joyce8/EMBER2024-capa huggingface dataset:
Function at 0x569d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x569d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x569d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x569d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x569d94
push eax
push esi
call fcn.0056c20b
add esp, 8
pop esi
ret 0x10

Function at 0x569da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x569e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x569e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x582320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0056bdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x569dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x569e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x569ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x569eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x582320
push ecx
mov dword [esp + 0x1c], 4
call fcn.0056bdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x569eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x569e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x56a000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x56a131
push esi
call fcn.0056d145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0055c080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x56a131
push 0
push ebp
call fcn.0055c3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0055c260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x56a08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0055c2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x56a121
push 0x582918
push edi
call fcn.0056b3f0
push eax
push ebx
push esi
call fcn.00569f60
push 0x5828f8
push edi
call fcn.0056b3f0
push eax
push ebx
push esi
call fcn.00569f60
push 0x5828d8
push edi
call fcn.0056b3f0
push eax
push ebx
push esi
call fcn.00569f60
push 0x5828c0
push edi
call fcn.0056b3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00569f60
push 0x5828a0
push edi
call fcn.0056b3f0
push eax
push ebx
push esi
call fcn.00569f60
push 0x582888
push edi
call fcn.0056b3f0
push eax
push ebx
push esi
call fcn.00569f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x56b1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0056b140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0056b140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0056b140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0056b140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x56bbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x56bc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x57d87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x56bc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x56bc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x416e54
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.00486110
mov dword [esp], 0xc8
mov dword [esp + 4], 0x96
push dword [0xb2cb18]
call fcn.0046aba9
mov ebx, eax
push dword [0xb2cb18]
call fcn.0046afb9
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 8], ebx
push dword [0xb2cb18]
call fcn.0046ac18
mov ebx, eax
push dword [0xb2cb18]
call fcn.0046b437
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp + 4]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 0xc], ebx
push reloc.WS2_32.dll_connect
push dword [0xb2c854]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0
call fcn.0046afc7
push 0xa
call fcn.0047c571
push eax
push 0x1a
push 0xaa
push 0xf
push 0xf
push 6
call fcn.00465a43
push 8
call fcn.0047c571
push eax
push 0x1a
push 0xaa
push 0x2d
push 0xf
push 4
call fcn.00465a43
push 9
call fcn.0047c571
push eax
push 0x1a
push 0xaa
push 0x4b
push 0xf
push 5
call fcn.00465a43
push dword [0xb2cafc]
push 0x14
push 0xaa
push 0x78
push 0xf
push 7
call fcn.00464291
call fcn.00429bef
call fcn.0046aeb8
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x417057
call fcn.0046e3a4
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x417054
push dword [esp + 0x20]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x417053
call fcn.0046e386
push eax
mov ebx, 6
cmp ebx, dword [esp]
jne 0x417008
mov eax, str.https:__msfree.su_donaties_donations.html
push eax
call fcn.0045e24c
add esp, 0xc
jmp 0x4170ac
mov ebx, 4
cmp ebx, dword [esp]
jne 0x417027
mov eax, str.https:__msfree.su_donaties_donations.html
push eax
call fcn.0045e24c
add esp, 0xc
jmp 0x4170ac
mov ebx, 5
cmp ebx, dword [esp]
jne 0x417043
mov eax, str.https:__msfree.su_donaties_donations.html
push eax
call fcn.0045e24c
add esp, 0xc
jmp 0x4170ac
mov ebx, 7
cmp ebx, dword [esp]
jne 0x417052
add esp, 0xc
jmp 0x4170ac
pop eax
pop eax
pop eax
jmp 0x417061
push 0
call fcn.0046b445
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x417084
call fcn.0046b463
mov ebx, eax
and ebx, ebx
jne 0x417084
call fcn.00429bef
jmp 0x4170ac
push 0xd
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x4170a7
call fcn.0046b463
mov ebx, eax
and ebx, ebx
jne 0x4170a7
call fcn.00429bef
jmp 0x4170ac
jmp 0x416fb4
push 0
call fcn.0046a837
xor eax, eax
add esp, 0x10
pop edi
pop ebx
ret 4
Function at 0x4262c2
Capabilities:
Hide graphical window

Disassembly:
push ebx
call fcn.00486110
push dword [esp + 8]
call fcn.0046a9a5
and eax, eax
je 0x4263b3
mov ebx, dword [esp + 8]
cmp ebx, dword [0xb2cb18]
jne 0x426346
push dword [0xb2cb1c]
call fcn.0046a9a5
and eax, eax
je 0x426304
push 1
push dword [0xb2cb1c]
call fcn.0046ad05
push 0
push dword [0xb2cb18]
call fcn.0046ad05
push 9
push dword [0xb2cb18]
call fcn.0046a9b7
push eax
call sub.USER32.dll_ShowWindow
push dword [0xb2cb18]
call fcn.0046a9b7
push eax
call sub.USER32.dll_SetForegroundWindow
push dword [0xb2cb18]
call fcn.0046b445
mov ebx, dword [esp + 8]
cmp ebx, dword [0xb2cb1c]
jne 0x4263b3
push dword [0xb2cb18]
call fcn.0046a9a5
and eax, eax
je 0x426371
push 1
push dword [0xb2cb18]
call fcn.0046ad05
push 0
push dword [0xb2cb1c]
call fcn.0046ad05
push 9
push dword [0xb2cb1c]
call fcn.0046a9b7
push eax
call sub.USER32.dll_ShowWindow
push dword [0xb2cb1c]
call fcn.0046a9b7
push eax
call sub.USER32.dll_SetForegroundWindow
push dword [0xb2cb1c]
call fcn.0046b445
xor eax, eax
pop ebx
ret 4
Function at 0x43990d
Capabilities:
Query environment variable

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.00486110
push dword [esp + 0x1c]
call fcn.004416d0
mov edx, dword [esp + 0x18]
lea ecx, [esp]
call fcn.00441000
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485f70
pop edx
push eax
push 0x3e8
call fcn.004835b0
call fcn.004860a0
lea eax, [esp + 8]
push eax
call fcn.00486010
push 0x3e8
mov eax, dword [esp + 8]
push eax
mov eax, 0x56e2a4
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov edx, 0x55d09e
lea ecx, [esp + 8]
call fcn.00441008
push edx
call fcn.00485f70
pop edx
push eax
push 0xe
mov edx, dword [esp + 0xc]
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485fb0
mov edx, 0x56a4c2
push edx
call fcn.00485fb0
call fcn.004860a0
push edx
call fcn.00485f70
pop edx
push eax
mov edx, 0x56378e
push edx
call fcn.00485fb0
mov edx, dword [esp + 0x10]
push edx
call fcn.00485fb0
call fcn.004860a0
mov edx, dword [esp + 0x14]
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485fb0
mov edx, str.System32cmd.exe
push edx
call fcn.00485fb0
call fcn.004416b2
add dword [esp], edx
call fcn.004416b2
add dword [esp + 4], edx
call fcn.004416b2
add dword [esp + 8], edx
call fcn.0045dcfe
call fcn.004416d0
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x439a9b
push dword [esp + 0xc]
call fcn.0045e263
and eax, eax
je 0x439a92
push dword [esp + 0xc]
call fcn.0045e2aa
and eax, eax
je 0x439a90
mov edx, dword [esp + 8]
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485fb0
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485f70
pop edx
push eax
push 0x18
push dword [esp + 0x20]
call fcn.0045e2d0
call fcn.004416b2
add dword [esp], edx
call fcn.0041b311
pop eax
mov edx, 0x57418a
push edx
call fcn.00485fb0
lea eax, [esp + 0xc]
push eax
call fcn.00486010
jmp 0x439a1b
push dword [esp + 0xc]
call fcn.0045e33d
mov edx, dword [esp + 8]
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485fb0
pop eax
push eax
call fcn.004416a0
pop edx
add eax, edx
jmp 0x439ac3
push dword [esp]
call fcn.00486170
push dword [esp + 4]
call fcn.00486170
push dword [esp + 8]
call fcn.00486170
add esp, 0x10
pop ebx
ret 4
Function at 0x43c912
Capabilities:
Query service status

Disassembly:
push ebp
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x43c918
call fcn.00486110
mov edx, dword [esp + 0x30]
lea ecx, [esp]
call fcn.00441000
lea eax, [esp + 4]
push 0xf003f
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerW
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 0
je 0x43c99f
push 0xf01ff
push dword [esp + 4]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_OpenServiceW
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 0
je 0x43c98d
lea eax, [esp + 4]
push eax
push dword [esp + 0x28]
call sub.ADVAPI32.dll_QueryServiceStatus
push dword [esp + 0x24]
call sub.ADVAPI32.dll_CloseServiceHandle
push dword [esp + 0x20]
call sub.ADVAPI32.dll_CloseServiceHandle
lea ebp, [esp + 4]
mov eax, dword [ebp + 4]
jmp 0x43c9a1
xor eax, eax
push dword [esp]
call fcn.00486170
add esp, 0x28
pop ebp
ret 4
Function at 0x43da81
Capabilities:
Terminate process

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.00486110
push dword [esp + 0x10]
push 0
push 1
call sub.KERNEL32.dll_OpenProcess
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, ebx
je 0x43daca
push 1
push dword [esp + 4]
call sub.KERNEL32.dll_TerminateProcess
and eax, eax
je 0x43dac2
mov dword [esp + 4], 1
push dword [esp]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [esp + 4]
jmp 0x43dad2
add esp, 8
pop ebx
ret 4

Function at 0x43fc90
Capabilities:
Get graphical window text

Disassembly:
push ebx
xor eax, eax
push eax
call fcn.00486110
push dword [esp + 0xc]
call fcn.004416d0
mov ebx, dword [0xb2d15c]
and ebx, ebx
jne 0x43fccc
push 0
push 0
call sub.USER32.dll_FindWindowW
mov dword [0xb2d160], eax
mov dword [0xb2d15c], 1
jmp 0x43fce1
push 2
push dword [0xb2d160]
call sub.USER32.dll_GetWindow
mov dword [0xb2d160], eax
mov ebx, dword [0xb2d160]
and ebx, ebx
je 0x43fd7b
push 0xfffffff0
push dword [0xb2d160]
call sub.USER32.dll_GetWindowLongW
mov ebx, eax
and ebx, 0x10000000
cmp ebx, 0x10000000
jne 0x43fd79
push 0xffffffec
push dword [0xb2d160]
call sub.USER32.dll_GetWindowLongW
mov ebx, eax
and ebx, 0x80
cmp ebx, 0x80
je 0x43fd79
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485f70
pop edx
push eax
push 0x100
call fcn.004835b0
lea eax, [esp + 4]
push eax
call fcn.00486010
push 0x100
push dword [esp + 4]
push dword [0xb2d160]
call sub.USER32.dll_GetWindowTextW
push dword [esp]
mov edx, 0x55d09e
pop ecx
call fcn.00441660
jne 0x43fd79
jmp 0x43fd93
jmp 0x43fd85
mov dword [0xb2d15c], 0
mov ebx, dword [0xb2d160]
and ebx, ebx
jne 0x43fca2
mov edx, dword [esp]
push edx
call fcn.00485f70
pop edx
push eax
push edx
call fcn.00485fb0
pop eax
push eax
call fcn.004416a0
pop edx
add eax, edx
jmp 0x43fdba
push dword [esp]
call fcn.00486170
add esp, 4
pop ebx
ret

Function at 0x4422b3
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x44234b
push edi
push 0xb2eaec
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0xb2d278]
test edi, edi
je 0x44231f
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x442318
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0xb2d278
call fcn.00485e5c
pop ecx
pop ecx
jmp 0x44231a
mov edi, dword [edi]
test edi, edi
jne 0x4422ef
pop ebx
mov eax, dword [0xb26e9c]
mov esi, eax
inc eax
push 0x10
push 0xb2d278
mov dword [0xb26e9c], eax
call fcn.00485e9c
pop ecx
pop ecx
push 0xb2eaec
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x442353
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push edi
call fcn.00442267
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, 0xb2eaec
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0xb2d278]
jmp 0x442384
cmp dword [esi + 0xc], edi
je 0x44238a
mov esi, dword [esi]
test esi, esi
jne 0x44237d
jmp 0x4423a2
add esi, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0xb2d278
call fcn.00485e5c
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret 4

Function at 0x443737
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x44378c
push dword [esp + 0x10]
push 0x4436b6
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0xb2d2e0]
test esi, esi
je 0x4437e5
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x443784
cmp byte [esi + 0x10], 0
je 0x443784
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x443760
jmp 0x4437e5
mov esi, dword [0xb2d2e0]
test esi, esi
je 0x4437e5
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x4437de
cmp byte [esi + 0x11], 0
je 0x4437ba
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x4437d1
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0xb2d2e0
call fcn.00485e5c
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x443799
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x45db22
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0xb2ee48]
call fcn.00485519
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x45dc22
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x45db78
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x45db70
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x45dbb8
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x45dbfa
push 0x22
pop edx
cmp cx, dx
je 0x45dbaa
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x45db9a
xor ecx, ecx
cmp word [eax], cx
je 0x45dbfa
mov ecx, eax
add eax, 2
jmp 0x45dbfc
test dx, dx
je 0x45dc02
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x45dbaa
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x45dbf0
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x45dbfa
cmp cx, dx
je 0x45dbed
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x45dbdd
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x45dbc2
jmp 0x45dbaa
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x45dc04
xor edx, edx
cmp dword [ebp], ebx
jne 0x45dc0d
test edi, edi
jne 0x45dc2a
test edx, edx
je 0x45dc12
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x45db66
test edi, edi
jne 0x45dc3b
mov eax, ebx
jmp 0x45dc3f
test esi, esi
je 0x45dc3b
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x45dc3f
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x45e393
Capabilities:
Read file on windows

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0x10], esi
jle 0x45e3e7
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push 0
push eax
mov eax, dword [esp + 0x20]
sub eax, esi
push eax
lea eax, [esi + ebp]
push eax
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x45e3d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x45e3e1
add esi, dword [esp + 0x10]
cmp esi, dword [esp + 0x18]
jl 0x45e3a6
jmp 0x45e3e5
add esi, dword [esp + 0x10]
pop ebp
pop ebx
mov eax, esi
pop esi
ret 0xc

Function at 0x45e461
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
cmp dword [esp + 0x24], 0x18
mov ebx, eax
je 0x45e520
cmp dword [esp + 0x24], 2
je 0x45e520
push 0x2000
push ebp
push dword [0xb2c63c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
jmp 0x45e4ef
cmp dword [esp + 0x18], 2
jne 0x45e50b
cmp dword [esp + 0x28], 0xffffffff
je 0x45e4b3
cmp ebp, dword [esp + 0x28]
jae 0x45e50b
add ebp, 2
test ebx, ebx
jne 0x45e4d8
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0xb2c63c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x45e50b
cmp ax, 0xd
je 0x45e4ef
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x45e49f
push dword [esp + 0x2c]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.00524740
jmp 0x45e5b2
push eax
push 0
push dword [0xb2c63c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp dword [esp + 0x28], 0xffffffff
je 0x45e53e
cmp ebp, dword [esp + 0x28]
jae 0x45e596
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45e596
cmp dword [esp + 0x18], 1
jne 0x45e596
inc ebp
test ebx, ebx
jne 0x45e583
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0xb2c63c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x45e596
cmp al, 0xd
je 0x45e531
mov byte [esi + edi], al
inc edi
dec ebx
jmp 0x45e531
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x2c]
mov byte [esi + edi], 0
push esi
jne 0x45e5ad
call fcn.00524790
jmp 0x45e5b2
call fcn.005246e0
push esi
push 0
push dword [0xb2c63c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10