joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac469
Capabilities:
Get file version info

Disassembly:
push 0x14
mov eax, 0x4fafe3
call fcn.004e3337
mov dword [ebp - 0x1c], edx
mov esi, ecx
mov eax, dword [0x542750]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], eax
push ecx
push edx
mov dword [ebp - 4], ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x4ac505
push edi
call fcn.004d5f08
pop ecx
mov ebx, eax
push ebx
push edi
xor edi, edi
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x4ac505
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
push 0x50f2c8
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4ac505
cmp dword [ebp - 0x14], 0x34
jne 0x4ac505
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0x10]
push str._d._d._d._d
push eax
call fcn.0040301c
push ebx
call fcn.004d5e39
add esp, 0x1c
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.004028cd
lea ecx, [ebp - 0x10]
call fcn.00403030
mov eax, esi
call fcn.004e3305
ret

Function at 0x4ac63a
Capabilities:
Delete file
Read .ini file

Disassembly:
push 0x210
mov eax, 0x4fde89
call fcn.004e336a
lea ecx, [ebp - 0x21c]
call fcn.004acacf
xor esi, esi
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x21c]
call fcn.00404b29
test eax, eax
je 0x4ac6df
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
call fcn.004db6f0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [ebp - 0x21c]
lea edx, [ebp - 0x218]
call fcn.004ac407
cmp eax, 1
jne 0x4ac6d3
push dword [0x543e38]
push esi
push str.force
push str.updatesetup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x4ac6df
call fcn.004ac6f2
mov esi, eax
jmp 0x4ac6df
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x21c]
call fcn.00403030
mov eax, esi
call fcn.004e3319
ret

Function at 0x4ac6f2
Capabilities:
Create process on windows

Disassembly:
push 8
mov eax, 0x4fb5a4
call fcn.004e3337
lea ecx, [ebp - 0x10]
call fcn.004acacf
xor esi, esi
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x10]
call fcn.00404b29
test eax, eax
je 0x4ac742
push str._typeupdatesetup
lea ecx, [ebp - 0x14]
call fcn.00404e83
push 5
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x14]
call fcn.00403030
inc esi
lea ecx, [ebp - 0x10]
call fcn.00403030
mov eax, esi
call fcn.004e3305
ret
Function at 0x4ad3cb
Capabilities:
Delete file

Disassembly:
push 0x1c
mov eax, 0x4f80dc
call fcn.004e336a
mov ebx, ecx
mov esi, dword [ebp + 8]
test esi, esi
jne 0x4ad3e4
xor eax, eax
jmp 0x4ad451
cmp dword [esi], 0x3cbfbbef
jne 0x4ad3ef
add esi, 3
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4ad3e0
cmp byte [ebx], 0
je 0x4ad406
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp + 0xc], 0
je 0x4ad41e
xor edi, edi
lea ecx, [ebx + 0x104]
mov eax, dword [ecx]
push edi
push edi
push esi
call dword [eax + 8]
jmp 0x4ad44e
mov edx, esi
lea ecx, [ebp - 0x28]
call fcn.0040fc5f
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [eax + 0x14], 0x10
jb 0x4ad435
mov eax, dword [eax]
lea ecx, [ebx + 0x104]
mov edx, dword [ecx]
push edi
push edi
push eax
call dword [edx + 8]
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00406ae3
xor eax, eax
inc eax
call fcn.004e3319
ret 8
Function at 0x4ae22c
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push 0x9a0
mov eax, 0x500f6c
call fcn.004e336a
mov ebx, edx
mov esi, ecx
and dword [ebp - 0x9a0], 0
mov eax, dword [0x542750]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x9ac], esi
mov dword [ebp - 0x99c], eax
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4ae280
lea eax, [ebp - 0x99c]
mov ecx, esi
push eax
call fcn.004028cd
jmp 0x4ae483
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x62c], ax
lea eax, [ebp - 0x62a]
push eax
call fcn.004db6f0
add esp, 0xc
lea eax, [ebp - 0x62c]
push str.cfg.ini
push edi
push 0x520cd4
push eax
call fcn.00413df2
add esp, 0x10
lea ecx, [ebp - 0x62c]
call fcn.00404b29
test eax, eax
je 0x4ae3cf
xor eax, eax
mov dword [ebp - method.CIniFile.virtual_0], vtable.CIniFile.0
mov dword [ebp - 0x9a4], eax
lea ecx, [ebp - 0x9a8]
lea eax, [ebp - 0x62c]
push eax
call fcn.0043092d
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.004db6f0
add esp, 0xc
lea eax, [ebp - 0x21c]
push dword [ebp - 0x9a4]
push 0x104
push eax
push 0x50e6f0
push str.main
push 0x50f824
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x9a0]
jne 0x4ae33d
sub ecx, edx
sar ecx, 1
je 0x4ae3c0
mov eax, dword [0x542750]
mov dword [ebp - 0x998], eax
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 3
push eax
push edi
lea eax, [ebp - 0x998]
push 0x520cd4
push eax
call fcn.0040301c
mov ecx, dword [ebp - 0x998]
add esp, 0x10
call fcn.00404b29
test eax, eax
je 0x4ae3b5
lea eax, [ebp - 0x998]
mov ecx, esi
push eax
call fcn.004028cd
lea ecx, [ebp - 0x998]
call fcn.00403030
lea ecx, [ebp - 0x9a8]
call fcn.00430a58
jmp 0x4ae483
lea ecx, [ebp - 0x998]
call fcn.00403030
lea ecx, [ebp - 0x9a8]
mov byte [ebp - 4], 1
call fcn.00430a58
lea ecx, [ebp - 0x994]
call fcn.00410dfe
lea eax, [ebp - 0x994]
mov byte [ebp - 4], 4
push eax
push ebx
call fcn.004afbcf
test eax, eax
jne 0x4ae409
lea eax, [ebp - 0x99c]
mov ecx, esi
push eax
call fcn.004028cd
mov dword [ebp - 0x9a0], 1
jmp 0x4ae474
mov eax, dword [ebp - 0x964]
xor ecx, ecx
cmp dword [eax - 8], ecx
je 0x4ae3ef
mov ecx, dword [0x542750]
mov dword [ebp - 0x998], ecx
push eax
push edi
lea eax, [ebp - 0x998]
mov byte [ebp - 4], 5
push 0x520cd4
push eax
call fcn.0040301c
mov ecx, dword [ebp - 0x998]
add esp, 0x10
call fcn.00404b29
test eax, eax
mov ecx, esi
lea eax, [ebp - 0x998]
jne 0x4ae459
lea eax, [ebp - 0x99c]
push eax
call fcn.004028cd
lea ecx, [ebp - 0x998]
mov dword [ebp - 0x9a0], 1
call fcn.00403030
lea ecx, [ebp - 0x994]
mov byte [ebp - 4], 1
call fcn.0041057c
lea ecx, [ebp - 0x99c]
call fcn.00403030
mov eax, esi
call fcn.004e3319
ret
Function at 0x4ae496
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
push 0x484
mov eax, 0x500fb5
call fcn.004e336a
mov dword [ebp - 0x474], edx
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor eax, 0x10
jne 0x4ae6c3
push 0x206
xor ebx, ebx
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
mov dword [ebp - 0x478], ebx
push ebx
push eax
call fcn.004db6f0
lea edx, [ebp - 0x218]
add esp, 0xc
mov ecx, esi
sub edx, esi
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4ae4eb
lea ecx, [ebp - 0x218]
sub ecx, 2
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
cmp ax, bx
jne 0x4ae503
mov eax, dword [0x52ae5c]
mov dword [ecx], eax
mov ax, word [0x52ae60]
mov word [ecx + 4], ax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4ae6c3
test byte [ebp - 0x468], 0x10
je 0x4ae6a6
lea eax, [ebp - 0x43c]
push eax
push 0x51e9bc
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4ae6a6
lea eax, [ebp - 0x43c]
push eax
push 0x525d7c
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4ae6a6
lea eax, [ebp - 0x43c]
push eax
call fcn.004d61c7
pop ecx
mov ecx, dword [0x542750]
mov ebx, eax
mov dword [ebp - 0x46c], ecx
xor eax, eax
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x46c]
push 0x52573c
push eax
call fcn.0040301c
lea ecx, [ebp - 0x43c]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x478]
jne 0x4ae5be
mov eax, dword [ebp - 0x46c]
sub ecx, edx
sar ecx, 1
cmp dword [eax - 8], ecx
jne 0x4ae697
test ebx, ebx
jle 0x4ae697
lea eax, [ebp - 0x43c]
push eax
push esi
lea eax, [ebp - 0x218]
push 0x520cd4
push eax
call fcn.00413df2
lea eax, [ebp - 0x218]
mov edx, ebx
push eax
lea ecx, [ebp - 0x470]
call fcn.004ae22c
add esp, 0x14
mov eax, dword [ebp - 0x470]
xor ecx, ecx
cmp dword [eax - 8], ecx
je 0x4ae68c
mov eax, dword [0x542750]
mov dword [ebp - 0x480], eax
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x48c], ecx
mov dword [ebp - 0x488], ecx
mov dword [ebp - 0x490], ecx
lea eax, [ebp - 0x470]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x484], ebx
call fcn.00402a9f
mov ecx, dword [ebp - 0x474]
lea eax, [ebp - 0x490]
push eax
call fcn.0040cbd6
lea ecx, [ebp - 0x47c]
call fcn.00403030
lea ecx, [ebp - 0x480]
call fcn.00403030
lea ecx, [ebp - 0x470]
call fcn.00403030
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x46c]
call fcn.00403030
lea eax, [ebp - 0x468]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4ae53f
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.004e3319
ret
Function at 0x4af0b3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x10
call fcn.004d6a5a
pop ecx
mov ecx, eax
xor edx, edx
test ecx, ecx
je 0x4af0d2
mov edi, ecx
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jmp 0x4af0d4
mov ecx, edx
mov esi, dword [ebp + 8]
mov edi, ecx
push edx
push edx
push ecx
movsd dword es:[edi], dword [esi]
push 0x4b0d92
push edx
push edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
ret 4
Function at 0x4b0c66
Capabilities:
Create thread

Disassembly:
push 0x44
mov eax, 0x5014dd
call fcn.004e3337
mov ebx, ecx
mov esi, dword [ebx + 4]
sub esi, dword [ebx]
sar esi, 2
test esi, esi
jle 0x4b0d2e
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0x14], ecx
mov eax, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], ecx
test esi, esi
jle 0x4b0ce3
lea ecx, [ebp - 0x50]
call fcn.00427427
mov byte [ebp - 4], 1
mov ecx, edi
mov eax, dword [ebx]
push dword [eax + ecx*4]
call fcn.004b0acc
test eax, eax
jne 0x4b0ccc
mov eax, dword [ebx]
lea eax, [eax + edi*4]
cmp dword [eax], 0
jle 0x4b0ccc
push eax
lea ecx, [ebp - 0x1c]
call fcn.004048b9
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.00425822
inc edi
cmp edi, esi
jl 0x4b0c9d
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
sub eax, edi
test eax, 0xfffffffc
jle 0x4b0d23
push 0xc
call fcn.004d6a5a
mov esi, eax
xor ebx, ebx
pop ecx
test esi, esi
je 0x4b0d06
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
jmp 0x4b0d08
mov esi, ebx
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.004b10fb
push ebx
push ebx
push esi
push 0x4b0d34
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test edi, edi
je 0x4b0d2e
push edi
call fcn.004d5e25
pop ecx
call fcn.004e3305
ret
Function at 0x4b1c1e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor eax, eax
push eax
push eax
push 2
push eax
push eax
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4b1c42
xor eax, eax
jmp 0x4b1ca6
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4b1c4a
sub esi, ecx
push esi
call fcn.004d5f08
push esi
mov ebx, eax
push 0
push ebx
call fcn.004db6f0
add esp, 0x10
mov edx, ebx
push 0x100
push ecx
mov ecx, dword [ebp + 8]
push esi
call fcn.004137eb
add esp, 0xc
test esi, esi
je 0x4b1c93
push 0
lea eax, [ebp - 4]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, dword [ebp - 4]
ja 0x4b1c7f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.004d5e39
pop ecx
xor eax, eax
pop esi
inc eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4b4888
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x501e52
call fcn.004e3337
mov esi, edx
mov edi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x14]
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl_
mov dword [ebp - 0x10], ebx
call fcn.00404e83
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.00402a02
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4b4915
push 4
pop esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], esi
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
test eax, eax
jne 0x4b490f
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], esi
jne 0x4b4915
cmp dword [ebp - 0x1c], esi
jne 0x4b4915
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jne 0x4b4915
mov bl, 1
jmp 0x4b4915
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
call fcn.00403030
mov al, bl
call fcn.004e3305
ret

Function at 0x4b4925
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x4fdf28
call fcn.004e3337
mov edi, edx
mov esi, ecx
push dword [ebp + 8]
call fcn.004b4888
pop ecx
test al, al
jne 0x4b499b
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x14]
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl_
call fcn.00404e83
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push edi
call fcn.00402a02
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4b4993
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
call fcn.00403030
call fcn.004e3305
ret
Function at 0x4b49a1
Capabilities:
Delete registry value

Disassembly:
push 8
mov eax, 0x4fdf28
call fcn.004e3337
mov esi, edx
mov edi, ecx
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl_
lea ecx, [ebp - 0x14]
call fcn.00404e83
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push esi
call fcn.00402a02
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4b49f6
push edi
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4b4a1b
push edi
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
call fcn.00403030
call fcn.004e3305
ret

Function at 0x4b4a29
Capabilities:
Delete registry value

Disassembly:
push esi
mov esi, ecx
call fcn.004b4a81
cmp eax, 7
jbe 0x4b4a7f
mov edx, str.FEATURE_BROWSER_EMULATION
mov ecx, esi
call fcn.004b49a1
mov edx, str.FEATURE_BLOCK_LMZ_SCRIPT
mov ecx, esi
call fcn.004b49a1
mov edx, str.FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT
mov ecx, esi
call fcn.004b49a1
mov edx, str.FEATURE_GPU_RENDERING
mov ecx, esi
call fcn.004b49a1
mov edx, str.FEATURE_AJAX_CONNECTIONEVENTS
mov ecx, esi
call fcn.004b49a1
mov ecx, esi
mov edx, str.FEATURE_SAFE_BINDTOOBJECT
pop esi
jmp fcn.004b49a1
pop esi
ret
Function at 0x4b4b22
Capabilities:
Delete registry value

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.004b4a81
mov edi, eax
cmp edi, 7
jbe 0x4b4ce9
imul edx, edi, 0x3e8
mov ecx, esi
push ebx
push edx
mov edx, str.FEATURE_BROWSER_EMULATION
call fcn.004b4925
push 0
mov edx, str.FEATURE_BLOCK_LMZ_SCRIPT
mov ecx, esi
call fcn.004b4925
push 0
mov edx, str.FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT
mov ecx, esi
call fcn.004b4925
xor ebx, ebx
add esp, 0xc
inc ebx
mov edx, str.FEATURE_GPU_RENDERING
mov ecx, esi
cmp edi, 9
jb 0x4b4b81
push ebx
call fcn.004b4925
pop ecx
jmp 0x4b4b86
call fcn.004b49a1
push ebx
mov edx, str.FEATURE_SAFE_BINDTOOBJECT
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_AJAX_CONNECTIONEVENTS
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_DISABLE_ISO_2022_JP_SNIFFING
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_DISABLE_MK_PROTOCOL
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_BEHAVIORS
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_DISABLE_SQM_UPLOAD_FOR_APP
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_OBJECT_CACHING
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_RESTRICT_ACTIVEXINSTALL
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_SCRIPTURL_MITIGATION
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_SECURITYBAND
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_VALIDATE_NAVIGATE_URL
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_VIEWLINKEDWEBOC_IS_UNSAFE
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_FEEDS
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_MIME_HANDLING
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_MIME_SNIFFING
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_PROTOCOL_LOCKDOWN
mov ecx, esi
call fcn.004b4925
add esp, 0x40
mov edx, str.FEATURE_RESTRICT_ABOUT_PROTOCOL_IE7
mov ecx, esi
push ebx
call fcn.004b4925
push ebx
mov edx, str.FEATURE_SHOW_APP_PROTOCOL_WARN_DIALOG
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_TABBED_BROWSING
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_WINDOW_RESTRICTIONS
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_XSSFILTER
mov ecx, esi
call fcn.004b4925
push ebx
mov edx, str.FEATURE_ZONE_ELEVATION
mov ecx, esi
call fcn.004b4925
add esp, 0x18
mov edx, str.FEATURE_ACTIVEX_REPURPOSEDETECTION
mov ecx, esi
call fcn.004b49a1
mov edx, str.FEATURE_BLOCK_LMZ_IMG
mov ecx, esi
call fcn.004b49a1
mov edx, str.FEATURE_BLOCK_LMZ_OBJECT
mov ecx, esi
call fcn.004b49a1
mov edx, str.FEATURE_Cross_Domain_Redirect_Mitigation
mov ecx, esi
call fcn.004b49a1
pop ebx
pop edi
mov ecx, esi
mov edx, str.FEATURE_LOCALMACHINE_LOCKDOWN
pop esi
jmp fcn.004b49a1
pop edi
pop esi
ret
Function at 0x4b4cec
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x4f7c9b
call fcn.004e3337
test ecx, ecx
je 0x4b4d3b
mov eax, dword [0x542750]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push ecx
push str.url.dll_FileProtocolHandler__s
push eax
call fcn.0040301c
add esp, 0xc
push 1
push 0
push dword [ebp - 0x10]
push str.rundll32.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x10]
call fcn.00403030
call fcn.004e3305
ret

Function at 0x4b5f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
and dword [esp + 0xc], 0
and dword [esp + 0x10], 0
push ebx
push esi
mov ebx, ecx
push edi
push ecx
lea ecx, [esp + 0x2c]
mov esi, dword [ebx + 0x78]
push dword [ebx + 0x28]
sub esi, dword [ebx + 0x70]
mov edi, dword [ebx + 0x7c]
inc esi
sub edi, dword [ebx + 0x74]
push dword [ebx + 0x24]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], edi
call fcn.004150a8
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.0041504e
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x4b603b
sub esp, 0x10
lea ecx, [esp + 0x28]
push edi
push esi
push 9
push 0x3a
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.004153d7
mov ecx, dword [ebx + 0x8c]
call fcn.0041544d
sub eax, 0x3a
cmp eax, esi
jae 0x4b603b
mov ecx, dword [ebx + 0x8c]
call fcn.0041544d
mov ecx, dword [ebx + 0x8c]
sub esi, eax
add esi, 0x3a
call fcn.0041544d
and dword [esp + 0x1c], 0
lea ecx, [esp + 0x10]
sub esp, 0x10
mov dword [esp + 0x30], esi
sub eax, 0x3a
mov dword [esp + 0x34], edi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push edi
push esi
push 9
push 0
push eax
push dword [ebx + 0x8c]
call fcn.004153d7
mov esi, dword [ebx + 0x5c]
jmp 0x4b6046
push esi
call fcn.004b63db
dec esi
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
jns 0x4b6040
push dword [ebx + 0x3c]
call fcn.004b63db
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
call fcn.004b60b6
mov eax, dword [ebx + 0x24]
lea esi, [esp + 0x18]
and dword [esp + 0x18], 0
lea edx, [esp + 0x28]
and dword [esp + 0x1c], 0
sub esp, 0x10
mov ecx, dword [ebx + 4]
mov edi, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebx + 0x28]
mov dword [esp + 0x34], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0044f78a
add esp, 0x10
push dword [esp + 0x10]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
push dword [esp + 0x2c]
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b7888
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4b78a8
push 0
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
inc eax
jmp 0x4b78aa
xor eax, eax
pop esi
ret 4
Function at 0x4bd2c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ecx + 8]
sub esp, 8
cmp eax, 5
ja case.0x4bd2cf.4
jmp dword [eax*4 + 0x4bd364]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
call fcn.004dbced
movsd qword [ebp - 8], xmm0
fld qword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
call fcn.004dbc5c
movsd qword [ebp - 8], xmm0
fld qword [ebp - 8]
mov esp, ebp
pop ebp
ret
fld qword [ecx]
mov esp, ebp
pop ebp
ret
fldz
mov esp, ebp
pop ebp
ret
cmp byte [ecx], 0
je 0x4bd327
movsd xmm0, qword [0x52c020]
movsd qword [ebp - 8], xmm0
fld qword [ebp - 8]
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
movsd qword [ebp - 8], xmm0
fld qword [ebp - 8]
mov esp, ebp
pop ebp
ret
movdqu xmm0, xmmword [str.Value_is_not_convertible_to_double.]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movdqu xmm0, xmmword [0x503f64]
movdqu xmmword [ecx + 0x10], xmm0
mov eax, dword [0x503f74]
mov dword [ecx + 0x20], eax
call fcn.004dae39
nop
or bl, dl
dec ebx
add dh, dl
ror byte [ebx], cl
in al, dx
ror byte [ebx], cl
add dl, bl
dec ebx
add byte [esi], dh
ror dword [ebx], cl
push cs
ror dword [ebx], cl
int3

Function at 0x4bd4b0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
movsx eax, byte [esi + 8]
cmp eax, 5
ja case.0x4bd4c0.4
jmp dword [eax*4 + 0x4bd5c8]
call fcn.004bdf10
test al, al
je 0x4bd512
mov eax, dword [esi]
pop esi
ret
call fcn.004bdf10
test al, al
jne 0x4bd4d0
jmp 0x4bd53f
movsd xmm1, qword [esi]
comisd xmm1, xmmword [0x503fb8]
jb 0x4bd574
movsd xmm0, qword [0x503fa0]
comisd xmm0, xmm1
jb 0x4bd574
cvttsd2si eax, xmm1
pop esi
ret
xor eax, eax
pop esi
ret
xor eax, eax
cmp byte [esi], al
pop esi
setne al
ret
movdqu xmm0, xmmword [str.LargestInt_out_of_Int_range]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movq xmm0, qword [0x503dac]
movq qword [ecx + 0x10], xmm0
mov eax, dword [0x503db4]
mov dword [ecx + 0x18], eax
call fcn.004dae39
movdqu xmm0, xmmword [str.LargestUInt_out_of_Int_range]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movq xmm0, qword [0x503dc8]
movq qword [ecx + 0x10], xmm0
mov eax, dword [0x503dd0]
mov dword [ecx + 0x18], eax
mov al, byte [0x503dd4]
mov byte [ecx + 0x1c], al
call fcn.004dae39
movdqu xmm0, xmmword [str.double_out_of_Int_range]
mov eax, 0x29a
push 0x7b
movdqu xmmword [eax], xmm0
movq xmm0, qword [0x503de8]
movq qword [eax + 0x10], xmm0
call fcn.004dae39
movdqu xmm0, xmmword [str.Value_is_not_convertible_to_Int.]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movdqu xmm0, xmmword [0x503e00]
movdqu xmmword [ecx + 0x10], xmm0
mov al, byte [0x503e10]
mov byte [ecx + 0x20], al
call fcn.004dae39
mov edi, edi
add eax, 0xc7004bd5
aam 75
add ah, dl
aam 0x4b
add bh, bl
aam 0x4b
add byte [ecx + 0x9004bd5], bl
aad 0x4b
invalid