joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b9f70
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x21c
mov eax, dword [0x597fb8]
xor eax, esp
mov dword [esp + 0x218], eax
push edi
xor edi, edi
call fcn.004aefd0
test eax, eax
jne 0x4ba0d1
push ebp
push esi
lea eax, [esp + 0x10]
push eax
call fcn.00523650
lea esi, [esp + 0x10]
call fcn.004b8df0
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov esi, eax
mov dword [esp + 0xc], esi
call ebp
sub eax, esi
cmp eax, 0xea60
ja 0x4ba0c5
push ebx
mov ebx, dword [0x598cdc]
lea ecx, [ecx]
mov ecx, dword [esp + 0x1c]
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
push ecx
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x4ba02e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Open_pipe_failed__d_n
call fcn.0048f080
add esp, 8
call fcn.004b8c30
test eax, eax
je 0x4ba0c4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
sub eax, dword [esp + 0x10]
cmp eax, 0xea60
jbe 0x4b9fd0
jmp 0x4ba0c4
push 0xb8
call fcn.004a47b0
push 0xb8
mov edi, eax
push 0
push edi
call fcn.0054a020
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 0xc
lea edx, [edi + 0x64]
push edx
call ebx
lea eax, [edi + 0x7c]
push eax
call ebx
lea ecx, [edi + 0x94]
push ecx
call ebx
mov dword [edi], esi
call fcn.004acc50
mov dword [edi + 0x14], eax
call fcn.004acc50
mov edx, dword [esp + 0x230]
mov dword [edi + 0x28], eax
mov eax, dword [esp + 0x234]
mov dword [edi + 0x5c], edx
mov dword [edi + 0x60], eax
call fcn.004acc50
mov dword [edi + 0x50], eax
call fcn.004acc50
mov dword [edi + 0x54], eax
call fcn.004acc50
push edi
push 0x4b9bd0
mov dword [edi + 0x58], eax
call fcn.004b21c0
mov edx, edi
mov dword [edi + 0x4c], eax
call fcn.004b9f30
test eax, eax
jne 0x4ba0c4
push edi
call fcn.004b8f50
xor edi, edi
pop ebx
lea ecx, [esp + 0x10]
push ecx
call fcn.00527550
pop esi
pop ebp
mov ecx, dword [esp + 0x21c]
mov eax, edi
pop edi
xor ecx, esp
call fcn.00549930
add esp, 0x21c
ret 8
Function at 0x4bb760
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, dword [edi + 0x50]
xor ebx, ebx
cmp esi, ebx
je 0x4bb7b1
push ebp
cmp dword [esi + 0xc], ebx
mov ebp, dword [esi]
je 0x4bb7eb
cmp dword [edi + 0x58], ebx
je 0x4bb7b7
mov edx, dword [edi + 0x30]
push ebx
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 0x1c]
push ecx
push edx
mov dword [edi + 0x58], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x4bb7dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e4
je 0x4bb82f
mov dword [edi + 0x38], 1
pop ebp
pop edi
pop esi
pop ebx
ret 4
lea eax, [edi + 0x1c]
push eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [edi + 0x30]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4bb815
mov eax, dword [esp + 0x14]
add dword [esi + 8], eax
sub dword [esi + 0xc], eax
cmp dword [esi + 0xc], ebx
jne 0x4bb778
mov edx, dword [esi + 4]
push edx
call fcn.004a4810
push esi
call fcn.004a4810
cmp ebp, ebx
mov dword [edi + 0x50], ebp
jne 0x4bb804
mov dword [edi + 0x54], ebx
cmp ebp, ebx
mov esi, ebp
jne 0x4bb771
pop ebp
pop edi
pop esi
pop ebx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4bb7a9
push str.write_pending..._n
call fcn.0048f080
add esp, 4
pop ebp
mov dword [edi + 0x58], 1
pop edi
pop esi
pop ebx
ret 4
Function at 0x4bcaa0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push edi
xor edi, edi
cmp dword [esi + 0x3c], edi
je 0x4bcb3d
mov ebx, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x4bcac0
cmp dword [esi + 0x4c], edi
je 0x4bcaec
mov edx, dword [esi + 0x30]
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + 8]
push ecx
push edx
mov dword [esi + 0x4c], edi
call ebx
test eax, eax
jne 0x4bcb2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e4
jmp 0x4bcbb9
mov edx, dword [esi + 0x3c]
lea eax, [esi + 8]
push eax
mov eax, dword [esi + 0x40]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0x30]
push edx
push eax
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call ebp
test eax, eax
je 0x4bcbae
mov edx, dword [esp + 0xc]
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x3c]
sub ecx, dword [esi + 0x44]
push edx
push eax
push ecx
push str.read_total:_p__remaining:__u__numread:__u_n
call fcn.0048f080
add esp, 0x10
mov eax, dword [esp + 0xc]
add dword [esi + 0x40], eax
sub dword [esi + 0x3c], eax
cmp dword [esi + 0x3c], edi
jne 0x4bcac0
cmp dword [esi + 0x48], edi
je 0x4bcb72
mov eax, esi
call fcn.004bbd90
mov eax, dword [esi + 0x44]
cmp eax, edi
je 0x4bcb56
push eax
call fcn.004a4810
push 4
call fcn.004a47b0
mov dword [esi + 0x48], edi
pop edi
pop ebp
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], 4
pop ebx
pop ecx
ret
mov eax, dword [esi + 0x44]
mov edi, dword [eax]
lea edx, [edi - 8]
cmp edx, 0x7ffff8
ja 0x4bcbc7
push eax
call fcn.004a4810
push edi
call fcn.004a47b0
mov dword [esi + 0x44], eax
mov dword [eax], edi
mov eax, dword [esi + 0x44]
add eax, 4
add edi, 0xfffffffc
mov dword [esi + 0x3c], edi
pop edi
pop ebp
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], 1
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4bcbc7
pop edi
pop ebp
mov dword [esi + 0x4c], 1
pop ebx
pop ecx
ret
pop edi
pop ebp
mov dword [esi + 0x38], 1
pop ebx
pop ecx
ret
Function at 0x4c0a00
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
cmp eax, 0x203
push esi
jg 0x4c0aad
je 0x4c0a8d
cmp eax, 0x7b
je 0x4c0ab8
cmp eax, 0x201
jne 0x4c0c59
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x5992f6], 0
mov esi, eax
je 0x4c0a60
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov ecx, esi
sub ecx, dword [0x5992d4]
cmp ecx, eax
ja 0x4c0a60
call fcn.004c0950
mov dword [0x5992d4], esi
xor eax, eax
pop esi
add esp, 8
ret 4
cmp byte [0x598f00], 0
jne 0x4c0a72
cmp byte [0x5992f4], 0
je 0x4c0a77
call fcn.004c0950
mov dword [0x5992d4], esi
mov byte [0x5992f6], 1
xor eax, eax
pop esi
add esp, 8
ret 4
call fcn.004c0950
mov byte [0x5992f6], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x5992d4], eax
xor eax, eax
pop esi
add esp, 8
ret 4
cmp eax, 0x205
jne 0x4c0c59
push ebx
push edi
push 0x10
call fcn.004ae120
test eax, eax
je 0x4c0ad4
xor edx, edx
cmp byte [0x598eff], dl
sete dl
mov edi, edx
jmp 0x4c0adb
movsx edi, byte [0x598eff]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, dword [sym.imp.USER32.dll_CreateMenu]
call esi
mov ebx, eax
call esi
test edi, edi
mov esi, eax
je 0x4c0b25
mov ecx, dword [0x58eeec]
mov edx, dword [ecx + 0x1cc]
push edx
push 0x9c41
push 0
push esi
call fcn.004aa7e0
mov eax, dword [0x58eeec]
mov ecx, dword [eax + 0xd34]
push ecx
push 0x9c47
jmp 0x4c0b51
mov edx, dword [0x58eeec]
mov eax, dword [edx + 0xd34]
push eax
push 0x9c47
push 0
push esi
call fcn.004aa7e0
mov ecx, dword [0x58eeec]
mov edx, dword [ecx + 0x1cc]
push edx
push 0x9c41
push 0
push esi
call fcn.004aa7e0
push esi
call fcn.004aa870
mov eax, dword [0x58eeec]
mov ecx, dword [eax + 0x260]
push ecx
push 0x9c44
push 0
push esi
call fcn.004b1af0
mov edx, dword [0x58eeec]
mov eax, dword [edx + 0xd24]
push eax
push 0xa2e5
push 0
push esi
call fcn.004b1af0
mov ecx, dword [0x58eeec]
mov edx, dword [ecx + 0xb54]
push edx
push 0xa2e4
push 0
push esi
call fcn.004b1af0
push esi
call fcn.004aa870
mov eax, dword [0x58eeec]
mov ecx, dword [eax + 0x1dc]
push ecx
push 0x9c45
push 0
push esi
call fcn.004aa7e0
push esi
call fcn.004aa870
mov edx, dword [0x58eeec]
mov eax, dword [edx + 0x1e0]
push eax
push 0x9c46
push 0
push esi
call fcn.004aa7e0
push 0x551656
push esi
push 0x10
push ebx
call fcn.004aa7e0
test edi, edi
push 0
je 0x4c0c06
push 0x9c41
jmp 0x4c0c0b
push 0x9c47
push esi
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov ecx, dword [0x5992f8]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [0x5992f8]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0
push edx
push 0
push eax
push ecx
push 2
push esi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov edx, dword [0x5992f8]
push 0
push 0
push 0
push edx
call dword [0x598e1c]
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 8
ret 4
Function at 0x4c57e0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
mov eax, dword [esi + 0x60]
push edi
push eax
call fcn.004ada80
mov edi, eax
test edi, edi
je 0x4c5816
cmp byte [0x598e96], 0
jne 0x4c580a
cmp byte [0x58b62b], 0
jne 0x4c5816
mov ecx, dword [esi + 0x60]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x2c8], 0
je 0x4c5827
mov eax, dword [esi + 0x2c4]
jmp 0x4c5830
mov edx, dword [esi + 0x60]
push edx
call fcn.004ada30
test eax, eax
jne 0x4c588d
test edi, edi
jne 0x4c588d
cmp dword [esi + 0x2c8], edi
jne 0x4c588d
mov ecx, dword [esi + 0x60]
mov edi, dword [esi + 0x2ac]
sub edi, dword [esi + 0x2a4]
push ebx
mov ebx, dword [esi + 0x2b0]
sub ebx, dword [esi + 0x2a8]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x2a4], eax
add eax, edi
mov dword [esi + 0x2a8], ecx
add ecx, ebx
mov dword [esi + 0x2ac], eax
mov dword [esi + 0x2b0], ecx
pop ebx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4cb570
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x218
mov eax, dword [0x597fb8]
xor eax, esp
mov dword [esp + 0x214], eax
cmp byte [0x5991a0], 0
push ebx
push esi
mov esi, dword [esp + 0x224]
push edi
jne 0x4cb660
cmp dword [0x5991a4], 5
jae 0x4cb660
lea eax, [esp + 0xc]
push eax
call fcn.00523650
mov edi, dword [esp + 0x22c]
push edi
push esi
xor ebx, ebx
call fcn.004c4560
mov dword [esp + 0xc], eax
add eax, 1
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.00527570
mov ebx, dword [esp + 0x14]
push edi
push esi
call fcn.004c4560
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
push edx
push eax
call fcn.00401000
add eax, 1
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4cb654
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
push ecx
push edx
push eax
call fcn.00401120
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esi + 0x60]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4cb64d
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0xc]
push ecx
call fcn.00527550
jmp 0x4cb6c8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0xc]
push ecx
call fcn.00527550
jmp 0x4cb6c8
push ebp
mov ebp, dword [esp + 0x230]
push ebp
push esi
xor ebx, ebx
call fcn.004c4560
lea edx, [eax + eax + 2]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4cb6c7
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebp
push esi
mov ebx, eax
call fcn.004c4560
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esi + 0x60]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4cb6c0
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4cb6c7
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebp
mov ecx, dword [esi + 0x180]
push ecx
call fcn.004b84b0
push esi
call fcn.004cb140
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00549930
add esp, 0x218
ret 8

Function at 0x4cba50
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push str.ui_close_n
call fcn.0048f080
mov esi, dword [esp + 0x10]
add esp, 4
call fcn.004c7b80
mov eax, dword [esi + 0x60]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, esi
call fcn.004c4820
cmp dword [esi + 0x440], 0
jne 0x4cbab8
cmp byte [0x598f12], 0
je 0x4cba95
push esi
call fcn.0050fef0
jmp 0x4cbab8
mov eax, esi
mov dword [esi + 0x440], 1
call fcn.004c3200
mov ecx, dword [0x599318]
mov dword [esi + 0x124], ecx
mov dword [0x599318], esi
cmp byte [0x58b62a], 0
pop esi
pop ebx
jne 0x4cbad4
cmp dword [0x59932c], 0
jne 0x4cbad4
call fcn.004c0090
ret 4
call fcn.004b72e0
mov dword [esp + 4], 0
jmp fcn.004096c0
Function at 0x4cce30
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
cmp byte [0x58b6a1], 0
je 0x4ccf63
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00510c80
test eax, eax
je 0x4ccf53
mov eax, dword [esi + 0x180]
push eax
call fcn.004b84b0
push esi
call fcn.004cb140
mov ecx, dword [esi + 0x2d4]
push ecx
push str.CUT_isviewing__d_n
push 0xffffffffffffffff
call fcn.0048f0a0
add esp, 0xc
cmp dword [esi + 0x2d4], 0
je 0x4cce9c
mov edx, dword [esi + 0x2d8]
mov eax, dword [esi + 0x60]
push edx
push eax
call dword [sym.imp.USER32.dll_ChangeClipboardChain]
mov dword [esi + 0x2d4], 0
mov ecx, dword [esi + 0x60]
push edi
push ecx
xor edi, edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4cceea
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
call fcn.004c29c0
test eax, eax
je 0x4ccee4
mov edi, dword [sym.imp.USER32.dll_SetClipboardData]
push eax
push 0xf
call edi
push 2
call fcn.004c2970
test eax, eax
je 0x4ccedf
push eax
call fcn.004c2fa0
movzx edx, ax
push edx
call edi
mov edi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
push edi
push str.iscut__d_n
push 0xffffffffffffffff
call fcn.0048f0a0
add esp, 0xc
test edi, edi
je 0x4ccf4c
push str.ghost_selection_n
push 0xffffffffffffffff
call fcn.0048f0a0
add esp, 8
push esi
call fcn.004f0950
mov eax, dword [esi + 0x2d4]
push eax
push str.viewing__d_n
push 0xffffffffffffffff
call fcn.0048f0a0
add esp, 0xc
cmp dword [esi + 0x2d4], 0
jne 0x4ccf4c
mov ecx, dword [esi + 0x60]
push ecx
call dword [sym.imp.USER32.dll_SetClipboardViewer]
mov dword [esi + 0x2d8], eax
mov dword [esi + 0x2d4], 1
mov dword [esi + 0x2d0], edi
pop edi
push str.is_cut_done_n
push 0xffffffffffffffff
call fcn.0048f0a0
add esp, 8
pop esi
ret 4
Function at 0x4d4850
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x114
mov eax, dword [0x597fb8]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push edi
push esi
mov dword [esi + 4], 0xff
mov dword [esi + 0x10], 1
mov dword [esi], 0
mov dword [esi + 8], 0
push 0x4d4760
mov dword [esi + 0x6c], 0
call fcn.004b21c0
mov dword [esi + 0x68], eax
lea eax, [esp + 8]
push eax
call fcn.00523650
mov eax, dword [0x58eeec]
mov ecx, dword [eax]
mov edx, dword [eax + 0x14]
push ecx
push edx
lea eax, [esp + 0x10]
push eax
call fcn.00524440
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x58]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push ecx
push 0x2711
push edx
call edi
push eax
call fcn.004aa2e0
lea eax, [esp + 8]
push eax
call fcn.00527550
mov ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
mov eax, dword [esi + 0x2c]
push ecx
mov ecx, dword [esi + 0x28]
push edx
mov edx, dword [esi + 0x58]
push eax
push ecx
push 0x2711
push edx
call fcn.004aa380
mov eax, dword [esi + 0x58]
push 0
push 0x2712
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi + 0x58]
push 0
push 0x2713
push ecx
call edi
push eax
call ebx
mov edx, dword [esi + 0x58]
push 0
push 0x2714
push edx
call edi
push eax
call ebx
mov eax, dword [esi + 0x58]
push 0
push 0x2715
push eax
call edi
push eax
call ebx
mov ecx, dword [esi + 0x58]
push 0
push 0x2716
push ecx
call edi
push eax
call ebx
mov ecx, dword [esp + 0x118]
pop edi
pop ebx
xor ecx, esp
call fcn.00549930
add esp, 0x114
ret
Function at 0x4f6be0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
push 2
push esi
call fcn.00510f80
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 0
mov ebp, 1
je 0x4f6c49
cmp dword [esi + 0x354], ebp
push esi
jne 0x4f6c24
call fcn.004ee200
mov edi, eax
imul edi, dword [esi + 0x35c]
jmp 0x4f6c2b
call fcn.004ee200
mov edi, eax
push edi
push esi
call fcn.004ee620
cmp ebx, edi
jl 0x4f6c3c
add eax, edi
cmp ebx, eax
jl 0x4f6c45
cmp byte [0x598ea1], 0
je 0x4f6c49
mov dword [esp + 0x10], ebp
push esi
call fcn.004ee200
cmp dword [esi + 0x354], ebp
mov dword [esp + 0x14], eax
jne 0x4f6c67
mov eax, dword [esi + 0x35c]
mov dword [esp + 0x20], eax
jmp 0x4f6c6b
mov dword [esp + 0x20], ebp
xor edi, edi
push edi
push esi
call fcn.004f46c0
call dword [sym.imp.USER32.dll_GetCapture]
mov ecx, dword [esi + 0x60]
push eax
push ecx
call fcn.004ad0c0
test eax, eax
je 0x4f6c8e
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ebx, dword [esp + 0x24]
cmp ebx, dword [esi + 0x354]
mov ebp, dword [sym.imp.USER32.dll_InvalidateRect]
je 0x4f6cf0
mov edx, dword [esi + 0x2e4]
push 0
push 0
push edx
mov dword [esi + 0x354], ebx
call ebp
test ebx, ebx
jne 0x4f6ccb
mov eax, dword [esi + 0x6c]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call fcn.004ee4e0
jmp 0x4f6cd7
mov ecx, dword [esi + 0x6c]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call fcn.004f46c0
push esi
call fcn.004efab0
push esi
call fcn.004f60b0
mov edi, 1
cmp ebx, 1
jne 0x4f6d27
mov eax, dword [esp + 0x28]
cmp eax, dword [esi + 0x358]
je 0x4f6d21
mov dword [esi + 0x358], eax
call fcn.004f0a30
push esi
call fcn.004f60b0
mov edx, dword [esi + 0x2e4]
push 0
push 0
push edx
call ebp
mov edi, ebx
push esi
call fcn.004efab0
test edi, edi
je 0x4f6d78
cmp ebx, 1
jne 0x4f6d38
mov ecx, dword [esi + 0x35c]
jmp 0x4f6d3d
mov ecx, 1
mov eax, dword [esp + 0x20]
cmp ecx, eax
je 0x4f6d64
imul dword [esp + 0x14]
push 1
mov edi, eax
push 1
mov ebx, edx
mov eax, ecx
cdq
push edx
push eax
push ebx
push edi
call fcn.0054a4e0
push eax
push esi
call fcn.004f6840
cmp dword [esp + 0x10], 0
je 0x4f6d78
mov eax, dword [esp + 0x18]
push 0
push eax
push esi
call fcn.004f6a10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x4fb7b0
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x334
mov eax, dword [0x597fb8]
xor eax, esp
mov dword [esp + 0x330], eax
push esi
lea eax, [esp + 0x114]
push eax
call fcn.00523650
lea ecx, [esp + 0x114]
push ecx
push 0x554af0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
xor esi, esi
call fcn.004ae600
test eax, eax
je 0x4fb8eb
lea edx, [esp + 4]
push edx
call fcn.00523650
lea eax, [esp + 0x224]
push eax
mov esi, 2
call fcn.00523650
push 0
lea ecx, [esp + 0x228]
push ecx
call fcn.004ad650
mov edx, dword [esp + 0x22c]
push edx
lea eax, [esp + 8]
push str.__s___startup
push eax
call fcn.00524440
add esp, 0xc
call fcn.004a3a20
test eax, eax
je 0x4fb85e
call fcn.004a3a20
push eax
lea ecx, [esp + 8]
push str.__instance___s_
push ecx
call fcn.005245e0
add esp, 0xc
mov eax, dword [0x599188]
cmp dword [eax + 0x10], 0
je 0x4fb87f
mov edx, dword [eax + 0x10]
push edx
lea eax, [esp + 8]
push str.__config___s_
push eax
call fcn.005245e0
add esp, 0xc
lea ecx, [esp + 0x224]
push ecx
call fcn.00527550
mov edx, dword [esp + 0x11c]
push edx
push str.reg:__s_n
call fcn.0048f080
mov eax, dword [esp + 0x14]
push eax
push str.set:__s_n
call fcn.0048f080
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x12c]
mov dl, byte [eax]
add esp, 0x10
cmp dl, byte [ecx]
jne 0x4fb8d2
test dl, dl
je 0x4fb8dc
mov dl, byte [eax + 1]
add eax, 1
add ecx, 1
cmp dl, byte [ecx]
je 0x4fb8c1
movzx ecx, byte [ecx]
movzx eax, byte [eax]
sub eax, ecx
jne 0x4fb8e1
mov esi, 1
lea edx, [esp + 4]
push edx
call fcn.00527550
lea eax, [esp + 0x114]
push eax
call fcn.00527550
mov ecx, dword [esp + 0x334]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00549930
add esp, 0x334
ret
Function at 0x502130
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x224
mov eax, dword [0x597fb8]
xor eax, esp
mov dword [esp + 0x220], eax
push 0x554af0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
call fcn.004b3c90
push 0
push str.InstallRunOnStartup
call fcn.004fdf70
lea eax, [esp]
push eax
call fcn.00523650
lea ecx, [esp + 0x110]
push ecx
call fcn.00523650
push 0
lea edx, [esp + 0x114]
push edx
call fcn.004ad650
mov eax, dword [esp + 0x118]
push eax
lea ecx, [esp + 4]
push str.__s___startup
push ecx
call fcn.00524440
add esp, 0xc
call fcn.004a3a20
test eax, eax
je 0x5021c4
call fcn.004a3a20
push eax
lea edx, [esp + 4]
push str.__instance___s_
push edx
call fcn.005245e0
add esp, 0xc
mov eax, dword [0x599188]
cmp dword [eax + 0x10], 0
je 0x5021e5
mov eax, dword [eax + 0x10]
push eax
lea ecx, [esp + 4]
push str.__config___s_
push ecx
call fcn.005245e0
add esp, 0xc
lea edx, [esp + 0x110]
push edx
call fcn.00527550
mov eax, dword [esp + 8]
push eax
push 0x554af0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
call fcn.004b3af0
push 1
push str.InstallRunOnStartup
call fcn.004fdf70
lea ecx, [esp]
push ecx
call fcn.00527550
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00549930
add esp, 0x224
ret
Function at 0x512e70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, dword [esp + 0x60]
push edi
mov edi, eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x34], ebp
cmp byte [edi], 0
je 0x512f7f
mov al, byte [edi]
cmp al, 0x25
jne 0x512f41
mov al, byte [edi + 1]
add edi, 1
cmp al, 0x25
jne 0x512efb
cmp byte [esi], al
jne 0x512f84
add esi, 1
add edi, 1
jmp 0x512f76
cmp al, 0x30
jb 0x512f38
cmp al, 0x39
ja 0x512f38
movzx ebx, al
sub ebx, 0x30
add edi, 1
mov dword [esp + ebx*4 + 0x38], esi
cmp byte [esi], 0
je 0x512f30
mov eax, dword [esp + 0x68]
push eax
lea ecx, [esi + ebp]
mov eax, edi
call fcn.005128a0
test eax, eax
jne 0x512f30
add ebp, 1
cmp byte [esi + ebp], al
jne 0x512f15
mov dword [esp + ebx*4 + 0x10], ebp
add esi, ebp
jmp 0x512f74
test al, al
je 0x512f7f
add edi, 1
jmp 0x512f76
cmp dword [esp + 0x68], ebp
je 0x512f53
cmp byte [esi], al
jne 0x512f84
add esi, 1
add edi, 1
jmp 0x512f76
push esi
call fcn.00522820
push edi
mov ebx, eax
call fcn.00522820
mov ebp, eax
push ebp
push edi
push ebx
push esi
call fcn.00414410
test eax, eax
jne 0x512f84
add esi, ebx
add edi, ebp
xor ebp, ebp
cmp byte [edi], 0
jne 0x512ed8
cmp byte [esi], 0
je 0x512f9d
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x70]
push ecx
push edx
call fcn.00523f80
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10
mov eax, dword [esp + 0x6c]
push ebp
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x44]
push edx
push eax
call fcn.00512950
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10