joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407840
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x70
push 0x44
lea eax, [esp + 0x30]
push 0
push eax
call fcn.0040b3b0
xor eax, eax
add esp, 0xc
mov dword [esp + 0x2c], 0x44
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [esp + 0x74]
lea ecx, [esp]
push ecx
lea edx, [esp + 0x30]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x407943
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
push ebp
mov ebp, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push esi
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea esp, [esp]
push 0x4ff
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x1c]
push ecx
push 1
call ebp
cmp eax, 1
jne 0x407913
push eax
push 0
push 0
push 0
lea edx, [esp + 0x30]
push edx
call esi
test eax, eax
je 0x4078c0
lea esp, [esp]
lea eax, [esp + 0x20]
push eax
call edi
lea ecx, [esp + 0x20]
push ecx
call ebx
push 1
push 0
push 0
push 0
lea edx, [esp + 0x30]
push edx
call esi
test eax, eax
jne 0x4078f0
jmp 0x4078c0
test eax, eax
je 0x40791c
cmp eax, 0xffffffff
jne 0x4078c0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x70
ret
xor eax, eax
add esp, 0x70
ret
Function at 0x4079d0
Capabilities:
Encrypt or decrypt via wincrypt
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
test eax, eax
push esi
mov dword [esp + 0xc], ecx
je 0x4079eb
cmp dword [esp + 0x18], 0
je 0x4079eb
xor esi, esi
jmp 0x4079f0
mov esi, 0x80070057
test esi, esi
mov dword [esp + 4], 0
jl 0x407bda
cmp dword [ecx + 4], 0
jne 0x407a12
mov eax, 0x80070005
pop esi
add esp, 0xc
ret 8
push ebp
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x1c], ebp
jne 0x407a50
call edi
test eax, eax
jle 0x407a4e
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x407bc3
push ebx
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407b08
call edi
test eax, eax
jle 0x407a7d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x407bc2
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x407aa8
call edi
test eax, eax
jle 0x407aa6
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x407ba7
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
jne 0x407ad3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x407ad1
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x407b6c
mov ecx, dword [esp + 0x20]
push 0
lea eax, [esp + 0x18]
push eax
push ebx
push edi
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407b1a
cmp dword [esp + 0x14], ebx
je 0x407b30
mov esi, 0x8000ffff
jmp 0x407b6c
test ebx, ebx
jne 0x407a7f
mov esi, 0x800710d2
jmp 0x407bc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x407b2e
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x407b6c
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 4]
lea edx, [esp + 0x10]
push edx
push edi
push 0
push 1
push 0
push ecx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x407b6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x407b6a
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test edi, edi
je 0x407b77
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test esi, esi
jl 0x407ba7
mov edx, dword [esp + 0x10]
push 2
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
test eax, eax
je 0x407b91
mov ebp, eax
jmp 0x407ba7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x407ba5
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test ebp, ebp
je 0x407bbe
test esi, esi
jl 0x407bb7
mov eax, dword [esp + 0x24]
mov dword [eax], ebp
jmp 0x407bbe
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebp, dword [esp + 0x20]
pop ebx
cmp ebp, 0xffffffff
je 0x407bcf
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
mov eax, esi
pop esi
add esp, 0xc
ret 8
mov eax, esi
pop esi
add esp, 0xc
ret 8
Function at 0x407c60
Capabilities:
Encrypt data using des via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 8
push ebx
push esi
mov ebx, ecx
mov esi, dword [ebx]
neg esi
sbb esi, esi
push edi
and esi, 0x7ff8fffb
add esi, 0x80070005
mov edi, 0
mov dword [esp + 0xc], edi
js 0x407c90
cmp dword [esp + 0x18], edi
jne 0x407c90
mov esi, 0x80070057
mov eax, dword [ebx + 4]
cmp eax, edi
je 0x407ca1
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [ebx + 4], edi
cmp esi, edi
jl 0x407d83
mov ecx, dword [ebx]
push ebp
lea eax, [esp + 0x10]
push eax
push edi
push edi
push 0x8004
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x407cdb
call ebp
cmp eax, edi
jle 0x407cd9
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x407d82
mov eax, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 4
lea edx, [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x24], 0x420042
call edi
test eax, eax
jne 0x407d16
call ebp
test eax, eax
jle 0x407d14
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x407d82
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 0x1c]
push 0
add eax, eax
push eax
mov eax, dword [esp + 0x18]
push edx
push eax
call edi
test eax, eax
jne 0x407d4c
call ebp
test eax, eax
jle 0x407d4a
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
jl 0x407d82
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx]
lea eax, [ebx + 4]
push eax
push 0xc00000
push ecx
push 0x6603
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x407d82
call ebp
test eax, eax
jle 0x407d80
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
pop ebp
mov eax, dword [esp + 0xc]
test eax, eax
je 0x407d92
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 8
ret 4
Function at 0x40b399
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4243c8]
jne 0x40b3a3
repz ret
jmp fcn.0040fee6

Function at 0x412243
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x424cf0]
je 0x41225e
inc edi
cmp edi, 0x17
jb 0x41224f
cmp edi, 0x17
jae 0x4123de
push ebp
push 3
call fcn.00417165
cmp eax, 1
pop ecx
je 0x4123aa
push 3
call fcn.00417165
test eax, eax
pop ecx
jne 0x412292
cmp dword [0x4243e0], 1
je 0x4123aa
cmp ebx, 0xfc
je 0x4123dd
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x425e40
push ebp
call fcn.004103bd
add esp, 0xc
test eax, eax
je 0x4122c8
push esi
push esi
push esi
push esi
push esi
call fcn.0040b633
add esp, 0x14
push 0x104
mov esi, 0x425e59
push esi
push 0
mov byte [0x425f5d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41230c
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004103bd
add esp, 0xc
test eax, eax
je 0x41230c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0040b633
add esp, 0x14
push esi
call fcn.0040ca60
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x412351
push esi
call fcn.0040ca60
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x426154
push 0x41e6c4
sub ecx, eax
push ecx
push eax
call fcn.00416126
add esp, 0x14
test eax, eax
je 0x412351
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0040b633
add esp, 0x14
jmp 0x412353
xor esi, esi
push 0x41e6c0
push ebx
push ebp
call fcn.0041606d
add esp, 0xc
test eax, eax
je 0x412373
push esi
push esi
push esi
push esi
push esi
call fcn.0040b633
add esp, 0x14
push dword [edi*8 + 0x424cf4]
push ebx
push ebp
call fcn.0041606d
add esp, 0xc
test eax, eax
je 0x412395
push esi
push esi
push esi
push esi
push esi
call fcn.0040b633
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00416fa8
add esp, 0xc
jmp 0x4123dd
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4123dd
cmp ebp, 0xffffffff
je 0x4123dd
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x424cf4]
push dword [esi]
call fcn.0040ca60
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x416fa8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040e322
xor ebx, ebx
cmp dword [0x4262e0], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x41707e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x41715e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x41715e
push eax
call fcn.0040e2b4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4262e0], eax
call esi
push eax
call fcn.0040e2b4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4262e4], eax
call esi
push eax
call fcn.0040e2b4
mov dword [0x4262e8], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00411fd0
test eax, eax
pop ecx
pop ecx
je 0x41704c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040b633
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x41707e
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040e2b4
cmp eax, ebx
pop ecx
mov dword [0x4262f0], eax
je 0x41707e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040e2b4
pop ecx
mov dword [0x4262ec], eax
mov eax, dword [0x4262ec]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x417103
cmp dword [0x4262f0], ecx
je 0x417103
push eax
call fcn.0040e32b
push dword [0x4262f0]
mov esi, eax
call fcn.0040e32b
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x417103
cmp edi, ebx
je 0x417103
call esi
cmp eax, ebx
je 0x4170d0
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4170d0
test byte [ebp - 0x18], 1
jne 0x417103
lea eax, [ebp - 0x10]
push eax
call fcn.00412007
test eax, eax
pop ecx
je 0x4170eb
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040b633
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4170fa
or dword [ebp + 0x10], 0x200000
jmp 0x41713e
or dword [ebp + 0x10], 0x40000
jmp 0x41713e
mov eax, dword [0x4262e4]
cmp eax, dword [ebp - 8]
je 0x41713e
push eax
call fcn.0040e32b
cmp eax, ebx
pop ecx
je 0x41713e
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x41713e
mov eax, dword [0x4262e8]
cmp eax, dword [ebp - 8]
je 0x41713e
push eax
call fcn.0040e32b
cmp eax, ebx
pop ecx
je 0x41713e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4262e0]
call fcn.0040e32b
cmp eax, ebx
pop ecx
je 0x41715e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x417160
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47e9f5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x53466c]
cmp eax, 0xffffffff
jne 0x47eb01
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0xa40420
call sub.msvcrt.dll_memset
mov dword [0xa40420], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], 0xa40464
call sub.msvcrt.dll_memset
mov dword [esp + 0x24], 0xa40464
mov dword [esp + 0x20], 0xa40420
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd.exe__c_ver
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x47eaf7
mov eax, dword [0xa40464]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa40464]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [0xa40468]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0x53466c], 1
jmp 0x47eb01
mov dword [0x53466c], 0
mov eax, dword [0x53466c]
leave
ret
Function at 0x48faee
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0048f6ea
test eax, eax
sete al
test al, al
je 0x48fb1a
mov eax, 0xfffffffe
mov edx, 0xffffffff
jmp 0x48fbcd
mov edx, dword [0x6a5cbc]
mov eax, dword [ebp + 8]
shl eax, 3
mov ecx, eax
shl ecx, 4
mov edi, ecx
sub edi, eax
mov eax, edi
add eax, edx
mov dword [0xa2f72c], eax
mov eax, dword [0xa2f72c]
movzx eax, byte [eax + 0x70]
test al, al
je 0x48fb51
mov eax, 0xfffffffc
mov edx, 0xffffffff
jmp 0x48fbcd
mov eax, dword [0x6a5cb8]
mov edx, dword [ebp + 8]
shl edx, 2
add eax, edx
mov dword [0xa2f730], eax
mov edi, 0xa2f738
mov eax, dword [0xa2f730]
mov eax, dword [eax]
mov dword [esp + 4], 0xa2f73c
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSize]
call eax
sub esp, 8
mov dword [edi], eax
mov eax, dword [0xa2f738]
mov edx, dword [0xa2f73c]
mov ebx, eax
and bh, 0xff
mov esi, edx
and esi, 0
mov eax, ebx
xor eax, 0xffffffff
or eax, esi
test eax, eax
jne 0x48fbc2
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
test eax, eax
setne al
test al, al
je 0x48fbc2
mov eax, 0xfffffffd
mov edx, 0xffffffff
jmp 0x48fbcd
mov eax, dword [0xa2f738]
mov edx, dword [0xa2f73c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x491573
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0048f6ea
test eax, eax
sete al
test al, al
je 0x4915b1
mov eax, 0xfffffffe
jmp 0x49176b
mov edx, dword [0x6a5cbc]
mov eax, dword [ebp + 8]
shl eax, 3
mov ecx, eax
shl ecx, 4
mov ebx, ecx
sub ebx, eax
mov eax, ebx
add eax, edx
mov dword [0xa2f674], eax
mov eax, dword [0xa2f674]
movzx eax, byte [eax + 0xa]
test al, al
jne 0x4915e6
mov eax, 0xfffffffd
jmp 0x49176b
cmp dword [ebp - 0x14], 0
jns 0x4915f6
mov eax, 0xfffffffc
jmp 0x49176b
mov eax, dword [ebp - 0xc]
mov edx, eax
xor edx, 0xffffffff
mov eax, dword [ebp - 0x10]
xor eax, 0xffffffff
or eax, edx
test eax, eax
je 0x491640
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00491439
mov dword [0xa2f678], eax
mov eax, dword [0xa2f678]
test eax, eax
setne al
test al, al
je 0x491640
mov eax, dword [0xa2f678]
jmp 0x49176b
mov eax, dword [0x6a5cb8]
mov edx, dword [ebp + 8]
shl edx, 2
add eax, edx
mov dword [0xa2f67c], eax
jmp 0x491751
cmp dword [ebp - 0x14], 0
jle 0x491671
mov dword [0xa2f680], 0xffffffff
add dword [ebp - 0x18], 1
adc dword [ebp - 0x14], 0xffffffff
jmp 0x491687
mov eax, dword [ebp - 0x18]
mov dword [0xa2f680], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edx, dword [0xa2f680]
mov eax, dword [0xa2f67c]
mov eax, dword [eax]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xa2f688
mov dword [esp + 8], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x4916f3
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [0xa2f690], eax
mov eax, dword [0xa2f690]
cmp eax, 5
je 0x4916e5
mov eax, dword [0xa2f690]
cmp eax, 0x21
jne 0x4916ec
mov eax, 0xfffffff9
jmp 0x49176b
mov eax, 0xfffffff7
jmp 0x49176b
mov eax, dword [0xa2f688]
mov edx, dword [0xa2f68c]
add dword [ebp + 0x14], eax
mov esi, dword [0xa2f674]
mov eax, dword [0xa2f674]
mov ecx, dword [eax + 0x10]
mov ebx, dword [eax + 0x14]
mov eax, dword [0xa2f688]
mov edx, dword [0xa2f68c]
add eax, ecx
adc edx, ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [0xa2f680]
mov ecx, eax
mov ebx, 0
mov eax, dword [0xa2f688]
mov edx, dword [0xa2f68c]
mov esi, ebx
xor esi, edx
xor eax, ecx
or eax, esi
test eax, eax
je 0x491751
mov eax, 0xffffffff
jmp 0x49176b
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
or eax, edx
test eax, eax
setne al
test al, al
jne 0x491657
mov eax, 0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4a861f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4a8669
mov dword [esp], 7
call fcn.0045ba38
mov eax, dword [ebp - 0x14]
jmp 0x4a8704
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call eax
sub esp, 8
mov edx, eax
sub dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp edx, eax
setne al
test al, al
je 0x4a86c5
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 4], 1
mov dword [esp], 0
call fcn.0045d152
mov dword [ebp - 0x14], eax
mov dword [esp], 0x33
call fcn.0045ba38
mov eax, dword [ebp - 0x14]
jmp 0x4a8704
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0045d152
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x18]
leave
ret
Function at 0x4b0c90
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 0xc]
mov dword [0xa51dc0], eax
jmp fcn.004b0480
Function at 0x4b2870
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
cmp byte [0x5349bc], 0
je 0x4b28b0
mov eax, dword [0xa51e58]
test eax, eax
je 0x4b28cd
mov dword [esp + 4], 0
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0xa51e58]
mov byte [eax + 0x38], 0
sub esp, 8
add esp, 0x1c
ret
mov dword [esp + 4], str.glutHideWindow
mov dword [esp], 0x564878
call fcn.004b62f0
mov eax, dword [0xa51e58]
test eax, eax
jne 0x4b2885
cmp dword [0x534a14], 2
je 0x4b2885
mov dword [esp + 4], str.glutHideWindow
mov dword [esp], 0x564924
call fcn.004b62f0
mov eax, dword [0xa51e58]
jmp 0x4b2885

Function at 0x4b2900
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
cmp byte [0x5349bc], 0
je 0x4b2940
mov eax, dword [0xa51e58]
test eax, eax
je 0x4b295d
mov byte [eax + 0x39], 0
mov dword [esp + 4], 6
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0xa51e58]
mov byte [eax + 0x38], 0
sub esp, 8
add esp, 0x1c
ret
mov dword [esp + 4], str.glutIconifyWindow
mov dword [esp], 0x564878
call fcn.004b62f0
mov eax, dword [0xa51e58]
test eax, eax
jne 0x4b2915
cmp dword [0x534a14], 2
je 0x4b2915
mov dword [esp + 4], str.glutIconifyWindow
mov dword [esp], 0x564924
call fcn.004b62f0
mov eax, dword [0xa51e58]
jmp 0x4b2915

Function at 0x4b60f0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, 1
push ebx
sub esp, 0x14
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [esp], 0xa0
call ebx
sub esp, 4
test ax, ax
js 0x4b6123
mov dword [esp], 0xa1
call ebx
movsx esi, ax
sub esp, 4
shr esi, 0x1f
mov dword [esp], 0xa2
call ebx
mov edx, 2
sub esp, 4
test ax, ax
js 0x4b614d
mov dword [esp], 0xa3
call ebx
mov edx, eax
sub esp, 4
shr edx, 0xe
and edx, 2
or esi, edx
mov dword [esp], 0xa4
call ebx
mov edx, 4
sub esp, 4
test ax, ax
js 0x4b6179
mov dword [esp], 0xa5
call ebx
mov edx, eax
sub esp, 4
shr edx, 0xd
and edx, 4
mov eax, esi
add esp, 0x14
or eax, edx
pop ebx
pop esi
ret

Function at 0x4b62f0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x534a48]
test ebx, ebx
je 0x4b6318
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [0x534a48]
add esp, 0x18
pop ebx
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea ebx, [esp + 0x24]
mov dword [esp + 8], 9
mov dword [esp + 4], 1
mov dword [esp], str.freeglut
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [0x534a1c]
test eax, eax
je 0x4b6369
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.__s_:
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], 0xa
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
cmp byte [0x5349bc], 0
jne 0x4b63b2
mov dword [esp], 1
call sub.msvcrt.dll_exit
call fcn.004b01f0
jmp 0x4b63a6