joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4793b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x4793e1
je 0x47943b
sub eax, 7
je 0x479402
dec eax
je 0x47942c
sub eax, 0x17
je 0x4794e0
jmp 0x47951e
add eax, 0xffffff00
sub eax, 9
jb 0x4794cc
add eax, 0xffffff09
sub eax, 0xb
jb 0x479494
jmp 0x47951e
mov eax, ebx
call fcn.00465d40
mov edi, eax
test edi, edi
je 0x47957e
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x479587
jmp 0x47957e
test byte [ebx + 0x44], 0x20
jne 0x479587
jmp 0x47957e
mov edx, esi
mov eax, ebx
call fcn.004769b0
cmp dword [esi + 0xc], 0xffffffff
jne 0x479587
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.00489294
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.004754e4
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.00479288
test eax, eax
je 0x479587
mov dword [esi + 0xc], 1
jmp 0x479587
mov edx, esi
mov eax, ebx
call fcn.0047931c
test al, al
je 0x47957e
cmp dword [esi + 0xc], 0
jne 0x479587
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.0047ba18
push eax
call sub.USER32.DLL_DefWindowProcA
jmp 0x479587
mov eax, ebx
call fcn.0047604c
test al, al
jne 0x479587
jmp 0x47957e
mov eax, ebx
call fcn.0047ba18
mov edi, eax
call sub.USER32.DLL_GetCapture
cmp edi, eax
jne 0x47957e
cmp dword [0x5d31d4], 0
je 0x47957e
mov eax, dword [0x5d31d4]
cmp ebx, dword [eax + 0x24]
jne 0x47957e
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x5d31d4]
call fcn.004768e4
jmp 0x47957e
mov eax, dword [0x5d8984]
cmp byte [eax + 0x20], 0
je 0x47957e
mov eax, dword [0x5d8984]
cmp dword [eax + 0x1c], 0
je 0x47957e
mov eax, dword [esi]
mov edx, dword [0x5d8984]
cmp eax, dword [edx + 0x1c]
jne 0x47957e
lea eax, [ebp - 0x110]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.00465c84
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.00492c8c
jmp 0x479587
mov edx, esi
mov eax, ebx
call fcn.004769b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x479a48
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x479a64
cmp dword [esi + 4], 0
je 0x479a91
test byte [ebx + 0x45], 1
jne 0x479a83
mov eax, ebx
call fcn.00478980
test eax, eax
jne 0x479a83
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x479ba1
mov edx, esi
mov eax, ebx
call fcn.004796c0
jmp 0x479ba1
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x479b9a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0047ba18
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.004768e4
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00479a48
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0047ba18
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479ba1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x487564
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 1
jne 0x487579
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x48dd28
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x48dd61
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004937f4
jmp 0x48dd6a
mov eax, ebx
mov edx, esi
call fcn.00493760
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48dd74
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x48dd95
mov al, byte [esp]
jmp 0x48dd97
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4925d0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4925ff
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004937f4
jmp 0x49261d
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00492558
mov edi, eax
test ebx, ebx
je 0x49261d
cmp dword [esi], 0
je 0x49261d
dec ebx
jmp 0x492606
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x492928
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x5d3564]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4929c0
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4929a0
xor eax, eax
push ebp
push 0x492999
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4929dc
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4929a0
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x5d3564]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x5d3564], ax
mov esp, ebp
pop ebp
ret

Function at 0x4936c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00492328
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x5d8c55], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x493688
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x494da8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x494f64
push reloc.WSOCK32.DLL_accept
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x494e09
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x494f80
push reloc.WSOCK32.DLL_accept
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x494e7b
xor eax, eax
push ebp
push 0x494e74
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00494c00
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x494e5d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x494fa0
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494e7b
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x494f5c
cmp byte [ebp - 0xd], 0
jne 0x494ebd
cmp byte [ebp - 0x12], 0
je 0x494f5c
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x494ed6
dec ebx
cmp byte [ebx], 0x2e
je 0x494ee5
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x494ed5
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x494f5c
inc ebx
cmp byte [ebp - 0x12], 0
je 0x494f12
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x494f5c
cmp byte [ebp - 0xd], 0
je 0x494f5c
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x494f5c
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495238
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x495294
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.KERNEL32.DLL_ReadFile
dec eax
pop eax
pop ecx
jne 0x495286
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x49527b
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x495276
mov eax, 0x64
jmp 0x49528b
call sub.KERNEL32.DLL_GetLastError
call fcn.00492480
xor eax, eax
jmp 0x495276
mov eax, 0x67
jmp 0x49528b

Function at 0x4952d8
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, eax
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x49531b
push 0
push dword [ebx]
call sub.KERNEL32.DLL_GetFileSize
cmp eax, 0xffffffff
je 0x495312
push eax
push 1
push 0
push 0
push dword [ebx]
call sub.KERNEL32.DLL_SetFilePointer
cmp eax, 0xffffffff
je 0x495312
pop edx
cmp eax, edx
setae al
pop ebx
ret
call fcn.00492490
mov al, 1
jmp 0x495310
mov eax, 0x67
call fcn.00492480
mov al, 0xff
jmp 0x495310

Function at 0x495408
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x4954f0
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x5d9038], 1
jae 0x4954e2
xor eax, eax
mov dword [0x5d8c44], eax
xor eax, eax
mov dword [0x5d8c4c], eax
xor eax, eax
mov dword [0x5d8c50], eax
mov byte [0x5d8c56], 2
mov byte [0x5d8c57], 2
mov byte [0x5d8c58], 3
mov word [0x5d9000], 0
mov word [0x5d9010], 1
mov word [0x5d9020], 0xa
mov dword [0x5d9028], 0x80020004
mov dword [0x5d8ff4], 0x494530
mov dword [0x5d8ff8], 0x494528
mov dword [0x5d8ffc], 0x494530
call fcn.004928f8
test al, al
je 0x4954a1
call fcn.00492928
call fcn.004929ec
mov eax, 0x5d8c5c
mov edx, 0x4954fc
call fcn.0049007e
mov eax, 0x5d8e28
mov edx, 0x4954fc
call fcn.0049007e
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x5d8c3c], eax
call fcn.00490fe4
mov dword [0x5d8c38], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x5d8c30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4954f7
ret

Function at 0x497a90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x497aac
call fcn.00498e08
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x497ac8
test bl, 1
je 0x497ac8
call fcn.0049f2e4
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x497cac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004989a4
test byte [ebp + 0xd], 0xc0
jne 0x497cd0
mov eax, dword [0x5d4550]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x497cdd
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x497d0a
je 0x497d1c
sub ecx, 0x100
je 0x497d2a
sub ecx, 0x100
je 0x497d31
sub ecx, 0x100
je 0x497d23
jmp 0x497d38
sub ecx, 0x600
je 0x497d31
sub ecx, 0x100
je 0x497d1c
jmp 0x497d38
mov edi, 1
jmp 0x497d3d
mov edi, 2
jmp 0x497d3d
mov edi, 4
jmp 0x497d3d
mov edi, 5
jmp 0x497d3d
mov edi, 3
test byte [ebp + 0xd], 1
je 0x497d64
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x5d3fc8]
test al, 0x80
je 0x497d5d
mov ebx, 0x80
jmp 0x497d76
mov ebx, 1
jmp 0x497d76
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x497d76
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x497d88
je 0x497d91
dec eax
je 0x497d9a
jmp 0x497da3
mov dword [ebp - 4], closesocket
jmp 0x497db2
mov dword [ebp - 4], 0x40000000
jmp 0x497db2
mov dword [ebp - 4], 0xc0000000
jmp 0x497db2
push 1
call fcn.00498d9c
pop ecx
mov ebx, eax
jmp 0x497e9e
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x497dce
sub eax, 0x10
je 0x497dd5
sub eax, 0x10
je 0x497dde
sub eax, 0x10
je 0x497de7
jmp 0x497de7
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x497dee
mov dword [ebp - 8], 1
jmp 0x497dee
mov dword [ebp - 8], 2
jmp 0x497dee
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x497e57
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x497e4c
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x497e4c
add ebx, 0xffffffb2
push ebx
call fcn.00498d9c
pop ecx
mov ebx, eax
jmp 0x497e9e
mov edi, esi
push edi
call fcn.00497c10
pop ecx
test eax, eax
je 0x497e6b
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x497e77
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.00498ac4
add esp, 8
mov ebx, eax
inc eax
jne 0x497e9e
push 4
call fcn.00498d9c
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.004989d8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c0e4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.004967a0
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.004968ac
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.004968ac
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x5d5171
lea ecx, [ebp - 0x200]
push ecx
call fcn.004967a0
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.004968ac
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.0049d274
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x49c1f5
push esi
call fcn.004968ac
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.004968ac
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.0049621c
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x49c1cc
xor eax, eax
jmp 0x49c27c
push esi
call fcn.004968ac
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.004968ac
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.004966fc
add esp, 0xc
jmp 0x49c235
mov edi, dword [ebx + 0x24]
push edi
call fcn.004968ac
pop ecx
push eax
push esi
call fcn.004968ac
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004968ac
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.0049623c
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x49c235
xor eax, eax
jmp 0x49c27c
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.004967a0
add esp, 8
push 0x5d5173
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004967a0
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.004967a0
add esp, 8
push 0x5d5175
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004967a0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49f27c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x49f2de
call fcn.0049f22c
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004968ac
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004968ac
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x49f35c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x5d5780], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x49f436
cmp dword [0x5d577c], 0
jne 0x49f436
cmp dword [0x5d5960], 0
je 0x49f3f0
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0049f12c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x49f3d6
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0049f12c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x49f3d6
lea ebx, [ebp - 0x84]
jmp 0x49f3d7
inc ebx
call fcn.0049f318
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x49f471
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x5d5784
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004968ac
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x5d5787
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x49f471
cmp dword [0x5d577c], 0
je 0x49f450
cmp dword [0x5d577c], 0xffffffff
je 0x49f471
push esi
call dword [0x5d577c]
pop ecx
mov eax, dword [0x5d5780]
test eax, eax
je 0x49f471
cmp dword [0x5d5780], 0xffffffff
je 0x49f471
cmp byte [eax], 0
je 0x49f471
push esi
push eax
call fcn.0049f27c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a6928
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4a6956
mov eax, ebx
call fcn.004a73cc
cmp dword [ebx + 0x3c], 0
je 0x4a694f
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4a69c7
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x4a69b9
cmp dword [ebx + 8], 0
je 0x4a6978
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x4a698a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4a69b9
cmp dword [ebx + 8], 0
je 0x4a696b
cmp eax, 3
je 0x4a699d
dec eax
jne 0x4a696b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4a696b
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x4a696b
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4a69e5
cmp dword [ebx + 0x10], 0xcc
je 0x4a69e5
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004a69f0
pop ebx
ret
Function at 0x4030b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429ddb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4363e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004123f3
push 4
mov dword [ebp - 4], 0
call fcn.00413137
mov edi, eax
add esp, 4
test edi, edi
je 0x40312c
call fcn.004127a1
mov dword [edi], eax
call fcn.00412560
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00412495
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x403122
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.004124bd
jmp 0x40312e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4064d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a058
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4363e4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
push 8
mov dword [esi], ebx
call fcn.00413137
add esp, 4
cmp eax, ebx
je 0x4065b4
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [ebp - 4], ebx
lea edi, [esi + 0x18]
push 8
mov dword [edi], ebx
call fcn.00413137
add esp, 4
cmp eax, ebx
je 0x406590
mov dword [edi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [edi]
mov dword [ecx], edi
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov eax, 0xf
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x74], eax
mov dword [esi + 0x70], ebx
mov byte [esi + 0x60], bl
mov word [esi + 0x7c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
call fcn.00413049
push 0x433654
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call fcn.0041451a
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], ebx
call fcn.00413049
push 0x433654
lea edx, [ebp - 0x2c]
push edx
mov dword [ebp - 0x2c], vtable.std::bad_alloc.0
call fcn.0041451a
int3