joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442c30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov edx, ecx
push ebx
push esi
push edi
mov esi, dword [edx + 0x4c]
mov ebx, 0x100
mov edi, dword [edx + 0x1b8]
cmp esi, 1
mov dword [ebp - 0xc], edx
sete al
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov byte [edi + 0x1c], al
mov eax, 0x2fe
push dword [edx + 0x64]
mov ecx, dword [edx + 4]
cmovne eax, ebx
push eax
push 1
push edx
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
mov dword [edi + 0x18], eax
add esp, 0x10
mov eax, dword [edi + 0x14]
mov dword [ebp - 8], ebx
cmp dword [ecx + 0x64], ebx
jle 0x442d5a
nop dword [eax]
mov ecx, dword [edi + ebx*4 + 0x20]
cdq
idiv ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
cmp esi, 1
jne 0x442cac
mov eax, dword [edi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [edi + 0x18]
lea edi, [ecx*2 - 2]
mov eax, dword [eax + ebx*4]
xor ebx, ebx
mov dword [ebp - 4], eax
lea eax, [ecx + 0xfe]
cdq
idiv edi
xor esi, esi
mov edx, eax
nop dword [eax + eax]
cmp esi, edx
jle 0x442cf4
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x442ce2
mov ecx, dword [ebp - 0x10]
movzx eax, bl
movzx ecx, cl
imul ecx, eax
mov eax, dword [ebp - 4]
mov byte [esi + eax], cl
inc esi
mov ecx, dword [ebp - 0x14]
cmp esi, 0xff
jle 0x442cd0
mov esi, dword [ebp - 0x18]
cmp esi, 1
jne 0x442d41
mov ebx, eax
mov ecx, esi
lea edx, [ebx - 1]
movzx eax, byte [ebx]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebx + 0xff]
mov byte [ebx + ecx + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x442d21
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, dword [eax + 0x64]
mov eax, dword [ebp - 0x10]
jl 0x442c90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44a1a0
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
je 0x44a1ba
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x44a1ba
mov ecx, dword [ecx + 0x44]
test ecx, ecx
je 0x44a1ba
push 1
push ecx
call eax
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x463610
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, ebx
push esi
push edi
mov edi, dword [ebp + 8]
cdq
add eax, dword [edi + 0x28]
adc edx, dword [edi + 0x2c]
cmp edx, dword [edi + 0x34]
jl 0x46365f
jg 0x463637
cmp eax, dword [edi + 0x30]
jb 0x46365f
lea eax, [esp + 0x14]
mov dword [esp + 0x10], 0
push eax
push dword [edi + 0x10]
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x14]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
mov esi, dword [edi]
push edi
call dword [esi + 0x1c]
push edx
push eax
push edi
call dword [esi + 0x18]
mov esi, dword [edi + 0x30]
mov eax, esi
sub eax, dword [edi + 0x28]
mov edx, dword [edi + 0x34]
sbb edx, dword [edi + 0x2c]
test edx, edx
jg 0x463692
jl 0x463683
test eax, eax
jae 0x463692
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
mov ecx, dword [esp + 0x10]
jmp 0x463698
mov ecx, eax
mov dword [esp + 0x14], edx
cmp ecx, ebx
jge 0x4636af
test edx, edx
jg 0x4636aa
jl 0x4636a6
test eax, eax
jae 0x4636aa
xor ebx, ebx
jmp 0x4636af
mov ebx, esi
sub ebx, dword [edi + 0x28]
mov eax, ebx
mov ecx, edi
cdq
push edx
push eax
push dword [ebp + 0xc]
call fcn.004636d0
neg eax
pop edi
sbb eax, eax
pop esi
and eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x473b20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
push edi
test eax, eax
jne 0x473c5b
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
cmp dword [esi + 0x21c], eax
je 0x473b6b
push 0x11
call ebx
cwde
test eax, 0x10000
jne 0x473b72
push 0xa0
call ebx
cwde
test eax, 0x10000
jne 0x473b72
push 0xa1
call ebx
cwde
test eax, 0x10000
jne 0x473b72
mov ecx, esi
call fcn.004738a0
mov edi, dword [ebp + 8]
test edi, edi
js 0x473d15
cmp edi, dword [esi + 0x20c]
jge 0x473d15
push 0xa0
call ebx
cwde
test eax, 0x10000
jne 0x473ba7
push 0xa1
call ebx
cwde
test eax, 0x10000
je 0x473bde
mov eax, dword [esi + 0x234]
test eax, eax
js 0x473bde
cmp eax, dword [esi + 0x20c]
jge 0x473bde
push eax
push edi
mov ecx, esi
call fcn.00473ac0
mov eax, dword [esi + 0x234]
cmp edi, eax
cmovg eax, edi
mov dword [esi + 0x238], eax
mov dword [esi + 0x240], eax
jmp 0x473d15
mov ecx, 1
cmp edi, dword [esi + 0x20c]
jae 0x473d66
cmp dword [esi + 0x21c], 0
mov eax, dword [esi + 0x208]
mov eax, dword [eax + edi*4]
mov edx, dword [eax + 0x10]
mov dword [ebp + 8], edx
je 0x473c24
push 0x11
call ebx
mov edx, dword [ebp + 8]
cwde
test eax, 0x10000
je 0x473c1f
xor ecx, ecx
test edx, edx
sete cl
jmp 0x473c24
mov ecx, 1
cmp edi, dword [esi + 0x20c]
jae 0x473d66
mov eax, dword [esi + 0x208]
mov eax, dword [eax + edi*4]
mov dword [eax + 0x10], ecx
sub ecx, edx
add dword [esi + 0x230], ecx
mov dword [esi + 0x238], edi
mov dword [esi + 0x234], edi
mov dword [esi + 0x240], edi
jmp 0x473d15
cmp eax, 2
jne 0x473cc4
mov edi, dword [ebp + 8]
test edi, edi
js 0x473cbd
cmp edi, dword [esi + 0x20c]
jge 0x473cbd
jae 0x473d66
mov eax, dword [esi + 0x208]
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x10], 0
jne 0x473d15
call fcn.004738a0
cmp edi, dword [esi + 0x20c]
jae 0x473d66
mov eax, dword [esi + 0x208]
mov eax, dword [eax + edi*4]
mov dword [eax + 0x10], 1
mov dword [esi + 0x234], edi
mov dword [esi + 0x238], edi
mov dword [esi + 0x240], edi
jmp 0x473d0b
call fcn.004738a0
jmp 0x473d15
cmp eax, 3
jne 0x473d15
call fcn.004738a0
mov ecx, dword [ebp + 8]
test ecx, ecx
js 0x473d15
cmp ecx, dword [esi + 0x20c]
jge 0x473d15
jae 0x473d66
mov eax, dword [esi + 0x208]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0x10], 1
mov dword [esi + 0x234], ecx
mov dword [esi + 0x238], ecx
mov dword [esi + 0x23c], ecx
mov dword [esi + 0x240], ecx
mov dword [esi + 0x230], 1
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x64]
mov ecx, dword [esi + 0x10c]
lea eax, [esi + 0x68]
push eax
call fcn.0047d2d0
mov eax, dword [esi + 0x10c]
push 0
push dword [esi + 0xb8]
push dword [0x6a2298]
push dword [eax + 0x1fc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esi + 0x22c]
test ecx, ecx
je 0x473d5f
mov eax, dword [ecx]
push dword [esi + 0xb8]
call dword [eax]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
push 0x80070057
call fcn.00405000
int3
Function at 0x475110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x69301c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x7c]
mov dword [ebp - 0x58], edi
test ecx, ecx
je 0x475139
mov eax, dword [ecx]
push 1
call dword [eax + 4]
push 0x28
call fcn.004a5e80
mov esi, eax
add esp, 4
mov dword [ebp - 0x54], esi
test esi, esi
je 0x475180
mov ecx, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], ecx
mov dword [esi], vtable.XSkinListWndSubClasser.0
mov dword [esi + 0x24], 1
jmp 0x475182
xor esi, esi
mov dword [ebx + 0x7c], esi
mov ecx, esi
mov eax, dword [esi]
mov dword [esi + 0x24], 1
call dword [eax + 8]
mov dword [ebp - 0x54], eax
mov eax, dword [esi + 0x14]
test eax, eax
jne 0x4751a9
call fcn.005ecbb2
mov dword [esi + 0x14], eax
test eax, eax
je 0x4751cf
push esi
push dword [ebp - 0x54]
push eax
call fcn.005eccb4
push dword [esi + 0x14]
call fcn.005ecc17
push eax
push 0xfffffffffffffffc
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
test eax, eax
je 0x4751cf
mov dword [esi + 0x20], eax
mov dword [esi + 4], edi
push dword [ebp - 0x58]
lea eax, [ebx + 0x20]
mov dword [0x6939b0], 0x6612e8
push eax
xorps xmm0, xmm0
mov dword [0x6939ac], 0
push 0x693988
mov dword [0x69398c], 3
movups xmmword [ebp - 0x14], xmm0
call fcn.00475e80
add esp, 8
movzx eax, ax
mov ecx, ebx
push eax
push 0
push 0x80
push 0x90410000
push 0x661304
lea eax, [ebp - 0x14]
push eax
push edi
call fcn.00475d90
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push 0
push 0
push dword [ebx + 4]
push 0x64
push 0x14
call edi
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push 0
push 0
push 0x50000003
push 0
push 0x661308
push 0
call esi
push 0
push 0
push 0
push dword [ebx + 4]
mov dword [ebx + 0x38], eax
push 0x64
push 0x14
call edi
push eax
push 0
push 0
push 0x50000014
push str.GRIP
push str.SCROLLBAR
push 0
call esi
push 0
push eax
mov dword [ebx + 0x3c], eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, ebx
call fcn.004755b0
mov eax, dword [ebx + 0x28]
push 0
push 0
push 2
push dword [ebx + 0x38]
mov dword [ebx + 0x70], eax
call dword [sym.imp.USER32.dll_SetScrollPos]
mov ecx, ebx
call fcn.00475670
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x4752f4
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [ebp - 0x50]
push eax
push esi
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
add ecx, 2
push esi
push dword [ebx + 4]
add eax, ecx
mov dword [ebx + 0x64], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [ebx + 0x74], eax
xor ecx, ebp
mov eax, dword [ebp - 0x58]
pop edi
mov dword [ebx + 0x78], eax
mov eax, 1
pop esi
pop ebx
call fcn.005eb48e
mov esp, ebp
pop ebp
ret 8
Function at 0x475670
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x69301c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
xorps xmm0, xmm0
movups xmmword [ebp - 0x14], xmm0
cmp dword [edi + 0x70], 0
je 0x475766
lea eax, [ebp - 0x14]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x14]
push eax
push dword [edi + 4]
call esi
test eax, eax
je 0x4756be
lea eax, [ebp - 0xc]
push eax
push dword [edi + 4]
call esi
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cdq
idiv dword [edi + 0x64]
mov ecx, dword [edi + 0x70]
push 1
dec ecx
mov dword [ebp - 0x30], 0x1c
push ecx
push 0
push 2
push dword [edi + 0x38]
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov dword [edi + 0x68], eax
mov dword [ebp - 0x18], 2
call dword [sym.imp.USER32.dll_SetScrollRange]
push 1
lea eax, [ebp - 0x30]
push eax
push 2
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov eax, dword [edi + 0x70]
mov ecx, dword [edi + 0x38]
dec eax
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [edi + 0x68], eax
jle 0x47572d
push 0
push ecx
call esi
push 0
jmp 0x475734
push 5
push ecx
call esi
push 5
push dword [edi + 0x3c]
call esi
mov eax, dword [edi + 0x60]
mov edx, dword [edi + 0x68]
add eax, edx
mov ecx, dword [edi + 0x70]
cmp eax, ecx
jle 0x475766
sub ecx, edx
mov dword [edi + 0x60], ecx
jns 0x475758
mov dword [edi + 0x60], 0
xor ecx, ecx
push 1
push ecx
push 2
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_SetScrollPos]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005eb48e
mov esp, ebp
pop ebp
ret
Function at 0x47e330
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 8], 0
push ebx
push esi
push edi
mov edi, ecx
cmp eax, 1
jne 0x47e4a5
push eax
push dword [edi + 0x224]
call dword [sym.imp.USER32.dll_KillTimer]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
mov dword [ebp - 0xc], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [edi + 0x3ec]
mov ecx, dword [edi + 0x3f0]
cmp dword [ebp - 0x10], eax
jne 0x47e587
cmp dword [ebp - 0xc], ecx
jne 0x47e587
mov eax, dword [edi + 0x374]
cmp eax, dword [edi + 0x3f4]
jne 0x47e405
mov eax, dword [edi + 0x368]
mov eax, dword [eax + 0x28]
sub eax, 0x10
push eax
call fcn.00404800
mov ecx, dword [edi + 0x3f4]
add esp, 4
mov dword [ebp - 8], 3
add eax, 0x10
je 0x47e590
mov ecx, dword [ecx + 0xd4]
mov edx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x47e3f8
test si, si
je 0x47e3f4
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x47e3f8
add ecx, 4
add edx, 4
test si, si
jne 0x47e3d2
xor ecx, ecx
jmp 0x47e3fd
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x47e408
mov bl, 1
jmp 0x47e40a
mov eax, dword [ebp + 8]
xor bl, bl
test byte [ebp - 8], 1
je 0x47e428
lea edx, [eax - 0x10]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47e428
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
jne 0x47e587
mov ecx, dword [edi + 0x3f4]
mov eax, dword [ecx + 0xd4]
cmp dword [eax - 0xc], 0
je 0x47e587
mov dword [edi + 0x374], ecx
mov eax, dword [ecx + 0xd4]
push ecx
sub eax, 0x10
mov esi, esp
push eax
mov dword [ebp + 8], esi
call fcn.00404800
add esp, 4
add eax, 0x10
mov dword [esi], eax
mov ecx, dword [edi + 0x368]
push dword [edi + 0x3f4]
call fcn.00485080
cmp dword [edi + 0x3e8], 0
je 0x47e587
push 0
push 0xbb8
push 2
push dword [edi + 0x224]
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 2
jne 0x47e4cc
mov ecx, dword [edi + 0x368]
call fcn.00485300
push 2
push dword [edi + 0x224]
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 3
jne 0x47e4e5
lea ecx, [edi + 0x380]
call fcn.004849c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 4
jne 0x47e587
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
mov dword [ebp - 0xc], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x10]
push eax
push dword [edi + 0x1fc]
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0
push 0x69c8c8
push 0x69c8ac
push 0
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.00469dc0
push eax
call fcn.0060eb2d
mov esi, eax
add esp, 0x14
test esi, esi
je 0x47e587
cmp dword [esi + 0x150], 0
je 0x47e587
mov eax, dword [esi + 0xb8]
test eax, eax
je 0x47e587
cmp eax, dword [edi + 0x114]
je 0x47e587
push 0
push 0
push 0x1f
push dword [edi + 0x110]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push dword [0x6a22b8]
mov dword [edi + 0x118], esi
push dword [edi + 0x224]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00405000
int3
Function at 0x485300
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x38]
test esi, esi
je 0x48538d
mov eax, dword [esi + 0xa0]
cmp dword [eax + 0x74], 0
je 0x48538d
mov ecx, dword [esi + 0x10c]
lea eax, [esi + 0x68]
push eax
call fcn.0047d2d0
mov eax, dword [esi + 0xa0]
mov ecx, esi
push 0
mov dword [eax + 0x74], 0
mov eax, dword [esi]
call dword [eax + 0x60]
mov eax, dword [esi + 0x10c]
mov dword [ebp - 4], esi
mov edx, dword [eax + 0x1cc]
test edx, edx
je 0x485364
mov ecx, dword [eax + 0x1c8]
test ecx, ecx
je 0x4853a3
cmp dword [ecx + 8], esi
je 0x48538d
lea esi, [eax + 0x1c4]
test edx, edx
jne 0x485382
push edx
push edx
push dword [0x6a22b4]
push dword [eax + 0x224]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.0040a4a0
mov eax, dword [edi + 4]
test eax, eax
je 0x48539d
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00405000
int3
Function at 0x48a9f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x613bee
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x69301c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.004a6e1d
mov ecx, eax
test ecx, ecx
je 0x48aadf
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
push dword [ebx + 0x110]
mov dword [ebp - 0x10], 1
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
je 0x48aabf
lea edi, [eax + 1]
test edi, edi
js 0x48aad5
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x48aa82
push edi
mov ecx, esi
call fcn.00404e50
push edi
push dword [esi]
push dword [ebx + 0x110]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi]
test eax, eax
jne 0x48aa9b
xor ecx, ecx
jmp 0x48aaad
push dword [eax - 8]
push eax
call fcn.005fa8cc
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x48aad5
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x48aad5
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00405000
push 0x80004005
call fcn.00405000
int3
Function at 0x48b220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x48b3a7
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x48b3a7
cmp dword [esi + 0x20], 0
je 0x48b3a7
cmp dword [esi + 0x24], 0
je 0x48b3a7
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov edx, dword [ecx + 0x18]
mov eax, dword [ecx + 8]
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], eax
test edx, edx
jns 0x48b27f
neg edx
mov dword [ecx + 0x18], edx
test edx, edx
mov eax, 0x71
push edi
mov edi, 0x2a
cmovne eax, edi
mov dword [ecx + 4], eax
xor eax, eax
cmp edx, 2
setne al
mov dword [esi + 0x30], eax
lea eax, [ecx + 0x94]
mov dword [ecx + 0xb18], eax
lea eax, [ecx + 0x988]
mov dword [ecx + 0xb24], eax
lea eax, [ecx + 0xa7c]
mov dword [ecx + 0xb30], eax
xor eax, eax
mov dword [ecx + 0x28], 0
mov dword [ecx + 0xb20], 0x697c14
mov dword [ecx + 0xb2c], 0x698140
mov dword [ecx + 0xb38], 0x698154
mov word [ecx + 0x16b8], ax
mov dword [ecx + 0x16bc], eax
call fcn.0048f3e0
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.005ee670
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x66802a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x668028]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x66802c]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x66802e]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
Function at 0x493a00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x613c80
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x69301c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x198]
mov dword [ebx], vtable.CBandiMuxerMp4.1.0
mov dword [ebx + 4], vtable.CBandiMuxerMp4.0
test eax, eax
je 0x493b0c
mov eax, dword [eax + 4]
sub eax, 0x10
push eax
call fcn.00404800
mov edi, dword [ebx + 0x198]
add esp, 4
lea esi, [eax + 0x10]
mov ecx, dword [edi]
test ecx, ecx
je 0x493a6d
mov dword [edi], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push 0
lea ecx, [edi + 4]
push 0x669194
call fcn.00405050
mov edi, dword [ebx + 0x198]
mov dword [ebp - 0x10], edi
test edi, edi
je 0x493aed
mov dword [ebp - 4], 0
mov ecx, dword [edi]
test ecx, ecx
je 0x493aa2
mov dword [edi], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push 0
push 0x669194
lea ecx, [edi + 4]
call fcn.00405050
mov edx, dword [edi + 4]
or eax, 0xffffffff
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x493acc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x10]
mov ecx, dword [edi]
test ecx, ecx
je 0x493adb
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push 8
push edi
mov dword [ebp - 4], 0xffffffff
call fcn.005eb8eb
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x493b0c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebx + 0x84]
test ecx, ecx
je 0x493b26
mov dword [ebx + 0x84], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
xor edi, edi
cmp dword [ebx + 0x60], edi
jle 0x493b4b
lea esi, [ebx + 0x10]
mov ecx, dword [esi]
test ecx, ecx
je 0x493b3c
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi], 0
inc edi
add esi, 4
cmp edi, dword [ebx + 0x60]
jl 0x493b30
mov ecx, dword [ebx + 0x84]
test ecx, ecx
je 0x493b5b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
or eax, 0xffffffff
lock xadd dword [0x6a223c], eax
jne 0x493b82
mov eax, dword [0x6a2240]
test eax, eax
je 0x493b82
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x6a2240], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49c730
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x6a23f4], 0
push edi
mov edi, ecx
je 0x49c7a8
sub esp, 8
mov dword [ebp - 4], 0
push str.SOFTWAREBANDISOFTBANDICAMOPTION
push ecx
lea ecx, [ebp - 4]
call fcn.00410d10
mov eax, dword [0x6a23dc]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.WindowPos.x
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [0x6a23e0]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.WindowPos.y
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x49c7a8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
call fcn.004aa30c
pop edi
mov esp, ebp
pop ebp
ret