joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433368
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x462872
call fcn.0045e340
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x46b264
lea ecx, [esi + 0xc]
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
call fcn.004022d0
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004022d0
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.004022d0
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi], 0x46b3b4
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4333ca
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x4628a5
call fcn.0045e340
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 3
call fcn.004132d7
push dword [esi + 0x24]
call fcn.00402b73
push dword [esi + 0x18]
call fcn.00402b73
push dword [esi + 0xc]
call fcn.00402b73
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi], 0x46b29c
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x436376
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x462e29
call fcn.0045e340
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004022d0
and dword [ebp - 4], 0
lea ecx, [esi + 0xc]
call fcn.004022d0
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004022d0
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.004022d0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.004022d0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x436597
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x462eed
call fcn.0045e340
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00402407
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.00402407
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00402407
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.00402407
add edi, 0x30
lea ecx, [esi + 0x30]
push edi
mov byte [ebp - 4], 3
call fcn.00402407
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x436f3c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x436f64
xor al, al
leave
ret
cmp dword [ebp - 0x104], 2
jne 0x436f60
cmp dword [ebp - 0x110], 5
jb 0x436f60
jbe 0x436f7c
mov al, 1
leave
ret
cmp dword [ebp - 0x10c], 1
jb 0x436f60
seta al
leave
ret
Function at 0x4370c1
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x4631b0
call fcn.0045e340
sub esp, 0x58
mov ecx, 0x47e838
call fcn.00409848
mov byte [0x47e840], al
call fcn.004372df
test al, al
jne 0x4370f8
mov ecx, str.Unsupported_Windows_version
call fcn.0043709f
push 1
pop eax
jmp 0x4372d1
push esi
call fcn.0045d9d0
call fcn.0043b4f9
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov ecx, str.comctl32.dll
call fcn.00437315
cmp eax, 0x40047
mov dword [0x47e80c], eax
sbb al, al
inc al
mov byte [0x47e0cc], al
call fcn.00437549
xor esi, esi
mov ecx, 0xc8
push esi
mov edx, ecx
call fcn.00409afa
neg al
sbb al, al
push esi
inc al
mov byte [0x47e843], al
call dword [sym.imp.ole32.dll_OleInitialize]
lea ecx, [ebp - 0x30]
call fcn.004022d0
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], esi
call fcn.004022d0
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00402332
lea eax, [ebp - 0x30]
lea edx, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.004523ad
push dword [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.00402b73
pop ecx
lea ecx, [ebp - 0x30]
call fcn.0040287e
lea ecx, [ebp - 0x30]
call fcn.00402833
lea ecx, [ebp - 0x24]
call fcn.004022d0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.004022d0
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.004523ad
lea ecx, [ebp - 0x24]
call fcn.0040287e
lea ecx, [ebp - 0x24]
call fcn.00402833
lea ecx, [ebp - 0x18]
call fcn.0040287e
lea ecx, [ebp - 0x18]
call fcn.00402833
mov ecx, dword [ebp - 0x18]
mov edx, 0x46bb78
call fcn.0040192c
test al, al
je 0x43720b
mov eax, dword [ebp - 0x18]
mov ecx, 0x47e810
add eax, 4
push eax
call fcn.00402473
cmp dword [ebp - 0x20], esi
je 0x43721e
lea eax, [ebp - 0x24]
mov ecx, 0x47e820
push eax
call fcn.004024d7
call fcn.00437592
call fcn.004375c4
mov ecx, 0x47e478
call fcn.0042fa81
mov ecx, dword [ebp + 8]
call fcn.0043737b
test eax, eax
je 0x4372ab
push ebx
push edi
push 0x48
push dword [0x47e830]
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
mov ebx, eax
push esi
push esi
lea eax, [ebp - 0x64]
push esi
push eax
call edi
test eax, eax
je 0x437295
lea eax, [ebp - 0x64]
push eax
push ebx
push dword [0x47e82c]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x43728c
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
lea eax, [ebp - 0x64]
push esi
push eax
jmp 0x43725d
call fcn.00423fcc
mov dword [0x47e82c], esi
call dword [sym.imp.ole32.dll_OleUninitialize]
mov esi, dword [ebp - 0x5c]
pop edi
pop ebx
push dword [ebp - 0x18]
call fcn.00402b73
push dword [ebp - 0x24]
call fcn.00402b73
push dword [ebp - 0x48]
call fcn.00402b73
push dword [ebp - 0x30]
call fcn.00402b73
add esp, 0x10
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4375c4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
and byte [0x47e84e], 0
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x43760d
cmp dword [ebp - 0x104], 2
jne 0x43760d
cmp dword [ebp - 0x110], 6
jb 0x43760d
mov byte [0x47e84e], 1
call fcn.0043760f
leave
ret

Function at 0x437ab9
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x463241
call fcn.0045e340
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
or dword [esi + 0x18], 0xffffffff
or dword [esi + 0x20], 0xffffffff
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
mov byte [esi + 0x1c], bl
mov byte [esi + 0x1d], bl
call fcn.004022d0
or dword [esi + 0x3c], 0xffffffff
or dword [esi + 0x40], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], ebx
mov byte [esi + 0x34], bl
mov byte [esi + 0x35], bl
mov dword [esi + 0x38], ebx
mov dword [esi], 0x46bc44
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x43b7fb
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x463938
call fcn.0045e340
sub esp, 0x28
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp si, ax
jne 0x43b8d9
mov ecx, eax
xor edi, edi
shr ax, 0xa
and ecx, 0x3ff
mov esi, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
movzx ecx, cx
lea edx, [ebp - 0x1c]
mov dword [ebp - 4], edi
call fcn.0043b907
lea ecx, [ebp - 0x34]
call fcn.0043b4b3
mov byte [ebp - 4], 1
mov dword [ebp - 0x10], edi
movzx ebx, si
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
not eax
and eax, ebx
cmp eax, dword [ebp - 0x18]
jae 0x43b8bb
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ecx + eax*4]
cmp dword [esi + 4], edi
je 0x43b8bb
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x28]
push eax
call fcn.00402407
push dword [esi]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00402732
lea ecx, [ebp - 0x28]
push str..txt
call fcn.00402732
mov edx, dword [ebp - 0x28]
mov ecx, 0x47e870
call fcn.0043b4a7
test al, al
jne 0x43b8e8
push dword [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00402b73
pop ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jb 0x43b85b
push dword [ebp - 0x34]
call fcn.00402b73
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x1c]
call fcn.004132d7
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
push dword [esi]
mov ecx, 0x47e890
call fcn.004025d5
push dword [ebp - 0x28]
call fcn.00402b73
push dword [ebp - 0x34]
call fcn.00402b73
pop ecx
jmp 0x43b8cc
Function at 0x43d003
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp ecx, 0x44c
jb 0x43d070
push esi
push ecx
mov ecx, dword [0x47e484]
imul ecx, ecx, 0x168
add ecx, 0x47e4ec
call fcn.0044ccec
mov eax, dword [0x47e484]
mov esi, eax
imul esi, esi, 0x168
add esi, 0x47e63c
mov ecx, dword [esi]
test ecx, ecx
je 0x43d04f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [esi], 0
mov eax, dword [0x47e484]
imul eax, eax, 0x168
add eax, 0x47e640
mov esi, eax
mov eax, dword [esi]
test eax, eax
je 0x43d06b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esi], 0
mov al, 1
pop esi
leave
ret
mov eax, 0x224
cmp ecx, eax
ja 0x43d1b4
je 0x43d183
add eax, 0xfffffff9
cmp ecx, eax
ja 0x43d0e7
je 0x43d0e0
sub ecx, 0x65
je 0x43d0d9
dec ecx
je 0x43d0d2
dec ecx
je 0x43d0cb
dec ecx
je 0x43d0c4
dec ecx
je 0x43d0b0
sub ecx, 0x1b3
jne case.0x43d1ca.553
push 1
jmp 0x43d167
push str.SHA256
mov ecx, 0x47e478
call fcn.004418d2
jmp 0x43d2bd
push str.SHA1
jmp 0x43d0b5
push str.CRC64
jmp 0x43d0b5
push str.CRC32
jmp 0x43d0b5
push 0x4684c0
jmp 0x43d0b5
push 0
jmp 0x43d1dd
sub ecx, 0x21e
je 0x43d165
dec ecx
je 0x43d161
dec ecx
je 0x43d143
dec ecx
je 0x43d127
dec ecx
je 0x43d11b
dec ecx
jne case.0x43d1ca.553
push dword [0x47e484]
push 0
push 1
mov ecx, 0x47e478
call fcn.004306e1
jmp 0x43d2bd
push dword [0x47e484]
push 0
push 0
jmp 0x43d10c
mov ecx, dword [0x47e484]
imul ecx, ecx, 0x168
add ecx, 0x47e4ec
call fcn.0044de7e
jmp 0x43d2bd
push 1
mov ecx, dword [0x47e484]
imul ecx, ecx, 0x168
add ecx, 0x47e4ec
call fcn.00449681
jmp 0x43d2bd
push 0
jmp 0x43d145
push 0
mov ecx, dword [0x47e484]
imul ecx, ecx, 0x168
add ecx, 0x47e4ec
call fcn.004497e2
jmp 0x43d2bd
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [0x47e484]
imul ecx, ecx, 0x168
shr eax, 0xf
not al
and al, 1
add ecx, 0x47e4ec
mov byte [ebp - 4], al
push dword [ebp - 4]
call fcn.0044d1d2
jmp 0x43d2bd
lea eax, [ecx - 0x225]
cmp eax, 0x2a
ja case.0x43d1ca.553
movzx eax, byte [eax + 0x43d2f9]
jmp dword [eax*4 + 0x43d2c5]
push str._.
jmp 0x43d1dd
push 0x46b974
mov ecx, dword [0x47e484]
imul ecx, ecx, 0x168
add ecx, 0x47e4ec
call fcn.0044979d
jmp 0x43d2bd
mov ecx, 0x47e478
call fcn.0044563f
jmp 0x43d2bd
push ecx
mov ecx, 0x47e478
call fcn.00459028
jmp 0x43d2bd
mov ecx, 0x47e478
call fcn.0044f3a2
jmp 0x43d2bd
mov ecx, 0x47e478
call fcn.0044fc42
jmp 0x43d2bd
mov ecx, dword [0x47e484]
imul ecx, ecx, 0x168
add ecx, 0x47e4ec
call fcn.0044b814
jmp 0x43d2bd
mov ecx, dword [0x47e484]
imul ecx, ecx, 0x168
add ecx, 0x47e4ec
call fcn.0044deaf
jmp 0x43d2bd
mov ecx, dword [0x47e484]
imul ecx, ecx, 0x168
add ecx, 0x47e4ec
call fcn.0044d99a
jmp 0x43d2bd
mov ecx, dword [0x47e484]
imul ecx, ecx, 0x168
add ecx, 0x47e4ec
call fcn.0044dbfd
jmp 0x43d2bd
mov ecx, 0x47e478
call fcn.0045c240
jmp 0x43d2bd
mov ecx, dword [0x47e484]
imul ecx, ecx, 0x168
add ecx, 0x47e4ec
call fcn.00444c04
mov al, 1
leave
ret
xor al, al
leave
ret
Function at 0x43fdb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x463ffc
call fcn.0045e340
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x46c740
mov dword [esi + 4], 0x46c72c
mov dword [esi + 8], 0x46c71c
mov dword [esi + 0xc], 0x46c6f8
mov dword [esi + 0x10], 0x46c6dc
mov dword [esi + 0x14], 0x468c00
mov dword [esi + 0x18], 0x468c10
mov dword [esi + 0x1c], ebx
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.004022d0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.004022d0
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 2
call fcn.004022d0
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x6c], ebx
lea ecx, [esi + 0x9c]
mov byte [ebp - 4], 5
mov byte [esi + 0x70], 1
mov byte [esi + 0x71], bl
mov dword [esi + 0x94], ebx
mov byte [esi + 0x98], bl
mov byte [esi + 0x99], bl
call fcn.004022d0
lea ecx, [esi + 0xa8]
mov byte [ebp - 4], 6
call fcn.004022d0
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 7
call fcn.004022d0
lea ecx, [esi + 0xc0]
mov byte [ebp - 4], 8
call fcn.004022d0
lea ecx, [esi + 0xcc]
mov byte [ebp - 4], 9
call fcn.004022d0
lea ecx, [esi + 0xd8]
mov byte [ebp - 4], 0xa
call fcn.004022d0
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0xe4], bl
mov byte [esi + 0xe5], bl
mov byte [esi + 0xe6], bl
mov dword [esi], 0x46b8ec
mov dword [esi + 4], 0x46b8d8
mov dword [esi + 8], 0x46b8c8
mov dword [esi + 0xc], 0x46b8a4
mov dword [esi + 0x10], 0x46b888
mov dword [esi + 0x14], 0x46b878
mov dword [esi + 0x18], 0x46b868
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x440692
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
mov eax, 0x4641f2
call fcn.0045e340
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.004022d0
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004022d0
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
mov byte [esi + 0x24], bl
mov byte [esi + 0x25], bl
mov dword [esi + 0x2c], ebx
call fcn.004022d0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4445e9
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x464960
call fcn.0045e340
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi], 0x46b264
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
mov dword [esi + 8], ebx
call fcn.004022d0
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x18], bl
mov byte [esi + 0x19], bl
mov byte [esi + 0x1a], bl
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
or dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x38], 1
mov dword [esi], 0x46ca7c
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x445cea
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x464d30
call fcn.0045e340
sub esp, 0x60
push ebx
push esi
push edi
mov edi, ecx
push edx
lea ecx, [ebp - 0x18]
call fcn.00402407
xor ebx, ebx
push 0x2e
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.004027db
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00402806
cmp esi, ebx
jl 0x445d26
cmp esi, eax
jge 0x445d30
push 0x2e
lea ecx, [ebp - 0x18]
call fcn.00402649
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x30]
push eax
mov dword [ebp - 0x6c], 0x3c
mov dword [ebp - 0x68], 0x140
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
call fcn.00402407
push edi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.00402407
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
mov dword [ebp - 0x50], 1
and eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x34]
push dword [ebp - 0x24]
mov esi, dword [ebp - 0x4c]
mov dword [eax], ecx
call fcn.00402b73
push dword [ebp - 0x30]
mov byte [ebp - 4], bl
call fcn.00402b73
pop ecx
cmp esi, 0x20
pop ecx
ja 0x445de1
cmp esi, 0x1f
jne 0x445ddc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x30]
call fcn.00404615
push 0x10
push 0x468ec8
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x30]
call fcn.00402b73
pop ecx
mov ebx, 0x80004005
push dword [ebp - 0x18]
call fcn.00402b73
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x447f56
Capabilities:
Enumerate processes

Disassembly:
mov eax, 0x4651dc
call fcn.0045e340
sub esp, 0x248
push edi
mov dword [ebp - 0x10], ecx
call fcn.0040ac3f
and dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x28], edi
je 0x44801b
lea ecx, [ebp - 0x1c]
call fcn.004022d0
push 0x22c
lea eax, [ebp - 0x254]
push 0
push eax
mov byte [ebp - 4], 1
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x44800b
mov eax, dword [ebp - 0x24c]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x230]
push eax
call fcn.00402473
mov ecx, dword [ebp - 0x10]
call fcn.00403b61
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
call fcn.004481df
lea eax, [ebp - 0x254]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
jmp 0x447fc3
push dword [ebp - 0x1c]
call fcn.00402b73
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
leave
ret
Function at 0x44f8ad
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x465d3f
call fcn.0045e340
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x46b264
mov dword [esi + 8], edi
lea ecx, [esi + 0x10]
mov dword [ebp - 4], edi
mov dword [esi + 0xc], edi
call fcn.004022d0
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 1
call fcn.004022d0
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi], 0x46cf38
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x451518
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x466108
call fcn.0045e340
sub esp, 0x18
push esi
mov esi, ecx
lea ecx, [ebp - 0x18]
lea edx, [esi + 0x3c]
call fcn.004514a0
and dword [ebp - 4], 0
push eax
lea ecx, [esi + 0xc]
call fcn.004024d7
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.00402b73
pop ecx
lea edx, [esi + 0x40]
lea ecx, [ebp - 0x18]
call fcn.004514f0
push eax
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 1
call fcn.004024d7
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.00402b73
pop ecx
lea edx, [esi + 0x44]
lea ecx, [ebp - 0x24]
call fcn.004514c8
push eax
lea ecx, [esi + 0x24]
mov dword [ebp - 4], 2
call fcn.004024d7
push dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
call fcn.00402b73
pop ecx
push dword [0x46d27c]
lea ecx, [esi + 0x30]
call fcn.004025d5
push 0x11
pop ecx
call fcn.004524c8
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x48], eax
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4524c8
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp dword [ebp - 4], 0
je 0x452532
push 0x4008
lea eax, [ebp - 0x2bc]
push 0x2b4
push eax
push 0x80
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 8]
test eax, eax
je 0x45252a
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x2b8]
leave
ret
xor eax, eax
leave
ret

Function at 0x452567
Capabilities:
Get file system object information

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push edx
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
ret 0xc
Function at 0x454e72
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x46669c
call fcn.0045e340
sub esp, 0x320
push ebx
mov dword [ebp - 0x1c], ecx
push esi
push edi
lea ecx, [ebp - 0x28]
call fcn.004022d0
mov esi, dword [ebp + 0x10]
and dword [ebp - 4], 0
cmp byte [esi], 0
je 0x454edf
push dword [esi + 0xc]
lea ecx, [ebp - 0x58]
push dword [esi + 8]
call fcn.004382be
push eax
mov edx, 0xdb0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.0043835e
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004024d7
push dword [ebp - 0x4c]
call fcn.00402b73
push dword [ebp - 0x58]
and byte [ebp - 4], 0
call fcn.00402b73
pop ecx
pop ecx
lea edi, [esi + 0x18]
mov ecx, edi
call fcn.00402806
lea ebx, [eax + 1]
lea eax, [ebp - 0x34]
push ebx
push eax
mov ecx, edi
call fcn.0040ed97
mov eax, dword [edi]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
lea eax, [eax + ebx*2]
push eax
call fcn.00402332
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
push eax
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.00454e14
lea eax, [ebp - 0x40]
mov ecx, ebx
push eax
call fcn.00454e14
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x18]
push eax
call fcn.00402407
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.00402683
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0x18]
push eax
call fcn.004026f6
lea ecx, [ebp - 0x18]
call fcn.00402683
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x18]
push eax
call fcn.004026f6
lea ecx, [ebp - 0x18]
call fcn.00402683
cmp byte [esi + 1], 0
je 0x454fa0
mov edx, 0x3f4
lea ecx, [ebp - 0x18]
call fcn.0043b6a8
push 0x46a904
lea ecx, [ebp - 0x18]
call fcn.00402732
push 0
lea edx, [ebp - 0x78]
lea ecx, [esi + 0x10]
call fcn.00408db2
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0x18]
push eax
call fcn.00402732
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call esi
push dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edi, dword [edi]
push pe_nt_image_headers32
lea eax, [ebp - 0x32c]
push 0x2b4
push eax
push 0x80
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x454ff7
push dword [ebp + 0xc]
push dword [ebx + 4]
call esi
push 0
push dword [ebp - 0x32c]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x18]
call fcn.00402b73
push dword [ebp - 0x40]
call fcn.00402b73
push dword [ebp - 0x34]
call fcn.00402b73
push dword [ebp - 0x28]
call fcn.00402b73
mov ecx, dword [ebp - 0xc]
add esp, 0x10
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x45521a
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov eax, 0x4666d4
call fcn.0045e340
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
or eax, 0xffffffff
mov dword [ebp - 0x10], esi
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
lea ecx, [esi + 0x38]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
call fcn.004022d0
lea ecx, [esi + 0x44]
mov dword [ebp - 4], ebx
call fcn.004022d0
lea ecx, [esi + 0x50]
mov byte [ebp - 4], 1
call fcn.004022d0
mov byte [esi + 0x5c], bl
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 3
call fcn.0044009b
lea ecx, [esi + 0x9c]
call fcn.0045de00
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret