joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443920
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push esi
lea eax, [esp + 4]
push edi
push eax
xor esi, esi
xor edi, edi
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x443b06
mov eax, dword [esp + 0x18]
sub eax, edi
je 0x443aff
dec eax
je 0x443a64
dec eax
jne 0x443b06
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
and eax, 0xffff
and ecx, 0xffff
shl eax, 0x10
or eax, ecx
mov esi, 1
cmp eax, 0x60000
ja 0x4439d2
je 0x4439cb
cmp eax, 0x50000
ja 0x4439b3
je 0x4439ac
cmp eax, 0x30033
je 0x4439a5
cmp eax, 0x40000
jne 0x443a08
mov esi, 0x81
jmp 0x443a06
mov esi, 0x200001
jmp 0x443a06
mov esi, 0x101
jmp 0x443a06
sub eax, 0x50001
je 0x4439c4
dec eax
jne 0x443a08
mov esi, 0x1001
jmp 0x443a06
mov esi, 0x201
jmp 0x443a06
mov esi, 0x2001
jmp 0x443a06
cmp eax, 0x60003
ja 0x4439fa
je 0x4439f3
sub eax, 0x60001
je 0x4439ec
dec eax
jne 0x443a08
mov esi, 0x40001
jmp 0x443a06
mov esi, 0x4001
jmp 0x443a06
mov esi, 0x80001
jmp 0x443a06
cmp eax, 0xa0000
jne 0x443a08
mov esi, 0x100001
xor edi, edi
lea edx, [esp + 0x1c]
push str.Service_Pack_1
push edx
call fcn.00470ce3
add esp, 8
test eax, eax
je 0x443a21
or edi, 2
lea eax, [esp + 0x1c]
push str.Service_Pack_2
push eax
call fcn.00470ce3
add esp, 8
test eax, eax
je 0x443a3a
or edi, 4
lea ecx, [esp + 0x1c]
push str.Service_Pack_3
push ecx
call fcn.00470ce3
add esp, 8
test eax, eax
je 0x443b06
or edi, 8
mov eax, esi
mov edx, edi
pop edi
pop esi
add esp, 0x94
ret
mov eax, dword [esp + 0xc]
xor edi, edi
cmp eax, 4
mov esi, 2
jne 0x443b06
mov eax, dword [esp + 0x10]
test eax, eax
je 0x443acb
cmp eax, 0xa
je 0x443a9c
cmp eax, 0x5a
jne 0x443b06
mov esi, 0x42
mov edx, edi
mov eax, esi
pop edi
pop esi
add esp, 0x94
ret
cmp byte [esp + 0x1d], 0x41
jne 0x443ab7
xor edi, edi
mov esi, 0x802
mov edx, edi
mov eax, esi
pop edi
pop esi
add esp, 0x94
ret
xor edi, edi
mov esi, 0x22
mov edx, edi
mov eax, esi
pop edi
pop esi
add esp, 0x94
ret
mov al, byte [esp + 0x1d]
cmp al, 0x43
je 0x443aeb
cmp al, 0x42
je 0x443aeb
xor edi, edi
mov esi, 0x12
mov edx, edi
mov eax, esi
pop edi
pop esi
add esp, 0x94
ret
xor edi, edi
mov esi, 0x402
mov edx, edi
mov eax, esi
pop edi
pop esi
add esp, 0x94
ret
mov esi, 4
xor edi, edi
mov edx, edi
mov eax, esi
pop edi
pop esi
add esp, 0x94
ret
Function at 0x444f20
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
lea eax, [esp + 8]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x444f42
pop esi
pop ebx
add esp, 0xc
ret 0x10
push ebp
push edi
push esi
push 0x40
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x445089
push edi
push esi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x445082
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push edx
push str.StringFileInfo040704B0FileVersion
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x444fc9
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
push ecx
push str._u._u
push edx
call fcn.0046fcfa
mov ecx, dword [esp + 0x3c]
add esp, 0x10
test ecx, ecx
je 0x444fb1
mov eax, dword [esp + 0x20]
push eax
call fcn.0043ab50
push edi
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebp
pop edi
pop ebp
pop esi
pop ebx
add esp, 0xc
ret 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push edx
push str.StringFileInfo040904B0FileVersion
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x445028
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
push ecx
push str._u._u
push edx
call fcn.0046fcfa
mov ecx, dword [esp + 0x3c]
add esp, 0x10
test ecx, ecx
je 0x444fb1
mov eax, dword [esp + 0x20]
push eax
call fcn.0043ab50
push edi
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebp
pop edi
pop ebp
pop esi
pop ebx
add esp, 0xc
ret 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
push 0x49409c
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x445082
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x445082
cmp dword [esp + 0x10], 0x34
jne 0x445082
mov eax, dword [ecx + 0x10]
mov edx, dword [esp + 0x24]
shr eax, 0x10
mov dword [edx], eax
xor eax, eax
mov ax, word [ecx + 0x10]
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x445082
mov edx, dword [edx]
push eax
push edx
push str._u._u
push ecx
call fcn.0043bde0
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebp
pop edi
pop ebp
pop esi
pop ebx
add esp, 0xc
ret 0x10
Function at 0x4450a0
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x47fd2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x1c]
call fcn.0043a8f0
mov ebx, dword [esp + 0x164]
xor ebp, ebp
cmp ebx, ebp
mov dword [esp + 0x154], ebp
jne 0x4450f6
lea eax, [esp + 0x48]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
mov ecx, esi
call fcn.00444d80
lea ebx, [esp + 0x48]
lea ecx, [esp + 0x18]
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebp
jne 0x445122
lea ecx, [esp + 0x1c]
mov dword [esp + 0x154], 0xffffffff
call fcn.0043a990
xor eax, eax
jmp 0x4451eb
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebp
je 0x4451d5
push esi
push edi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4451ce
mov edi, dword [esp + 0x160]
lea edx, [esp + 0x1c]
push edi
push str.StringFileInfo040704B0_s
push edx
call fcn.0043bde0
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
push ebp
lea ecx, [esp + 0x28]
call fcn.0043baa0
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x445186
mov edx, dword [esp + 0x10]
push edx
jmp 0x4451bd
push edi
lea eax, [esp + 0x20]
push str.StringFileInfo040904B0_s
push eax
call fcn.0043bde0
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
push ebp
lea ecx, [esp + 0x28]
call fcn.0043baa0
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4451ce
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [esp + 0x160]
call fcn.0043ab50
mov ebp, 1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x154], 0xffffffff
call fcn.0043a990
mov eax, ebp
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret 0xc
Function at 0x446790
Capabilities:
Get geographical location

Disassembly:
push 0xffffffffffffffff
push 0x48002b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x3c]
call fcn.0043a8f0
lea ecx, [esp + 0x10]
mov dword [esp + 0xa0], 0
call fcn.0043a8f0
mov ebx, 1
lea ecx, [esp + 0x68]
mov byte [esp + 0xa0], bl
call fcn.0045c8f0
lea ecx, [esp + 0x10]
mov byte [esp + 0xa0], 2
call fcn.0043bb30
push eax
push 0
lea ecx, [esp + 0x18]
call fcn.0043baa0
push eax
push 0x59
push 0
push ebx
lea ecx, [esp + 0x7c]
call fcn.0045c9f0
and eax, 0xffff
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x446828
lea ecx, [esp + 0x10]
call fcn.0043acd0
jmp 0x446836
push 0x495754
lea ecx, [esp + 0x14]
call fcn.0043ae00
push 0
lea ecx, [esp + 0x14]
call fcn.0043baa0
mov esi, dword [esp + 0xac]
push eax
push esi
lea eax, [esp + 0x44]
push str._s_s
push eax
call fcn.0043bde0
mov edi, dword [esp + 0xc4]
add esp, 0x10
lea ecx, [esp + 0x10]
push edi
push ecx
push 0
lea ecx, [esp + 0x48]
call fcn.0043baa0
mov ebp, dword [esp + 0xb0]
push eax
mov ecx, ebp
call fcn.0045c4f0
cmp eax, ebx
je 0x4468b7
push esi
lea eax, [esp + 0x40]
push str._sen
push eax
call fcn.0043bde0
add esp, 0xc
lea ecx, [esp + 0x10]
push edi
push ecx
push 0
lea ecx, [esp + 0x48]
call fcn.0043baa0
push eax
mov ecx, ebp
call fcn.0045c4f0
cmp eax, ebx
jne 0x446901
mov edx, dword [esp + 0xb0]
lea ecx, [esp + 0x10]
push edx
call fcn.0043bbc0
lea ecx, [esp + 0x68]
mov byte [esp + 0xa0], bl
call fcn.0045c960
lea ecx, [esp + 0x10]
mov byte [esp + 0xa0], 0
call fcn.0043a990
lea ecx, [esp + 0x3c]
mov dword [esp + 0xa0], 0xffffffff
call fcn.0043a990
mov eax, ebx
jmp 0x446938
lea ecx, [esp + 0x68]
mov byte [esp + 0xa0], bl
call fcn.0045c960
lea ecx, [esp + 0x10]
mov byte [esp + 0xa0], 0
call fcn.0043a990
lea ecx, [esp + 0x3c]
mov dword [esp + 0xa0], 0xffffffff
call fcn.0043a990
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x94
ret 0x10
Function at 0x4472c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4800f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0043a8f0
mov eax, dword [esi]
mov dword [esp + 0x38], 0
test eax, eax
jne 0x447315
lea ecx, [esp + 4]
mov dword [esp + 0x38], 0xffffffff
call fcn.0043a990
xor eax, eax
pop esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
push eax
mov eax, dword [esi + 0xc]
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x61757570
lea ecx, [esp + 8]
push str._C_SubClassing_Property__08X
push ecx
call fcn.0043bde0
add esp, 0xc
lea ecx, [esp + 4]
push 0
call fcn.0043baa0
mov edx, dword [esi + 0xc]
push eax
push edx
call dword [sym.imp.USER32.dll_RemovePropA]
lea ecx, [esp + 4]
mov dword [esi], 0
mov dword [esp + 0x38], 0xffffffff
call fcn.0043a990
mov ecx, dword [esp + 0x30]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x44a000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x480208
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0043a8f0
mov eax, dword [esi]
mov dword [esp + 0x38], 0
test eax, eax
jne 0x44a055
lea ecx, [esp + 4]
mov dword [esp + 0x38], 0xffffffff
call fcn.0043a990
xor eax, eax
pop esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
push eax
mov eax, dword [esi + 0xc]
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x62697478
lea ecx, [esp + 8]
push str._C_SubClassing_Property__08X
push ecx
call fcn.0043bde0
add esp, 0xc
lea ecx, [esp + 4]
push 0
call fcn.0043baa0
mov edx, dword [esi + 0xc]
push eax
push edx
call dword [sym.imp.USER32.dll_RemovePropA]
lea ecx, [esp + 4]
mov dword [esi], 0
mov dword [esp + 0x38], 0xffffffff
call fcn.0043a990
mov ecx, dword [esp + 0x30]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x44ad00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4802b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0043a8f0
mov eax, dword [esi]
mov dword [esp + 0x38], 0
test eax, eax
jne 0x44ad55
lea ecx, [esp + 4]
mov dword [esp + 0x38], 0xffffffff
call fcn.0043a990
xor eax, eax
pop esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
push eax
mov eax, dword [esi + 0xc]
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x64656e6f
lea ecx, [esp + 8]
push str._C_SubClassing_Property__08X
push ecx
call fcn.0043bde0
add esp, 0xc
lea ecx, [esp + 4]
push 0
call fcn.0043baa0
mov edx, dword [esi + 0xc]
push eax
push edx
call dword [sym.imp.USER32.dll_RemovePropA]
lea ecx, [esp + 4]
mov dword [esi], 0
mov dword [esp + 0x38], 0xffffffff
call fcn.0043a990
mov ecx, dword [esp + 0x30]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x44cfa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x480429
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea edi, [esi + 0x30]
mov dword [esp + 0x1c], ebx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0044ae80
lea ecx, [edi + 0x2cc]
mov byte [esp + 0x1c], 1
call fcn.0043a8f0
mov dword [edi], 0x4846c8
lea ecx, [esi + 0x328]
mov byte [esp + 0x1c], 2
call fcn.0043a8f0
lea ecx, [esi + 0x358]
mov byte [esp + 0x1c], 3
call fcn.0043f120
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x398], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x394], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x44d0b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48049f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esp + 0x44], 3
call fcn.0044d220
lea ecx, [esi + 0x358]
mov byte [esp + 0x44], 2
call fcn.0043f150
lea ecx, [esi + 0x328]
mov byte [esp + 0x44], 1
call fcn.0043a990
lea edi, [esi + 0x30]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x2cc]
mov byte [esp + 0x44], 4
call fcn.0043a990
mov ecx, edi
mov byte [esp + 0x44], 0
call fcn.0044af30
or edi, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], edi
call fcn.0043a8f0
mov eax, dword [esi]
mov dword [esp + 0x44], 5
test eax, eax
je 0x44d17e
push eax
mov eax, dword [esi + 0xc]
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x62696d75
lea ecx, [esp + 0x14]
push str._C_SubClassing_Property__08X
push ecx
call fcn.0043bde0
add esp, 0xc
lea ecx, [esp + 0x10]
push 0
call fcn.0043baa0
mov edx, dword [esi + 0xc]
push eax
push edx
call dword [sym.imp.USER32.dll_RemovePropA]
mov dword [esi], 0
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], edi
call fcn.0043a990
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x40
ret

Function at 0x44d840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x480518
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0043a8f0
mov eax, dword [esi]
mov dword [esp + 0x38], 0
test eax, eax
jne 0x44d895
lea ecx, [esp + 4]
mov dword [esp + 0x38], 0xffffffff
call fcn.0043a990
xor eax, eax
pop esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
push eax
mov eax, dword [esi + 0xc]
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x62696d75
lea ecx, [esp + 8]
push str._C_SubClassing_Property__08X
push ecx
call fcn.0043bde0
add esp, 0xc
lea ecx, [esp + 4]
push 0
call fcn.0043baa0
mov edx, dword [esi + 0xc]
push eax
push edx
call dword [sym.imp.USER32.dll_RemovePropA]
lea ecx, [esp + 4]
mov dword [esi], 0
mov dword [esp + 0x38], 0xffffffff
call fcn.0043a990
mov ecx, dword [esp + 0x30]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x44e280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4805d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00459a40
lea ebx, [esi + 8]
xor edi, edi
mov ecx, ebx
mov dword [esp + 0x18], edi
call fcn.00459a40
push str.kernel32.dll
mov ecx, esi
mov byte [esp + 0x1c], 1
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
call fcn.00459a70
push 0x495948
mov ecx, ebx
call fcn.00459a70
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x44e380
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x480608
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call fcn.0043a8f0
mov eax, dword [esi + 0x10]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x3c], edi
jne 0x44e3c5
push str.RegisterApplicationRestart
mov ecx, esi
call fcn.00459b10
cmp eax, edi
mov dword [esi + 0x10], eax
je 0x44e42c
mov eax, dword [esp + 0x44]
cmp eax, 0xffffffff
jne 0x44e3fc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [esp + 0xc]
call fcn.0043c190
push eax
lea ecx, [esp + 0xc]
call fcn.0043ae00
lea ecx, [esp + 8]
call fcn.0043b1c0
lea ecx, [esp + 8]
call fcn.0043b160
jmp 0x44e406
push eax
lea ecx, [esp + 0xc]
call fcn.0043ae00
push edi
lea ecx, [esp + 0xc]
call fcn.0043baa0
mov eax, dword [esp + 0x48]
lea ecx, [esp + 8]
push eax
push edi
call fcn.0043bb40
push eax
call dword [esi + 0x10]
test eax, eax
jl 0x44e42c
mov edi, 1
lea ecx, [esp + 8]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0043a990
mov ecx, dword [esp + 0x34]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8

Function at 0x451180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x480a88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0043a8f0
mov eax, dword [esi]
mov dword [esp + 0x38], 0
test eax, eax
jne 0x4511d5
lea ecx, [esp + 4]
mov dword [esp + 0x38], 0xffffffff
call fcn.0043a990
xor eax, eax
pop esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
add esp, 0x38
ret
push eax
mov eax, dword [esi + 0xc]
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x64697669
lea ecx, [esp + 8]
push str._C_SubClassing_Property__08X
push ecx
call fcn.0043bde0
add esp, 0xc
lea ecx, [esp + 4]
push 0
call fcn.0043baa0
mov edx, dword [esi + 0xc]
push eax
push edx
call dword [sym.imp.USER32.dll_RemovePropA]
lea ecx, [esp + 4]
mov dword [esi], 0
mov dword [esp + 0x38], 0xffffffff
call fcn.0043a990
mov ecx, dword [esp + 0x30]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x4519e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484718
push 0x470d64
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor edx, edx
mov dword [ebp - 4], edx
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x54], 0x3c
cmp dword [ebp + 0x18], 1
mov eax, str.runas
je 0x451a2c
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x50], edx
lea edx, [ebp - 0x54]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
mov dword [ebp - 4], 0xffffffff
je 0x451a87
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x451b30
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x480d33
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd4
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x20]
call fcn.00451240
xor ebx, ebx
lea ecx, [esp + 0x74]
mov dword [esp + 0xec], ebx
call fcn.0043a8f0
mov eax, dword [esp + 0x114]
mov esi, dword [esp + 0xf4]
mov ebp, 1
mov byte [esp + 0xec], 1
cmp eax, ebp
je 0x451c7f
cmp esi, ebx
je 0x451c7f
push str..exe
push esi
call fcn.00470ce3
add esp, 8
test eax, eax
jne 0x451c7f
mov edx, dword [esp + 0xf8]
mov ecx, 0x11
lea edi, [esp + 0xa0]
push edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], eax
mov cx, word [esp + 0x104]
mov dword [esp + 0x18], eax
push esi
mov dword [esp + 0x20], eax
push str.__s___s
mov dword [esp + 0x28], eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0xb0], 0x44
mov word [esp + 0xe0], cx
mov dword [esp + 0xdc], ebp
call fcn.0043bde0
mov eax, dword [esp + 0x10c]
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0xa0]
push ecx
push edx
push eax
push ebx
push 0x200
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x98]
call fcn.0043baa0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x451c6b
lea ecx, [esp + 0x74]
mov byte [esp + 0xec], bl
call fcn.0043a990
lea ecx, [esp + 0x20]
mov dword [esp + 0xec], 0xffffffff
call fcn.00451270
xor eax, eax
jmp 0x451d7a
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x10]
jmp 0x451d01
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x110]
mov dword [esp + 0x38], 0x3c
cmp eax, ebp
mov dword [esp + 0x44], str.runas
je 0x451caf
mov dword [esp + 0x44], str.open
mov edx, dword [esp + 0xf8]
mov eax, dword [esp + 0x100]
mov ecx, dword [esp + 0xfc]
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x104]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x38]
or edx, 0x40
push eax
mov dword [esp + 0x4c], esi
mov dword [esp + 0x54], ecx
mov dword [esp + 0x40], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x451c40
mov esi, dword [esp + 0x70]
cmp esi, ebx
je 0x451c40
push ebx
push esi
lea ecx, [esp + 0x28]
call fcn.004513c0
mov eax, dword [esp + 0x10c]
push ebx
cmp eax, ebp
jne 0x451d25
push 0xffffffffffffffff
lea ecx, [esp + 0x28]
call fcn.00451500
jmp 0x451d31
push ebx
push 0xffffffffffffffff
lea ecx, [esp + 0x2c]
call fcn.00451440
lea ecx, [esp + 0x20]
call fcn.004513e0
mov eax, dword [esp + 0x108]
cmp eax, ebx
je 0x451d4d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x74]
mov byte [esp + 0xec], bl
call fcn.0043a990
lea ecx, [esp + 0x20]
mov dword [esp + 0xec], 0xffffffff
call fcn.00451270
mov eax, ebp
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xe0
ret 0x24