joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457650
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4e5f5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
push ebx
lea eax, [esp + 0xc]
push eax
push str.INDATA
push 0x18
push ebx
mov dword [esp + 0x30], ebx
call fcn.00422b90
mov eax, dword [esp + 0x20]
add esp, 0x14
cmp eax, 0x200
jge 0x4576c8
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x4576b6
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
push esi
push 0x18
call fcn.004c86a5
add esp, 4
mov dword [esp + 8], eax
cmp eax, ebx
mov byte [esp + 0x20], 1
je 0x4576eb
mov ecx, eax
call fcn.0041def4
mov esi, eax
jmp 0x4576ed
xor esi, esi
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push ebp
push edi
push edx
push eax
mov ecx, esi
mov byte [esp + 0x30], bl
mov dword [0x519284], esi
call fcn.00422955
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x457751
push str.flashop
lea ecx, [esp + 0x14]
call fcn.00457350
mov eax, dword [eax]
push eax
mov ecx, esi
mov byte [esp + 0x2c], 2
call fcn.0041df30
mov edi, eax
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov byte [esp + 0x28], bl
je 0x45774d
mov ecx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push ecx
call ebp
cmp edi, ebx
jne 0x457790
cmp esi, ebx
je 0x457765
mov ecx, esi
call fcn.0041df0a
push esi
call fcn.004c86d5
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x45777b
mov edx, dword [0x51927c]
add eax, 0xfffffff8
push eax
push ebx
push edx
call ebp
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4577a5
add eax, 0xfffffff8
push eax
mov eax, dword [0x51927c]
push ebx
push eax
call ebp
mov ecx, dword [esp + 0x20]
mov eax, edi
pop edi
pop ebp
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x457820
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x4e5f88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
mov ebp, ecx
mov dword [esp + 8], ebp
mov dword [ebp], 0x4f52f8
mov eax, dword [ebp + 0x18]
test eax, eax
mov dword [esp + 0x18], 0
je 0x45785e
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x519280], 1
jle 0x457909
mov eax, dword [ebp + 0x48]
test eax, eax
push edi
lea edi, [ebp + 0x48]
je 0x457908
push esi
push 0x5194ec
mov dword [esp + 0x18], 0x5194ec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x20], 1
call fcn.00443b90
mov eax, dword [0x519450]
test eax, eax
mov esi, 0xfffffffd
mov dword [esp + 0xc], esi
je 0x4578c3
push 0
call eax
mov esi, eax
test esi, esi
mov dword [esp + 0xc], esi
je 0x4578c3
cmp esi, 1
jne 0x4578c3
call dword [0x519454]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 3
push edi
mov byte [esp + 0x44], 2
call dword [0x519280]
mov dword [edi], 0
mov eax, dword [0x519454]
add esp, 0x24
test eax, eax
mov byte [esp + 0x20], 1
je 0x4578fc
test esi, esi
jne 0x4578fc
call eax
push 0x5194ec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop edi
mov ecx, ebp
call fcn.00455cf0
mov ecx, dword [esp + 0x10]
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x4592d0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4e5fd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
movzx eax, word [0x51e010]
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push ebx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, eax
lea edi, [ebp + 2]
lea eax, [edi + edi + 4]
push 0
call fcn.00445f60
mov esi, eax
add esp, 4
test esi, esi
je 0x459320
mov word [esi + edi*2 + 2], 0
mov ecx, dword [esp + 0x10]
push edi
push esi
push ebp
push ebx
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
xor ebp, ebp
cmp edi, ebp
jge 0x45933b
xor edi, edi
lea eax, [edi + edi + 4]
push esi
mov word [esi + edi*2], bp
call fcn.00445f60
add esp, 4
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x459359
mov word [eax + edi*2 + 2], bp
movzx edx, word [0x51e010]
mov eax, dword [esp + 0x3c]
push eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, eax
lea edi, [ebp + 2]
lea eax, [edi + edi + 4]
push 0
call fcn.00445f60
mov esi, eax
add esp, 4
test esi, esi
je 0x459393
mov word [esi + edi*2 + 2], 0
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x10]
push edi
push esi
push ebp
push ecx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jge 0x4593b0
xor edi, edi
lea eax, [edi + edi + 4]
push esi
mov word [esi + edi*2], 0
call fcn.00445f60
mov esi, eax
add esp, 4
test esi, esi
mov dword [esp + 0x10], esi
je 0x4593d4
mov word [esi + edi*2 + 2], 0
mov edi, dword [esp + 0x14]
push edi
push esi
push str._r_nRegSetDHCP__s__s__r_n
push 0x519150
mov byte [esp + 0x40], 1
call fcn.0041e97e
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 0x10
test esi, esi
je 0x459409
mov eax, dword [0x51927c]
add esi, 0xfffffff8
push esi
push 0
push eax
call ebp
test edi, edi
je 0x45941c
mov ecx, dword [0x51927c]
add edi, 0xfffffff8
push edi
push 0
push ecx
call ebp
mov edx, dword [str.0.0.0.0]
mov eax, dword [0x4f53f8]
mov edi, dword [esp + 0x38]
mov cl, byte [0x4f53fc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
mov dword [esp + 0x20], edx
lea edx, [esp + 0x1c]
push edx
push 4
push 0
mov dword [esp + 0x30], eax
mov eax, dword [edi]
push str.EnableDHCP
push eax
mov byte [esp + 0x3c], cl
mov dword [esp + 0x30], 1
call esi
mov edx, dword [edi]
push 9
lea ecx, [esp + 0x20]
push ecx
push 7
push 0
push str.IPAddress
push edx
call esi
mov ecx, dword [edi]
push 9
lea eax, [esp + 0x20]
push eax
push 7
push 0
push str.SubnetMask
push ecx
call esi
mov edx, dword [edi]
push 1
push 0x4f53cc
push 7
push 0
push str.DefaultGateway
push edx
call esi
test ebx, ebx
mov eax, ebx
je 0x4594cb
cmp byte [ebx], 0x2d
jne 0x4594af
mov ebx, 0x4ec037
cmp byte [eax], 0
je 0x4594cb
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [edi]
push ebx
push 1
push 0
push str.NameServer
push eax
call esi
mov ecx, dword [edi]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x460650
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push edi
mov edi, dword [esp + 8]
mov eax, dword [edi]
push 0
mov word [eax], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x460694
push esi
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x46068d
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov ecx, edi
call fcn.004574e0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
mov eax, edi
pop edi
ret
Function at 0x461f30
Capabilities:
Get disk information

Disassembly:
sub esp, 0x18
push edi
mov eax, esi
call fcn.00454570
mov edi, eax
mov eax, 0x20
mov word [esp + 0xc], ax
mov word [esp + 0x10], ax
mov eax, 0x3a
mov word [esp + 0x14], ax
mov word [esp + 6], ax
lea eax, [esp + 4]
push eax
mov word [esp + 0x12], 0x2a
mov word [esp + 0x16], si
mov word [esp + 0x1a], 0x2c
mov word [esp + 0x1c], 0
mov word [esp + 8], si
mov word [esp + 0xc], 0x5c
mov word [esp + 0xe], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x461f9d
cmp edi, 2
je 0x461fae
push 0
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x519150
call fcn.0045f380
pop edi
add esp, 0x18
ret
Function at 0x4637c0
Capabilities:
Set environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4e6560
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, dword [esp + 0x1c]
mov ax, word [esi]
cmp ax, 0x26
mov ebx, ecx
je 0x463805
test byte [ebx + 0xb], 0xf
jne 0x463805
mov ecx, dword [ebx + 0x2c]
test ecx, ecx
je 0x46389e
mov ecx, dword [ecx + 0x6c]
cmp word [ecx], 0x26
jne 0x46389e
push edi
xor edi, edi
mov dword [esp + 0x20], edi
cmp ax, 0x26
mov dword [esp + 0x18], edi
je 0x46381d
push 0x4f5a1c
jmp 0x463829
cmp word [esi + 2], 0x26
je 0x463842
push 0x4f5a1e
lea ecx, [esp + 0x24]
call fcn.004575a0
lea ecx, [esp + 0x20]
push esi
call fcn.004462e0
mov edi, dword [esp + 0x20]
mov esi, edi
push 0x5194ec
mov dword [esp + 0x10], 0x5194ec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [esp + 0x24]
push 0xffffffffffffffff
push edx
push esi
mov ecx, ebx
mov byte [esp + 0x24], 1
call fcn.0041e64f
push 0x5194ec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x46388a
mov eax, dword [0x51927c]
add edi, 0xfffffff8
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 8
test ax, ax
je 0x46388b
mov ecx, dword [esp + 0x20]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [esp + 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x466040
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x2c
cmp eax, 0xf8000009
push esi
mov esi, ecx
je 0x466054
mov dword [esi + 0x40], eax
push ebx
mov ebx, dword [esp + 0x3c]
test ebx, ebx
push ebp
mov ebp, dword [esi + 0x1c]
push edi
mov edi, dword [ebp + 0x18]
je 0x4660bb
cmp word [ebx], 0x23
jne 0x4660b2
push 0x3a
push ebx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x4660b2
mov dword [esp + 0x10], ebx
mov word [eax], 0
lea ebx, [eax + 2]
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x4c], SysReAllocStringLen
call fcn.00449a90
add esp, 8
test eax, eax
je 0x4660b2
mov eax, dword [esp + 0x44]
test eax, eax
jge 0x4660af
mov eax, SysReAllocStringLen
mov dword [ebp + 0x50], eax
push ebx
lea ecx, [ebp + 0x4c]
call fcn.004575a0
mov ebp, dword [esi + 0x40]
xor edx, edx
test ebp, ebp
setl dl
dec edx
and edx, 5
push edx
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x408
push edi
call ebp
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x40]
cmp eax, 0x64
jg 0x466106
test eax, eax
jl 0x466106
mov eax, dword [esi + 0x40]
push 0
push eax
push 0x402
push edi
call ebp
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x44], eax
jne 0x46611b
test ebx, ebx
je 0x46611b
push 1
push 0
push edi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esi + 0x40]
push ecx
lea edx, [esp + 0x18]
push 0x4efae8
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [esi + 8]
add esp, 0xc
cmp word [eax], 0
pop edi
pop ebp
pop ebx
je 0x46614c
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esi + 0x30]
push eax
call fcn.004637c0
pop esi
add esp, 0x2c
ret 8

Function at 0x466160
Capabilities:
Set environment variable

Disassembly:
mov eax, dword [ecx + 0x6c]
cmp word [eax], 0
je 0x466174
mov ecx, dword [ecx + 0x13c]
jmp fcn.004637c0
ret 8
Function at 0x4850f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2e4
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, eax
cmp edx, 0xb4
jle 0x485118
mov edx, 0xb4
mov ebx, dword [ebp + 0x14]
xor eax, eax
mov dword [esp + 0x10], 0
mov ecx, 0xb6
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov dword [esp + 0x2d8], ecx
mov dword [esp + 0x24c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x23c], eax
lea ecx, [edx + edx]
mov eax, ecx
shr ecx, 2
mov byte [esp + 0x78], 0x40
mov dword [esp + 0xa0], ebx
lea edi, [esp + 0xa4]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x5194c4
mov word [esp + edx*2 + 0xa8], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x518dc8
push 0x10000
lea ecx, [esp + 0x18]
push ecx
push 0x484390
push 0x20000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esp + 0xc], eax
je 0x4851f8
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x270f
jmp 0x4851c0
cmp dword [esp + 0xa0], ebx
jne 0x4851ed
push 0
call esi
dec edi
jns 0x4851c0
cmp dword [esp + 0xa0], ebx
jne 0x4851ed
lea esp, [esp]
push 1
call esi
cmp dword [esp + 0xa0], ebx
je 0x4851e0
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5194c4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48e640
Capabilities:
Access peb ldr_data
Check os version
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e5abb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
push ebx
push ebp
push edi
mov ebx, ecx
mov edx, dword [ebx + 0x18]
lea ecx, [esp + 0x10]
push ecx
push ebx
xor edi, edi
push 0x465
push edx
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, eax
cmp ebp, edi
mov dword [esp + 0xc], ebp
je 0x48e75b
mov eax, dword [ebx + 0xa8]
mov eax, dword [eax]
mov ecx, dword [ebx + 0xac]
mov ecx, dword [ecx]
push esi
mov esi, ebp
sub esi, eax
sar esi, 2
add esi, 0x1000
xor edx, edx
test ecx, ecx
jle 0x48e6ec
mov ebp, eax
mov eax, dword [ebp]
cmp dword [eax + 4], 6
jne 0x48e6e0
mov edi, dword [esp + 0x5c]
cmp edi, dword [eax + 0x44]
sete al
movzx edi, al
test edi, edi
jne 0x48e6e8
inc edx
add ebp, 4
cmp edx, ecx
jl 0x48e6c6
mov ebp, dword [esp + 0x10]
push 0x48
call fcn.004c86a5
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x30], 0
je 0x48e74a
mov ecx, dword [esp + 0x5c]
xor edx, edx
test edi, edi
sete dl
push edx
mov edx, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x5c]
push edx
mov edx, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x5c]
push edx
mov edx, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x5c]
push edx
mov edx, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x5c]
push edx
mov edx, dword [esp + 0x5c]
push ecx
push esi
push edx
mov ecx, eax
call fcn.0048dca0
jmp 0x48e74c
xor eax, eax
push 0
push ebx
mov dword [ebp], eax
call fcn.004413e0
add esp, 8
pop esi
mov ecx, dword [esp + 0x24]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x28
Function at 0x4a3e90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x48
push ebx
push ebp
push esi
push edi
xor edi, edi
mov esi, ecx
mov ecx, dword [esi + 0x18]
lea eax, [esp + 0x38]
push eax
push ecx
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 0x18]
lea edx, [esp + 0x20]
push edx
push eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov ebp, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 5
call ebp
push 6
mov ebx, eax
call ebp
push 0x2d
mov dword [esp + 0x18], eax
call ebp
push 0x2e
mov dword [esp + 0x1c], eax
call ebp
mov edx, dword [esi + 0x18]
lea ecx, [esp + 0x48]
push ecx
push edx
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x18]
lea eax, [esp + 0x28]
push eax
push edi
push 0x130a
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov al, byte [esp + 0x5c]
test al, al
jne 0x4a3f58
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
add ecx, edx
jmp 0x4a3f70
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
add edx, ebx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x5c], edx
mov eax, edx
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x50]
mov ebp, dword [esp + 0x54]
sub edi, edx
mov edx, dword [esp + 0x1c]
sub edi, ebx
mov ebx, dword [esp + 0x14]
sub ebp, edx
mov edx, dword [esp + 0x38]
sub ebp, ebx
sub edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x3c]
sub edi, eax
add eax, edx
mov edx, dword [esp + 0x24]
sub ebx, edx
sub ebp, ecx
add ecx, ebx
cmp dword [esi + 0x60], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x10], ecx
jne 0x4a3fc2
cmp dword [esi + 0x64], ecx
jne 0x4a3fc2
cmp dword [esi + 0x68], edi
jne 0x4a3fc2
cmp dword [esi + 0x6c], ebp
je 0x4a403a
mov ebx, dword [esi + 0x70]
mov dword [esp + 0x1c], ebx
xor ebx, ebx
cmp dword [esi + 0x78], ebx
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], ebp
jle 0x4a400d
jmp 0x4a3fe6
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x10]
push 4
push ebp
push edi
push ecx
push eax
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + ebx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi + 0x78]
inc ebx
cmp ebx, eax
jl 0x4a3fde
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
neg edx
push edx
neg eax
push eax
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [esi + 0x18]
push 1
lea edx, [esp + 0x3c]
push edx
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret 4
Function at 0x4a4050
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x4e8738
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
push 0
mov esi, ecx
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x7c]
push 0
push 0x132f
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, dword [esi + 0x70]
mov edi, eax
cmp edi, ebx
je 0x4a4122
test edi, edi
jl 0x4a4122
cmp edi, dword [esi + 0x78]
jge 0x4a4122
mov ecx, dword [ebp + ebx*4]
mov eax, dword [ecx]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
je 0x4a40b8
mov edx, dword [eax + 0x18]
push 0
push edx
call ebx
mov dword [esi + 0x7c], edi
mov eax, dword [ebp + edi*4]
mov eax, dword [eax]
test eax, eax
je 0x4a40cd
mov ecx, dword [eax + 0x18]
push 5
push ecx
call ebx
push 0x4f5a1c
lea ecx, [esp + 0x14]
call fcn.00457400
mov eax, dword [esi + 0x4c]
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0
call fcn.004462e0
push str..Select
lea ecx, [esp + 0x14]
call fcn.004462e0
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x50]
push edx
inc edi
push edi
push eax
call fcn.00448b60
add esp, 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0043f290
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4a52a0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x4a52ce
mov ecx, dword [esi + 0x18]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push ecx
call edi
mov edx, dword [esi + 0x18]
push 5
push edx
call edi
pop edi
pop esi
ret
Function at 0x4a5bd0
Capabilities:
Capture screenshot

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e8860
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x24
push ebp
xor ebp, ebp
cmp eax, ebp
jl 0x4a5d08
push ebx
mov ebx, dword [esp + 0x3c]
push esi
push edi
lea eax, [esp + 0x24]
push eax
push ebx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
push ebx
sub esi, edx
sub edi, ecx
mov dword [esp + 0x24], ebx
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
mov dword [esp + 0x1c], ebx
push 0xf
mov dword [esp + 0x40], ebp
call dword [sym.imp.USER32.dll_GetSysColor]
push ebx
mov dword [esp + 0x18], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, eax
mov dword [esp + 0x18], ebp
push edi
push esi
push ebx
mov byte [esp + 0x48], 1
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
test eax, eax
je 0x4a5c7d
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push edi
push esi
push ebx
mov dword [esp + 0x1c], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
test eax, eax
je 0x4a5ca8
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x48]
push edx
lea eax, [esp + 0x28]
push eax
push ebp
call fcn.00445860
mov ecx, dword [esp + 0x20]
push ecx
push edi
push esi
push 0
push 0
push ebx
push edi
push esi
push 0
push 0
push ebp
call fcn.004a5aa0
add esp, 0x38
push 0xcc0020
push 0
push 0
push ebp
push edi
push esi
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
test ebp, ebp
je 0x4a5cf5
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
test ebx, ebx
je 0x4a5d05
mov edx, dword [esp + 0x44]
push ebx
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
pop ebp
mov dword fs:[0], ecx
add esp, 0x30
ret

Function at 0x4abc30
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
and eax, 0xffdf
sub esp, 8
cmp ax, 0x41
je 0x4abc51
cmp ax, 0x42
je 0x4abc51
mov eax, 0xfffffffe
add esp, 8
ret
mov word [esp], ax
lea eax, [esp]
push eax
mov word [esp + 6], 0x3a
mov word [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 2
setne cl
mov eax, ecx
add esp, 8
ret
Function at 0x4abdd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e8c28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push 0x5194ec
mov dword [esp + 8], 0x5194ec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 8]
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], 0
call fcn.00415774
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
add esp, 4
push ecx
push edx
mov byte [esp + 0x14], al
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, dword [esp + 0x24]
xor ecx, ecx
cmp eax, 0xffffffff
sete cl
mov dword [esp + 0x1c], 0
dec ecx
and ecx, eax
mov al, byte [esp + 0xc]
test al, al
mov esi, ecx
mov dword [edx], esi
je 0x4abe5d
mov eax, dword [esp + 8]
push eax
call fcn.00415785
add esp, 4
push 0x5194ec
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x4abe80
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
ret