joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4725e2
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 0x30], 0
je 0x4725f1
pop ebp
jmp 0x4726b2
pop ebp
jmp 0x4725f7
push ebp
push esp
pop ebp
sub esp, 0x404
push ebx
push esi
push ecx
pop esi
push edi
push 0x4ba4fc
push dword [esi + 0x34]
call fcn.0042548b
push eax
pop edi
pop ecx
pop ecx
test edi, edi
jne 0x472624
push eax
push 0xdeadbeef
push 0x1f
jmp 0x472693
mov dword [ebp - 4], 1
sub ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
or eax, eax
je 0x47268b
cmp dword [ebp - 4], ebx
je 0x472671
push edi
push 1
push dword [ebp - 4]
lea eax, [ebp - 0x404]
push eax
call fcn.00424a93
mov eax, dword [ebp - 4]
add esp, 0x10
add dword [esi + 8], eax
adc dword [esi + 0xc], ebx
or eax, eax
jne 0x47262d
mov eax, dword [esi + 8]
push esi
pop ecx
or eax, dword [esi + 0xc]
jne 0x472685
push ebx
push 0xdeadbeef
push 0x21
jmp 0x472695
push 1
push ebx
push ebx
jmp 0x472695
push ebx
push 0xdeadbeef
push 0x20
mov ecx, esi
call fcn.00472777
mov bl, al
test edi, edi
je 0x4726a7
push edi
call fcn.004255d6
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
push ebp
pop esp
pop ebp
ret 4
push ebp
push esp
pop ebp
push ecx
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], 1
push ebx
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov eax, dword [ebp - 8]
or eax, eax
jne 0x4726ea
mov eax, 0x400
mov dword [ebp - 8], eax
cmp dword [ebp - 4], ebx
je 0x472740
or eax, eax
jne 0x4726f7
push ebx
pop edi
jmp 0x472703
push eax
call fcn.00420ff6
push eax
pop edi
mov eax, dword [ebp - 8]
pop ecx
lea ecx, [ebp - 4]
push ecx
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
or eax, eax
je 0x472752
cmp dword [ebp - 4], ebx
je 0x472739
push dword [ebp - 4]
lea ecx, [esi + 0x44]
push edi
call fcn.00472a07
mov eax, dword [ebp - 4]
add dword [esi + 8], eax
adc dword [esi + 0xc], ebx
test eax, eax
je 0x472740
mov eax, dword [ebp - 8]
jmp 0x4726ef
push edi
call fcn.0042106c
pop ecx
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x472763
push ebx
push 0xdeadbeef
push 0x21
jmp 0x472767
push edi
call fcn.0042106c
pop ecx
push ebx
push 0xdeadbeef
push 0x20
jmp 0x472767
push 1
push ebx
push ebx
mov ecx, esi
call fcn.00472777
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x472882
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
push 0x38
xor esi, esi
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.00423020
xor eax, eax
mov dword [ebp - 0x4c], 0x7c
inc eax
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x4c]
push eax
push esi
push dword [ebp + 8]
call fcn.00422e3c
pop ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x4728d9
xor al, al
jmp 0x472989
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
push edi
push dword [ebp - 0x44]
push esi
push dword [ebp - 0x48]
call fcn.004078ad
push dword [ebp - 0x38]
lea ecx, [ebx + 0x10]
push esi
push dword [ebp - 0x3c]
call fcn.004078ad
push dword [ebp - 0x2c]
lea ecx, [ebx + 0x20]
push esi
push dword [ebp - 0x30]
call fcn.004078ad
push dword [ebp - 0x24]
lea ecx, [ebx + 0x30]
push esi
push dword [ebp - 0x28]
call fcn.004078ad
push dword [ebp - 0x1c]
lea ecx, [ebx + 0x40]
push esi
push dword [ebp - 0x20]
call fcn.004078ad
push dword [ebp - 0x14]
lea esi, [ebx + 0x50]
push 0
push dword [ebp - 0x18]
push esi
pop ecx
call fcn.004078ad
push esi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x40]
call fcn.00458123
push eax
lea ecx, [ebx + 0x60]
call fcn.004081a7
lea ecx, [ebp - 0x10]
call fcn.00405a64
mov ax, word [ebp - 0x34]
mov word [ebx + 0x78], ax
mov eax, dword [ebp - 0x40]
mov dword [ebx + 0x74], eax
dec eax
je 0x47297e
dec eax
je 0x472975
mov dword [ebx + 0x70], 3
jmp 0x472985
mov dword [ebx + 0x70], 2
jmp 0x472985
mov dword [ebx + 0x70], 1
pop edi
mov al, 1
pop ebx
pop esi
push ebp
pop esp
pop ebp
ret 8

Function at 0x477590
Capabilities:
Hash data with crc32

Disassembly:
push ebp
push esp
pop ebp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
or edx, 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
add eax, esi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
mov ebx, eax
imul ebx, dword [ebp + 0x14]
push edi
push esi
pop edi
lea eax, [esi + eax*4]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x14]
shl ebx, 2
shl eax, 2
mov dword [ebp + 0xc], eax
movzx eax, byte [esi + 2]
movzx ecx, dl
xor ecx, eax
shr edx, 8
movzx eax, byte [esi + 1]
xor edx, dword [ecx*4 + 0x4b70b0]
movzx ecx, dl
xor ecx, eax
shr edx, 8
movzx eax, byte [esi]
add esi, ebx
xor edx, dword [ecx*4 + 0x4b70b0]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4b70b0]
cmp esi, dword [ebp + 8]
jb 0x477607
add edi, dword [ebp + 0xc]
mov esi, edi
cmp edi, dword [ebp + 0x10]
jb 0x4775c3
not edx
mov dword [ebp + 8], edx
fild dword [ebp + 8]
test edx, edx
jns 0x47761e
fadd qword [0x4bbac8]
pop edi
fstp qword [ebp - 8]
fld qword [ebp - 8]
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret 0x10
Function at 0x47762d
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x10], ecx
mov eax, dword [esi + 8]
mov edx, dword [esi]
cmp eax, edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esi + 4]
setl bl
cmp ecx, edi
mov byte [ebp - 1], bl
setl bh
mov byte [ebp + 0xf], bh
test bl, bl
je 0x477660
mov dword [esi], eax
mov dword [esi + 8], edx
test bh, bh
je 0x47766a
mov dword [esi + 4], ecx
mov dword [esi + 0xc], edi
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
push dword [eax + 0x104]
call fcn.00473c94
mov ecx, dword [ebp - 0x1c]
add dword [esi + 8], ecx
mov eax, dword [ebp - 0x18]
add dword [esi + 0xc], eax
add dword [esi], ecx
add dword [esi + 4], eax
mov edi, dword [esi + 8]
mov ebx, dword [esi + 0xc]
sub edi, dword [esi]
sub ebx, dword [esi + 4]
inc edi
inc ebx
push 0
mov dword [ebp - 0xc], ebx
call dword [sym.imp.USER32.dll_GetDC]
push ebx
push edi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push dword [ebp - 8]
mov dword [ebp + 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dh, byte [ebp + 0xf]
mov ecx, ebx
mov dword [ebp - 0x14], eax
test dh, dh
je 0x4776db
neg ecx
mov dl, byte [ebp - 1]
mov eax, edi
test dl, dl
je 0x4776e6
neg eax
test dh, dh
je 0x4776ef
mov ebx, dword [esi + 0xc]
jmp 0x4776f2
mov ebx, dword [esi + 4]
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp - 0xc]
test dl, dl
je 0x477701
mov edx, dword [esi + 8]
jmp 0x477703
mov edx, dword [esi]
mov esi, dword [ebp - 0x10]
push 0xcc0020
push ecx
push eax
push dword [ebp + 0xc]
push edx
push dword [ebp - 8]
push ebx
push edi
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, ebx
mov dword [ebp - 0x48], 0x28
neg eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], eax
sub ecx, ecx
push 0x20
sub eax, eax
mov dword [ebp - 0x38], ecx
inc eax
mov word [ebp - 0x3c], ax
pop eax
push ecx
mov word [ebp - 0x3a], ax
lea eax, [ebp - 0x48]
push eax
push ecx
push ecx
push ecx
push dword [ebp + 8]
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDIBits]
call esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x34]
push ecx
mov dword [eax], ecx
call fcn.00420ff6
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x48]
push eax
push edi
push ebx
mov ebx, dword [ebp - 0x10]
push 0
push dword [ebp + 8]
push ebx
call esi
push dword [ebp - 0x14]
mov esi, eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 8]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
or esi, esi
je 0x4777ac
push edi
pop eax
jmp 0x4777b5
push edi
call fcn.0042106c
pop ecx
sub eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4780a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 2
pop eax
lea ecx, [ebp - 0x10]
mov word [edi], ax
call fcn.00405c18
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call fcn.0047830b
push dword [ebp - 0x10]
call dword [sym.imp.WSOCK32.dll_inet_addr]
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00405a64
cmp ebx, 0xffffffff
jne 0x4780f7
mov ecx, dword [ebp + 0xc]
mov edx, str.255.255.255.255
call fcn.0045a36d
test al, al
je 0x4780f7
push 0
push 1
jmp 0x47811a
mov ecx, dword [ebp + 0x10]
mov dword [edi + 4], ebx
lea eax, [ecx - 1]
cmp eax, 0xfffe
ja 0x478116
push ecx
call dword [sym.imp.WSOCK32.dll_htons]
mov word [edi + 2], ax
mov al, 1
jmp 0x478128
push 0
push 2
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.00456aa3
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x478131
Capabilities:
Get socket status

Disassembly:
push ebp
push esp
pop ebp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
and dword [ebx], 0
push ecx
pop edi
mov dword [ebx + 4], eax
mov ecx, 0x3e8
push esi
pop eax
inc dword [ebx]
cdq
idiv ecx
mov dword [ebp - 8], eax
imul eax, eax, 0x3e8
sub esi, eax
imul eax, esi, 0x3e8
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
sub eax, eax
push eax
cmp byte [ebp + 0x14], al
je 0x47817a
push ebx
push eax
jmp 0x47817c
push eax
push ebx
push eax
call dword [sym.imp.WSOCK32.dll_select]
push eax
pop esi
test esi, esi
jne 0x478196
cmp byte [ebp + 0x14], al
je 0x4781c2
push eax
push 0x274c
jmp 0x4781b6
jle 0x4781ad
push ebx
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll___WSAFDIsSet]
test eax, eax
jne 0x4781c2
push 0xfffffffffffffffe
pop esi
push eax
push esi
jmp 0x4781b6
push 0
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
mov eax, dword [edi]
mov ecx, dword [eax + 4]
add ecx, edi
call fcn.00456aa3
pop edi
mov eax, esi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret 0x10
Function at 0x48122d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push ecx
pop esi
mov dword [ebp - 4], 0xff
sub ecx, ecx
lea eax, [ebp - 0x24]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 4]
push edx
pop ebx
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0xc], ebx
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x48132c
mov eax, ebx
or eax, 0x20019
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 8]
push ecx
push eax
push 0
lea eax, [ebp - 0x228]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or eax, eax
jne 0x481343
mov ecx, dword [ebp - 8]
mov edx, ebx
call fcn.0048122d
push dword [ebp - 8]
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x481343
sub ebx, ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
call fcn.00481072
test al, al
lea eax, [ebp - 0x228]
je 0x4812de
push ebx
mov ebx, dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
push ebx
push eax
push esi
call fcn.0047ff84
call eax
jmp 0x4812e9
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, dword [ebp - 0xc]
test eax, eax
jne 0x481334
cmp dword [ebp - 0x18], eax
je 0x4812fb
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ecx, ecx
mov dword [ebp - 4], 0xff
lea eax, [ebp - 0x24]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x228]
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
mov eax, dword [ebp - 0x1c]
jne 0x481277
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x18], 0
je 0x481343
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x48132e
Function at 0x4888b4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
mov ecx, 0x4c67b0
push ebx
push esi
push edi
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00402402
test al, al
jne 0x4888dd
xor eax, eax
jmp 0x488ab7
mov ecx, dword [ebp - 4]
mov eax, dword [0x4c6810]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [0x4c6824]
mov eax, dword [eax + ecx*4]
lea ecx, [ebp + 0xc]
mov edi, dword [eax]
mov bl, byte [edi + 0x90]
mov esi, dword [edi]
mov dword [ebp - 8], esi
mov byte [ebp + 0xb], bl
call fcn.0040322f
cmp dword [edi + 0x48], 0
jl 0x48891e
push dword [edi + 0x48]
call fcn.0048a71e
movzx eax, bl
mov ebx, dword [ebp + 0xc]
cmp eax, 0x12
jg 0x488a02
je 0x4889bf
test eax, eax
je 0x4889af
jle 0x4888d6
cmp eax, 4
jle 0x488a48
cmp eax, 8
je 0x48898f
cmp eax, 0x10
je 0x488979
cmp eax, 0x11
jne 0x4888d6
mov eax, dword [ebp + 0xc]
or eax, eax
js 0x4888d6
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.004022d0
push 1
push 0
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x488aa0
cmp dword [ebp + 0xc], 0
jl 0x4888d6
push dword [ebp + 0xc]
push 0
push 0x111d
jmp 0x4889a3
cmp dword [ebp + 0xc], 0
jl 0x4888d6
push dword [ebp + 0xc]
push 0
push 0x2001
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x488aa0
mov eax, dword [ebp + 0xc]
or eax, eax
jns 0x488a6a
jmp 0x4888d6
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jl 0x4888d6
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.004022d0
test byte [edi + 0x92], 0x20
jne 0x488aa0
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi]
call esi
push 5
push dword [edi]
call esi
push dword [edi]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x488aa0
cmp eax, 0x13
je 0x488a55
cmp eax, 0x14
je 0x488951
cmp eax, 0x17
je 0x488a48
cmp eax, 0x18
je 0x488a2a
jle 0x4888d6
cmp eax, 0x1b
jle 0x488a48
jmp 0x4888d6
or ebx, ebx
js 0x4888d6
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0xb
push eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
push ebx
mov dword [edi + 0x48], ebx
call fcn.004022d0
jmp 0x488a95
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xfffffffe
je 0x4888d6
mov eax, 0xfe000000
cmp ebx, eax
jne 0x488a77
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.004022d0
jmp 0x488aa0
push ebx
push 0
push 0x1001
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
push ebx
push 0
push 0x1026
push dword [ebp - 8]
call esi
push 1
push edi
push dword [ebp - 4]
call fcn.0048b57f
cmp dword [0x4c62b0], 0
je 0x488ab4
cmp byte [ebp + 0xb], 8
jne 0x488ab4
or eax, 0xffffffff
jmp 0x488ab7
sub eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48a2c5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov ecx, 0x4c67b0
push eax
push dword [ebp + 8]
call fcn.00402402
test al, al
jne 0x48a2ef
xor eax, eax
jmp 0x48a422
mov ecx, dword [ebp - 0xc]
mov eax, dword [0x4c6810]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 8]
push edi
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov eax, dword [0x4c6824]
mov eax, dword [eax + ecx*4]
mov ecx, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [eax]
mov ebx, dword [edi]
cmp esi, 0xffffffff
je 0x48a38a
movzx eax, byte [edi + 0x90]
dec eax
dec eax
je 0x48a356
dec eax
je 0x48a359
sub eax, 3
je 0x48a351
dec eax
je 0x48a34c
sub eax, 3
je 0x48a344
sub eax, 0xc
jne 0x48a377
jmp 0x48a41f
or esi, 0x4000000
jmp 0x48a377
or esi, 3
jmp 0x48a377
or esi, 0xe
jmp 0x48a377
or esi, 4
push 0
test esi, 0x800
je 0x48a367
push 1
jmp 0x48a36f
or esi, 0x10000
push 0
push 0xcf
push ebx
call ecx
or esi, 0x50000000
push esi
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x10]
cmp esi, 0xffffffff
je 0x48a3c7
push esi
push 0xffffffffffffffec
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [0x4c6824]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax]
cmp byte [eax + 0x90], 0x13
jne 0x48a3c7
push esi
push 0
push 0x1036
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], eax
mov al, byte [edi + 0x93]
mov ecx, dword [ebp + 8]
cmp al, 0xff
je 0x48a3ea
movzx eax, al
cmp eax, dword [ecx + 0x190]
je 0x48a3ea
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x48a3f3
push 1
push edi
push ecx
call fcn.0048b57f
mov al, byte [edi + 0x90]
cmp al, 2
je 0x48a406
cmp al, 3
je 0x48a406
cmp esi, 0xffffffff
je 0x48a417
push 0x27
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowPos]
sub eax, eax
cmp dword [ebp - 4], eax
setne al
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret 0xc
Function at 0x48b8ef
Capabilities:
Create process on windows

Disassembly:
push ebp
push esp
pop ebp
push ebx
push esi
push 0x44
push 0
mov ebx, 0x4c7f20
push ebx
call fcn.00423020
push 0x10
push 0
mov esi, 0x4c7f64
push esi
call fcn.00423020
add esp, 0x18
mov dword [0x4c7f20], 0x44
sub eax, eax
inc eax
mov dword [0x4c7f4c], eax
push esi
push ebx
mov word [0x4c7f50], ax
sub eax, eax
push eax
push eax
push 0x20
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop esi
pop ebx
or eax, eax
je 0x48b954
push dword [0x4c7f64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret 4

Function at 0x48b958
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 3
mov edi, ecx
mov edx, dword [ebx + 4]
mov dword [ebp + 8], edx
pop esi
cmp dword [ebx + 0x190], eax
je 0x48ba0e
cmp dword [edi + 0x84], esi
jl 0x48ba08
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
test ecx, ecx
je 0x48b9f9
cmp dword [ecx + 4], edx
jne 0x48b9f9
mov dl, byte [ecx + 0x90]
cmp dl, 0xb
je 0x48b9f6
mov dh, byte [ecx + 0x93]
movzx eax, dh
cmp eax, dword [ebx + 0x190]
je 0x48b9c8
cmp byte [ebx + 0x198], 0
je 0x48b9f6
cmp dh, 0xff
je 0x48b9f6
cmp dl, 0xa
je 0x48b9f6
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
test byte [eax + 0x92], 0x40
je 0x48b9f6
cmp byte [eax + 0x90], 0x1a
jne 0x48b9f6
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp + 8]
inc esi
cmp esi, dword [edi + 0x84]
jle 0x48b988
mov eax, dword [ebp + 0xc]
push 3
pop esi
mov dword [ebx + 0x190], eax
cmp dword [edi + 0x84], esi
jl 0x48ba9b
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
test ecx, ecx
je 0x48ba8c
cmp dword [ecx + 4], edx
jne 0x48ba8c
cmp byte [ecx + 0x90], 0xb
je 0x48ba8c
movzx eax, byte [ecx + 0x93]
cmp eax, dword [ebx + 0x190]
jne 0x48ba8c
test byte [ecx + 0x92], 0x20
jne 0x48ba8c
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
push 4
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
test byte [eax + 0x92], 0x40
je 0x48ba8c
cmp byte [eax + 0x90], 0x1a
jne 0x48ba8c
push 1
push dword [eax]
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp + 8]
inc esi
cmp esi, dword [edi + 0x84]
jle 0x48ba1a
mov eax, dword [ebp + 0xc]
push 0
push eax
push 0x130c
push dword [ebx + 0x188]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret 8
Function at 0x48bced
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x24
push ebx
push esi
push edi
sub edi, edi
cmp word [eax], di
je 0x48be07
push edi
push edi
push 3
push edi
push edi
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
pop edi
cmp edi, 0xffffffff
jne 0x48bd24
sub eax, eax
jmp 0x48be36
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
or ebx, ebx
jne 0x48bd47
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48bd1d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
lea ecx, [ebp - 0xc]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push eax
pop esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, esi
je 0x48bd1d
lea eax, [ebp - 8]
push eax
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea eax, [ebp - 4]
sub edi, edi
push eax
push 0x492cac
push edi
push edi
push dword [ebp - 8]
mov dword [ebp - 4], edi
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
or ecx, ecx
je 0x48bd1d
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
push ecx
call dword [eax + 0xc]
lea eax, [ebp - 0x24]
push eax
push 0x18
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_GetObjectW]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
cmp dword [edx], edi
jne 0x48bde3
cmp dword [ecx], edi
jne 0x48bde3
mov eax, dword [ebp - 0x20]
mov dword [edx], eax
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
push 0x2000
push dword [ecx]
push dword [edx]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CopyImage]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
jmp 0x48be0c
mov eax, edi
mov dword [ebp + 0xc], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x64], 0
je 0x48be21
push dword [esi + 0x64]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 0xc]
push eax
push edi
mov dword [esi + 0x64], eax
mov esi, dword [esi]
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x48c788
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
push esp
pop ebp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x4c67b0
push edi
mov ecx, esi
call fcn.00402612
mov ecx, dword [0x4c6810]
mov eax, dword [ecx + eax*4]
mov ebx, dword [eax]
cmp dword [ebp + 0xc], edi
jne 0x48c7e2
xor esi, esi
cmp dword [ebx + 0x1a0], esi
je 0x48c846
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push esi
push edi
push dword [ebp - 4]
push dword [ebp - 8]
push esi
push dword [ebx + 0x1a0]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x48c864
push dword [ebp + 0xc]
mov ecx, esi
call fcn.004025db
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x48c846
mov ecx, dword [0x4c6824]
mov ecx, dword [ecx + eax*4]
mov eax, dword [ecx]
mov cl, byte [eax + 0x90]
cmp cl, 0xe
je 0x48c846
cmp cl, 0xf
je 0x48c846
cmp cl, 0x13
je 0x48c846
cmp cl, 0x10
je 0x48c846
xor esi, esi
cmp dword [eax + 0xc], esi
je 0x48c846
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [0x4c6824]
mov ecx, dword [ebp + 8]
push esi
push dword [ebx]
push dword [ebp - 4]
mov eax, dword [eax + ecx*4]
push dword [ebp - 8]
push esi
mov eax, dword [eax]
push dword [eax + 0xc]
jmp 0x48c7d7
mov eax, dword [ebp + 0x14]
movzx ecx, ax
mov eax, dword [ebp + 0x10]
shl ecx, 0x10
movzx eax, ax
or ecx, eax
push ecx
push dword [ebp + 0xc]
push 0x7b
push edi
call dword [sym.imp.USER32.dll_DefDlgProcW]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret 0x10