esp, 0x1c
mov esi, 0x4d
jmp 0x46a927
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x46a87a
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00444860
push eax
push edi
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
push ebp
call fcn.004525a0
add esp, 0x1c
mov esi, 0x4d
jmp 0x46a91d
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x28], ebx
jl 0x46a8a8
jg 0x46a88e
cmp edi, 0x100000
jbe 0x46a8a8
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push ebp
call fcn.004525a0
add esp, 0xc
mov esi, 0x4d
jmp 0x46a91d
lea eax, [edi + 1]
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x46a8c0
lea esi, [eax + 0x1b]
jmp 0x46a91d
test edi, edi
je 0x46a904
jmp 0x46a8d0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x46a965
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46a95d
add esi, eax
cmp esi, edi
jb 0x46a8d0
mov byte [edi + ebx], 0
push ebp
push dword [esp + 0x14]
push edi
push ebx
push dword [esp + 0x2c]
call fcn.0046a570
add esp, 0x14
mov esi, eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [0x4c8004]
mov eax, dword [esp + 0x24]
add esp, 4
test eax, eax
je 0x46a942
push eax
call fcn.00474b43
add esp, 4
mov ecx, dword [esp + 0x12c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004705e8
add esp, 0x120
ret
mov edi, esi
mov byte [esi + ebx], 0
jmp 0x46a908
push 0x100
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00444860
push eax
push dword [esp + 0x20]
push str.schannel:_failed_to_read_from_CA_file__s:__s
push ebp
call fcn.004525a0
add esp, 0x1c
mov esi, 0x4d
jmp 0x46a91d
Function at 0x41b13e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.004ac8b0
mov dword [esp], 0xc8
mov dword [esp + 4], 0x96
push 0
call fcn.004977a1
mov ebx, eax
push 0
call fcn.00497ab8
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 8], ebx
push 0
call fcn.00497810
mov ebx, eax
push 0
call fcn.00497b35
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp + 4]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 0xc], ebx
push 0x80000004
push dword [0x2249a4c]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x5d
call fcn.004971ec
push 0xb
push 0x64
call fcn.004a5866
push eax
push 0x1a
push 0xaa
push 0xf
push 0xf
push 0x60
call fcn.00491810
push 0xb
push 0x62
call fcn.004a5866
push eax
push 0x1a
push 0xaa
push 0x2d
push 0xf
push 0x5e
call fcn.00491810
push 0xb
push 0x63
call fcn.004a5866
push eax
push 0x1a
push 0xaa
push 0x4b
push 0xf
push 0x5f
call fcn.00491810
push dword [0x2249b7c]
push 0x14
push 0xaa
push 0x78
push 0xf
push 0x61
call fcn.0048f076
call fcn.0043f3d5
call fcn.004971e4
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x41b332
call fcn.0049ac65
push eax
mov ebx, 0x5d
cmp ebx, dword [esp]
jne 0x41b32f
push dword [esp + 0x20]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x41b32e
call fcn.0049ac56
push eax
mov ebx, 0x60
cmp ebx, dword [esp]
jne 0x41b2fc
mov eax, 0x53ac1e
push eax
call fcn.0046db32
add esp, 0xc
jmp 0x41b389
mov ebx, 0x5e
cmp ebx, dword [esp]
jne 0x41b30d
add esp, 0xc
jmp 0x41b389
mov ebx, 0x5f
cmp ebx, dword [esp]
jne 0x41b31e
add esp, 0xc
jmp 0x41b389
mov ebx, 0x61
cmp ebx, dword [esp]
jne 0x41b32d
add esp, 0xc
jmp 0x41b389
pop eax
pop eax
pop eax
jmp 0x41b33c
push 0x5d
call fcn.004971c6
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x41b360
call fcn.00497b43
mov ebx, eax
cmp ebx, 0x5d
jne 0x41b360
call fcn.0043f3d5
jmp 0x41b389
push 0xd
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x41b384
call fcn.00497b43
mov ebx, eax
cmp ebx, 0x5d
jne 0x41b384
call fcn.0043f3d5
jmp 0x41b389
jmp 0x41b2a9
push 0x5d
call fcn.00496f76
xor eax, eax
add esp, 0x10
pop edi
pop ebx
ret 4
Function at 0x44a059
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.004ac8b0
mov dword [esp], 0
jmp 0x44a06c
mov eax, dword [esp + 0x10]
cmp eax, dword [esp]
jl 0x44a125
push 0
call fcn.004970a7
and eax, eax
je 0x44a11c
mov dword [esp + 4], 0xffffffff
call fcn.004500e4
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
and ebx, ebx
jle 0x44a0eb
call fcn.0049ac65
push eax
mov ebx, dword [0x2249b9c]
cmp ebx, dword [esp]
jne 0x44a0c6
push dword [esp + 8]
call fcn.00448bd0
mov ebx, eax
and ebx, ebx
jne 0x44a0c4
jmp 0x44a0e8
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x44a0de
push dword [esp + 8]
call fcn.0043c081
mov ebx, eax
and ebx, ebx
jne 0x44a0dc
jmp 0x44a0e8
push 3
call fcn.00496f55
pop eax
jmp 0x44a0f5
push 5
call fcn.00496f55
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x44a112
mov dword [0x2249b50], 1
jmp 0x44a11c
mov dword [0x2249b50], 0
inc dword [esp]
jno 0x44a06c
xor eax, eax
add esp, 8
pop ebx
ret 4
Function at 0x44f4e1
Capabilities:
Query environment variable

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.004ac8b0
push dword [esp + 0x1c]
call fcn.00452470
mov edx, dword [esp + 0x18]
lea ecx, [esp]
call fcn.00452000
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac710
pop edx
push eax
push 0x3e8
call fcn.004aa170
call fcn.004ac840
lea eax, [esp + 8]
push eax
call fcn.004ac750
push 0x3e8
mov eax, dword [esp + 8]
push eax
mov eax, 0x54672c
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov edx, 0x5360c4
lea ecx, [esp + 8]
call fcn.00452008
push edx
call fcn.004ac710
pop edx
push eax
push 0xe
mov edx, dword [esp + 0xc]
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac7e0
mov edx, 0x54348c
push edx
call fcn.004ac7e0
call fcn.004ac840
push edx
call fcn.004ac710
pop edx
push eax
mov edx, 0x53d68c
push edx
call fcn.004ac7e0
mov edx, dword [esp + 0x10]
push edx
call fcn.004ac7e0
call fcn.004ac840
mov edx, dword [esp + 0x14]
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac7e0
mov edx, 0x53bb3a
push edx
call fcn.004ac7e0
call fcn.00452452
add dword [esp], edx
call fcn.00452452
add dword [esp + 4], edx
call fcn.00452452
add dword [esp + 8], edx
call fcn.0046d5e4
call fcn.00452470
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x44f66f
push dword [esp + 0xc]
call fcn.0046dd10
and eax, eax
je 0x44f666
push dword [esp + 0xc]
call fcn.0046dd57
and eax, eax
je 0x44f664
mov edx, dword [esp + 8]
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac7e0
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac710
pop edx
push eax
push 0x18
push dword [esp + 0x20]
call fcn.0046dd7d
call fcn.00452452
add dword [esp], edx
call fcn.00429b3d
pop eax
mov edx, 0x54c0c0
push edx
call fcn.004ac7e0
lea eax, [esp + 0xc]
push eax
call fcn.004ac750
jmp 0x44f5ef
push dword [esp + 0xc]
call fcn.0046ddb6
mov edx, dword [esp + 8]
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac7e0
pop eax
push eax
call fcn.00452440
pop edx
add eax, edx
jmp 0x44f697
push dword [esp]
call fcn.004ac910
push dword [esp + 4]
call fcn.004ac910
push dword [esp + 8]
call fcn.004ac910
add esp, 0x10
pop ebx
ret 4
Function at 0x4501b4
Capabilities:
Delete registry key

Disassembly:
push ebx
mov edx, 7
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4501ba
call fcn.004ac8b0
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.00452000
mov edx, dword [esp + 0x28]
lea ecx, [esp + 4]
call fcn.00452000
push dword [esp]
call fcn.0045033b
push dword [esp + 4]
mov edx, 0x5375de
pop ecx
call fcn.00452400
je 0x450289
cmp dword [0x2249c78], 0
je 0x45026f
mov eax, 0x536c8a
push eax
push 0xffffffff
call fcn.0048e5e0
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x45026d
mov eax, 0x546556
push eax
push dword [esp + 0xc]
call fcn.0048e63a
mov dword [esp + 0xc], eax
push 0
mov ebx, dword [0x2249c7c]
or ebx, 0xf003f
push ebx
mov eax, dword [0x2249c6c]
push eax
push dword [0x2249c74]
push dword [esp + 0x1c]
call fcn.0048e696
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.0048e520
jmp 0x450284
mov eax, dword [0x2249c6c]
push eax
push dword [0x2249c74]
call sub.ADVAPI32.dll_RegDeleteKeyW
mov dword [esp + 0x10], eax
jmp 0x450312
lea eax, [esp + 0x18]
push eax
push dword [0x2249c74]
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x2249c78], 0
je 0x4502ff
mov eax, 0x536c8a
push eax
push 0xffffffff
call fcn.0048e5e0
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4502fd
push 0
mov ebx, dword [0x2249c7c]
or ebx, 0xf003f
push ebx
mov eax, dword [0x2249c6c]
push eax
push dword [esp + 0x24]
mov eax, 0x546556
push eax
push dword [esp + 0x1c]
call fcn.0048e6f3
mov dword [esp + 0x10], eax
push dword [esp + 8]
call fcn.0048e520
jmp 0x450312
mov eax, dword [0x2249c6c]
push eax
push dword [esp + 0x1c]
call sub.ADVAPI32.dll_RegDeleteKeyW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x450321
mov eax, 1
jmp 0x450323
xor eax, eax
push dword [esp + 4]
call fcn.004ac910
push dword [esp]
call fcn.004ac910
add esp, 0x1c
pop ebx
ret 8
Function at 0x45053d
Capabilities:
Get graphical window text

Disassembly:
push ebx
xor eax, eax
push eax
call fcn.004ac8b0
push dword [esp + 0xc]
call fcn.00452470
mov ebx, dword [0x2249cb4]
and ebx, ebx
jne 0x450579
push 0
push 0
call sub.USER32.dll_FindWindowW
mov dword [0x2249cb8], eax
mov dword [0x2249cb4], 1
jmp 0x45058e
push 2
push dword [0x2249cb8]
call sub.USER32.dll_GetWindow
mov dword [0x2249cb8], eax
mov ebx, dword [0x2249cb8]
and ebx, ebx
je 0x450628
push 0xfffffff0
push dword [0x2249cb8]
call sub.USER32.dll_GetWindowLongW
mov ebx, eax
and ebx, 0x10000000
cmp ebx, 0x10000000
jne 0x450626
push 0xffffffec
push dword [0x2249cb8]
call sub.USER32.dll_GetWindowLongW
mov ebx, eax
and ebx, 0x80
cmp ebx, 0x80
je 0x450626
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac710
pop edx
push eax
push 0x100
call fcn.004aa170
lea eax, [esp + 4]
push eax
call fcn.004ac750
push 0x100
push dword [esp + 4]
push dword [0x2249cb8]
call sub.USER32.dll_GetWindowTextW
push dword [esp]
mov edx, 0x5360c4
pop ecx
call fcn.00452400
jne 0x450626
jmp 0x450640
jmp 0x450632
mov dword [0x2249cb4], 0
mov ebx, dword [0x2249cb8]
and ebx, ebx
jne 0x45054f
mov edx, dword [esp]
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac7e0
pop eax
push eax
call fcn.00452440
pop edx
add eax, edx
jmp 0x450667
push dword [esp]
call fcn.004ac910
add esp, 4
pop ebx
ret

Function at 0x450674
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
mov edx, 0x19
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x45067b
call fcn.004ac8b0
mov edx, dword [esp + 0x70]
lea ecx, [esp]
call fcn.00452000
lea eax, [esp + 4]
lea eax, [esp + 0x48]
lea ebp, [esp + 4]
mov dword [ebp], 0x44
mov dword [ebp + 0x2c], 1
mov ebx, dword [esp + 0x74]
and ebx, 2
and ebx, ebx
je 0x4506ca
lea ebp, [esp + 4]
mov word [ebp + 0x30], 0
jmp 0x4506d4
lea ebp, [esp + 4]
mov word [ebp + 0x30], 1
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
push 0
call sub.KERNEL32.dll_CreateProcessW
mov dword [esp + 0x58], eax
cmp dword [esp + 0x58], 0
je 0x45075d
mov ebx, dword [esp + 0x74]
and ebx, 1
and ebx, ebx
je 0x450754
lea ebp, [esp + 0x48]
push dword [ebp + 4]
pop eax
mov dword [esp + 0x5c], eax
push 1
call fcn.00496f55
lea eax, [esp + 0x60]
push eax
push dword [esp + 0x60]
call sub.KERNEL32.dll_GetExitCodeThread
mov ebx, dword [esp + 0x60]
cmp ebx, 0x103
je 0x450752
jmp 0x450754
jmp 0x45072c
lea ebp, [esp + 0x48]
mov eax, dword [ebp]
jmp 0x45075f
xor eax, eax
push dword [esp]
call fcn.004ac910
add esp, 0x64
pop ebx
pop ebp
ret 8