joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455ccb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x455d5d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x455d33
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x455d1b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
jmp 0x455d31
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x455d31
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x455d5b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
push 1
push 0x30a8
push 0
push 0xf14
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.00455ef5
add esp, 0x18
jmp 0x455d7e
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push 0x7b0c
push 0
push dword [ebp - 0x28]
call fcn.0042cfbf
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x461b37
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x461c51
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x461c0f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x461c03
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x461bc5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x461c01
push dword [ebp - 0x2c]
push 0x2bf
push dword [ebp - 4]
push 1
push 0x2c82
push 1
push 0x4338
push 0x35c0
push 0x4024
push 0x7726
push 1
call fcn.00453e25
add esp, 0x2c
jmp 0x461bba
jmp 0x461c0d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x461c4f
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
push 0x4ea7
push 0
push 1
push 0x77f9
push 0x3793
push 0x7d33
push 1
push dword [ebp - 0x38]
push 0
push dword [ebp - 0x3c]
push 0x2cfd
push 0x238a
call fcn.00444f22
add esp, 0x30
jmp 0x461c71
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x44], eax
push 1
push dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
push eax
call fcn.00427192
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x4635aa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x4636b3
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x463636
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x463619
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x463634
push 0
push 0x1619
push 0
push 0
push 0x747
push 0x1bf4
call dword [sym.imp.USER32.dll_ToAsciiEx]
jmp 0x4636b1
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x46369f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x463680
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x46369d
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.0040bd1c
mov dword [eax], 0x1ad386cc
jmp 0x463675
jmp 0x4636b1
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x4636ee
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
push 0x6f6
push 0x7e57
push 0x5b2f
push dword [ebp - 0x48]
push 0
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push 0x14bf
push 1
call fcn.00440735
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x46a673
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cae05
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x8c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x46a6ad
push 1
call fcn.0046a8e9
pop ecx
jmp 0x46a8d8
lea eax, [ebp + 0x10]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x46a6ff
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
push 0x2d4a
push dword [ebp - 0x20]
push 0x384f
push 1
push dword [ebp - 0x44]
push 0x2b2c
call fcn.0045bc63
add esp, 0x18
jmp 0x46a8d8
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], 0x661b
mov dword [ebp - 0x40], str.kippzodm_nlimuh_rxaqk_avdf_alkicrl_rjt_tmrsaqsto_shjoueygs_btsu_foulikul
cmp dword [ebp - 0x1c], 0x68db
jle 0x46a78c
and dword [ebp - 0x18], 0
jmp 0x46a729
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5a5b
jge 0x46a786
and dword [ebp - 0x14], 0
jmp 0x46a73f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3d78
jge 0x46a784
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x14]
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x9c]
call fcn.004019b1
pop ecx
pop ecx
mov ecx, eax
call fcn.0040b8ce
push eax
call fcn.004b4d47
pop ecx
lea ecx, [ebp - 0x9c]
call fcn.0040b8c4
jmp 0x46a738
jmp 0x46a722
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x46a881
mov dword [ebp - 0x54], 0xfd41
mov dword [ebp - 0x80], 0xfffffff6
mov dword [ebp - 0x4c], 0x98070ade
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x5c], 0x4b666a75
mov dword [ebp - 0x74], 0xf5ed9a92
mov dword [ebp - 0x64], 0x1151c3c3
mov dword [ebp - 0x84], 0xa97963ba
mov dword [ebp - 0x6c], 0xe649f6d4
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x58], 0xc8f0d071
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x68], 0xfffffff7
mov dword [ebp - 0x70], 0xa065c2dd
mov dword [ebp - 0x78], 0x3aaf5bfb
mov dword [ebp - 0x38], 0xc41ac3dc
push 0
push 0x4925
push 1
push 0x35dc
push 0x4316
push 0x37ee
push 1
push 0
push 0x20c2
push 0x2eac
push 0x2092
push 0x33af
push 0x31fb
push 0x55ff
push 0x3ee5
push 0x5dd2
push 0x5cad
push 0x279f
push 1
call fcn.00460fe4
add esp, 0x4c
lea eax, [ebp - 0x38]
push eax
push 0
push 1
push 0x882
push 0x69cb
call fcn.00443eb4
add esp, 0x14
jmp 0x46a89c
push 0
push 0x1619
push 0
push 0
push 0x747
push 0x1bf4
call dword [sym.imp.USER32.dll_ToAsciiEx]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x63d7
jge 0x46a8b2
push dword [ebp - 0x40]
call fcn.004b4d47
pop ecx
jmp 0x46a8ce
or dword [ebp - 4], 0xffffffff
jmp 0x46a8d8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46bac2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x46bb57
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x46bb3b
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x46bb18
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x46bb39
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x46bb39
push 0x1ecd
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x46bb55
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push 0xeb7
push 0
push 1
call fcn.00460ca7
add esp, 0x10
jmp 0x46bb8d
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x2c]
push 0x25a6
push 0x493d
push 1
push 1
push 0x4e09
push 0x3497
call fcn.00435ad9
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x46c71a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x46c7f9
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x46c7de
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x46c7a4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x46c7a2
push 0
push 0x311
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x46c7dc
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.0040bd1c
mov esi, eax
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.0040bd1c
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x46c7f7
push 0
push 0x7455
push 0x6ffb
push 0x61da
call fcn.0046db5f
add esp, 0x10
jmp 0x46c81c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
push 0x4c92
push 0
push dword [ebp - 0x44]
push 0x39
call fcn.0042f3a6
add esp, 0x14
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47bacd
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4caf27
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x47bb5e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x47bb23
push 0x439e
push 1
call fcn.0047bcbb
pop ecx
pop ecx
jmp 0x47bb59
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
push 1
push dword [ebp - 0x30]
push 0x104b
push 0
push 0x1c09
push 0x516a
push dword [ebp - 0x34]
push 0x7f19
push 0
push 1
call fcn.0048b575
add esp, 0x28
jmp 0x47bcaa
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x47bbbb
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x47bba9
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
jmp 0x47bbb6
push 0x5a1
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x47bcaa
mov dword [ebp - 0x20], 0x57d2
mov dword [ebp - 0x50], str.bymikbt_mkdljgbwb_ufeniybiu_itbi
cmp dword [ebp - 0x20], 0x5931
jle 0x47bc4e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
and dword [ebp - 0x14], 0
jmp 0x47bbeb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6222
jge 0x47bc41
and dword [ebp - 0x18], 0
jmp 0x47bc01
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7b54
jge 0x47bc3f
mov eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.004019b1
pop ecx
pop ecx
mov ecx, eax
call fcn.0040b8ce
push eax
call fcn.004b4d47
pop ecx
lea ecx, [ebp - 0x70]
call fcn.0040b8c4
jmp 0x47bbfa
jmp 0x47bbe4
push 0x15b8
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4512
push 0
push 0
push 0x7bc7
push 0x6c89
push 0x4544
call fcn.0047df4e
add esp, 0x18
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x572d
jge 0x47bc84
push dword [ebp - 0x50]
call fcn.004b4d47
pop ecx
jmp 0x47bca0
or dword [ebp - 4], 0xffffffff
jmp 0x47bcaa
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4823d8
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cafe5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x482577
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x482553
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], 0x304e
mov dword [ebp - 0x34], str.sidwi_moakbmhnz_zbc_yhdxvmtnv_hpjxume_frd_clmopizul
cmp dword [ebp - 0x24], 0x3075
jle 0x4824cf
and dword [ebp - 0x20], 0
jmp 0x482454
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x6d7d
jge 0x4824c7
and dword [ebp - 0x18], 0
jmp 0x48246a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3666
jge 0x4824c5
and dword [ebp - 0x1c], 0
jmp 0x482480
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7bbe
jge 0x4824c3
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x78]
call fcn.004019b1
pop ecx
pop ecx
mov ecx, eax
call fcn.0040b8ce
push eax
call fcn.004b4d47
pop ecx
lea ecx, [ebp - 0x78]
call fcn.0040b8c4
jmp 0x482479
jmp 0x482463
jmp 0x48244d
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x2faa
jge 0x4824eb
push dword [ebp - 0x34]
call fcn.004b4d47
pop ecx
jmp 0x482507
or dword [ebp - 4], 0xffffffff
jmp 0x482511
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x482533
mov byte [ebp - 0x11], 0
push 0
push 0
push 0
lea eax, [ebp - 0x11]
push eax
call fcn.0049128d
add esp, 0x10
jmp 0x482551
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x482551
push 0
call dword [sym.imp.USER32.dll_ShowCursor]
jmp 0x482575
push 0
push 1
push 0x26cb
push 0x3850
push 0
push 0x2248
push 0x2c58
call fcn.0047d4c3
add esp, 0x1c
jmp 0x4825c8
lea eax, [ebp + 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x48259d
push 0
call fcn.00484789
pop ecx
jmp 0x4825c8
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
push 0x4908
push 0x4d7e
push dword [ebp - 0x54]
push 0xe18
push 0
push dword [ebp - 0x58]
call fcn.0047e692
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4857cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 8]
test eax, eax
je 0x48589e
mov eax, dword [ebp + 0x28]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x485847
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 1
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0x3a41
call fcn.004858c7
add esp, 0x18
jmp 0x48589c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x48586e
push 0
push 0x1c27
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x48589c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x48589c
push 0x3a2
push 0
push 0
push 0
push 0
push 0x1761
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4858c3
lea eax, [ebp + 0x20]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
push 0x5f3c
push 1
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x44]
call fcn.0047e545
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x48a914
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x48a95f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
push eax
push 0x75da
push 1
push 0x4725
push dword [ebp - 0xc]
push 0x41a6
push dword [ebp - 0x10]
call fcn.0048aa4f
add esp, 0x1c
jmp 0x48aa4b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x48a9be
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push 0x2328
push dword [ebp - 0x20]
push 0
push dword [ebp - 0x24]
push 0x426e
call fcn.00482332
add esp, 0x14
jmp 0x48aa4b
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x48aa2d
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x48aa0e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x48aa2b
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x4c]
call fcn.0040bd1c
mov dword [eax], 1
jmp 0x48aa03
jmp 0x48aa4b
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x48aa4b
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esp, ebp
pop ebp
ret
Function at 0x4905d2
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x490615
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x6aad
push 1
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
push eax
push 0x21af
push 0x1ce8
push 1
push 0
call fcn.00490679
add esp, 0x20
jmp 0x490675
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x49063b
push 0x76c
push 0
call fcn.0048dc94
pop ecx
pop ecx
jmp 0x490675
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x490661
push 0
push 0x1f3a
push 0
push 0x914
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
jmp 0x490675
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x490675
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esp, ebp
pop ebp
ret