joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b2403
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push 0x968
mov eax, 0x504fe4
call fcn.004e6cea
mov ebx, edx
mov esi, ecx
and dword [ebp - 0x968], 0
mov eax, dword [0x548750]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x974], esi
mov dword [ebp - 0x964], eax
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4b2457
lea eax, [ebp - 0x964]
mov ecx, esi
push eax
call fcn.0040291d
jmp 0x4b265a
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x62c], ax
lea eax, [ebp - 0x62a]
push eax
call fcn.004deff0
add esp, 0xc
lea eax, [ebp - 0x62c]
push str.cfg.ini
push edi
push 0x5256b4
push eax
call fcn.004143d4
add esp, 0x10
lea ecx, [ebp - 0x62c]
call fcn.00404c46
test eax, eax
je 0x4b25a6
xor eax, eax
mov dword [ebp - method.CIniFile.virtual_0], vtable.CIniFile.0
mov dword [ebp - 0x96c], eax
lea ecx, [ebp - 0x970]
lea eax, [ebp - 0x62c]
push eax
call fcn.00433da9
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.004deff0
add esp, 0xc
lea eax, [ebp - 0x21c]
push dword [ebp - 0x96c]
push 0x104
push eax
push 0x512700
push str.main
push 0x513960
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x968]
jne 0x4b2514
sub ecx, edx
sar ecx, 1
je 0x4b2597
mov eax, dword [0x548750]
mov dword [ebp - 0x960], eax
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 3
push eax
push edi
lea eax, [ebp - 0x960]
push 0x5256b4
push eax
call fcn.0040306c
mov ecx, dword [ebp - 0x960]
add esp, 0x10
call fcn.00404c46
test eax, eax
je 0x4b258c
lea eax, [ebp - 0x960]
mov ecx, esi
push eax
call fcn.0040291d
lea ecx, [ebp - 0x960]
call fcn.00403080
lea ecx, [ebp - 0x970]
call fcn.00433ed4
jmp 0x4b265a
lea ecx, [ebp - 0x960]
call fcn.00403080
lea ecx, [ebp - 0x970]
mov byte [ebp - 4], 1
call fcn.00433ed4
lea ecx, [ebp - 0x95c]
call fcn.00411306
lea eax, [ebp - 0x95c]
mov byte [ebp - 4], 4
push eax
push ebx
call fcn.004b39b4
test eax, eax
jne 0x4b25e0
lea eax, [ebp - 0x964]
mov ecx, esi
push eax
call fcn.0040291d
mov dword [ebp - 0x968], 1
jmp 0x4b264b
mov eax, dword [ebp - 0x934]
xor ecx, ecx
cmp dword [eax - 8], ecx
je 0x4b25c6
mov ecx, dword [0x548750]
mov dword [ebp - 0x960], ecx
push eax
push edi
lea eax, [ebp - 0x960]
mov byte [ebp - 4], 5
push 0x5256b4
push eax
call fcn.0040306c
mov ecx, dword [ebp - 0x960]
add esp, 0x10
call fcn.00404c46
test eax, eax
mov ecx, esi
lea eax, [ebp - 0x960]
jne 0x4b2630
lea eax, [ebp - 0x964]
push eax
call fcn.0040291d
lea ecx, [ebp - 0x960]
mov dword [ebp - 0x968], 1
call fcn.00403080
lea ecx, [ebp - 0x95c]
mov byte [ebp - 4], 1
call fcn.00410abb
lea ecx, [ebp - 0x964]
call fcn.00403080
mov eax, esi
call fcn.004e6c99
ret
Function at 0x4b266d
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
push 0x484
mov eax, 0x50502d
call fcn.004e6cea
mov dword [ebp - 0x474], edx
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor eax, 0x10
jne 0x4b289a
push 0x206
xor ebx, ebx
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
mov dword [ebp - 0x478], ebx
push ebx
push eax
call fcn.004deff0
lea edx, [ebp - 0x218]
add esp, 0xc
mov ecx, esi
sub edx, esi
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4b26c2
lea ecx, [ebp - 0x218]
sub ecx, 2
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
cmp ax, bx
jne 0x4b26da
mov eax, dword [0x52fa74]
mov dword [ecx], eax
mov ax, word [0x52fa78]
mov word [ecx + 4], ax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4b289a
test byte [ebp - 0x468], 0x10
je 0x4b287d
lea eax, [ebp - 0x43c]
push eax
push 0x522f54
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4b287d
lea eax, [ebp - 0x43c]
push eax
push 0x52a994
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4b287d
lea eax, [ebp - 0x43c]
push eax
call fcn.004d9ace
pop ecx
mov ecx, dword [0x548750]
mov ebx, eax
mov dword [ebp - 0x46c], ecx
xor eax, eax
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x46c]
push 0x52a33c
push eax
call fcn.0040306c
lea ecx, [ebp - 0x43c]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x478]
jne 0x4b2795
mov eax, dword [ebp - 0x46c]
sub ecx, edx
sar ecx, 1
cmp dword [eax - 8], ecx
jne 0x4b286e
test ebx, ebx
jle 0x4b286e
lea eax, [ebp - 0x43c]
push eax
push esi
lea eax, [ebp - 0x218]
push 0x5256b4
push eax
call fcn.004143d4
lea eax, [ebp - 0x218]
mov edx, ebx
push eax
lea ecx, [ebp - 0x470]
call fcn.004b2403
add esp, 0x14
mov eax, dword [ebp - 0x470]
xor ecx, ecx
cmp dword [eax - 8], ecx
je 0x4b2863
mov eax, dword [0x548750]
mov dword [ebp - 0x480], eax
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x48c], ecx
mov dword [ebp - 0x488], ecx
mov dword [ebp - 0x490], ecx
lea eax, [ebp - 0x470]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x484], ebx
call fcn.00402aef
mov ecx, dword [ebp - 0x474]
lea eax, [ebp - 0x490]
push eax
call fcn.0046d3a2
lea ecx, [ebp - 0x47c]
call fcn.00403080
lea ecx, [ebp - 0x480]
call fcn.00403080
lea ecx, [ebp - 0x470]
call fcn.00403080
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x46c]
call fcn.00403080
lea eax, [ebp - 0x468]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4b2716
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.004e6c99
ret
Function at 0x4b328a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x10
call fcn.004da35a
pop ecx
mov ecx, eax
xor edx, edx
test ecx, ecx
je 0x4b32a9
mov edi, ecx
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
jmp 0x4b32ab
mov ecx, edx
mov esi, dword [ebp + 8]
mov edi, ecx
push edx
push edx
push ecx
movsd dword es:[edi], dword [esi]
push 0x4b4b62
push edx
push edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
ret 4

Function at 0x4b4931
Capabilities:
Create thread

Disassembly:
push 0x44
mov eax, 0x5054f4
call fcn.004e6cb7
mov ebx, ecx
mov esi, dword [ebx + 4]
sub esi, dword [ebx]
sar esi, 2
test esi, esi
jle 0x4b49f9
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0x14], ecx
mov eax, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], ecx
test esi, esi
jle 0x4b49ae
lea ecx, [ebp - 0x50]
call fcn.00428811
mov byte [ebp - 4], 1
mov ecx, edi
mov eax, dword [ebx]
push dword [eax + ecx*4]
call fcn.004b4797
test eax, eax
jne 0x4b4997
mov eax, dword [ebx]
lea eax, [eax + edi*4]
cmp dword [eax], 0
jle 0x4b4997
push eax
lea ecx, [ebp - 0x1c]
call fcn.004049d6
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0
call fcn.0042704b
inc edi
cmp edi, esi
jl 0x4b4968
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
sub eax, edi
test eax, 0xfffffffc
jle 0x4b49ee
push 0xc
call fcn.004da35a
mov esi, eax
xor ebx, ebx
pop ecx
test esi, esi
je 0x4b49d1
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
jmp 0x4b49d3
mov esi, ebx
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.0042d6ed
push ebx
push ebx
push esi
push 0x4b49ff
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test edi, edi
je 0x4b49f9
push edi
call fcn.004d972c
pop ecx
call fcn.004e6c85
ret

Function at 0x4b53aa
Capabilities:
Create directory

Disassembly:
push 0x10
mov eax, 0x5056a0
call fcn.004e6cb7
mov edi, edx
mov esi, ecx
and dword [ebp - 0x1c], 0
test edi, edi
jne 0x4b53d1
push 0x512700
call fcn.00404fa0
jmp 0x4b5459
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.00404fa0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
mov edx, edi
call fcn.0043202d
mov eax, dword [0x548750]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x10]
push dword [ebp - 0x14]
mov edi, 0x54dbe8
push edi
push 0x511e14
push eax
call fcn.0040306c
add esp, 0x10
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push edi
push str._s_s_s._s
push eax
call fcn.0040306c
add esp, 0x18
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.0040291d
lea ecx, [ebp - 0x10]
call fcn.00403080
lea ecx, [ebp - 0x18]
call fcn.00403080
lea ecx, [ebp - 0x14]
call fcn.00403080
mov eax, esi
call fcn.004e6c85
ret
Function at 0x4b59ca
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor eax, eax
push eax
push eax
push 2
push eax
push eax
push 0x40000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4b59ee
xor eax, eax
jmp 0x4b5a52
push ebx
push esi
mov esi, dword [ebp + 8]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4b59f6
sub esi, ecx
push esi
call fcn.004d980f
push esi
mov ebx, eax
push 0
push ebx
call fcn.004deff0
add esp, 0x10
mov edx, ebx
push 0x100
push ecx
mov ecx, dword [ebp + 8]
push esi
call fcn.00413dcd
add esp, 0xc
test esi, esi
je 0x4b5a3f
push 0
lea eax, [ebp - 4]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, dword [ebp - 4]
ja 0x4b5a2b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.004d9740
pop ecx
xor eax, eax
pop esi
inc eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4b8159
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x505e2d
call fcn.004e6cb7
mov esi, edx
mov edi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x14]
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl_
mov dword [ebp - 0x10], ebx
call fcn.00404fa0
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.00402a52
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4b81e6
push 4
pop esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], esi
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
test eax, eax
jne 0x4b81e0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], esi
jne 0x4b81e6
cmp dword [ebp - 0x1c], esi
jne 0x4b81e6
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 8]
jne 0x4b81e6
mov bl, 1
jmp 0x4b81e6
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
call fcn.00403080
mov al, bl
call fcn.004e6c85
ret

Function at 0x4b81f6
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x501c4d
call fcn.004e6cb7
mov edi, edx
mov esi, ecx
push dword [ebp + 8]
call fcn.004b8159
pop ecx
test al, al
jne 0x4b826c
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x14]
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl_
call fcn.00404fa0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push edi
call fcn.00402a52
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4b8264
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
call fcn.00403080
call fcn.004e6c85
ret
Function at 0x4b8272
Capabilities:
Delete registry value

Disassembly:
push 8
mov eax, 0x501c4d
call fcn.004e6cb7
mov esi, edx
mov edi, ecx
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl_
lea ecx, [ebp - 0x14]
call fcn.00404fa0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push esi
call fcn.00402a52
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4b82c7
push edi
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4b82ec
push edi
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
call fcn.00403080
call fcn.004e6c85
ret

Function at 0x4b82fa
Capabilities:
Delete registry value

Disassembly:
push esi
mov esi, ecx
call fcn.004b8352
cmp eax, 7
jbe 0x4b8350
mov edx, str.FEATURE_BROWSER_EMULATION
mov ecx, esi
call fcn.004b8272
mov edx, str.FEATURE_BLOCK_LMZ_SCRIPT
mov ecx, esi
call fcn.004b8272
mov edx, str.FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT
mov ecx, esi
call fcn.004b8272
mov edx, str.FEATURE_GPU_RENDERING
mov ecx, esi
call fcn.004b8272
mov edx, str.FEATURE_AJAX_CONNECTIONEVENTS
mov ecx, esi
call fcn.004b8272
mov ecx, esi
mov edx, str.FEATURE_SAFE_BINDTOOBJECT
pop esi
jmp fcn.004b8272
pop esi
ret
Function at 0x4b83f3
Capabilities:
Delete registry value

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.004b8352
mov edi, eax
cmp edi, 7
jbe 0x4b85ba
imul edx, edi, 0x3e8
mov ecx, esi
push ebx
push edx
mov edx, str.FEATURE_BROWSER_EMULATION
call fcn.004b81f6
push 0
mov edx, str.FEATURE_BLOCK_LMZ_SCRIPT
mov ecx, esi
call fcn.004b81f6
push 0
mov edx, str.FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT
mov ecx, esi
call fcn.004b81f6
xor ebx, ebx
add esp, 0xc
inc ebx
mov edx, str.FEATURE_GPU_RENDERING
mov ecx, esi
cmp edi, 9
jb 0x4b8452
push ebx
call fcn.004b81f6
pop ecx
jmp 0x4b8457
call fcn.004b8272
push ebx
mov edx, str.FEATURE_SAFE_BINDTOOBJECT
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_AJAX_CONNECTIONEVENTS
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_DISABLE_ISO_2022_JP_SNIFFING
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_DISABLE_MK_PROTOCOL
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_BEHAVIORS
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_DISABLE_SQM_UPLOAD_FOR_APP
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_OBJECT_CACHING
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_RESTRICT_ACTIVEXINSTALL
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_SCRIPTURL_MITIGATION
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_SECURITYBAND
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_VALIDATE_NAVIGATE_URL
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_VIEWLINKEDWEBOC_IS_UNSAFE
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_FEEDS
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_MIME_HANDLING
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_MIME_SNIFFING
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_PROTOCOL_LOCKDOWN
mov ecx, esi
call fcn.004b81f6
add esp, 0x40
mov edx, str.FEATURE_RESTRICT_ABOUT_PROTOCOL_IE7
mov ecx, esi
push ebx
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_SHOW_APP_PROTOCOL_WARN_DIALOG
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_TABBED_BROWSING
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_WINDOW_RESTRICTIONS
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_XSSFILTER
mov ecx, esi
call fcn.004b81f6
push ebx
mov edx, str.FEATURE_ZONE_ELEVATION
mov ecx, esi
call fcn.004b81f6
add esp, 0x18
mov edx, str.FEATURE_ACTIVEX_REPURPOSEDETECTION
mov ecx, esi
call fcn.004b8272
mov edx, str.FEATURE_BLOCK_LMZ_IMG
mov ecx, esi
call fcn.004b8272
mov edx, str.FEATURE_BLOCK_LMZ_OBJECT
mov ecx, esi
call fcn.004b8272
mov edx, str.FEATURE_Cross_Domain_Redirect_Mitigation
mov ecx, esi
call fcn.004b8272
pop ebx
pop edi
mov ecx, esi
mov edx, str.FEATURE_LOCALMACHINE_LOCKDOWN
pop esi
jmp fcn.004b8272
pop edi
pop esi
ret
Function at 0x4b85bd
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x4fb5ab
call fcn.004e6cb7
test ecx, ecx
je 0x4b860c
mov eax, dword [0x548750]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push ecx
push str.url.dll_FileProtocolHandler__s
push eax
call fcn.0040306c
add esp, 0xc
push 1
push 0
push dword [ebp - 0x10]
push str.rundll32.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x10]
call fcn.00403080
call fcn.004e6c85
ret

Function at 0x4b9841
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
and dword [esp + 0xc], 0
and dword [esp + 0x10], 0
push ebx
push esi
mov ebx, ecx
push edi
push ecx
lea ecx, [esp + 0x2c]
mov esi, dword [ebx + 0x78]
push dword [ebx + 0x28]
sub esi, dword [ebx + 0x70]
mov edi, dword [ebx + 0x7c]
inc esi
sub edi, dword [ebx + 0x74]
push dword [ebx + 0x24]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], edi
call fcn.00415755
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.004156fb
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x4b990c
sub esp, 0x10
lea ecx, [esp + 0x28]
push edi
push esi
push 9
push 0x3a
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.00415a84
mov ecx, dword [ebx + 0x8c]
call fcn.00415afa
sub eax, 0x3a
cmp eax, esi
jae 0x4b990c
mov ecx, dword [ebx + 0x8c]
call fcn.00415afa
mov ecx, dword [ebx + 0x8c]
sub esi, eax
add esi, 0x3a
call fcn.00415afa
and dword [esp + 0x1c], 0
lea ecx, [esp + 0x10]
sub esp, 0x10
mov dword [esp + 0x30], esi
sub eax, 0x3a
mov dword [esp + 0x34], edi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push edi
push esi
push 9
push 0
push eax
push dword [ebx + 0x8c]
call fcn.00415a84
mov esi, dword [ebx + 0x5c]
jmp 0x4b9917
push esi
call fcn.004b9cac
dec esi
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
jns 0x4b9911
push dword [ebx + 0x3c]
call fcn.004b9cac
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
call fcn.004b9987
mov eax, dword [ebx + 0x24]
lea esi, [esp + 0x18]
and dword [esp + 0x18], 0
lea edx, [esp + 0x28]
and dword [esp + 0x1c], 0
sub esp, 0x10
mov ecx, dword [ebx + 4]
mov edi, esp
mov dword [esp + 0x30], eax
mov eax, dword [ebx + 0x28]
mov dword [esp + 0x34], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004525ad
add esp, 0x10
push dword [esp + 0x10]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
push dword [esp + 0x2c]
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bb159
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4bb179
push 0
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
inc eax
jmp 0x4bb17b
xor eax, eax
pop esi
ret 4
Function at 0x4c0b50
Capabilities:
Terminate process

Disassembly:
movsx eax, byte [ecx + 8]
cmp eax, 5
ja case.0x4c0b59.4
jmp dword [eax*4 + 0x4c0bb4]
mov al, byte [ecx]
ret
xor al, al
ret
mov eax, dword [ecx]
or eax, dword [ecx + 4]
je case.0x4c0b59.0
mov al, 1
ret
movsd xmm0, qword [ecx]
ucomisd xmm0, qword [0x530a98]
lahf
test ah, 0x44
jnp case.0x4c0b59.0
mov al, 1
ret
movdqu xmm0, xmmword [str.Value_is_not_convertible_to_bool.]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movdqu xmm0, xmmword [0x507f98]
movdqu xmmword [ecx + 0x10], xmm0
mov ax, word [0x507fa8]
mov word [ecx + 0x20], ax
call fcn.004de739
arpl word [ebx], cx
dec esp
add byte [esi + 0xb], ah
dec esp
add byte [esi + 0xb], ah
dec esp
add byte [eax + 0xb], dh
dec esp
add byte [ebp + 0x60004c0b], al
or ecx, dword [eax + eax - 0x34]
int3

Function at 0x4c0be0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [ecx + 8]
sub esp, 8
cmp eax, 5
ja case.0x4c0bef.4
jmp dword [eax*4 + 0x4c0c84]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
call fcn.004df5ed
movsd qword [ebp - 8], xmm0
fld qword [ebp - 8]
mov esp, ebp
pop ebp
ret
mov edx, dword [ecx + 4]
mov ecx, dword [ecx]
call fcn.004df55c
movsd qword [ebp - 8], xmm0
fld qword [ebp - 8]
mov esp, ebp
pop ebp
ret
fld qword [ecx]
mov esp, ebp
pop ebp
ret
fldz
mov esp, ebp
pop ebp
ret
cmp byte [ecx], 0
je 0x4c0c47
movsd xmm0, qword [0x530b18]
movsd qword [ebp - 8], xmm0
fld qword [ebp - 8]
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
movsd qword [ebp - 8], xmm0
fld qword [ebp - 8]
mov esp, ebp
pop ebp
ret
movdqu xmm0, xmmword [str.Value_is_not_convertible_to_double.]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movdqu xmm0, xmmword [0x507f74]
movdqu xmmword [ecx + 0x10], xmm0
mov eax, dword [0x507f84]
mov dword [ecx + 0x20], eax
call fcn.004de739
nop
sub byte [esp + ecx*2], cl
add dh, dh
or ecx, dword [eax + eax + 0xc]
or al, 0x4c
add byte [edx], ah
or al, 0x4c
add byte [esi + 0xc], dl
dec esp
add byte [esi], ch
or al, 0x4c
add ah, cl
int3
Function at 0x4c0ca0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
movsx eax, byte [esi + 8]
cmp eax, 5
ja case.0x4c0cb0.4
jmp dword [eax*4 + 0x4c0db8]
mov eax, dword [esi]
mov edx, dword [esi + 4]
pop esi
ret
call fcn.004c17d0
test al, al
jne case.0x4c0cb0.1
jmp 0x4c0d10
mov edx, SysReAllocStringLen
xor ecx, ecx
call fcn.004df5ed
movsd xmm1, qword [esi]
comisd xmm1, xmm0
jb 0x4c0d4f
mov edx, SysReAllocString
or ecx, 0xffffffff
call fcn.004df5ed
movsd xmm1, qword [esi]
comisd xmm0, xmm1
jb 0x4c0d4f
movapd xmm0, xmm1
pop esi
jmp fcn.004df44d
xor eax, eax
xor edx, edx
pop esi
ret
xor eax, eax
cmp byte [esi], al
pop esi
setne al
cdq
ret
movdqu xmm0, xmmword [str.LargestUInt_out_of_Int64_range]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movq xmm0, qword [0x507eb4]
movq qword [ecx + 0x10], xmm0
mov eax, dword [0x507ebc]
mov dword [ecx + 0x18], eax
mov ax, word [0x507ec0]
mov word [ecx + 0x1c], ax
mov al, byte [0x507ec2]
mov byte [ecx + 0x1e], al
call fcn.004de739
movdqu xmm0, xmmword [str.double_out_of_Int64_range]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movq xmm0, qword [0x507ed4]
movq qword [ecx + 0x10], xmm0
mov ax, word [0x507edc]
mov word [ecx + 0x18], ax
call fcn.004de739
movdqu xmm0, xmmword [str.Value_is_not_convertible_to_Int64.]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movdqu xmm0, xmmword [0x507ef0]
movdqu xmmword [ecx + 0x10], xmm0
mov ax, word [0x507f00]
mov word [ecx + 0x20], ax
mov al, byte [0x507f02]
mov byte [ecx + 0x22], al
call fcn.004de739
lea ecx, [ecx]
add byte [0xcb7004c], cl
dec esp
add byte [esi - 0x36ffb3f4], bh
or al, 0x4c
add byte [esi + 0xd], bh
dec esp
add byte [esi], al
or eax, 0x8b56004c
push esi
mov esi, ecx
jmp 0x4c0ca0
Function at 0x4c0cbe
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
movsx eax, byte [esi + 8]
cmp eax, 5
ja case.0x4c0cb0.4
jmp dword [eax*4 + 0x4c0db8]
mov eax, dword [esi]
mov edx, dword [esi + 4]
pop esi
ret
call fcn.004c17d0
test al, al
jne case.0x4c0cb0.1
jmp 0x4c0d10
mov edx, SysReAllocStringLen
xor ecx, ecx
call fcn.004df5ed
movsd xmm1, qword [esi]
comisd xmm1, xmm0
jb 0x4c0d4f
mov edx, SysReAllocString
or ecx, 0xffffffff
call fcn.004df5ed
movsd xmm1, qword [esi]
comisd xmm0, xmm1
jb 0x4c0d4f
movapd xmm0, xmm1
pop esi
jmp fcn.004df44d
xor eax, eax
xor edx, edx
pop esi
ret
xor eax, eax
cmp byte [esi], al
pop esi
setne al
cdq
ret
movdqu xmm0, xmmword [str.LargestUInt_out_of_Int64_range]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movq xmm0, qword [0x507eb4]
movq qword [ecx + 0x10], xmm0
mov eax, dword [0x507ebc]
mov dword [ecx + 0x18], eax
mov ax, word [0x507ec0]
mov word [ecx + 0x1c], ax
mov al, byte [0x507ec2]
mov byte [ecx + 0x1e], al
call fcn.004de739
movdqu xmm0, xmmword [str.double_out_of_Int64_range]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movq xmm0, qword [0x507ed4]
movq qword [ecx + 0x10], xmm0
mov ax, word [0x507edc]
mov word [ecx + 0x18], ax
call fcn.004de739
movdqu xmm0, xmmword [str.Value_is_not_convertible_to_Int64.]
mov ecx, 0x29a
push 0x7b
movdqu xmmword [ecx], xmm0
movdqu xmm0, xmmword [0x507ef0]
movdqu xmmword [ecx + 0x10], xmm0
mov ax, word [0x507f00]
mov word [ecx + 0x20], ax
mov al, byte [0x507f02]
mov byte [ecx + 0x22], al
call fcn.004de739
lea ecx, [ecx]
add byte [0xcb7004c], cl
dec esp
add byte [esi - 0x36ffb3f4], bh
or al, 0x4c
add byte [esi + 0xd], bh
dec esp
add byte [esi], al
or eax, 0x8b56004c
push esi
mov esi, ecx
jmp 0x4c0ca0