joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4067c0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x1a8
mov eax, 0x40b568
push ebx
push ebp
push esi
push edi
xor ebp, ebp
cmp ecx, dword [eax]
je 0x4067e4
add eax, 8
inc ebp
cmp eax, 0x40b5f8
jb 0x4067d5
cmp ecx, dword [ebp*8 + 0x40b568]
jne 0x40698b
mov eax, dword [0x40fdd4]
cmp eax, 1
je 0x40694d
test eax, eax
jne 0x406810
cmp dword [0x40b274], 1
je 0x40694d
cmp ecx, 0xfc
je 0x40698b
lea eax, [esp + 0xb4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40684b
mov ecx, 5
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x406894
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 3
mov ebx, ecx
lea ecx, [esp + 0xb8]
sub ecx, 0x3b
push 0x40a710
add ebx, ecx
push ebx
call fcn.00403b40
add esp, 0xc
mov ecx, 6
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push 0x12010
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40a6f0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Microsoft_Visual_C_Runtime_Library
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp*8 + 0x40b56c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.004086a0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x411260]
test eax, eax
je 0x40695e
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x406968
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebp*8 + 0x40b56c]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
Function at 0x42af60
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x4e18b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00427bb0
add esp, 4
movzx edx, al
test edx, edx
je 0x42aff1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.0048cf30
add esp, 0xc
mov dword [ebp - 0x2d8], 0x10001
lea edx, [ebp - 0x2d8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x42afef
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp + 0xc]
jne 0x42afef
jmp 0x42aff1
jmp 0x42af73
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048c332
mov esp, ebp
pop ebp
ret
Function at 0x43db40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0x43dbac
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0x43dbf3
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.0048bcae
add esp, 8
test eax, eax
jne 0x43dbf1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x43dbf5
jmp 0x43dba3
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x45fb70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x45fbd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x45fbc7
mov edx, dword [0x4f7f78]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x45fbbb
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x45fba0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x45fbc9
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x462a50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bacc7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4e18b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00461990
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00461990
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00461990
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00462350
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00462350
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00462350
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x462d20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4badb7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4e18b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004618c0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.004618c0
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.004618c0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00462370
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.00462370
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.00462370
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x464b60
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb5ca
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x4e18b0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x14], 0x8000
mov dword [ebp - 0x10], 0x4e42dc
mov byte [ebp - 0x45], 0
lea eax, [ebp - 0x45]
push eax
push 0x8000
lea ecx, [ebp - 0x44]
call fcn.0043e930
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0xa8]
call fcn.004636a0
mov dword [ebp - 0xb0], eax
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0xb4], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xb4]
call fcn.00462090
push eax
push 0x8000
push 0
lea ecx, [ebp - 0x44]
call fcn.0043e990
push eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.00462090
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00462090
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa8]
call fcn.0041f6c0
push 0
lea ecx, [ebp - 0x44]
call fcn.0043e990
push eax
lea ecx, [ebp - 0x34]
call fcn.00424330
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x34]
push edx
call fcn.0046bbe0
add esp, 8
movzx eax, al
test eax, eax
je 0x464c93
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.00462390
mov edx, dword [ebp - 0xac]
or edx, 1
mov dword [ebp - 0xac], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.004243c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.0043e970
mov eax, dword [ebp + 8]
jmp 0x464ce3
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
call fcn.00468210
mov ecx, dword [ebp - 0xac]
or ecx, 1
mov dword [ebp - 0xac], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.004243c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x44]
call fcn.0043e970
mov eax, dword [ebp + 8]
jmp 0x464ce3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0048c332
mov esp, ebp
pop ebp
ret
Function at 0x465380
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb781
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4e18b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00462090
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x465436
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x21]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 2
push ecx
lea ecx, [ebp - 0x20]
call fcn.0043e930
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
push 0
lea ecx, [ebp - 0x20]
call fcn.0043e990
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00462090
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
lea ecx, [ebp - 0x20]
call fcn.0043e990
push eax
mov ecx, dword [ebp + 8]
call fcn.00424330
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0043e970
mov eax, dword [ebp + 8]
jmp 0x465455
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00424380
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x465850
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bb871
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4e18b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x4658f8
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x21]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.0043e930
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push 0
lea ecx, [ebp - 0x20]
call fcn.0043e990
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
lea ecx, [ebp - 0x20]
call fcn.0043e990
push eax
mov ecx, dword [ebp + 8]
call fcn.00424330
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0043e970
mov eax, dword [ebp + 8]
jmp 0x465913
mov ecx, dword [ebp + 8]
call fcn.00437870
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4662d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bbae1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4e18b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
push 0
push 0
push 0xe
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x21]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.0043e930
mov dword [ebp - 4], 1
push 0
lea ecx, [ebp - 0x20]
call fcn.0043e990
push eax
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push 0xd
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
lea ecx, [ebp - 0x20]
call fcn.0043e990
push eax
mov ecx, dword [ebp + 8]
call fcn.00424330
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0043e970
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x479fc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4beb48
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4e18b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movsx eax, byte [0x4f8790]
test eax, eax
jne 0x479ff5
call fcn.00479eb0
movzx ecx, byte [0x4f8789]
test ecx, ecx
jne 0x47a0af
movzx edx, byte [0x4f8788]
test edx, edx
jne 0x47a0af
cmp dword [0x4f8894], 0
je 0x47a058
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [0x4f8894]
push ecx
call fcn.00465d90
add esp, 8
mov dword [ebp - 0x10], eax
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0x186
mov eax, dword [0x4f8894]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x4f8894]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x47a0af
push 0x4f8790
lea ecx, [ebp - 0x74]
call fcn.004618c0
mov dword [ebp - 4], 0
push 0x10001
lea edx, [ebp - 0x74]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00465ba0
add esp, 0x10
xor edx, edx
cmp eax, 2
sete dl
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.0041f6c0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x47a0af
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x485780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x48578f
mov eax, dword [eax + 4]
jmp 0x485792
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x48581b
push esi
mov esi, dword [0x4f8c50]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
je 0x485800
cmp eax, 3
je 0x485800
cmp eax, 0x7b
je 0x485800
cmp eax, 0x57
je 0x485800
cmp eax, 0xa1
je 0x485800
cmp eax, 0x35
je 0x485800
cmp eax, 0x20
jne 0x4857f5
mov eax, dword [0x4f8c54]
mov dword [ecx], eax
mov edx, dword [0x4f8c58]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x4f8c54]
mov dword [ecx], eax
mov edx, dword [0x4f8c58]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x4f8c54]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x4f8c58]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x485848
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0x485860
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 8
jb 0x48586f
mov eax, dword [eax + 4]
jmp 0x485872
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4858fb
push esi
mov esi, dword [0x4f8c50]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
je 0x4858e0
cmp eax, 3
je 0x4858e0
cmp eax, 0x7b
je 0x4858e0
cmp eax, 0x57
je 0x4858e0
cmp eax, 0xa1
je 0x4858e0
cmp eax, 0x35
je 0x4858e0
cmp eax, 0x20
jne 0x4858d5
mov eax, dword [0x4f8c54]
mov dword [ecx], eax
mov edx, dword [0x4f8c58]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x4f8c54]
mov dword [ecx], eax
mov edx, dword [0x4f8c58]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x4f8c54]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x4f8c58]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x485928
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0x48c332
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4e18b0]
jne 0x48c33c
repz ret
jmp fcn.00497b9c
Function at 0x4981ff
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4e2230]
je 0x49821a
inc edi
cmp edi, 0x17
jb 0x49820b
cmp edi, 0x17
jae 0x49839a
push ebp
push 3
call fcn.004a560e
cmp eax, 1
pop ecx
je 0x498366
push 3
call fcn.004a560e
test eax, eax
pop ecx
jne 0x49824e
cmp dword [0x4e1970], 1
je 0x498366
cmp ebx, 0xfc
je 0x498399
push 0x4e6124
mov ebx, 0x314
push ebx
mov ebp, 0x4f90e0
push ebp
call fcn.0048b4da
add esp, 0xc
test eax, eax
je 0x498284
push esi
push esi
push esi
push esi
push esi
call fcn.0048cc0c
add esp, 0x14
push 0x104
mov esi, 0x4f90f9
push esi
push 0
mov byte [0x4f91fd], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4982c8
push 0x4e610c
push 0x2fb
push esi
call fcn.0048b4da
add esp, 0xc
test eax, eax
je 0x4982c8
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0048cc0c
add esp, 0x14
push esi
call fcn.0048bd00
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x49830d
push esi
call fcn.0048bd00
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4f93f4
push 0x4e6108
sub ecx, eax
push ecx
push eax
call fcn.0048c341
add esp, 0x14
test eax, eax
je 0x49830d
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0048cc0c
add esp, 0x14
jmp 0x49830f
xor esi, esi
push 0x4e497c
push ebx
push ebp
call fcn.0048b469
add esp, 0xc
test eax, eax
je 0x49832f
push esi
push esi
push esi
push esi
push esi
call fcn.0048cc0c
add esp, 0x14
push dword [edi*8 + 0x4e2234]
push ebx
push ebp
call fcn.0048b469
add esp, 0xc
test eax, eax
je 0x498351
push esi
push esi
push esi
push esi
push esi
call fcn.0048cc0c
add esp, 0x14
push 0x12010
push 0x4e60e0
push ebp
call fcn.004a5451
add esp, 0xc
jmp 0x498399
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x498399
cmp ebp, 0xffffffff
je 0x498399
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4e2234]
push dword [esi]
call fcn.0048bd00
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret