joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d510
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 0x1a
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x80]
mov esi, 0x4ba63d
push ebx
sub esp, 0x9c
mov eax, dword [0x4ba63c]
mov dword [ebp - 0x81], eax
mov eax, dword [0x4ba6a1]
mov dword [ebp - 0x1c], eax
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
lea eax, [edx + 0x84]
and eax, 0xfffffff0
call fcn.0040bc90
mov ecx, 0x1a
sub esp, eax
lea esi, [ebp - 0x81]
lea ebx, [esp + 0x1b]
and ebx, 0xfffffff0
mov edi, ebx
lea eax, [ebx + 0x68]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x8c], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x8c]
mov byte [ebx + edx + 0x68], 0
mov dword [esp], ebx
call fcn.004af610
nop
nop
nop
nop
nop
nop
nop
push edi
push esi
push ebx
sub esp, 0x20
cmp byte [0x4b8bf8], 0
jne 0x41d636
mov byte [0x4b8bf8], 1
call fcn.004adac0
test eax, eax
je 0x41d604
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
sete al
mov dword [esp + 4], 0
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.0040ab80
mov dword [esp], 2
mov esi, dword [fcn.00419eb0]
mov edi, eax
call esi
mov dword [esp + 8], 0x30
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x1c]
mov dword [esp], 2
test edx, edx
je 0x41d5f4
call esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x4b9351
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x4ae820
jmp 0x4ae818
call esi
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
jmp 0x41d5ba
mov dword [esp], 2
call dword [0x4b70b0]
mov dword [esp + 8], 0x2d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
call sub.msvcrt.dll_fwrite
jmp 0x4ae813
mov dword [esp], 2
call dword [0x4b70b0]
mov dword [esp + 8], 0x1d
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
call sub.msvcrt.dll_fwrite
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x4752f0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll__fileno_1
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ebp, eax
cmp eax, 0xffffffff
je 0x475330
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x475301
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x46cf50
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x523890]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00469bb0
add esp, 4
movzx edx, al
test edx, edx
je 0x46cfe1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.004cda30
add esp, 0xc
mov dword [ebp - 0x2d8], 0x10001
lea edx, [ebp - 0x2d8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x46cfdf
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp + 0xc]
jne 0x46cfdf
jmp 0x46cfe1
jmp 0x46cf63
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cce32
mov esp, ebp
pop ebp
ret
Function at 0x47fb20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0x47fb8c
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0x47fbd3
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.004cc7ae
add esp, 8
test eax, eax
jne 0x47fbd1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x47fbd5
jmp 0x47fb83
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4a1d10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4a1d70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x4a1d67
mov edx, dword [0x539e38]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4a1d5b
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4a1d40
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x4a1d69
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x4a4bf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb767
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x523890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004a3b30
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.004a3b30
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.004a3b30
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004a44f0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.004a44f0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.004a44f0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a4ec0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb857
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x523890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004a3a60
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.004a3a60
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.004a3a60
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004a4510
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.004a4510
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.004a4510
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a6d00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc06a
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x523890]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x14], 0x8000
mov dword [ebp - 0x10], 0x52624c
mov byte [ebp - 0x45], 0
lea eax, [ebp - 0x45]
push eax
push 0x8000
lea ecx, [ebp - 0x44]
call fcn.00480920
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0xa8]
call fcn.004a5840
mov dword [ebp - 0xb0], eax
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0xb4], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xb4]
call fcn.004a4230
push eax
push 0x8000
push 0
lea ecx, [ebp - 0x44]
call fcn.00480980
push eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.004a4230
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004a4230
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa8]
call fcn.004616c0
push 0
lea ecx, [ebp - 0x44]
call fcn.00480980
push eax
lea ecx, [ebp - 0x34]
call fcn.00466330
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x34]
push edx
call fcn.004add80
add esp, 8
movzx eax, al
test eax, eax
je 0x4a6e33
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.004a4530
mov edx, dword [ebp - 0xac]
or edx, 1
mov dword [ebp - 0xac], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.004663c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00480960
mov eax, dword [ebp + 8]
jmp 0x4a6e83
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
call fcn.004aa3b0
mov ecx, dword [ebp - 0xac]
or ecx, 1
mov dword [ebp - 0xac], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.004663c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.00480960
mov eax, dword [ebp + 8]
jmp 0x4a6e83
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004cce32
mov esp, ebp
pop ebp
ret
Function at 0x4a7520
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc221
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x523890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
call fcn.004a4230
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x4a75d6
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x21]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 2
push ecx
lea ecx, [ebp - 0x20]
call fcn.00480920
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
push 0
lea ecx, [ebp - 0x20]
call fcn.00480980
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004a4230
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
lea ecx, [ebp - 0x20]
call fcn.00480980
push eax
mov ecx, dword [ebp + 8]
call fcn.00466330
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00480960
mov eax, dword [ebp + 8]
jmp 0x4a75f5
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00466380
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4a79f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc311
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x523890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x4a7a98
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x21]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.00480920
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push 0
lea ecx, [ebp - 0x20]
call fcn.00480980
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
lea ecx, [ebp - 0x20]
call fcn.00480980
push eax
mov ecx, dword [ebp + 8]
call fcn.00466330
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00480960
mov eax, dword [ebp + 8]
jmp 0x4a7ab3
mov ecx, dword [ebp + 8]
call fcn.00479860
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4a8470
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc581
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x523890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
push 0
push 0
push 0xe
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x21]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.00480920
mov dword [ebp - 4], 1
push 0
lea ecx, [ebp - 0x20]
call fcn.00480980
push eax
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push 0xd
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
lea ecx, [ebp - 0x20]
call fcn.00480980
push eax
mov ecx, dword [ebp + 8]
call fcn.00466330
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00480960
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4bc160
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff5e8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x523890]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movsx eax, byte [0x53a650]
test eax, eax
jne 0x4bc195
call fcn.004bc050
movzx ecx, byte [0x53a649]
test ecx, ecx
jne 0x4bc24f
movzx edx, byte [0x53a648]
test edx, edx
jne 0x4bc24f
cmp dword [0x53a754], 0
je 0x4bc1f8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [0x53a754]
push ecx
call fcn.004a7f30
add esp, 8
mov dword [ebp - 0x10], eax
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0x186
mov eax, dword [0x53a754]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x53a754]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x4bc24f
push 0x53a650
lea ecx, [ebp - 0x74]
call fcn.004a3a60
mov dword [ebp - 4], 0
push 0x10001
lea edx, [ebp - 0x74]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004a7d40
add esp, 0x10
xor edx, edx
cmp eax, 2
sete dl
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.004616c0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x4bc24f
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4c6280
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x4c628f
mov eax, dword [eax + 4]
jmp 0x4c6292
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4c631b
push esi
mov esi, dword [0x53aaf0]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
je 0x4c6300
cmp eax, 3
je 0x4c6300
cmp eax, 0x7b
je 0x4c6300
cmp eax, 0x57
je 0x4c6300
cmp eax, 0xa1
je 0x4c6300
cmp eax, 0x35
je 0x4c6300
cmp eax, 0x20
jne 0x4c62f5
mov eax, dword [0x53aaf4]
mov dword [ecx], eax
mov edx, dword [0x53aaf8]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x53aaf4]
mov dword [ecx], eax
mov edx, dword [0x53aaf8]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x53aaf4]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x53aaf8]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x4c6348
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0x4c6360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 8
jb 0x4c636f
mov eax, dword [eax + 4]
jmp 0x4c6372
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4c63fb
push esi
mov esi, dword [0x53aaf0]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
je 0x4c63e0
cmp eax, 3
je 0x4c63e0
cmp eax, 0x7b
je 0x4c63e0
cmp eax, 0x57
je 0x4c63e0
cmp eax, 0xa1
je 0x4c63e0
cmp eax, 0x35
je 0x4c63e0
cmp eax, 0x20
jne 0x4c63d5
mov eax, dword [0x53aaf4]
mov dword [ecx], eax
mov edx, dword [0x53aaf8]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x53aaf4]
mov dword [ecx], eax
mov edx, dword [0x53aaf8]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x53aaf4]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x53aaf8]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x4c6428
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret
Function at 0x4c9130
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x5002ab
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x523890]
xor eax, esp
mov dword [esp + 0x278], eax
push ebp
push esi
push edi
mov eax, dword [0x523890]
xor eax, esp
push eax
lea eax, [esp + 0x28c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x29c]
mov ecx, dword [esp + 0x2ac]
mov edx, dword [esp + 0x2b0]
mov edi, dword [esp + 0x2a0]
mov ebp, dword [esp + 0x2a8]
push 0xffffffffffffffff
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2a8]
push 0
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], 0
call fcn.0047a0d0
mov eax, dword [esp + 0x30]
test eax, eax
mov dword [esp + 0x294], 0
je 0x4c91ff
lea esi, [eax - 1]
cmp esi, eax
jbe 0x4c91e4
call fcn.004cd864
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x4c91f3
lea eax, [esp + 0x20]
cmp word [eax + esi*2], 0x5c
mov edx, 0x526d68
je 0x4c9204
mov edx, 0x526d60
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c9210
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.004c8110
mov eax, dword [esp + 0x20]
mov esi, 8
cmp dword [esp + 0x34], esi
jae 0x4c923d
lea eax, [esp + 0x20]
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [edi], eax
jne 0x4c9290
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], 0
call esi
cmp eax, 2
jne 0x4c9267
xor eax, eax
jmp 0x4c9269
call esi
cmp dword [esp + 0x34], 8
mov esi, dword [esp + 0x10]
mov edx, dword [0x53aaf0]
mov dword [esi], eax
mov dword [esi + 4], edx
jb 0x4c928c
mov eax, dword [esp + 0x20]
push eax
call fcn.004cd275
add esp, 4
mov eax, esi
jmp 0x4c930d
lea eax, [esp + 0x64]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c9297
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x68]
push ecx
mov ecx, ebp
call fcn.004809d0
test byte [esp + 0x38], 0x10
je 0x4c92d0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [edx], 3
mov dword [eax], 3
jmp 0x4c92e4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ecx], 2
mov dword [edx], 2
cmp dword [esp + 0x34], esi
mov eax, dword [0x53aaf4]
mov edi, dword [esp + 0x10]
mov dword [edi], eax
mov ecx, dword [0x53aaf8]
mov dword [edi + 4], ecx
jb 0x4c930b
mov edx, dword [esp + 0x20]
push edx
call fcn.004cd275
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x28c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.004cce32
add esp, 0x288
ret