joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0180
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
je 0x4b01a4
cmp dword [ebp - 0x20], 4
je 0x4b0272
jmp 0x4b0281
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x108]
add edx, 0x14
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x108], edx
lea ecx, [ebp - 0x10]
call fcn.00439b90
lea ecx, [ebp - 0x10]
call fcn.00439b90
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x30
call fcn.00434980
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ecx + 0x108]
cmp eax, dword [edx + 0x10c]
jge 0x4b01f7
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x108]
mov dword [ebp - 0x24], edx
jmp 0x4b0203
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x10c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x24]
mov dword [ebp - 4], edx
push 1
lea ecx, [ebp - 0x10]
call fcn.00439b90
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x30
call fcn.00417fc0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [eax + 0x108]
cmp edx, dword [ecx + 0x10c]
jl 0x4b0270
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x30
call fcn.00426800
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x30
call fcn.004a0810
mov ecx, eax
call fcn.0046ade0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4b0270
push 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4b0281
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x30
call fcn.00426800
mov esp, ebp
pop ebp
ret 4

Function at 0x4b0290
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x30
call fcn.004a0810
mov ecx, eax
call fcn.0046ade0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b02c4
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4b3880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
movzx ecx, word [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b38e8
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4b38e8
cmp dword [ebp + 0xc], 0
je 0x4b38dc
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x4b38ea
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b4730
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52970c
mov eax, dword fs:[0]
push eax
sub esp, 0x480
mov eax, dword [0x56f28c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov word [ebp - 0x424], ax
push 0x40e
push 0
lea ecx, [ebp - 0x422]
push ecx
call fcn.00500270
add esp, 0xc
lea ecx, [ebp - 0x428]
call fcn.004457d0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b48f8
push 0x208
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x4b48f8
push str.explorer.exe
lea ecx, [ebp - 0x424]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov dword [ebp - 0x484], 0
push 0x40
push 0
lea edx, [ebp - 0x480]
push edx
call fcn.00500270
add esp, 0xc
mov dword [ebp - 0x484], 0x44
lea eax, [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov ecx, 5
mov word [ebp - 0x454], cx
mov dword [ebp - 0x458], 1
lea edx, [ebp - 0x424]
push edx
push 0x53f6cc
lea eax, [ebp - 0x428]
push eax
call fcn.00428670
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4b484f
push str.__e___
lea ecx, [ebp - 0x428]
call fcn.0042fdb0
jmp 0x4b485f
push str.__select___
lea ecx, [ebp - 0x428]
call fcn.0042fdb0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x428]
call fcn.0042fdb0
push 0x53f700
lea ecx, [ebp - 0x428]
call fcn.0042fdb0
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x484]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x428]
call fcn.00418d50
push eax
push 0
call fcn.004b4a40
push 0
lea ecx, [ebp - 0x428]
call fcn.00428020
mov edx, dword [ebp - 0x434]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x488], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.004458f0
mov eax, dword [ebp - 0x488]
jmp 0x4b491a
mov dword [ebp - 0x48c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.004458f0
mov eax, dword [ebp - 0x48c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ffa01
mov esp, ebp
pop ebp
ret
Function at 0x4b4a40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x559288
push 0x504400
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x56f28c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x2c]
push eax
mov ecx, dword [ebp + 0x28]
push ecx
mov edx, dword [ebp + 0x24]
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
jmp 0x4b4acb
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x28
Function at 0x4c9fb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x1c], ecx
mov dword [ebp + 0xc], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x530]
jne 0x4c9fd3
jmp 0x4ca1ec
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x684], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
je 0x4ca005
cmp dword [ebp - 0x20], 2
je 0x4ca10c
cmp dword [ebp - 0x20], 3
je 0x4ca179
jmp 0x4ca1d8
push 1
mov ecx, dword [ebp - 0x1c]
add ecx, 0x60
push ecx
mov edx, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, edx
call fcn.004a7bf0
mov dword [ebp - 0x24], eax
call fcn.004d8c80
add esp, 8
call fcn.00427ed0
mov ecx, eax
call fcn.00493130
xor ecx, ecx
cmp eax, 4
sete cl
push ecx
push 0xac5
mov edx, dword [ebp - 0x1c]
add edx, 0x5c
push edx
call fcn.004d8d30
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x4ca0b0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x530]
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 2
je 0x4ca06f
cmp dword [ebp - 0x28], 3
je 0x4ca083
jmp 0x4ca090
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x98]
mov dword [edx + 0x684], ecx
jmp 0x4ca090
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x684], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x680], 0
push 0
push 0xa
push 1
mov ecx, dword [ebp - 0x1c]
add ecx, 0x30
call fcn.004267d0
jmp 0x4ca107
push 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x98]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x5402f0
call fcn.004fc2c0
mov ecx, eax
call fcn.004fce50
lea ecx, [ebp - 0x10]
call fcn.00439b90
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x30
call fcn.00418010
push 1
lea ecx, [ebp - 0x10]
call fcn.00439b90
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x60
call fcn.004a1f10
mov ecx, eax
call fcn.0049c800
jmp 0x4ca1d8
push 0x5402f8
call fcn.004fc2c0
mov ecx, eax
call fcn.004fce50
cmp dword [ebp + 0xc], 0
je 0x4ca155
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x98]
mov dword [ecx + 0x684], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x680], 0
push 0
push 0xa
push 1
mov ecx, dword [ebp - 0x1c]
add ecx, 0x30
call fcn.004267d0
jmp 0x4ca177
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x98]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004caac0
push 5
mov ecx, dword [ebp - 0x1c]
add ecx, 0x98
call fcn.00418070
jmp 0x4ca1d8
push 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x98]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [ebp - 0x1c]
add eax, 0x60
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.004a7bf0
mov dword [ebp - 0x2c], eax
call fcn.004d8c80
add esp, 8
push 0
push 0xac5
mov ecx, dword [ebp - 0x1c]
add ecx, 0x5c
push ecx
call fcn.004d8d30
add esp, 0xc
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x30]
push eax
push 0x540300
call fcn.004fc2c0
mov ecx, eax
call fcn.004fc730
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x530], edx
mov ecx, dword [ebp - 0x1c]
call fcn.004ca200
mov esp, ebp
pop ebp
ret 8
Function at 0x4cd6f0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52b649
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x56f28c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
call fcn.004ca4e0
call fcn.00424e90
mov ecx, eax
call fcn.00473ad0
call fcn.00424e90
push eax
call fcn.00473080
push eax
push 0x7c9
mov eax, dword [ebp - 0x20]
add eax, 0x5c
push eax
call fcn.004d8d30
add esp, 0xc
mov dword [ebp - 0x10], 0
call fcn.00427ed0
mov ecx, eax
call fcn.00490e50
test eax, eax
je 0x4cd792
push str.IDI_ICON_WIFI_LOGO_FREE
mov ecx, dword [ebp - 0x20]
add ecx, 0x64
push ecx
mov edx, esp
mov dword [ebp - 0x14], esp
push ecx
mov ecx, edx
call fcn.00499e40
mov dword [ebp - 0x24], eax
call fcn.004d8de0
add esp, 8
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
jmp 0x4cd7bf
push str.IDI_ICON_WIFI_LOGO
mov ecx, dword [ebp - 0x20]
add ecx, 0x64
push ecx
mov edx, esp
mov dword [ebp - 0x18], esp
push ecx
mov ecx, edx
call fcn.00499e40
mov dword [ebp - 0x2c], eax
call fcn.004d8de0
add esp, 8
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4cd7f3
mov ecx, dword [ebp - 0x20]
add ecx, 0x4b4
call fcn.004dab10
movzx ecx, al
test ecx, ecx
je 0x4cd7f3
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x20]
add ecx, 0x4b4
call fcn.004a1f10
mov ecx, eax
call fcn.004a3820
call fcn.00427ed0
mov ecx, eax
call fcn.00490e50
push eax
push 0x7cc
mov eax, dword [ebp - 0x20]
add eax, 0x5c
push eax
call fcn.004da2b0
add esp, 0xc
mov ecx, dword [ebp - 0x20]
add ecx, 0x60
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00498e80
mov dword [ebp - 4], 0
call fcn.00427ed0
mov ecx, eax
call fcn.00490e50
push eax
push 0x8c1
lea edx, [ebp - 0x1c]
push edx
call fcn.004da2b0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004bfa60
call fcn.00424e90
push eax
call fcn.00473080
push eax
call fcn.00427ed0
mov ecx, eax
call fcn.00490e50
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x68
call fcn.004be320
mov ecx, dword [ebp - 0x20]
add ecx, 0x68
call fcn.004bcf90
push 0
push 0
push 0x1410
mov ecx, dword [ebp - 0x20]
add ecx, 0x30
call fcn.00417f90
call fcn.00427ed0
mov ecx, eax
call fcn.00493130
xor ecx, ecx
cmp eax, 4
sete cl
push ecx
push 0xac5
mov edx, dword [ebp - 0x20]
add edx, 0x5c
push edx
call fcn.004d8d30
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4ce220
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52b746
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x56f28c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x60], ecx
mov eax, dword [ebp - 0x60]
cmp dword [eax + 0x65c], 0
je 0x4ce2b1
mov ecx, dword [ebp - 0x60]
mov ecx, dword [ecx + 0x65c]
add ecx, 0x30
call fcn.00418090
test eax, eax
je 0x4ce27a
mov edx, dword [ebp - 0x60]
mov ecx, dword [edx + 0x65c]
add ecx, 0x2c
call fcn.004d1910
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 0x65c]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], 0
je 0x4ce2aa
push 1
mov ecx, dword [ebp - 0x40]
add ecx, 0x2c
mov eax, dword [ebp - 0x40]
mov edx, dword [eax + 0x2c]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x64], eax
jmp 0x4ce2b1
mov dword [ebp - 0x64], 0
lea ecx, [ebp - 0x54]
push ecx
mov ecx, dword [ebp - 0x60]
add ecx, 0x4e0
call fcn.004a1f10
mov ecx, eax
call fcn.0049c7a0
push eax
lea ecx, [ebp - 0x20]
call fcn.00434380
push 0xb0
call fcn.004fff64
add esp, 4
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x5c], 0
je 0x4ce2fd
mov ecx, dword [ebp - 0x5c]
call fcn.004f94c0
mov dword [ebp - 0x68], eax
jmp 0x4ce304
mov dword [ebp - 0x68], 0
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x58], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x58]
mov dword [eax + 0x65c], ecx
lea ecx, [ebp - 0x30]
call fcn.00439b90
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x60]
add ecx, 0x30
call fcn.00418010
mov eax, dword [ebp - 0x14]
sub eax, 6
push eax
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp - 0x30]
mov dword [ecx], edx
mov eax, dword [ebp - 0x2c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x28]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x24]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x60]
mov edx, dword [ecx + 0x30]
push edx
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 0x65c]
call fcn.004f9f20
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x3c]
push edx
call fcn.00427ed0
mov ecx, eax
call fcn.00491750
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x60]
mov ecx, dword [edx + 0x65c]
call fcn.004fa470
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 0x68c]
or ecx, 1
mov edx, dword [ebp - 0x60]
mov dword [edx + 0x68c], ecx
mov ecx, dword [ebp - 0x60]
call fcn.004d0040
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4d0a60
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52bab0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x56f28c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x698], 0
je 0x4d0afe
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx + 0x698]
add ecx, 0x30
call fcn.00418090
test eax, eax
je 0x4d0aba
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + 0x698]
add ecx, 0x2c
call fcn.004d1910
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x698]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
je 0x4d0aea
push 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x2c]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x24], eax
jmp 0x4d0af1
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x698], 0
push 0x64
call fcn.004fff64
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0
je 0x4d0b25
mov ecx, dword [ebp - 0x1c]
call fcn.004c5520
mov dword [ebp - 0x28], eax
jmp 0x4d0b2c
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x698], ecx
push 0
push 0
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx + 0x698]
add ecx, 0x2c
call fcn.004d67b0
push 5
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x698]
add ecx, 0x30
call fcn.00418070
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4d2ea0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52bd32
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x56f28c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
push 0xfffffffffffffff0
mov ecx, dword [ebp - 0x34]
add ecx, 0x30
call fcn.00499060
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 0xff3fffff
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0xfffffffffffffff0
mov ecx, dword [ebp - 0x34]
add ecx, 0x30
call fcn.00499080
mov ecx, dword [ebp - 0x34]
call fcn.004d2d20
test eax, eax
jne 0x4d2f07
xor eax, eax
jmp 0x4d2fdc
lea edx, [ebp - 0x10]
push edx
call fcn.0044aff0
add esp, 4
mov dword [ebp - 4], 0
push 0x5413c0
lea ecx, [ebp - 0x10]
call fcn.0042fdb0
lea ecx, [ebp - 0x10]
call fcn.0046ade0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4d2f79
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x30
call fcn.00418010
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x6c
mov dword [ebp - 0x28], edx
push 0x16
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x24]
push ecx
push 0
push 0
push 0
mov ecx, dword [ebp - 0x34]
add ecx, 0x30
call fcn.00429aa0
push 0
mov ecx, dword [ebp - 0x34]
add ecx, 0x30
call fcn.00429b40
mov edx, dword [ebp - 0x34]
add edx, 0x58
push edx
lea ecx, [ebp - 0x2c]
call fcn.00498e80
mov byte [ebp - 4], 1
call fcn.00427ed0
mov ecx, eax
call fcn.00490e50
push eax
push 0xce6
lea eax, [ebp - 0x2c]
push eax
call fcn.004da2b0
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004bfa60
mov dword [ebp - 0x30], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004458f0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4db130
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x56f28c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4db14d
xor eax, eax
jmp 0x4db1b8
mov dword [ebp - 0x814], 0x400
push 0x808
push 0
lea eax, [ebp - 0x810]
push eax
call fcn.00500270
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x810]
push edx
call fcn.004db1d0
add esp, 8
lea eax, [ebp - 0x810]
push eax
call fcn.004db1f0
add esp, 4
push str.THEMES_
lea ecx, [ebp - 0x810]
push ecx
call fcn.00425ba0
add esp, 8
test eax, eax
je 0x4db1ae
mov eax, 1
jmp 0x4db1b8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ffa01
mov esp, ebp
pop ebp
ret
Function at 0x4e0210
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x4e0352
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4e0243
mov eax, 1
jmp 0x4e0354
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [eax]
cmp edx, dword [ecx + 0x68]
jne 0x4e0281
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0xd
jne 0x4e0281
mov ecx, dword [ebp - 8]
sub ecx, 0x60
call fcn.004e2010
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
sub ecx, 0x60
call fcn.004e1880
mov eax, 1
jmp 0x4e0354
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 9
jne 0x4e0352
mov edx, dword [ebp - 8]
cmp dword [edx + 0xa8], 3
je 0x4e02a6
mov eax, dword [ebp - 8]
cmp dword [eax + 0xa8], 2
jne 0x4e02b0
mov eax, 1
jmp 0x4e0354
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x8000
mov dword [ebp - 4], ecx
je 0x4e02d0
mov eax, 1
jmp 0x4e0354
mov edx, dword [ebp - 8]
cmp dword [edx + 0xb4], 0
je 0x4e0352
mov eax, dword [ebp - 8]
cmp dword [eax + 0xb8], 0
je 0x4e02f4
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0xb8], 2
jne 0x4e031e
mov ecx, dword [ebp - 8]
sub ecx, 0x60
call fcn.004e2010
mov ecx, dword [ebp - 8]
add ecx, 0x28
call fcn.0046ade0
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
sub ecx, 0x60
call fcn.004e1650
jmp 0x4e0352
mov edx, dword [ebp - 8]
cmp dword [edx + 0xb8], 1
jne 0x4e0352
mov ecx, dword [ebp - 8]
sub ecx, 0x60
call fcn.004e2010
mov ecx, dword [ebp - 8]
add ecx, 0x24
call fcn.0046ade0
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
sub ecx, 0x60
call fcn.004e1690
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x4e3200
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d406
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x56f28c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.004457d0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004457d0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
add edx, 0x14
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x542348
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.00427f80
push str.360conf.dll
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00427f80
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret