joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473780
Capabilities:
Reference http user-agent string

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x24c]
test eax, eax
je 0x4739a4
push ebx
push ebp
mov ebp, dword [sym.imp.GDI32.dll_GetCurrentObject]
push edi
lea edi, [esi + 0x260]
test edi, edi
je 0x4737cd
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4737cd
test edi, edi
jne 0x4737b3
xor ebx, ebx
jmp 0x4737b6
mov ebx, dword [edi + 4]
push 1
push eax
call ebp
cmp eax, ebx
je 0x4737de
push edi
lea ecx, [esi + 0x248]
call fcn.00515d24
jmp 0x4737de
mov eax, dword [esi + 0x248]
lea ecx, [esi + 0x248]
push 7
call dword [eax + 0x24]
lea edi, [esi + 0x268]
test edi, edi
je 0x473817
mov eax, dword [edi + 4]
test eax, eax
je 0x473817
test edi, edi
jne 0x4737f7
xor ebx, ebx
jmp 0x4737fa
mov ebx, dword [edi + 4]
mov ecx, dword [esi + 0x24c]
push 2
push ecx
call ebp
cmp eax, ebx
je 0x473828
push edi
lea ecx, [esi + 0x248]
call fcn.00515d24
jmp 0x473828
mov edx, dword [esi + 0x248]
lea ecx, [esi + 0x248]
push 0
call dword [edx + 0x24]
lea edi, [esi + 0x270]
test edi, edi
je 0x473865
mov eax, dword [edi + 4]
test eax, eax
je 0x473865
test edi, edi
jne 0x473841
xor ebx, ebx
jmp 0x473844
mov ebx, dword [edi + 4]
mov eax, dword [esi + 0x24c]
push 6
push eax
call ebp
cmp eax, ebx
je 0x473876
mov edx, dword [esi + 0x248]
lea ecx, [esi + 0x248]
push edi
call dword [edx + 0x28]
jmp 0x473876
mov eax, dword [esi + 0x248]
lea ecx, [esi + 0x248]
push 0x11
call dword [eax + 0x24]
cmp dword [esp + 0x14], 1
jne 0x473882
mov edi, dword [esi + 0x5c]
jmp 0x473885
mov edi, dword [esi + 0x58]
mov ecx, dword [esi + 0x250]
push ecx
call dword [sym.imp.GDI32.dll_GetTextColor]
cmp eax, edi
je 0x4738a6
mov edx, dword [esi + 0x248]
lea ecx, [esi + 0x248]
push edi
call dword [edx + 0x30]
cmp dword [esi + 0x60], 0xff000000
je 0x4738f1
mov eax, dword [esi + 0x250]
push eax
call dword [sym.imp.GDI32.dll_GetBkMode]
cmp eax, 2
je 0x4738ce
push 2
lea ecx, [esi + 0x248]
call fcn.00515e00
mov ecx, dword [esi + 0x250]
push ecx
call dword [sym.imp.GDI32.dll_GetBkColor]
mov edx, dword [esi + 0x60]
cmp eax, edx
je 0x473938
mov eax, dword [esi + 0x248]
lea ecx, [esi + 0x248]
push edx
jmp 0x473935
mov ecx, dword [esi + 0x250]
push ecx
call dword [sym.imp.GDI32.dll_GetBkMode]
cmp eax, 1
je 0x473910
push 1
lea ecx, [esi + 0x248]
call fcn.00515e00
mov edx, dword [esi + 0x250]
push edx
call dword [sym.imp.GDI32.dll_GetBkColor]
cmp eax, 0xffffff
je 0x473938
mov eax, dword [esi + 0x248]
lea ecx, [esi + 0x248]
push 0xffffff
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x250]
push ecx
call dword [sym.imp.GDI32.dll_GetROP2]
mov ecx, dword [esi + 0x48]
inc ecx
cmp eax, ecx
je 0x473959
push ecx
lea ecx, [esi + 0x248]
call fcn.00515e5c
mov edx, dword [esi + 0x250]
push edx
call dword [sym.imp.GDI32.dll_GetStretchBltMode]
mov edi, eax
call fcn.00482ed0
cmp edi, eax
pop edi
pop ebp
pop ebx
je 0x473985
call fcn.00482ed0
push eax
lea ecx, [esi + 0x248]
call fcn.00515e8a
mov eax, dword [esi + 0x250]
push eax
call dword [sym.imp.GDI32.dll_GetPolyFillMode]
cmp eax, 2
je 0x4739a4
push 2
lea ecx, [esi + 0x248]
call fcn.00515e2e
pop esi
ret 4
Function at 0x475220
Capabilities:
Reference http user-agent string

Disassembly:
push 0xffffffffffffffff
push 0x51bf43
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x18], edi
mov dword [edi], 0x922790
xor ebp, ebp
push ebp
mov dword [esp + 0x28], ebp
call fcn.00511259
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x14], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
push ebp
push ebx
mov ecx, edi
call fcn.004745a0
mov esi, eax
cmp esi, ebp
je 0x475313
push ebx
mov ecx, edi
call fcn.00474dd0
cmp eax, 1
jne 0x475287
inc ebx
jmp 0x475260
lea ebx, [esi + 0x18]
mov esi, ebx
push esi
call fcn.004ca470
add esi, eax
push esi
call fcn.004ca470
mov edi, dword [eax + esi]
add eax, esi
add esp, 8
cmp edi, ebp
je 0x4752ff
mov dword [eax], ebp
mov eax, dword [esp + 0x10]
cmp eax, ebp
jne 0x4752c7
mov eax, dword [edi + 0x1dc]
cmp eax, ebp
je 0x4752c7
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
mov dword [edi + 0x1dc], ebp
mov esi, ebx
push esi
call fcn.004ca470
add esi, eax
push esi
call fcn.004ca470
lea esi, [eax + esi + 0x14]
add esp, 8
mov eax, dword [esi]
cmp eax, ebp
je 0x4752ed
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
mov dword [esi], ebp
cmp dword [esp + 0x14], ebp
jne 0x4752f6
mov dword [edi + 0x1c], ebp
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 4]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
inc eax
mov dword [esp + 0x10], eax
mov ebx, eax
jmp 0x475264
mov dword [edi], 0x922778
lea esi, [edi + 8]
mov dword [esp + 0x24], 1
mov ecx, esi
mov dword [edi + 4], ebp
call fcn.00464630
mov ecx, esi
mov dword [esp + 0x24], 0xffffffff
mov dword [esi], 0x921d20
call fcn.00464630
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x475480
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
lea esi, [ecx + 0x14]
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], esi
xor ebx, ebx
push 0
push ebx
mov ecx, esi
call fcn.004745a0
mov edi, eax
test edi, edi
je 0x47550e
push ebx
mov ecx, esi
call fcn.00474dd0
test eax, eax
jne 0x47550b
lea esi, [edi + 0x18]
push esi
call fcn.004ca470
add esi, eax
push esi
call fcn.004ca470
add esi, eax
add esp, 8
mov esi, dword [esi]
test esi, esi
je 0x4754d7
mov esi, dword [esi + 0x1c]
cmp esi, ebp
je 0x475542
test esi, esi
je 0x475507
mov eax, dword [edi]
push 0
push eax
push 0x3ea
call fcn.00479d20
test eax, eax
je 0x475507
test dword [eax + 0x14], 0x200200
je 0x475507
push ebp
push esi
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
jne 0x475546
mov esi, dword [esp + 0x14]
inc ebx
jmp 0x47549c
mov eax, dword [esp + 0x20]
test eax, eax
je 0x475535
push ebp
call dword [sym.imp.USER32.dll_GetParent]
mov ebp, eax
test ebp, ebp
je 0x475535
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 1
mov dword [esp + 0x10], eax
jle 0x47549a
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret 8
test ebx, ebx
je 0x475535
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x475640
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, ecx
test eax, eax
je 0x4756c5
push eax
call dword [sym.imp.USER32.dll_GetTopWindow]
mov esi, eax
test esi, esi
je 0x4756c5
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetWindow]
push 0
push esi
mov ecx, edi
call fcn.00475480
cmp eax, 0xffffffff
je 0x4756b8
push 0
push 0
push eax
lea ecx, [edi + 0x14]
call fcn.004745a0
mov eax, dword [eax]
push eax
push 0x3ea
call fcn.00479d20
test eax, eax
je 0x4756b8
mov ecx, dword [eax + 0x14]
test ch, 4
je 0x4756b8
push 0
push 0
push 0xf0
push esi
call ebx
test eax, eax
je 0x4756b8
push 0
push 0
push 0xf1
push esi
call ebx
push 2
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x475667
pop ebp
pop ebx
pop edi
pop esi
ret 4
Function at 0x4770b0
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x10]
push ebx
push esi
push edi
mov ebx, ecx
lea eax, [esp + 0xc]
push 0
push eax
lea ecx, [ebx + 0x104]
push edx
mov dword [esp + 0x1c], ebx
call fcn.00474bf0
test eax, eax
je 0x477267
mov eax, dword [esp + 0xc]
push 0
push 0
lea ecx, [eax + 0x14]
call fcn.004745a0
mov esi, eax
add esi, 0x18
push esi
call fcn.004ca470
add esi, eax
push esi
call fcn.004ca470
mov edi, dword [esi + eax]
add esi, eax
add esp, 8
test edi, edi
je 0x477267
mov eax, dword [edi + 0x1c]
test eax, eax
mov dword [esp + 0x14], eax
je 0x477267
mov esi, dword [sym.imp.USER32.dll_IsWindow]
push eax
call esi
test eax, eax
je 0x477267
mov eax, dword [edi + 0x1b8]
test eax, eax
jne 0x477156
mov eax, dword [esp + 0x20]
test eax, eax
je 0x477267
push 5
mov ecx, edi
call fcn.00513daa
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
mov eax, dword [edi + 0x1bc]
push ebp
cmp eax, 1
mov dword [edi + 0x1b8], 0
jne 0x477223
mov ecx, dword [edi + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.005112cb
test eax, eax
je 0x477223
mov ebp, dword [eax + 0x1c]
test ebp, ebp
je 0x477223
push ebp
call esi
test eax, eax
je 0x477223
xor ebx, ebx
lea edx, [esp + 0x10]
mov eax, ebx
push edx
push eax
mov eax, dword [esp + 0x1c]
inc ebx
lea ecx, [eax + 0x104]
call fcn.00474bb0
test eax, eax
je 0x47721f
mov ecx, dword [esp + 0x10]
push 0
push 0
add ecx, 0x14
call fcn.004745a0
mov esi, eax
add esi, 0x18
push esi
call fcn.004ca470
add esi, eax
push esi
call fcn.004ca470
add esi, eax
add esp, 8
mov esi, dword [esi]
test esi, esi
jne 0x4771ee
xor eax, eax
jmp 0x4771f1
mov eax, dword [esi + 0x1c]
cmp eax, ebp
jne 0x4771a0
cmp dword [esi + 0x1b0], 1
jne 0x47721f
mov edx, dword [esp + 0x18]
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov dword [edi + 0x1b0], 1
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
pop ebp
test eax, eax
je 0x47723f
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
push 0
push eax
push ecx
mov ecx, ebx
call fcn.00477460
cmp dword [edi + 0x1bc], 1
jne 0x477267
mov edx, dword [esp + 0x1c]
mov esi, dword [ebx + 0x1e0]
push 1
mov ecx, ebx
mov dword [ebx + 0x1e0], edx
call fcn.004784e0
mov dword [ebx + 0x1e0], esi
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8
Function at 0x477460
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x2c
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
push edi
push 0
lea ebx, [ebp + 0x14]
push 0
mov ecx, ebx
call fcn.004745a0
mov esi, eax
add esi, 0x18
push esi
call fcn.004ca470
add esi, eax
push esi
call fcn.004ca470
mov ecx, dword [esi + eax]
add esi, eax
add esp, 8
test ecx, ecx
je 0x47755e
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x477557
mov eax, dword [0x95febc]
mov edi, dword [ecx + 0x1c]
test eax, eax
je 0x4774d3
mov eax, dword [ecx + 0x70]
cmp eax, 3
jne 0x4774c3
call fcn.00480d40
jmp 0x4774da
sub eax, 2
neg eax
sbb eax, eax
and eax, 3
add eax, 2
push eax
jmp 0x4774d5
push 5
call fcn.00513daa
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47755e
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
test esi, esi
je 0x47755e
cmp esi, edi
je 0x477553
push esi
push edi
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x47755e
push 0
push esi
mov ecx, ebp
call fcn.00475480
test eax, eax
jl 0x47755e
push eax
mov ecx, ebx
call fcn.004745f0
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x14], eax
xor eax, eax
lea edx, [esp + 0x10]
push eax
push edx
push 0x7d8
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], 0xfffffff9
mov dword [esp + 0x28], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
call fcn.00479d20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
xor eax, eax
jmp 0x47750f
push 5
call fcn.00513daa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
Function at 0x4782f0
Capabilities:
Reference http user-agent string

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
push esi
push edi
xor edi, edi
lea ebx, [ecx + 0x104]
lea ecx, [esp + 0x10]
mov eax, edi
push ecx
push eax
mov ecx, ebx
inc edi
call fcn.00474bb0
test eax, eax
je 0x47835a
mov edx, dword [esp + 0x10]
push 0
push 0
lea ecx, [edx + 0x14]
call fcn.004745a0
mov esi, eax
add esi, 0x18
push esi
call fcn.004ca470
add esi, eax
push esi
call fcn.004ca470
add esi, eax
add esp, 8
mov esi, dword [esi]
test esi, esi
je 0x478303
mov eax, dword [esi + 0x1c]
push eax
call ebp
test eax, eax
je 0x478303
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x4784e0
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x10], ebx
je 0x4785bf
lea ebp, [edi + 0x30]
push ebx
push ebx
push ebx
push ebx
push ebp
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x4785bf
mov eax, dword [edi + 0x1fc]
shr eax, 2
dec eax
js 0x47858b
lea esi, [eax*4]
lea ebx, [eax + 1]
mov eax, dword [edi + 0x1f4]
mov ecx, dword [eax + esi]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x47856d
push 4
push esi
lea ecx, [edi + 0x1ec]
call fcn.00464d20
push 4
push esi
lea ecx, [edi + 0x200]
call fcn.00464d20
push 4
push esi
lea ecx, [edi + 0x214]
call fcn.00464d20
jmp 0x478583
mov eax, dword [edi + 0x21c]
mov edx, dword [edi + 0x208]
mov ecx, dword [eax + esi]
push ecx
call dword [edx + esi]
add esp, 4
sub esi, 4
dec ebx
jne 0x47852d
xor ebx, ebx
mov ecx, dword [esp + 0x14]
mov edx, dword [edi]
mov eax, ecx
inc ecx
mov dword [esp + 0x14], ecx
push eax
mov ecx, edi
call dword [edx + 0x60]
test eax, eax
jne 0x4785a6
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x1c], 1
jne 0x4785b5
cmp dword [edi + 0x1e0], ebx
je 0x478615
cmp dword [esp + 0x10], ebx
jne 0x478504
mov esi, dword [esp + 0x1c]
cmp esi, 1
jne 0x4785ce
cmp dword [edi + 0x34], 0x12
je 0x478615
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x5c]
test eax, eax
je 0x478615
cmp esi, 1
jne 0x4785e6
cmp dword [edi + 0x1e0], ebx
je 0x478615
mov edx, dword [edi]
lea esi, [edi + 0x30]
push esi
mov ecx, edi
call dword [edx + 0x64]
test eax, eax
je 0x478601
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], ebx
push ebx
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x4785bf
jmp 0x4784f7
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4

Function at 0x478620
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push esi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 0
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x478663
cmp dword [esp + 8], 0x12
je 0x478663
call fcn.0051479d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x5c]
push 0
push 0
push 0
lea eax, [esp + 0x10]
push 0
push eax
call esi
test eax, eax
jne 0x47863d
pop esi
add esp, 0x1c
ret
Function at 0x478a00
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov ebx, ecx
lea edi, [ebp + 0x14]
push 0
push eax
mov ecx, edi
call fcn.004745a0
mov esi, eax
add esi, 0x18
push esi
call fcn.004ca470
add esi, eax
push esi
call fcn.004ca470
mov ecx, dword [esp + 0x20]
add esp, 8
add esi, eax
push ecx
push ebp
mov esi, dword [esi]
mov ecx, ebx
call fcn.00478ab0
cmp eax, 0xffffffff
je 0x478a90
push 0
push eax
mov ecx, edi
call fcn.004745a0
test eax, eax
je 0x478aa6
lea edi, [eax + 0x18]
push edi
call fcn.004ca470
add edi, eax
push edi
call fcn.004ca470
add edi, eax
add esp, 8
mov edi, dword [edi]
test edi, edi
je 0x478aa6
mov edx, dword [edi + 0x1c]
mov eax, dword [esi + 0x1c]
push 0x13
push 0
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ecx, dword [esi + 0x1c]
push 0x13
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x478b40
Capabilities:
Reference http user-agent string

Disassembly:
mov dword [ecx + 0x1c8], 0
add ecx, 0x1cc
jmp fcn.0050f841
Function at 0x478f00
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x64
lea ecx, [esp]
push eax
push 0x93de7c
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp]
mov ecx, 0x95fdf8
push 0
push 0
push 0
push edx
call fcn.00478f40
add esp, 0x64
ret
Function at 0x479890
Capabilities:
Reference http user-agent string

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x424]
lea edi, [esi + 0x424]
test eax, eax
jne 0x4798c2
lea eax, [esi + 0x428]
push eax
push edi
push str.DEFAULT_ICON
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.00482da0
add esp, 0x10
mov edx, dword [esp + 0xc]
mov ecx, dword [edi]
pop edi
mov dword [edx], ecx
mov ecx, dword [esp + 0xc]
mov eax, dword [esi + 0x428]
pop esi
mov dword [ecx], eax
ret 8
Function at 0x47acd0
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebx
push esi
push edi
lea ebx, [eax + 0x14]
push 0
push 0
mov ecx, ebx
call fcn.004745a0
lea esi, [eax + 0x18]
mov edi, esi
push edi
call fcn.004ca470
add edi, eax
push edi
call fcn.004ca470
mov ecx, dword [edi + eax + 0x1c]
lea eax, [edi + eax + 0x1c]
mov edx, dword [eax + ecx*4 + 4]
lea eax, [eax + ecx*4 + 4]
lea edi, [eax + edx + 4]
push edi
call fcn.004ca470
mov edi, dword [eax + edi + 4]
push esi
shr edi, 3
and edi, 1
call fcn.004ca470
add esi, eax
push esi
call fcn.004ca470
add esi, eax
add esp, 0x14
mov esi, dword [esi]
test esi, esi
je 0x47adc7
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47adc7
mov ecx, dword [esi + 0x1c]
push ebp
push ecx
call dword [sym.imp.USER32.dll_GetMenu]
lea edx, [esp + 0x10]
mov ecx, ebx
push edx
mov dword [esp + 0x18], eax
xor ebp, ebp
call fcn.004751c0
test eax, eax
mov dword [esp + 0x1c], ebp
jle 0x47ad91
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push edi
push ecx
push ebp
push 0xffffffffffffffff
push eax
push ebp
push edx
mov ecx, ebx
call fcn.004745a0
push eax
call fcn.004859e0
add esp, 0x18
mov ebp, eax
mov eax, dword [esi + 0x1dc]
test eax, eax
je 0x47ada2
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
mov ecx, dword [esi + 0x1c]
mov eax, dword [esp + 0x1c]
push ebp
push ecx
mov dword [esi + 0x1dc], eax
call dword [sym.imp.USER32.dll_SetMenu]
mov eax, dword [esp + 0x14]
pop ebp
test eax, eax
je 0x47adc7
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
pop edi
pop esi
pop ebx
add esp, 8
ret 4
Function at 0x47c340
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov eax, dword [esi + 0x88]
test eax, eax
jne 0x47c358
xor ebx, ebx
jmp 0x47c35e
mov ebx, dword [esi + 0x80]
mov edi, dword [esi + 0x88]
push 1
push edi
push ebx
call fcn.00482660
push 0
push edi
push ebx
mov dword [esp + 0x34], eax
call fcn.00482660
add esp, 0x18
mov dword [esp + 0xc], eax
test eax, eax
mov ebx, 1
jne 0x47c3d2
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x47c3d2
xor ebx, ebx
lea eax, [esp + 0x10]
push ebx
push eax
push 0x3e8
call fcn.00479d20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x47c3ca
test ecx, ecx
jne 0x47c3ca
lea ecx, [esp + 0xc]
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, 0x95fdf8
call fcn.00479890
jmp 0x47c3d2
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 1
push 0x80
push ecx
call edi
mov edx, dword [esp + 0xc]
mov eax, dword [esi + 0x1c]
push edx
push 0
push 0x80
push eax
call edi
mov eax, dword [esi + 0x1a4]
mov edi, dword [sym.imp.USER32.dll_DestroyIcon]
test eax, eax
je 0x47c40f
push eax
call edi
mov eax, dword [esi + 0x1a8]
test eax, eax
je 0x47c41c
push eax
call edi
cmp ebx, 1
jne 0x47c43c
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
mov dword [esi + 0x1a4], ecx
mov dword [esi + 0x1a8], edx
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x1a8], 0
mov dword [esi + 0x1a4], 0
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x47db20
Capabilities:
Reference http user-agent string

Disassembly:
push 0xffffffffffffffff
push 0x51c83c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [edi], 0x922b8c
mov esi, dword [edi + 0xec]
mov ebp, dword [sym.imp.USER32.dll_DestroyIcon]
xor ebx, ebx
mov dword [esp + 0x20], 4
cmp esi, ebx
je 0x47db9a
cmp esi, ebx
je 0x47db9a
mov eax, dword [esi + 0xc]
mov dword [esi], ebx
cmp eax, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
je 0x47db7e
push eax
call ebp
mov dword [esi + 0xc], ebx
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x47db91
push eax
call fcn.0050f620
add esp, 4
mov dword [esi + 0x10], ebx
push esi
call fcn.0050f620
add esp, 4
push edi
call fcn.0047c210
mov eax, dword [edi + 0x1a4]
add esp, 4
cmp eax, ebx
je 0x47dbb0
push eax
call ebp
mov eax, dword [edi + 0x1a8]
cmp eax, ebx
je 0x47dbbd
push eax
call ebp
lea ecx, [edi + 0x1d4]
mov dword [esp + 0x14], ecx
mov dword [ecx], method.CGdiObject.virtual_0
mov byte [esp + 0x20], 5
call fcn.00516727
lea ecx, [edi + 0x1c0]
mov byte [esp + 0x20], 2
mov dword [ecx], 0x922b78
call fcn.00464630
lea ecx, [edi + 0xf0]
mov byte [esp + 0x20], 1
call fcn.0048aa80
lea esi, [edi + 0x3c]
mov dword [esp + 0x14], esi
lea ecx, [esi + 0x90]
mov byte [esp + 0x20], 0xa
call fcn.0050f8b6
lea ecx, [esi + 0x74]
mov byte [esp + 0x20], 9
call fcn.0050f8b6
lea ecx, [esi + 0x50]
mov byte [esp + 0x20], 8
mov dword [ecx], 0x922b78
call fcn.00464630
lea ecx, [esi + 0x3c]
mov byte [esp + 0x20], 7
mov dword [ecx], 0x922b78
call fcn.00464630
lea ecx, [esi + 0x10]
mov byte [esp + 0x20], 6
mov dword [ecx], 0x922b78
call fcn.00464630
lea ecx, [esi + 4]
mov byte [esp + 0x20], bl
call fcn.0050f8b6
mov ecx, edi
mov dword [esp + 0x20], 0xffffffff
call fcn.00511959
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x47de30
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x58
push esi
mov esi, ecx
push edi
mov ecx, 0x16
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x1c]
mov dword [esp + 8], 0x58
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x68]
test eax, eax
mov dword [esp + 0x10], 0x64
je 0x47de73
push 0x3e
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.004fed20
add esp, 0xc
mov eax, dword [esi + 0x1ac]
mov edi, dword [esp + 0x64]
test eax, eax
je 0x47deca
test edi, edi
jne 0x47de8e
lea edx, [esp + 8]
push edx
push 2
jmp 0x47dea9
lea eax, [esp + 8]
mov dword [esp + 0x14], 7
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], 0x8064
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov ecx, dword [esi + 0x1ac]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [esi + 0x1ac], edi
pop edi
pop esi
add esp, 0x58
ret 8
test edi, edi
je 0x47deef
lea edx, [esp + 8]
mov dword [esp + 0x14], 7
push edx
push 0
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], 0x8064
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov dword [esi + 0x1ac], edi
pop edi
pop esi
add esp, 0x58
ret 8