joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468ea0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d559d
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x517ba0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
test esi, esi
jne 0x468eeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x468fd5
push 0
push 0
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
push eax
push 0x400
push esi
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x468fae
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4eb4f0
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004b8a72
add esp, 0xc
lea eax, [ebp - 0x218]
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0
push 0
mov edi, eax
lea eax, [ebp - 0x21c]
push eax
push 0x400
push esi
push edi
push 0x900
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x468fa1
push 0x4e38ec
lea ecx, [ebp + 8]
call fcn.0049fa40
push dword [ebp - 0x21c]
lea ecx, [ebp + 8]
call fcn.0049fa40
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x468fd5
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x468fd5
push 0x4e38ec
lea ecx, [ebp + 8]
call fcn.0049fa40
push dword [ebp - 0x21c]
lea ecx, [ebp + 8]
call fcn.0049fa40
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp + 8]
call fcn.0049f770
push 0x10
push 0x4e23b8
push eax
push dword [0x51cf34]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x469004
call fcn.0049fda0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4433
mov esp, ebp
pop ebp
ret
Function at 0x46a3e0
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46a40d
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov ecx, dword [ebx]
test ecx, ecx
je 0x46a425
call fcn.004744a0
jmp 0x46a427
xor eax, eax
push 0
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46a48a
cmp dword [ebp - 4], 4
jne 0x46a48a
mov ecx, dword [ebx]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x46a45a
call fcn.0049fcc0
jmp 0x46a45c
xor eax, eax
push 0
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46a48a
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jne 0x46a48a
push esi
mov bl, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
push esi
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov al, bl
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x46aec0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d575d
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x517ba0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call esi
push 0
push 0x5174a0
call fcn.00423ba0
add esp, 8
test eax, eax
jne 0x46af19
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.00423600
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 0
test eax, eax
je 0x46af8d
mov eax, dword [eax]
test eax, eax
je 0x46af8d
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x46af8d
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x46af51
mov eax, dword [eax]
jmp 0x46af53
xor eax, eax
push 0x5174a0
push dword [ebp + 8]
push eax
call fcn.004238d0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x46afb0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x46af75
mov eax, dword [ecx]
jmp 0x46af77
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp edi, 0x800704d6
jne 0x46af8a
push 4
jmp 0x46af8b
push edi
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.00403090
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x46afc4
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
jmp 0x46af95
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
jmp 0x46af95
Function at 0x46d370
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
add edi, esi
cmp esi, edi
jae 0x46d3a7
mov ebx, dword [sym.imp.WS2_32.dll_recv]
push 0
mov eax, edi
sub eax, esi
push eax
push esi
push dword [0x5174a4]
call ebx
test eax, eax
je 0x46d3ae
cmp eax, 0xffffffff
je 0x46d3ae
add esi, eax
cmp esi, edi
jb 0x46d388
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret

Function at 0x46d440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x517ba0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x51cf33], 0
je 0x46d4a3
mov ecx, dword [0x5174a0]
cmp ecx, 0xffffffff
je 0x46d4a3
cmp dword [0x517664], 0
je 0x46d47c
mov eax, 0x989680
xor edx, edx
div dword [0x517664]
jmp 0x46d47e
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 1
push eax
push ecx
mov dword [ebp - 8], 0
call sub.FLTLIB.DLL_FilterSendMessage
cmp byte [ebp + 8], 0
je 0x46d4fd
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x46b730
push 0
push 0
call fcn.004bbd27
mov dword [0x51c738], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x47e810
push 0
push 0
call fcn.004bbd27
mov dword [0x51c73c], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x46d2a0
push 0
push 0
call fcn.004bbd27
add esp, 0x48
mov dword [0x51c740], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x46afe0
push 0
push 0
call fcn.004bbd27
mov dword [0x51c730], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x46b3a0
push 0
push 0
call fcn.004bbd27
mov ecx, dword [ebp - 4]
add esp, 0x30
xor ecx, ebp
mov dword [0x51c734], eax
call fcn.004a4433
mov esp, ebp
pop ebp
ret
Function at 0x477430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, ecx
push edi
push 0
push 0
push 0x1200
push dword [ebx + 0x14]
call esi
inc eax
xor ecx, ecx
mov dword [ebp - 8], eax
mov edx, 4
add eax, eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a4906
mov edi, eax
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
add esp, 4
shl eax, 3
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], edi
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0xffffffff
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47752b
cmp dword [ebp - 0x10], 3
jne 0x47752b
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], eax
jne 0x47752b
mov ecx, dword [ebp - 8]
lea eax, [ecx + 1]
lea eax, [edi + eax*4]
push eax
lea eax, [ecx - 1]
push eax
push 0x1212
push dword [ebx + 0x14]
call esi
mov eax, dword [ebp - 8]
xor esi, esi
test eax, eax
jle 0x477527
cmp dword [edi + esi*4], 0
jle 0x477522
mov edi, dword [edi + esi*4]
push 0x4e
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp edi, eax
jge 0x47751c
mov dword [ebp - 0x48], 1
lea eax, [ebp - 0x48]
mov dword [ebp - 0x44], edi
push eax
test esi, esi
jne 0x47750a
push esi
push 0x120c
push dword [ebx + 0xc]
jmp 0x477516
lea eax, [esi - 1]
push eax
push 0x120c
push dword [ebx + 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
inc esi
cmp esi, eax
jl 0x4774d8
mov byte [ebp - 1], 1
push edi
call fcn.004a447f
mov al, byte [ebp - 1]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x477540
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x517ba0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push edi
push 0
mov edi, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
push 0
push 0x1200
push dword [edi + 0x14]
mov dword [ebp - 0x20], eax
call ebx
xor ecx, ecx
mov edx, 4
lea esi, [eax + 1]
lea eax, [esi + esi]
mov dword [ebp - 0x18], esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a4906
add esp, 4
mov dword [ebp - 0x1c], eax
lea ecx, [eax + 4]
mov dword [eax + esi*4], 0
lea ecx, [ecx + esi*4]
push ecx
lea ecx, [esi - 1]
push ecx
push 0x1211
push dword [edi + 0x14]
call ebx
mov eax, dword [ebp - 0x18]
xor esi, esi
test eax, eax
jle 0x47761e
mov ebx, dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [ebp - 0x14]
push eax
test esi, esi
jne 0x4775ea
push esi
push 0x1207
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 2
lea eax, [ebp - 0x14]
push eax
push dword [edi + 8]
push dword [edi + 0xc]
jmp 0x477608
lea eax, [esi - 1]
push eax
push 0x1207
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
push 2
lea eax, [ebp - 0x14]
push eax
push dword [edi + 8]
push dword [edi + 0x14]
call ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
mov dword [ecx + esi*4], eax
inc esi
mov eax, dword [ebp - 0x18]
cmp esi, eax
jl 0x4775c5
mov ebx, dword [ebp - 0x1c]
shl eax, 3
push eax
push ebx
push 3
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
call fcn.004a447f
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov al, 1
pop edi
pop esi
pop ebx
call fcn.004a4433
mov esp, ebp
pop ebp
ret 8
Function at 0x47fac0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d66f0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x517ba0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], esi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x2c]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
test eax, eax
je 0x47fb40
lock inc dword [eax + 8]
lea eax, [esi + 0x34]
mov dword [ebp - 4], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov ecx, dword [edi + 0x38]
sub ecx, dword [edi + 0x34]
sar ecx, 5
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
je 0x47fbf0
cmp ecx, 0x7ffffff
ja 0x47fc1f
push ecx
mov ecx, eax
call fcn.00429b60
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
shl edx, 5
add edx, eax
mov dword [ebp - 0x20], ecx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], edx
mov esi, dword [ebp + 8]
mov edi, dword [ecx]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov eax, dword [esi + 0x38]
mov esi, dword [esi + 0x34]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], ecx
mov byte [ebp - 4], 2
cmp esi, eax
je 0x47fbd9
nop word [eax + eax]
push esi
mov ecx, edi
call fcn.0047fca0
add edi, 0x20
add esi, 0x20
mov dword [ebp - 0x28], edi
cmp esi, dword [ebp - 0x14]
jne 0x47fbc0
mov ecx, dword [ebp - 0x10]
push ecx
push edi
push edi
call fcn.0044f2f0
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov esi, dword [ebp - 0x18]
mov dword [eax + 4], edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x40]
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ecx
movups xmm0, xmmword [edi + 0x48]
movups xmmword [esi + 0x48], xmm0
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.0040dd70
int3
Function at 0x4820b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
mov dword [ebp + 0x10], 1
jne 0x4820f0
mov ebx, dword [ebp + 0xc]
cmp ebx, 0x110
jne 0x4820f9
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x14]
push edi
push ebx
call fcn.00482ab0
cmp dword [ebp + 0x10], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jne 0x482246
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x18
cmp ebx, 2
jne 0x48210e
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x14]
push edi
push ebx
call fcn.004829d0
jmp 0x4820e1
cmp ebx, 0x111
jne 0x482180
movzx eax, di
mov edx, 2
mov ecx, eax
cmp dx, ax
mov dword [ebp + 0xc], ecx
mov eax, edi
jne 0x482157
lea ecx, [ebp + 0x10]
shr eax, 0x10
push ecx
push dword [ebp + 0x14]
mov ecx, esi
mov dword [ebp + 0x1c], eax
push edx
push eax
call fcn.0041d3a0
cmp dword [ebp + 0x10], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jne 0x482246
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
jmp 0x48215a
shr eax, 0x10
movzx eax, ax
xor edx, edx
cmp dx, ax
jne 0x482180
lea edx, [ebp + 0x10]
mov dword [ebp + 0x10], 1
push edx
push dword [ebp + 0x14]
push ecx
push eax
mov ecx, esi
call fcn.00482850
jmp 0x4820e1
lea ecx, [esi + 0x20]
cmp ebx, 5
jne 0x482219
xor eax, eax
test ecx, ecx
cmove esi, eax
cmp byte [ecx + 0x1c], al
je 0x4821f7
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x4821f7
cmp edi, 2
jne 0x4821d3
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esi + 0x20]
call fcn.00442570
mov eax, dword [ebp + 0x18]
pop edi
pop esi
mov dword [eax], 0
lea eax, [ebx - 4]
pop ebx
pop ebp
ret 0x18
test edi, edi
jne 0x4821f7
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esi + 0x20]
call fcn.00442570
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
cmp edi, 1
je 0x48223d
lea ecx, [esi + 0x20]
call fcn.00442570
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov eax, 1
pop ebp
ret 0x18
cmp ebx, 0x24
jne 0x4820f0
cmp dword [ecx + 0x14], 0xffffffff
je 0x48223d
cmp dword [ecx + 0x18], 0xffffffff
je 0x48223d
mov edx, dword [ebp + 0x14]
mov eax, dword [ecx + 0x14]
mov ecx, dword [ecx + 0x18]
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x18
Function at 0x4837a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d007d
mov eax, dword fs:[0]
add byte [eax], al

Function at 0x483bd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push edi
mov edi, ecx
push 0x44b
push dword [edi + 4]
call esi
push 0x44c
push dword [edi + 4]
cmp eax, 1
sete byte [ebp - 1]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, 1
push 1
lea eax, [ebp - 1]
setne byte [ebp - 2]
push eax
push 3
push 0
push 0x4f2c94
push dword [0x51cb0c]
call esi
push 1
lea eax, [ebp - 2]
push eax
push 3
push 0
push 0x4f2ccc
push dword [0x51cb0c]
call esi
push 0x414
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.00474100
push 0x4f2c0c
push dword [0x51cb0c]
mov esi, eax
push dword [edi + 4]
call fcn.0048da70
add esp, 0x10
mov ecx, esi
push 0x4f2c6c
push dword [0x51cb0c]
call fcn.00477540
mov ecx, esi
call fcn.00474600
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
pop edi
mov dword [0x51cb14], 0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x485710
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d6d70
mov eax, dword fs:[0]
push eax
sub esp, 0x290
mov eax, dword [0x517ba0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x240]
mov ebx, dword [ebp + 0xc]
push eax
call fcn.00422ba0
add esp, 4
mov eax, dword [ebp - 0x240]
mov dword [ebp - 4], 0
test eax, eax
je 0x485768
mov eax, dword [eax]
jmp 0x48576a
xor eax, eax
lea ecx, [ebp - 0x23c]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x4858d5
test byte [ebp - 0x23c], 0x10
jne 0x4858d5
call fcn.0046cbb0
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
test ebx, ebx
jne 0x485877
cmp dword [ebp - 0x21c], 0
jne 0x4857e9
cmp dword [ebp - 0x220], 0
jne 0x4857e9
push 0x30
push 0x4e23b8
push 0x4f3540
push esi
call edi
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x4857db
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4858d5
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4858d5
push 0x24
push 0x4e23b8
push 0x4f3628
push esi
call edi
cmp eax, 6
jne 0x4858d5
push 0x4f3728
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004b7f10
push 0x58
lea eax, [ebp - 0x29c]
push 0
push eax
call fcn.004a7410
add esp, 0x18
mov dword [ebp - 0x29c], 0x58
lea eax, [ebp - 0x218]
mov dword [ebp - 0x298], esi
mov dword [ebp - 0x280], eax
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x27c], 0x104
push eax
mov dword [ebp - 0x290], 0x4e2554
mov dword [ebp - 0x268], 0x20008
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
jne 0x48588c
jmp 0x4858d5
push ebx
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.004b7f10
add esp, 0xc
push 0x4e2430
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00466840
add esp, 0xc
lea eax, [ebp - 0x218]
mov ecx, 0x51c200
push 0x51cd28
push 0x51cb20
push 0
push eax
call fcn.0042bdb0
test al, al
jne 0x485943
push 0x10
push 0x4e23b8
push 0x4f3740
push esi
call edi
xor bl, bl
mov esi, dword [ebp - 0x240]
test esi, esi
je 0x485925
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x485925
test esi, esi
je 0x485925
mov eax, dword [esi]
test eax, eax
je 0x485903
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x48591a
push eax
call fcn.004a447f
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.004a4471
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4433
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x485951
mov eax, dword [eax]
jmp 0x485953
xor eax, eax
push eax
push esi
call fcn.0046c5d0
mov ecx, dword [ebp - 0x240]
add esp, 8
mov bl, al
test ecx, ecx
je 0x48596d
mov ecx, dword [ecx]
jmp 0x48596f
xor ecx, ecx
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test bl, bl
jne 0x48598b
push 0x10
push 0x4e23b8
push 0x4f3790
jmp 0x4858d2
mov bl, 1
jmp 0x4858d7
Function at 0x48b130
Capabilities:
Get memory capacity
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x517ba0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x51cf98
call fcn.0048d620
push dword [0x51c748]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
push 0
call fcn.0046c540
add esp, 8
cmp byte [0x51cf30], 0
jne 0x48b1cf
push 0x38
lea eax, [ebp - 0x244]
mov dword [ebp - 0x24c], 0x40
push 0
push eax
mov dword [ebp - 0x248], 0
call fcn.004a7410
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x4f38b8
push eax
call fcn.00402e90
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x10
push 0x4e23b8
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x48c9a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
mov dword [ebp + 0x10], 1
jne 0x48c9e5
mov ebx, dword [ebp + 0xc]
mov edx, 1
cmp ebx, 0x110
jne 0x48c9ee
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x14]
push edi
push ebx
call fcn.0044c900
cmp dword [ebp + 0x10], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jne 0x48cb65
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x18
cmp ebx, 2
jne 0x48ca03
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x14]
push edi
push ebx
call fcn.0044c8e0
jmp 0x48c9d6
cmp ebx, 0x111
jne 0x48ca9f
movzx eax, di
mov ecx, eax
cmp dx, ax
mov dword [ebp + 0xc], ecx
mov eax, edi
jne 0x48ca76
lea ecx, [ebp + 0x10]
shr eax, 0x10
push ecx
push dword [ebp + 0x14]
mov ecx, esi
mov dword [ebp + 0x1c], eax
push 1
push eax
call fcn.0041d3a0
cmp dword [ebp + 0x10], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jne 0x48cb65
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
movzx eax, ax
mov edx, 0x9c68
movzx eax, ax
cmp dx, cx
jne 0x48ca9f
lea ecx, [ebp + 0x10]
mov dword [ebp + 0x10], 1
push ecx
push dword [ebp + 0x14]
mov ecx, esi
push edx
push eax
call fcn.0044c8b0
jmp 0x48c9d6
mov edx, 2
shr eax, 0x10
cmp dx, cx
jne 0x48ca4d
lea ecx, [ebp + 0x10]
mov dword [ebp + 0x10], 1
push ecx
push dword [ebp + 0x14]
mov ecx, esi
push edx
push eax
call fcn.0041d3a0
jmp 0x48c9d6
lea edx, [esi + 0x20]
cmp ebx, 5
jne 0x48cb38
xor eax, eax
test edx, edx
cmove esi, eax
cmp byte [edx + 0x1c], al
je 0x48cb16
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x48cb16
cmp edi, 2
jne 0x48caf2
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esi + 0x20]
call fcn.00442570
mov eax, dword [ebp + 0x18]
pop edi
pop esi
mov dword [eax], 0
lea eax, [ebx - 4]
pop ebx
pop ebp
ret 0x18
test edi, edi
jne 0x48cb16
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esi + 0x20]
call fcn.00442570
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
cmp edi, 1
je 0x48cb5c
lea ecx, [esi + 0x20]
call fcn.00442570
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
mov dword [eax], 0
mov eax, 1
pop ebp
ret 0x18
cmp ebx, 0x24
jne 0x48c9e5
cmp dword [edx + 0x14], 0xffffffff
je 0x48cb5c
cmp dword [edx + 0x18], 0xffffffff
je 0x48cb5c
mov eax, dword [ebp + 0x14]
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0x18]
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], edx
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 0x18