joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456731
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe308
mov eax, dword fs:[0]
push eax
mov eax, 0x1014
call fcn.004e7570
mov eax, dword [0x5415b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x1010], ax
push 0xffe
lea eax, [ebp - 0x100e]
mov dword [ebp - 0x1020], ebx
push ebx
push eax
call fcn.004db6f0
add esp, 0xc
lea eax, [ebp - 0x1010]
push 0x800
push eax
push dword [edi + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x542750]
mov dword [ebp - 0x1014], eax
push 0x11
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xffff8000
test cx, ax
je 0x45680e
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x1014]
call fcn.004028a2
lea eax, [ebp - 0x1014]
mov ecx, esi
push eax
call fcn.004028cd
lea ecx, [ebp - 0x1014]
call fcn.00403030
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d5e2a
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x101c]
mov dword [ebp - 0x101c], ebx
push eax
push ebx
push 0x434
push dword [edi + 0x6c]
mov dword [ebp - 0x1018], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1018]
mov edx, dword [ebp - 0x101c]
cmp eax, edx
jne 0x4568a4
lea ecx, [ebp - 0x1010]
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x456849
sub ecx, edi
lea eax, [ebp - 0x1010]
sar ecx, 1
cmp ecx, edx
jne 0x45687f
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x1014]
push 0x52471c
push eax
call fcn.0040301c
add esp, 0x10
jmp 0x4567d5
push eax
lea ecx, [ebp - 0x1014]
call fcn.004028a2
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1014]
push dword [ebp - 0x101c]
call fcn.004590e8
jmp 0x4567d5
add edx, edx
cmp edx, 0x1000
jae 0x4568e3
lea eax, [ebp + eax*2 - 0x1010]
xor ecx, ecx
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x1010]
mov word [ebp + edx - 0x1010], cx
push eax
lea eax, [ebp - 0x1014]
push str._s_c_s
push eax
call fcn.0040301c
add esp, 0x14
jmp 0x4567d5
call fcn.004d8504
int3
Function at 0x45747f
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 8
mov eax, 0x4fb5a4
call fcn.004e3337
mov edi, ecx
mov eax, dword [0x542750]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov ebx, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push 0xd
call ebx
test eax, eax
je 0x4574b0
push 0xd
pop esi
jmp 0x4574bb
push 1
call ebx
test eax, eax
je 0x45752d
xor esi, esi
inc esi
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x45752d
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
jne 0x4574f3
inc ebx
cmp esi, ebx
je 0x457527
push ebx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x457527
push ebx
mov esi, ebx
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x457527
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp esi, 0xd
jne 0x45750e
test eax, eax
je 0x457520
push eax
lea ecx, [ebp - 0x10]
call fcn.004028a2
jmp 0x457520
cmp esi, 1
jne 0x457520
test eax, eax
je 0x457520
push eax
lea ecx, [ebp - 0x10]
call fcn.004137a6
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.004028cd
lea ecx, [ebp - 0x10]
call fcn.00403030
mov eax, edi
call fcn.004e3305
ret
Function at 0x457f44
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
mov dword [ebp - 4], edi
push dword [edi + 0x130]
or dword [edi + 0xd4], 0xffffffff
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x457f6e
xor eax, eax
jmp 0x458069
mov eax, dword [edi + 0x124]
sub eax, dword [edi + 0x120]
test eax, 0xfffffffc
jne 0x457f91
push 0
push dword [edi + 0x130]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x457f67
cmp dword [ebp + 8], 0
je 0x458058
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [edi + 0x6c]
jne 0x457f67
xor edx, edx
cmp dword [edi + 0xa0], edx
jne 0x457f67
mov ecx, dword [edi + 0x68]
or dword [edi + 0xd4], 0xffffffff
push ebx
push esi
mov eax, dword [ecx]
push edx
push edx
push 0x65
call dword [eax]
mov esi, eax
mov eax, dword [edi + 0x44]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x50]
add eax, dword [edi + 0x48]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push 1
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push esi
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov ecx, dword [edi + 0x124]
sub ecx, dword [edi + 0x120]
mov eax, dword [edi + 0x154]
add eax, dword [ebp - 0x10]
mov ebx, dword [edi + 0x158]
add ebx, dword [ebp - 0xc]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
sar ecx, 2
imul ecx, dword [edi + 0x84]
mov edi, dword [edi + 0x150]
push 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push ecx
mov dword [ebp + 8], ecx
xor ecx, ecx
add edi, dword [eax + 0x4c]
push edi
push ecx
push ecx
push ecx
push dword [eax + 0xb4]
call esi
push 0x50
push dword [ebp + 8]
lea eax, [ebx + 2]
push edi
push eax
push dword [ebp - 8]
mov eax, dword [ebp - 4]
push 0
push dword [eax + 0x130]
call esi
pop esi
pop ebx
jmp 0x458066
push 0
push dword [edi + 0x130]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
inc eax
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x458093
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.004e7570
mov eax, dword [0x5415b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x100c]
push eax
xor esi, esi
mov dword [ebp - 0x1010], edi
mov ebx, ecx
mov dword [ebp - 0x100c], esi
push esi
push 0x434
mov dword [ebp - 0x1008], esi
push dword [ebx + 0x6c]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push 0xffe
mov word [ebp - 0x1004], ax
lea eax, [ebp - 0x1002]
push esi
push eax
call fcn.004db6f0
add esp, 0xc
lea eax, [ebp - 0x1004]
push 0x800
push eax
push dword [ebx + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea esi, [ebp - 0x1004]
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x45811a
mov edx, edi
sub esi, ecx
sar esi, 1
xor edi, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x458130
mov edi, dword [ebp - 0x1008]
sub edx, ecx
mov ecx, dword [ebp - 0x100c]
sar edx, 1
cmp edi, ecx
jne 0x458154
lea eax, [esi + 1]
jmp 0x45815b
mov eax, esi
sub eax, edi
inc eax
add eax, ecx
cmp eax, edx
je 0x458180
jge 0x45818d
cmp edi, ecx
jne 0x45817c
cmp esi, ecx
jne 0x458172
inc ecx
mov dword [ebp - 0x1008], edx
jmp 0x458187
inc ecx
inc edi
mov dword [ebp - 0x1008], edi
jmp 0x458187
cmp edi, esi
je 0x458169
inc ecx
mov dword [ebp - 0x1008], ecx
mov dword [ebp - 0x100c], ecx
push dword [ebp - 0x1010]
push dword [ebx + 0x6c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebp - 0x100c]
push eax
xor eax, eax
push eax
push 0x437
push dword [ebx + 0x6c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1008]
xor ecx, ecx
cmp eax, dword [ebp - 0x100c]
pop edi
setne cl
mov dword [ebx + 0x74], ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d5e2a
mov esp, ebp
pop ebp
ret 4
Function at 0x458e7d
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, 0x4fd356
call fcn.004e3337
mov esi, ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
shr eax, 0x10
div dword [esi + 0x34]
push eax
mov dword [esi + 0x24], eax
call fcn.00458c23
test eax, eax
jne 0x458ee4
mov eax, dword [0x542750]
mov dword [ebp + 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp + 0x10]
push eax
push dword [esi + 0x24]
mov ecx, esi
call fcn.00458f7b
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x54]
push dword [ebp + 0x10]
push 2
mov eax, dword [ecx]
call dword [eax + 0x70]
lea ecx, [ebp + 0x10]
call fcn.00403030
xor eax, eax
call fcn.004e3305
ret 0x10

Function at 0x45d25c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x118], 0
je 0x45d28d
cmp dword [esi + 0xe0], 0
je 0x45d28d
push 0x260
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [ebp + 0xc], 1
jne 0x45d29a
mov ecx, esi
call fcn.00447765
mov ecx, dword [0x5478e4]
push dword [esi + 0xec]
lea ecx, [ecx + 0x86ec]
call fcn.00431ab7
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x45d7ab
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esi + 0xf0]
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
sar eax, 2
test eax, eax
je 0x45d7d1
call fcn.004133d8
lea ecx, [esi + 0x124]
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
sar eax, 2
test eax, eax
je 0x45d7e8
call fcn.004133d8
mov edi, dword [esi + 0x130]
test edi, edi
je 0x45d807
mov ecx, edi
call fcn.004370e9
push edi
call fcn.004d5e25
and dword [esi + 0x130], 0
pop ecx
lea ecx, [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, esi
call fcn.00447765
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x45e194
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov ecx, 0x107
cmp eax, ecx
ja 0x45e23e
je 0x45e231
sub eax, 0x8c
je 0x45e211
sub eax, 0x4a
je 0x45e1fc
dec eax
je 0x45e211
sub eax, 0x2d
je 0x45e1ec
dec eax
je 0x45e1dc
dec eax
jne 0x45e2c1
cmp dword [esi + 0x74], eax
sete al
mov dword [esi + 0x74], eax
jmp 0x45e2bc
xor eax, eax
cmp dword [esi + 0x70], eax
sete al
mov dword [esi + 0x70], eax
jmp 0x45e2bc
xor eax, eax
cmp dword [esi + 0x6c], eax
sete al
mov dword [esi + 0x6c], eax
jmp 0x45e2bc
call fcn.00438b96
lea ecx, [esi - 0x90]
call fcn.0045d86f
jmp 0x45e2c1
call fcn.00438b96
push 0
push dword [esi - 0x8c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x5c]
call fcn.0045db5b
jmp 0x45e2c1
xor eax, eax
cmp dword [esi + 0x78], eax
sete al
mov dword [esi + 0x78], eax
jmp 0x45e2bc
sub eax, 0x108
je 0x45e2b1
dec eax
je 0x45e29e
dec eax
je 0x45e28b
dec eax
je 0x45e278
dec eax
je 0x45e265
dec eax
jne 0x45e2c1
cmp dword [esi + 0x90], eax
sete al
mov dword [esi + 0x90], eax
jmp 0x45e2bc
xor eax, eax
cmp dword [esi + 0x8c], eax
sete al
mov dword [esi + 0x8c], eax
jmp 0x45e2bc
xor eax, eax
cmp dword [esi + 0x88], eax
sete al
mov dword [esi + 0x88], eax
jmp 0x45e2bc
xor eax, eax
cmp dword [esi + 0x84], eax
sete al
mov dword [esi + 0x84], eax
jmp 0x45e2bc
xor eax, eax
cmp dword [esi + 0x80], eax
sete al
mov dword [esi + 0x80], eax
jmp 0x45e2bc
xor eax, eax
cmp dword [esi + 0x7c], eax
sete al
mov dword [esi + 0x7c], eax
call fcn.00438b96
lea ecx, [esi - 0x90]
call fcn.0045e2d3
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x45f1bb
Capabilities:
Hide graphical window

Disassembly:
push 4
mov eax, 0x4fc58e
call fcn.004e3337
mov edi, ecx
mov ecx, dword [edi + 0x170]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
test ecx, ecx
je 0x45f220
call fcn.004372a1
mov ecx, dword [edi + 0x170]
mov esi, eax
push 1
call fcn.00407811
push 0
push 0
push 0x10
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [edi + 0x170]
call fcn.00407130
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405200
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x5478e4]
push dword [edi + 0x100]
lea ecx, [ecx + 0x86ec]
call fcn.00431ab7
mov eax, dword [edi + 0x128]
mov esi, dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45f284
push dword [eax + 4]
call esi
test eax, eax
je 0x45f26c
mov eax, dword [edi + 0x128]
push 0
push 0
push 0x10
push dword [eax + 4]
call ebx
mov ecx, dword [edi + 0x128]
test ecx, ecx
je 0x45f284
mov eax, dword [ecx]
push 1
call dword [eax + 4]
and dword [edi + 0x128], 0
mov ecx, dword [edi + 0x12c]
test ecx, ecx
je 0x45f29b
mov eax, dword [ecx]
push 1
call dword [eax]
and dword [edi + 0x12c], 0
mov eax, dword [edi + 0x11c]
test eax, eax
je 0x45f2d7
push dword [eax + 4]
call esi
test eax, eax
je 0x45f2bf
mov eax, dword [edi + 0x11c]
push 0
push 0
push 0x10
push dword [eax + 4]
call ebx
mov ecx, dword [edi + 0x11c]
test ecx, ecx
je 0x45f2d7
mov eax, dword [ecx]
push 1
call dword [eax + 4]
and dword [edi + 0x11c], 0
mov eax, dword [edi + 0x158]
test eax, eax
je 0x45f313
push dword [eax + 4]
call esi
test eax, eax
je 0x45f2fb
mov eax, dword [edi + 0x158]
push 0
push 0
push 0x10
push dword [eax + 4]
call ebx
mov ecx, dword [edi + 0x158]
test ecx, ecx
je 0x45f313
mov eax, dword [ecx]
push 1
call dword [eax + 4]
and dword [edi + 0x158], 0
lea ecx, [edi + 0x24]
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
call fcn.004e3305
ret 0x10
Function at 0x462a2c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4fef58
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5415b0]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov eax, dword [0x5415b0]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
sub eax, 0x65
je 0x462bc7
sub eax, 0xda
je 0x462b84
dec eax
je 0x462ad7
dec eax
jne 0x462bc3
cmp dword [ebp + 0xc], 1
jne 0x462aa7
mov eax, dword [edi]
xor esi, esi
push esi
push esi
push 0x140
call dword [eax]
jmp 0x462bc3
cmp dword [ebp + 0xc], 6
jne 0x462bc3
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi - 0x8c]
cmp eax, ecx
je 0x462bc3
xor esi, esi
push esi
push esi
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x462bc3
xor esi, esi
lea ecx, [edi - 0x6c]
mov eax, dword [ecx]
push esi
push 0x545ae0
push 0x544c64
push esi
push str.favnameedit
call dword [eax + 0x20]
push eax
call fcn.004f7704
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x462bbe
xor eax, eax
push 0x206
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push esi
push eax
call fcn.004db6f0
add esp, 0xc
lea eax, [esp + 0x14]
push 0x104
push eax
push dword [ebx + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.00404e83
mov dword [esp + 0x230], esi
mov eax, dword [esp + 0x10]
cmp dword [eax - 8], esi
je 0x462b61
mov ecx, dword [edi + 0x54]
lea eax, [esp + 0x10]
xor edx, edx
push eax
inc edx
call fcn.0046b4d2
pop ecx
push esi
push esi
push 0x10
push dword [edi - 0x8c]
call dword [sym.imp.USER32.dll_PostMessageW]
or dword [esp + 0x230], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00403030
jmp 0x462bbe
mov ecx, dword [edi + 0x54]
xor esi, esi
push esi
push 2
pop edx
call fcn.0046b4d2
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
pop ecx
push esi
push esi
push 0x10
push dword [edi - 0x8c]
call ebx
push dword [edi + 0x50]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x462bbe
push esi
push esi
push 0x4e6
push dword [edi + 0x50]
call ebx
call fcn.00438b96
xor eax, eax
jmp 0x462bcd
mov eax, dword [edi - 0x8c]
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004d5e2a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x463003
Capabilities:
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4feff5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5415b0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x542750]
mov dword [esp + 0x10], eax
push esi
push 0x547b18
lea eax, [esp + 0x18]
xor edi, edi
push 0x525624
push eax
mov dword [esp + 0x30], edi
call fcn.0040301c
add esp, 0x10
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call fcn.004aef68
push esi
call fcn.004b2582
cmp byte [0x5483f4], 0
je 0x463086
push edi
push edi
push esi
push 0x4630ee
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x542750]
mov dword [esp + 0xc], eax
push esi
lea eax, [esp + 0x10]
mov byte [esp + 0x24], 1
push 0x525754
push eax
call fcn.0040301c
add esp, 0xc
lea eax, [esp + 0xc]
push esi
push 0x51e100
push eax
call fcn.0040301c
add esp, 0xc
push 0xffffffffffffffff
push dword [esp + 0x10]
push str.SLGAddGameID
call fcn.004309c7
lea ecx, [esp + 0xc]
call fcn.00403030
lea ecx, [esp + 0x10]
call fcn.00403030
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46344e
Capabilities:
Create process on windows

Disassembly:
push 0xc74
mov eax, 0x4ff08a
call fcn.004e336a
mov esi, edx
mov ebx, ecx
push 0x44
pop edi
push edi
lea eax, [ebp - 0xc80]
push 0
push eax
call fcn.004db6f0
mov dword [ebp - 0xc80], edi
lea edx, [ebp - 0xc20]
xor eax, eax
lea edi, [ebp - 0xc34]
stosd dword es:[edi], eax
add esp, 0xc
mov ecx, ebx
sub edx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x463492
lea eax, [ebp - 0xc20]
push 0x5c
push eax
call fcn.004d73be
xor ecx, ecx
xor edi, edi
push 0x7fe
push edi
mov word [eax + 2], cx
xor eax, eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call fcn.004db6f0
lea edx, [ebp - 0x810]
add esp, 0x14
mov ecx, ebx
sub edx, ebx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4634df
test esi, esi
je 0x46354e
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4634f7
sub ecx, edx
sar ecx, 1
je 0x46354e
mov eax, dword [0x542750]
mov dword [ebp - 0xc24], eax
push esi
push ebx
lea eax, [ebp - 0xc24]
mov dword [ebp - 4], edi
push str.__s___s
push eax
call fcn.0040301c
push 0x3e8
push dword [ebp - 0xc24]
lea eax, [ebp - 0x810]
push eax
call fcn.004d737e
add esp, 0x1c
lea ecx, [ebp - 0xc24]
call fcn.00403030
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0xc20]
push eax
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x810]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x463590
push dword [ebp - 0xc34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc30]
call esi
call fcn.004e3319
ret
Function at 0x4638eb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ff0f6
mov eax, dword fs:[0]
push eax
sub esp, 0x37c
mov eax, dword [0x5415b0]
xor eax, esp
mov dword [esp + 0x374], eax
push esi
push edi
mov eax, dword [0x5415b0]
xor eax, esp
push eax
lea eax, [esp + 0x388]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x14]
call fcn.00410dfe
lea eax, [esp + 0x14]
xor edi, edi
push eax
push esi
mov dword [esp + 0x398], edi
call fcn.004b0b0e
test eax, eax
je 0x463958
lea ecx, [esp + 0x14]
call fcn.004639e1
jmp 0x4639ad
push edi
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
call fcn.00463e52
mov dword [eax], esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [0x548234], edi
jne 0x46399d
push 0x463682
push 0xc8
push edi
push edi
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x548234], eax
push edi
push edi
push esi
push 0x463596
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
or dword [esp + 0x390], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0041057c
mov ecx, dword [esp + 0x388]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x374]
xor ecx, esp
call fcn.004d5e2a
mov esp, ebp
pop ebp
ret

Function at 0x463a66
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ff12f
mov eax, dword fs:[0]
push eax
sub esp, 0x374
mov eax, dword [0x5415b0]
xor eax, esp
mov dword [esp + 0x36c], eax
push esi
push edi
mov eax, dword [0x5415b0]
xor eax, esp
push eax
lea eax, [esp + 0x380]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [0x5478e4]
xor edi, edi
test ecx, ecx
je 0x463ac2
push 1
push edi
push edx
add ecx, 0x524
call fcn.004b80b3
lea ecx, [esp + 0xc]
call fcn.00410dfe
lea eax, [esp + 0xc]
mov dword [esp + 0x388], edi
push eax
push esi
call fcn.004b0b0e
push edi
test eax, eax
je 0x463afe
mov eax, dword [0x5478e4]
push esi
push 0x558
mov eax, dword [eax + 0x8770]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x463b14
push edi
push esi
push 0x463b48
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esp + 0x388], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.0041057c
mov ecx, dword [esp + 0x380]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x36c]
xor ecx, esp
call fcn.004d5e2a
mov esp, ebp
pop ebp
ret
Function at 0x464792
Capabilities:
Create thread

Disassembly:
push 0x20
mov eax, 0x4ff281
call fcn.004e3337
mov esi, ecx
test esi, esi
jle 0x464803
push 0x548528
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
mov ecx, esi
call fcn.00464728
mov edi, eax
xor ebx, ebx
test edi, edi
jne 0x4647e4
lea ecx, [ebp - 0x28]
call fcn.00464511
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], esi
cmp dword [ebp + 8], ebx
je 0x4647dc
lea eax, [ebp - 0x28]
push eax
call fcn.00465784
lea ecx, [ebp - 0x28]
call fcn.00464809
push 0x548528
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x464803
push ebx
push ebx
push esi
push 0x464f87
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.004e3305
ret

Function at 0x46482d
Capabilities:
Create thread

Disassembly:
push 0x1c
mov eax, 0x4ff2a4
call fcn.004e3337
mov edi, ecx
push 0x548528
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi]
lea ebx, [edi + 8]
mov edx, dword [ebx]
call fcn.00464728
mov esi, eax
test esi, esi
jne 0x464886
lea ecx, [ebp - 0x28]
call fcn.00464511
and dword [ebp - 4], esi
mov ecx, dword [edi]
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x1c]
push ebx
call fcn.00402a9f
lea eax, [ebp - 0x28]
push eax
call fcn.00465784
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00464809
push 0x548528
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
jne 0x4648dc
push 0x10
call fcn.004d6a5a
mov esi, eax
pop ecx
test esi, esi
je 0x4648c0
mov ecx, dword [0x542750]
mov dword [esi + 4], ecx
mov ecx, dword [0x542750]
mov dword [esi + 8], ecx
mov ecx, dword [0x542750]
mov dword [esi + 0xc], ecx
jmp 0x4648c2
xor esi, esi
push edi
mov ecx, esi
call fcn.004648e2
xor eax, eax
push eax
push eax
push esi
push 0x464ed9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.004e3305
ret

Function at 0x46491c
Capabilities:
Create thread

Disassembly:
push edi
mov edi, ecx
push dword [edi + 8]
mov ecx, dword [edi]
call fcn.0046497b
pop ecx
test eax, eax
je 0x464979
push ebx
push esi
push 0x10
call fcn.004d6a5a
mov esi, eax
xor ebx, ebx
pop ecx
test esi, esi
je 0x46495d
mov ecx, dword [0x542750]
mov dword [esi + 4], ecx
mov ecx, dword [0x542750]
mov dword [esi + 8], ecx
mov ecx, dword [0x542750]
mov dword [esi + 0xc], ecx
jmp 0x46495f
mov esi, ebx
push edi
mov ecx, esi
call fcn.004648e2
push ebx
push ebx
push esi
push 0x4655f4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
pop ebx
pop edi
ret