joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468910
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e4acb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
push 0x1c
call fcn.004c5dbe
add esp, 4
mov dword [esp + 8], eax
xor esi, esi
cmp eax, esi
mov dword [esp + 0x14], esi
je 0x46894b
mov ecx, eax
call fcn.004832a0
mov esi, eax
mov eax, dword [esp + 0x2c]
push esi
push eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.00483320
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
add esp, 8
add edi, 0x1248
or ah, 1
push esi
push edx
mov edx, dword [esp + 0x24]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 8], edi
push eax
mov eax, dword [edx + 4]
push ecx
push eax
call dword [sym.imp.USER32.dll_InsertMenuA]
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18

Function at 0x468a60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e4b1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, ecx
push 0x1c
mov dword [esp + 0x18], 1
call fcn.004c5dbe
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x468aa4
mov ecx, eax
call fcn.004832a0
mov esi, eax
jmp 0x468aa6
xor esi, esi
add edi, 0x1248
push esi
mov dword [esi + 8], edi
or edi, 0xffffffff
mov dword [esi + 0xc], edi
mov eax, dword [esp + 0x2c]
push eax
mov byte [esp + 0x1c], 1
call fcn.00483320
mov ecx, dword [esp + 0x34]
push esi
push ecx
call fcn.004833f0
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
add esp, 0x10
or ah, 1
push esi
push edx
mov edx, dword [ecx + 4]
push eax
push edx
call dword [sym.imp.USER32.dll_AppendMenuA]
lea ecx, [esp + 0x28]
mov byte [esp + 0x14], 0
call fcn.004c5787
lea ecx, [esp + 0x2c]
mov dword [esp + 0x14], edi
call fcn.004c5787
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14

Function at 0x469000
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e4bcb
push eax
mov dword fs:[0], esp
sub esp, 0x104
lea eax, [esp + 4]
push esi
push edi
push 0xff
mov edi, ecx
push eax
call sub.WSOCK32.dll_gethostname
lea ecx, [esp + 0xc]
lea esi, [edi + 0x71c]
push ecx
mov ecx, esi
call fcn.004c5910
mov esi, dword [esi]
mov eax, dword [esi - 8]
test eax, eax
je 0x4690a0
push esi
call sub.WSOCK32.dll_gethostbyname
mov edx, dword [0x52251c]
mov dword [esp + 8], edx
test eax, eax
mov dword [esp + 0x114], 0
je 0x46908c
mov eax, dword [eax + 0xc]
xor ecx, ecx
xor edx, edx
add edi, 0x720
mov eax, dword [eax]
mov cl, byte [eax + 1]
mov dl, byte [eax]
push ecx
push edx
push 0x520b68
push edi
call fcn.004bdb29
add esp, 0x10
lea ecx, [esp + 8]
mov dword [esp + 0x114], 0xffffffff
call fcn.004c5787
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x110
ret
Function at 0x46ae40
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x280]
test eax, eax
je 0x46ae9b
dec eax
je 0x46ae86
dec eax
je 0x46ae73
sub eax, 2
jne 0x46ae8f
mov dword [0x51e088], 0
call fcn.00470d10
mov dword [esi + 0x280], 0
pop esi
ret
mov ecx, esi
call fcn.00470410
mov dword [esi + 0x280], 0
pop esi
ret
push 0
mov ecx, esi
call fcn.0046b140
mov dword [esi + 0x280], 0
pop esi
ret
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
mov dword [0x52791c], 1
call edi
push 0x10
mov ebx, eax
call edi
pop edi
test bx, bx
pop ebx
jl 0x46aece
test ax, ax
jl 0x46aedc
push 0
mov ecx, esi
call fcn.0046b140
pop esi
ret
test ax, ax
jge 0x46aedc
mov ecx, esi
call fcn.00470d10
pop esi
ret
mov ecx, esi
call fcn.00470410
pop esi
ret
Function at 0x46cdf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push ebx
lea eax, [esp + 8]
push ebp
push eax
mov ebp, 0x104
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocString
xor ebx, ebx
mov dword [esp + 0x14], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x46ce27
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
mov eax, dword [esp + 0xc]
push esi
lea ecx, [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push 0
push str.Display_Inline_Images
push eax
mov dword [esp + 0x28], ebp
call edi
mov esi, 0x51cfe0
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x46ce7a
test cl, cl
je 0x46ce76
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x46ce7a
add eax, 2
add esi, 2
test cl, cl
jne 0x46ce56
xor eax, eax
jmp 0x46ce7f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x46ce88
mov ebx, 0x10
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push str.Display_Inline_Videos
push edx
mov dword [esp + 0x28], ebp
call edi
mov esi, 0x51cfe0
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x46ced3
test cl, cl
je 0x46cecf
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x46ced3
add eax, 2
add esi, 2
test cl, cl
jne 0x46ceaf
xor eax, eax
jmp 0x46ced8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x46cedf
or ebx, 0x20
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push str.Play_Background_Sounds
push edx
mov dword [esp + 0x28], ebp
call edi
mov esi, 0x51cfe0
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x46cf2a
test cl, cl
je 0x46cf26
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x46cf2a
add eax, 2
add esi, 2
test cl, cl
jne 0x46cf06
xor eax, eax
jmp 0x46cf2f
sbb eax, eax
sbb eax, 0xffffffff
pop edi
pop esi
test eax, eax
jne 0x46cf38
or ebx, 0x40
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x46cf50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x4e5198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x527998]
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
test eax, eax
je 0x46d03d
cmp byte [edi], 0
je 0x46d190
mov esi, 0x51d838
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x46cfb8
test cl, cl
je 0x46cfb4
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x46cfb8
add eax, 2
add esi, 2
test cl, cl
jne 0x46cf90
xor eax, eax
jmp 0x46cfbd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x46d190
mov esi, 0x51d840
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x46cff4
test cl, cl
je 0x46cff0
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x46cff4
add eax, 2
add esi, 2
test cl, cl
jne 0x46cfcc
xor eax, eax
jmp 0x46cff9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x46d190
mov esi, str.Done
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x46d030
test cl, cl
je 0x46d02c
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x46d030
add eax, 2
add esi, 2
test cl, cl
jne 0x46d008
xor eax, eax
jmp 0x46d035
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x46d190
mov esi, dword [esp + 0x28]
test esi, esi
je 0x46d052
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x527968], eax
jmp 0x46d07c
mov eax, dword [0x527968]
test eax, eax
je 0x46d07c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x527968]
cmp eax, 0x7d0
jb 0x46d190
mov dword [0x527968], 0
push 1
push edi
mov dword [0x527998], esi
call fcn.004ae0f0
add esp, 8
test eax, eax
je 0x46d171
push 0x51c648
push edi
call fcn.004ad970
add esp, 8
cmp eax, edi
jne 0x46d171
mov eax, dword [0x52251c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], eax
mov eax, dword [0x52700c]
mov byte [esp + 0x1c], 1
test eax, eax
push 0xefa5
je 0x46d0e2
lea eax, [esp + 0x28]
push eax
call fcn.00417b10
add esp, 8
jmp 0x46d0eb
lea ecx, [esp + 0x28]
call fcn.004c681c
push edi
lea ecx, [esp + 0x2c]
call fcn.004c5910
lea ecx, [esp + 0x24]
lea edx, [esp + 0x10]
push ecx
push 0x51c3dc
push edx
call fcn.004c5a90
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 2
call fcn.004c5b9f
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 1
call fcn.004c5787
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
push 1
push eax
push 0
add ecx, 0x81c
call fcn.004cd762
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 0
call fcn.004c5787
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004c5787
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 8
mov edx, dword [esp + 0xc]
lea ecx, [edx + 0x81c]
test ecx, ecx
je 0x46d190
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x46d190
push 1
push edi
push 0
call fcn.004cd762
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x46d660
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x40
push esi
push edi
push str.kernel32.dll
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x46d6ba
push str.GlobalMemoryStatusEx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46d6af
lea ecx, [esp + 8]
mov dword [esp + 8], 0x40
push ecx
call eax
test eax, eax
je 0x46d6af
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, 0x14
call fcn.004ae880
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
jne 0x46d6da
lea edx, [esp + 8]
mov dword [esp + 8], 0x20
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x14]
pop edi
shr eax, 0x14
pop esi
add esp, 0x40
ret
mov eax, edi
pop edi
pop esi
add esp, 0x40
ret
Function at 0x46d820
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e5278
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov al, byte [0x527140]
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
test al, 1
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ebx
jne 0x46d877
or al, 1
push 0x5269d8
mov ecx, 0x52713c
mov byte [0x527140], al
call fcn.004c57f5
push 0x46d9f0
call fcn.004ae3a7
add esp, 4
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], ebx
push eax
call fcn.004be422
mov ecx, dword [eax]
mov edx, dword [esi + 0x768]
push ecx
mov dword [ebp - 0x18], ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
lea ecx, [ebp - 0x18]
mov dword [eax], edx
lea eax, [ebp - 0x1c]
push eax
call fcn.00435060
mov edi, dword [eax]
mov edx, 5
cmp edi, edx
jle 0x46d8ef
mov eax, dword [0x52713c]
mov esi, str.127.0.0.1
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x46d8db
test cl, cl
je 0x46d8d7
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x46d8db
add eax, 2
add esi, 2
test cl, cl
jne 0x46d8b7
xor eax, eax
jmp 0x46d8e0
sbb eax, eax
sbb eax, 0xffffffff
xor ebx, ebx
cmp eax, ebx
je 0x46d8eb
mov edx, 0x14
cmp edi, edx
jg 0x46d8ff
mov ecx, dword [0x52713c]
cmp dword [ecx - 8], 1
jge 0x46d9bf
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push 0x527770
mov byte [ebp - 4], 1
mov dword [eax + 0x768], edx
call sub.WSOCK32.dll_gethostbyname
mov edi, eax
cmp edi, ebx
je 0x46d9bf
mov ecx, dword [edi + 0xc]
cmp dword [ecx], ebx
je 0x46d9bf
mov edx, dword [edi + 0xc]
cmp dword [edx + ebx*4], 0
je 0x46d9c6
mov ecx, 0x52713c
call fcn.004c5712
push 0x5269d8
lea ecx, [ebp - 0x14]
call fcn.004c57f5
mov byte [ebp - 4], 2
xor esi, esi
movsx eax, word [edi + 0xa]
cmp esi, eax
jge 0x46d9a1
test esi, esi
jle 0x46d973
push 0x51c58c
mov ecx, 0x52713c
call fcn.004c5b63
mov ecx, dword [edi + 0xc]
xor eax, eax
mov edx, dword [ecx + ebx*4]
lea ecx, [ebp - 0x14]
mov al, byte [edx + esi]
push eax
push 0x520bf4
push ecx
call fcn.004bdb29
add esp, 0xc
lea edx, [ebp - 0x14]
mov ecx, 0x52713c
push edx
call fcn.004c5b9f
inc esi
jmp 0x46d958
lea ecx, [ebp - 0x14]
inc ebx
mov byte [ebp - 4], 1
call fcn.004c5787
jmp 0x46d92e
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 8]
push 0x52713c
mov ecx, esi
call fcn.004c54fc
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46e1d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e5370
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
call fcn.004d72f1
mov eax, dword [eax + 4]
add edi, 0x6f4
push edi
lea esi, [eax + 0xfc]
lea eax, [esp + 0x14]
push esi
push eax
call fcn.004c59b6
push 0x51c594
lea ecx, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x30], 0
call fcn.004c5a1c
mov edi, dword [esp + 0x2c]
lea edx, [esp + 8]
push edi
push eax
push edx
mov byte [esp + 0x30], 1
call fcn.004c5a1c
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 4
call fcn.004c5787
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 3
call fcn.004c5787
push ecx
lea eax, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.004c54fc
call fcn.004156a0
add esp, 4
test eax, eax
jne 0x46e356
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x46e2a4
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.004c5787
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x20
ret 8
push str.default
lea ecx, [esp + 0x18]
push esi
push ecx
call fcn.004c5a1c
push 0x51c594
lea edx, [esp + 0x34]
push eax
push edx
mov byte [esp + 0x30], 5
call fcn.004c5a1c
push edi
push eax
lea eax, [esp + 0x34]
mov byte [esp + 0x2c], 6
push eax
call fcn.004c5a1c
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 7
call fcn.004c58c0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 6
call fcn.004c5787
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 5
call fcn.004c5787
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 3
call fcn.004c5787
push ecx
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.004c54fc
call fcn.004156a0
add esp, 4
test eax, eax
jne 0x46e356
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.004c5787
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x20
ret 8
mov eax, dword [esp + 8]
push 0x2050
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.004c5787
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 8
Function at 0x46e690
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e53f2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x160
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 2
push str.MenuShowFavIcon
push 0x51ce88
mov ecx, 0x526f48
mov dword [esp + 0x30], esi
call fcn.004d7819
cmp eax, 2
mov dword [esi + 0x254], eax
jne 0x46e8af
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x52701c
call fcn.004c54fc
call fcn.004156a0
add esp, 4
test eax, eax
jne 0x46e705
mov eax, dword [0x52701c]
push eax
call fcn.00415840
add esp, 4
mov ecx, dword [0x52251c]
mov dword [esp + 0x10], ecx
push str..ico
lea edx, [esp + 0x18]
push 0x52701c
push edx
mov dword [esp + 0x184], 0
call fcn.004c5a1c
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x30]
mov bl, 1
push eax
push ecx
mov byte [esp + 0x180], bl
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x46e883
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 0x5c]
lea ecx, [esp + 0x10]
push edx
call fcn.004c5910
push 0x5c
lea ecx, [esp + 0x14]
call fcn.004bd781
push 0x2e
lea ecx, [esp + 0x14]
mov ebp, eax
call fcn.004bd781
sub eax, ebp
lea ecx, [esp + 0x10]
dec eax
push eax
push 0x5c
call fcn.004bd781
inc eax
lea ecx, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004bd5f7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x17c], 2
call fcn.004c58c0
lea ecx, [esp + 0x18]
mov byte [esp + 0x178], bl
call fcn.004c5787
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push 0x51c648
push edx
call fcn.004c5a90
push 0x51c85c
push eax
lea eax, [esp + 0x28]
mov byte [esp + 0x180], 3
push eax
call fcn.004c5a1c
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x17c], 4
call fcn.004c58c0
lea ecx, [esp + 0x20]
mov byte [esp + 0x178], 3
call fcn.004c5787
lea ecx, [esp + 0x1c]
mov byte [esp + 0x178], bl
call fcn.004c5787
push 0
push ecx
lea edx, [esp + 0x64]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
push 0x52701c
push ecx
call fcn.004c5a1c
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
mov byte [esp + 0x188], 5
call fcn.004c54fc
mov ebp, dword [esp + 0x30]
mov byte [esp + 0x184], bl
mov ecx, ebp
call fcn.0047c090
mov ecx, dword [esp + 0x10]
push eax
push ecx
lea ecx, [ebp + 0x7d0]
call fcn.0048a4a0
lea edx, [esp + 0x30]
push edx
push esi
call edi
test eax, eax
jne 0x46e758
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x14]
mov byte [esp + 0x178], 0
call fcn.004c5787
lea ecx, [esp + 0x10]
mov dword [esp + 0x178], 0xffffffff
call fcn.004c5787
mov ecx, dword [esp + 0x170]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x16c
ret
Function at 0x46e8d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e5408
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push esi
mov esi, ecx
push edi
push 0
mov eax, dword [esi + 0xe94]
push 0
push 0x431
push eax
call ebx
push eax
call fcn.004bf0f3
test eax, eax
je 0x46e916
mov ecx, eax
call fcn.004bf0dd
lea ecx, [esp + 0xc]
call fcn.004bf061
push 1
push 1
push 0xff
push 0x10
push 0x10
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.004bf126
push 1
push str.Go.bmp
mov ecx, esi
call fcn.0046e1d0
mov edx, dword [esp + 0x10]
mov edi, eax
lea eax, [esp + 0xc]
push 0xff00ff
neg eax
sbb eax, eax
push edi
and eax, edx
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0xe94]
push ecx
push 0
push 0x430
push edx
call ebx
lea ecx, [esp + 0xc]
call fcn.004bf0b3
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004bf08a
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x46fed0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e55f8
push eax
mov dword fs:[0], esp
mov eax, dword [ecx + 0x1150]
mov ecx, dword [esp + 0x10]
sub esp, 0x58
push esi
mov esi, dword [eax + ecx*4]
test esi, esi
push edi
je 0x46ffb3
lea edx, [esi + 4]
lea ecx, [esp + 0x70]
push edx
call fcn.004c54fc
lea eax, [esp + 0x70]
mov dword [esp + 0x68], 0
push eax
call fcn.00416d40
lea edx, [esp + 0x74]
mov ecx, esp
mov dword [esp + 0xc], esp
push edx
call fcn.004c54fc
call fcn.00414c50
add esp, 4
cmp eax, 1
je 0x46ffa2
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x70]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
mov dword [esp + 0x28], 0x44
mov dword [esp + 0x54], 1
mov word [esp + 0x58], 1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push eax
push 0x20
push 1
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esp + 0x10]
push eax
call edi
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x20], ecx
lea ecx, [esp + 0x70]
mov dword [esp + 0x68], 0xffffffff
call fcn.004c5787
mov ecx, dword [esp + 0x60]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x64
ret 4
Function at 0x4716f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e57c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov esi, ecx
sub esp, 8
mov eax, esp
mov dword [esp + 0x10], esp
mov ecx, dword [esi + 0x29c]
mov edx, dword [esi + 0x2a0]
mov dword [eax], ecx
mov dword [eax + 4], edx
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.00474060
push eax
mov ecx, 0x527304
mov dword [esp + 0x2c], 0
call fcn.004c58c0
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.004c5787
mov ecx, dword [esp + 0x30]
mov dword [0x527920], 1
lea eax, [ecx - 3]
cmp eax, 6
ja case.default.0x471770
jmp dword [eax*4 + 0x471958]
mov dword [esp + 0x10], vtable.CMenu.0
mov dword [esp + 0x14], 0
lea edx, [esp + 0x18]
mov dword [esp + 0x28], 1
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
call fcn.004d72f1
mov eax, dword [eax + 0xc]
push 0x135
push eax
call dword [sym.imp.USER32.dll_LoadMenuA]
push eax
lea ecx, [esp + 0x14]
call fcn.004c67af
mov eax, dword [esp + 0x14]
push 0
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call fcn.004c677c
mov edi, eax
mov eax, dword [0x52700c]
test eax, eax
je 0x4717f0
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push str.MenuDragImage
call fcn.004c57f5
push edi
call fcn.004187b0
add esp, 8
mov ecx, dword [0x52251c]
mov dword [esp + 0x30], ecx
mov eax, dword [0x52700c]
mov byte [esp + 0x28], 2
test eax, eax
push 0x300
je 0x47181c
lea edx, [esp + 0x34]
push edx
call fcn.00417b10
add esp, 8
jmp 0x471825
lea ecx, [esp + 0x34]
call fcn.004c681c
push 0x527304
lea eax, [esp + 0x10]
push 0x51c3b4
push eax
call fcn.004c5a90
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.004c5b9f
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 2
call fcn.004c5787
mov ecx, dword [esp + 0x30]
mov edx, dword [edi + 4]
push ecx
push 0x81a0
push 0
push edx
call dword [sym.imp.USER32.dll_AppendMenuA]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push esi
push eax
push ecx
push 2
mov ecx, edi
call fcn.004c28ab
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 1
call fcn.004c5787
mov dword [esp + 0x10], vtable.CMenu.0
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 4
call fcn.004c6806
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x24
ret 4
mov ecx, esi
call fcn.00474250
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x24
ret 4
mov ecx, esi
call fcn.00474ef0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x24
ret 4
mov ecx, esi
call fcn.004747d0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x24
ret 4
mov ecx, esi
call fcn.00474aa0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x24
ret 4
mov ecx, esi
call fcn.00474ac0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x24
ret 4
mov ecx, esi
call fcn.00474fd0
mov ecx, dword [esp + 0x20]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x24
ret 4