joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c7d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push ecx
push edx
mov dword [esp + 0xc], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x42c7fb
mov eax, dword [esp]
test eax, eax
je 0x42c7f7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop ecx
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 4]
push ecx
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [esp]
jne 0x42c7ec
test eax, eax
je 0x42c82b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop ecx
ret

Function at 0x42c8a0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5cea68
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x66a8c4]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x66a8c4]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [esp + 0x50]
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x58]
mov ebp, dword [esp + 0x5c]
xor ebx, ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
call fcn.00403ca0
mov edx, dword [esp + 0x64]
lea ecx, [esp + 0x14]
push ecx
push edx
push ebx
push edi
mov dword [esp + 0x58], ebx
push esi
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42c952
mov eax, dword [esp + 0x60]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], ebx
call fcn.00401590
lea ecx, [esp + 0x60]
push ecx
lea ecx, [esp + 0x24]
call fcn.00401570
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push ebx
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x20]
call fcn.00401570
mov esi, dword [esp + 0x1c]
push eax
mov ecx, esi
call fcn.00404560
lea ecx, [esp + 0x20]
call fcn.00403d10
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00590c4b
add esp, 0x38
ret
Function at 0x42c9a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebp
push edi
mov ecx, esi
call fcn.00403c80
lea ecx, [esp + 8]
push ecx
push eax
push reloc.WS2_32.dll_accept
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x42c9f2
mov edx, dword [esp + 8]
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov edi, eax
mov eax, dword [esp + 8]
push eax
call ebp
test edi, edi
sete al
test al, al
jne 0x42ca4f
mov ecx, dword [esp + 0x14]
call fcn.00403c80
mov ecx, esi
mov edi, eax
call fcn.00403c80
lea ecx, [esp + 8]
push ecx
push 0x20006
push 0
push eax
push reloc.WS2_32.dll_accept
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42ca4f
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x42ca48
mov ecx, dword [esp + 0xc]
push ecx
call ebp
mov edx, dword [esp + 8]
push edx
call ebp
pop edi
pop ebp
add esp, 8
ret

Function at 0x42d5d0
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push esi
push edi
push 0
push 0x6031ac
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jbe 0x42d679
push ebx
push esi
call fcn.004edb78
add esp, 4
mov ebx, eax
push ebx
push esi
push 0
push 0x6031ac
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
or edi, 0xffffffff
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x42d668
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x602b08
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x42d668
mov ecx, dword [esp + 0xc]
movzx eax, word [ecx + 0xa]
movzx ecx, word [ecx + 8]
cmp eax, 5
jne 0x42d64e
test ecx, ecx
jle 0x42d668
xor edi, edi
jmp 0x42d668
cmp eax, 6
jne 0x42d660
xor edx, edx
cmp ecx, 2
setge dl
inc edx
mov edi, edx
jmp 0x42d668
cmp eax, 0xa
jne 0x42d668
lea edi, [eax - 7]
push ebx
call fcn.00591683
add esp, 4
pop ebx
mov eax, edi
cmp edi, 0xffffffff
jne 0x42d67e
mov eax, 4
pop edi
pop esi
add esp, 8
ret
Function at 0x435ff0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov dword [eax], 0
cmp dword [0x66c5f0], 0
push esi
je 0x436053
mov eax, dword [0x672720]
test eax, eax
je 0x436020
push eax
call dword [0x66c648]
add esp, 4
lea ebx, [esp + 0x10]
mov eax, 0x14
call fcn.004339c0
mov eax, dword [0x672720]
test eax, eax
je 0x436041
push eax
call dword [0x66c650]
add esp, 4
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x436062
lea eax, [esi + 7]
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 0x14
call dword [0x66c618]
add esp, 4
mov esi, eax
jmp 0x436045
cmp dword [0x66c5f4], 0
je 0x4360a6
mov eax, dword [0x66c6f8]
test eax, eax
je 0x436082
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x4360a6
lea ecx, [esi + 4]
push ecx
push 0
push esi
push 0x435fc0
push 0
push 0
mov dword [esi + 8], ebp
mov dword [esi + 0xc], edi
call fcn.0059d6a6
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x4360b6
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x4360ce
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call ebp
add esp, 4
mov dword [esi + 0x10], eax
mov edx, dword [esp + 0x18]
mov dword [edx], esi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x464180
Capabilities:
Parse credit card information

Disassembly:
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov edi, dword [esp + 0x14]
test ecx, ecx
je 0x464202
mov esi, dword [ecx + 4]
movzx edx, byte [ecx]
test esi, 0x200
jne 0x464202
cmp edx, 0x25
je 0x46428a
cmp edx, 0x9c
je 0x46428a
cmp edx, 0x5e
je 0x4641c4
cmp edx, 0x9d
jne 0x464209
cmp byte [ecx + 0x26], 0x5e
jne 0x46421e
mov eax, dword [edi]
movzx eax, byte [eax + 0x42]
mov edx, dword [ecx + 8]
push edx
push eax
push edi
xor eax, eax
call fcn.00474a30
add esp, 0xc
mov ebp, eax
test ebp, ebp
je 0x464202
cmp dword [ebp + 0xc], 0
jne 0x464202
mov ecx, dword [edi]
mov eax, dword [ebp]
movzx ecx, byte [ecx + 0x42]
push eax
push ecx
push edi
mov eax, ebp
call fcn.00474a30
add esp, 0xc
test eax, eax
jne 0x464202
xor ebp, ebp
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
cmp edx, 0x9a
je 0x46421e
cmp edx, 0x98
je 0x46421e
cmp edx, 0x3d
jne 0x464223
cmp dword [ecx + 0x2c], ebp
jne 0x46429c
test esi, 0x100
je 0x464202
mov edx, dword [ecx + 0xc]
test edx, edx
je 0x46423f
test dword [edx + 4], 0x100
je 0x46423f
mov ecx, edx
jmp 0x46428d
mov ebx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x14]
test ecx, ecx
je 0x464282
test esi, 0x800
jne 0x464282
mov edi, dword [ecx]
xor edx, edx
test edi, edi
jle 0x464282
lea esi, [ecx + 8]
lea esp, [esp]
mov eax, dword [esi]
test dword [eax + 4], 0x100
jne 0x46427b
inc edx
add esi, 0x18
cmp edx, edi
jl 0x464260
mov edi, dword [esp + 0x14]
mov ecx, ebx
jmp 0x46428d
lea edx, [edx + edx*2]
mov ebx, dword [ecx + edx*8 + 8]
mov edi, dword [esp + 0x14]
mov ecx, ebx
jmp 0x46428d
mov ecx, dword [ecx + 0xc]
test ecx, ecx
jne 0x46418e
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret
movsx edx, word [ecx + 0x20]
test edx, edx
jl 0x464202
mov eax, dword [ecx + 0x2c]
mov ecx, dword [eax + 4]
mov eax, dword [edi]
shl edx, 4
mov edx, dword [ecx + edx + 8]
movzx ecx, byte [eax + 0x42]
push ecx
xor ecx, ecx
call fcn.00474bb0
add esp, 4
jmp 0x4641da
Function at 0x46e970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov ebx, eax
lea ebx, [ebx]
xor edi, edi
cmp dword [ebp + 0x14], edi
jle 0x46e9c9
cmp edi, 2
mov esi, edi
jge 0x46e991
xor esi, 1
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x46e9ad
mov edx, dword [ebp + 0x10]
mov eax, esi
shl eax, 4
mov eax, dword [eax + edx]
call fcn.00436b40
test eax, eax
jne 0x46e9c3
mov eax, dword [ebp + 0x10]
shl esi, 4
mov eax, dword [esi + eax + 0xc]
add eax, 8
call fcn.00438150
test eax, eax
jne 0x46ea07
inc edi
cmp edi, dword [ebp + 0x14]
jl 0x46e987
mov al, byte [ebx]
movzx edx, al
movzx edx, byte [edx + 0x5fc860]
sub edx, 0x73
mov ecx, ebx
jne 0x46ea05
mov edx, str.sqlite_master
sub edx, ebx
test al, al
je 0x46ea0c
mov al, byte [ecx + 1]
movzx esi, byte [edx + ecx + 1]
movzx esi, byte [esi + 0x5fc860]
inc ecx
movzx edi, al
movzx edi, byte [edi + 0x5fc860]
sub edi, esi
je 0x46e9e3
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x18]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x10]
test ecx, ecx
jne 0x46ea20
neg eax
sbb eax, eax
jmp 0x46ea29
test eax, eax
je 0x46ea05
call fcn.00436b40
test eax, eax
jne 0x46ea05
mov ebx, str.sqlite_temp_master
jmp 0x46e980
Function at 0x4a9500
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c4bd9
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x66a8c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x4a958c
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], 0x5d515c
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xc], 0x5d5154
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x14], 0x5d514c
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x1c], 0x5d5144
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x24], 0x5d513c
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x2c], 0x5d5134
mov ecx, dword [ebp - 0x14]
add ecx, 0x70
call fcn.00422ce0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
or eax, 1
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp - 0x14]
call fcn.004a9d00
mov dword [ebp - 4], 1
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.004a9d70
mov byte [ebp - 4], 2
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
call fcn.004a9dd0
mov byte [ebp - 4], 3
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x18
call fcn.004a9ed0
mov byte [ebp - 4], 4
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x20
call fcn.004aa050
mov byte [ebp - 4], 5
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x28
call fcn.004aa120
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x14]
mov dword [ecx], vtable.CefClientHandler.6.0
mov edx, dword [ebp - 0x14]
mov dword [edx + 8], vtable.CefClientHandler.5.0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x10], vtable.CefClientHandler.4.0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x18], vtable.CefClientHandler.3.0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x20], vtable.CefClientHandler.2.0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x28], vtable.CefClientHandler.1.0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + eax + 4], vtable.CefClientHandler.0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
mov ecx, dword [eax + 4]
sub ecx, 0x6c
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x14]
mov dword [eax + edx], ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x30
call fcn.004ab9d0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x14]
mov byte [ecx + 0x48], 0
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x4c], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x50
call fcn.00420b30
mov ecx, dword [ebp - 0x14]
add ecx, 0x54
call fcn.004a9ce0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ad150
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c54a8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x66a8c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
movzx eax, byte [ebp + 0x18]
push eax
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x10]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x24]
call dword [0x609664]
push 0
lea ecx, [ebp - 0x10]
call fcn.004ae290
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 0x14]
call fcn.004ae290
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x24]
add ecx, 0x4b8
call fcn.00587180
test eax, eax
je 0x4ad310
mov dword [ebp - 0x1c], 0
jmp 0x4ad1f0
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x24]
add ecx, 0x4b8
call fcn.00587180
add eax, 0x30
mov ecx, eax
call fcn.0040b090
cmp dword [ebp - 0x1c], eax
jae 0x4ad310
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x24]
add ecx, 0x4b8
call fcn.00587180
add eax, 0x30
mov ecx, eax
call fcn.004ae220
push eax
lea ecx, [ebp - 0x10]
call fcn.004ad340
lea ecx, [ebp - 0x10]
call fcn.00587180
test eax, eax
je 0x4ad30b
lea ecx, [ebp - 0x10]
call fcn.00587180
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x28]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x30]
push edx
lea ecx, [ebp - 0x14]
call fcn.004ad340
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.004ab740
lea ecx, [ebp - 0x14]
call fcn.00587180
test eax, eax
je 0x4ad30b
lea ecx, [ebp - 0x14]
call fcn.00587180
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x34]
mov eax, dword [edx + 0x10]
call eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4ad30b
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4ad30b
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [edx + 0x4bc]
je 0x4ad2dd
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4ad30b
push 5
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
mov eax, dword [ebp + 0x14]
sub eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x4ad1e7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004ab740
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004ab740
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4b1420
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c5b8b
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x174], ecx
mov byte [ebp - 0x154], 0
push 0x103
push 0
lea eax, [ebp - 0x153]
push eax
call fcn.00591690
add esp, 0xc
lea ecx, [ebp - 0x154]
push ecx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov ecx, 0x66e36c
call fcn.00403c80
push eax
lea edx, [ebp - 0x154]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x5d5bbc
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x5d5bc4
lea ecx, [ebp - 0x154]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [ebp - 0x154]
push edx
lea ecx, [ebp - 0x170]
call fcn.00404560
mov dword [ebp - 4], 0
push 1
lea eax, [ebp - 0x170]
push eax
push 0x66e110
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0041b9d0
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x170]
call fcn.00403d10
lea ecx, [ebp - 0x2c]
call fcn.00408810
movzx edx, al
test edx, edx
je 0x4b1532
push 0x64
mov ecx, dword [ebp - 0x174]
call dword [0x609694]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403d10
jmp 0x4b160d
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x4c]
push ecx
call fcn.005bfa30
add esp, 8
mov byte [ebp - 4], 3
push 0x10
push 0xc
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add eax, 0xf
and eax, 0xfffffff0
push eax
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add eax, 0xf
and eax, 0xfffffff0
push eax
push 1
lea ecx, [ebp - 0x4c]
call fcn.00401790
push eax
call dword [0x609690]
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
push edx
push 1
push 0x80
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x10
push 0xc
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add eax, 0xf
and eax, 0xfffffff0
push eax
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add eax, 0xf
and eax, 0xfffffff0
push eax
push 1
lea ecx, [ebp - 0x4c]
call fcn.00401790
push eax
call dword [0x609690]
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
push edx
push 0
push 0x80
mov eax, dword [ebp - 0x174]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4c]
call fcn.00401750
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403d10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret
Function at 0x4b5020
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c62b8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x66a8c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
push 0x5d6514
mov ecx, dword [ebp - 0x38]
add ecx, 0x30
call dword [0x609688]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4b50a5
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx + 0xec]
call eax
movzx ecx, al
test ecx, ecx
je 0x4b50a5
push 0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax + 0xf0]
call edx
push 0
push 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 4]
push ecx
push 0x4b1660
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x480]
add eax, 1
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x480], eax
mov edx, dword [ebp - 0x38]
cmp dword [edx + 0x480], 1
jne 0x4b50ff
push str..show
lea ecx, [ebp - 0x34]
call fcn.00404560
mov dword [ebp - 4], 0
lea eax, [ebp - 0x34]
push eax
call fcn.004cb890
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00403d10
call fcn.004cc8d0
call fcn.004cd6a0
mov dword [ebp - 0x14], 0
jmp 0x4b5111
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x38]
add ecx, 0xd74
call fcn.004b7bb0
cmp dword [ebp - 0x14], eax
jae 0x4b516a
mov edx, dword [ebp - 0x14]
push edx
mov ecx, dword [ebp - 0x38]
add ecx, 0xd74
call fcn.004b7bd0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.004b7cc0
test eax, eax
je 0x4b5168
mov ecx, dword [ebp - 0x18]
call fcn.004b7cc0
mov ecx, eax
call fcn.004a5a60
push 1
push 1
mov ecx, dword [ebp - 0x18]
call fcn.004b7cc0
mov ecx, eax
call dword [0x6096e8]
jmp 0x4b5108
movzx eax, byte [0x66e0bb]
test eax, eax
je 0x4b5190
push 0x53
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x4b51c3
movzx eax, byte [0x66e0c4]
test eax, eax
je 0x4b51b6
push 0x53
push 0
push 0
push 0
push 0
push 1
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x4b51c3
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
push 1
mov ecx, dword [ebp - 0x38]
call dword [0x6096e8]
call fcn.004cc9c0
movzx edx, byte [0x66e0d0]
test edx, edx
je 0x4b51f6
push 0
push 0x1f4
push 4
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4bb2e0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x66a8c4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00591690
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.00591690
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x418]
push edx
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.0059267b
add esp, 0x14
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00590c4b
mov esp, ebp
pop ebp
ret
Function at 0x4bc860
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [ebp + 8]
mov dword [0x66e0a8], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.004bbfe0
add esp, 4
mov dword [ebp - 4], eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4bcae0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp dword [eax], 0xb7
sete cl
mov eax, ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c1100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x1f4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret