joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b460
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [0x4e5180]
mov edi, dword [sym.imp.USER32.dll_GetMenu]
call edi
cmp byte [0x4e45bc], 0
mov ebx, eax
mov eax, 8
sete dl
xor ecx, ecx
test dl, dl
mov byte [0x4e45bc], dl
cmovne ecx, eax
push ecx
push 0x9c6e
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
cmp byte [0x4e45bc], al
setne al
add eax, 9
push eax
push 0x9c6e
push 0x42b
push dword [0x4e5198]
call esi
push 1
push 0
push dword [0x4e5198]
call dword [sym.imp.USER32.dll_InvalidateRect]
lea eax, [ebp - 0x14]
push eax
push dword [0x4e5180]
call dword [sym.imp.USER32.dll_GetClientRect]
cmp byte [0x4e45bc], 0
jne 0x45b5bb
push dword [0x4e518c]
mov esi, dword [sym.imp.USER32.dll_IsWindowVisible]
call esi
test eax, eax
jne 0x45b522
push dword [0x4e5190]
call esi
test eax, eax
je 0x45b6a3
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x4e518c]
call esi
push 0
push dword [0x4e5190]
call esi
push 0x400
push 5
push dword [0x4e5180]
call edi
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
push dword [0x4e5180]
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
movsd xmm0, qword [0x4e0410]
movzx ecx, ax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
shl ecx, 0x10
movzx eax, ax
or ecx, eax
movsd qword [0x4e0418], xmm0
movsd xmm0, qword [0x4ba630]
push ecx
push 0
push 0
push dword [0x4e5180]
movsd qword [0x4e0410], xmm0
call fcn.0045d7c0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
movsd xmm0, qword [0x4e0418]
movzx ecx, ax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
shl ecx, 0x10
movzx eax, ax
or ecx, eax
movsd qword [0x4e0410], xmm0
push ecx
push 0
push 0
push dword [0x4e5180]
call fcn.0045d7c0
mov edi, dword [0x4e518c]
add esp, 0x10
cmp byte [0x4e45bb], 0
cmovne edi, dword [0x4e5190]
push 0
push 2
push 0xffffffffffffffff
push 0x100c
push dword [0x4e5184]
call esi
push eax
push 0x1013
push dword [0x4e5184]
call esi
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 0
je 0x45b645
push dword [0x4e51bc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov cl, byte [0x4e45bb]
mov edx, 0x4bee9c
test cl, cl
mov eax, 0x4bee90
cmove eax, edx
push eax
mov eax, dword [0x4e56dc]
cmovne eax, dword [0x4e56d8]
push eax
push 0x410
push 5
push ebx
call dword [sym.imp.USER32.dll_InsertMenuW]
push dword [0x4e5180]
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 2
push 0xffffffffffffffff
push 0x100c
push edi
call esi
push 5
cmp eax, 0xffffffff
je 0x45b699
push 1
jmp 0x45b69b
push 0
call fcn.004447c0
add esp, 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
Function at 0x45c1e0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x4e519c]
test eax, eax
je 0x45c20d
push 9
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4e519c]
call dword [sym.imp.USER32.dll_SetFocus]
push dword [0x4e519c]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
ret
push esi
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0
push 0
push 0x464150
mov esi, eax
call fcn.00493b6c
add esp, 0xc
push 0xffffffffffffffff
push dword [0x4e56c0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
xor eax, eax
ret

Function at 0x45f9e0
Capabilities:
Hide graphical window
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push dword [0x4e5180]
call fcn.0044c040
add esp, 8
mov esi, 1
push esi
push edi
call fcn.00451ff0
inc esi
add esp, 8
cmp esi, 8
jl 0x45fa06
push dword [0x4e56c8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
mov ecx, 0x4dfd10
call fcn.004589c0
push 0
push dword [0x4e56c4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x461280
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x2c
push eax
push dword [0x4e5180]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
xor eax, eax
cmp dword [ebp - 0x28], 2
sete al
lea eax, [eax*4 + 5]
push eax
push dword [0x4e5180]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4e5180]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [0x4e5180]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
mov byte [0x4e51e3], 1
mov byte [0x4e51d9], 0
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
Function at 0x461ad0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetMenu]
push esi
push edi
mov edi, dword [ebp + 8]
push 8
push 0x9c4b
push edi
mov byte [0x4e45bb], 1
call ebx
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
push eax
call esi
xor eax, eax
mov ecx, 8
cmp byte [0x4e45bb], al
cmove eax, ecx
push eax
push 0x9c46
push edi
call ebx
push eax
call esi
cmp byte [0x4e45bb], 0
mov ecx, 4
mov eax, 1
cmovne eax, ecx
push eax
push 0x9c5e
push 0x42b
push dword [0x4e5198]
call dword [sym.imp.USER32.dll_PostMessageW]
push 1
push 0
push dword [0x4e5198]
call dword [sym.imp.USER32.dll_InvalidateRect]
test edi, edi
je 0x461b60
push dword [0x4e51bc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
cmp byte [0x4e45bb], cl
mov edi, 5
mov eax, edi
cmovne eax, ecx
push eax
push dword [0x4e518c]
call esi
xor eax, eax
cmp byte [0x4e45bb], al
cmovne eax, edi
push eax
push dword [0x4e5190]
call esi
cmp byte [0x4e45bc], 0
je 0x461bd3
push 0x400
push edi
push dword [0x4e5180]
call ebx
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
push 0x4bee90
push dword [0x4e56d8]
push 0x410
push edi
push dword [0x4e5180]
call ebx
push eax
call dword [sym.imp.USER32.dll_InsertMenuW]
push 5
push 2
push 0xffffffffffffffff
push 0x100c
push dword [0x4e5190]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
setne al
movzx eax, al
push eax
call fcn.004447c0
add esp, 8
push dword [0x4e5180]
call dword [sym.imp.USER32.dll_DrawMenuBar]
cmp byte [0x4e45bc], 0
pop edi
pop esi
pop ebx
jne 0x461c28
push 0
push 0
push 0
push dword [0x4e5180]
call fcn.0045b460
add esp, 0x10
xor eax, eax
pop ebp
ret
Function at 0x461c30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetMenu]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0x9c4b
push edi
mov byte [0x4e45bb], 0
call ebx
mov esi, dword [sym.imp.USER32.dll_CheckMenuItem]
push eax
call esi
xor eax, eax
mov ecx, 8
cmp byte [0x4e45bb], al
cmove eax, ecx
push eax
push 0x9c46
push edi
call ebx
push eax
call esi
cmp byte [0x4e45bb], 0
mov ecx, 4
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
cmovne eax, ecx
push eax
push 0x9c5e
push 0x42b
push dword [0x4e5198]
call esi
xor eax, eax
cmp byte [0x4e45bb], al
sete al
push eax
push 0x9c47
push 0x401
push dword [0x4e5198]
call esi
push 1
push 0
push dword [0x4e5198]
call dword [sym.imp.USER32.dll_InvalidateRect]
test edi, edi
je 0x461ce0
push dword [0x4e51bc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
cmp byte [0x4e45bb], cl
mov edi, 5
mov eax, edi
cmovne eax, ecx
push eax
push dword [0x4e518c]
call esi
xor eax, eax
cmp byte [0x4e45bb], al
cmovne eax, edi
push eax
push dword [0x4e5190]
call esi
cmp byte [0x4e45bc], 0
je 0x461d90
push 0x400
push edi
push dword [0x4e5180]
call ebx
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
push 0x4bee9c
push dword [0x4e56dc]
push 0x410
push edi
push dword [0x4e5180]
call ebx
push eax
call dword [sym.imp.USER32.dll_InsertMenuW]
push edi
push 2
push 0xffffffffffffffff
push 0x100c
push dword [0x4e518c]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
setne al
movzx eax, al
push eax
call fcn.004447c0
add esp, 8
push dword [0x4e5180]
call dword [sym.imp.USER32.dll_DrawMenuBar]
cmp byte [0x4e45bc], 0
jne 0x461da4
push 0
push 0
push 0
push dword [0x4e5180]
call fcn.0045b460
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x464070
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 4]
push 0x104
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jne 0x46409c
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jns 0x4640c3
mov eax, dword [ebp - 4]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0x4bef6c
mov dword [ebp - 0x18], 0x11
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov edi, eax
test edi, edi
je 0x464130
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov ecx, dword [ebp - 4]
push edi
push ecx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4647a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 4
push 0x4e47ee
push 0x4befa8
mov dword [ebp - 4], 0
call fcn.004917b4
mov edi, dword [sym.imp.USER32.dll_DialogBoxParamW]
add esp, 0xc
test eax, eax
jne 0x464830
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 0x4e45e4
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
push esi
call fcn.0048fb2f
add esp, 4
mov ebx, eax
push ebx
push esi
push 0
push 0x4e45e4
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x464825
cmp dword [ebx + 0x30], 0x60000
jae 0x464825
cmp dword [ebp + 8], 0
push 0
push 0x436070
push 0
jne 0x464818
push 0x4befb4
jmp 0x46481d
push 0x4befdc
push dword [0x4dfca0]
call edi
push ebx
call fcn.0048faf7
add esp, 4
pop esi
pop ebx
cmp byte [0x4e47ec], 0
jne 0x464879
cmp dword [0x4ea0b4], 0
je 0x46484c
cmp word [0x4e47ee], 0
jne 0x464879
push 0
push 0x436070
push 0
push 0x4befb4
push dword [0x4dfca0]
call edi
push 1
push dword [0x4e5180]
mov byte [0x4e47ec], 1
call fcn.0044c040
add esp, 8
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x466860
Capabilities:
Delete file
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x4db648
push 0x4c0880
call fcn.0043ee20
add esp, 8
test eax, eax
jne 0x4669a9
push 0x104
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4c0898
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x4c08b8
push eax
call fcn.00426350
lea eax, [ebp - 0x20c]
push eax
push 0x96
call fcn.0043ea80
add esp, 0x18
test al, al
jne 0x466969
push 0x4c0898
lea eax, [ebp - 0x414]
push 0x4c08d4
push eax
call fcn.00426350
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x20c]
push eax
push 0x96
call fcn.0043ea80
add esp, 8
test al, al
jne 0x466969
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4c0898
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x4c08ec
push eax
call fcn.00426350
lea eax, [ebp - 0x20c]
push eax
push 0x96
call fcn.0043ea80
add esp, 0x18
test al, al
je 0x466993
push 0x4db648
lea eax, [ebp - 0x20c]
push eax
push 0x4c0880
call fcn.0043eb10
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x20c]
push eax
jne 0x4669a3
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
Function at 0x4672d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0x4c05e8
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x4672f2
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x4c05f0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x467314
push 0x4c0600
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop ebp
ret
Function at 0x468570
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2b8], 0
test ecx, ecx
je 0x4685c6
mov eax, dword [ebp + 0xc]
or eax, 0x100
push eax
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2b8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
Function at 0x46a8f0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0x4675d0
push 0
push 0
call fcn.004929fc
add esp, 0x18
mov esi, eax
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x46a953
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x20
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47b850
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 1], 0
push dword [esi + 0x44]
push 0
push 0x800
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jne 0x47b884
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4ea078]
test eax, eax
je 0x47b8be
cmp byte [ebp + 8], 0
push ebx
je 0x47b8a7
call eax
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [0x4ea07c]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 4
jbe 0x47b8d0
lea ecx, [esi + 0xb8]
jmp 0x47b8da
mov byte [ebp - 1], 1
lea ecx, [esi + 0x88]
push edi
mov edi, dword [esi + 4]
xor ebx, ebx
mov dword [ebp - 0xc], ebx
test edi, edi
je 0x47b907
lea eax, [ecx + 0x38]
mov edx, edi
add ecx, 0x34
nop
cmp dword [ecx], 5
jne 0x47b8fb
cmp dword [eax], 5
jne 0x47b8fb
inc ebx
add ecx, 0x40
add eax, 0x40
dec edx
jne 0x47b8f0
mov dword [ebp - 0xc], ebx
cmp byte [ebp + 8], 0
je 0x47b916
cmp edi, ebx
jne 0x47b91e
jmp 0x47ba17
cmp edi, ebx
jne 0x47ba17
cmp byte [ebp - 1], 0
jne 0x47b92c
add esi, 0xb8
jmp 0x47b932
add esi, 0x88
mov dword [ebp - 0x14], 0
test edi, edi
je 0x47ba14
lea edi, [esi + 0x38]
lea ebx, [esi + 0x34]
add esi, 0x24
mov dword [ebp - 8], esi
lea ecx, [ecx]
mov eax, dword [esi]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x24], 0
push eax
push 2
lea eax, [ebp - 0x18]
mov dword [ebp - 0x3c], 0x18
push eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call dword [0x4ea080]
test eax, eax
jne 0x47b9ee
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x47b9eb
cmp byte [ebp + 8], al
je 0x47b9d9
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x47b9c0
cmp eax, 1
jne 0x47b9e4
cmp dword [ebx], 5
jne 0x47b9c0
cmp dword [edi], 5
je 0x47b9e4
lea eax, [ebp - 0x10]
push eax
push esi
call dword [0x4ea070]
cmp dword [edi], 5
je 0x47b9e4
cmp dword [ebp - 0x10], 0
je 0x47b9e4
inc dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
push esi
call dword [0x4ea074]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
add esi, 0x40
mov ecx, dword [ebp + 0xc]
inc eax
add ebx, 0x40
mov dword [ebp - 8], esi
add edi, 0x40
mov dword [ebp - 0x14], eax
cmp eax, dword [ecx + 4]
jb 0x47b950
mov ebx, dword [ebp - 0xc]
mov esi, ecx
jmp 0x47ba17
mov esi, dword [ebp + 0xc]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp + 8], 0
pop edi
je 0x47ba37
cmp dword [esi + 4], ebx
jne 0x47ba37
pop esi
mov eax, 0x770
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x481660
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
push 0
push 0x4723d0
call fcn.00493b6c
add esp, 0xc
pop esi
pop ebp
ret
Function at 0x483240
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4e45c3], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
je 0x4832b4
push eax
lea eax, [ebp - 0x804]
push 0x4c0680
push eax
call fcn.0043c580
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x31
push 0x4b0220
push eax
push dword [0x4e5180]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x4832b4
push dword [0x4e5184]
call dword [sym.imp.USER32.dll_SetFocus]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push esi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x4832e9
push dword [0x4e5180]
push 0x4bfb18
call fcn.00483c20
add esp, 8
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x483321
push dword [0x4e5180]
push 0x4c06c4
call fcn.00483c20
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
Function at 0x483350
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa08
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x4e45c3], 0
mov eax, dword [ebp + 8]
je 0x4833bd
push eax
lea eax, [ebp - 0xa04]
push 0x4c06f8
push eax
call fcn.0043c580
add esp, 0xc
lea eax, [ebp - 0xa04]
push 0x31
push 0x4b0220
push eax
push dword [0x4e5180]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
jne 0x4833bd
push dword [0x4e5184]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [0x4e028c]
test esi, esi
je 0x4834fb
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov eax, esi
test esi, esi
je 0x4834eb
jmp 0x4833e0
cmp dword [eax + 0x44], ebx
je 0x4833f1
mov eax, dword [eax + 0x54]
test eax, eax
jne 0x4833e0
jmp 0x4834eb
push dword [esi + 0x44]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x4834ae
push dword [esi + 0x3c]
lea eax, [ebp - 0xa04]
push 0x4c0764
push eax
call fcn.0043c580
mov edi, dword [0x4e5180]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x48347c
push 0
push 0
lea ecx, [ebp - 0xa08]
push ecx
push 0x400
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [ebp - 0xa08]
lea eax, [ebp - 0xa04]
push eax
lea eax, [ebp - 0x204]
push 0x4c05d0
push eax
call fcn.004406f0
add esp, 0x10
push dword [ebp - 0xa08]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x483497
lea eax, [ebp - 0xa04]
push eax
lea eax, [ebp - 0x204]
push 0x4c05e0
push eax
call fcn.004406f0
add esp, 0xc
push 0x10
push 0x4b0220
lea eax, [ebp - 0x204]
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4834eb
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4834e4
push dword [esi + 0x3c]
lea eax, [ebp - 0xa04]
push 0x4c0788
push eax
call fcn.0043c580
push dword [0x4e5180]
lea eax, [ebp - 0xa04]
push eax
call fcn.00483c20
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esi + 0x5b0]
test esi, esi
jne 0x4833d1
pop edi
pop ebx
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret