joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448bbc
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push str.GetDiskFreeSpaceExW
mov edi, ecx
xor ebx, ebx
push 0x4631e0
mov dword [ebp - 8], edi
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ecx, dword [0x484594]
cmp eax, ebx
je 0x448bf4
cmp ecx, ebx
je 0x448c4f
cmp edi, ebx
je 0x448c38
cmp ecx, ebx
jne 0x448bff
xor ecx, ecx
inc ecx
mov eax, edi
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, bx
jne 0x448c04
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
imul esi, ecx
mov ecx, esi
call fcn.00434e42
push ebx
push ebx
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push dword [ebp - 8]
mov byte [edi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov byte [ebp - 1], 1
push str.GetDiskFreeSpaceExA
push 0x4631e0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, ebx
je 0x448c70
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push edi
call eax
mov esi, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x448ca0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mul dword [ebp - 0x14]
push ebx
push dword [ebp - 0x1c]
push edx
push eax
call fcn.00401270
mov esi, eax
mov dword [ebp - 0x1c], edx
cmp byte [ebp - 1], bl
je 0x448cac
mov ecx, edi
call fcn.0043492c
cmp dword [ebp - 8], ebx
je 0x448cb8
mov edx, dword [ebp - 0x1c]
mov eax, esi
jmp 0x448cbd
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x448f3c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ecx
push edi
push 0
mov edi, edx
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x448f57
xor al, al
jmp 0x448ff4
mov eax, dword [0x484594]
push ebx
push ebp
push esi
test eax, eax
jne 0x448f97
lea esi, [edi + edi]
lea eax, [esi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push esi
push dword [esp + 0x14]
xor ecx, ecx
push eax
mov word [esi + eax], cx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0xd
pop esi
jmp 0x448fcf
lea esi, [edi + 1]
imul esi, eax
push esi
push 0x2002
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov ebx, eax
xor eax, eax
push eax
push eax
dec esi
push esi
push ebx
push edi
push dword [esp + 0x24]
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
xor esi, esi
mov byte [eax + ebx], 0
inc esi
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebp
push esi
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
mov al, bl
pop ebx
pop edi
pop ecx
ret

Function at 0x448ff7
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 3
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x449019
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esi + esi + 4]
call section..text
mov eax, dword [ebp + 8]
mov edx, esp
mov edi, edx
sub edi, eax
movzx ecx, word [eax]
mov word [edi + eax], cx
inc eax
inc eax
test cx, cx
jne 0x44903b
xor eax, eax
mov word [edx + esi*2 + 2], ax
mov eax, 0x454
mov word [ebp - 0x10], ax
mov eax, dword [0x484594]
mov ebx, edx
mov dword [ebp - 0x18], ebx
test eax, eax
jne 0x44908a
mov edx, str.SHFileOperationW
mov ecx, str.shell32
call fcn.00435c3b
test eax, eax
je 0x449082
lea ecx, [ebp - 0x20]
push ecx
call eax
jmp 0x4490cc
mov ebx, dword [ebp - 0x18]
mov eax, dword [0x484594]
xor ecx, ecx
mov dx, word [ebx + ecx*2]
inc ecx
test dx, dx
jne 0x44908c
mov dx, word [ebx + ecx*2]
inc ecx
test dx, dx
jne 0x44908c
lea esi, [ecx + 1]
imul eax, esi
mov edi, eax
call section..text
mov eax, esp
xor ecx, ecx
push ecx
push ecx
push edi
push eax
push esi
push ebx
push ecx
push ecx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4491e4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov ebx, edx
call fcn.004350be
and dword [ebp - 4], 0
mov edi, eax
jmp 0x449244
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jl 0x449239
cmp dword [0x484944], 0
jne 0x449239
push edi
push dword [0x489190]
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0x32
call fcn.0043e3e2
add esp, 0xc
cmp eax, 5
je 0x449253
cmp eax, 3
je 0x44927a
push 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edi
mov ecx, ebx
call fcn.00402200
mov esi, eax
cmp esi, 3
je 0x4491fc
cmp esi, 1
jne 0x449266
push edi
push dword [0x489194]
call fcn.0045c3cd
pop ecx
pop ecx
mov ecx, edi
call fcn.0043492c
xor eax, eax
pop edi
cmp esi, 1
pop esi
setle al
pop ebx
leave
ret
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x44a8f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 0x25
mov edi, ecx
call esi
push 0x27
movsx ebx, ax
call esi
cwde
push 0x26
mov dword [ebp - 8], eax
call esi
cwde
push 0x28
mov dword [ebp - 0xc], eax
call esi
cmp byte [edi + 0x14], 1
cwde
mov dword [ebp - 4], eax
jne 0x44a96a
test bl, 1
je 0x44a93a
push 0
push 0xffffffffffffffff
mov ecx, edi
call fcn.0044a0cb
test byte [ebp - 8], 1
je 0x44a94b
push 0
push 1
mov ecx, edi
call fcn.0044a0cb
test byte [ebp - 0xc], 1
je 0x44a95a
push 1
mov ecx, edi
call fcn.0044a092
test byte [ebp - 4], 1
jne 0x44a966
cmp dword [ebp - 4], 0
jge 0x44a96a
mov byte [edi + 0x15], 0xa
cmp byte [edi + 0x16], 0
jne 0x44a984
inc byte [edi + 0x15]
cmp byte [edi + 0x15], 0xa
jb 0x44a984
mov ecx, edi
mov byte [edi + 0x15], 0
call fcn.0044a85b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44adde
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push dword [esi + 4]
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDC]
lea ecx, [ebp - 0x10]
mov edi, eax
mov eax, dword [esi]
push ecx
push edi
mov ecx, esi
call dword [eax + 0xc]
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp byte [esi + 0xc0], 0
je 0x44ae73
push 0x50
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x44ae4f
mov edi, dword [esi + 4]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, edi
jne 0x44ae4f
xor byte [esi + 0xde], 1
lea ecx, [esi + 0xc8]
call fcn.0044a8f4
mov ecx, dword [esi + 0xe0]
lea eax, [esi + 0xc4]
cmp ecx, dword [eax]
je 0x44ae73
mov dword [eax], ecx
mov ecx, esi
call fcn.0044aabe
pop edi
pop esi
leave
ret 4
Function at 0x44b02c
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4847c8]
test eax, eax
je 0x44b03f
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
ret
push esi
push 0x184
call fcn.00435115
mov esi, eax
pop ecx
test esi, esi
je 0x44b060
mov ecx, esi
call fcn.0043cb2e
mov dword [esi], 0x470560
jmp 0x44b062
xor esi, esi
push 0
push 0x1e
mov ecx, esi
call fcn.0043d5a5
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x44b515
Capabilities:
Hide graphical window

Disassembly:
push esi
push 0x18
call fcn.00435115
pop ecx
test eax, eax
je 0x44b535
push dword [esp + 0xc]
mov ecx, eax
push dword [esp + 0xc]
call fcn.0044b4c8
mov esi, eax
jmp 0x44b537
xor esi, esi
push 0
push 0xe9
mov ecx, esi
call fcn.0043d5a5
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 8

Function at 0x44b566
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, 0x4617f4
call fcn.0042d321
push 1
mov edi, eax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x44b5d3
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x44b5d3
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x44b5cd
push 4
push 0x463d88
push esi
call sub.MSVCRT.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x44b5cd
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44b5b4
sub eax, edx
cmp eax, 0x12c
jae 0x44b5cd
mov ecx, esi
call fcn.0042d321
mov edi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0xffffffffffffffff
push edi
call fcn.0044b515
pop edi
pop esi
ret
Function at 0x44b5ef
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
cmp byte [esi + 0x2f], 0
je 0x44b605
xor al, al
jmp 0x44b7b5
push edi
call fcn.0044b5de
mov edi, eax
mov ecx, edi
mov dword [ebp - 4], edi
call fcn.004354db
test al, al
jne 0x44b648
push dword [0x488440]
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0x30
call fcn.0043e3e2
pop ecx
pop ecx
mov ecx, edi
call fcn.0043492c
xor al, al
jmp 0x44b7b4
mov eax, dword [esi + 0x10]
mov eax, dword [eax]
cmp byte [eax + 0x20], 0
push ebx
jne 0x44b681
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44b681
test al, 0x10
je 0x44b681
mov eax, dword [esi + 0x10]
mov eax, dword [eax]
mov edx, dword [eax + 0x1c]
mov ecx, edi
call fcn.0043511e
mov ecx, edi
mov ebx, eax
call fcn.0043492c
mov dword [ebp - 4], ebx
mov edi, ebx
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push edi
call fcn.00417a91
push 0x4e6
mov ecx, esi
call fcn.0043ce3b
movzx ebx, al
neg ebx
sbb ebx, ebx
push 0x4b4
mov ecx, esi
and ebx, 0x10
call fcn.0043ce3b
movzx edi, al
neg edi
sbb edi, edi
and edi, 0x40
or edi, ebx
mov ebx, dword [esi + 0x28]
push 0x4b2
mov ecx, esi
call fcn.0043ce3b
mov ecx, dword [ebx]
movzx eax, al
neg eax
sbb eax, eax
and eax, 2
and ecx, 0xffffffad
or eax, ecx
or eax, edi
push 0x4b6
mov dword [ebx], eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov eax, dword [esi + 0x20]
xor ebx, ebx
xor edi, edi
cmp dword [eax + 0x14], ebx
je 0x44b721
mov ecx, dword [esi + 0x20]
push edi
call fcn.004398d9
test al, al
jne 0x44b718
mov ecx, dword [esi + 0x20]
push edi
call fcn.0043987c
mov eax, dword [eax + 0x10]
cmp eax, ebx
je 0x44b718
mov byte [eax + 0x1c], bl
mov eax, dword [esi + 0x20]
inc edi
cmp edi, dword [eax + 0x14]
jne 0x44b6f8
push 0x5c
push dword [ebp - 4]
call sub.MSVCRT.dll_wcsrchr
pop ecx
pop ecx
cmp eax, ebx
je 0x44b746
mov edx, dword [ebp - 4]
xor ecx, ecx
mov word [eax], cx
mov ecx, 0x484bcc
call fcn.004353e0
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 4]
call fcn.0043492c
push ebx
push 0x4be
mov ecx, esi
call fcn.0044b07a
mov ecx, eax
call fcn.0042d74b
cmp word [eax], bx
pop ebx
je 0x44b773
mov ecx, dword [esi + 0x10]
mov dword [ecx + 0x254], eax
jmp 0x44b77a
mov ecx, eax
call fcn.0043492c
mov ecx, dword [esi + 0x10]
call fcn.00402ede
mov ecx, dword [esi + 0x10]
mov edi, eax
mov eax, dword [esi + 0x28]
push dword [eax]
mov edx, edi
call fcn.0043eb4f
test al, al
jne 0x44b79c
mov byte [esi + 0x2e], al
jmp 0x44b7ab
push dword [esi + 0x18]
mov ecx, dword [esi + 0x10]
xor dl, dl
mov byte [esi + 0x2e], 1
call dword [esi + 0x14]
mov ecx, edi
call fcn.0043492c
mov al, 1
pop edi
pop esi
leave
ret
Function at 0x44c2c5
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
push 0x3c
mov esi, edx
mov edi, ecx
call fcn.00435115
pop ecx
test eax, eax
je 0x44c2ec
push dword [esp + 0x10]
mov ecx, eax
push dword [esp + 0x10]
push esi
push edi
call fcn.0044bfc1
mov esi, eax
jmp 0x44c2ee
xor esi, esi
push 0
push 0x29
mov ecx, esi
call fcn.0043d5a5
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret 8

Function at 0x44c77c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x466
mov esi, ecx
call fcn.0043ce9b
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x44c7a1
mov byte [ebp - 4], 1
test al, 0x10
jne 0x44c7a5
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov ecx, esi
push 0x51d
call fcn.0043ce54
push dword [ebp - 4]
mov ecx, esi
push 0x51e
call fcn.0043ce54
pop esi
leave
ret
Function at 0x44e229
Capabilities:
Create process on windows

Disassembly:
push 1
xor eax, eax
push eax
push eax
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov al, cl
ret

Function at 0x44e956
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x44e916
call dword [sym.imp.USER32.dll_EnumWindows]
xor eax, eax
cmp dword [ebp - 4], 2
setle al
leave
ret

Function at 0x45026d
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
movzx esi, byte [0x4849a1]
neg esi
push edi
mov edi, ecx
mov ecx, dword [0x484a50]
sbb esi, esi
mov byte [ebp - 1], 0
and esi, 4
call fcn.004352d9
mov dword [ebp - 8], eax
call fcn.0040d10f
mov ecx, eax
call fcn.0040d095
push eax
push dword [ebp - 8]
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x4502d2
push str.Torrent_storage_folder_cant_be_the_same_as_the_autoload_folder_
call fcn.0045c3cd
pop ecx
xor bl, bl
mov ecx, dword [ebp - 8]
call fcn.0043492c
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x25c]
push eax
mov edx, 0x471078
call fcn.0043511e
mov ecx, eax
call fcn.0042d7aa
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x450385
test byte [ebp - 0x25c], 0x10
jne 0x450362
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0x230]
call fcn.0043511e
mov ebx, eax
xor eax, eax
push eax
push eax
push 3
push eax
push eax
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
je 0x450357
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc byte [edi + 0x59]
push ebx
push 0x44e4fd
push 0
mov edx, esi
push 0
or edx, 0x100
mov ecx, ebx
call fcn.0044f7e4
jmp 0x450362
mov ecx, ebx
mov byte [ebp - 1], 1
call fcn.0043492c
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
je 0x45037c
cmp byte [edi + 0x59], 0xc8
jb 0x450300
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov bl, byte [ebp - 1]
jmp 0x4502c3

Function at 0x4508db
Capabilities:
Persist via run registry key

Disassembly:
cmp byte [0x484a54], 0
je 0x4508f8
mov ecx, dword [0x484a50]
call fcn.004352d9
mov ecx, eax
call fcn.0042d7aa
jmp 0x4508fa
xor eax, eax
push eax
mov ecx, 0x4846a4
call fcn.0043d9c4
mov ecx, dword [0x4847e4]
test ecx, ecx
je 0x450928
push esi
mov esi, ecx
call fcn.0044e5c2
push 0
mov ecx, esi
call fcn.0045066e
mov ecx, esi
call fcn.0044ebae
pop esi
mov cl, byte [0x484a3a]
jmp fcn.00446225
Function at 0x4509d6
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, ecx
call fcn.004507e1
call fcn.0044e034
push dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_DestroyWindow]
call ebp
mov ecx, esi
call fcn.004501cc
call fcn.00429c2d
call fcn.0041e600
call fcn.00411adc
xor edx, edx
xor cl, cl
call fcn.00410641
mov eax, dword [0x484014]
or byte [eax + 0x18], 1
mov eax, dword [0x484010]
or byte [eax + 0x18], 1
mov eax, dword [0x48400c]
or byte [eax + 0x14], 1
mov eax, dword [0x484008]
or byte [eax + 0x14], 1
mov ecx, dword [0x482184]
xor ebx, ebx
cmp ecx, ebx
je 0x450a47
push ebx
call fcn.0041f900
mov ecx, dword [0x482180]
cmp ecx, ebx
je 0x450a57
push ebx
call fcn.0041f900
call fcn.0041e612
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esp + 0x10], ebx
mov byte [esp + 0xf], bl
push edi
call fcn.0040d7e4
inc dword [esp + 0x14]
mov ecx, eax
mov eax, dword [0x47a1dc]
mov edi, ecx
cmp eax, ebx
je 0x450a9c
imul eax, eax, 0x3e8
push 0x32
cdq
pop ebx
idiv ebx
cmp dword [esp + 0x14], eax
jl 0x450a9a
and edi, 0xfffffff7
xor ebx, ebx
cmp byte [0x47a1d5], bl
jne 0x450ab0
cmp dword [esp + 0x14], 0xc8
jl 0x450ab0
xor edi, edi
test cl, 2
jne 0x450acc
cmp byte [esp + 0x13], bl
jne 0x450acc
mov cl, 1
mov byte [esp + 0x13], 1
call fcn.0044e102
push dword [esi + 4]
call ebp
cmp edi, ebx
je 0x450ada
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x450a6f
pop edi
cmp byte [esp + 0xf], bl
jne 0x450af1
xor cl, cl
call fcn.0044e102
xor dl, dl
mov cl, 1
call fcn.0040d498
call fcn.0041e600
mov ecx, dword [0x484014]
push ebx
call fcn.0041f900
mov ecx, dword [0x484010]
push ebx
call fcn.0041f900
mov ecx, dword [0x48400c]
push ebx
call fcn.0041f900
mov ecx, dword [0x484008]
push ebx
call fcn.0041f900
call fcn.0041e612
cmp byte [esp + 0x18], bl
je 0x450b56
cmp byte [0x484958], bl
je 0x450b45
push dword [0x48484c]
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
push dword [0x48484c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call fcn.0043f809
push ebx
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x453281
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 4]
push 0x1a
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
xor edi, edi
mov eax, dword [ebp + 8]
sub eax, edi
neg eax
sbb eax, eax
and eax, 7
add eax, edi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x1c]
push eax
push edi
push 0x1306
push ebx
mov dword [ebp - 0x1c], 2
call dword [sym.imp.USER32.dll_SendMessageA]
inc edi
cmp edi, 7
jl 0x45329c
mov ebx, dword [ebp + 8]
mov edi, dword [esi + ebx*4 + 0x70]
test edi, edi
jne 0x453335
mov eax, ebx
sub eax, edi
je 0x453324
dec eax
je 0x45331b
dec eax
je 0x453312
dec eax
je 0x453309
dec eax
je 0x453300
dec eax
je 0x4532f7
dec eax
jne 0x45335e
mov ecx, esi
call fcn.0045c572
jmp 0x45332b
mov ecx, esi
call fcn.0045e5f1
jmp 0x45332b
mov ecx, esi
call fcn.0045b061
jmp 0x45332b
mov ecx, esi
call fcn.0045d91e
jmp 0x45332b
mov ecx, esi
call fcn.0045d4f0
jmp 0x45332b
mov ecx, esi
call fcn.0045ef03
jmp 0x45332b
mov ecx, esi
call fcn.0045bf75
mov edi, eax
test edi, edi
je 0x45335e
mov dword [esi + ebx*4 + 0x70], edi
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x453347
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
mov dword [esi + 0x5c], edi
call fcn.0045279c
mov ecx, esi
mov dword [0x484a70], ebx
call fcn.0045322f
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4547c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x484
push ebx
push esi
xor ebx, ebx
mov esi, ecx
mov ecx, dword [esi]
inc ebx
cmp dword [ecx + 8], ebx
jne 0x4548df
push dword [ecx]
call fcn.004169fe
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.00402c9b
cmp eax, 0x3e8
jne 0x4548d7
mov ecx, dword [ebp - 4]
call fcn.00433bc9
mov ecx, eax
call fcn.00433de8
test al, al
jne 0x454852
push dword [ebp - 4]
lea eax, [ebp - 0x484]
push dword [0x488a2c]
push 0x230
push eax
call fcn.0042e92c
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0x34
call fcn.0043e3e2
add esp, 0x18
cmp eax, 6
jne 0x4548df
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
push ebx
xor edi, edi
push edi
push edi
push dword [ebp - 4]
push edi
push edi
call esi
cmp eax, 0x20
jg 0x4548d6
push dword [ebp - 4]
push str.shell32.dll_OpenAs_RunDLL__s
call fcn.0042ea2e
pop ecx
pop ecx
push ebx
push edi
push eax
push str.RUNDLL32.EXE
push edi
push edi
mov dword [ebp - 8], eax
call esi
cmp eax, 0x20
jg 0x4548ce
push 0x471e38
call fcn.0045c3cd
push dword [ebp - 4]
lea eax, [ebp - 0x484]
push dword [0x488a34]
push 0x230
push eax
call fcn.0042e92c
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0x30
call fcn.0043e3e2
add esp, 0x1c
lea ecx, [ebp - 8]
call fcn.0042d71a
pop edi
lea ecx, [ebp - 4]
call fcn.0042d71a
pop esi
pop ebx
leave
ret

Function at 0x4548e3
Capabilities:
Create process on windows
Get common file path

Disassembly:
push esi
mov esi, dword [ecx]
cmp byte [esi + 0x20], 0
push edi
jne 0x454927
push dword [esi]
mov ecx, esi
call fcn.004169fe
mov edi, eax
mov ecx, edi
call fcn.0043592e
test al, al
je 0x454920
push edi
push str._select___s_
call fcn.0042e9f5
pop ecx
pop ecx
mov ecx, eax
call fcn.00436065
mov ecx, edi
pop edi
pop esi
jmp fcn.0043492c
mov ecx, edi
call fcn.0043492c
push dword [esi + 0x18]
push str.__s_
call fcn.0042e9f5
pop ecx
pop ecx
pop edi
mov ecx, eax
pop esi
jmp fcn.00436065
Function at 0x457f88
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x484ce4]
test eax, eax
je 0x457f9b
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
ret
push esi
push 0x6c
call fcn.00435115
pop ecx
test eax, eax
je 0x457fb3
mov ecx, eax
call fcn.00457ac5
mov esi, eax
jmp 0x457fb5
xor esi, esi
push 0
push 0x25
mov ecx, esi
call fcn.0043d5a5
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x459ee0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x484ce8]
push edi
mov edi, ecx
test eax, eax
je 0x459ef7
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
ret
push esi
push 0x108
call fcn.00435115
pop ecx
test eax, eax
je 0x459f12
mov ecx, eax
call fcn.00459cc5
mov esi, eax
jmp 0x459f14
xor esi, esi
push 0
push 0x13
mov ecx, esi
call fcn.0043d5a5
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, 0xffffffff
je 0x459f37
push edi
mov ecx, esi
call fcn.0045960e
pop esi
pop edi
ret

Function at 0x45a4b0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x484cf0]
test eax, eax
je 0x45a4c3
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
ret
push esi
push 0x2c
call fcn.00435115
mov esi, eax
pop ecx
test esi, esi
je 0x45a4e1
mov ecx, esi
call fcn.0043cb2e
mov dword [esi], 0x47271c
jmp 0x45a4e3
xor esi, esi
push 0
push 0x2c
mov ecx, esi
call fcn.0043d5a5
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret