joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4400a6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x4401b4
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x440172
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x440153
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x440134
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x440151
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.00435532
mov dword [eax], 0xfffffffb
jmp 0x440129
jmp 0x440170
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x440170
push 0
push 0x729
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x4401b2
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push 1
push 1
push dword [ebp - 0x3c]
push 0
push 0x24f9
push dword [ebp - 0x40]
push 0
push 0x7225
push 0x5cfc
push 0xece
push 0x4997
push 0x2165
call fcn.0043d35b
add esp, 0x30
jmp 0x4401d0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
push 0
push dword [ebp - 0x44]
push dword [ebp - 0x48]
call fcn.00443194
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x44302d
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x443145
lea eax, [ebp + 0x38]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4430ce
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4430c6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x4430cc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x443143
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push 0
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push 0x1fc8
push 0x7cc
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push 1
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push 0x10f2
call fcn.004407ec
add esp, 0x3c
jmp 0x443165
push 0x32f5
push 1
push 0x2ef2
push 0x603f
push 0x6e51
push 0
call fcn.00449ec9
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x4434b4
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x38]
test eax, eax
je 0x443559
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4434f8
push 0x428f
push 0x71c4
push 1
call fcn.004435be
add esp, 0xc
jmp 0x443557
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x443524
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x443522
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x443557
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x443557
push 0x5d80
push 0
push 0
push 0x3503
push 0x7ead
push 1
call fcn.0045191b
add esp, 0x18
jmp 0x4435ba
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x24]
push 0
push 1
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call fcn.0044d4ba
add esp, 0x2c
mov esp, ebp
pop ebp
ret
Function at 0x44485e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x44494b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x444931
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x444925
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x4448c8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jg 0x444923
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x444921
push 1
push 0
push 0x1638
push 0x5877
push 0x1b3c
push 1
push 0x1180
push 0x5b91
push 0x67f5
push 0x26dc
push 0x5daf
push 0x42de
push 0x7df5
push 0x606a
call fcn.0044302d
add esp, 0x38
jmp 0x4448bd
jmp 0x44492f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x444949
push 0x1a24
push 0x67c8
push 0
push 0
push 1
call fcn.00452553
add esp, 0x14
jmp 0x444963
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push 0x2670
push 0
call fcn.00444654
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x445af9
Capabilities:
Get file system object information
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x445b3c
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x445b32
push 0x3156
push 0
push 0x6d14
push 0xf69
call fcn.00457242
add esp, 0x10
jmp 0x445b3a
push 0
call fcn.004585e3
pop ecx
jmp 0x445bb4
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x445bac
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x445b9f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x445b9d
push 0x1fe0
push 0x1c49
push 0
push 0x1424
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x445baa
push 0x827
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x445bb4
push 0
call fcn.00457f24
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x448ae8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x448ba4
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x448b69
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x448b5a
mov byte [ebp - 1], 0
push 0x4d42
push 0
push 0x259b
push 0x14b9
push 1
push 1
lea eax, [ebp - 1]
push eax
push 0x5c8b
push 1
call fcn.0043e56b
add esp, 0x24
jmp 0x448b67
push 0xc25
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x448ba2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 0x23d
push 1
push 0x471f
push dword [ebp - 0x1c]
push 0x4c99
push dword [ebp - 0x20]
push 0x269c
push 0
push 0x77dd
push 1
call fcn.004406ba
add esp, 0x28
jmp 0x448bb6
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push 0
call fcn.0043c242
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x44f616
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x44f65e
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
push 0x638a
push 0x1f94
push 0x26be
push 1
push 0x61a
push 0x156
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
push 0x2fb
call fcn.0044f71d
add esp, 0x20
jmp 0x44f719
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x44f6f5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x44f6e6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x44f6ca
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x44f6e4
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.00435532
and dword [eax], 0
jmp 0x44f6bf
jmp 0x44f6f3
push 0
push 0xca3
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x44f719
push 0xef7
push 0xf93
push 0
push 1
push 1
push 0x225c
push 1
push 0x1854
call fcn.004404c8
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x454270
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x45433a
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4542dd
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4542d3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x4542db
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x454338
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x454319
mov byte [ebp - 1], 0
push 0
lea eax, [ebp - 1]
push eax
push 0x6713
push 0x56c3
push 1
push 0x493a
push 1
push 0x372f
call fcn.00442caf
add esp, 0x20
jmp 0x454338
push 0
push 0
push 0x1dc9
push 0
push 0x2515
push 0
push 0x1810
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x45437f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x454364
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 0
push dword [ebp - 0x34]
call fcn.0045c1bf
pop ecx
pop ecx
jmp 0x45437f
push 1
push 0x4af
push 0x76cd
push 0
push 0x7ba2
call fcn.0043d7ef
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x4586d5
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x4587bc
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x458781
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x45876e
mov byte [ebp - 1], 0
push 0x1ae4
push 0x39cb
push 1
lea eax, [ebp - 1]
push eax
push 0x6f9f
push 1
push 1
push 0x771f
push 0x7394
push 0x1707
push 0x38e9
push 0
push 0x113c
push 1
push 0x2c32
push 0x5017
push 1
push 0x1195
call fcn.00456f40
add esp, 0x48
jmp 0x45877f
push 0x113f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x4587ba
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x4587b0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x4587ba
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
jmp 0x4587e0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
push 0x4054
push 1
push dword [ebp - 0x2c]
push 0x205
push 0x5a24
push 1
call fcn.0043c680
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x459480
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
movzx eax, byte [ebp + 0x38]
test eax, eax
je 0x45954b
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4594c1
push 0
call fcn.0045a9a8
pop ecx
jmp 0x459546
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x45952f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x45952d
push 1
push 0x7e21
push 0x5e4e
push 0
push 0
push 1
push 0x3cfd
push 0x4a1
push 0x1a
push 0x1ebf
push 0xd19
push 0x2683
push 0x226
call fcn.00450662
add esp, 0x34
jmp 0x459546
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x45963e
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x4595cc
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x4595c2
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jge 0x4595c0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, 0x100
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x4595a7
jmp 0x4595ca
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x45963e
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x6c], eax
push 1
push dword [ebp - 0x60]
push 0x1556
push 0x3807
push dword [ebp - 0x64]
push 0x364e
push 0x228f
push dword [ebp - 0x68]
push 0x7293
push 0x2eb2
push 0
push 0
push dword [ebp - 0x6c]
push 0x7f28
push 0x548f
push 0x3fc7
push 0x2693
push dword [ebp - 0x70]
push 0x1cf1
call fcn.00443297
add esp, 0x4c
mov esp, ebp
pop ebp
ret
Function at 0x495500
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4a349f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b6484]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00493384
mov dword [ebp - 0x14], eax
cmp dword [0xab0870], esi
jne 0x4a3592
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4a351f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4a3672
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4a3672
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a3672
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xab0870], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xab0874], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xab0878], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xab0880], eax
test eax, eax
je 0x4a358f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xab087c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4a35b7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4a35aa
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4a35cc
push 4
pop eax
jmp 0x4a3674
cmp dword [ebp - 0x14], esi
je 0x4a35cc
push dword [0xab0870]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4a35b1
mov eax, dword [0xab087c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4a362a
cmp dword [0xab0880], edi
je 0x4a362a
push eax
call ebx
push dword [0xab0880]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4a362a
test eax, eax
je 0x4a362a
call ecx
test eax, eax
je 0x4a361f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4a361f
test byte [ebp - 8], 1
jne 0x4a362a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4a365a
mov eax, dword [0xab0874]
cmp eax, edi
je 0x4a3657
push eax
call ebx
test eax, eax
je 0x4a3657
call eax
mov esi, eax
test esi, esi
je 0x4a3657
mov eax, dword [0xab0878]
cmp eax, edi
je 0x4a3657
push eax
call ebx
test eax, eax
je 0x4a3657
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xab0870]
call ebx
test eax, eax
je 0x4a3672
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4a3674
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049282b
mov esp, ebp
pop ebp
ret