joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432aa0
Capabilities:
Delete file

Disassembly:
cmp dword [0x4e4cb8], 0
push esi
jne 0x432af5
mov eax, dword [0x4e4c9c]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
mov ecx, dword [0x4e4ca0]
push ecx
call esi
mov edx, dword [0x4e4ca4]
push 1
push edx
call fcn.0041ca90
push str.KRebootConfigWritter::SetDonotNeedRebootUpdate_delete_all_back_files
mov ecx, 0x4e49b4
call fcn.00419ab0
add esp, 0xc
push str.KRebootConfigWritter::SaveRebootBackConfig_end
mov ecx, 0x4e49b4
call fcn.00419ab0
add esp, 4
pop esi
ret
call fcn.00432b10
push str.KRebootConfigWritter::SaveRebootBackConfig_end
mov ecx, 0x4e49b4
call fcn.00419ab0
add esp, 4
pop esi
ret

Function at 0x432b10
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4b4ce8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4e02dc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [0x4e3844]
mov edx, dword [eax + 0xc]
mov ecx, 0x4e3844
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], 0
cmp dword [0x4e4ca8], 0
lea edi, [esp + 0xc]
mov eax, 0x4e4ca0
jne 0x432b68
mov eax, 0x4e4c9c
call fcn.0040a8e0
mov edi, dword [esp + 0xc]
push 3
push edi
push 0x4e4cac
call fcn.00417710
mov esi, eax
push esi
push str.KRebootConfigWritter::AddRebootFile_Save_config_file_return:_d
mov ecx, 0x4e49b4
call fcn.00419ab0
add esp, 8
test esi, esi
jne 0x432b9a
push edi
jmp 0x432bb2
cmp dword [0x4e4ca8], 0
je 0x432bab
mov eax, dword [0x4e4c9c]
push eax
jmp 0x432bb2
mov ecx, dword [0x4e4ca0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [edi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x432bdc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x432bf0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4b3118
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4e02dc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
cmp dword [0x4e4cb8], 0
mov eax, dword [0x4e4c9c]
jne 0x432c69
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
mov ecx, dword [0x4e4ca0]
push ecx
call esi
mov edx, dword [0x4e4ca4]
push 1
push edx
call fcn.0041ca90
push str.KRebootConfigWritter::SetDonotNeedRebootUpdate_delete_all_back_files
mov ecx, 0x4e49b4
call fcn.00419ab0
add esp, 0xc
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
add eax, 0xfffffff0
call fcn.00401270
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov dword [esp + 0x20], 0
cmp dword [0x4e4ca8], 0
je 0x432c9b
mov eax, 0x4e4ca0
lea edi, [esp + 0x10]
call fcn.0040a8e0
mov esi, dword [esp + 0x10]
push 3
push esi
push 0x4e4cac
call fcn.00417710
lea eax, [esi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x432ccc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
jmp 0x432ce0
mov ecx, dword [0x4e4c8c]
test ecx, ecx
mov edx, dword [0x4e4c90]
je 0x432d06
mov eax, edx
sub eax, ecx
sar eax, 2
cmp esi, eax
jae 0x432d06
mov ecx, dword [ecx + esi*4]
push ecx
call edi
add esi, 1
jmp 0x432ce0
cmp ecx, edx
mov ebx, edx
jbe 0x432d1d
call fcn.0049445b
mov edx, dword [0x4e4c90]
mov ecx, dword [0x4e4c8c]
cmp ecx, edx
mov esi, 0x4e4c88
mov edi, ecx
jbe 0x432d2d
call fcn.0049445b
push ebx
push esi
mov eax, 0x4e4c88
push edi
push eax
lea edx, [esp + 0x20]
push edx
mov ebx, eax
call fcn.00415620
push str.KRebootConfigWritter::SaveRebootConfig_end
mov ecx, 0x4e49b4
call fcn.00419ab0
add esp, 4
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x434040
Capabilities:
Get common file path

Disassembly:
sub esp, 0x218
mov eax, dword [0x4e02dc]
xor eax, esp
mov dword [esp + 0x214], eax
xor eax, eax
push 0x20e
push eax
mov dword [esp + 8], eax
mov word [esp + 0xc], ax
lea eax, [esp + 0xe]
push eax
call fcn.0049a440
add esp, 0xc
push 0x104
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push esi
lea ecx, [esp + 8]
call fcn.00401400
mov ecx, dword [esp + 0x214]
xor ecx, esp
mov eax, esi
call fcn.004935b6
add esp, 0x218
ret

Function at 0x436b10
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4b4908
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4e02dc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x20]
xor esi, esi
mov dword [esp + 0x18], esi
lea edi, [ebx + 4]
mov dword [edi], vtable.BkWin::IBkWindow.0
mov dword [ebx], vtable.CBkWindow.0
mov dword [edi], vtable.CBkWindow.1.0
call fcn.004368f0
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x28], esi
mov eax, dword [0x4e3844]
mov edx, dword [eax + 0xc]
mov ecx, 0x4e3844
call edx
add eax, 0x10
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x38], esi
mov dword [ebx + 0x3c], esi
mov dword [ebx + 0x40], esi
mov eax, dword [0x4e3844]
mov edx, dword [eax + 0xc]
mov ecx, 0x4e3844
call edx
add eax, 0x10
mov dword [ebx + 0x44], eax
mov dword [ebx + 0x48], esi
mov eax, dword [0x4e3844]
mov edx, dword [eax + 0xc]
mov ecx, 0x4e3844
call edx
add eax, 0x10
mov dword [ebx + 0x4c], eax
mov eax, dword [0x4e3844]
mov edx, dword [eax + 0xc]
mov ecx, 0x4e3844
call edx
add eax, 0x10
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x5c], esi
mov word [ebx + 0x60], si
mov dword [ebx + 0x64], esi
mov dword [ebx + 0x6c], esi
mov dword [ebx + 0xa4], esi
mov dword [ebx + 0xa8], esi
mov dword [ebx + 0xac], esi
mov dword [ebx + 0xb0], 1
mov dword [ebx + 0xb4], esi
mov dword [ebx + 0xb8], esi
mov dword [ebx + 0xbc], esi
mov dword [ebx + 0xc0], esi
or eax, 0xffffffff
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0xdc], eax
mov dword [ebx + 0xe0], eax
mov ecx, closesocket
lea eax, [ebx + 0x18]
mov dword [ebx + 0xc4], vtable.BkWin::BkLayoutParam.0
mov dword [ebx + 0xc8], edi
mov dword [ebx + 0xf4], esi
mov dword [ebx + 0xf8], esi
mov dword [ebx + 0xd8], esi
mov dword [ebx + 0xd4], esi
mov dword [ebx + 0xd0], esi
mov dword [ebx + 0xcc], esi
mov dword [ebx + 0xe4], esi
mov dword [ebx + 0xec], esi
mov dword [ebx + 0xe8], ecx
mov dword [ebx + 0xf0], ecx
push eax
mov dword [ebx + 0xfc], esi
mov dword [ebx + 0x100], esi
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov eax, ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x43ad60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b4880
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e02dc]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [0x4e3844]
mov edx, dword [eax + 0xc]
mov ecx, 0x4e3844
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x34]
xor esi, esi
push 0x50
push esi
push eax
mov dword [esp + 0x34], esi
call fcn.0049a440
mov ecx, dword [esp + 0x3c]
add esp, 0xc
xor ebp, ebp
add ecx, 0x12c
mov dword [esp + 0x18], esi
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x30]
push 0x4c8da8
lea edx, [esp + 0x20]
push edx
push eax
lea ebx, [esp + 0x24]
call fcn.0040a3c0
mov byte [esp + 0x28], 1
mov ecx, dword [eax]
lea eax, [ecx - 0x10]
lea esi, [edi - 0x10]
cmp eax, esi
je 0x43ae36
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x43ae25
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x43ae25
call fcn.00401270
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x43ae1c
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
lea edi, [ebx + 0x10]
mov dword [esp + 0x14], edi
jmp 0x43ae36
mov ebx, dword [ecx - 0xc]
push ecx
lea eax, [esp + 0x18]
call fcn.00401750
mov edi, dword [esp + 0x14]
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43ae5b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [edi - 0xc], 0
je 0x43ae79
cmp ebp, 0x14
jae 0x43ae84
push edi
call fcn.004957b9
mov ecx, dword [esp + 0x38]
add esp, 4
mov dword [ecx + ebp*4], eax
add ebp, 1
cmp dword [esp + 0x18], 0
jg 0x43adc7
lea eax, [edi - 0x10]
mov dword [esp + 0x28], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43aea8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x43e410
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x18]
cmp edi, 0xf
mov ebx, ecx
mov ebp, 1
jne 0x43e446
mov dword [ebx + 0xfc], ebp
mov dword [esi], 0
cmp dword [ebx + 0xfc], 0
je 0x43e495
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 0x14
cmp edi, 2
jne 0x43e4b4
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
mov dword [ebx + 0xfc], ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
je 0x43e479
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43e479
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi], 0
cmp dword [ebx + 0xfc], 0
jne 0x43e43d
mov edi, dword [esp + 0x18]
cmp dword [ebx + 0xfc], 0
jne 0x43e43d
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push esi
push eax
push ecx
push edi
push edx
mov ecx, ebx
call fcn.00438de0
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
cmp edi, 0x47
jne 0x43e4ce
mov edx, dword [esp + 0x20]
push edx
mov dword [ebx + 0xfc], ebp
call fcn.0043e2b0
jmp 0x43e42e
cmp edi, 0x18
jne 0x43e48c
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0xfc], ebp
call fcn.0043e3b0
jmp 0x43e42e
Function at 0x4485e0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
test byte [esi + 0x14], 2
je 0x448639
lea eax, [esp]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 4]
sub ecx, eax
je 0x448629
mov edx, dword [esp + 8]
mov ecx, dword [esp]
sub edx, ecx
je 0x448629
mov edx, dword [esi + 0x10]
push 0x11
push 0
push 0
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub ecx, edx
push ecx
push edi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
add esp, 0x14
ret
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
add esp, 0x14
ret

Function at 0x448640
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x18
cmp dword [esp + 0x1c], 1
push ebp
mov ebp, dword [esp + 0x24]
jne 0x448669
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
mov dword [esi + 0x18], ebp
pop ebp
add esp, 0x18
ret 8
lea ecx, [esp + 8]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x14]
sub edx, dword [esp + 0xc]
je 0x4486da
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 8]
je 0x4486da
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x4486d0
or byte [esi + 0x14], 4
mov al, byte [esi + 0x14]
test al, 2
jne 0x4486c7
or al, 2
push esi
mov ecx, edi
mov byte [esi + 0x14], al
call fcn.00448760
mov ecx, dword [esi + 8]
push 8
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x18], ebp
pop ebp
add esp, 0x18
ret 8
cmp dword [esi + 0x18], ebp
je 0x4486d0
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], ebp
pop ebp
add esp, 0x18
ret 8
mov edx, dword [esi + 8]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
pop ebp
add esp, 0x18
ret 8

Function at 0x448700
Capabilities:
Hide graphical window

Disassembly:
push ecx
cmp byte [esi + 0xd], 0
je 0x448757
and byte [esi + 0x14], 1
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x44872f
or byte [esi + 0x14], 4
test eax, 0x20000000
mov cl, byte [esi + 0x14]
jne 0x44872f
or cl, 2
mov byte [esi + 0x14], cl
test byte [esi + 0x14], 2
je 0x44874b
push esi
mov ecx, edi
call fcn.00448760
mov eax, dword [esi + 8]
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ecx
ret
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop ecx
ret
Function at 0x44eff0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4b4763
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4e02dc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
fldz
xor edi, edi
fst dword [esi + 4]
mov ecx, 0x4e3844
fst dword [esi + 8]
fst dword [esi + 0xc]
fstp dword [esi + 0x10]
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi], vtable.CBkRichtextObjBase.0
mov eax, dword [0x4e3844]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
mov dword [esp + 0x14], edi
mov dword [esi], vtable.CBkRichtextObj.0
mov eax, dword [0x4e3844]
mov edx, dword [eax + 0xc]
mov ecx, 0x4e3844
call edx
add eax, 0x10
mov dword [esi + 0x30], eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x38], 1
mov dword [esi + 0x34], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x44fff0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov edx, dword [eax + 0x4c]
push esi
push edi
xor esi, esi
lea ecx, [esp + 0x14]
push ecx
push esi
push esi
push 2
push esi
mov ecx, ebx
mov dword [esp + 0x28], esi
mov dword [ebx + 0xfc], esi
call edx
mov eax, dword [ebx + 0x38]
shr eax, 3
not eax
test al, 1
je 0x45004f
mov edi, dword [ebx + 0xc]
call fcn.00436870
cmp eax, esi
je 0x45004f
mov ecx, dword [eax + 0x38]
shr ecx, 3
not ecx
test cl, 1
je 0x45004f
mov edi, dword [eax + 0xc]
call fcn.00436870
cmp eax, esi
jne 0x450036
mov esi, dword [ebp + 0xc]
test esi, esi
mov dword [esp + 0x10], esi
jne 0x450074
mov eax, 1
mov dword [ebx + 0x10c], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esp + 0x10]
cmp dword [esi + 0x38], 0x10
jb 0x45007f
mov ebx, dword [esi + 0x24]
jmp 0x450082
lea ebx, [esi + 0x24]
call fcn.00450460
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x1c], ebx
je 0x4501a6
call fcn.00407ca0
mov edi, eax
cmp dword [edi + 0xc], 0xffffffff
jne 0x450119
lea esi, [esp + 0x18]
call fcn.00408cc0
mov eax, dword [eax]
push eax
push 0
push 0x4c20e0
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4500e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x450104
lea ecx, [esp + 0x14]
push ecx
push edi
mov dword [esp + 0x1c], 0
call fcn.004080e0
test eax, eax
je 0x450104
cmp dword [esp + 0x14], 0
jne 0x45010d
call fcn.00408e00
test eax, eax
je 0x450112
mov eax, 1
mov esi, dword [esp + 0x10]
mov dword [edi + 0xc], eax
cmp dword [edi + 0xc], 0
mov edi, dword [ebp + 8]
je 0x450132
cmp dword [edi + 0xb8], 0
je 0x450132
mov eax, 1
jmp 0x450134
xor eax, eax
mov dword [ebx + 0x1c], eax
lea eax, [edi + 0x104]
mov dword [ebx + 0x18], eax
mov edx, dword [ebx]
mov eax, dword [edx + 0x74]
push esi
mov ecx, ebx
call eax
mov eax, dword [edi + 0x12c]
add edi, 0x128
test eax, eax
jne 0x45015e
xor edx, edx
jmp 0x450166
mov edx, dword [edi + 8]
sub edx, eax
sar edx, 2
test eax, eax
je 0x450183
mov ecx, dword [edi + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x450183
mov eax, dword [edi + 8]
mov dword [eax], ebx
add eax, 4
mov dword [edi + 8], eax
jmp 0x4501a2
mov ebx, dword [edi + 8]
cmp eax, ebx
jbe 0x45018f
call fcn.0049445b
push ebx
push edi
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x2c]
push edx
mov eax, edi
call fcn.0045ded0
mov esi, dword [esp + 0x10]
mov edi, dword [esi + 0x40]
test edi, edi
je 0x4501c4
lea ecx, [ecx]
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
mov ecx, edi
call edx
test eax, eax
jne 0x4501e9
mov edi, dword [edi + 0x40]
test edi, edi
jne 0x4501b0
xor eax, eax
test eax, eax
mov dword [esp + 0x10], eax
jne 0x450070
mov ecx, dword [ebp + 8]
pop edi
mov eax, 1
pop esi
mov dword [ecx + 0x10c], eax
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
mov ecx, edi
call edx
jmp 0x4501c6
Function at 0x452200
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x20]
sub eax, dword [ebp + 0x1c]
sub ebx, dword [ebp + 0x18]
mov edx, dword [ebp]
push esi
push edi
push 1
push eax
xor esi, esi
mov dword [esp + 0x3c], eax
mov eax, dword [edx + 0x74]
push ebx
mov ecx, ebp
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x1c], esi
call eax
mov edi, dword [ebp + 0x140]
cmp edi, esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
je 0x452388
call fcn.00436870
mov esi, eax
test esi, esi
je 0x45233e
mov ecx, dword [esi + 0x14]
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push 2
mov dword [esp + 0x18], ecx
push 0
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x34]
mov ecx, esi
call eax
test eax, eax
je 0x45228f
lea ebx, [esi + 0x18]
call fcn.004377a0
mov ebx, dword [esp + 0x30]
movzx edi, word [esp + 0x34]
mov edx, dword [esi]
mov edx, dword [edx + 0x4c]
xor eax, eax
movzx ecx, bx
mov dword [esp + 0x18], eax
mov dword [esi + 0xfc], eax
lea eax, [esp + 0x18]
push eax
shl edi, 0x10
or edi, ecx
mov ecx, dword [esp + 0x30]
push edi
push ecx
push 0x202
push 0
mov ecx, esi
call edx
mov eax, dword [esp + 0x1c]
cmp dword [ebp + 0x140], eax
jne 0x452302
mov eax, dword [esi + 0x44]
test eax, eax
je 0x4522f2
cmp word [eax], 0
je 0x4522f2
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x45233e
cmp dword [esi + 0x14], 0
je 0x45233e
mov dword [esp + 0x28], 1
jmp 0x45233e
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push 1
push 0
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x34]
mov ecx, esi
call eax
test eax, eax
je 0x452324
lea ebx, [esi + 0x18]
call fcn.004377a0
mov ecx, dword [esp + 0x2c]
push edi
push ecx
push 0x2a3
mov ecx, esi
call fcn.00409570
mov dword [esp + 0x10], 1
xor eax, eax
cmp dword [esp + 0x28], eax
mov dword [ebp + 0x140], eax
je 0x452360
push 0x67
push esi
mov ebx, ebp
call fcn.00451c90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
cmp dword [esp + 0x10], eax
je 0x452388
cmp dword [esp + 0x14], eax
je 0x452388
mov edx, dword [esp + 0x20]
cmp edx, dword [ebp + 0x13c]
jne 0x45237e
mov dword [ebp + 0x13c], eax
push 0x6a
push esi
mov ebx, ebp
call fcn.00451c90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
Function at 0x455240
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4b37d8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push edi
mov eax, dword [0x4e02dc]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [esp + 0xc]
push eax
call fcn.00401400
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x1e]
movzx eax, word [esp + 0x1c]
movzx ecx, word [esp + 0x1a]
push edx
movzx edx, word [esp + 0x1c]
push eax
push ecx
push edx
push str.__02d__02d__02d__03d__n
lea edi, [esp + 0x20]
call fcn.0041a590
mov eax, dword [esp + 0x20]
add esp, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4552dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x24
ret
Function at 0x45aca0
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
mov esi, eax
test esi, esi
je 0x45acb0
lea eax, [esi + 0x578]
jmp 0x45acb2
xor eax, eax
push eax
call fcn.00432f50
mov ecx, dword [esi + 0x588]
test ecx, ecx
je 0x45acc8
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
mov eax, dword [esi + 4]
push 0
push 0x1f4
push 0xbb9
push eax
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [esi + 0x580], 0
je 0x45ad09
mov ecx, dword [esi + 4]
push 0
push ecx
mov dword [esi + 0x41c], 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x57c], 1
jmp 0x45ad13
mov dword [esi + 0x57c], 0
mov eax, dword [0x4e4d0c]
test eax, eax
jne 0x45ad26
call fcn.00426530
mov dword [0x4e4d0c], eax
cmp eax, 6
jne 0x45ad34
add esi, 0x24
push esi
call fcn.0045d950
mov eax, 1
pop esi
pop ecx
ret 4

Function at 0x45ad90
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [esi + 4]
push edi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea edi, [esi + 0x578]
call fcn.00432fe0
cmp dword [esi + 0x4d4], 0
jne 0x45add9
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0xc]
push 0
push 3
push 0x7e8
push edx
mov dword [esi + 0x430], ecx
mov dword [esi + 0x4d4], 1
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop ecx
ret 4

Function at 0x45ae20
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
push edi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea edi, [esi + 0x578]
call fcn.00432fe0
cmp dword [esi + 0x4d4], 0
jne 0x45ae65
mov ecx, dword [esi + 4]
push 0
push 3
mov eax, 1
push 0x7e8
push ecx
mov dword [esi + 0x430], eax
mov dword [esi + 0x4d4], eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
ret

Function at 0x45b060
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
push edi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea edi, [esi + 0x578]
call fcn.00432fe0
cmp dword [esi + 0x4d4], 0
jne 0x45b0a8
mov ecx, dword [esi + 4]
push 0
push 3
push 0x7e8
push ecx
mov dword [esi + 0x430], 3
mov dword [esi + 0x4d4], 1
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
ret

Function at 0x45b0b0
Capabilities:
Hide graphical window

Disassembly:
push edi
mov dword [0x4e4c34], 1
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea edi, [esi + 0x578]
call fcn.00432fe0
cmp dword [esi + 0x4d4], 0
jne 0x45b102
mov ecx, dword [esi + 4]
push 0
push 3
push 0x7e8
push ecx
mov dword [esi + 0x430], 3
mov dword [esi + 0x4d4], 1
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
ret

Function at 0x45b110
Capabilities:
Hide graphical window

Disassembly:
push edi
mov dword [0x4e4c34], 0
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea edi, [esi + 0x578]
call fcn.00432fe0
cmp dword [esi + 0x4d4], 0
jne 0x45b162
mov ecx, dword [esi + 4]
push 0
push 3
push 0x7e8
push ecx
mov dword [esi + 0x430], 3
mov dword [esi + 0x4d4], 1
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
ret
Function at 0x45b170
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
push edi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea edi, [esi + 0x578]
call fcn.00432fe0
cmp dword [esi + 0x4d4], 0
jne 0x45b1b8
mov ecx, dword [esi + 4]
push 0
push 3
push 0x7e8
push ecx
mov dword [esi + 0x430], 2
mov dword [esi + 0x4d4], 1
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
ret