joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460168
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4d4584]
cmp dword [eax + 0x30], 0
je 0x460212
cmp dword [ebx + 0x94], 0
jne 0x46020c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4600f8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46020c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4601d2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46020c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041a478
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4601e1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x460f2c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x460f61
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404b3c
jmp 0x460f6e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404aa0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4622f8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x462366
mov eax, esi
call fcn.0044c544
test al, al
je 0x462366
mov eax, dword [ebx + 0x84]
call fcn.0044c1a4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x462366
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x46235a
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044c1a4
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00444558
jmp 0x462366
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00462134
pop esi
pop ebx
ret

Function at 0x463e80
Capabilities:
Get system information on windows

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, edx
push esp
call sub.kernel32.dll_GetSystemInfo
dec ebx
je 0x463e97
dec ebx
je 0x463e9d
dec ebx
je 0x463ea4
jmp 0x463eab
movzx eax, word [esp]
jmp 0x463ead
movzx eax, word [esp + 0x20]
jmp 0x463ead
movzx eax, word [esp + 0x22]
jmp 0x463ead
xor eax, eax
add esp, 0x24
pop ebx
ret

Function at 0x47ded4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x47df2e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0047dec4
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0047b950
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0047b4a8
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47df35
lea eax, [ebp - 4]
call fcn.00404a4c
ret
Function at 0x48cca0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x208], ecx
mov dword [ebp - 0x204], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48ce9d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.0048db60
mov eax, dword [ebp - 0x204]
lea edx, [esi + 1]
call fcn.0040d9dc
cmp al, 2
jne 0x48ccfe
dec esi
mov eax, ebx
call fcn.0048db74
test al, al
je 0x48ce08
test esi, esi
jge 0x48cd13
xor esi, esi
lea edi, [esi + 1]
lea edx, [ebp - 0x208]
mov eax, ebx
call fcn.0048db60
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x48cd3e
sub eax, 4
mov eax, dword [eax]
cmp edi, eax
jge 0x48cd69
lea edx, [ebp - 0x210]
mov eax, ebx
call fcn.0048db60
mov eax, dword [ebp - 0x210]
movzx eax, byte [eax + edi - 1]
mov edx, dword [0x4d00d4]
movzx eax, al
bt dword [edx], eax
jae 0x48cd69
inc edi
mov eax, dword [ebx + 0x300]
cmp esi, eax
jl 0x48cd77
mov esi, eax
mov edi, esi
mov ecx, edi
mov edx, edi
mov eax, ebx
call fcn.0048cfb8
cmp edi, esi
je 0x48ce00
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
push esi
lea esi, [ebp - 0x100]
lea edi, [ebp - 0x200]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
pop esi
mov byte [ebp - 0x1f0], 0x81
mov byte [ebp - 0x1db], 0x81
mov byte [ebp - 0x1ef], 0
lea eax, [ebp - 0x200]
push eax
call sub.user32.dll_SetKeyboardState
push 1
push 0x25
push 0x100
mov eax, ebx
call fcn.0044c1a4
push eax
call sub.user32.dll_SendMessageA
push 1
push 0x25
push 0x101
mov eax, ebx
call fcn.0044c1a4
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_SetKeyboardState
mov dword [ebx + 0x2f4], esi
jmp 0x48ce6f
test esi, esi
jge 0x48ce0e
xor esi, esi
lea edx, [ebp - 0x214]
mov eax, ebx
call fcn.0048db60
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x48ce36
sub eax, 4
mov eax, dword [eax]
cmp eax, esi
jg 0x48ce64
lea edx, [ebp - 0x218]
mov eax, ebx
call fcn.0048db60
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x48ce62
sub eax, 4
mov eax, dword [eax]
mov esi, eax
mov ecx, esi
mov edx, esi
mov eax, ebx
call fcn.0048cfb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48cea4
lea eax, [ebp - 0x218]
mov edx, 3
call fcn.00404a70
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.00404a70
ret
Function at 0x494ea8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
push 0x494f24
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x494f15
xor edx, edx
push ebp
push 0x494f0e
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x494f34
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
test eax, eax
je 0x494ef1
push ebx
call eax
mov byte [ebp - 1], 1
jmp 0x494ef7
push ebx
call sub.kernel32.dll_GetSystemInfo
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494f1b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
push ebx
call sub.kernel32.dll_GetSystemInfo
movzx eax, byte [ebp - 1]
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x494f6c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49512c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x24
call fcn.004033b4
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x14]
mov dword [0x4cefdc], eax
mov eax, dword [ebp - 0xc]
mov dword [0x4cefe0], eax
mov eax, dword [ebp - 0x24]
mov dword [0x4cefe4], eax
mov eax, dword [0x4d00e4]
cmp dword [eax], 2
sete byte [0x4cebac]
push 0x495138
call sub.kernel32.dll_GetModuleHandleA_2
lea edx, [ebp - 4]
call fcn.00495338
cmp byte [0x4cebac], 0
jne 0x494ff8
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.00495368
test al, al
je 0x494ff8
mov eax, dword [ebp - 0x4c]
mov dword [0x4d5b00], eax
jmp 0x494fff
xor eax, eax
mov dword [0x4d5b00], eax
call fcn.00494cbc
and eax, 0x7f
cmp eax, 0x10
ja case.0x495010.0
jmp dword [eax*4 + 0x495017]
mov byte [0x4ceb98], 1
jmp case.0x495010.0
mov byte [0x4ceb9c], 1
jmp case.0x495010.0
mov byte [0x4ceba0], 1
jmp case.0x495010.0
mov byte [0x4ceba4], 1
jmp case.0x495010.0
mov byte [0x4ceba8], 1
jmp case.0x495010.0
mov byte [0x4cebb0], 1
mov byte [0x4cebb4], 1
jmp case.0x495010.0
mov byte [0x4cebb0], 1
mov byte [0x4cebb8], 1
jmp case.0x495010.0
mov byte [0x4cebb0], 1
mov byte [0x4cebb8], 1
mov byte [0x4cebbc], 1
jmp case.0x495010.0
mov byte [0x4cebc0], 1
jmp case.0x495010.0
mov byte [0x4cebc4], 1
jmp case.0x495010.0
mov byte [0x4cebc8], 1
jmp case.0x495010.0
mov byte [0x4cebcc], 1
jmp case.0x495010.0
mov byte [0x4cebd0], 1
jmp case.0x495010.0
mov byte [0x4cebd4], 1
jmp case.0x495010.0
mov byte [0x4cebd8], 1
jmp case.0x495010.0
mov byte [0x4cebdc], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495133
lea eax, [ebp - 4]
call fcn.00404a4c
ret
Function at 0x495368
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x49540f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.00404f10
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jbe 0x4953f9
lea eax, [ebp - 4]
mov edx, edi
call fcn.00405198
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.00404f10
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4953f9
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x495420
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4953f9
cmp dword [ebp - 0xc], 0x34
jne 0x4953f9
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495416
lea eax, [ebp - 4]
call fcn.00404a4c
ret

Function at 0x496f1c
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
push 1
push 0
push 0
push ebx
push 0x496f3c
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
seta al
pop ebx
ret
Function at 0x49c638
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov dl, 1
mov eax, dword [0x428544]
call fcn.0042e9f4
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x49c80b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 0x54]
cmp dword [eax + 8], 0
jle 0x49c7ea
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0042fdf0
mov eax, dword [ebp - 8]
call fcn.0042efc8
mov eax, dword [eax + 0x14]
mov edx, esi
call fcn.00429ee8
cmp byte [ebp + 8], 0
je 0x49c6d2
xor edx, edx
mov eax, ebx
call fcn.0049b59c
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor edx, edx
mov eax, ebx
call fcn.0049b59c
mov edx, dword [eax]
call dword [edx + 0x20]
mov esi, eax
mov eax, ebx
call fcn.0049b4cc
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
jmp 0x49c70e
xor edx, edx
mov eax, ebx
call fcn.0049b59c
mov edx, dword [eax]
call dword [edx + 0x2c]
mov esi, eax
mov eax, ebx
call fcn.0049b4cc
imul esi, eax
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor edx, edx
mov eax, ebx
call fcn.0049b59c
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.00418db8
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
call fcn.0042efc8
pop edx
call fcn.0042a2e4
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.0049b4cc
dec eax
test eax, eax
jl 0x49c7c2
inc eax
mov dword [ebp - 0x10], eax
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0049b470
push 0
lea eax, [ebp - 0x20]
push eax
mov edx, esi
mov eax, ebx
call fcn.0049b5c8
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x20]
imul esi
movzx edx, byte [ebp + 8]
imul edx
push eax
mov edx, esi
mov eax, ebx
call fcn.0049b5c8
mov eax, dword [eax + 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
imul esi
movzx edx, byte [ebp + 8]
xor dl, 1
and edx, 0x7f
imul edx
xor ecx, ecx
pop edx
call fcn.00418d90
mov eax, dword [ebp - 8]
call fcn.0042efc8
mov edx, eax
lea ecx, [ebp - 0x20]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
inc esi
dec dword [ebp - 0x10]
jne 0x49c758
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0049b470
cmp byte [ebp + 0xc], 0
je 0x49c7ea
movzx eax, word [ebx + 0x58]
cmp eax, 0x10
jg 0x49c7e0
mov eax, 0x10
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0049ac5c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c812
mov eax, dword [ebp - 8]
call fcn.00403af0
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00405630
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00405630
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00405630
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00405630
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00405630
mov dword [0x41203c], eax
call fcn.00405630
test eax, eax
jge 0x402550
push 8
call fcn.00405630
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00405630
pop ecx
push 1
call fcn.00405630
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00405630
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00405630
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00405630
jmp 0x402495

Function at 0x405630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40563f
pop dword [ebp - 0x30]
mov eax, 0x40563f
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x35b0e
push 0
mov eax, 0x1751d5b7
sub eax, 0x1710f4df
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x1c1ebe7e
sub ecx, 0x1c1e848e
xor edx, edx
add edx, eax
mov edi, 0xd499a68e
sub edi, 0xd4586aca
add edi, dword [ebp - 0x30]
mov esi, 0xcd39156
add esi, 0xa24eef20
add dword [ebp - 4], 0x97259105
mov ebx, dword [edi]
xor dword [ebp - 0x14], eax
xor ebx, esi
xor dword [ebp - 0x2c], 0x2240f2c4
mov dword [edx], ebx
add dword [ebp - 0x18], 0xee49b049
add edx, 0x2adfab5a
sub edx, 0x2adfab56
add edi, 0x114504b9
sub edi, 0x114504b5
loop 0x40569b
add eax, 0xda93
mov ebx, eax
add eax, 0x68f381a8
add eax, 0x970c7e5d
mov ecx, 0x862de38c
sub ecx, 0x85ede38c
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x46311b]
shl eax, 2
mov dword [0x46311f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00459550
pop edx
call fcn.004588ec
call fcn.00459554
push 0
call fcn.0045a36c
pop ecx
push 0x4630c4
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x463123], eax
push 0
jmp fcn.004602b0

Function at 0x401b54
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00459798
pop ecx
mov esi, eax
inc esi
push dword [0x46328c]
call sub.USER32.DLL_OpenClipboard
test eax, eax
je 0x401b67
push esi
push 0x102
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test eax, eax
je 0x401bb0
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov esi, eax
test eax, eax
je 0x401b87
push edi
push esi
call fcn.00459768
add esp, 8
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
call sub.USER32.DLL_EmptyClipboard
push ebx
push 1
call sub.USER32.DLL_SetClipboardData
call sub.USER32.DLL_CloseClipboard
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4584e2
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov esi, 0x46c878
lea edi, [ebp - 0x2c]
push 0
push dword [0x46eeb0]
push 0
push dword [0x46328c]
push 0
push 0
push 0
push 0
push 1
push 0
push str.tooltips_class32
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [esi], eax
cmp dword [esi], 0
je 0x4585f2
mov eax, dword [ebp + 8]
mov dword [0x46c87c], eax
push 0
push 1
push 0x401
push dword [esi]
call sub.USER32.DLL_SendMessageA
push 0xc350
push 2
push 0x403
push dword [esi]
call sub.USER32.DLL_SendMessageA
push 0xa
push 1
push 0x403
push dword [esi]
call sub.USER32.DLL_SendMessageA
push 0xa
push 3
push 0x403
push dword [esi]
call sub.USER32.DLL_SendMessageA
mov dword [edi], 0x2c
mov dword [edi + 4], 1
mov edx, dword [0x46328c]
mov dword [edi + 8], edx
mov ecx, dword [0x46eeb0]
mov dword [edi + 0x20], ecx
xor ebx, ebx
jmp 0x4585cb
movzx eax, bx
movzx edx, word [eax*2 + 0x4632cc]
push edx
push dword [0x46328c]
call sub.USER32.DLL_GetDlgItem
mov dword [edi + 0xc], eax
movzx ecx, bx
mov eax, dword [ecx*4 + 0x4632d8]
mov dword [edi + 0x24], eax
push edi
push 0
push 0x404
push dword [esi]
call sub.USER32.DLL_SendMessageA
inc ebx
movzx edx, bx
cmp word [edx*2 + 0x4632cc], 0
jne 0x458594
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
push 0x458428
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x46f5bc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x459244
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x45a5d4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x45a5f0
call fcn.0045b834
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x45a60b
test bl, 1
je 0x45a60b
mov dword [0x46e248], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x45a7b8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x45a7d7
mov eax, dword [0x46d378]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x45a7e4
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x45a811
je 0x45a823
sub ecx, 0x100
je 0x45a831
sub ecx, 0x100
je 0x45a838
sub ecx, 0x100
je 0x45a82a
jmp 0x45a83f
sub ecx, 0x600
je 0x45a838
sub ecx, 0x100
je 0x45a823
jmp 0x45a83f
mov edi, 1
jmp 0x45a844
mov edi, 2
jmp 0x45a844
mov edi, 4
jmp 0x45a844
mov edi, 5
jmp 0x45a844
mov edi, 3
test byte [ebp + 0xd], 1
je 0x45a86b
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x46cdf0]
test al, 0x80
je 0x45a864
mov ebx, 0x80
jmp 0x45a87d
mov ebx, 1
jmp 0x45a87d
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x45a87d
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x45a88f
je 0x45a898
dec eax
je 0x45a8a1
jmp 0x45a8aa
mov dword [ebp - 4], 0x80000000
jmp 0x45a8b9
mov dword [ebp - 4], 0x40000000
jmp 0x45a8b9
mov dword [ebp - 4], 0xc0000000
jmp 0x45a8b9
push 1
call fcn.0045b7d0
pop ecx
mov ebx, eax
jmp 0x45a9a5
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x45a8d5
sub eax, 0x10
je 0x45a8dc
sub eax, 0x10
je 0x45a8e5
sub eax, 0x10
je 0x45a8ee
jmp 0x45a8ee
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x45a8f5
mov dword [ebp - 8], 1
jmp 0x45a8f5
mov dword [ebp - 8], 2
jmp 0x45a8f5
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x45a95e
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x45a953
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x45a953
add ebx, 0xffffffb2
push ebx
call fcn.0045b7d0
pop ecx
mov ebx, eax
jmp 0x45a9a5
mov edi, esi
push edi
call fcn.0045a728
pop ecx
test eax, eax
je 0x45a972
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x45a97e
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0045b514
add esp, 8
mov ebx, eax
inc eax
jne 0x45a9a5
push 4
call fcn.0045b7d0
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f2e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x45f342
call fcn.0045f290
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00459798
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00459798
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x45f3a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x46e250], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x45f47a
cmp dword [0x46e24c], 0
jne 0x45f47a
cmp dword [0x46e440], 0
je 0x45f434
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0045f190
add esp, 8
mov ebx, eax
test eax, eax
jne 0x45f41a
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0045f190
add esp, 8
mov ebx, eax
test eax, eax
jne 0x45f41a
lea ebx, [ebp - 0x84]
jmp 0x45f41b
inc ebx
call fcn.0045f35c
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x45f4b5
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x46e254
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00459798
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x46e257
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x45f4b5
cmp dword [0x46e24c], 0
je 0x45f494
cmp dword [0x46e24c], 0xffffffff
je 0x45f4b5
push esi
call dword [0x46e24c]
pop ecx
mov eax, dword [0x46e250]
test eax, eax
je 0x45f4b5
cmp dword [0x46e250], 0xffffffff
je 0x45f4b5
cmp byte [eax], 0
je 0x45f4b5
push esi
push eax
call fcn.0045f2e0
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret