joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c87c
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4b5870]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x20c], ax
mov edi, ecx
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.00470210
add esp, 0xc
lea eax, [ebp - 0x20c]
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.wininet.dll
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00471b6c
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x6c], eax
test eax, eax
je 0x43c9bd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetOpenW
push eax
call esi
push str.InternetConnectW
push dword [edi + 0x6c]
mov dword [edi + 0x3c], eax
call esi
push str.HttpOpenRequestW
push dword [edi + 0x6c]
mov dword [edi + 0x40], eax
call esi
push str.HttpAddRequestHeadersW
push dword [edi + 0x6c]
mov dword [edi + 0x44], eax
call esi
push str.HttpSendRequestW
push dword [edi + 0x6c]
mov dword [edi + 0x48], eax
call esi
push str.HttpQueryInfoW
push dword [edi + 0x6c]
mov dword [edi + 0x4c], eax
call esi
push str.InternetReadFile
push dword [edi + 0x6c]
mov dword [edi + 0x50], eax
call esi
push str.InternetCloseHandle
push dword [edi + 0x6c]
mov dword [edi + 0x54], eax
call esi
push str.InternetCrackUrlW
push dword [edi + 0x6c]
mov dword [edi + 0x58], eax
call esi
push str.InternetSetOptionW
push dword [edi + 0x6c]
mov dword [edi + 0x5c], eax
call esi
push str.InternetQueryDataAvailable
push dword [edi + 0x6c]
mov dword [edi + 0x60], eax
call esi
mov dword [edi + 0x64], eax
cmp dword [edi + 0x3c], ebx
je 0x43c9ba
cmp dword [edi + 0x40], ebx
je 0x43c9ba
cmp dword [edi + 0x44], ebx
je 0x43c9ba
cmp dword [edi + 0x48], ebx
je 0x43c9ba
cmp dword [edi + 0x4c], ebx
je 0x43c9ba
cmp dword [edi + 0x50], ebx
je 0x43c9ba
cmp dword [edi + 0x54], ebx
je 0x43c9ba
cmp dword [edi + 0x58], ebx
je 0x43c9ba
cmp dword [edi + 0x5c], ebx
je 0x43c9ba
cmp dword [edi + 0x60], ebx
je 0x43c9ba
inc ebx
mov dword [edi + 0x38], ebx
mov eax, dword [edi + 0x38]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046f685
mov esp, ebp
pop ebp
ret
Function at 0x43ec65
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4b5870]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x410], eax
xor eax, eax
push 0x60
push eax
push esi
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x408], eax
call ebx
mov edi, eax
test edi, edi
jne 0x43ecce
push 2
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x43ecce
call fcn.0043dfae
mov esi, eax
jmp 0x43ed6f
push dword [ebp - 0x410]
push dword [ebp - 0x40c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x43ecee
call fcn.0043dfae
jmp 0x43ed62
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x43ece7
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x43ed14
mov esi, 0x8007000e
jmp 0x43ed64
push eax
lea ecx, [ebp - 0x408]
call fcn.0043dd86
cmp dword [ebp - 0x408], 0
je 0x43ed0d
push esi
push dword [ebp - 0x408]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x43ece7
mov eax, dword [ebp - 0x408]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x418]
push dword [ebp - 0x408]
call fcn.0043eb2a
mov esi, eax
test edi, edi
je 0x43ed6f
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x43ed88
lea ecx, [ebp - 0x408]
call fcn.0043e24f
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046f685
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43fbc8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
test edx, edx
jne 0x43fbdb
push 0xd
pop eax
jmp 0x43fc1f
push esi
xor eax, eax
push edi
mov dword [ebp + 0xc], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp + 0xc]
jne 0x43fbee
sub ecx, dword [ebp - 4]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x43fbe6
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43fc26
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x43fc38
push 0xd
pop eax
jmp 0x43fc6a
mov ecx, edx
push ebx
push edi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x43fc41
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x446356
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [eax + 0x14], 8
jb 0x44636c
mov eax, dword [eax]
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x44638b
xor al, al
jmp 0x4463f0
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x4463e4
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
push ebx
push esi
call fcn.0040f590
cmp dword [edi + 0x14], 0x10
jb 0x4463b0
mov edi, dword [edi]
test esi, esi
je 0x4463e1
mov ecx, ebx
push ebx
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
mov eax, esi
sub eax, ecx
push eax
lea eax, [ecx + edi]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4463e1
mov ecx, dword [ebp - 4]
add ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp ecx, esi
jb 0x4463b6
mov bl, 1
pop edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4575ae
Capabilities:
Find taskbar

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
xor edi, edi
push edi
push 0x49be84
push edi
push edi
call esi
test eax, eax
je 0x4575e2
push edi
push str.ReBarWindow32
push edi
push eax
call esi
test eax, eax
je 0x4575e2
push str.Quick_Launch
push str.ToolbarWindow32
push edi
push eax
call esi
pop edi
pop esi
ret
Function at 0x457610
Capabilities:
Find taskbar

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
xor edi, edi
push edi
push 0x49be84
push edi
push edi
call esi
test eax, eax
je 0x45764e
push edi
push str.ReBarWindow32
push edi
push eax
call esi
test eax, eax
je 0x45764e
push edi
push str.MSTaskSwWClass
push edi
push eax
call esi
test eax, eax
je 0x45764e
push edi
push str.MSTaskListWClass
push edi
push eax
call esi
pop edi
pop esi
ret

Function at 0x458159
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], ax
lea eax, [ebp - 4]
push eax
push str.Softwareliebao
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x458226
lea eax, [ebp + 8]
mov dword [ebp - 8], 1
push eax
push ebx
lea eax, [ebp - 8]
mov dword [ebp + 8], ebx
push eax
push ebx
push str.AppDataPath
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45821d
mov eax, dword [ebp + 8]
mov ecx, esi
shr eax, 1
push ebx
add eax, 0x10
push eax
call fcn.0040b210
add dword [ebp + 8], 2
cmp dword [esi + 0x14], 8
jb 0x4581d8
mov eax, dword [esi]
jmp 0x4581da
mov eax, esi
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.AppDataPath
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45821d
cmp dword [esi + 0x14], 8
jb 0x458200
mov ecx, dword [esi]
jmp 0x458202
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x458205
sub ecx, edx
sar ecx, 1
push ebx
push ecx
mov ecx, esi
call fcn.0040b210
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45822e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], ax
lea eax, [ebp - 4]
push eax
push str.Softwareliebao
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4582fb
lea eax, [ebp + 8]
mov dword [ebp - 8], 1
push eax
push ebx
lea eax, [ebp - 8]
mov dword [ebp + 8], ebx
push eax
push ebx
push str.Install_Path_Dir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4582f2
mov eax, dword [ebp + 8]
mov ecx, esi
shr eax, 1
push ebx
add eax, 0x10
push eax
call fcn.0040b210
add dword [ebp + 8], 2
cmp dword [esi + 0x14], 8
jb 0x4582ad
mov eax, dword [esi]
jmp 0x4582af
mov eax, esi
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.Install_Path_Dir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4582f2
cmp dword [esi + 0x14], 8
jb 0x4582d5
mov ecx, dword [esi]
jmp 0x4582d7
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4582da
sub ecx, edx
sar ecx, 1
push ebx
push ecx
mov ecx, esi
call fcn.0040b210
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x458303
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], ax
lea eax, [ebp - 4]
push eax
push str.Softwareliebao
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4583d0
lea eax, [ebp + 8]
mov dword [ebp - 8], 1
push eax
push ebx
lea eax, [ebp - 8]
mov dword [ebp + 8], ebx
push eax
push ebx
push str.ProgramPath
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4583c7
mov eax, dword [ebp + 8]
mov ecx, esi
shr eax, 1
push ebx
add eax, 0x10
push eax
call fcn.0040b210
add dword [ebp + 8], 2
cmp dword [esi + 0x14], 8
jb 0x458382
mov eax, dword [esi]
jmp 0x458384
mov eax, esi
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.ProgramPath
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4583c7
cmp dword [esi + 0x14], 8
jb 0x4583aa
mov ecx, dword [esi]
jmp 0x4583ac
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4583af
sub ecx, edx
sar ecx, 1
push ebx
push ecx
mov ecx, esi
call fcn.0040b210
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4583d8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x4b5870]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x48], ebx
cmp dword [esi + 0x14], 8
jb 0x458402
mov eax, dword [esi]
jmp 0x458404
mov eax, esi
lea ecx, [ebp - 0x48]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x44], eax
test eax, eax
je 0x4584cc
push edi
push eax
call fcn.00470362
mov edi, eax
mov dword [ebp - 0x58], edi
pop ecx
test edi, edi
je 0x4584cb
cmp dword [esi + 0x14], 8
jb 0x458436
mov esi, dword [esi]
push edi
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4584c4
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x4c], ebx
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], ebx
push eax
push 0x4a7f5c
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4584c4
cmp dword [ebp - 0x4c], ebx
je 0x4584c4
mov eax, dword [ebp - 0x50]
push 0x3a
movzx ecx, word [eax + 0xa]
movzx ebx, word [eax + 8]
movzx edi, word [eax + 0xe]
movzx esi, word [eax + 0xc]
xor eax, eax
push eax
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push eax
mov dword [ebp - 0x44], ecx
call fcn.00470210
push esi
push edi
push ebx
push dword [ebp - 0x44]
lea eax, [ebp - 0x40]
push str._d._d._d._d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x40]
push eax
call fcn.00406100
mov ecx, dword [ebp - 0x54]
add esp, 0x28
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00402920
mov edi, dword [ebp - 0x58]
mov bl, 1
push edi
call fcn.0046edf3
pop ecx
pop edi
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.0046f685
mov esp, ebp
pop ebp
ret

Function at 0x458f14
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4b5870]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
lea eax, [ebp - 0x22c]
push 0x228
push esi
push eax
mov dword [ebp - 0x230], esi
call fcn.00470210
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x458fb8
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x458fb1
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, dword [ebp + 8]
cmp dword [ebp - 0x228], ebx
je 0x458f95
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x458f7a
jmp 0x458fb0
lea eax, [ebp - 0x20c]
push str.explorer.exe
push eax
call fcn.00472a84
pop ecx
pop ecx
xor ecx, ecx
inc ecx
test eax, eax
cmove esi, ecx
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0046f685
mov esp, ebp
pop ebp
ret
Function at 0x45a066
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
mov edi, ecx
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov byte [edi + 0x5c], al
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x45a19c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XL_Init
push eax
call esi
push str.XL_UnInit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.XL_CreateTask
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.XL_DeleteTask
push dword [edi]
mov dword [edi + 0xc], eax
call esi
push str.XL_StartTask
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.XL_StopTask
push dword [edi]
mov dword [edi + 0x14], eax
call esi
push str.XL_QueryTaskInfoEx
push dword [edi]
mov dword [edi + 0x18], eax
call esi
push str.XL_DelTempFile
push dword [edi]
mov dword [edi + 0x1c], eax
call esi
push str.XL_SetSpeedLimit
push dword [edi]
mov dword [edi + 0x20], eax
call esi
push str.XL_SetUploadSpeedLimit
push dword [edi]
mov dword [edi + 0x24], eax
call esi
push str.XL_SetProxy
push dword [edi]
mov dword [edi + 0x28], eax
call esi
push str.XL_SetUserAgent
push dword [edi]
mov dword [edi + 0x2c], eax
call esi
push str.XL_ParseThunderPrivateUrl
push dword [edi]
mov dword [edi + 0x30], eax
call esi
push str.XL_Determine3GNetType
push dword [edi]
mov dword [edi + 0x34], eax
call esi
push str.XL_GetFileSizeWithUrl
push dword [edi]
mov dword [edi + 0x38], eax
call esi
push str.XL_SetFileIdAndSize
push dword [edi]
mov dword [edi + 0x3c], eax
call esi
push str.XL_SetAdditionInfo
push dword [edi]
mov dword [edi + 0x40], eax
call esi
push str.XL_CreateTaskByURL
push dword [edi]
mov dword [edi + 0x44], eax
call esi
push str.XL_CreateTaskByThunder
push dword [edi]
mov dword [edi + 0x48], eax
call esi
push str.XL_CreateBTTaskByThunder
push dword [edi]
mov dword [edi + 0x4c], eax
call esi
push str.XL_AddServerResourceEx
push dword [edi]
mov dword [edi + 0x50], eax
call esi
push str.XL_SetThreadNum
push dword [edi]
mov dword [edi + 0x54], eax
call esi
mov dword [edi + 0x58], eax
mov byte [edi + 0x5c], 1
pop esi
mov eax, edi
pop edi
pop ebp
ret 4
Function at 0x45a920
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x4b5870]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
push 0x4a7f58
call fcn.00406100
pop ecx
push eax
push 0x4a7f58
mov ecx, edi
call fcn.00402920
push 0x4a7f58
lea ecx, [ebp - 0x7c]
call fcn.004074d0
push 0x4a7f58
lea ecx, [ebp - 0x64]
call fcn.004074d0
lea eax, [ebp - 0x7c]
mov ecx, str..apk
push eax
test esi, esi
mov eax, str..ipa
cmove eax, ecx
mov ecx, ebx
push eax
push SysReAllocStringLen
call fcn.0045b492
test eax, eax
jne 0x45a99d
xor esi, esi
mov edi, esi
jmp 0x45aaa7
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x4c]
call fcn.004074a0
mov esi, str._shellopencommand
push esi
call fcn.00406100
pop ecx
push eax
push esi
lea ecx, [ebp - 0x4c]
call fcn.00408ee0
cmp dword [ebp - 0x38], 8
lea ecx, [ebp - 0x64]
push ecx
lea eax, [ebp - 0x4c]
mov ecx, ebx
cmovae eax, dword [ebp - 0x4c]
push eax
push SysReAllocStringLen
call fcn.0045b492
test eax, eax
je 0x45aa98
cmp dword [ebp - 0x54], 0
je 0x45aa98
xor eax, eax
mov dword [ebp - 8], 7
mov word [ebp - 0x1c], ax
xor esi, esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x64]
push 3
push eax
call fcn.004136f0
add esp, 0xc
cmp dword [ebp - 0xc], esi
jne 0x45aa1a
mov edi, esi
jmp 0x45aa8b
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x80]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x80], esi
cmovae eax, dword [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea ecx, [ebp - 0x34]
push dword [eax]
call fcn.004074d0
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
push esi
cmovae eax, dword [ebp - 0x34]
push esi
push 3
push esi
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x45aa64
mov edi, esi
jmp 0x45aa80
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x34]
cmp edi, eax
je 0x45aa7d
push 0xffffffffffffffff
push esi
push eax
mov ecx, edi
call fcn.00403730
xor edi, edi
inc edi
push esi
push 1
lea ecx, [ebp - 0x34]
call fcn.00403940
push esi
push 1
lea ecx, [ebp - 0x1c]
call fcn.00403940
jmp 0x45aa9c
xor esi, esi
mov edi, esi
push esi
push 1
lea ecx, [ebp - 0x4c]
call fcn.00403940
push esi
push 1
lea ecx, [ebp - 0x64]
call fcn.00403940
push esi
push 1
lea ecx, [ebp - 0x7c]
call fcn.00403940
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046f685
mov esp, ebp
pop ebp
ret 8
Function at 0x45ac4c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [esi + 0x34], eax
jne 0x45ac88
mov eax, dword [0x4b526c]
cmp eax, 0xa
push 0xb
pop ecx
cmovne eax, ecx
mov dword [0x4b526c], eax
cmp eax, ecx
jne 0x45ac79
lea ecx, [esi - 0x40]
call fcn.0045aad2
push 0
lea ecx, [esi - 0x40]
call fcn.0045a479
jmp 0x45ad46
cmp eax, dword [esi + 0x30]
jne 0x45ad46
push ebx
push edi
lea edi, [esi - 0x40]
mov dword [0x4b526c], 0xa
mov ecx, edi
call fcn.0045aad2
xor ebx, ebx
cmp dword [esi + 0x4c], ebx
je 0x45acc5
push 5
push ebx
push ebx
push 0x49c420
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x45ad44
lea eax, [esi - 0x40]
test eax, eax
lea eax, [esi - 4]
jne 0x45acd1
mov eax, ebx
push eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov ecx, eax
call fcn.00439c5e
cmp dword [esi + 0x70], ebx
je 0x45ad2e
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov ecx, eax
call fcn.004397c9
lea eax, [esi + 0x60]
cmp dword [eax + 0x14], 8
jb 0x45acfe
mov eax, dword [eax]
push 5
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [edi]
mov ecx, edi
push ebx
push 1
push 0x1511
call dword [eax + 8]
mov ecx, eax
call fcn.004397c9
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x45ad3a
cmp dword [esi + 0x54], ebx
jne 0x45ad3a
mov ecx, edi
call fcn.0045b704
mov dword [esi + 0x44], 0x3e8
mov dword [esi + 0x40], ebx
pop edi
pop ebx
pop esi
pop ebp
ret 4
Function at 0x45adf3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4b5870]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov eax, dword [edi + 0x60]
test eax, eax
jle 0x45ae17
dec eax
mov dword [edi + 0x60], eax
jmp 0x45aeee
push esi
test eax, eax
jne 0x45ae75
or dword [edi + 0x60], 0xffffffff
mov ecx, dword [0x4b9564]
push 1
call fcn.004399a8
xor ebx, ebx
mov byte [0x4b9568], 1
cmp dword [edi + 0x74], ebx
je 0x45aeed
lea esi, [edi - 0x3c]
mov ecx, esi
call fcn.0045a3bc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, eax
call fcn.004397c9
add edi, 0x64
cmp dword [edi + 0x14], 8
jb 0x45ae62
mov edi, dword [edi]
push 5
push ebx
push ebx
push edi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x45aeed
mov eax, dword [ebp + 8]
sub dword [edi + 0x48], eax
cmp dword [edi + 0x48], 0
jg 0x45aeed
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x14]
lea esi, [edi - 0x3c]
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, eax
call fcn.004397c9
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push dword [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x45aec1
and dword [edi + 0x44], 0
jmp 0x45aee6
inc dword [edi + 0x44]
cmp dword [edi + 0x44], 0xa
jl 0x45aee6
mov eax, dword [0x4b526c]
cmp eax, 0xa
push 0xc
pop ecx
cmovne eax, ecx
mov ecx, esi
push 1
mov dword [0x4b526c], eax
call fcn.0045a479
mov dword [edi + 0x48], 0x3e8
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0046f685
mov esp, ebp
pop ebp
ret 4