joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442af0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffec0
mov esi, esp
mov eax, dword [0x4be784]
cmp byte [eax + 0x300], 0x2e
jne 0x442b14
mov eax, 0x442b84
call fcn.004b1c50
jmp 0x442b2a
mov edx, dword [0x4be784]
add edx, 0x300
mov eax, dword [0x4bedb0]
call fcn.004b81b0
push 0x442b88
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
mov byte [esi + 0x2c], 0
push esi
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
jmp 0x442b6d
test byte [esi], 0x10
jne 0x442b5c
lea eax, [esi + 0x2c]
push eax
call sub.kernel32.dll_DeleteFileA_1
push esi
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x442b73
cmp byte [esi + 0x2c], 0
jne 0x442b4e
push ebx
call sub.kernel32.dll_FindClose
add esp, 0x140
pop esi
pop ebx
ret
Function at 0x442f74
Capabilities:
Delete registry key

Disassembly:
push ebx
mov ebx, eax
mov ax, 0x4d
call fcn.004aa600
mov edx, dword [0x4bedd4]
mov edx, dword [edx]
call fcn.004ae1b0
mov eax, dword [0x4bedb0]
mov edx, 0x66
call fcn.004b12a8
test al, al
jne 0x442fb1
test bl, bl
je 0x4430df
push 0
call sub.user32.dll_PostQuitMessage
pop ebx
ret
mov ax, 0x4e
call fcn.004aa600
mov edx, 0x66
call fcn.004b12a8
test al, al
jne 0x442fd9
test bl, bl
je 0x4430df
push 0
call sub.user32.dll_PostQuitMessage
pop ebx
ret
call fcn.0042eae4
mov eax, dword [0x4be744]
cmp dword [eax], 0
jg 0x4430df
mov eax, dword [0x4bef80]
mov byte [eax], 1
mov ax, 0x136
call fcn.004aa600
mov dl, 3
call fcn.004ad8ec
mov eax, dword [0x4be784]
cmp byte [eax + 0x18a4], 0
jbe 0x443019
xor eax, eax
call fcn.00497d2c
mov eax, dword [0x4bebf0]
push eax
push 0x80000000
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [0x4be5a4]
push eax
push 0x80000000
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [0x4bef44]
push eax
push 0x80000000
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [0x4be9a0]
push eax
push 0x80000000
call sub.advapi32.dll_RegDeleteKeyA
push 0x4430e4
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
mov eax, dword [0x4be88c]
mov eax, dword [eax]
push eax
push 0x80000001
call sub.advapi32.dll_RegDeleteKeyA
call fcn.004429cc
test al, al
je 0x4430a9
mov eax, 0xa
call fcn.004ae058
cmp dword [0x4c12dc], 0
je 0x443083
cmp dword [0x4c12e0], 0
jne 0x443083
call fcn.00442a68
call fcn.00442a38
mov eax, dword [0x4be784]
mov byte [eax + 0x18cf], 1
call fcn.00442b90
call fcn.00442790
mov eax, dword [0x4be850]
mov byte [eax], 1
call fcn.004adbe0
push 0
push 0
push 2
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageA
pop ebx
ret
Function at 0x449aa4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x449cc5
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [0x4beb60]
mov dword [edx], eax
mov edx, dword [0x4be490]
mov dword [edx], eax
call fcn.00449954
mov eax, dword [0x4be784]
cmp byte [eax + 0x18ee], 0
je 0x449af2
push 5
mov eax, dword [0x4be9bc]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
jmp 0x449b01
push 0
mov eax, dword [0x4be9bc]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
call fcn.00441020
push 9
mov eax, dword [0x4bed90]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetSubMenu
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xf01
mov ebx, 0x42330000
mov eax, dword [0x4be7e4]
cmp byte [eax], 0
jne 0x449b34
or ebx, 0x10000000
lea eax, [ebp - 8]
push eax
mov eax, dword [0x4bf704]
push eax
push 0
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
push 0x12c
push 0x190
push 0x64
push 0x64
push ebx
push 0x449cd4
mov eax, dword [0x4bead0]
push eax
push 0
call sub.user32.dll_CreateWindowExA
mov edx, dword [0x4bed7c]
mov dword [edx], eax
push 0x4492d4
push 0xfffffffffffffffc
mov eax, dword [0x4bed7c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowLongA
mov edx, dword [0x4beb80]
mov dword [edx], eax
mov eax, dword [0x4be784]
cmp byte [eax + 0x193c], 0
je 0x449ba0
call fcn.00449808
mov eax, dword [0x4bebd4]
cmp byte [eax], 0
je 0x449bc0
push 0
push 0x89
mov eax, dword [0x4bed90]
mov eax, dword [eax]
push eax
call sub.user32.dll_DeleteMenu
jmp 0x449bd4
push 0
push 0x96
mov eax, dword [0x4bed90]
mov eax, dword [eax]
push eax
call sub.user32.dll_DeleteMenu
mov eax, dword [0x4bee68]
cmp byte [eax], 0
je 0x449bfc
mov eax, dword [0x4bee68]
cmp byte [eax], 6
je 0x449bfc
push 0
push 0xa5
mov eax, dword [0x4bed90]
mov eax, dword [eax]
push eax
call sub.user32.dll_DeleteMenu
mov eax, dword [0x4bebe0]
cmp dword [eax], 0
jne 0x449c1a
push 0
push 0xb0
mov eax, dword [0x4bed90]
mov eax, dword [eax]
push eax
call sub.user32.dll_DeleteMenu
call fcn.004281d8
call fcn.00424530
call fcn.00484fd8
mov eax, dword [0x4beb60]
mov eax, dword [eax]
call fcn.0040678c
push eax
mov eax, dword [0x4bf704]
push eax
mov eax, 0x449a38
push eax
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4c1390], eax
mov eax, 0xa
call fcn.00403010
cmp eax, 4
jge 0x449c73
push 0
push 0x1d4c
push 0xa
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetTimer
lea edx, [ebp - 0xc]
mov eax, 1
call fcn.004027e0
mov eax, dword [ebp - 0xc]
mov edx, 0x449ce0
call fcn.00404c60
je 0x449ca7
push 0
push 0
push 0x40f
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageA
jmp 0x449caf
mov eax, dword [0x4be850]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449ccc
lea eax, [ebp - 0xc]
call fcn.0040489c
ret
Function at 0x44affc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.004adcb4
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44b02c
mov edx, dword [ebp - 4]
mov ax, 3
call fcn.004acdac
jmp 0x44b1a3
fild qword [ebp + 8]
fdiv dword [0x44b1b0]
call fcn.004028f4
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0xe000
call fcn.004af060
mov dword [ebp - 0x14], eax
mov eax, 0xe000
call fcn.00402504
mov edi, eax
mov edx, 0xe000
mov eax, edi
call fcn.004066e4
mov ax, 0xfd
call fcn.004aa600
mov edx, eax
mov eax, dword [0x4bec98]
call fcn.004b81b0
mov eax, dword [0x4bec98]
xor edx, edx
call fcn.004ad8ec
mov eax, dword [ebp - 0x10]
test eax, eax
jle 0x44b140
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 1
push 0xe000
push edi
push ebx
call sub.kernel32.dll__hwrite
mov esi, eax
push ebx
call sub.kernel32.dll_FlushFileBuffers
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fild dword [ebp - 0x10]
fdivp st(1)
fmul dword [0x44b1b4]
call fcn.004028e8
mov edx, dword [0x4be344]
mov byte [edx], al
mov eax, dword [0x4be344]
mov al, byte [eax]
mov edx, dword [0x4be8d0]
cmp al, byte [edx]
je 0x44b0ec
call fcn.004b5c48
call fcn.004ae0a4
cmp esi, 0xe000
je 0x44b105
mov edx, dword [ebp - 4]
mov ax, 5
call fcn.004acdac
mov eax, dword [0x4bed48]
cmp byte [eax], 0
jne 0x44b117
cmp esi, 0xe000
je 0x44b134
push ebx
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_DeleteFileA_1
call fcn.004adbe0
mov eax, edi
call fcn.00402524
jmp 0x44b1a3
inc dword [ebp - 0xc]
dec dword [ebp - 0x18]
jne 0x44b0a0
mov eax, dword [0x4be344]
mov byte [eax], 0x64
mov eax, dword [0x4be344]
mov al, byte [eax]
mov edx, dword [0x4be8d0]
cmp al, byte [edx]
je 0x44b15e
call fcn.004b5c48
mov eax, dword [ebp - 0x14]
push eax
push edi
push ebx
call sub.kernel32.dll__hwrite
mov esi, eax
push ebx
call sub.kernel32.dll_FlushFileBuffers
push ebx
call sub.kernel32.dll_CloseHandle_1
call fcn.004adbe0
mov eax, edi
call fcn.00402524
cmp esi, dword [ebp - 0x14]
je 0x44b19f
mov edx, dword [ebp - 4]
mov ax, 5
call fcn.004acdac
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_DeleteFileA_1
jmp 0x44b1a3
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44c35c
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffd00
mov esi, eax
lea ecx, [esp + 0x200]
mov edx, dword [0x4be36c]
movzx edx, byte [edx]
mov eax, dword [0x4be854]
mov eax, dword [eax]
call fcn.004032b4
lea eax, [esp + 0x200]
mov edx, dword [0x4beadc]
call fcn.0040369c
mov edx, 0xd
mov eax, dword [0x4beadc]
cmp byte [eax], 0x20
jne 0x44c3a7
mov byte [eax], 0x30
inc eax
dec edx
jne 0x44c39f
mov eax, esp
mov edx, esi
call fcn.004b81b0
mov eax, esp
mov dl, 0x2e
call fcn.004b838c
mov edi, eax
test edi, edi
je 0x44c40d
lea eax, [esp + 0x100]
mov edx, edi
call fcn.004b81b0
mov byte [edi], 0
mov eax, dword [0x4be784]
add eax, 0x859
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4beadc]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x100]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
jmp 0x44c42c
push 0x44c440
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4beadc]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
push esp
push esi
call sub.kernel32.dll_MoveFileA
mov eax, ebx
add esp, 0x300
pop edi
pop esi
pop ebx
ret
Function at 0x44d6c4
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, eax
mov eax, dword [0x4bebe0]
cmp dword [eax], 0
je 0x44d8ab
cmp byte [esi + 0x442], 0
jge 0x44d76e
mov edx, 0x44d8b4
mov eax, esp
call fcn.004b81b0
mov bl, byte [esi + 0x442]
cmp bl, 0xff
jne 0x44d711
mov edx, 0x44d8b8
mov eax, dword [0x4beb38]
call fcn.004b81b0
jmp 0x44d75e
cmp bl, 0xfe
jne 0x44d727
mov edx, 0x44d8bc
mov eax, dword [0x4beb38]
call fcn.004b81b0
jmp 0x44d75e
movsx eax, bl
mov edx, 0x80
sub edx, eax
sub edx, 3
mov dword [esp + 0x100], edx
fild dword [esp + 0x100]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dl, 2
xor eax, eax
call fcn.004af0b0
mov edx, eax
mov eax, dword [0x4beb38]
call fcn.004b81b0
mov eax, dword [0x4beb38]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
cmp byte [esi + 0x442], 0
jne 0x44d820
mov eax, dword [esi + 0xc]
cmp dword [eax + 0x3c], 0
jne 0x44d7b8
cmp dword [eax + 0x48], 0
jne 0x44d7b8
mov edx, 0x44d8c0
mov eax, esp
call fcn.004b81b0
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0xc]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
push 0x44d8c0
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
jmp 0x44d820
mov edx, dword [0x4be784]
add edx, 0x100
mov eax, esp
call fcn.004b81b0
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0xc]
call fcn.004aed10
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, esp
call fcn.004b1914
test al, al
je 0x44d7fd
mov eax, esp
xor edx, edx
call fcn.004b0584
test al, al
je 0x44d8ab
push 0
lea edx, [esp + 4]
mov eax, esi
mov cl, 1
call fcn.00456534
test al, al
je 0x44d8ab
mov edx, esp
mov eax, dword [0x4be3a8]
call fcn.004aa39c
cmp byte [esi + 0x442], 0
jle 0x44d860
mov edx, 0x44d8b4
mov eax, esp
call fcn.004b81b0
movsx eax, byte [esi + 0x442]
add eax, 0x40
mov edx, dword [0x4beb38]
mov byte [edx], al
mov eax, dword [0x4beb38]
mov byte [eax + 1], 0
mov eax, dword [0x4beb38]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
push 1
push 0x44d8c4
lea eax, [esp + 8]
push eax
mov eax, dword [0x4bebe0]
mov eax, dword [eax]
push eax
push 0
mov eax, dword [esi]
push eax
call sub.shell32.dll_ShellExecuteA
mov edx, dword [0x4be438]
mov dword [edx], eax
mov eax, dword [0x4be438]
cmp dword [eax], 0x20
ja 0x44d8ab
mov eax, dword [0x4be438]
cmp dword [eax], 0
jbe 0x44d8ab
mov edx, dword [0x4bebe0]
mov edx, dword [edx]
mov ax, 7
call fcn.004acdac
add esp, 0x104
pop esi
pop ebx
ret
Function at 0x44d8c8
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
mov eax, ebx
call fcn.0044f5d0
test al, al
je 0x44da53
mov eax, dword [ebx + 0xc]
push dword [eax + 0x14]
push dword [eax + 0x10]
xor eax, eax
call fcn.004adfd4
test al, al
je 0x44da53
mov edx, dword [0x4be784]
add edx, 0x100
mov eax, esp
call fcn.004b81b0
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0xc]
call fcn.004aed10
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, esp
call fcn.004b1914
test al, al
je 0x44d980
mov edx, dword [0x4be784]
add edx, 0x100
mov eax, esp
call fcn.004b81b0
push 0x44da5c
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0xc]
call fcn.004aed10
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, esp
call fcn.004b1914
test al, al
je 0x44d980
mov eax, esp
xor edx, edx
call fcn.004b0584
test al, al
je 0x44da53
push 4
mov ax, word [ebx + 0x424]
call fcn.004b1cb8
mov edx, eax
lea ecx, [esp + 4]
mov eax, dword [ebx + 0xc]
call fcn.00419530
test al, al
je 0x44da53
push 1
push 0x44da60
push 0x44da60
lea eax, [esp + 0xc]
push eax
push 0
mov eax, dword [ebx]
push eax
call sub.shell32.dll_ShellExecuteA
mov edx, dword [0x4be438]
mov dword [edx], eax
mov eax, dword [0x4be438]
cmp dword [eax], 0x20
ja 0x44da03
mov eax, dword [0x4be438]
cmp dword [eax], 0
jbe 0x44da03
mov edx, esp
mov ax, 7
call fcn.004acdac
push esp
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x44da53
mov edx, esp
mov ax, 4
call fcn.004acdac
jmp 0x44da53
mov eax, 0xfa
call fcn.004ae058
mov eax, dword [0x4bef84]
mov byte [eax], 1
mov ax, 0x16
call fcn.004aa600
mov edx, esp
call fcn.004ae1b0
mov eax, dword [0x4bedb0]
mov edx, 0x13
call fcn.004b12a8
cmp al, 1
jne 0x44da53
push esp
call sub.kernel32.dll_DeleteFileA_1
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x44da53
mov edx, esp
mov ax, 4
call fcn.004acdac
add esp, 0x100
pop ebx
ret

Function at 0x44ec28
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x4be784]
cmp byte [eax + 0x193c], 0
jne 0x44ec5f
mov eax, dword [0x4be8e4]
cmp dword [eax], 0
je 0x44ecd3
mov eax, dword [0x4be8e4]
mov eax, dword [eax]
push eax
call sub.user32.dll_DestroyWindow
mov eax, dword [0x4be8e4]
xor edx, edx
mov dword [eax], edx
pop ebx
ret
mov eax, dword [0x4be8e4]
cmp dword [eax], 0
jne 0x44eca5
call fcn.00475d4c
push 0
mov eax, dword [0x4beacc]
movzx eax, byte [eax]
inc eax
push eax
mov eax, dword [0x4becac]
movsx eax, word [eax]
push eax
mov eax, dword [0x4beba8]
movzx eax, byte [eax]
add eax, 2
push eax
mov eax, dword [0x4be49c]
movsx eax, word [eax]
push eax
mov eax, dword [0x4be8e4]
mov eax, dword [eax]
push eax
call sub.user32.dll_MoveWindow
mov eax, dword [0x4be744]
cmp dword [eax], 0
jle 0x44ecc4
test bl, bl
je 0x44ecd3
push 4
mov eax, dword [0x4be8e4]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
jmp 0x44ecd3
push 0
mov eax, dword [0x4be8e4]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x44f47c
Capabilities:
Delete file

Disassembly:
push ebx
push esi
mov esi, eax
mov ebx, dword [esi + 0xc]
mov eax, dword [ebx + 0x98]
test eax, eax
je 0x44f4af
push 0x4000
mov edx, dword [ebx + 0x9c]
push edx
push eax
call sub.kernel32.dll_VirtualFree_1
xor eax, eax
mov dword [ebx + 0x9c], eax
xor eax, eax
mov dword [ebx + 0x98], eax
cmp byte [ebx + 0xa1], 0
je 0x44f4dc
mov eax, dword [ebx + 8]
test eax, eax
je 0x44f4ca
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebx + 8], eax
mov ax, word [ebx + 0x92]
call fcn.004b1cb8
push eax
call sub.kernel32.dll_DeleteFileA_1
mov dl, 1
mov eax, ebx
call fcn.00418a58
mov byte [ebx + 0xa1], 0
mov word [ebx + 0x94], 0
mov byte [ebx + 0x96], 0
cmp byte [esi + 0x443], 0
je 0x44f50c
mov eax, esi
call fcn.0046ee24
mov byte [esi + 0x443], 0
mov eax, esi
call fcn.0044f57c
mov byte [esi + 0x438], 1
mov eax, dword [esi + 0xc]
movsx eax, word [eax + 0x92]
mov edx, dword [0x4bec7c]
cmp eax, dword [edx]
jne 0x44f53a
call fcn.00427d08
mov eax, dword [0x4bee6c]
mov byte [eax], 1
pop esi
pop ebx
ret
Function at 0x450960
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd0
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
mov esi, dword [0x4bedb0]
mov ebp, 0x4c16f0
mov eax, ebp
call fcn.00403624
call fcn.00411380
mov edx, eax
mov eax, ebp
call fcn.004035b8
call fcn.00402ca8
mov eax, dword [0x4bed48]
cmp byte [eax], 0
je 0x4509ae
mov edx, 0x450bd4
mov eax, ebp
call fcn.00404e58
call fcn.00402ca8
mov eax, ebp
call fcn.00403624
cmp ebx, edi
jae 0x4509d7
sub edi, ebx
mov dword [esp + 4], edi
xor eax, eax
mov dword [esp + 8], eax
fild qword [esp + 4]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004b21b4
jmp 0x4509e3
mov edx, 0x450be8
mov eax, esi
call fcn.004b81b0
mov edx, esi
mov eax, dword [0x4beb38]
call fcn.004b81b0
mov ax, 0x251
call fcn.004aa600
mov edx, dword [0x4beb38]
call fcn.004ae1b0
mov edx, esi
mov eax, ebp
call fcn.004035b8
call fcn.00403624
test ebx, ebx
jbe 0x450a81
mov dword [esp + 4], ebx
xor eax, eax
mov dword [esp + 8], eax
fild qword [esp + 4]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004b21b4
mov edx, esi
mov eax, ebp
call fcn.004035b8
call fcn.00402ca8
mov ax, 0x33a
call fcn.004aa600
mov edx, eax
mov eax, ebp
call fcn.004035b8
call fcn.00402ca8
mov edx, 0x450bf4
mov eax, ebp
call fcn.00404e58
mov edx, dword [0x4be784]
movzx edx, word [edx + 0x17bc]
call fcn.0040357c
mov edx, 0x450c18
call fcn.00404e58
call fcn.00403624
mov eax, dword [0x4be784]
cmp byte [eax + 0x1880], 0
je 0x450b53
mov eax, dword [esp]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
fild qword [esp + 4]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004b21b4
mov edx, eax
mov eax, ebp
call fcn.004035b8
push eax
mov ax, 0x253
call fcn.004aa600
mov edx, eax
pop eax
call fcn.004035b8
call fcn.00403624
cmp dword [esp], 0
jbe 0x450b53
mov edx, 0x450c2c
mov eax, ebp
call fcn.00404e58
call fcn.00402ca8
mov eax, dword [0x4be784]
cmp byte [eax + 0x1938], 0
je 0x450b42
mov eax, dword [0x4be784]
cmp byte [eax + 0x1dfa], 0
jne 0x450b16
mov edx, 0x450c64
mov eax, ebp
call fcn.00404e58
call fcn.00402ca8
jmp 0x450b53
lea eax, [esp + 0xc]
mov edx, dword [0x4be784]
add edx, 0x1dfa
mov ecx, 0x21
call fcn.00403678
lea edx, [esp + 0xc]
mov eax, ebp
call fcn.00403584
call fcn.00402ca8
jmp 0x450b53
mov edx, 0x450c74
mov eax, ebp
call fcn.00404e58
call fcn.00402ca8
mov eax, ebp
call fcn.00402d90
mov edx, dword [0x4be784]
add edx, 0x500
mov eax, esi
call fcn.004b81b0
push 0x450c90
push esi
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4be784]
add eax, 0x100
push eax
push esi
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4becb4]
mov eax, dword [eax]
push eax
push esi
call sub.kernel32.dll_lstrcatA
push 0x450c94
push esi
call sub.kernel32.dll_lstrcatA
push 3
push esi
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jae 0x450bc4
mov edx, dword [0x4be784]
add edx, 0x500
mov ax, 7
call fcn.004acdac
add esp, 0x30
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4538e0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
call fcn.004b4058
test al, al
je 0x453a42
mov byte [ebx + 0x44c], 1
push 0
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [ebx + 0x48]
push eax
call sub.user32.dll_ShowWindow
push esp
mov eax, dword [ebx]
push eax
call sub.user32.dll_GetClientRect
push 0
mov eax, dword [0x4bf704]
push eax
push 0x1e241
mov eax, dword [ebx]
push eax
movsx edi, word [ebx + 0x58]
mov eax, dword [esp + 0x1c]
sub eax, edi
mov edx, dword [0x4be3f0]
movzx edx, byte [edx]
mov ebp, edx
add ebp, ebp
add eax, ebp
push eax
mov esi, dword [0x4be3f0]
movzx esi, byte [esi]
add ebp, dword [esp + 0x1c]
push ebp
mov eax, dword [0x4be3f0]
movzx eax, byte [eax]
sub edi, eax
push edi
mov eax, dword [0x4be3f0]
neg esi
push esi
push 0x40c80000
mov ax, 0x371
call fcn.004aa600
push eax
mov eax, dword [0x4be740]
push eax
push 0x80
call sub.user32.dll_CreateWindowExA
mov dword [ebx + 0x1e4], eax
mov eax, dword [ebx + 0xc]
movsx eax, word [eax + 0x92]
push eax
push 0xffffffffffffffeb
mov eax, dword [ebx + 0x1e4]
push eax
call sub.user32.dll_SetWindowLongA
mov eax, dword [ebx + 0x1e4]
push eax
call sub.user32.dll_GetDC
mov esi, eax
mov dword [ebx + 0x1e8], esi
push esi
call sub.gdi32.dll_CreateCompatibleDC
mov edi, eax
mov dword [ebx + 0x1ec], edi
mov eax, dword [0x4be838]
mov eax, dword [eax]
push eax
push edi
call sub.gdi32.dll_SelectObject
mov dword [ebx + 0x1f0], eax
push 4
mov eax, dword [ebx + 0x1e4]
push eax
call sub.user32.dll_ShowWindow
push 8
call sub.gdi32.dll_GetStockObject
push eax
mov eax, dword [ebx + 0x1e8]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [0x4be8b8]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebx + 0x1e8]
push eax
call sub.gdi32.dll_SelectObject
push 8
call sub.gdi32.dll_GetStockObject
push eax
mov eax, dword [ebx + 0x1ec]
push eax
call sub.gdi32.dll_SelectObject
push 0
push 0x10
push 0x113
mov eax, dword [ebx]
push eax
call sub.user32.dll_PostMessageA
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45aad8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
mov byte [ebp - 1], 0
mov eax, dword [0x4bead4]
mov eax, dword [eax]
call fcn.004adcb4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x45ab12
mov edx, dword [0x4bead4]
mov edx, dword [edx]
mov ax, 3
call fcn.004acdac
jmp 0x45acd3
mov eax, dword [esi + 0xc]
mov edx, dword [eax + 0x1a0]
call dword [edx + 0x10]
test al, al
je 0x45acd3
mov ax, 0xfc
call fcn.004aa600
mov edx, eax
mov eax, dword [0x4bec98]
call fcn.004b81b0
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0xc]
call fcn.004aed10
mov edx, eax
mov eax, dword [0x4bec98]
mov ecx, 0x3c
call fcn.004b820c
mov eax, dword [0x4be784]
movzx eax, byte [eax + 0x188c]
lea eax, [eax + eax*4]
mov edx, dword [0x4be720]
lea eax, [edx + eax]
push eax
mov eax, dword [0x4bec98]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4bec98]
xor edx, edx
call fcn.004ad8ec
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, 0xe000
call fcn.00402504
mov dword [ebp - 0x20], eax
mov eax, dword [0x4be84c]
mov byte [eax], 1
push 0xe000
lea edx, [ebp - 0x18]
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0x20]
mov ebx, dword [eax + 0x1a0]
call dword [ebx + 0x18]
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll__hwrite
mov edi, eax
cmp ebx, edi
je 0x45abee
mov edx, dword [0x4bead4]
mov edx, dword [edx]
mov ax, 5
call fcn.004acdac
mov eax, dword [0x4bed48]
cmp byte [eax], 0
jne 0x45abfc
cmp ebx, edi
je 0x45ac30
mov eax, dword [ebp - 0x20]
call fcn.00402524
mov eax, dword [esi + 0xc]
mov edx, dword [eax + 0x1a0]
call dword [edx + 0x14]
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x4bead4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_DeleteFileA_1
call fcn.004adbe0
jmp 0x45acd3
mov dword [ebp - 0x28], ebx
xor eax, eax
mov dword [ebp - 0x24], eax
fild qword [ebp - 0x28]
fild qword [ebp - 0x10]
faddp st(1)
fistp qword [ebp - 0x10]
wait
mov eax, dword [esi + 0xc]
fild qword [eax + 0x10]
fild qword [ebp + 8]
fsubp st(1)
fadd dword [0x45ace0]
fild qword [ebp - 0x10]
fdivrp st(1)
fmul dword [0x45ace4]
call fcn.004028e8
mov edx, dword [0x4be344]
mov byte [edx], al
mov eax, dword [0x4be344]
mov al, byte [eax]
mov edx, dword [0x4be8d0]
cmp al, byte [edx]
je 0x45ac83
call fcn.004b5c48
mov eax, dword [0x4be354]
inc word [eax]
mov eax, dword [0x4be354]
movzx eax, word [eax]
mov ecx, 0xa
xor edx, edx
div ecx
test edx, edx
jne 0x45aca5
call fcn.004ae0a4
test ebx, ebx
jne 0x45aba8
mov eax, dword [ebp - 0x20]
call fcn.00402524
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esi + 0xc]
mov edx, dword [eax + 0x1a0]
call dword [edx + 0x14]
call fcn.004adbe0
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8