joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4588b9
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x14
push 0x2c
push dword [esp + 0x20]
call fcn.0046891a
pop ecx
pop ecx
mov dword [esp], eax
test eax, eax
jne 0x4588d7
xor eax, eax
jmp 0x458ad2
push dword [esp + 0x1c]
xor ecx, ecx
push dword [esp + 0x1c]
mov word [eax], cx
add dword [esp + 8], 2
call fcn.00458875
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4588d0
lea eax, [esp]
push eax
call dword [sym.imp.PPLIB32W.DLL__SkipSpace_4]
cmp ax, 0x20
jb 0x458acf
push esi
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
push ebx
push ebp
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.PPLIB32W.DLL__GetKeyCode_4]
mov ebx, eax
test ebx, ebx
jl 0x458ab4
cmp ebx, 0x3fff
jne 0x45893e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x458a9d
mov edi, 0x100
test edi, ebx
jne 0x458978
movzx eax, bl
test byte [eax + str._AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA], 0x34
jne 0x458978
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov ecx, eax
and ebx, 0xff00
and ecx, 0xff
or ebx, ecx
test edi, eax
je 0x458978
or ebx, 0x400
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call ebp
push 0x12
movsx edi, ax
call ebp
cwde
push 0x10
mov dword [esp + 0x1c], eax
call ebp
cwde
sar eax, 0xf
and eax, 1
mov ebp, ebx
and ebp, 0x400
mov dword [esp + 0x28], eax
xor dword [esp + 0x28], ebp
je 0x4589c5
mov eax, ebx
shr eax, 0xa
not eax
push 0
and eax, 1
push 0x10
or eax, 0x100
push eax
push dword [esp + 0x38]
call esi
sar edi, 0xe
and edi, 2
mov eax, ebx
and eax, 0x800
mov dword [esp + 0x14], edi
xor dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov edi, 0x100
je 0x4589fc
mov eax, ebx
shr eax, 0xb
not eax
push 0
and eax, 1
push 0x11
or eax, edi
push eax
push dword [esp + 0x38]
call esi
mov eax, dword [esp + 0x18]
sar eax, 0xd
and eax, 4
mov ecx, ebx
and ecx, 0x1000
mov dword [esp + 0x18], eax
xor dword [esp + 0x18], ecx
mov dword [esp + 0x20], ecx
je 0x458a33
mov eax, ebx
shr eax, 0xc
not eax
push 0
and eax, 1
push 0x12
or eax, edi
push eax
push dword [esp + 0x38]
call esi
push 0
and ebx, 0xff
push ebx
push edi
mov edi, dword [esp + 0x38]
push edi
call esi
push 0x80000000
push ebx
push 0x101
push edi
call esi
xor ebx, ebx
cmp dword [esp + 0x28], ebx
je 0x458a6a
push ebx
or ebp, 0x40000
push 0x10
shr ebp, 0xa
push ebp
push edi
call esi
cmp dword [esp + 0x14], ebx
je 0x458a83
mov eax, dword [esp + 0x1c]
push ebx
or eax, 0x80000
push 0x11
shr eax, 0xb
push eax
push edi
call esi
cmp dword [esp + 0x18], ebx
je 0x458a9d
mov eax, dword [esp + 0x20]
push 0
or eax, 0x100000
push 0x12
shr eax, 0xc
push eax
push edi
call esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.PPLIB32W.DLL__SkipSpace_4]
cmp ax, 0x20
jae 0x458914
jmp 0x458acb
push str.EPRMParameter_error
push 1
push str.sendkey
push 0
call dword [sym.imp.PPLIB32W.DLL_XMessage]
add esp, 0x10
pop edi
pop ebp
pop ebx
pop esi
xor eax, eax
inc eax
add esp, 0x14
ret 8
Function at 0x45b423
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x1ac]
sub esp, 0x22c
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0x1a8], eax
push esi
mov esi, dword [ebp + 0x1b4]
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x60]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x1c01
push 1
push edi
lea eax, [ebp - 0x60]
push eax
push str.TENNEnter_new_name
push dword [esi]
call dword [sym.imp.PPLIB32W.DLL__tInput_24]
test eax, eax
jle 0x45b4e8
push ebx
lea eax, [ebp - 0x60]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [esi + 8]
xor ebx, ebx
cmp eax, ebx
je 0x45b4e7
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0x1304
push eax
call edi
cmp eax, ebx
mov dword [ebp - 0x64], eax
jle 0x45b4e7
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x133c
push dword [esi + 8]
mov dword [ebp - 0x80], 8
call edi
test eax, eax
je 0x45b4c3
mov eax, dword [ebp - 0x68]
cmp eax, dword [esi]
je 0x45b4cb
inc ebx
cmp ebx, dword [ebp - 0x64]
jl 0x45b4a2
jmp 0x45b4e7
lea eax, [ebp - 0x60]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x133d
push dword [esi + 8]
mov dword [ebp - 0x80], 1
call edi
pop ebx
mov ecx, dword [ebp + 0x1a8]
pop edi
xor ecx, ebp
pop esi
call fcn.0046890b
add ebp, 0x1ac
leave
ret 4

Function at 0x45c08a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [0x48a234], edi
jle 0x45c0dd
mov esi, dword [ebp + 8]
mov eax, dword [0x48a240]
mov ecx, dword [esi]
add eax, edi
cmp ecx, dword [eax + 0x1c]
jne 0x45c0d1
mov eax, dword [eax + 0x18]
lea ecx, [ebp - 0x1c]
push ecx
push dword [esi + 4]
mov dword [ebp - 0x1c], 8
push 0x133c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x45c0e6
inc ebx
add edi, 0x3c
cmp ebx, dword [0x48a234]
jl 0x45c0a2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
push 0x258
mov edi, 0x48a420
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
and dword [esi + 0xb0], 0
xor eax, eax
mov dword [esi + 0xc], edi
inc eax
jmp 0x45c0df
Function at 0x462c2e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
cmp dword [0x489764], ebp
je 0x462e5b
push esi
push edi
push ebp
call fcn.0045bd78
mov esi, eax
xor edi, edi
cmp esi, edi
jl 0x462e59
push ebx
push edi
push 0x3e05
push dword [0x48b024]
push dword [0x489764]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [0x48a308]
mov ecx, dword [0x48a23c]
mov ebx, esi
imul ebx, ebx, 0x18
mov dword [ebx + ecx + 8], eax
inc dword [0x48a308]
push ebp
call fcn.0045bda2
test eax, eax
jge 0x462d4a
test dword [0x4870dc], 0x80000
je 0x462cc2
cmp dword [0x48a230], edi
jle 0x462cd1
push edi
push ebp
call fcn.0045b501
test eax, eax
jge 0x462cbe
inc edi
cmp edi, dword [0x48a230]
jl 0x462ca8
jmp 0x462cd1
mov eax, edi
jmp 0x462ccd
push dword [0x489764]
call fcn.0045bda2
test eax, eax
jge 0x462cd3
xor eax, eax
mov ecx, dword [0x48a240]
imul eax, eax, 0x3c
mov edx, dword [0x48a23c]
lea eax, [eax + ecx + 0x10]
mov ecx, dword [eax]
imul ecx, ecx, 0x18
cmp dword [0x48a230], 1
mov edi, dword [ecx + edx]
jne 0x462cff
mov dword [0x489768], edi
jmp 0x462d0d
cmp edi, dword [0x489768]
jne 0x462d0d
mov dword [0x489768], ebp
push 0
push 0
mov dword [eax], esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xb
push dword [0x48a220]
call esi
push 0
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
call edi
push 0xfffffffffffffffe
call fcn.00460142
push 0
push 1
push 0xb
push dword [0x48a220]
call esi
push 1
push ebp
call edi
jmp 0x462dc8
cmp dword [0x48a22c], 1
jle 0x462dc2
cmp dword [0x48a230], 1
jne 0x462d8e
mov eax, dword [0x489764]
mov dword [0x489768], eax
cmp eax, edi
je 0x462d74
push eax
call fcn.0045bd78
test eax, eax
jge 0x462dc8
mov ecx, dword [0x48a23c]
xor eax, eax
cmp esi, edi
sete al
imul eax, eax, 0x18
mov eax, dword [eax + ecx]
mov dword [0x489768], eax
jmp 0x462dc8
push ebp
call fcn.0045bda2
cmp eax, dword [0x48a238]
je 0x462da4
mov dword [0x489768], ebp
jmp 0x462dc8
push dword [0x489768]
call fcn.0045bda2
test eax, eax
jl 0x462dc2
push dword [0x489768]
call fcn.0045bd78
test eax, eax
jge 0x462dc8
mov dword [0x489768], edi
mov eax, dword [0x48a23c]
lea eax, [ebx + eax + 4]
mov dword [0x488538], 0x480850
mov ecx, dword [eax]
mov dword [0x48a2b0], ecx
mov dword [0x48a264], ecx
mov eax, dword [eax]
pop ebx
test eax, eax
je 0x462e01
add eax, 0x584
push eax
call fcn.004651e9
mov dword [0x489764], ebp
mov eax, dword [0x489768]
test eax, eax
jne 0x462e13
cmp dword [0x48a22c], 2
jge 0x462e1b
cmp dword [0x489764], eax
jne 0x462e22
push 0
call fcn.00466c74
push 1
push 0
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [0x48a234]
test eax, eax
je 0x462e4f
cmp eax, 1
jle 0x462e46
push ebp
call fcn.0045bda2
jmp 0x462e48
xor eax, eax
push eax
push ebp
call fcn.0045b82a
push str.KCW_FocusFix1
call fcn.00466f70
pop edi
pop esi
pop ebp
ret 8
Function at 0x462e5f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x48a22c], 2
jge 0x462e7d
push 0
push dword [ebp + 8]
call fcn.00401794
push 0x6a
pop eax
jmp 0x46301d
push ebx
push edi
push dword [ebp + 0xc]
xor edi, edi
cmp dword [ebp + 0x10], edi
jne 0x462e96
call fcn.0045c037
mov ebx, eax
cmp ebx, edi
jge 0x462ebb
jmp 0x462ea1
call fcn.0045bd78
mov ebx, eax
cmp ebx, edi
jge 0x462ea8
xor eax, eax
jmp 0x46301b
add ebx, dword [ebp + 0x10]
mov eax, dword [0x48a22c]
jns 0x462eb5
lea ebx, [eax - 1]
cmp ebx, eax
jl 0x462ebb
xor ebx, ebx
push esi
cmp dword [0x48a234], edi
je 0x462ffc
mov eax, dword [0x48a230]
xor ecx, ecx
cmp eax, edi
jle 0x462ee8
mov edx, dword [0x48a240]
lea esi, [edx + 0x10]
cmp dword [esi], ebx
je 0x462f1a
inc ecx
add esi, 0x3c
cmp ecx, eax
jl 0x462edc
test dword [0x4870dc], 0x80000
je 0x462f40
test eax, eax
jle 0x462f51
mov esi, ebx
imul esi, esi, 0x18
mov eax, dword [0x48a23c]
push edi
push dword [esi + eax]
call fcn.0045b501
test eax, eax
jge 0x462f3c
inc edi
cmp edi, dword [0x48a230]
jl 0x462efd
jmp 0x462f51
imul ecx, ecx, 0x3c
mov dword [0x488538], 0x48088c
mov eax, dword [ecx + edx + 0x10]
mov ecx, dword [0x48a23c]
imul eax, eax, 0x18
push dword [eax + ecx]
jmp 0x463011
mov esi, edi
jmp 0x462f4d
push dword [0x489764]
call fcn.0045bda2
mov esi, eax
test esi, esi
jge 0x462f53
xor esi, esi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0xb
push dword [ebp + 8]
call edi
imul esi, esi, 0x3c
mov eax, dword [0x48a240]
mov eax, dword [esi + eax + 0x10]
mov ecx, dword [0x48a23c]
imul eax, eax, 0x18
push 0
push dword [eax + ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x48a230], 1
mov eax, dword [0x48a240]
lea eax, [esi + eax + 0x10]
jne 0x462fa6
mov ecx, dword [eax]
mov edx, dword [0x48a23c]
imul ecx, ecx, 0x18
mov ecx, dword [ecx + edx]
jmp 0x462fc4
mov edx, dword [eax]
mov ecx, dword [0x48a23c]
imul edx, edx, 0x18
mov edx, dword [edx + ecx]
cmp edx, dword [0x489768]
jne 0x462fca
mov edx, ebx
imul edx, edx, 0x18
mov ecx, dword [edx + ecx]
mov dword [0x489768], ecx
mov dword [eax], ebx
mov ecx, dword [0x48a23c]
push 0x40
xor esi, esi
push esi
mov eax, ebx
push esi
imul eax, eax, 0x18
push 0xfffffffffffffff6
push 0xfffffffffffffff6
push esi
push dword [eax + ecx]
call dword [sym.imp.USER32.dll_SetWindowPos]
push esi
push 1
push 0xb
push dword [ebp + 8]
call edi
push 0xfffffffffffffffe
call fcn.00460142
mov eax, dword [0x48a23c]
imul ebx, ebx, 0x18
mov dword [0x488538], 0x480864
push dword [ebx + eax]
call dword [sym.imp.USER32.dll_SetFocus]
push 0x6a
pop eax
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x465186
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x804]
push eax
push 0x400
push 0xd
push dword [0x48a224]
call esi
lea eax, [ebp - 0x804]
push eax
push 0xba60
push dword [0x48b024]
push dword [0x489764]
call esi
push dword [0x489764]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046890b
leave
ret

Function at 0x46569a
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x48a300]
add eax, 6
mov dword [0x48a31c], eax
call fcn.00457880
push 0
push dword [0x48ab14]
push 0x1003
push dword [0x48a220]
push 0xa
push 0xa
push 0xfffffffffffffff6
push 0xfffffffffffffff6
push 0x40200180
push 0x4739e8
push 0x4745e0
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push dword [0x48a2fc]
mov dword [0x48a224], eax
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xc6
push 0x4804
push 0x4c04
push 0
push 0x400
push dword [0x48a224]
push 0
call dword [sym.imp.PPLIB32W.DLL__PPxRegistExEdit_28]
push 1
push dword [0x48a224]
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x46572a
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x454]
sub esp, 0x4d4
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0x450], eax
mov eax, dword [0x4870dc]
push ebx
push esi
mov esi, dword [ebp + 0x45c]
push edi
mov ecx, 0x5000c040
test eax, 0x20000
je 0x465764
mov ecx, 0x5000c240
test eax, 0x10000000
je 0x465771
or ecx, 0x108
xor edi, edi
push edi
push dword [0x48ab14]
push 0x1f80
push dword [0x48a220]
push 0xa
push 0xa
push 0xfffffffffffffff6
push 0xfffffffffffffff6
push ecx
push 0x4739e8
push str.SysTabControl32
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
mov dword [ebp - 0x64], ebx
cmp ebx, edi
je 0x46581b
push 1
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x1334
push ebx
call edi
push 1
push 0x48a338
push dword [0x48a334]
call fcn.0044f924
push eax
push 0x30
push ebx
call edi
mov dword [esi + 8], ebx
xor ebx, ebx
cmp dword [esi + 0x10], ebx
jle 0x46581b
push 0x258
lea eax, [ebp - 0x60]
push eax
mov eax, dword [esi + 0xc]
push dword [eax + ebx*8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x60]
mov dword [ebp - 0x74], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x80], 9
mov eax, dword [eax + ebx*8]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x133e
push dword [ebp - 0x64]
call edi
inc ebx
cmp ebx, dword [esi + 0x10]
jl 0x4657db
mov ecx, dword [ebp + 0x450]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046890b
add ebp, 0x454
leave
ret 4
Function at 0x465835
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x458]
sub esp, 0x4d8
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0x454], eax
mov eax, dword [ebp + 0x464]
push ebx
push esi
mov esi, dword [ebp + 0x460]
push edi
xor ebx, ebx
xor edi, edi
cmp esi, ebx
mov dword [ebp - 0x64], eax
jge 0x465872
mov esi, dword [0x48a230]
dec esi
inc edi
cmp esi, dword [0x48a234]
mov ecx, dword [0x48a240]
cmovge esi, ebx
imul esi, esi, 0x3c
lea esi, [esi + ecx + 0x18]
cmp dword [esi], ebx
jne 0x4658a4
push edi
push eax
push 1
call fcn.0045b3a0
push 0xfffffffffffffffe
call fcn.00460142
push 1
push ebx
jmp 0x465999
mov eax, dword [esi + 0x10]
cmp eax, ebx
jne 0x4658d9
push 0x10
pop ecx
call fcn.00424f73
mov ebx, eax
mov dword [ebp - 0x60], ebx
test ebx, ebx
je 0x4658c7
mov eax, dword [esi]
mov dword [ebx], eax
test edi, edi
jne 0x4658c7
inc dword [esi + 0x10]
mov eax, dword [0x4870e0]
shr eax, 0xb
not eax
and eax, 1
mov dword [esi + 0x14], eax
jmp 0x4658f6
lea eax, [eax*8 + 8]
push eax
push dword [esi + 0xc]
push ebx
push dword [0x48b040]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebp - 0x60], eax
mov ebx, eax
test ebx, ebx
je 0x4659a5
push dword [ebp - 0x64]
call fcn.0045e5f0
mov edi, eax
test edi, edi
jne 0x465917
push 0xd
mov dword [esi + 0xc], ebx
pop eax
jmp 0x4659a7
push 0x258
lea eax, [ebp - 0x5c]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
and dword [ebp - 0x68], 0
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0x133e
push edi
mov dword [ebp - 0x80], 9
call ebx
mov eax, dword [esi + 8]
test eax, eax
je 0x465965
lea ecx, [ebp - 0x80]
push ecx
push dword [esi + 0x10]
mov dword [ebp - 0x68], edi
push 0x133e
push eax
call ebx
mov eax, dword [ebp - 0x60]
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], eax
mov dword [esi], edi
mov dword [eax + ecx*8], edi
inc dword [esi + 0x10]
test dword [0x4870e0], 0x1000
jne 0x46598e
cmp dword [esi + 8], 0
jne 0x46598e
push esi
call fcn.0046572a
push 0xfffffffffffffffe
call fcn.00460142
push 1
push 0
push dword [0x48a220]
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
mov ecx, dword [ebp + 0x454]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046890b
add ebp, 0x458
leave
ret 8
Function at 0x466598
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b4
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x258
lea ecx, [ebp - 0x4b4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
imul eax, eax, 3
push 2
pop edi
add eax, edi
push eax
xor ecx, ecx
push esi
mov word [ebp - 6], cx
call fcn.00464f3b
test eax, eax
je 0x46666f
mov eax, dword [esi + 4]
push 0x3f
pop ecx
mov word [eax], cx
add dword [esi + 4], edi
mov eax, dword [esi + 4]
xor ecx, ecx
mov word [eax], cx
movzx eax, word [ebp - 0x4b4]
lea edx, [ebp - 0x4b2]
cmp word [ebp - 0x4b4], cx
je 0x466663
push ebx
cmp ax, 0x3f
jne 0x46662b
push 0x25
pop ecx
push 0x26
mov eax, dword [esi + 4]
mov word [eax], cx
add dword [esi + 4], edi
mov eax, dword [esi + 4]
pop ecx
mov word [eax], cx
jmp 0x466655
cmp ax, 0x25
jne 0x466637
push 0x25
pop ecx
push ecx
jmp 0x466619
lea ecx, [eax - 0x41]
cmp cx, 0x19
mov ecx, dword [esi + 4]
ja 0x466652
push 0x25
pop ebx
mov word [ecx], bx
add dword [esi + 4], edi
mov ecx, dword [esi + 4]
or eax, 0x20
mov word [ecx], ax
movzx eax, word [edx]
add dword [esi + 4], edi
add edx, edi
test ax, ax
jne 0x46660e
pop ebx
mov eax, dword [esi + 4]
push 0x3f
pop ecx
mov word [eax], cx
add dword [esi + 4], edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046890b
leave
ret 8

Function at 0x46890b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x488548]
jne 0x468915
repz ret
jmp fcn.00469bec
Function at 0x46fa7d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0046a76c
and dword [ebp - 4], 0
cmp dword [0x48a144], 0
mov ebx, eax
jne 0x46fb2e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x46fbdf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x46fbdf
push eax
call fcn.0046a6fa
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x48a144], eax
call esi
push eax
call fcn.0046a6fa
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x48a148], eax
call esi
push eax
call fcn.0046a6fa
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x48a14c], eax
call esi
push eax
call fcn.0046a6fa
pop ecx
mov dword [0x48a154], eax
test eax, eax
je 0x46fb2e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0046a6fa
pop ecx
mov dword [0x48a150], eax
mov eax, dword [0x48a150]
cmp eax, ebx
je 0x46fb86
cmp dword [0x48a154], ebx
je 0x46fb86
push eax
call fcn.0046a775
push dword [0x48a154]
mov esi, eax
call fcn.0046a775
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x46fb86
test edi, edi
je 0x46fb86
call esi
test eax, eax
je 0x46fb7d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x46fb7d
test byte [ebp - 0xc], 1
jne 0x46fb86
or dword [ebp + 0x10], 0x200000
jmp 0x46fbbf
mov eax, dword [0x48a148]
cmp eax, ebx
je 0x46fbbf
push eax
call fcn.0046a775
pop ecx
test eax, eax
je 0x46fbbf
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x46fbbf
mov eax, dword [0x48a14c]
cmp eax, ebx
je 0x46fbbf
push eax
call fcn.0046a775
pop ecx
test eax, eax
je 0x46fbbf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x48a144]
call fcn.0046a775
pop ecx
test eax, eax
je 0x46fbdf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x46fbe1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f9e0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x476beb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046b49c
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40fa62
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00468e0d
mov eax, dword [eax]
push 0x4901cc
push eax
call fcn.0045bc84
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046b727
test bl, bl
je 0x40fa62
push 0x4901cc
lea ecx, [esp + 0xc]
call fcn.0046bab7
push 0x493d3c
lea ecx, [esp + 0xc]
call fcn.0046bab7
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40fa9e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046b727
jmp 0x40fb69
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40fb22
lea edx, [esp + 0x7c]
push 0x493d38
push edx
call fcn.0045bc84
add esp, 8
test eax, eax
je 0x40fb22
lea eax, [esp + 0x7c]
push 0x493d34
push eax
call fcn.0045bc84
add esp, 8
test eax, eax
je 0x40fb22
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40fab2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046b727
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x410360
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4103c2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x4103d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x476c6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x49a224]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x410508
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x410436
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046b727
xor eax, eax
jmp 0x41057f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0046b864
push esi
lea ecx, [esp + 0xc]
call fcn.0046baf3
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x41055d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push accept
call fcn.00410360
test eax, eax
jne 0x41055d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push accept
mov ecx, edi
call fcn.00410360
test eax, eax
jne 0x41055d
lea eax, [esp + 0x14]
push 0x493d50
push eax
call fcn.0045ccc0
mov esi, eax
add esp, 8
test esi, esi
jne 0x41053c
lea ecx, [esp + 0x14]
push 0x493d4c
push ecx
call fcn.0045cc40
mov esi, eax
add esp, 8
test esi, esi
jne 0x41053c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41053f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0046b814
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41044e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0046b727
xor eax, eax
jmp 0x41057f
mov byte [esi], 0
push 0x493d48
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0046b727
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4