joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493130
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x98]
sub esp, 0x38
push ebx
push ebp
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x49326b
mov ecx, dword [esi + 0x70]
xor eax, eax
lea edx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
push edx
push eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp dword [esi + 0xf8], eax
mov ebx, ecx
je 0x4931aa
mov eax, dword [esi + 0xf8]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
lea ecx, [esp + 0x10]
push ecx
push eax
call edx
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x14]
cmp ecx, eax
jge 0x493244
mov edx, dword [esp + 0x24]
push 1
mov eax, edi
sub eax, dword [esp + 0x10]
mov ecx, ebx
sub eax, dword [esi + 0x164]
sub ecx, edx
push ecx
mov ecx, edi
sub ecx, eax
push ecx
push edx
push eax
mov eax, dword [esi + 0x2c]
push eax
mov dword [esp + 0x48], ebp
mov dword [esp + 0x50], edi
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [esi + 0x2c]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x164]
add edx, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
push 1
sub ebx, eax
push ebx
sub edi, edx
sub edi, ebp
push edi
push eax
mov eax, dword [esi + 0x98]
push ebp
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [esi + 0x110]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x49326b
mov edx, dword [esi + 0x110]
push 1
push 0x32
push 2
push edx
call dword [sym.imp.USER32.dll_SetScrollPos]
pop edi
pop ebp
pop ebx
add esp, 0x38
ret
mov eax, dword [esi + 0x2c]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x24]
mov ecx, dword [esi + 0x98]
push 1
sub ebx, eax
push ebx
sub edi, ebp
push edi
push eax
push ebp
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop ebp
pop ebx
add esp, 0x38
ret

Function at 0x494440
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x5940b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi]
lea eax, [esp + 0xc]
push eax
call fcn.00481430
mov dword [esp + 0x18], 0
mov eax, dword [esi + 4]
lea edi, [esp + 0xc]
call fcn.0047da50
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4944ba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x4985f0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x58b1a9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], 0
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov ebx, 1
mov dword [esp + 0x24], ebx
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [esi], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x18], ebx
call fcn.00498760
lea edi, [esp + 0x10]
mov byte [esp + 0x24], 2
call fcn.00480f90
mov byte [esp + 0x24], bl
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x49869d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi]
sub eax, 0x10
mov ecx, ebx
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, 0x1000
or eax, ecx
jge 0x4986bf
mov ecx, 0x1000
mov eax, esi
call fcn.00481530
mov edi, dword [esp + 0x10]
mov eax, dword [esi]
mov ecx, dword [esp + 0x34]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x30]
mov edx, dword [edx]
push edi
push 0x1000
push eax
push 0x5adcfc
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [esi]
test ecx, ecx
jne 0x4986ef
xor eax, eax
jmp 0x498705
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4986f4
sub eax, ebx
sar eax, 1
js 0x49874d
cmp eax, dword [ecx - 8]
jg 0x49874d
mov dword [ecx - 0xc], eax
mov ecx, dword [esi]
mov word [ecx + eax*2], 0
lea eax, [edi - 0x10]
mov byte [esp + 0x24], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x498736
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 0xc
push 0x80070057
call fcn.00473d10
int3
Function at 0x498760
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x58b159
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor edi, edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x18], edi
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0x28], edi
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
mov dword [esp + 0x18], 1
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
mov dword [esp + 0x28], 1
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x4987f9
mov ecx, 0x104
lea eax, [esp + 0x14]
call fcn.00481530
mov esi, dword [esp + 0x14]
push esi
push 1
push edi
push 0x801a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, edi
jge 0x498827
cmp dword [esi - 8], edi
jl 0x49881d
mov dword [esi - 0xc], edi
mov word [esi], di
jmp 0x4988cf
push 0x80070057
call fcn.00473d10
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x14]
call fcn.00482d20
push eax
mov ecx, 0x5aeb10
call fcn.0047b7f0
mov byte [esp + 0x17], al
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x498866
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x13], 0
je 0x4988b7
mov esi, dword [esi - 0xc]
lea eax, [esi - 1]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x14]
call fcn.0047dae0
lea edi, [esp + 0x14]
mov byte [esp + 0x28], 2
call fcn.00480f90
mov byte [esp + 0x28], 1
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4988b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x14]
push esi
push str._sKingsoftkgameboxwebcfgwebcfg.ini
mov edi, ebp
call fcn.00481690
mov ecx, dword [ebp]
add esp, 8
call fcn.004b4630
lea eax, [esi - 0x10]
mov byte [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4988f0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 4
Function at 0x498960
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x588158
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00498dc0
test eax, eax
je 0x4989d3
push edi
lea esi, [esp + 0x10]
call fcn.00498ea0
mov dword [esp + 0x18], 0
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4989e7
lea eax, [esi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4989d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
lea ecx, [esp + 0xc]
push ecx
mov ecx, edi
call fcn.004990e0
mov edi, eax
lea eax, [esi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x498a19
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x498dc0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x588158
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00498f70
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x498e46
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x498e30
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
add esi, 4
lea ecx, [esp + 0xc]
push esi
push ecx
call fcn.004b3410
mov esi, eax
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x498e81
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x49b180
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x58d9a5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], 1
mov eax, dword [esi + 0x60]
test eax, eax
je 0x49b1e5
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x49b1d4
mov eax, dword [esi + 0x60]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x60], 0
lea edx, [esi + 0x2c]
push edx
call fcn.0049b0c0
lea eax, [esi + 0x20]
mov byte [esp + 0x14], 0
call fcn.0049ca00
push esi
mov dword [esp + 0x18], 0xffffffff
call fcn.00494f20
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x49dbc0
Capabilities:
Hide graphical window

Disassembly:
test esi, esi
je 0x49dc8b
lea eax, [esi - 0x428]
test eax, eax
je 0x49dc8b
cmp dword [esi + 0x10], 0
je 0x49dc8b
cmp dword [esi + 4], 0
je 0x49dc42
cmp dword [esi + 8], 1
mov dword [esi + 4], 0
jne 0x49dc0e
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 0x24], 0
mov dword [esi + 0x10], 0
ret 4
mov ecx, dword [esi + 0x18]
push 0
push 0
push 0
mov dword [eax + 0x28], ecx
mov dword [eax + 0x378], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov dword [esi + 0x24], 0
mov dword [esi + 0x10], 0
ret 4
mov edx, dword [esi + 0x14]
push edi
lea edi, [eax + 4]
mov eax, dword [edi]
push edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi]
push 1
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
mov eax, 0x80000
call fcn.004448e0
cmp dword [esp + 8], 0
jne 0x49dc7c
push 1
lea eax, [esi + 0x28]
push edi
call fcn.00477830
pop edi
mov dword [esi + 0x24], 0
mov dword [esi + 0x10], 0
ret 4

Function at 0x49f610
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
test byte [esi + 0x14], 2
je 0x49f669
lea eax, [esp]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 4]
sub ecx, eax
je 0x49f659
mov edx, dword [esp + 8]
mov ecx, dword [esp]
sub edx, ecx
je 0x49f659
mov edx, dword [esi + 0x10]
push 0x11
push 0
push 0
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub ecx, edx
push ecx
push edi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
add esp, 0x14
ret
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
add esp, 0x14
ret
Function at 0x49f670
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x18
cmp dword [esp + 0x1c], 1
push ebp
mov ebp, dword [esp + 0x24]
jne 0x49f699
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
mov dword [esi + 0x18], ebp
pop ebp
add esp, 0x18
ret 8
lea ecx, [esp + 8]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x14]
sub edx, dword [esp + 0xc]
je 0x49f70a
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 8]
je 0x49f70a
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x49f700
or byte [esi + 0x14], 4
mov al, byte [esi + 0x14]
test al, 2
jne 0x49f6f7
or al, 2
push esi
mov ecx, edi
mov byte [esi + 0x14], al
call fcn.0049f730
mov ecx, dword [esi + 8]
push 8
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x18], ebp
pop ebp
add esp, 0x18
ret 8
cmp dword [esi + 0x18], ebp
je 0x49f700
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], ebp
pop ebp
add esp, 0x18
ret 8
mov edx, dword [esi + 8]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
pop ebp
add esp, 0x18
ret 8

Function at 0x49fc30
Capabilities:
Hide graphical window

Disassembly:
push ecx
cmp byte [esi + 0xd], 0
je 0x49fc87
and byte [esi + 0x14], 1
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x49fc5f
or byte [esi + 0x14], 4
test eax, 0x20000000
mov cl, byte [esi + 0x14]
jne 0x49fc5f
or cl, 2
mov byte [esi + 0x14], cl
test byte [esi + 0x14], 2
je 0x49fc7b
push esi
mov ecx, edi
call fcn.0049f730
mov eax, dword [esi + 8]
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ecx
ret
mov ecx, dword [esi + 8]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop ecx
ret
Function at 0x4a28d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5881c8
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x20]
xor esi, esi
mov dword [esp + 0x18], esi
mov dword [ebx], vtable.CBkWindow.0
call fcn.004a29f0
mov dword [ebx + 4], eax
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], esi
lea edi, [ebx + 0x14]
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
mov dword [ebx + 0x24], esi
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x38], esi
mov dword [ebx + 0x3c], esi
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], esi
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [ebx + 0x48], eax
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [ebx + 0x4c], eax
or eax, 0xffffffff
push edi
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x58], esi
mov dword [ebx + 0x5c], esi
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x64], esi
mov dword [ebx + 0x9c], esi
mov dword [ebx + 0xa0], esi
mov dword [ebx + 0xa4], esi
mov dword [ebx + 0xa8], 1
mov dword [ebx + 0xac], esi
mov dword [ebx + 0xb0], esi
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov eax, ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x4a4900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58a440
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x34]
xor esi, esi
push 0x50
push esi
push eax
mov dword [esp + 0x34], esi
call fcn.005695a0
mov ecx, dword [esp + 0x3c]
add esp, 0xc
xor ebp, ebp
add ecx, 0xdc
mov dword [esp + 0x18], esi
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x30]
push 0x5ae564
lea edx, [esp + 0x20]
push edx
push eax
lea ebx, [esp + 0x24]
call fcn.00440fd0
mov byte [esp + 0x28], 1
mov ecx, dword [eax]
lea eax, [ecx - 0x10]
lea esi, [edi - 0x10]
cmp eax, esi
je 0x4a49d6
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x4a49c5
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x4a49c5
call fcn.00481090
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x4a49bc
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
lea edi, [ebx + 0x10]
mov dword [esp + 0x14], edi
jmp 0x4a49d6
mov ebx, dword [ecx - 0xc]
push ecx
lea eax, [esp + 0x18]
call fcn.00480ff0
mov edi, dword [esp + 0x14]
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4a49fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [edi - 0xc], 0
je 0x4a4a19
cmp ebp, 0x14
jae 0x4a4a24
push edi
call fcn.00567862
mov ecx, dword [esp + 0x38]
add esp, 4
mov dword [ecx + ebp*4], eax
add ebp, 1
cmp dword [esp + 0x18], 0
jg 0x4a4967
lea eax, [edi - 0x10]
mov dword [esp + 0x28], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4a4a48
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
Function at 0x4a7d90
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
cmp ebx, 0xf
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov esi, ecx
mov ebp, 1
jne 0x4a7dc6
mov dword [esi + 0xac], ebp
mov dword [edi], 0
cmp dword [esi + 0xac], 0
je 0x4a7e15
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret 0x14
cmp ebx, 2
jne 0x4a7e34
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
push eax
push ecx
mov dword [esi + 0xac], ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
test ebx, ebx
je 0x4a7df9
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a7df9
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [edi], 0
cmp dword [esi + 0xac], 0
jne 0x4a7dbd
mov ebx, dword [esp + 0x18]
cmp dword [esi + 0xac], 0
jne 0x4a7dbd
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push edi
push eax
push ecx
push ebx
push edx
mov ecx, esi
call fcn.004a10d0
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
cmp ebx, 0x47
jne 0x4a7e50
mov edx, dword [esp + 0x20]
push edx
mov eax, esi
mov dword [esi + 0xac], ebp
call fcn.004a7e70
jmp 0x4a7dae
cmp ebx, 0x18
jne 0x4a7e0c
mov eax, dword [esp + 0x1c]
mov dword [esi + 0xac], ebp
call fcn.004a7f90
jmp 0x4a7dae
Function at 0x4b2370
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [ebx + 4]
push ebp
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
xor ebp, ebp
cmp dword [ebx + 0x2c0], ebp
mov dword [esp + 0x10], ebp
je 0x4b239a
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [ebx + 0x2c0], ebp
mov edi, dword [ebx + 0x2b4]
cmp edi, ebp
je 0x4b248b
call fcn.004799d0
mov esi, eax
test esi, esi
mov edi, 1
je 0x4b2436
mov edx, dword [esi]
mov eax, dword [edx + 0x2c]
push 2
push 0
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x38]
mov ecx, esi
call eax
test eax, eax
je 0x4b23d9
push edi
push ebx
call fcn.004b1de0
mov ecx, dword [ebx + 0x2b4]
cmp ecx, dword [ebx + 0x2b0]
jne 0x4b2436
movzx edx, word [esp + 0x34]
movzx eax, word [esp + 0x30]
mov ecx, dword [esp + 0x2c]
shl edx, 0x10
or edx, eax
push edx
push ecx
push 0x202
mov ecx, esi
call fcn.00479a50
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4b2429
cmp word [eax], bp
je 0x4b2429
push edi
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4b2436
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4b2436
mov dword [esp + 0x10], edi
mov ebp, eax
cmp dword [esp + 0x10], 0
mov dword [ebx + 0x2b4], 0
je 0x4b248b
mov eax, dword [ebx + 4]
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edx, dword [esi]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 8]
mov ecx, esi
mov dword [esp + 0x20], ebp
call eax
mov ecx, dword [ebx + 4]
push ecx
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push ecx
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 0xc
Function at 0x4b2810
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x58e008
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x5eb3c0]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0xc4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xd4]
xor ebx, ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0x14], ebx
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov esi, ecx
mov ecx, 0x5f7780
mov dword [esp + 0x18], ebp
call edx
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0xcc], ebx
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
mov edi, 1
mov dword [esp + 0x14], edi
je 0x4b2975
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0xc4], bl
mov dword [esp + 0x70], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x5c], 0x67452301
mov dword [esp + 0x60], 0xefcdab89
mov dword [esp + 0x64], 0x98badcfe
mov dword [esp + 0x68], 0x10325476
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.004381e0
mov dword [esp + 0xcc], edi
mov eax, dword [esp + 0x3c]
mov esi, 0x10
cmp dword [esp + 0x50], esi
jae 0x4b28fc
lea eax, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x58]
call fcn.004b29a0
lea edi, [esp + 0x1c]
lea eax, [esp + 0x54]
call fcn.004b3120
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0xd8], 2
call fcn.004382b0
mov byte [esp + 0xcc], 1
cmp dword [esp + 0x34], esi
jb 0x4b2947
mov eax, dword [esp + 0x20]
push eax
call fcn.00563626
add esp, 4
cmp dword [esp + 0x4c], ebx
je 0x4b2962
cmp dword [esp + 0x50], esi
mov edx, dword [esp + 0x3c]
jae 0x4b295b
lea edx, [esp + 0x3c]
mov ebx, ebp
call fcn.00479660
cmp dword [esp + 0x50], esi
jb 0x4b2975
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00563626
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0xc4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.00564207
add esp, 0xbc
ret