joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5086d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b219
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004d4f70
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x6156e8
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004b27d6
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x1b7
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004b5e90
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x50876f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x5087a5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b12e8
and eax, 0xff
test eax, eax
jne 0x508786
jmp 0x5087a5
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x6b051c
call fcn.004b9670
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b3524
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x50cab0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b5e9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004d4f70
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x615930
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004b27d6
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x16f
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004b5e90
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x50cb4f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x50cb85
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b12e8
and eax, 0xff
test eax, eax
jne 0x50cb66
jmp 0x50cb85
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x6b09d8
call fcn.004b9670
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b3524
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x50fe20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59b929
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004d4f70
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x615ab4
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004b27d6
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x122
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004b5e90
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x50febf
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x50fef5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b12e8
and eax, 0xff
test eax, eax
jne 0x50fed6
jmp 0x50fef5
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x6b0d50
call fcn.004b9670
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b3524
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x512eb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59bd59
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004d4f70
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x615c40
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004b27d6
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0xf2
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004b5e90
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x512f4f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x512f85
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b12e8
and eax, 0xff
test eax, eax
jne 0x512f66
jmp 0x512f85
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x6b0fb4
call fcn.004b9670
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b3524
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x515f50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c0c9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004d4f70
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x615db8
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004b27d6
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0xd2
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004b5e90
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x515fef
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x516025
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b12e8
and eax, 0xff
test eax, eax
jne 0x516006
jmp 0x516025
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x6b12bc
call fcn.004b9670
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b3524
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x519410
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c459
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.00519500
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x615f38
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004b27d6
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0xb2
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004b5e90
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5194af
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x5194e5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b12e8
and eax, 0xff
test eax, eax
jne 0x5194c6
jmp 0x5194e5
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x6aeef0
call fcn.004b9670
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b3524
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x51c9c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c839
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004d4f70
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x615ff0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004b27d6
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x93
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004b5e90
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x51ca5f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x51ca95
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b12e8
and eax, 0xff
test eax, eax
jne 0x51ca76
jmp 0x51ca95
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x6aeef0
call fcn.004b9670
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b3524
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x51e2e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59c8a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0051e3d0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x616228
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004b27d6
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x75
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004b5e90
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x51e37c
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x51e3b2
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b12e8
and eax, 0xff
test eax, eax
jne 0x51e393
jmp 0x51e3b2
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x6aeef0
call fcn.004b9670
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b3524
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x522040
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59cd29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004d4f70
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x616304
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004b27d6
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x54
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004b5e90
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5220dc
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x522112
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b12e8
and eax, 0xff
test eax, eax
jne 0x5220f3
jmp 0x522112
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x6aeef0
call fcn.004b9670
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b3524
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x52ca72
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0xffffffffffffffff
push 0x4f1
push 0x6b3d50
push 0
mov ecx, dword [ebp - 0xc]
call fcn.004b27d6
mov eax, dword [eax + 0x5c]
push eax
call fcn.004b8730
add esp, 0x14
test eax, eax
je 0x52caf1
push 0xffffffffffffffff
push 0x4f1
push 0x6b3d8c
push 0x4f1
push 0x6b3dc8
call fcn.004b8320
add esp, 0x14
push 0xffffffffffffffff
push 0x4f1
push 0x6b3e04
call fcn.004afca3
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.00578c4a
mov ecx, dword [ebp + 8]
call fcn.0049eca0
push eax
call fcn.00578eee
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
call fcn.004ba340
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jle 0x52cb3e
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 4]
jg 0x52cb3e
mov edx, dword [ebp - 8]
sub edx, 1
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
call fcn.004ba470
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov dword [ecx + 0x14], edx
jmp 0x52cb73
push 0x6f0380
mov ecx, dword [ebp + 8]
call fcn.004b9da0
and eax, 0xff
test eax, eax
je 0x52cb73
push 0
lea eax, [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x6c]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov dword [edx + 0x18], eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x14]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.0052cb9d
mov esp, ebp
pop ebp
ret 0x14
Function at 0x52d5d5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0xffffffffffffffff
push 0x581
push 0x6b3e48
push 0
mov ecx, dword [ebp - 0xc]
call fcn.004b27d6
mov eax, dword [eax + 0x5c]
push eax
call fcn.004b8730
add esp, 0x14
test eax, eax
je 0x52d654
push 0xffffffffffffffff
push 0x581
push 0x6b3e84
push 0x581
push 0x6b3ec0
call fcn.004b8320
add esp, 0x14
push 0xffffffffffffffff
push 0x581
push 0x6b3efc
call fcn.004afca3
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.00578c4a
mov ecx, dword [ebp + 8]
call fcn.0049eca0
push eax
call fcn.00578eee
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
call fcn.004ba340
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jle 0x52d6a1
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 4]
jg 0x52d6a1
mov edx, dword [ebp - 8]
sub edx, 1
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0xc
call fcn.004ba470
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
mov dword [ecx + 0x14], edx
jmp 0x52d6d6
push 0x6f0384
mov ecx, dword [ebp + 8]
call fcn.004b9da0
and eax, 0xff
test eax, eax
je 0x52d6d6
push 0
lea eax, [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x6c]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov dword [edx + 0x18], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x14]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.0052d6f4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5329a7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push edi
mov dword [ebp - 0x214], ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
mov word [ebp - 0x210], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0x6b5170
lea eax, [ebp - 0x210]
push eax
call fcn.00578856
add esp, 8
test eax, eax
je 0x532a19
xor al, al
jmp 0x532ac5
push 0
push str.ComboBoxEx32
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x532a3c
xor al, al
jmp 0x532ac5
push 0
push str.ComboBox
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x532a5c
xor al, al
jmp 0x532ac5
push 0
push str.Edit
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x532a7c
xor al, al
jmp 0x532ac5
mov ecx, dword [ebp + 8]
call fcn.0049eca0
push eax
push 0
push 0xc
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0xd
push 0x100
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x12c
call fcn.0049da50
push 0
push 0xd
push 0x101
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x533a8e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e0fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
call fcn.00534460
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
call fcn.004ba340
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
and ecx, 0xff
test ecx, ecx
jne 0x533ae3
mov edx, dword [ebp + 0xc]
and edx, 0xff
test edx, edx
je 0x533c8f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
jmp 0x533b03
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x14]
jge 0x533c8f
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004f1f80
mov ecx, dword [eax]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x38]
push ecx
call dword [eax + 0x24]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x533b46
cmp dword [ebp - 0x20], 0
jne 0x533b48
jmp 0x533afa
mov edx, dword [ebp + 0xc]
and edx, 0xff
test edx, edx
je 0x533b6f
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x20]
push eax
call dword [edx + 0xf8]
mov ecx, dword [ebp + 8]
and ecx, 0xff
test ecx, ecx
je 0x533c7e
mov dword [ebp - 0x28], 0
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
push edx
call dword [ecx + 0xe8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x28], 0
je 0x533c7e
mov eax, dword [ebp - 0x28]
push eax
call fcn.00576ea7
add esp, 4
add eax, 0x64
push eax
lea ecx, [ebp - 0x2c]
call fcn.00499510
mov dword [ebp - 4], 0
push 0
push str.__h2_
mov ecx, dword [ebp - 0x1c]
add ecx, 1
push ecx
push 0
push str._h2_style_background_color:red__body
lea ecx, [ebp - 0x2c]
call fcn.0049e690
mov ecx, eax
call fcn.004ae420
mov ecx, eax
call fcn.0049e520
push 0
mov edx, dword [ebp - 0x28]
push edx
lea ecx, [ebp - 0x2c]
call fcn.0049e520
lea ecx, [ebp - 0x2c]
call fcn.0049eca0
push eax
lea ecx, [ebp - 0x30]
call fcn.004b95a0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x40]
call fcn.0049a900
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x20]
push eax
call dword [edx + 0xe4]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004b9460
cmp dword [ebp - 0x18], 0
jl 0x533c53
mov dword [ebp - 0x44], 0x6b5380
jmp 0x533c5a
mov dword [ebp - 0x44], str.false
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x6b538c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.004995e0
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x20]
push ecx
call dword [eax + 8]
jmp 0x533afa
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8