joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42506a
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push 0x45c
mov eax, 0x4efe4c
call fcn.004d382d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x454], eax
push 0x5c
push ecx
xor edi, edi
mov dword [ebp - 4], edi
mov eax, esp
mov dword [ebp - 0x458], esp
push eax
xor esi, esi
call fcn.004766c0
pop ecx
lea eax, [ebp - 0x460]
push eax
call fcn.00477b10
add esp, 8
mov byte [ebp - 4], 1
mov eax, esp
mov dword [ebp - 0x458], esp
push dword [ebp + 8]
push dword [ebp - 0x460]
push str._s:_CHttpStreaming::DownloadFileToMemory:__s
push eax
call fcn.004777e0
add esp, 0x10
call fcn.0042503a
mov eax, dword [0x5475b4]
pop ecx
cmp eax, edi
jne 0x425101
push edi
push edi
push edi
push edi
push str.http_cameyo_streaming
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [0x5475b4], eax
cmp eax, edi
je 0x4251f2
push edi
push edi
push edi
push edi
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0x45c], eax
cmp eax, edi
je 0x4251c5
push edi
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x50]
push ecx
push 0x13
push eax
mov dword [ebp - 0x458], 0x40
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
lea eax, [ebp - 0x50]
push 0x502950
push eax
call fcn.004ccf60
pop ecx
pop ecx
test eax, eax
jne 0x4251b7
mov esi, 0x4000
push esi
call fcn.004cd074
pop ecx
mov ebx, eax
lea eax, [ebp - 0x468]
push eax
push esi
push ebx
jmp 0x425194
add edi, dword [ebp - 0x468]
cmp dword [ebp - 0x468], esi
jne 0x4251a4
lea eax, [edi + 0x4000]
push eax
push ebx
call fcn.004cdc3e
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 0x468]
push eax
push esi
lea eax, [ebx + edi]
push eax
push dword [ebp - 0x45c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x425169
mov eax, dword [ebp - 0x464]
mov dword [eax], ebx
mov eax, dword [ebp - 0x454]
xor esi, esi
mov dword [eax], edi
inc esi
push dword [ebp - 0x45c]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x4251f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x464]
push eax
mov dword [ebp - 0x454], edi
call dword [sym.imp.WININET.dll_InternetGetLastResponseInfoW]
push ecx
mov eax, esp
mov dword [ebp - 0x454], esp
push dword [ebp - 0x460]
push str._s:_CHttpStreaming::DownloadFileToMemory:_out
push eax
call fcn.004777e0
add esp, 0xc
call fcn.0042503a
pop ecx
mov ecx, dword [ebp - 0x460]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, esi
call fcn.004d38b0
ret
Function at 0x428543
Capabilities:
Terminate process

Disassembly:
push 0x10
mov eax, 0x4f4591
call fcn.004d37c4
mov edi, ecx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [edi + 0x8c]
push str.UnpackUtils_ReadIni_PeContainer_s_
push eax
call fcn.004777e0
add esp, 0xc
call fcn.00425a06
pop ecx
call fcn.004bdbe3
push eax
lea ecx, [ebp - 0x14]
call fcn.004204a1
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Main
call fcn.00422827
push 3
call fcn.004924d0
mov esi, dword [ebp - 0x14]
mov eax, dword [esi - 0xc]
test eax, eax
jne 0x4285b7
lea ecx, [esi - 0x10]
call fcn.0042001a
xor al, al
jmp 0x428639
push eax
push esi
push dword [ebp + 8]
call fcn.00425f5c
add esp, 0xc
mov byte [ebp - 0xd], al
test al, al
jne 0x42862e
push 0
push 0x5c
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.004766c0
pop ecx
lea eax, [ebp - 0x1c]
push eax
call fcn.00477b10
add esp, 0xc
mov esi, eax
push 0x500aa0
lea eax, [ebp - 0x18]
push str.Not_a_correct__s_package
push eax
mov byte [ebp - 4], 1
call fcn.004777e0
add esp, 0xc
push dword [esi]
push dword [eax]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esi - 0x10]
call fcn.0042001a
mov al, byte [ebp - 0xd]
call fcn.004d389c
ret
Function at 0x428b18
Capabilities:
Enumerate files on windows

Disassembly:
push 0x274
mov eax, 0x4efdc5
call fcn.004d382d
xor esi, esi
push 0x24c
lea eax, [ebp - 0x260]
push esi
mov dword [ebp - 4], 1
push eax
mov dword [ebp - 0x264], esi
call fcn.004cd900
pop ecx
pop ecx
mov eax, esp
mov dword [ebp - 0x26c], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.UnpackUtils_StampLocalCache:_FileNamePortion_s__FullStampLocalCache_s
push eax
call fcn.004777e0
add esp, 0x10
call fcn.00425a06
mov eax, esp
mov dword [ebp - 0x26c], esp
lea ecx, [ebp + 8]
push ecx
push str.EngineStamps_
push eax
call fcn.00422acb
lea eax, [ebp - 0x278]
add esp, 0xc
push eax
mov ecx, esi
call fcn.0048a080
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0x274]
push str._s..stamp
push eax
call fcn.004777e0
add esp, 0x14
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x278]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push ecx
mov ebx, eax
mov eax, esp
mov dword [ebp - 0x26c], esp
push dword [ebp - 0x274]
push str.UnpackUtils_FullStampLocalCache:_FindMask_s
push eax
call fcn.004777e0
add esp, 0xc
call fcn.00425a06
pop ecx
cmp ebx, 0xffffffff
je 0x428d0d
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x268]
call fcn.00422827
push ecx
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x280], esp
push 0x50057c
call fcn.00422827
push ecx
mov byte [ebp - 4], 6
lea eax, [ebp - 0x268]
mov dword [ebp - 0x27c], esp
mov ecx, esp
push eax
call fcn.00422f20
push ecx
mov dword [ebp - 0x270], esp
mov edi, esp
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
push str.EngineStamps
mov byte [ebp - 4], 7
xor esi, esi
call fcn.00422827
push edi
mov ecx, esi
call fcn.0048a080
pop ecx
pop ecx
lea edi, [ebp - 0x26c]
mov byte [ebp - 4], 5
call fcn.004770a0
add esp, 0xc
push eax
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 8
call fcn.00422f41
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
call fcn.0042001a
push ecx
mov eax, esp
mov dword [ebp - 0x270], esp
push dword [ebp - 0x268]
push str.UnpackUtils_FullStampLocalCache:_KillFile__s_
push eax
call fcn.004777e0
add esp, 0xc
call fcn.00425a06
lea eax, [ebp - 0x268]
mov dword [ebp - 0x270], esp
mov ecx, esp
push eax
call fcn.00422f20
call fcn.0047ad80
pop ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.0042001a
lea eax, [ebp - 0x264]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x428c00
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x50206c
push ecx
lea eax, [ebp + 0xc]
mov dword [ebp - 0x270], esp
mov ecx, esp
push eax
xor edi, edi
call fcn.00422f20
call fcn.004781b0
pop ecx
pop ecx
mov ecx, dword [ebp - 0x274]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0042001a
call fcn.004d38b0
ret
Function at 0x42ac4e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x10
mov eax, 0x4f319d
call fcn.004d37c4
lea eax, [ebp + 8]
xor ebx, ebx
push eax
mov ecx, 0x54729c
mov dword [ebp - 4], ebx
call fcn.00422f41
lea eax, [ebp + 8]
mov esi, 0x547000
push eax
mov ecx, esi
call fcn.00422f41
push 1
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push esi
call fcn.00422f20
lea edi, [ebp - 0x14]
call fcn.004776f0
pop ecx
pop ecx
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00422f41
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042001a
push 1
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.004229cf
mov edi, 0x50057c
push edi
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00422e4b
test eax, eax
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x14]
setne byte [ebp - 0xd]
add ecx, 0xfffffff0
call fcn.0042001a
cmp byte [ebp - 0xd], bl
je 0x42acee
push edi
mov ecx, esi
call fcn.00424248
mov esi, dword [0x547000]
call fcn.0047a410
push dword [0x547000]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42ad3b
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Diff_Init:_Cannot_create_TempDir
call fcn.00422827
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.General
mov byte [ebp - 4], 3
call fcn.00422827
push 3
mov byte [ebp - 4], bl
call fcn.0047c9c0
add esp, 0xc
push 0x547030
call fcn.0042ad94
mov esi, 0x50206c
push esi
mov ecx, 0x547004
call fcn.004233e5
push esi
mov ecx, 0x54700c
call fcn.004233e5
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push esi
call fcn.00422827
mov esi, 0x547060
call fcn.0042ae4c
call fcn.00460bd0
call fcn.00465f60
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042001a
xor eax, eax
inc eax
call fcn.004d389c
ret
Function at 0x42b60d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x541100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
xor eax, eax
cmp dword [esi], ebx
je 0x42b62f
inc eax
jmp 0x42b7fd
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x32c], ebx
call fcn.004cd900
push 0x110
lea eax, [ebp - 0x31c]
push ebx
push eax
call fcn.004cd900
add esp, 0x18
lea eax, [ebp - 0x320]
push eax
mov dword [ebp - 0x320], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42b7fb
cmp dword [ebp - 0x310], 2
jne 0x42b7fb
cmp dword [ebp - 0x31c], 5
jb 0x42b7fb
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x42b7fb
lea eax, [ebp - 0x328]
push eax
push 0x4fab2c
push 1
push ebx
push 0x4fab3c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x42b7dd
mov eax, dword [ebp - 0x328]
mov ecx, dword [eax]
lea edx, [ebp - 0x324]
push edx
push eax
call dword [ecx + 0x1c]
test eax, eax
jl 0x42b7dd
push edi
push dword [ebp - 0x324]
call fcn.004cd3f0
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop ecx
mov dword [esi + 8], eax
cmp dword [ebp - 0x324], ebx
je 0x42b714
push dword [ebp - 0x324]
call edi
mov eax, dword [ebp - 0x328]
mov ecx, dword [eax]
lea edx, [ebp - 0x324]
push edx
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x42b7dc
push dword [ebp - 0x324]
call fcn.004cd3f0
pop ecx
mov dword [esi + 0xc], eax
cmp dword [ebp - 0x324], ebx
je 0x42b74e
push dword [ebp - 0x324]
call edi
push dword [esi + 0xc]
lea eax, [ebp - 0x20c]
push str.WinNT:___s
push 0x104
push eax
call fcn.004cfd20
add esp, 0x10
lea eax, [ebp - 0x32c]
push eax
push 0x4fa9ec
lea eax, [ebp - 0x20c]
push eax
call sub.ACTIVEDS.dll_ADsGetObject
test eax, eax
jl 0x42b7dc
mov eax, dword [ebp - 0x32c]
mov ecx, dword [eax]
lea edx, [ebp - 0x324]
push edx
push eax
call dword [ecx + 0x20]
test eax, eax
jl 0x42b7dc
mov eax, dword [ebp - 0x32c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x324]
push str.Domain
call fcn.004ccf60
pop ecx
pop ecx
test eax, eax
jne 0x42b7c6
mov dword [esi + 4], 1
cmp dword [ebp - 0x324], ebx
je 0x42b7d6
push dword [ebp - 0x324]
call edi
mov dword [esi], 1
pop edi
mov eax, dword [ebp - 0x328]
cmp eax, ebx
je 0x42b7ed
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esi], ebx
jne 0x42b7f7
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [esi]
jmp 0x42b7fd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004cc3b2
leave
ret
Function at 0x4301c2
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
cmp dword [0x5475c4], esi
jne 0x430243
mov dword [0x5475c4], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00476000
pop ecx
test eax, eax
jne 0x430232
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x546ef8], eax
cmp dword [0x5475c8], esi
jne 0x43021f
push esi
push esi
push 0x50206c
call fcn.004cd3f0
pop ecx
push eax
push 0x42fe42
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x5475c8], eax
push 0x190
push dword [0x546ef8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
ret
push str.This_is_a_System_process__so_skipping_window_display.
push str.GfxServerInit
call fcn.00475890
pop ecx
pop ecx
pop esi
ret

Function at 0x4318e8
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x14], ecx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], ecx
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x24]
push ecx
push eax
call ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call ebx
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x10]
sub esi, dword [ebp - 0xc]
sub edi, dword [ebp - 8]
sub esi, dword [ebp - 0x24]
sub edi, dword [ebp - 0x20]
add esi, dword [ebp - 0x14]
add edi, dword [ebp - 0x18]
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x43197e
lea ecx, [ebp - 0x34]
push ecx
push eax
call ebx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
test eax, eax
jg 0x431970
test ecx, ecx
jle 0x43197e
jmp 0x431975
sub eax, dword [ebp - 0x28]
add edi, eax
test ecx, ecx
jle 0x43197e
sub ecx, dword [ebp - 0x2c]
add esi, ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 1
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431adb
Capabilities:
Create directory
Create thread

Disassembly:
push 0x30
mov eax, 0x4f106a
call fcn.004d37c4
xor esi, esi
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov ebx, 0x500aa0
push ebx
mov dword [ebp - 0x18], esi
call fcn.00422827
lea eax, [ebp - 0x10]
push eax
call fcn.00476eb0
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042001a
push 0x10
call fcn.004bd4f2
mov edi, eax
pop ecx
cmp edi, esi
je 0x431b42
lea ecx, [edi + 8]
call fcn.0042048d
lea ecx, [edi + 0xc]
call fcn.0042048d
mov dword [0x546f00], edi
jmp 0x431b48
mov dword [0x546f00], esi
push ecx
mov edi, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x50057c
call fcn.00422827
push ecx
mov dword [ebp - 4], esi
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Troubleshoot.log
call fcn.00422827
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], eax
call fcn.00422827
mov eax, dword [ebp - 0x14]
push eax
call fcn.00476eb0
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
call fcn.004770a0
add esp, 0xc
call fcn.00431504
lea eax, [ebp - 0x18]
push eax
push esi
push dword [ebp + 8]
push 0x431808
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x431bd7
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x3c]
push eax
call edi
test eax, eax
jg 0x431bc3
mov eax, dword [ebp - 0x34]
call fcn.004d389c
ret 4
Function at 0x431f0c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 4]
xor esi, esi
push esi
push dword [0x546f20]
add eax, 0xffffff7e
push esi
push dword [0x546f0c]
cdq
push 0x82
sub eax, edx
push 0x190
sar eax, 1
push eax
mov eax, dword [ebp - 8]
add eax, 0xfffffe70
cdq
sub eax, edx
sar eax, 1
push eax
push 0x80c90000
push dword [ebp + 0xc]
push str.InputBox
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x546f08], eax
cmp eax, esi
jne 0x431f82
xor eax, eax
jmp 0x432100
push ebx
push edi
push dword [ebp + 0x10]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [0x546f1c]
call edi
push dword [0x546f08]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
push dword [0x546f0c]
call dword [sym.imp.USER32.dll_EnableWindow]
push 5
push dword [0x546f08]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x546f08]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp + 0x14], esi
je 0x431ff4
push dword [ebp + 0x14]
push dword [0x546f10]
call edi
cmp dword [ebp + 0x18], esi
je 0x431ff4
push dword [ebp + 0x18]
push esi
push 0xb1
push dword [0x546f10]
call ebx
mov dword [ebp + 0x14], esi
jmp 0x4320e6
cmp dword [ebp - 0x28], 0x100
jne 0x4320d2
cmp dword [ebp - 0x24], 0x1b
jne 0x43201e
push esi
push esi
push 2
push dword [0x546f08]
call ebx
mov dword [ebp + 0x14], esi
cmp dword [ebp - 0x24], 0xd
jne 0x432088
push dword [0x546f10]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
inc edi
cmp eax, esi
je 0x43204a
push eax
call fcn.004bd521
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax + 4], esi
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004bd52c
pop ecx
mov ecx, dword [ebp + 8]
push edi
push eax
push dword [0x546f10]
mov dword [ecx + 4], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
push esi
push 2
push dword [0x546f08]
call ebx
mov dword [ebp + 0x14], 1
cmp dword [ebp - 0x24], 9
jne 0x4320d2
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, eax
cmp edi, dword [0x546f10]
jne 0x4320aa
push dword [0x546f14]
call dword [sym.imp.USER32.dll_SetFocus]
cmp edi, dword [0x546f14]
jne 0x4320be
push dword [0x546f18]
call dword [sym.imp.USER32.dll_SetFocus]
cmp edi, dword [0x546f18]
jne 0x4320d2
push dword [0x546f10]
call dword [sym.imp.USER32.dll_SetFocus]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x431ffc
mov eax, dword [ebp + 0x14]
pop edi
pop ebx
pop esi
leave
ret 0x14
Function at 0x434ea5
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x4f0fe4
call fcn.004d37c4
lea eax, [ebp + 8]
xor ebx, ebx
lea ecx, [esi + 0xa0]
push eax
mov dword [ebp - 4], ebx
call fcn.00422f41
cmp dword [esi + 0xa4], ebx
je 0x434f2e
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
je 0x434f08
push eax
lea eax, [ebp - 0x10]
push 0x508498
push eax
call fcn.004777e0
add esp, 0xc
mov byte [ebp - 4], 1
push dword [eax]
lea ecx, [esi + 0x2220]
call fcn.004c5b40
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0042001a
jmp 0x434f18
push 0x50206c
lea ecx, [esi + 0x2220]
call fcn.004c5b40
mov eax, dword [esi + 0xa4]
test byte [eax + 4], 1
lea ecx, [esi + 0x19f4]
jne 0x434f44
push 1
jmp 0x434f45
push 0x50206c
lea ecx, [esi + 0x2220]
call fcn.004c5b40
lea ecx, [esi + 0x19f4]
push ebx
call fcn.004c5be2
mov ecx, dword [ebp + 8]
xor eax, eax
cmp dword [ecx - 0xc], ebx
lea ecx, [esi + 0x121c]
setne al
push eax
call fcn.004c5be2
mov eax, dword [esi + 0xa4]
cmp eax, ebx
je 0x434fde
test byte [eax + 4], 2
push ebx
push ebx
push 0x1009
push dword [esi + 0x1d4]
je 0x434f9e
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push 0xffffffffffffffff
push ebx
push ebx
push str.Drag__drop_here_files_from_your_computer
push ebx
push 3
lea ecx, [esi + 0x1b4]
call fcn.004c6df4
jmp 0x434fde
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push 0xfa
push 1
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
push dword [esi + 0x13c]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push 0x434310
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0042001a
call fcn.004d389c
ret 4
Function at 0x4388cb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
mov esi, dword [edx - 0xc]
push edi
or edi, 0xffffffff
cmp dword [0x546fac], 0
jne 0x4388e7
call fcn.004a7500
lea ecx, [esi + esi]
xor eax, eax
test ecx, ecx
jle 0x43890b
movzx esi, byte [eax + edx]
xor esi, edi
and esi, 0xff
shr edi, 8
xor edi, dword [esi*4 + 0x546ad8]
inc eax
cmp eax, ecx
jl 0x4388f0
lea ecx, [edx - 0x10]
call fcn.0042001a
mov eax, edi
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x43891b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
jbe 0x43893a
mov eax, dword [ebp + 8]
mov dl, cl
and dl, 0x7f
add eax, ecx
add dl, 0x21
xor byte [eax], dl
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x438925
pop ebp
ret