joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4350a3
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.00422125
push 0
mov edx, 0xe776a8
mov dword [ebp - 0x264], eax
mov ecx, eax
call fcn.005b48ad
pop ecx
push eax
lea ecx, [ebp - 0x26c]
call fcn.0042784f
lea ecx, [ebp - 0x2c8]
call fcn.0043526b
mov edx, dword [ebp - 0x26c]
lea ecx, [ebp - 0x260]
push 0xffffffffffffffff
call fcn.005b47cf
pop ecx
lea ecx, [ebp - 0x258]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x43523a
test byte [ebp - 0x258], 0x10
jne 0x435149
push 0xffffffffffffffff
lea edx, [ebp - 0x22c]
xor ecx, ecx
call fcn.005b0c60
pop ecx
mov dword [ebp - 0x25c], eax
lea ecx, [ebp - 0x2c8]
lea eax, [ebp - 0x25c]
push eax
call fcn.004354ee
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x435118
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ecx
push ecx
lea ecx, [ebp - 0x320]
call fcn.0042a507
lea eax, [ebp - 0x320]
push eax
call fcn.00434d73
mov esi, dword [ebp - 0x310]
xor edi, edi
mov eax, dword [ebp - 0x31c]
lea ebx, [esi + eax*4]
jmp 0x4351e3
mov eax, edi
inc edi
cmp eax, 0x14
jg 0x4351e7
mov ecx, dword [esi]
mov ecx, dword [ecx]
call fcn.00434fc8
test eax, eax
je 0x4351e0
push 0xffffffffffffffff
mov ecx, eax
call fcn.005b4856
mov edx, eax
lea ecx, [ebp - 0x260]
call fcn.005b47cf
pop ecx
push 0
lea ecx, [ebp - 0x2c8]
push dword [eax]
call fcn.00434f93
test eax, eax
js 0x4351e0
push eax
lea ecx, [ebp - 0x2c8]
call fcn.004354b3
push eax
call fcn.00702f96
pop ecx
add esi, 4
cmp esi, ebx
jne 0x43518e
mov edi, dword [ebp - 0x2b8]
mov eax, dword [ebp - 0x2c4]
lea ebx, [edi + eax*4]
jmp 0x43522b
mov edx, dword [edi]
lea ecx, [ebp - 0x260]
push 0xffffffffffffffff
call fcn.005b471e
pop ecx
mov ecx, dword [ebp - 0x264]
push 0
mov edx, dword [eax]
call fcn.005b48ad
pop ecx
mov esi, eax
mov ecx, esi
call fcn.005b54cc
push esi
call fcn.00702f96
pop ecx
add edi, 4
cmp edi, ebx
jne 0x4351f8
lea ecx, [ebp - 0x320]
call fcn.00421c7c
lea ecx, [ebp - 0x2c8]
call fcn.00435514
lea ecx, [ebp - 0x2c8]
call fcn.00421c7c
push dword [ebp - 0x26c]
call fcn.00702f96
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
Function at 0x4371ae
Capabilities:
Bypass mark of the web
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
push edi
push str.CopySelfToDir__s__n
call fcn.005b3a54
lea ecx, [ebp - 0x10]
call fcn.005b6ca0
push 0
push str.SumatraPDF.exe
mov edx, edi
lea ecx, [ebp - 0x18]
call fcn.005b4ae7
mov edx, dword [ebp - 0x10]
push 0
mov esi, dword [eax]
mov ecx, esi
call fcn.005b5512
add esp, 0x14
lea ecx, [ebp - 8]
mov edx, esi
mov bl, al
push 0xffffffffffffffff
call fcn.005b471e
pop ecx
mov ecx, dword [ebp - 8]
mov edx, str.:Zone.Identifier
push 0
push 0
call fcn.005b0f7a
pop ecx
pop ecx
push eax
lea ecx, [ebp - 8]
call fcn.0042784f
push dword [ebp - 4]
lea ecx, [ebp - 0x18]
push dword [ebp - 8]
call fcn.005b4817
pop ecx
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 8]
call fcn.00702f96
pop ecx
push edi
push dword [ebp - 0x10]
test bl, bl
jne 0x437254
push str.__failed_to_copy__s_to_dir__s_n
call fcn.005b3a54
add esp, 0xc
xor al, al
jmp 0x437263
push str.__copied__s_to_dir__s_n
call fcn.005b3a54
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x438694
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push 0x30
lea eax, [ebp - 0x30]
push 0
push eax
call fcn.006f59b0
add esp, 0xc
lea ecx, [ebp - 0x30]
mov edx, str.SUMATRA_PDF_INSTALLER_FRAME
push 0x438565
call fcn.005b641f
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 1
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
movzx esi, ax
test si, si
sete cl
call fcn.00420997
test si, si
jne 0x4386fe
push str.CreateInstallerWindow:_RegisterClassExW___failed_n
call fcn.005b3949
pop ecx
xor al, al
jmp 0x438749
call fcn.00438497
mov ecx, eax
mov dword [0xefc0dc], ecx
test ecx, ecx
je 0x4386fa
mov eax, dword [0xefd4f4]
mov dword [eax], ecx
push dword [0xe73398]
mov ecx, dword [0xefc0d0]
call fcn.00438fad
pop ecx
mov ecx, dword [0xefd4f4]
xor edx, edx
mov ecx, dword [ecx]
call fcn.005b75f7
mov ecx, dword [0xefd4f4]
push 5
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
pop esi
leave
ret
Function at 0x439207
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x438], ebx
push edi
mov edi, edx
test esi, esi
je 0x4392eb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
je 0x4392eb
test edi, edi
jne 0x43924c
test ebx, ebx
je 0x4392eb
push esi
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x439260
xor bl, bl
jmp 0x4392d7
push 0x424
xor ebx, ebx
lea eax, [ebp - 0x430]
push ebx
push eax
call fcn.006f59b0
add esp, 0xc
mov dword [ebp - 0x434], 0x428
lea eax, [ebp - 0x434]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x4392cf
test edi, edi
je 0x4392a6
lea edx, [ebp - 0x214]
mov ecx, edi
call fcn.005b4d60
test al, al
jne 0x4392d5
mov eax, dword [ebp - 0x438]
test eax, eax
je 0x4392c1
lea edx, [ebp - 0x214]
mov ecx, eax
call fcn.005b4d60
test al, al
jne 0x4392d5
lea eax, [ebp - 0x434]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x439291
jmp 0x4392d7
mov bl, 1
test esi, esi
je 0x4392e7
cmp esi, 0xffffffff
je 0x4392e7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x4392ed
xor al, al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret

Function at 0x43951b
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
push 8
mov edi, edx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x4395a1
cmp esi, 0xffffffff
je 0x4395a1
push 0x424
xor ebx, ebx
lea eax, [ebp - 0x42c]
push ebx
push eax
call fcn.006f59b0
add esp, 0xc
mov dword [ebp - 0x430], 0x428
lea eax, [ebp - 0x430]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32FirstW]
jmp 0x439597
lea edx, [ebp - 0x210]
mov ecx, edi
call fcn.005b4d60
test al, al
jne 0x43959d
lea eax, [ebp - 0x430]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x439578
jmp 0x4395ae
mov al, 1
jmp 0x4395a3
xor al, al
mov bl, al
test esi, esi
je 0x4395b5
cmp esi, 0xffffffff
je 0x4395b5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
Function at 0x4395c6
Capabilities:
Enumerate processes
Find taskbar
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x244
mov eax, dword [0xee37e4]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push esi
mov eax, ecx
lea ecx, [esp + 0xc]
push edi
push 0xffffffffffffffff
mov edx, eax
mov dword [esp + 0x10], eax
call fcn.005b471e
pop ecx
push dword [esp + 0x10]
push str.KillProcessesWithModule:__s_n
call fcn.005b3949
pop ecx
pop ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4396ea
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4396ea
xor ebx, ebx
mov edi, dword [esp + 0x20]
mov ecx, edi
mov edx, dword [esp + 0xc]
call fcn.0043951b
test al, al
je 0x4396b2
push dword [esp + 0xc]
push edi
push str.KillProcWithIdAndModule___processId_d__modulePath_s_n
call fcn.005b3a54
add esp, 0xc
push edi
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4396b2
cmp edi, 0xffffffff
je 0x4396b2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x43968e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4396b2
push 0x2710
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x20]
push str.__killed_process_with_id__d_n
call fcn.005b3949
pop ecx
pop ecx
inc ebx
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x43963a
test ebx, ebx
jle 0x4396ed
push str.Shell_TrayWnd
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, dword [sym.imp.USER32.dll_UpdateWindow]
push eax
call edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
jmp 0x4396ed
or ebx, 0xffffffff
test esi, esi
je 0x4396fd
cmp esi, 0xffffffff
je 0x4396fd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x24c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.006f3e28
mov esp, ebp
pop ebp
ret
Function at 0x439714
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x21
push str.KillProcessesUsingInstallation___n
call fcn.005b37b7
pop ecx
pop ecx
call fcn.00438fc7
mov edi, eax
mov dword [ebp - 0x250], edi
test edi, edi
je 0x439901
mov ecx, edi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x439754
sub ecx, edx
sar ecx, 1
je 0x439901
push ebx
mov edx, str.libmupdf.dll
mov ecx, edi
call fcn.005b4b63
pop ecx
push ebx
mov edx, str.npPdfViewer.dll
mov dword [ebp - 0x248], eax
mov ecx, edi
call fcn.005b4b63
pop ecx
push ebx
push 2
mov dword [ebp - 0x244], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4398e7
push 0x228
lea eax, [ebp - 0x234]
mov byte [ebp - 0x240], 1
push ebx
push eax
call fcn.006f59b0
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4398d6
mov edi, dword [ebp - 0x230]
mov ecx, edi
push dword [ebp - 0x244]
mov edx, dword [ebp - 0x248]
mov dword [ebp - 0x24c], edi
call fcn.00439207
pop ecx
test al, al
je 0x4398b0
lea eax, [ebp - 0x214]
push eax
push edi
push str.__attempting_to_kill_process__d__s_n
call fcn.005b3a54
add esp, 0xc
push edi
push str.KillProcWithId_processId_d__n
call fcn.005b3949
pop ecx
pop ecx
push edi
push ebx
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x439877
cmp edi, 0xffffffff
je 0x439877
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x439860
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov byte [ebp - 0x239], al
jmp 0x43987f
push 0x2710
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x439858
mov al, bl
mov byte [ebp - 0x239], bl
movzx eax, al
push eax
push dword [ebp - 0x24c]
push str.__KillProcWithId__d__returned__d_n
call fcn.005b3949
mov eax, dword [ebp - 0x240]
xor ecx, ecx
add esp, 0xc
movzx eax, al
cmp byte [ebp - 0x239], cl
cmove eax, ecx
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4397e1
mov edi, dword [ebp - 0x250]
mov bl, byte [ebp - 0x240]
test esi, esi
je 0x4398e7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x244]
call fcn.00702f96
pop ecx
push dword [ebp - 0x248]
call fcn.00702f96
pop ecx
jmp 0x439903
mov bl, 1
push edi
call fcn.00702f96
pop ecx
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
Function at 0x43991b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1d
push str.ProcessesUsingInstallation___n
call fcn.005b37b7
pop ecx
pop ecx
call fcn.00438fc7
mov edi, eax
mov dword [ebp - 0x248], edi
test edi, edi
je 0x439a6e
mov ecx, edi
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x43995b
sub ecx, edx
sar ecx, 1
je 0x439a6e
push esi
mov edx, str.libmupdf.dll
mov ecx, edi
call fcn.005b4b63
pop ecx
mov ebx, eax
mov edx, str.npPdfViewer.dll
push esi
mov ecx, edi
mov dword [ebp - 0x23c], ebx
call fcn.005b4b63
pop ecx
push esi
push 2
mov dword [ebp - 0x240], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x439a5b
push 0x228
lea eax, [ebp - 0x234]
push 0
push eax
call fcn.006f59b0
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x439a50
mov edi, ebx
mov ebx, dword [ebp - 0x230]
mov edx, edi
push dword [ebp - 0x240]
mov ecx, ebx
call fcn.00439207
pop ecx
test al, al
je 0x439a28
push ebx
lea eax, [ebp - 0x214]
push eax
push str._s___d_
call fcn.005b24d2
add esp, 0xc
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x244]
mov ecx, 0xef52c8
push eax
call fcn.004354ee
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x22c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4399e2
mov edi, dword [ebp - 0x248]
mov ebx, dword [ebp - 0x23c]
test esi, esi
je 0x439a5b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x240]
call fcn.00702f96
pop ecx
push ebx
call fcn.00702f96
pop ecx
push edi
call fcn.00702f96
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
Function at 0x442118
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push esi
push str.GetDirSize__s__n
call fcn.005b3a54
xor edi, edi
mov edx, 0xe7a724
push edi
mov ecx, esi
call fcn.005b4b63
add esp, 0xc
mov ebx, eax
lea eax, [ebp - 0x258]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x44219a
mov ecx, dword [ebp - 0x258]
mov eax, ecx
shr eax, 4
test al, 1
jne 0x442181
shr ecx, 7
test cl, 1
je 0x442181
add edi, dword [ebp - 0x238]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x442164
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call fcn.00702f96
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
Function at 0x442efc
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp byte [edi + 0xef5a94], 0
jne 0x44305a
mov esi, dword [edi + 0xef5a88]
mov eax, dword [edi + 0xef5a8c]
mov ebx, dword [edi + 0xef5a90]
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionPreviewHandlers
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionPreviewHandlers
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push esi
push str.SoftwareClassesCLSID_s
call fcn.005b24d2
mov esi, eax
lea edx, [ebp - 4]
mov ecx, esi
call fcn.00442ec9
push dword [ebp - 0xc]
push str.SoftwareClasses_s_shellexe357fccd_a995_4576_b01f_234630154e96
call fcn.005b24d2
push esi
mov dword [ebp - 8], eax
call fcn.00702f96
mov ecx, dword [ebp - 8]
lea edx, [ebp - 4]
add esp, 0x14
call fcn.00442ec9
test ebx, ebx
je 0x442fb2
push ebx
push str.SoftwareClasses_s_shellexe357fccd_a995_4576_b01f_234630154e96
call fcn.005b24d2
push dword [ebp - 8]
mov esi, eax
call fcn.00702f96
add esp, 0xc
mov dword [ebp - 8], esi
lea edx, [ebp - 4]
mov ecx, esi
call fcn.00442ec9
push dword [ebp - 0xc]
push str.SoftwareClasses_s_shellexbb2e617c_0920_11d1_9a0b_00c04fc2d6c1
call fcn.005b24d2
push dword [ebp - 8]
mov esi, eax
mov dword [ebp - 0x10], esi
call fcn.00702f96
add esp, 0xc
lea edx, [ebp - 4]
mov ecx, esi
call fcn.00442ec9
test ebx, ebx
je 0x443002
push ebx
push str.SoftwareClasses_s_shellexbb2e617c_0920_11d1_9a0b_00c04fc2d6c1
call fcn.005b24d2
push dword [ebp - 0x10]
mov esi, eax
call fcn.00702f96
add esp, 0xc
mov dword [ebp - 0x10], esi
lea edx, [ebp - 4]
mov ecx, esi
call fcn.00442ec9
push dword [ebp - 0xc]
push str.SoftwareClasses_s_shellex8895b1c6_b41f_4c1c_a562_0d564250836f
call fcn.005b24d2
push dword [ebp - 0x10]
mov esi, eax
mov dword [ebp - 0xc], esi
call fcn.00702f96
add esp, 0xc
lea edx, [ebp - 4]
mov ecx, esi
call fcn.00442ec9
test ebx, ebx
je 0x443053
push ebx
push str.SoftwareClasses_s_shellex8895b1c6_b41f_4c1c_a562_0d564250836f
call fcn.005b24d2
mov esi, eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00702f96
add esp, 0xc
mov dword [ebp - 0xc], esi
lea edx, [ebp - 4]
mov ecx, esi
call fcn.00442ec9
push esi
call fcn.00702f96
pop ecx
add edi, 0x10
cmp edi, 0x70
jb 0x442f0a
cmp dword [ebp - 4], 0
pop edi
pop esi
sete al
pop ebx
leave
ret
Function at 0x443268
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push 0x100
xor ebx, ebx
push ebx
push 0xefcdc8
call fcn.006f59b0
push 0x1c0
push ebx
push 0xefcee4
mov dword [0xefcec8], ebx
call fcn.006f59b0
add esp, 0x18
mov eax, 0xefcef8
mov edx, 0xffff
push 8
pop ecx
and dword [eax - 8], ebx
mov dword [eax - 0x14], ebx
mov dword [eax - 0x10], ebx
mov dword [eax - 0xc], ebx
mov dword [eax - 4], 0xffffffff
mov word [eax], dx
lea eax, [eax + 0x38]
and dword [eax - 0x34], ebx
and dword [eax - 0x30], ebx
and dword [eax - 0x2c], ebx
and dword [eax - 0x28], ebx
mov byte [eax - 0x24], bl
mov dword [eax - 0x20], ebx
mov dword [eax - 0x1c], ebx
mov dword [eax - 0x18], ebx
sub ecx, 1
jne 0x4432a3
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
mov dword [0xefd0a4], ebx
mov dword [0xefd0a8], ebx
mov dword [0xefd0c4], ebx
call edi
push 1
mov esi, eax
call edi
push 0x1000
mov dword [0xefd0c8], esi
mov dword [0xefd0cc], eax
mov byte [0xefd0d0], bl
mov dword [0xefd0d4], ebx
mov dword [0xefd0d8], ebx
mov dword [0xefd0dc], ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
test eax, eax
push 0xefcecc
setne byte [0xefd0d0]
mov dword [0xefd0d4], ebx
mov dword [0xefd0d8], 0xffffff
call esi
push 0xefd0ac
call esi
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
mov esi, 0xefcdc8
mov dword [0xefd0dc], eax
push esi
push 0x4444dc
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0xefd0c4], eax
sete cl
call fcn.00420997
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x445acf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov byte [ebp - 5], dl
mov ebx, ecx
push edi
mov dl, 1
call fcn.00445a91
mov ecx, dword [ebp + 8]
call fcn.005b22d2
test al, al
jne 0x445b75
push 0x1c
call fcn.006f40bd
mov edx, dword [ebp + 8]
mov edi, eax
mov al, byte [ebp - 5]
pop ecx
xor ecx, ecx
mov byte [edi + 9], cl
push 0xffffffffffffffff
mov dword [edi], 0xe7c134
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], ecx
mov dword [edi + 4], ebx
mov byte [edi + 8], al
mov dword [ebp - 0xc], ecx
call fcn.005b0c60
pop ecx
mov dword [ebp - 0x10], eax
lea ecx, [edi + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.0042787a
push dword [ebp - 0x10]
call fcn.00702f96
mov al, byte [ebp + 0xc]
pop ecx
push dword [ebp + 0x10]
mov ecx, edi
mov byte [edi + 9], al
call fcn.0044554c
xor eax, eax
push eax
push eax
push edi
push 0x445895
push eax
push eax
mov dword [ebx + 0x208], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x208], eax
mov dword [edi + 0x18], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x447a2b
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x58]
mov eax, dword [edi + 0x88]
cmp dword [eax + 4], 0
jne 0x447a52
cmp dword [esi + 0x130], 4
je 0x447a52
mov cl, 1
jmp 0x447a54
xor cl, cl
call fcn.00420997
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x447b38
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, esi
call fcn.00462c67
mov ebx, eax
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
mov edx, 0xe76934
push eax
mov ecx, edi
call fcn.0044791d
pop ecx
mov esi, eax
mov ecx, esi
call fcn.005b22d2
test al, al
jne 0x447aa1
mov dl, 1
call fcn.005b770f
push esi
call fcn.00702f96
cmp byte [ebp - 1], 0
pop ecx
jne 0x447b32
test ebx, ebx
je 0x447b32
mov esi, dword [edi + 0x88]
test esi, esi
je 0x447b32
cmp dword [esi + 4], 0
je 0x447b32
xor cl, cl
call fcn.00420997
xor eax, eax
cmp eax, dword [esi + 4]
sbb cl, cl
inc cl
call fcn.00420997
mov esi, dword [esi + 0x10]
mov ecx, ebx
push dword [esi]
call fcn.0042c971
mov ecx, dword [ebx + 0x6c]
lea edx, [ebp - 0x1c]
mov eax, dword [esi]
and dword [ebp - 8], 0
mov dword [ebp - 0x1c], eax
lea eax, [esi + 4]
movss dword [ebp - 0x18], xmm0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 2
mov ecx, dword [ebx + 0x1c]
push edx
mov eax, dword [ecx]
call dword [eax + 0x10]
mov esi, eax
test esi, esi
je 0x447b32
mov ecx, dword [esi]
call fcn.005b7799
mov ecx, esi
call fcn.005b63be
push 0x10
push esi
call fcn.006f3e3b
pop ecx
pop ecx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x448219
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 8]
push esi
push edi
push eax
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [edi]
mov ecx, edi
push esi
mov eax, dword [eax + 0x4c]
call eax
test al, al
jne 0x44824f
push esi
push str.Error:_failed_to_load_page__d_n
call fcn.005b3a54
pop ecx
pop ecx
jmp 0x4482d1
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00420fef
movsd qword [esp], xmm0
push esi
push str.pageload____3d:__.2f_ms_n
call fcn.005b3a54
add esp, 0x10
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
xorps xmm0, xmm0
mov dword [ebp - 0x20], esi
push ecx
mov ecx, edi
mov dword [ebp - 0x1c], 0x3f800000
movups xmmword [ebp - 0x18], xmm0
call dword [eax + 0x10]
mov edi, eax
test edi, edi
jne 0x4482a1
push esi
push str.Error:_failed_to_render_page__d_n
jmp 0x448243
mov ecx, edi
call fcn.005b63be
push 0x10
push edi
call fcn.006f3e3b
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00420fef
add esp, 8
movsd qword [esp], xmm0
push esi
push str.pagerender__3d:__.2f_ms_n
call fcn.005b3a54
add esp, 0x10
pop edi
pop esi
leave
ret
Function at 0x4482d5
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push edi
push eax
mov edi, ecx
call esi
push edi
push str.Starting:__s_n
call fcn.005b3a54
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
call esi
xor edx, edx
mov ecx, edi
call fcn.00429061
mov esi, eax
test esi, esi
jne 0x44831c
push edi
push str.Error:_failed_to_load__s_n
call fcn.005b3a54
pop ecx
pop ecx
jmp 0x448363
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00420fef
movsd qword [esp], xmm0
push 0xe7c308
call fcn.005b3a54
mov eax, dword [esi]
add esp, 0xc
mov ecx, esi
push 1
call dword [eax]
push edi
push ecx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00420fef
movsd qword [esp + 4], xmm0
mov dword [esp], str.Finished__in__.2f_ms_:__s_n
call fcn.005b3a54
add esp, 0x10
pop edi
pop esi
leave
ret