joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4094c0
Capabilities:
Get token membership

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
xor esi, esi
mov dword [esp + 0xc], eax
mov ecx, 5
mov dword [esp + 8], esi
mov dword [esp + 4], esi
mov word [esp + 0x10], ax
call dword [sym.imp.MSVBVM60.DLL___vbaUI1I4]
lea ecx, [esp + 4]
mov byte [esp + 0x11], al
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push 0x220
push 0x20
mov ecx, 2
call dword [sym.imp.MSVBVM60.DLL___vbaUI1I2]
lea edx, [esp + 0x30]
push eax
push edx
call dword [sym.imp.ADVAPI32.DLL_AllocateAndInitializeSid]
test eax, eax
je 0x409544
mov ecx, dword [esp + 4]
lea eax, [esp + 8]
push eax
push ecx
push esi
call dword [sym.imp.ADVAPI32.DLL_CheckTokenMembership]
test eax, eax
je 0x409539
mov ecx, dword [esp + 8]
xor edx, edx
cmp ecx, esi
setne dl
neg edx
mov esi, edx
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.DLL_FreeSid]
mov ax, si
pop esi
add esp, 0x10
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x475004]
jne 0x40100a
repz ret
jmp fcn.00401685

Function at 0x407b30
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004023ae
and dword [ebp - 4], 0
cmp dword [0x476cf4], 0
mov ebx, eax
jne 0x407be1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407c92
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407c92
push eax
call fcn.0040233c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x476cf4], eax
call esi
push eax
call fcn.0040233c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x476cf8], eax
call esi
push eax
call fcn.0040233c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x476cfc], eax
call esi
push eax
call fcn.0040233c
pop ecx
mov dword [0x476d04], eax
test eax, eax
je 0x407be1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040233c
pop ecx
mov dword [0x476d00], eax
mov eax, dword [0x476d00]
cmp eax, ebx
je 0x407c39
cmp dword [0x476d04], ebx
je 0x407c39
push eax
call fcn.004023b7
push dword [0x476d04]
mov esi, eax
call fcn.004023b7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407c39
test edi, edi
je 0x407c39
call esi
test eax, eax
je 0x407c30
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407c30
test byte [ebp - 0xc], 1
jne 0x407c39
or dword [ebp + 0x10], 0x200000
jmp 0x407c72
mov eax, dword [0x476cf8]
cmp eax, ebx
je 0x407c72
push eax
call fcn.004023b7
pop ecx
test eax, eax
je 0x407c72
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407c72
mov eax, dword [0x476cfc]
cmp eax, ebx
je 0x407c72
push eax
call fcn.004023b7
pop ecx
test eax, eax
je 0x407c72
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x476cf4]
call fcn.004023b7
pop ecx
test eax, eax
je 0x407c92
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407c94
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x7c9b34d6
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x3b401b20
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x406191
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x4bb451
call fcn.004bafa8
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x28], ebx
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x14], eax
xor edi, edi
mov ecx, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x18], edi
cmp edi, ecx
jae 0x4062d2
cmp dword [ebx + 0x10], edi
ja 0x4061d0
push str.dwjvGNbvYXiyAtZEcqFzBid
call fcn.0048c228
cmp dword [ebx + 0x14], 8
jb 0x4061da
mov eax, dword [ebx]
jmp 0x4061dc
mov eax, ebx
movzx edx, word [eax + edi*2]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x24], 0x27ac
cmp dword [ebp - 0x24], 0x284e
jle 0x406249
xor edi, edi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], 0x44e9
mov eax, esi
and eax, ebx
xor eax, edi
cdq
push edx
push eax
mov ecx, 0xaba398
call fcn.0042a0ad
dec esi
dec dword [ebp - 0x1c]
jne 0x406206
mov esi, dword [ebp - 0x20]
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x4efb
jl 0x4061fc
inc ebx
cmp ebx, 0x539
jl 0x4061f7
inc edi
cmp edi, 0x5b81
jl 0x4061f5
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x30]
lea eax, [edi - 0x7e29]
movzx ecx, ax
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
add ecx, edx
movzx esi, cx
movzx eax, dx
add eax, edi
xor edx, edx
push 0x19
pop ecx
div ecx
mov ecx, edx
shl esi, cl
mov eax, dword [ebp - 0x14]
add eax, esi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x2642
jge 0x406299
mov edx, str.ntu_wuuzxrn_ebw_luda_dmtqptu_cwblaw_qmbf
mov ecx, 0xaba398
call fcn.0042b8ed
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
jmp 0x4062c9
inc edi
mov ecx, dword [ebp - 0x34]
jmp 0x4061b6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414258
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x4142f1
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4142d9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4142b0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 1
push dword [ebp - 0x1c]
call fcn.004143e5
pop ecx
pop ecx
jmp 0x4142d7
push 0
push 0x3897
push 0x66ce
push 0x1ed3
push 0x5ce
push 1
push 0x57a6
push 1
call fcn.00423409
add esp, 0x20
jmp 0x4142ec
push 0
push 0
push 1
push 0x18c0
call fcn.00427f5b
add esp, 0x10
jmp 0x4143e1
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x41433c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push 0xfc0
push dword [ebp - 0x28]
push 1
call fcn.0040d02b
add esp, 0xc
jmp 0x4143e1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x41438b
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 1
push 0
push dword [ebp - 0x44]
push 0x2d8e
push 0x1520
push 0x5930
push 1
push 0x1cc7
call fcn.004195c7
add esp, 0x20
jmp 0x4143e1
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x4143b9
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x4143e1
push 0
push 0xd54
push 0x89c
push 0x2601
push 0x1d07
push 0x5a1
push 0x1653
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov esp, ebp
pop ebp
ret
Function at 0x416c47
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x416da5
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x416d6a
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x416d4b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x416d15
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp dword [eax], 0x1e52
jle 0x416d13
push 1
push 0x765e
push 0x6563
push 0x7eb3
push 0
call fcn.0041a012
add esp, 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x416d49
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x74]
call fcn.0040541e
pop ecx
pop ecx
mov ecx, eax
call fcn.00402eb0
push eax
call fcn.0048ef08
pop ecx
lea ecx, [ebp - 0x74]
call fcn.00402c9d
jmp 0x416d68
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
push 0x44ba
push dword [ebp - 0x4c]
push 0
push 0x6249
call fcn.0041e4b2
add esp, 0x10
jmp 0x416da3
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
push 0x5fef
push 0x7133
push 1
push 0x5bc7
push 1
push 1
push dword [ebp - 0x54]
push 0
push 0x48d9
push 0x6b1
push 0x3195
push 1
call fcn.00409d82
add esp, 0x30
jmp 0x416dc8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x5c], eax
push 0x4ec6
push 0
push dword [ebp - 0x58]
push 1
push dword [ebp - 0x5c]
call fcn.0041dc81
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x43874e
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x43880f
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43879c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0x3b94
push 1
push dword [ebp - 0x10]
call fcn.00438853
add esp, 0xc
jmp 0x43880d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x4387f6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x4387f4
push 0xce6
push 0x19bf
push 1
push 1
push 0x657
push 0x4ca8
push 0x1026
push 1
push 0x1a2
call fcn.0042fd24
add esp, 0x24
jmp 0x43880d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x43880d
push 0x1563
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x43884f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
push 0x6548
push 0x5f5f
mov eax, dword [ebp - 0x2c]
push dword [eax]
push 0xd25
push 0x7cba
push 0
push 0x1439
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.00437a30
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x4489b6
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x448a89
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x448a36
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
push 0x64fd
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0xcbc
push 0x3d7d
push 0x7ded
push 0x3996
push 1
call fcn.00448acb
add esp, 0x24
jmp 0x448a87
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x448a67
push 0x9c0
push 0xbc6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x448a87
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x448a87
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x448ac7
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x448aaf
push 0x2b24
push 1
call fcn.0042c8fb
pop ecx
pop ecx
jmp 0x448ac7
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
push 0x2bc0
push 0
call fcn.004325c1
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x44c147
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x44c228
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x44c218
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x44c1f6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 1
jmp 0x44c1bd
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x44c1f4
mov dword [ebp - 8], 0xd8f6efba
mov dword [ebp - 8], 0
jmp 0x44c1dc
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jg 0x44c1f2
push 0x199b
push 0
call fcn.0044f904
pop ecx
pop ecx
jmp 0x44c1d5
jmp 0x44c1b2
jmp 0x44c216
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x44c216
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x44c226
push 0x5ab
push 0
call fcn.0044f904
pop ecx
pop ecx
jmp 0x44c25e
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
push eax
push 0x3ffd
push 0x5679
push 0
push 0x382f
push 0x205c
push 1
push dword [ebp - 0x38]
call fcn.00450991
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x45148b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x45150e
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x4514e7
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0
push 0x3e55
push dword [ebp - 0x24]
call fcn.00452735
add esp, 0x14
jmp 0x451509
push 0x3f0d
push 0x7b35
push 0
push 0x189d
push 0x368d
push 1
push 0
call fcn.004500f3
add esp, 0x1c
jmp 0x451647
lea eax, [ebp + 0x24]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x4515a3
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x45157e
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x45157c
push 0x410
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x45159e
push 0
push 0x1db3
push 0x260c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
jmp 0x451647
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x451635
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4515ed
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jg 0x451633
mov dword [ebp - 0x64], 0x3ee7
mov dword [ebp - 0x68], 0xc924b541
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x7c], 0xfffffffa
mov dword [ebp - 0x78], 0xfffffffa
mov dword [ebp - 0x74], 0xfffffffa
mov dword [ebp - 0x70], 0xfffffffa
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x4515e2
jmp 0x451647
push 0x2138
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov esp, ebp
pop ebp
ret
Function at 0x45173c
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4517b1
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x451785
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push 0x62c6
push 0x7fe0
push 0
call fcn.00458f86
add esp, 0x10
jmp 0x4517ac
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0x2b92
push 0
push dword [ebp - 0x18]
push 0x29d5
push 0x3c76
push 0x4e3
call fcn.00459c03
add esp, 0x18
jmp 0x4518b7
lea eax, [ebp + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x451870
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x4517fd
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x45186e
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x45181f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x19
jl 0x45186e
mov dword [ebp - 0x34], 0xffffffff
push 0
push 0x65e2
push 0x1af
push 0
push 0x2545
push 0x755d
push 0x2b27
push 1
push 0xa99
push 0x69c
push 0x1953
call fcn.00456b0f
add esp, 0x2c
cmp dword [ebp - 0x34], 0
je 0x45186c
jmp 0x45186e
jmp 0x451814
jmp 0x4518b7
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x4518ac
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x4518aa
push 0x3817
push 0
call fcn.0045593a
pop ecx
pop ecx
jmp 0x4518b7
push 0x232f
call dword [sym.imp.GDI32.dll_GetStockObject]
mov esp, ebp
pop ebp
ret