joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f5c89
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
and eax, 0xff
test eax, eax
je 0x4f5cee
cmp dword [0x81fe60], 0
jne 0x4f5cb1
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x81fe60], eax
cmp dword [0x81fe38], 0
jne 0x4f5cd3
mov ecx, dword [0x81fe60]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x81fe60]
add eax, dword [edx + 0x3c]
mov dword [0x81fe38], eax
cmp dword [ebp + 0x10], 0
je 0x4f5ce4
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x81fe38]
mov dword [ecx], edx
mov eax, dword [0x81fe60]
jmp 0x4f5e4b
xor eax, eax
mov al, byte [0x81fe54]
and eax, 1
test eax, eax
jne 0x4f5d22
mov cl, byte [0x81fe54]
or cl, 1
mov byte [0x81fe54], cl
mov ecx, 0x81fe58
call fcn.005013a0
push 0x4f5e4f
call fcn.005e61b8
add esp, 4
push 0
call fcn.005e7f6a
add esp, 4
push eax
call fcn.005e4b82
add esp, 4
mov ecx, 0x81fe58
call fcn.004e03b0
and eax, 0xff
test eax, eax
je 0x4f5de5
push 0x81fe58
push 0x81da38
call fcn.004fedf0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4f5de5
mov edx, 1
test edx, edx
je 0x4f5dd2
mov eax, dword [ebp + 8]
and eax, 0x200000
test eax, eax
jne 0x4f5dd2
mov ecx, dword [ebp - 8]
push ecx
push 0xb5
push 0x7a20b0
push 0xb5
push 0x7a20f4
call fcn.004ff360
add esp, 0x14
mov edx, dword [ebp - 8]
push edx
push 0xb5
push 0x7a2138
call fcn.004f6ce3
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.005e843a
cmp dword [ebp + 0x10], 0
je 0x4f5de1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
xor eax, eax
jmp 0x4f5e4b
cmp dword [0x81fe40], 0
jne 0x4f5dfd
mov ecx, 0x81fe58
call fcn.004e1270
mov dword [0x81fe40], eax
cmp dword [ebp + 0x14], 0
je 0x4f5e12
mov ecx, 0x81fe58
call fcn.004e0910
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
cmp dword [0x81fe4c], 0
jne 0x4f5e35
mov eax, dword [0x81fe40]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [0x81fe40]
add edx, dword [ecx + 0x3c]
mov dword [0x81fe4c], edx
cmp dword [ebp + 0x10], 0
je 0x4f5e46
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x81fe4c]
mov dword [eax], ecx
mov eax, dword [0x81fe40]
mov esp, ebp
pop ebp
ret
Function at 0x4f6e7a
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60bfe0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push edi
mov dword [ebp - 0x134], 0
push 0x7a2630
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4f6ee9
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4f6ee9
mov ecx, dword [ebp + 8]
call fcn.005013a0
mov eax, dword [ebp - 0x134]
or al, 1
mov dword [ebp - 0x134], eax
mov eax, dword [ebp + 8]
jmp 0x4f70a1
push str.GetProcessImageFileNameA
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4f6f20
mov ecx, dword [ebp + 8]
call fcn.005013a0
mov edx, dword [ebp - 0x134]
or edx, 1
mov dword [ebp - 0x134], edx
mov eax, dword [ebp + 8]
jmp 0x4f70a1
lea ecx, [ebp - 0x24]
call fcn.005013a0
mov dword [ebp - 4], 1
push 0
push 0x104
lea ecx, [ebp - 0x24]
call fcn.004e0320
push 0x104
lea ecx, [ebp - 0x24]
call fcn.004e1270
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
push 0
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x24]
call fcn.004e0320
mov dx, word [0x7a2674]
mov word [ebp - 0x10], dx
mov al, byte [0x7a2676]
mov byte [ebp - 0xe], al
mov dword [ebp - 0x18], 0
jmp 0x4f6f89
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0x1a
jge 0x4f7074
mov byte [ebp - 0x128], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x127]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x4f7066
push 0
lea ecx, [ebp - 0x128]
push ecx
lea ecx, [ebp - 0x130]
call fcn.004dffa0
mov byte [ebp - 4], 2
push 1
push 0
lea edx, [ebp - 0x130]
push edx
lea ecx, [ebp - 0x24]
call fcn.004e3b10
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov byte [ebp - 0x12c], cl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x130]
call fcn.004e0030
mov edx, dword [ebp - 0x12c]
and edx, 0xff
test edx, edx
je 0x4f7066
push 1
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x128]
push ecx
lea ecx, [ebp - 0x24]
call fcn.00500830
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp + 8]
call fcn.004dffd0
mov eax, dword [ebp - 0x134]
or al, 1
mov dword [ebp - 0x134], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004e0030
mov eax, dword [ebp + 8]
jmp 0x4f70a1
mov cl, byte [ebp - 0x10]
add cl, 1
mov byte [ebp - 0x10], cl
jmp 0x4f6f80
push 0
push 0x81fe84
mov ecx, dword [ebp + 8]
call fcn.004dffa0
mov edx, dword [ebp - 0x134]
or edx, 1
mov dword [ebp - 0x134], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004e0030
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4f70b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60bff6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
push 0
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
ja 0x4f70f8
xor eax, eax
jmp 0x4f7216
mov dword [ebp - 0x144], 0
mov ecx, 0x49
xor eax, eax
lea edi, [ebp - 0x140]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x144], pe_nt_image_headers32
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.KERNEL32.dll_Process32First
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x14], al
mov edx, dword [ebp - 0x14]
and edx, 0xff
test edx, edx
je 0x4f7209
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x18]
jne 0x4f71eb
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 8], 0
jne 0x4f7168
jmp 0x4f7209
mov edx, dword [ebp - 0x10]
push edx
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jne 0x4f718a
jmp 0x4f7209
push 1
mov eax, dword [ebp - 0x148]
push eax
lea ecx, [ebp - 0x14c]
push ecx
call fcn.004f6e7a
add esp, 8
mov dword [ebp - 0x150], eax
mov edx, dword [ebp - 0x150]
mov dword [ebp - 0x154], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x154]
push eax
mov ecx, dword [ebp + 8]
call fcn.004e02e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14c]
call fcn.004e0030
mov ecx, dword [ebp - 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4f7209
lea edx, [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call sub.KERNEL32.dll_Process32Next
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x14], al
jmp 0x4f7134
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4f7d51
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60c0d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
call fcn.004f5880
sub eax, dword [0x81fe68]
sbb edx, dword [0x81fe6c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0
ja 0x4f7d95
cmp dword [ebp - 0x28], 0x3a98
jbe 0x4f7dfa
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x18]
mov eax, dword [edx + 0x5c]
and eax, 0x200000
test eax, eax
jne 0x4f7dfa
push 0xffffffffffffffff
push 0x2bc
push 0x7a2e68
push 0x2bc
push 0x7a2ea4
call fcn.004ff360
add esp, 0x14
push 0xffffffffffffffff
push 0x2bc
push 0x7a2ee0
call fcn.004f6ce3
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.005e843a
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x5c]
and ecx, 0xffdfffff
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x10]
mov edx, dword [eax + 0x18]
mov dword [edx + 0x5c], ecx
xor eax, eax
mov al, byte [0x81fe66]
and eax, 0x20
test eax, eax
je 0x4f7e44
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x5c]
or ecx, 0x200000
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x10]
mov edx, dword [eax + 0x18]
mov dword [edx + 0x5c], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0x1c], 0
jne 0x4f7e88
push 0
push 0x7a2f1c
lea ecx, [ebp - 0x10]
call fcn.004e0720
mov dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.004f96b3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004e0030
mov al, 1
jmp 0x4f7f5a
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4f7ed3
push 0
push 0x7a2f34
lea ecx, [ebp - 0x14]
call fcn.004e0720
mov dword [ebp - 4], 1
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.004f96b3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004e0030
mov al, 1
jmp 0x4f7f5a
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x10]
cmp dword [edx + 0x14], 0
je 0x4f7ef2
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10]
mov ecx, dword [ecx + 0x14]
call fcn.00539090
cmp eax, 1
jge 0x4f7f27
push 0
push 0x7a2f4c
lea ecx, [ebp - 0x18]
call fcn.004e0720
mov dword [ebp - 4], 2
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.004f96b3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004e0030
mov al, 1
jmp 0x4f7f5a
push 0
push 0x81fe88
lea ecx, [ebp - 0x1c]
call fcn.004e0720
mov dword [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.004f96b3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004e0030
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4f7f68
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
mov dword [ebp - 0x114], ecx
call fcn.004f5880
sub eax, dword [0x81fe68]
sbb edx, dword [0x81fe6c]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], edx
cmp dword [ebp - 0x118], 0
ja 0x4f7faa
cmp dword [ebp - 0x11c], 0x3a98
jbe 0x4f8012
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x18]
mov eax, dword [edx + 0x5c]
and eax, 0x200000
test eax, eax
jne 0x4f8012
push 0xffffffffffffffff
push 0x2db
push 0x7a2f68
push 0x2db
push 0x7a2fa4
call fcn.004ff360
add esp, 0x14
push 0xffffffffffffffff
push 0x2db
push 0x7a2fe0
call fcn.004f6ce3
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.005e843a
mov ecx, dword [ebp - 0x114]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x5c]
and ecx, 0xffdfffff
mov edx, dword [ebp - 0x114]
mov eax, dword [edx + 0x10]
mov edx, dword [eax + 0x18]
mov dword [edx + 0x5c], ecx
xor eax, eax
mov al, byte [0x81fe66]
and eax, 0x20
test eax, eax
je 0x4f8068
mov ecx, dword [ebp - 0x114]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x5c]
or ecx, 0x200000
mov edx, dword [ebp - 0x114]
mov eax, dword [edx + 0x10]
mov edx, dword [eax + 0x18]
mov dword [edx + 0x5c], ecx
cmp dword [ebp + 8], 0
jne 0x4f8075
xor eax, eax
jmp 0x4f8193
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x110], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
push 0x7a301c
lea edx, [ebp - 0x10c]
push edx
call fcn.004ffff0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4f8182
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x4f8180
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.USER32.dll_GetClassNameA]
push 0x7a3038
lea eax, [ebp - 0x10c]
push eax
call fcn.004ffff0
add esp, 8
test eax, eax
jne 0x4f8132
mov eax, dword [ebp - 0x110]
jmp 0x4f8193
mov ecx, dword [ebp - 0x110]
push ecx
mov ecx, dword [ebp - 0x114]
call fcn.004f7f68
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4f8160
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4f8160
mov eax, dword [ebp - 4]
jmp 0x4f8193
push 0
push 0
mov eax, dword [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 0x110], eax
jmp 0x4f80ec
jmp 0x4f818d
cmp dword [ebp - 8], 0
jne 0x4f818d
mov eax, dword [ebp + 8]
jmp 0x4f8193
mov eax, dword [ebp - 0x110]
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4f8328
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0x14], 0
je 0x4f836e
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0x14]
call fcn.00539090
cmp eax, 1
jge 0x4f8375
xor al, al
jmp 0x4f849d
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x10], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
add edx, 4
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
call fcn.004f5880
sub eax, dword [0x81fe68]
sbb edx, dword [0x81fe6c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
ja 0x4f83c2
cmp dword [ebp - 0xc], 0x3a98
jbe 0x4f8428
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x5c]
and ecx, 0x200000
test ecx, ecx
jne 0x4f8428
push 0xffffffffffffffff
push 0x343
push 0x7a311c
push 0x343
push 0x7a3158
call fcn.004ff360
add esp, 0x14
push 0xffffffffffffffff
push 0x343
push 0x7a3194
call fcn.004f6ce3
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.005e843a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x5c]
and edx, 0xffdfffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx + 0x18]
mov dword [eax + 0x5c], edx
xor ecx, ecx
mov cl, byte [0x81fe66]
and ecx, 0x20
test ecx, ecx
je 0x4f8473
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x5c]
or edx, 0x200000
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx + 0x18]
mov dword [eax + 0x5c], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
cmp dword [edx + 0x1c], 0
je 0x4f8493
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
cmp dword [ecx], 0
je 0x4f8493
mov dword [ebp - 0x10], 1
jmp 0x4f849a
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x4ff660
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x4ff675
xor eax, eax
jmp 0x4ff6ac
push 0
push 0
push 0
push 6
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4ff696
xor eax, eax
jmp 0x4ff6ac
cmp dword [ebp + 8], 0
je 0x4ff6a6
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp - 4]
add eax, 8
mov esp, ebp
pop ebp
ret 4
Function at 0x5392dc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
and eax, 0xff
test eax, eax
je 0x539341
cmp dword [0x82c114], 0
jne 0x539304
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x82c114], eax
cmp dword [0x82c0fc], 0
jne 0x539326
mov ecx, dword [0x82c114]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x82c114]
add eax, dword [edx + 0x3c]
mov dword [0x82c0fc], eax
cmp dword [ebp + 0x10], 0
je 0x539337
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x82c0fc]
mov dword [ecx], edx
mov eax, dword [0x82c114]
jmp 0x53949e
xor eax, eax
mov al, byte [0x82c10c]
and eax, 1
test eax, eax
jne 0x539375
mov cl, byte [0x82c10c]
or cl, 1
mov byte [0x82c10c], cl
mov ecx, 0x82c110
call fcn.005013a0
push 0x5394a2
call fcn.005e61b8
add esp, 4
push 0
call fcn.005e7f6a
add esp, 4
push eax
call fcn.005e4b82
add esp, 4
mov ecx, 0x82c110
call fcn.004e03b0
and eax, 0xff
test eax, eax
je 0x539438
push 0x82c110
push 0x81da38
call fcn.004fedf0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x539438
mov edx, 1
test edx, edx
je 0x539425
mov eax, dword [ebp + 8]
and eax, 0x200000
test eax, eax
jne 0x539425
mov ecx, dword [ebp - 8]
push ecx
push 0xb5
push 0x7c7cc8
push 0xb5
push 0x7c7d20
call fcn.004ff360
add esp, 0x14
mov edx, dword [ebp - 8]
push edx
push 0xb5
push 0x7c7d78
call fcn.004f6ce3
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.005e843a
cmp dword [ebp + 0x10], 0
je 0x539434
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
xor eax, eax
jmp 0x53949e
cmp dword [0x82c100], 0
jne 0x539450
mov ecx, 0x82c110
call fcn.004e1270
mov dword [0x82c100], eax
cmp dword [ebp + 0x14], 0
je 0x539465
mov ecx, 0x82c110
call fcn.004e0910
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
cmp dword [0x82c108], 0
jne 0x539488
mov eax, dword [0x82c100]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [0x82c100]
add edx, dword [ecx + 0x3c]
mov dword [0x82c108], edx
cmp dword [ebp + 0x10], 0
je 0x539499
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x82c108]
mov dword [eax], ecx
mov eax, dword [0x82c100]
mov esp, ebp
pop ebp
ret
Function at 0x53cacc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
and eax, 0xff
test eax, eax
je 0x53cb31
cmp dword [0x82c130], 0
jne 0x53caf4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x82c130], eax
cmp dword [0x82c118], 0
jne 0x53cb16
mov ecx, dword [0x82c130]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x82c130]
add eax, dword [edx + 0x3c]
mov dword [0x82c118], eax
cmp dword [ebp + 0x10], 0
je 0x53cb27
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x82c118]
mov dword [ecx], edx
mov eax, dword [0x82c130]
jmp 0x53cc8e
xor eax, eax
mov al, byte [0x82c128]
and eax, 1
test eax, eax
jne 0x53cb65
mov cl, byte [0x82c128]
or cl, 1
mov byte [0x82c128], cl
mov ecx, 0x82c12c
call fcn.005013a0
push 0x53cc92
call fcn.005e61b8
add esp, 4
push 0
call fcn.005e7f6a
add esp, 4
push eax
call fcn.005e4b82
add esp, 4
mov ecx, 0x82c12c
call fcn.004e03b0
and eax, 0xff
test eax, eax
je 0x53cc28
push 0x82c12c
push 0x81da38
call fcn.004fedf0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x53cc28
mov edx, 1
test edx, edx
je 0x53cc15
mov eax, dword [ebp + 8]
and eax, 0x200000
test eax, eax
jne 0x53cc15
mov ecx, dword [ebp - 8]
push ecx
push 0xb5
push 0x7c8178
push 0xb5
push 0x7c81d0
call fcn.004ff360
add esp, 0x14
mov edx, dword [ebp - 8]
push edx
push 0xb5
push 0x7c8228
call fcn.004f6ce3
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.005e843a
cmp dword [ebp + 0x10], 0
je 0x53cc24
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
xor eax, eax
jmp 0x53cc8e
cmp dword [0x82c11c], 0
jne 0x53cc40
mov ecx, 0x82c12c
call fcn.004e1270
mov dword [0x82c11c], eax
cmp dword [ebp + 0x14], 0
je 0x53cc55
mov ecx, 0x82c12c
call fcn.004e0910
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
cmp dword [0x82c124], 0
jne 0x53cc78
mov eax, dword [0x82c11c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [0x82c11c]
add edx, dword [ecx + 0x3c]
mov dword [0x82c124], edx
cmp dword [ebp + 0x10], 0
je 0x53cc89
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x82c124]
mov dword [eax], ecx
mov eax, dword [0x82c11c]
mov esp, ebp
pop ebp
ret
Function at 0x53ddd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60db29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0051bd60
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x71f1cc
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004f9816
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x33b
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004fced0
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x53de6f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x53dea5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004f8328
and eax, 0xff
test eax, eax
jne 0x53de86
jmp 0x53dea5
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x7c8440
call fcn.00500660
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004fa564
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4