joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fd90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x8b0], 0
jne 0x45ff29
push 0x20
call fcn.00493133
add esp, 4
mov dword [ebp - 4], eax
mov ecx, eax
mov dword [eax], vtable.CWndShadow.0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xd], 0x5000864
mov byte [eax + 0x11], 5
mov dword [eax + 0x14], 0
mov byte [eax + 0x18], 0
mov dword [eax + 0x1c], 0x505050
push dword [esi + 4]
mov dword [esi + 0x8b0], eax
call fcn.0042f3b0
mov eax, dword [esi + 0x8b0]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x45fe0e
and byte [eax + 0xc], 0xf9
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [esi + 0x8b0]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [edi + 4]
test eax, eax
je 0x45fe36
test byte [edi + 0xc], 2
mov byte [edi + 0xf], 8
je 0x45fe36
push eax
call ebx
push eax
mov ecx, edi
call fcn.0042f790
mov edi, dword [esi + 0x8b0]
mov eax, dword [edi + 4]
test eax, eax
je 0x45fe5a
test byte [edi + 0xc], 2
mov word [edi + 0x10], 0x202
je 0x45fe5a
push eax
call ebx
push eax
mov ecx, edi
call fcn.0042f790
mov edi, dword [esi + 0x8b0]
mov eax, dword [edi + 4]
test eax, eax
je 0x45fe7c
test byte [edi + 0xc], 2
mov byte [edi + 0xe], 0xd
je 0x45fe7c
push eax
call ebx
push eax
mov ecx, edi
call fcn.0042f790
mov edi, dword [esi + 0x8b0]
mov eax, dword [edi + 4]
test eax, eax
je 0x45fe9e
test byte [edi + 0xc], 2
mov byte [edi + 0xd], 0x64
je 0x45fe9e
push eax
call ebx
push eax
mov ecx, edi
call fcn.0042f790
mov edi, dword [esi + 0x8b0]
mov eax, dword [edi + 4]
test eax, eax
je 0x45fec3
test byte [edi + 0xc], 2
mov dword [edi + 0x1c], 0x505050
je 0x45fec3
push eax
call ebx
push eax
mov ecx, edi
call fcn.0042f790
mov edi, dword [esi + 0x8b0]
mov ecx, dword [esi + 4]
cmp dword [edi + 4], 0
je 0x45ff1b
and byte [edi + 0xc], 9
mov al, byte [edi + 0xc]
test al, 1
je 0x45ff05
test al, 8
jne 0x45ff05
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x45ff05
or byte [edi + 0xc], 4
mov cl, byte [edi + 0xc]
test eax, 0x21000000
jne 0x45ff05
or cl, 2
mov byte [edi + 0xc], cl
test byte [edi + 0xc], 2
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
je 0x45ff14
push 8
jmp 0x45ff16
push 0
push dword [edi + 4]
call eax
push dword [esi + 4]
mov ecx, dword [esi + 0x8b0]
call fcn.0042f790
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46b430
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [edi], 0xb
jne 0x46b491
push dword [edi + 0x14]
lea eax, [esi + 0x1ec]
push dword [edi + 0x10]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x46b491
cmp byte [esi + 0xc9c], 0
jne 0x46b491
mov ecx, dword [esi + 0xcac]
mov byte [esi + 0xc9c], 1
test ecx, ecx
je 0x46b47d
mov eax, dword [ecx]
push 1
call dword [eax + 0x250]
mov ecx, dword [esi + 0xca8]
test ecx, ecx
je 0x46b491
mov eax, dword [ecx]
push 0
call dword [eax + 0x250]
cmp dword [edi], 0xa
jne 0x46b4e3
push dword [edi + 0x14]
lea eax, [esi + 0x1ec]
push dword [edi + 0x10]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x46b4e3
cmp byte [esi + 0xc9c], al
je 0x46b4e3
mov ecx, dword [esi + 0xcac]
mov byte [esi + 0xc9c], al
test ecx, ecx
je 0x46b4cf
mov eax, dword [ecx]
push 0
call dword [eax + 0x250]
mov ecx, dword [esi + 0xca8]
test ecx, ecx
je 0x46b4e3
mov eax, dword [ecx]
push 1
call dword [eax + 0x250]
mov eax, dword [edi]
cmp eax, 0xd
je 0x46b4ff
cmp eax, 0xf
je 0x46b4ff
push edi
mov ecx, esi
call fcn.0046a1e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
mov eax, dword [eax + 0x10c]
cmp eax, method.UiLib::CCheckBoxUI.virtual_268
jne 0x46b5f7
mov al, byte [esi + 0x236]
test al, al
je 0x46b58b
push ecx
mov ecx, dword [esi + 0x40]
push 0
push 0
push str.itemclick
push esi
call fcn.004229a0
mov ecx, dword [esi + 0xc98]
test ecx, ecx
je 0x46b58b
mov eax, dword [ecx]
mov eax, dword [eax + 0x34]
cmp eax, method.UiLib::CTreeViewUI.1.virtual_52
jne 0x46b600
mov al, byte [ecx + 5]
test al, al
je 0x46b593
mov eax, dword [esi + 0xc74]
lea ecx, [esi + 0xc74]
mov eax, dword [eax + 0x10]
cmp eax, method.UiLib::CTreeNodeUI.virtual_16
jne 0x46b607
mov al, byte [ecx + 0x19]
test al, al
jne 0x46b58b
mov ecx, dword [esi + 0xc98]
mov byte [esi + 0xc8d], 1
push 0
push dword [esi + 0xc78]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x46b571
mov eax, dword [esi + 0xc74]
lea ecx, [esi + 0xc74]
mov eax, dword [eax + 0x10]
cmp eax, method.UiLib::CTreeNodeUI.virtual_16
jne 0x46b60e
mov al, byte [ecx + 0x19]
mov ecx, dword [esi + 0xc98]
test al, al
je 0x46b5e2
push dword [esi + 0xc78]
mov byte [esi + 0xc8d], 0
mov eax, dword [ecx]
call dword [eax + 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ecx]
push 0
push dword [esi + 0xc78]
call dword [eax + 0x2c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call eax
jmp 0x46b518
call eax
jmp 0x46b54c
call eax
jmp 0x46b56d
call eax
jmp 0x46b5be
Function at 0x46dac0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4e5070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 0
je 0x46db5f
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.00493c60
mov ebx, esp
test ebx, ebx
je 0x46db5f
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x14]
push 0xffffffffffffffff
add ecx, 0x3fc
push ebx
call fcn.00429c90
mov eax, dword [esi + 0x14]
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x28], 0x20
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x14]
lea edx, [ebp - 0x28]
mov dword [ebp - 0x1c], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x184]
mov ecx, dword [esi + 0x14]
push ecx
push 0
push 0
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.004229a0
xor eax, eax
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00493122
mov esp, ebp
pop ebp
ret

Function at 0x46ff40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x46ff71
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x46ff60
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x4718a0
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor cl, cl
cmp dword [esi + 0x4c], 0xffffffff
je 0x471a69
mov eax, dword [esi + 0x4c]
cmp eax, 0x7c
je 0x471a69
cmp eax, 0x29
jne 0x4718d9
cmp dword [esi + 0x10], 0
jne 0x471a69
test dword [esi + 0x50], 0x10000000
je 0x471a6f
cmp eax, 0x2e
jne 0x471930
push 5
lea ecx, [esi + 0x24]
call fcn.00471c20
mov eax, dword [esi]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x471924
cmp byte [eax], 0x5c
jne 0x471922
inc eax
cmp eax, ecx
je 0x471922
mov ecx, dword [esi + 0x50]
test cl, 8
jne 0x47190f
mov dl, byte [eax]
cmp dl, 0x28
je 0x471920
cmp dl, 0x29
je 0x471920
test cl, 0x10
jne 0x471922
mov cl, byte [eax]
cmp cl, 0x7b
je 0x471920
cmp cl, 0x7d
jne 0x471922
mov dword [esi], eax
inc dword [esi]
mov ecx, esi
call fcn.00470d70
jmp 0x471a56
cmp eax, 0x5c
jne 0x471995
mov ecx, esi
call fcn.00471850
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x471962
cmp byte [esi + 0x48], 0x62
jne 0x471962
push 4
lea ecx, [esi + 0x24]
call fcn.00471c20
mov ecx, esi
call fcn.00471850
jmp 0x471a5d
test eax, eax
je 0x471989
cmp byte [esi + 0x48], 0x42
jne 0x471989
push 4
lea ecx, [esi + 0x24]
call fcn.00471c20
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.00471850
jmp 0x471a5d
mov ecx, esi
call fcn.00472530
jmp 0x471a56
cmp eax, 0x5b
jne 0x4719b8
mov ecx, esi
call fcn.00471850
mov ecx, esi
call fcn.004724a0
push 4
push 0x5d
mov ecx, esi
call fcn.00472440
jmp 0x471a56
cmp eax, 0x28
jne 0x4719e2
mov ecx, esi
call fcn.00471850
mov ecx, esi
call fcn.004725f0
push 5
push 0x29
mov ecx, esi
mov bl, al
call fcn.00472440
test bl, bl
je 0x471a5d
jmp 0x471a56
cmp eax, 0x5e
jne 0x4719fa
push 2
lea ecx, [esi + 0x24]
call fcn.00471c20
mov ecx, esi
call fcn.00471850
jmp 0x471a5d
cmp eax, 0x24
jne 0x471a12
push 3
lea ecx, [esi + 0x24]
call fcn.00471c20
mov ecx, esi
call fcn.00471850
jmp 0x471a5d
cmp eax, 0x2a
je 0x471a84
cmp eax, 0x2b
je 0x471a84
cmp eax, 0x3f
je 0x471a84
cmp eax, 0x7b
je 0x471a84
cmp eax, 0x7d
jne 0x471a34
test dword [esi + 0x50], 0x10000000
je 0x471a76
cmp eax, 0x5d
jne 0x471a42
test dword [esi + 0x50], 0x10000000
je 0x471a7d
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.004727e0
mov ecx, esi
call fcn.00471850
mov ecx, esi
call fcn.004726b0
cmp dword [esi + 0x4c], 0xffffffff
mov cl, 1
jne 0x4718b1
pop esi
mov al, cl
pop ebx
pop ecx
ret
push 5
call fcn.00491c04
push 6
call fcn.00491c04
push 4
call fcn.00491c04
push 0xa
call fcn.00491c04
int3
Function at 0x47f0f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7ee0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4e5070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
je 0x47f2c0
cmp dword [esi + 0xd4c], 0
je 0x47f1f3
cmp byte [esi + 0xe1c], 0
je 0x47f179
mov eax, dword [esi + 0x40]
mov eax, dword [eax + 0x69c]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x47f158
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
test al, al
jne 0x47f179
push 0
push dword [esi + 0xd4c]
call dword [0x4eb834]
mov ecx, dword [esi + 0x40]
add esp, 8
push 0x7d0
push 0x79
push esi
call fcn.00422020
mov byte [esi + 0xd49], 0
mov dword [esi + 0xe24], 0
mov eax, dword [esi + 0xec8]
sub eax, dword [esi + 0xec4]
cmp eax, 4
jb 0x47f1ac
push dword [esi + 0xe28]
mov ecx, dword [esi + 0x40]
push 0x78
push esi
call fcn.00422020
mov edx, edi
lea ecx, [ebp - 0x28]
call fcn.0042a340
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 0x10
jb 0x47f1c5
mov eax, dword [eax]
push eax
push dword [esi + 0xd4c]
call dword [0x4ebb90]
mov eax, dword [ebp - 0x14]
add esp, 8
cmp eax, 0x10
jb 0x47f2c0
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00403e20
jmp 0x47f2c0
cmp dword [esi + 0xd50], 0
je 0x47f2c0
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, 8
mov dword [ebp - 4], 1
push edi
mov word [ebp - 0x38], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
cmp byte [esi + 0xe1c], 0
mov dword [ebp - 0x30], eax
je 0x47f266
mov eax, dword [esi + 0x40]
mov eax, dword [eax + 0x69c]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x47f248
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
test al, al
jne 0x47f266
push 0
push dword [esi + 0xd1c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x40]
push 0x7d0
push 0x79
push esi
call fcn.00422020
mov byte [esi + 0xd49], 0
mov dword [esi + 0xe24], 0
mov eax, dword [esi + 0xec8]
sub eax, dword [esi + 0xec4]
test eax, 0xfffffffc
je 0x47f29b
push dword [esi + 0xe28]
mov ecx, dword [esi + 0x40]
push 0x78
push esi
call fcn.00422020
mov eax, dword [esi + 0xd50]
lea edx, [ebp - 0x38]
push 0
push 0
push 0
mov ecx, dword [eax]
push 0
push edx
push eax
call dword [ecx + 0xd0]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00493122
mov esp, ebp
pop ebp
ret 4
Function at 0x47f4d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp edi, dword [esi + 0xd50]
jne 0x47f5d7
cmp dword [esi + 0xdec], 0
jne 0x47f585
mov eax, dword [esi + 0x40]
mov eax, dword [eax + 0x69c]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x47f585
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
call eax
test al, al
je 0x47f585
push 0
push dword [esi + 0xd1c]
mov dword [esp + 0x10], str.Internet_Explorer_Hidden
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea ecx, [esp + 8]
push ecx
push 0x47f2e0
push eax
call dword [sym.imp.USER32.dll_EnumThreadWindows]
mov eax, dword [esp + 0xc]
mov dword [esi + 0xdec], eax
test eax, eax
je 0x47f585
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
push esi
push str.BrowserContext
push dword [esi + 0xdec]
mov dword [esi + 0xdf0], eax
call dword [sym.imp.USER32.dll_SetPropW]
push 0x4802d0
push 0xfffffffffffffffc
push dword [esi + 0xdec]
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp byte [esi + 0xe1c], 0
mov byte [esi + 0xd49], 1
je 0x47f5aa
push 5
push dword [esi + 0xd1c]
mov byte [esi + 0xe1c], 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x47f5d7
push 0x78
push esi
call fcn.00422170
mov ecx, dword [esi + 0x40]
push 0x79
push esi
call fcn.00422170
push ecx
mov ecx, dword [esi + 0x40]
push 0
push 0
push str.LoadOver
push esi
call fcn.004229a0
mov ecx, dword [esi + 0xee8]
test ecx, ecx
je 0x47f5ea
push dword [ebp + 0xc]
mov eax, dword [ecx]
push edi
call dword [eax + 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x480e30
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b8038
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4e5070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.BrowserKernalSwitched
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [ebp + 8], 0
mov byte [esi + 0xd4a], 0
je 0x480ea2
movups xmm0, xmmword [esi + 0x1ec]
mov edx, dword [esi]
sub esp, 0x10
mov eax, esp
mov ecx, esi
movups xmmword [eax], xmm0
call dword [edx + 0x254]
mov ecx, dword [esi + 0x40]
push 0x7d0
push 0x79
push esi
call fcn.00422020
jmp 0x480efd
mov ecx, dword [esi + 0x40]
push 0xc8
push 0x79
push esi
call fcn.00422020
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 2
mov eax, 8
push dword [esi + 0xd60]
mov word [ebp - 0x1c], ax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0
push 0
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, dword [esi + 0xd50]
push 0
push 0
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xd0]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp + 0x24]
cmp eax, 8
jb 0x480f12
inc eax
lea ecx, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
call fcn.00404770
xor eax, eax
mov dword [ebp + 0x24], 7
mov word [ebp + 0x10], ax
mov eax, dword [ebp + 0x3c]
mov dword [ebp + 0x20], 0
cmp eax, 8
jb 0x480f3b
inc eax
lea ecx, [ebp + 0x28]
push eax
push dword [ebp + 0x28]
call fcn.00404770
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x38
Function at 0x488250
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0x20]
mov esi, ecx
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [eax + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
test eax, eax
jne 0x488284
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x488287
pop esi
pop ebp
ret 0x20
mov dword [esi + 4], eax
cmp dword [esi + 8], 0
je 0x4882b3
push 4
lea eax, [ebp + 8]
mov dword [ebp + 8], 2
push eax
push 0x3f
push dword [esi + 4]
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x4882b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4882b5
xor eax, eax
pop esi
pop ebp
ret 0x20
Function at 0x488940
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b81e4
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x4e5070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
lea eax, [edi + 0x10]
mov dword [edi], vtable.CConnection.0
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x488996
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
lea eax, [edi + 0x30]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
lea eax, [edi + 0x48]
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov byte [ebp - 4], 4
push 0x138
mov dword [edi + 0x28], 0
mov byte [edi + 0xc], 0
call fcn.00493133
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.0042c7f0
push 0
push 0
push 0
push 0xffffffffffffffff
mov dword [edi + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [edi + 0x2c], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x489190
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
jne 0x489212
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x489212
call fcn.0042cc50
test eax, eax
je 0x4891b6
push dword [ebp + 8]
mov ecx, eax
call fcn.0042d000
push ebx
push edi
lea ebx, [esi + 0x30]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x64]
sub eax, dword [esi + 0x60]
sar eax, 2
cmp eax, 5
jge 0x4891fa
cmp dword [esi + 0x28], eax
jne 0x4891fa
push 0
push 0
push esi
push 0x488d40
push 0
push 0
call fcn.00498fd8
add esp, 0x18
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
lea ecx, [esi + 0x60]
push eax
call fcn.00409e50
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 1
push 0
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
pop edi
pop ebx
pop esi
pop ebp
ret 4
Function at 0x4a5551
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a53d0
Function at 0x4016be
Capabilities:
Hide graphical window
Terminate process

Disassembly:
push 0
call sub.ion_timed_out._GetModuleHandleA
mov dword [0x403975], eax
call fcn.00401e59
test eax, eax
je 0x4017ea
call fcn.00401fd2
test eax, eax
je 0x4017ea
push 0x400
push 0
call sub.ion_timed_out._GlobalAlloc
test eax, eax
je 0x4017ea
mov dword [0x40398d], eax
call fcn.00401e25
cmp dword [0x4035fe], 3
je 0x4017fc
mov dword [0x4037e1], 0x154
push 0
push 0x4037e1
push 0x154
push 0x29
call sub.sume_process._SystemParametersInfoA
push 0x4038f9
call sub.end_process._CreateFontIndirectA
mov dword [0x403979], eax
call fcn.00401c90
call fcn.0040167b
call fcn.00402b32
call fcn.00401877
test eax, eax
je 0x4017ea
mov dword [0x40397d], eax
push 0
push dword [0x40397d]
call sub.sume_process._ShowWindow
call fcn.00401e9c
mov eax, dword [0x40360e]
test eax, eax
je 0x401794
push eax
push section.CODE
push dword [0x40397d]
push 2
push dword [0x403975]
call sub.sume_process._DialogBoxParamA
test eax, eax
je 0x4017ea
push dword [0x40397d]
call 0x401808
push 1
push dword [0x40397d]
call sub.sume_process._ShowWindow
push 0
push 0
push 0
push 0x403991
call sub.sume_process._GetMessageA
test eax, eax
je 0x4017ea
push 0x403991
push dword [0x40397d]
call sub.sume_process._IsDialogMessageA
test eax, eax
jne 0x4017ac
push 0x403991
call sub.sume_process._TranslateMessage
push 0x403991
call sub.sume_process._DispatchMessageA
jmp 0x4017ac
push dword [0x40398d]
call sub.ion_timed_out._GlobalFree
push 0
call sub.ion_timed_out._ExitProcess
call fcn.004018d1
push 0
call sub.ion_timed_out._ExitProcess
enter 0, 0
push ebx
push edi
cmp dword [0x403632], 0
je 0x401871
mov edi, dword [0x403636]
cmp byte [edi], 0
je 0x401871
push edi
call fcn.00402bd9
mov ebx, eax
push edi
call sub.ion_timed_out._lstrlen
lea edi, [edi + eax + 5]
cmp ebx, dword [edi - 4]
je 0x40181d
cmp dword [0x403632], 1
je 0x401852
push 0x4034d6
call fcn.00402878
pop edi
pop ebx
leave
ret 4
push 0x65
push dword [ebp + 8]
call sub.sume_process._GetDlgItem
push 0
push eax
call sub.sume_process._EnableWindow
push 0x403471
push dword [ebp + 8]
call sub.sume_process._SetWindowTextA
pop edi
pop ebx
leave
ret 4

Function at 0x4018d1
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Resume thread
Suspend thread
Terminate process

Disassembly:
enter 0x324, 0
lea edi, [ebp - 0x44]
cld
xor eax, eax
mov dword [ebp - 0x324], eax
mov ecx, 0x11
rep stosd dword es:[edi], eax
mov dword [ebp - 0x44], 0x44
push 0xff
push 0x403652
push dword [0x403975]
call sub.ion_timed_out._GetModuleFileNameA
call sub.ion_timed_out._GetCommandLineA
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0x54]
push edx
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
push eax
push dword [0x40361a]
call sub.ion_timed_out._CreateProcessA
test eax, eax
je 0x401a13
push dword [ebp - 0x54]
call fcn.00401be4
test eax, eax
je 0x401a07
mov dword [0x403642], eax
mov edi, dword [0x403602]
mov eax, dword [edi]
jmp dword [eax*4 + 0x401951]
push 0x403454
call fcn.00402878
jmp 0x401a4d
push 0x4033a0
call fcn.00402878
leave
ret
push 0
push dword [ebp - 0x54]
call sub.ion_timed_out._TerminateProcess
leave
ret
Function at 0x401acf
Capabilities:
Resume thread
Suspend thread

Disassembly:
enter 0x144, 0
push edi
mov edi, dword [0x403642]
mov dword [ebp - 0x144], 1
cmp dword [edi], 0xffffffff
je 0x401b9a
cmp dword [edi + 8], 0
jne 0x401b8f
mov dword [ebp - 0x144], 0
push 0x40364a
push 4
push dword [edi]
push dword [edi + 4]
push dword [ebp + 8]
call sub.ion_timed_out._VirtualProtectEx
lea edx, [ebp - 0x140]
push 0x40364a
push dword [edi]
push edx
push dword [edi + 4]
push dword [ebp + 8]
call sub.ion_timed_out._ReadProcessMemory
test eax, eax
je 0x401bdd
mov eax, dword [edi]
lea edx, [edi + 0xc]
lea eax, [ebp - 0x140]
push dword [edi]
push edx
push eax
call fcn.00402292
test eax, eax
je 0x401b89
mov eax, dword [edi]
lea edx, [edi + eax*2 + 0xc]
lea eax, [ebp - 0x140]
push dword [edi]
push edx
push eax
call fcn.0040226b
lea eax, [ebp - 0x140]
push 0x40364e
push dword [edi]
push eax
push dword [edi + 4]
push dword [ebp + 8]
call sub.ion_timed_out._WriteProcessMemory
test eax, eax
je 0x401bdd
mov dword [edi + 8], 1
jmp 0x401b8f
cmp dword [ebp + 0x10], 1
jne 0x401bdd
mov eax, dword [edi]
lea edi, [edi + eax*4 + 0xc]
jmp 0x401ae4
cmp dword [ebp + 0x10], 1
jne 0x401bd5
cmp dword [ebp - 0x144], 1
je 0x401bd5
push dword [ebp + 0xc]
call sub.ion_timed_out._ResumeThread
push 0xa
call sub.ion_timed_out._Sleep
push dword [ebp + 0xc]
call sub.ion_timed_out._SuspendThread
mov edi, dword [0x403642]
mov dword [ebp - 0x144], 1
jmp 0x401ae4
xor eax, eax
inc eax
pop edi
leave
ret 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x402125
Capabilities:
Encode data using xor

Disassembly:
enter 0, 0
push ebx
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
shr ecx, 2
mov eax, 0x4c414d45
xor eax, 0x11080400
xor dword [edi + ecx*4], eax
dec ecx
jne 0x40213e
pop edi
pop ebx
leave
ret 8

Function at 0x4021de
Capabilities:
Copy file

Disassembly:
enter 0, 0
push ebx
push esi
push edi
push dword [ebp + 8]
call sub.ion_timed_out._lstrlen
mov ebx, eax
inc eax
push eax
push 0
call sub.ion_timed_out._GlobalAlloc
mov edi, eax
push dword [ebp + 8]
push edi
call sub.ion_timed_out._lstrcpy
mov esi, edi
mov eax, 0x2e
mov ecx, ebx
std
add edi, ecx
repne scasb al, byte es:[edi]
cld
test ecx, ecx
je 0x40221a
inc edi
mov byte [edi], 0
push 0x403542
push esi
call sub.ion_timed_out._lstrcat
push 0
push esi
push dword [ebp + 8]
call sub.ion_timed_out._CopyFileA
mov esi, eax
push esi
call sub.ion_timed_out._GlobalFree
test esi, esi
jne 0x402258
push 0x34
push 0x4035b1
push 0x403356
push dword [0x40397d]
call sub.sume_process._MessageBoxA
cmp eax, 6
jne 0x402262
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4