joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b6f20
Capabilities:
Create service
Persist via windows service

Disassembly:
sub esp, 0x41c
push ebx
push ebp
push esi
push edi
call fcn.004b6c20
push str.install_service..._n
mov dword [esp + 0x14], 0x1e
call fcn.0048dc10
add esp, 4
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x4b7055
mov ebx, dword [esp + 0x434]
mov ebp, dword [esp + 0x430]
jmp 0x4b6f70
lea eax, [esp + 0x14]
push eax
call fcn.0051ec40
push ebx
push ebp
lea ecx, [esp + 0x1c]
push ecx
xor esi, esi
call fcn.004b6a40
lea edx, [esp + 0x228]
push edx
call fcn.004b6b20
mov eax, dword [esp + 0x1c]
push esi
push esi
push esi
push esi
push esi
push eax
push esi
push 2
push 0x10
push 2
lea ecx, [esp + 0x250]
push ecx
mov edx, ecx
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
test eax, eax
je 0x4b6fca
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.004b6d50
jmp 0x4b701a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x4b6fde
call fcn.004b6d50
jmp 0x4b701a
cmp dword [esp + 0x10], 0
je 0x4b6ffe
cmp eax, 0x430
jne 0x4b6ffe
sub dword [esp + 0x10], 1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4b701f
push eax
mov eax, dword [0x581de4]
mov ecx, dword [eax + 0x1040]
mov edx, dword [eax]
push ecx
push edx
push 0x10
push 0
call fcn.004a78c0
add esp, 0x14
mov esi, 1
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [esp + 0x14]
push eax
call fcn.00522920
test esi, esi
jne 0x4b7077
push str.install_service..._n
call fcn.0048dc10
add esp, 4
push 2
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
jne 0x4b6f70
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x581de4]
mov ecx, dword [eax + 0x1044]
mov edx, dword [eax]
push ecx
push edx
push 0x10
push 0
call fcn.004a78c0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret 8
Function at 0x4b7ac0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, dword [edi + 0x50]
xor ebx, ebx
cmp esi, ebx
je 0x4b7b11
push ebp
cmp dword [esi + 0xc], ebx
mov ebp, dword [esi]
je 0x4b7b4b
cmp dword [edi + 0x58], ebx
je 0x4b7b17
mov edx, dword [edi + 0x30]
push ebx
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 0x1c]
push ecx
push edx
mov dword [edi + 0x58], ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x4b7b3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e4
je 0x4b7b8f
mov dword [edi + 0x38], 1
pop ebp
pop edi
pop esi
pop ebx
ret 4
lea eax, [edi + 0x1c]
push eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [edi + 0x30]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4b7b75
mov eax, dword [esp + 0x14]
add dword [esi + 8], eax
sub dword [esi + 0xc], eax
cmp dword [esi + 0xc], ebx
jne 0x4b7ad8
mov edx, dword [esi + 4]
push edx
call fcn.004a23a0
push esi
call fcn.004a23a0
cmp ebp, ebx
mov dword [edi + 0x50], ebp
jne 0x4b7b64
mov dword [edi + 0x54], ebx
cmp ebp, ebx
mov esi, ebp
jne 0x4b7ad1
pop ebp
pop edi
pop esi
pop ebx
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4b7b09
push str.write_pending..._n
call fcn.0048dc10
add esp, 4
pop ebp
mov dword [edi + 0x58], 1
pop edi
pop esi
pop ebx
ret 4
Function at 0x4b8da0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push edi
xor edi, edi
cmp dword [esi + 0x3c], edi
je 0x4b8e3d
mov ebx, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x4b8dc0
cmp dword [esi + 0x4c], edi
je 0x4b8dec
mov edx, dword [esi + 0x30]
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + 8]
push ecx
push edx
mov dword [esi + 0x4c], edi
call ebx
test eax, eax
jne 0x4b8e2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e4
jmp 0x4b8eb9
mov edx, dword [esi + 0x3c]
lea eax, [esi + 8]
push eax
mov eax, dword [esi + 0x40]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0x30]
push edx
push eax
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
call ebp
test eax, eax
je 0x4b8eae
mov edx, dword [esp + 0xc]
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x3c]
sub ecx, dword [esi + 0x44]
push edx
push eax
push ecx
push str.read_total:_p__remaining:__u__numread:__u_n
call fcn.0048dc10
add esp, 0x10
mov eax, dword [esp + 0xc]
add dword [esi + 0x40], eax
sub dword [esi + 0x3c], eax
cmp dword [esi + 0x3c], edi
jne 0x4b8dc0
cmp dword [esi + 0x48], edi
je 0x4b8e72
mov eax, esi
call fcn.004b80f0
mov eax, dword [esi + 0x44]
cmp eax, edi
je 0x4b8e56
push eax
call fcn.004a23a0
push 4
call fcn.004a2340
mov dword [esi + 0x48], edi
pop edi
pop ebp
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], 4
pop ebx
pop ecx
ret
mov eax, dword [esi + 0x44]
mov edi, dword [eax]
lea edx, [edi - 8]
cmp edx, 0x7ffff8
ja 0x4b8ec7
push eax
call fcn.004a23a0
push edi
call fcn.004a2340
mov dword [esi + 0x44], eax
mov dword [eax], edi
mov eax, dword [esi + 0x44]
add eax, 4
add edi, 0xfffffffc
mov dword [esi + 0x3c], edi
pop edi
pop ebp
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], 1
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4b8ec7
pop edi
pop ebp
mov dword [esi + 0x4c], 1
pop ebx
pop ecx
ret
pop edi
pop ebp
mov dword [esi + 0x38], 1
pop ebx
pop ecx
ret
Function at 0x4bf850
Capabilities:
Open clipboard

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.004ea470
test eax, eax
jne 0x4bf86d
cmp dword [esi + 0x33c], eax
je 0x4bf876
push esi
call fcn.004e9e30
mov eax, 1
pop esi
ret 4
call dword [sym.imp.USER32.dll_GetCapture]
push eax
mov eax, dword [esi + 0x60]
push eax
call fcn.004aa540
test eax, eax
je 0x4bf899
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, 1
pop esi
ret 4
cmp dword [esi + 0x2cc], 0
je 0x4bf8c5
mov ecx, dword [esi + 0x60]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4bf8bc
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 1
pop esi
ret 4
push esi
call fcn.0050cde0
test eax, eax
jne 0x4bf86d
cmp dword [esi + 0x2c4], eax
je 0x4bf9fa
push ebx
push ebp
push edi
push esi
call fcn.004bf450
xor edx, edx
mov ebp, eax
mov eax, dword [esi + 0x2c4]
test eax, eax
setne dl
test eax, eax
mov edi, edx
je 0x4bf901
mov ebx, dword [esi + 0x2c0]
jmp 0x4bf90c
mov eax, dword [esi + 0x60]
push eax
call fcn.004aad80
mov ebx, eax
mov ecx, dword [esi + 0x60]
push ecx
call fcn.004aadd0
neg eax
sbb eax, eax
neg eax
test edi, edi
jne 0x4bf94f
xor edx, edx
test ebx, ebx
setne dl
xor ecx, ecx
test ebp, ebp
setne cl
cmp edx, ecx
jne 0x4bf94f
test eax, eax
je 0x4bf9ee
mov edx, dword [esi + 0x60]
push 9
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [edi + 1]
pop edi
pop ebp
pop ebx
pop esi
ret 4
mov eax, dword [esi + 0x60]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 1
push eax
call ebx
xor eax, eax
cmp dword [esi + 0x2c4], eax
je 0x4bf9c2
mov ecx, dword [esi + 0x58]
mov edx, dword [esi + 0x60]
push ecx
push edx
lea edi, [esi + 0x2b0]
mov dword [esi + 0x2c4], eax
call dword [sym.imp.USER32.dll_SetMenu]
mov eax, dword [esi + 0x60]
push eax
call fcn.004a9e20
mov ecx, dword [esi + 0x60]
or eax, 0xc40000
push eax
push 0xfffffffffffffff0
push ecx
call dword [0x58b060]
test edi, edi
mov eax, 0x20
je 0x4bf9c2
mov eax, dword [edi + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [edi]
push 0x34
sub edx, eax
push edx
mov edx, dword [edi + 8]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 0x60]
push ecx
push 0
push eax
jmp 0x4bf9d4
mov ecx, dword [esi + 0x60]
or eax, 0x17
push eax
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
test ebp, ebp
je 0x4bf9e6
mov edx, dword [esi + 0x60]
push 3
push edx
call ebx
mov eax, dword [esi + 0x60]
push 5
push eax
call ebx
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret 4
xor eax, eax
pop esi
ret 4
Function at 0x4c7260
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 0x214
cmp byte [0x58b3b8], 0
push ebx
push esi
push edi
jne 0x4c7345
cmp dword [0x58b3bc], 5
jae 0x4c7345
lea eax, [esp + 0xc]
push eax
call fcn.0051ec40
mov edi, dword [esp + 0x228]
mov esi, dword [esp + 0x224]
push edi
push esi
xor ebx, ebx
call fcn.004c07b0
mov dword [esp + 0xc], eax
add eax, 1
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.00522940
mov ebx, dword [esp + 0x14]
push edi
push esi
call fcn.004c07b0
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
push edx
push eax
call fcn.00401000
add eax, 1
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4c7339
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
push ecx
push edx
push eax
call fcn.004010e0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esi + 0x60]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4c7332
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0xc]
push ecx
call fcn.00522920
jmp 0x4c73b4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0xc]
push ecx
call fcn.00522920
jmp 0x4c73b4
mov esi, dword [esp + 0x224]
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push esi
xor ebx, ebx
call fcn.004c07b0
lea edx, [eax + eax + 2]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4c73b3
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebp
push esi
mov ebx, eax
call fcn.004c07b0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esi + 0x60]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4c73ac
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x4c73b3
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebp
mov ecx, dword [esi + 0x17c]
push ecx
call fcn.004b4da0
push esi
call fcn.004c6e50
pop edi
pop esi
pop ebx
add esp, 0x214
ret 8

Function at 0x4c7710
Capabilities:
Hide graphical window

Disassembly:
push esi
push str.ui_close_n
call fcn.0048dc10
mov esi, dword [esp + 0xc]
add esp, 4
call fcn.004c3b70
mov eax, dword [esi + 0x60]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x58b134], 0
jne 0x4c7768
cmp dword [esi + 0x438], 0
jne 0x4c7768
mov eax, esi
mov dword [esi + 0x438], 1
call fcn.004bf3c0
mov ecx, dword [0x58b514]
mov dword [esi + 0x124], ecx
mov dword [0x58b514], esi
cmp byte [0x57e60c], 0
pop esi
jne 0x4c7783
cmp dword [0x58b528], 0
jne 0x4c7783
call fcn.004bc1f0
ret 4
call fcn.004b3c70
mov dword [esp + 4], 0
jmp fcn.00409400
Function at 0x4c8460
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
cmp byte [0x57e663], 0
je 0x4c8593
push esi
mov esi, dword [esp + 8]
push esi
call fcn.0050c3d0
test eax, eax
je 0x4c8583
mov eax, dword [esi + 0x17c]
push eax
call fcn.004b4da0
push esi
call fcn.004c6e50
mov ecx, dword [esi + 0x2d0]
push ecx
push str.CUT_isviewing__d_n
push 0xffffffffffffffff
call fcn.0048dc30
add esp, 0xc
cmp dword [esi + 0x2d0], 0
je 0x4c84cc
mov edx, dword [esi + 0x2d4]
mov eax, dword [esi + 0x60]
push edx
push eax
call dword [sym.imp.USER32.dll_ChangeClipboardChain]
mov dword [esi + 0x2d0], 0
mov ecx, dword [esi + 0x60]
push edi
push ecx
xor edi, edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4c851a
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
call fcn.004bec00
test eax, eax
je 0x4c8514
mov edi, dword [sym.imp.USER32.dll_SetClipboardData]
push eax
push 0xf
call edi
push 2
call fcn.004bebb0
test eax, eax
je 0x4c850f
push eax
call fcn.004bf160
movzx edx, ax
push edx
call edi
mov edi, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
push edi
push str.iscut__d_n
push 0xffffffffffffffff
call fcn.0048dc30
add esp, 0xc
test edi, edi
je 0x4c857c
push str.ghost_selection_n
push 0xffffffffffffffff
call fcn.0048dc30
add esp, 8
push esi
call fcn.004ec4f0
mov eax, dword [esi + 0x2d0]
push eax
push str.viewing__d_n
push 0xffffffffffffffff
call fcn.0048dc30
add esp, 0xc
cmp dword [esi + 0x2d0], 0
jne 0x4c857c
mov ecx, dword [esi + 0x60]
push ecx
call dword [sym.imp.USER32.dll_SetClipboardViewer]
mov dword [esi + 0x2d4], eax
mov dword [esi + 0x2d0], 1
mov dword [esi + 0x2cc], edi
pop edi
push str.is_cut_done_n
push 0xffffffffffffffff
call fcn.0048dc30
add esp, 8
pop esi
ret 4
Function at 0x4d08d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x110
push ebx
push edi
push esi
mov dword [esi + 4], 0xff
mov dword [esi + 0x10], 1
mov dword [esi], 0
mov dword [esi + 8], 0
push 0x4d07e0
mov dword [esi + 0x6c], 0
call fcn.004af1a0
mov dword [esi + 0x68], eax
lea eax, [esp + 8]
push eax
call fcn.0051ec40
mov eax, dword [0x581de4]
mov ecx, dword [eax]
mov edx, dword [eax + 0x14]
push ecx
push edx
lea eax, [esp + 0x10]
push eax
call fcn.0051fa10
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x58]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push ecx
push 0x2711
push edx
call edi
push eax
call fcn.004a79e0
lea eax, [esp + 8]
push eax
call fcn.00522920
mov ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
mov eax, dword [esi + 0x2c]
push ecx
mov ecx, dword [esi + 0x28]
push edx
mov edx, dword [esi + 0x58]
push eax
push ecx
push 0x2711
push edx
call fcn.004a7a60
mov eax, dword [esi + 0x58]
push 0
push 0x2712
push eax
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov ecx, dword [esi + 0x58]
push 0
push 0x2713
push ecx
call edi
push eax
call ebx
mov edx, dword [esi + 0x58]
push 0
push 0x2714
push edx
call edi
push eax
call ebx
mov eax, dword [esi + 0x58]
push 0
push 0x2715
push eax
call edi
push eax
call ebx
mov ecx, dword [esi + 0x58]
push 0
push 0x2716
push ecx
call edi
push eax
call ebx
pop edi
pop ebx
add esp, 0x110
ret

Function at 0x4dac00
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov eax, dword [ebp + 4]
cmp eax, 0x100
push esi
je 0x4dac17
cmp eax, 0x104
jne 0x4dac38
mov esi, dword [0x58b530]
test esi, esi
je 0x4dac38
mov eax, dword [ebp]
mov ecx, dword [esi + 0xc]
push eax
push ecx
call fcn.004aa540
test eax, eax
jne 0x4dac3f
mov esi, dword [esi]
test esi, esi
jne 0x4dac21
pop esi
xor eax, eax
pop ebp
ret 4
mov edx, dword [esi + 0xc]
push 0x400
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp], eax
jne 0x4dac38
push ebx
push edi
call fcn.004b07b0
mov edi, dword [ebp + 8]
mov ebx, eax
lea eax, [edi - 8]
cmp eax, 0xdd
ja case.0x4dac70.10
movzx eax, byte [eax + 0x4dacc0]
jmp dword [eax*4 + 0x4dacb0]
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
ret 4
test ebx, ebx
jne case.0x4dac70.10
xor edi, edi
jmp case.0x4dac70.10
mov ecx, dword [ebp]
push ecx
call sub.IMM32.dll_ImmGetVirtualKey
mov edi, eax
mov edx, dword [ebp]
push edi
push ebx
push edx
call fcn.004b1030
mov dword [esi + 0x20], edi
pop edi
mov dword [esi + 0x1c], ebx
pop ebx
pop esi
mov eax, 1
pop ebp
ret 4
Function at 0x4e6da0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov eax, dword [ebp + 4]
cmp eax, 0x100
push esi
je 0x4e6db7
cmp eax, 0x104
jne 0x4e6dd8
mov esi, dword [0x58b540]
test esi, esi
je 0x4e6dd8
mov eax, dword [ebp]
mov ecx, dword [esi + 0xc]
push eax
push ecx
call fcn.004aa540
test eax, eax
jne 0x4e6ddf
mov esi, dword [esi]
test esi, esi
jne 0x4e6dc1
pop esi
xor eax, eax
pop ebp
ret 4
mov edx, dword [esi + 0xc]
push 0x3f0
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp], eax
jne 0x4e6dd8
push ebx
push edi
call fcn.004b07b0
mov edi, dword [ebp + 8]
mov ebx, eax
lea eax, [edi - 8]
cmp eax, 0xdd
ja case.0x4e6e10.10
movzx eax, byte [eax + 0x4e6e60]
jmp dword [eax*4 + 0x4e6e50]
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
ret 4
test ebx, ebx
jne case.0x4e6e10.10
xor edi, edi
jmp case.0x4e6e10.10
mov ecx, dword [ebp]
push ecx
call sub.IMM32.dll_ImmGetVirtualKey
mov edi, eax
mov edx, dword [ebp]
push edi
push ebx
push edx
call fcn.004b1030
mov dword [esi + 0x20], edi
pop edi
mov dword [esi + 0x1c], ebx
pop ebx
pop esi
mov eax, 1
pop ebp
ret 4
Function at 0x4f2720
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
push 2
push esi
call fcn.0050c6d0
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 0
mov ebp, 1
je 0x4f2789
cmp dword [esi + 0x34c], ebp
push esi
jne 0x4f2764
call fcn.004e9ea0
mov edi, eax
imul edi, dword [esi + 0x354]
jmp 0x4f276b
call fcn.004e9ea0
mov edi, eax
push edi
push esi
call fcn.004ea2c0
cmp ebx, edi
jl 0x4f277c
add eax, edi
cmp ebx, eax
jl 0x4f2785
cmp byte [0x58b0c0], 0
je 0x4f2789
mov dword [esp + 0x10], ebp
push esi
call fcn.004e9ea0
cmp dword [esi + 0x34c], ebp
mov dword [esp + 0x14], eax
jne 0x4f27a7
mov eax, dword [esi + 0x354]
mov dword [esp + 0x20], eax
jmp 0x4f27ab
mov dword [esp + 0x20], ebp
xor edi, edi
push edi
push esi
call fcn.004f0240
call dword [sym.imp.USER32.dll_GetCapture]
mov ecx, dword [esi + 0x60]
push eax
push ecx
call fcn.004aa540
test eax, eax
je 0x4f27ce
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ebx, dword [esp + 0x24]
cmp ebx, dword [esi + 0x34c]
mov ebp, dword [sym.imp.USER32.dll_InvalidateRect]
je 0x4f2830
mov edx, dword [esi + 0x2e0]
push 0
push 0
push edx
mov dword [esi + 0x34c], ebx
call ebp
test ebx, ebx
jne 0x4f280b
mov eax, dword [esi + 0x6c]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call fcn.004ea180
jmp 0x4f2817
mov ecx, dword [esi + 0x6c]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call fcn.004f0240
push esi
call fcn.004eb670
push esi
call fcn.004f1c00
mov edi, 1
cmp ebx, 1
jne 0x4f2867
mov eax, dword [esp + 0x28]
cmp eax, dword [esi + 0x350]
je 0x4f2861
mov dword [esi + 0x350], eax
call fcn.004ec5d0
push esi
call fcn.004f1c00
mov edx, dword [esi + 0x2e0]
push 0
push 0
push edx
call ebp
mov edi, ebx
push esi
call fcn.004eb670
test edi, edi
je 0x4f28b8
cmp ebx, 1
jne 0x4f2878
mov ecx, dword [esi + 0x354]
jmp 0x4f287d
mov ecx, 1
mov eax, dword [esp + 0x20]
cmp ecx, eax
je 0x4f28a4
imul dword [esp + 0x14]
push 1
mov edi, eax
push 1
mov ebx, edx
mov eax, ecx
cdq
push edx
push eax
push ebx
push edi
call fcn.005458e0
push eax
push esi
call fcn.004f2380
cmp dword [esp + 0x10], 0
je 0x4f28b8
mov eax, dword [esp + 0x18]
push 0
push eax
push esi
call fcn.004f2550
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x4f7740
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x330
push esi
lea eax, [esp + 0x114]
push eax
call fcn.0051ec40
lea ecx, [esp + 0x114]
push ecx
push 0x549824
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
xor esi, esi
call fcn.004ab900
test eax, eax
je 0x4f786d
lea edx, [esp + 4]
push edx
call fcn.0051ec40
lea eax, [esp + 0x224]
push eax
mov esi, 2
call fcn.0051ec40
push 0
lea ecx, [esp + 0x228]
push ecx
call fcn.004aaa50
mov edx, dword [esp + 0x22c]
push edx
lea eax, [esp + 8]
push str.__s___startup
push eax
call fcn.0051fa10
add esp, 0xc
call fcn.004a1a20
test eax, eax
je 0x4f77e0
call fcn.004a1a20
push eax
lea ecx, [esp + 8]
push str.__instance___s_
push ecx
call fcn.0051fb90
add esp, 0xc
mov eax, dword [0x58b3a4]
cmp dword [eax + 0x10], 0
je 0x4f7801
mov edx, dword [eax + 0x10]
push edx
lea eax, [esp + 8]
push str.__config___s_
push eax
call fcn.0051fb90
add esp, 0xc
lea ecx, [esp + 0x224]
push ecx
call fcn.00522920
mov edx, dword [esp + 0x11c]
push edx
push str.reg:__s_n
call fcn.0048dc10
mov eax, dword [esp + 0x14]
push eax
push str.set:__s_n
call fcn.0048dc10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x12c]
mov dl, byte [eax]
add esp, 0x10
cmp dl, byte [ecx]
jne 0x4f7854
test dl, dl
je 0x4f785e
mov dl, byte [eax + 1]
add eax, 1
add ecx, 1
cmp dl, byte [ecx]
je 0x4f7843
movzx ecx, byte [ecx]
movzx eax, byte [eax]
sub eax, ecx
jne 0x4f7863
mov esi, 1
lea edx, [esp + 4]
push edx
call fcn.00522920
lea eax, [esp + 0x114]
push eax
call fcn.00522920
mov eax, esi
pop esi
add esp, 0x330
ret
Function at 0x4fbe90
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x220
push 0x549824
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
call fcn.004b0f60
lea eax, [esp]
push eax
call fcn.0051ec40
lea ecx, [esp + 0x110]
push ecx
call fcn.0051ec40
push 0
lea edx, [esp + 0x114]
push edx
call fcn.004aaa50
mov eax, dword [esp + 0x118]
push eax
lea ecx, [esp + 4]
push str.__s___startup
push ecx
call fcn.0051fa10
add esp, 0xc
call fcn.004a1a20
test eax, eax
je 0x4fbf0a
call fcn.004a1a20
push eax
lea edx, [esp + 4]
push str.__instance___s_
push edx
call fcn.0051fb90
add esp, 0xc
mov eax, dword [0x58b3a4]
cmp dword [eax + 0x10], 0
je 0x4fbf2b
mov eax, dword [eax + 0x10]
push eax
lea ecx, [esp + 4]
push str.__config___s_
push ecx
call fcn.0051fb90
add esp, 0xc
lea edx, [esp + 0x110]
push edx
call fcn.00522920
mov eax, dword [esp + 8]
push eax
push 0x549824
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_bind
call fcn.004b0e90
lea ecx, [esp]
push ecx
call fcn.00522920
add esp, 0x220
ret
Function at 0x50e510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, dword [esp + 0x60]
push edi
mov edi, eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x34], ebp
cmp byte [edi], 0
je 0x50e61f
mov al, byte [edi]
cmp al, 0x25
jne 0x50e5e1
mov al, byte [edi + 1]
add edi, 1
cmp al, 0x25
jne 0x50e59b
cmp byte [esi], al
jne 0x50e624
add esi, 1
add edi, 1
jmp 0x50e616
cmp al, 0x30
jb 0x50e5d8
cmp al, 0x39
ja 0x50e5d8
movzx ebx, al
sub ebx, 0x30
add edi, 1
mov dword [esp + ebx*4 + 0x38], esi
cmp byte [esi], 0
je 0x50e5d0
mov eax, dword [esp + 0x68]
push eax
lea ecx, [esi + ebp]
mov eax, edi
call fcn.0050df90
test eax, eax
jne 0x50e5d0
add ebp, 1
cmp byte [esi + ebp], al
jne 0x50e5b5
mov dword [esp + ebx*4 + 0x10], ebp
add esi, ebp
jmp 0x50e614
test al, al
je 0x50e61f
add edi, 1
jmp 0x50e616
cmp dword [esp + 0x68], ebp
je 0x50e5f3
cmp byte [esi], al
jne 0x50e624
add esi, 1
add edi, 1
jmp 0x50e616
push esi
call fcn.0051e050
push edi
mov ebx, eax
call fcn.0051e050
mov ebp, eax
push ebp
push edi
push ebx
push esi
call fcn.00413e80
test eax, eax
jne 0x50e624
add esi, ebx
add edi, ebp
xor ebp, ebp
cmp byte [edi], 0
jne 0x50e578
cmp byte [esi], 0
je 0x50e63d
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x70]
push ecx
push edx
call fcn.0051f570
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10
mov eax, dword [esp + 0x6c]
push ebp
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x44]
push edx
push eax
call fcn.0050e040
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10