joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0d11
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x598a05
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x20], ecx
call fcn.004ae840
sub eax, dword [0x6e3e80]
sbb edx, dword [0x6e3e84]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0
ja 0x4b0d55
cmp dword [ebp - 0x28], 0x3a98
jbe 0x4b0dba
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x18]
mov eax, dword [edx + 0x5c]
and eax, 0x200000
test eax, eax
jne 0x4b0dba
push 0xffffffffffffffff
push 0x2bc
push 0x689918
push 0x2bc
push 0x689954
call fcn.004b8320
add esp, 0x14
push 0xffffffffffffffff
push 0x2bc
push 0x689990
call fcn.004afca3
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.00578c4a
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x5c]
and ecx, 0xffdfffff
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x10]
mov edx, dword [eax + 0x18]
mov dword [edx + 0x5c], ecx
xor eax, eax
mov al, byte [0x6e3e7e]
and eax, 0x20
test eax, eax
je 0x4b0e04
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x5c]
or ecx, 0x200000
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x10]
mov edx, dword [eax + 0x18]
mov dword [edx + 0x5c], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0x1c], 0
jne 0x4b0e48
push 0
push 0x6899cc
lea ecx, [ebp - 0x10]
call fcn.00499550
mov dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.004b2673
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004995e0
mov al, 1
jmp 0x4b0f1a
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4b0e93
push 0
push 0x6899e4
lea ecx, [ebp - 0x14]
call fcn.00499550
mov dword [ebp - 4], 1
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.004b2673
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004995e0
mov al, 1
jmp 0x4b0f1a
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x10]
cmp dword [edx + 0x14], 0
je 0x4b0eb2
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10]
mov ecx, dword [ecx + 0x14]
call fcn.004ba340
cmp eax, 1
jge 0x4b0ee7
push 0
push 0x6899fc
lea ecx, [ebp - 0x18]
call fcn.00499550
mov dword [ebp - 4], 2
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x20]
call fcn.004b2673
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004995e0
mov al, 1
jmp 0x4b0f1a
push 0
push 0x6e3ea0
lea ecx, [ebp - 0x1c]
call fcn.00499550
mov dword [ebp - 4], 3
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.004b2673
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004995e0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4b0f28
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
mov dword [ebp - 0x114], ecx
call fcn.004ae840
sub eax, dword [0x6e3e80]
sbb edx, dword [0x6e3e84]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], edx
cmp dword [ebp - 0x118], 0
ja 0x4b0f6a
cmp dword [ebp - 0x11c], 0x3a98
jbe 0x4b0fd2
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x18]
mov eax, dword [edx + 0x5c]
and eax, 0x200000
test eax, eax
jne 0x4b0fd2
push 0xffffffffffffffff
push 0x2db
push 0x689a18
push 0x2db
push 0x689a54
call fcn.004b8320
add esp, 0x14
push 0xffffffffffffffff
push 0x2db
push 0x689a90
call fcn.004afca3
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.00578c4a
mov ecx, dword [ebp - 0x114]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x5c]
and ecx, 0xffdfffff
mov edx, dword [ebp - 0x114]
mov eax, dword [edx + 0x10]
mov edx, dword [eax + 0x18]
mov dword [edx + 0x5c], ecx
xor eax, eax
mov al, byte [0x6e3e7e]
and eax, 0x20
test eax, eax
je 0x4b1028
mov ecx, dword [ebp - 0x114]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x5c]
or ecx, 0x200000
mov edx, dword [ebp - 0x114]
mov eax, dword [edx + 0x10]
mov edx, dword [eax + 0x18]
mov dword [edx + 0x5c], ecx
cmp dword [ebp + 8], 0
jne 0x4b1035
xor eax, eax
jmp 0x4b1153
mov byte [ebp - 0x10c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x110], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
push 0x689acc
lea edx, [ebp - 0x10c]
push edx
call fcn.004b8fb0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b1142
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x4b1140
push 0x104
lea ecx, [ebp - 0x10c]
push ecx
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.USER32.dll_GetClassNameA]
push 0x689ae8
lea eax, [ebp - 0x10c]
push eax
call fcn.004b8fb0
add esp, 8
test eax, eax
jne 0x4b10f2
mov eax, dword [ebp - 0x110]
jmp 0x4b1153
mov ecx, dword [ebp - 0x110]
push ecx
mov ecx, dword [ebp - 0x114]
call fcn.004b0f28
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b1120
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4b1120
mov eax, dword [ebp - 4]
jmp 0x4b1153
push 0
push 0
mov eax, dword [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 0x110], eax
jmp 0x4b10ac
jmp 0x4b114d
cmp dword [ebp - 8], 0
jne 0x4b114d
mov eax, dword [ebp + 8]
jmp 0x4b1153
mov eax, dword [ebp - 0x110]
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4b12e8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0x14], 0
je 0x4b132e
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0x14]
call fcn.004ba340
cmp eax, 1
jge 0x4b1335
xor al, al
jmp 0x4b145d
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x10], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
add edx, 4
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
call fcn.004ae840
sub eax, dword [0x6e3e80]
sbb edx, dword [0x6e3e84]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
ja 0x4b1382
cmp dword [ebp - 0xc], 0x3a98
jbe 0x4b13e8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + 0x5c]
and ecx, 0x200000
test ecx, ecx
jne 0x4b13e8
push 0xffffffffffffffff
push 0x343
push 0x689bcc
push 0x343
push 0x689c08
call fcn.004b8320
add esp, 0x14
push 0xffffffffffffffff
push 0x343
push 0x689c44
call fcn.004afca3
add esp, 0xc
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.00578c4a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x5c]
and edx, 0xffdfffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx + 0x18]
mov dword [eax + 0x5c], edx
xor ecx, ecx
mov cl, byte [0x6e3e7e]
and ecx, 0x20
test ecx, ecx
je 0x4b1433
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0x18]
mov edx, dword [ecx + 0x5c]
or edx, 0x200000
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
mov eax, dword [ecx + 0x18]
mov dword [eax + 0x5c], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
cmp dword [edx + 0x1c], 0
je 0x4b1453
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
cmp dword [ecx], 0
je 0x4b1453
mov dword [ebp - 0x10], 1
jmp 0x4b145a
mov dword [ebp - 0x10], 0
mov al, byte [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4
Function at 0x4b8620
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x4b8635
xor eax, eax
jmp 0x4b866c
push 0
push 0
push 0
push 6
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4b8656
xor eax, eax
jmp 0x4b866c
cmp dword [ebp + 8], 0
je 0x4b8666
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp - 4]
add eax, 8
mov esp, ebp
pop ebp
ret 4
Function at 0x4f21ac
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
and eax, 0xff
test eax, eax
je 0x4f2211
cmp dword [0x6f012c], 0
jne 0x4f21d4
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x6f012c], eax
cmp dword [0x6f0114], 0
jne 0x4f21f6
mov ecx, dword [0x6f012c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x6f012c]
add eax, dword [edx + 0x3c]
mov dword [0x6f0114], eax
cmp dword [ebp + 0x10], 0
je 0x4f2207
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x6f0114]
mov dword [ecx], edx
mov eax, dword [0x6f012c]
jmp 0x4f236e
xor eax, eax
mov al, byte [0x6f0124]
and eax, 1
test eax, eax
jne 0x4f2245
mov cl, byte [0x6f0124]
or cl, 1
mov byte [0x6f0124], cl
mov ecx, 0x6f0128
call fcn.00540f00
push 0x4f2372
call fcn.00576b2b
add esp, 4
push 0
call fcn.0057877a
add esp, 4
push eax
call fcn.00575522
add esp, 4
mov ecx, 0x6f0128
call fcn.00499260
and eax, 0xff
test eax, eax
je 0x4f2308
push 0x6f0128
push 0x6e1a50
call fcn.004b7db0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4f2308
mov edx, 1
test edx, edx
je 0x4f22f5
mov eax, dword [ebp + 8]
and eax, 0x200000
test eax, eax
jne 0x4f22f5
mov ecx, dword [ebp - 8]
push ecx
push 0xb5
push 0x6ae778
push 0xb5
push 0x6ae7d0
call fcn.004b8320
add esp, 0x14
mov edx, dword [ebp - 8]
push edx
push 0xb5
push 0x6ae828
call fcn.004afca3
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.00578c4a
cmp dword [ebp + 0x10], 0
je 0x4f2304
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
xor eax, eax
jmp 0x4f236e
cmp dword [0x6f0118], 0
jne 0x4f2320
mov ecx, 0x6f0128
call fcn.0049eca0
mov dword [0x6f0118], eax
cmp dword [ebp + 0x14], 0
je 0x4f2335
mov ecx, 0x6f0128
call fcn.00526cc0
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
cmp dword [0x6f0120], 0
jne 0x4f2358
mov eax, dword [0x6f0118]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [0x6f0118]
add edx, dword [ecx + 0x3c]
mov dword [0x6f0120], edx
cmp dword [ebp + 0x10], 0
je 0x4f2369
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x6f0120]
mov dword [eax], ecx
mov eax, dword [0x6f0118]
mov esp, ebp
pop ebp
ret
Function at 0x4f590c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
and eax, 0xff
test eax, eax
je 0x4f5971
cmp dword [0x6f0148], 0
jne 0x4f5934
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x6f0148], eax
cmp dword [0x6f0130], 0
jne 0x4f5956
mov ecx, dword [0x6f0148]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x6f0148]
add eax, dword [edx + 0x3c]
mov dword [0x6f0130], eax
cmp dword [ebp + 0x10], 0
je 0x4f5967
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x6f0130]
mov dword [ecx], edx
mov eax, dword [0x6f0148]
jmp 0x4f5ace
xor eax, eax
mov al, byte [0x6f0140]
and eax, 1
test eax, eax
jne 0x4f59a5
mov cl, byte [0x6f0140]
or cl, 1
mov byte [0x6f0140], cl
mov ecx, 0x6f0144
call fcn.00540f00
push 0x4f5ad2
call fcn.00576b2b
add esp, 4
push 0
call fcn.0057877a
add esp, 4
push eax
call fcn.00575522
add esp, 4
mov ecx, 0x6f0144
call fcn.00499260
and eax, 0xff
test eax, eax
je 0x4f5a68
push 0x6f0144
push 0x6e1a50
call fcn.004b7db0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4f5a68
mov edx, 1
test edx, edx
je 0x4f5a55
mov eax, dword [ebp + 8]
and eax, 0x200000
test eax, eax
jne 0x4f5a55
mov ecx, dword [ebp - 8]
push ecx
push 0xb5
push 0x6aec28
push 0xb5
push 0x6aec80
call fcn.004b8320
add esp, 0x14
mov edx, dword [ebp - 8]
push edx
push 0xb5
push 0x6aecd8
call fcn.004afca3
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.00578c4a
cmp dword [ebp + 0x10], 0
je 0x4f5a64
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
xor eax, eax
jmp 0x4f5ace
cmp dword [0x6f0134], 0
jne 0x4f5a80
mov ecx, 0x6f0144
call fcn.0049eca0
mov dword [0x6f0134], eax
cmp dword [ebp + 0x14], 0
je 0x4f5a95
mov ecx, 0x6f0144
call fcn.00526cc0
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
cmp dword [0x6f013c], 0
jne 0x4f5ab8
mov eax, dword [0x6f0134]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [0x6f0134]
add edx, dword [ecx + 0x3c]
mov dword [0x6f013c], edx
cmp dword [ebp + 0x10], 0
je 0x4f5ac9
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x6f013c]
mov dword [eax], ecx
mov eax, dword [0x6f0134]
mov esp, ebp
pop ebp
ret
Function at 0x4f6c10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59a459
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004d4f70
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x614ddc
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004b27d6
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x33b
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004b5e90
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4f6caf
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x4f6ce5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b12e8
and eax, 0xff
test eax, eax
jne 0x4f6cc6
jmp 0x4f6ce5
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x6aeef0
call fcn.004b9670
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b3524
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f74b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov al, byte [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b8220
add esp, 0x14
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4f74f7
mov edx, dword [ebp + 8]
and edx, 0x200000
test edx, edx
je 0x4f74ef
xor eax, eax
jmp 0x4f75c3
or eax, 0xffffffff
jmp 0x4f75c3
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
push 0
push 0
mov cl, byte [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004f590c
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
and eax, 0xff
test eax, eax
je 0x4f752b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x18], edx
jmp 0x4f7534
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x64
jae 0x4f75c1
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx + 2]
and edx, 0x20
test edx, edx
je 0x4f7563
xor eax, eax
jmp 0x4f75c3
mov eax, 1
test eax, eax
je 0x4f75c1
push 0xf110000b
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0x2ca
push 0x6aeb8c
call fcn.004b8320
add esp, 0x14
push 0xf110000b
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004afca3
add esp, 0xc
push 0xf110000b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.00578c4a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4fa060
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59a779
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004d4f70
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x614f54
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004b27d6
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x312
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004b5e90
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4fa0ff
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x4fa135
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b12e8
and eax, 0xff
test eax, eax
jne 0x4fa116
jmp 0x4fa135
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x6af254
call fcn.004b9670
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b3524
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4fcc20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59a9b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004d4f70
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x6150bc
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004b27d6
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x2e1
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004b5e90
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4fccbf
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x4fccf5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b12e8
and eax, 0xff
test eax, eax
jne 0x4fccd6
jmp 0x4fccf5
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x6af55c
call fcn.004b9670
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b3524
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ffd20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59abf9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004d4f70
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x615344
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004b27d6
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x295
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004b5e90
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4ffdbf
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x4ffdf5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b12e8
and eax, 0xff
test eax, eax
jne 0x4ffdd6
jmp 0x4ffdf5
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x6af9e0
call fcn.004b9670
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b3524
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x5029a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59afa9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004d4f70
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x6154c4
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
call fcn.004b27d6
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0x273
push str.C:Userspc1Desktopcpp_vipTbJYVipTBcmdInfoinclude_.._.._comObject_Cietb.h
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x5c]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.004b5e90
add esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x502a3f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x502a75
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b12e8
and eax, 0xff
test eax, eax
jne 0x502a56
jmp 0x502a75
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x6afc4c
call fcn.004b9670
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
call fcn.004b3524
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4