joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a44a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.004d5aa0
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.0048a000
mov eax, 0x51019a
push eax
push dword [esp + 4]
push 0xffffffff
call fcn.004c0f42
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x46a6b1
push dword [esp + 4]
call fcn.004c10a1
and eax, eax
je 0x46a6a8
push dword [esp + 4]
call fcn.004c0f1e
mov ebx, eax
cmp ebx, 1
jne 0x46a4cd
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0xc]
call fcn.004c0ef0
push edx
push eax
pop eax
pop edx
add dword [esp], eax
adc dword [esp + 4], edx
pop dword [esp + 0x18]
pop dword [esp + 0x18]
jmp 0x46a6a3
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d57b0
pop edx
push eax
push dword [esp + 0xc]
call fcn.004c0ea2
call fcn.004d5880
mov edx, 0x510b02
pop ecx
push ecx
call fcn.0048a200
mov ecx, eax
call fcn.0048a210
je 0x46a504
xor eax, eax
jmp 0x46a509
mov eax, 1
and eax, eax
je 0x46a5c4
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d57b0
pop edx
push eax
push dword [esp + 0xc]
call fcn.004c0ea2
call fcn.004d5880
mov edx, 0x51c212
pop ecx
push ecx
call fcn.0048a200
mov ecx, eax
call fcn.0048a210
je 0x46a548
xor eax, eax
jmp 0x46a54d
mov eax, 1
and eax, eax
je 0x46a5b7
push edx
call fcn.004d57b0
pop edx
push eax
mov edx, dword [esp + 4]
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d58b0
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d57b0
pop edx
push eax
push dword [esp + 0x14]
call fcn.004c0ea2
pop eax
call fcn.0048a262
add dword [esp], edx
call fcn.004c14d6
call fcn.0048a280
mov ebx, eax
and ebx, 0x400
and ebx, ebx
je 0x46a5a7
xor eax, eax
jmp 0x46a5ac
mov eax, 1
and eax, eax
je 0x46a5b7
mov eax, 1
jmp 0x46a5b9
xor eax, eax
and eax, eax
je 0x46a5c4
mov eax, 1
jmp 0x46a5c6
xor eax, eax
and eax, eax
je 0x46a6a3
call fcn.004bf818
mov dword [0x540f14], eax
push 0x11
call sub.USER32.DLL_GetKeyState
mov ebx, eax
sar ebx, 7
and ebx, 1
and ebx, ebx
jne 0x46a60f
push 0x6a
call fcn.004b2591
mov ebx, eax
cmp ebx, 1
je 0x46a60f
mov ebx, dword [0x540f14]
cmp ebx, 0x333c
je 0x46a60f
jmp 0x46a616
mov eax, 1
jmp 0x46a618
xor eax, eax
and eax, eax
je 0x46a62d
push 1
push 0x6a
call fcn.004af861
jmp 0x46a6a8
push dword [esp + 0x18]
push dword [esp + 0x18]
push edx
call fcn.004d57b0
pop edx
push eax
push 0
push 0
mov edx, dword [esp + 0x14]
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d58b0
push edx
call fcn.004d57b0
pop edx
push eax
push edx
call fcn.004d57b0
pop edx
push eax
push dword [esp + 0x24]
call fcn.004c0ea2
pop eax
mov edx, 0x51148e
push edx
call fcn.004d58b0
call fcn.0048a262
add dword [esp], edx
call fcn.0046a44a
call fcn.0048a280
push edx
push eax
pop eax
pop edx
add dword [esp], eax
adc dword [esp + 4], edx
pop dword [esp + 0x18]
pop dword [esp + 0x18]
jmp 0x46a483
push dword [esp + 4]
call fcn.004c106f
lea eax, [esp + 0x14]
mov edx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x46a6c0
push edx
push dword [esp + 4]
call fcn.004d5b30
pop edx
add esp, 8
pop ebx
ret 0xc
Function at 0x47df6c
Capabilities:
Check mutex on windows

Disassembly:
push ebx
xor eax, eax
push eax
call fcn.004d5aa0
mov dword [esp], 0
mov eax, str.GlobalLibello
push eax
push 0
push 0
call sub.KERNEL32.dll_CreateMutexW
mov dword [0x541384], eax
mov ebx, dword [0x541384]
and ebx, ebx
je 0x47dfb6
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
jne 0x47dfb6
mov eax, 1
jmp 0x47dfb8
xor eax, eax
and eax, eax
je 0x47dfd1
push dword [0x541384]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x541384], 0
cmp dword [0x541384], 0
je 0x47dfe0
xor eax, eax
jmp 0x47dfe9
mov eax, 1
jmp 0x47dfe9
add esp, 4
pop ebx
ret
Function at 0x48ad8f
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
xor ebx, ebx
push esi
mov esi, ebx
test eax, eax
je 0x48af35
cmp word [eax], bx
je 0x48af35
push ebx
push pe_nt_image_headers32
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
je 0x48af31
push ebp
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
test ebp, ebp
jle 0x48af26
push edi
push dword [esp + 0x20]
call fcn.0048b445
mov edi, eax
test edi, edi
je 0x48af25
cmp dword [esp + 0x20], 0xffffffff
mov ebx, dword [esp + 0x18]
jne 0x48ae05
push 2
jmp 0x48ae09
push dword [esp + 0x20]
push ebx
call fcn.0048b8d4
mov esi, eax
test esi, esi
je 0x48af1e
cmp ebx, 0xffffffff
jne 0x48ae20
mov ebx, esi
mov eax, dword [esi + 4]
mov dword [esi + 0x30], ebx
lea ebx, [ebp + 8]
mov dword [esi + 0x38], eax
xor eax, eax
push ebx
push eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x14], eax
push dword [0x540d84]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x28], eax
test eax, eax
je 0x48ae61
mov dword [eax + 4], ebx
mov eax, dword [esi + 0x28]
and dword [eax], 0
mov eax, dword [esi + 0x28]
add eax, 8
mov dword [esi + 0x44], eax
cmp dword [esp + 0x20], 0xffffffff
je 0x48ae6f
mov dword [esi + 0x34], 1
push esi
push edi
call fcn.004dc9e0
pop ecx
pop ecx
xor ebx, ebx
mov ecx, 0x4000
mov dword [esp + 0x20], ecx
test ebp, ebp
jle 0x48af1a
lea eax, [ecx + ebx]
cmp eax, ebp
jle 0x48ae9a
mov ecx, ebp
sub ecx, ebx
mov dword [esp + 0x20], ecx
push ecx
push edi
call fcn.004dc370
mov dword [esp + 0x20], eax
pop ecx
pop ecx
test eax, eax
je 0x48af0c
push 0
lea ecx, [esp + 0x20]
push ecx
push dword [esp + 0x28]
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x1c]
add ebx, eax
cmp dword [esi + 0x14], 0
jne 0x48aede
push eax
push dword [esp + 0x1c]
call fcn.0048b4f0
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x1c]
cmp ebx, ebp
jl 0x48aee6
push 1
jmp 0x48aee8
push 0
push eax
push edi
call fcn.004dc640
add esp, 0xc
test eax, eax
je 0x48af00
mov ecx, dword [esp + 0x20]
cmp ebx, ebp
jl 0x48ae8b
jmp 0x48af1a
push edi
call fcn.004dc620
pop ecx
mov dword [esi + 0x18], eax
jmp 0x48af13
mov dword [esi + 0x18], 1
push edi
push esi
call fcn.0048b5aa
and dword [esi + 0x2c], 0
push edi
call fcn.004dc780
pop ecx
pop edi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
mov eax, esi
jmp 0x48af37
xor eax, eax
pop esi
pop ebx
pop ecx
ret 0xc
Function at 0x48bf2f
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
push dword [esp + 0x50]
push dword [0x545230]
call fcn.004d5397
mov esi, eax
test esi, esi
je 0x48bfe6
mov edi, dword [sym.imp.USER32.DLL_SendMessageW]
xor ebp, ebp
push ebp
push dword [esp + 0x58]
push 0x419
push dword [esi]
call edi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x48bfe6
lea eax, [esp + 0x10]
push eax
push ebx
push 0x41d
push dword [esi]
call edi
mov dword [esp + 0x20], 0x2c
mov dword [esp + 0x24], 0x10
mov eax, dword [esi]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x20]
push eax
push ebp
push 0x433
mov dword [esp + 0x38], ebx
mov dword [esp + 0x4c], ebp
push dword [esi + 4]
call edi
lea eax, [esp + 0x20]
push eax
push ebp
push 0x432
push dword [esi + 4]
call edi
xor eax, eax
inc eax
jmp 0x48bfe8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0xc

Function at 0x48c0af
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x48c147
push edi
push 0x54523c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x541b24]
test edi, edi
je 0x48c11b
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x48c114
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0x541b24
call fcn.004d56c0
pop ecx
pop ecx
jmp 0x48c116
mov edi, dword [edi]
test edi, edi
jne 0x48c0eb
pop ebx
mov eax, dword [0x53de64]
mov esi, eax
inc eax
push 0x10
push 0x541b24
mov dword [0x53de64], eax
call fcn.004d5700
pop ecx
pop ecx
push 0x54523c
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x48c14f
Capabilities:
Resume thread

Disassembly:
push dword [esp + 4]
call fcn.0048c063
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret 4

Function at 0x48c162
Capabilities:
Suspend thread

Disassembly:
push dword [esp + 4]
call fcn.0048c063
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
ret 4
Function at 0x48ca8f
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x48cb8a
push edi
push dword [esp + 0x1c]
push dword [0x54525c]
call fcn.004d5397
mov edi, eax
test edi, edi
je 0x48cb89
mov eax, dword [edi + 4]
push ebx
mov ebx, dword [esp + 0x24]
push esi
imul esi, ebx, 0x24
cmp dword [eax + esi], 2
jne 0x48cadc
mov eax, dword [eax + esi + 0x18]
test eax, eax
je 0x48cadc
push 0
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [edi + 4]
mov eax, dword [eax + esi + 0x20]
test eax, eax
je 0x48caf5
push eax
call fcn.004cf57e
mov eax, dword [edi + 4]
and dword [eax + esi + 0x20], 0
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x30]
push ebp
mov dword [esi + eax], 1
mov eax, dword [edi + 4]
mov dword [eax + esi + 8], ecx
mov eax, dword [edi + 4]
mov dword [eax + esi + 0x1c], ebp
call fcn.004cf66f
test eax, eax
je 0x48cb2e
push 0
push 0
push ebp
call fcn.004cf2b9
mov ecx, dword [edi + 4]
mov dword [ecx + esi + 0x20], eax
jmp 0x48cb36
mov eax, dword [edi + 4]
and dword [eax + esi + 0x20], 0
mov eax, dword [esp + 0x30]
test al, 1
je 0x48cb46
or ebx, 0x200
jmp 0x48cb50
test al, 2
je 0x48cb50
or ebx, 0x100
mov esi, dword [sym.imp.USER32.DLL_SendMessageW]
mov eax, ebx
push 0
or eax, 0x1000
push eax
push 0x40b
push dword [edi]
call esi
lea eax, [esp + 0x10]
push eax
push ebx
push 0x40a
push dword [edi]
call esi
push 1
lea eax, [esp + 0x14]
push eax
push dword [edi]
call dword [sym.imp.USER32.DLL_InvalidateRect]
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x10
ret 0x10
Function at 0x48fac1
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x48fb16
push dword [esp + 0x10]
push 0x48fa40
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x541e20]
test esi, esi
je 0x48fb6f
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x48fb0e
cmp byte [esi + 0x10], 0
je 0x48fb0e
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x48faea
jmp 0x48fb6f
mov esi, dword [0x541e20]
test esi, esi
je 0x48fb6f
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x48fb68
cmp byte [esi + 0x11], 0
je 0x48fb44
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x48fb5b
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0x541e20
call fcn.004d56c0
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x48fb23
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x4a9ead
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x545270]
call fcn.004d4d57
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x4a9fad
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x4a9f03
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x4a9efb
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x4a9f43
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x4a9f85
push 0x22
pop edx
cmp cx, dx
je 0x4a9f35
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x4a9f25
xor ecx, ecx
cmp word [eax], cx
je 0x4a9f85
mov ecx, eax
add eax, 2
jmp 0x4a9f87
test dx, dx
je 0x4a9f8d
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x4a9f35
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x4a9f7b
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x4a9f85
cmp cx, dx
je 0x4a9f78
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x4a9f68
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x4a9f4d
jmp 0x4a9f35
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x4a9f8f
xor edx, edx
cmp dword [ebp], ebx
jne 0x4a9f98
test edi, edi
jne 0x4a9fb5
test edx, edx
je 0x4a9f9d
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x4a9ef1
test edi, edi
jne 0x4a9fc6
mov eax, ebx
jmp 0x4a9fca
test esi, esi
je 0x4a9fc6
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x4a9fca
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x4aa7b9
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebx, eax
cmp dword [esp + 0x24], 0x18
je 0x4aa868
cmp dword [esp + 0x24], 2
je 0x4aa868
push 0x2000
push edi
push dword [0x540d84]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
jmp 0x4aa83b
cmp dword [esp + 0x18], 2
jne 0x4aa853
test ebx, ebx
jne 0x4aa824
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0x540d84]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x4aa853
cmp ax, 0xd
je 0x4aa83b
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call ebp
test eax, eax
jne 0x4aa7fb
push dword [esp + 0x28]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.004f3830
jmp 0x4aa8ee
push eax
push 0
push dword [0x540d84]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
jmp 0x4aa8ba
cmp dword [esp + 0x18], 1
jne 0x4aa8d2
test ebx, ebx
jne 0x4aa8a9
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0x540d84]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x4aa8d2
cmp al, 0xd
je 0x4aa8ba
mov byte [esi + edi], al
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call ebp
test eax, eax
jne 0x4aa881
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x28]
mov byte [esi + edi], 0
push esi
jne 0x4aa8e9
call fcn.004f3720
jmp 0x4aa8ee
call fcn.004f36c0
push esi
push 0
push dword [0x540d84]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x4aae54
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push dword [0x545290]
call fcn.004d4d57
mov ebx, eax
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x4aaea9
push ebp
push esi
xor ecx, ecx
mov ebp, 0xfde9
push ecx
push ecx
push 0xffffffffffffffff
push dword [eax + 0xc]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push dword [esp + 0x10]
mov esi, eax
lea ecx, [esi - 1]
push ecx
call fcn.004d5d20
push esi
push eax
mov eax, dword [ebx + 0x20]
push 0xffffffffffffffff
push dword [eax + 0xc]
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
pop esi
pop ebp
pop ebx
ret 4
pop ebx
jmp fcn.004d5e30
Function at 0x4ad340
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x541e3c], 0
jne 0x4ad34e
call fcn.004ad2c0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x541e40]
call esi
test eax, eax
jne 0x4ad371
call fcn.004ad2c0
push dword [0x541e40]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x4ad380
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x4ad3e0
mov ebx, 0x10
test edi, edi
jns 0x4ad3e9
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x4ad3b2
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4ad400
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x541e3c], 0
jne 0x4ad40e
call fcn.004ad2c0
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x541e40]
call esi
mov edx, eax
test edx, edx
jne 0x4ad435
call fcn.004ad2c0
push dword [0x541e40]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x4ad468
mov ebx, 0x10
test esi, esi
jns 0x4ad471
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x4ad480
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4ae0aa
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
cmp word [0x542058], 0
jne 0x4ae16c
push edi
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x4ae0df
mov word [0x542058], di
jmp 0x4ae0e7
xor eax, eax
mov word [0x542058], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x542074], eax
test eax, eax
je 0x4ae16b
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.getaddrinfo
push eax
call esi
push str.freeaddrinfo
push dword [0x542074]
mov dword [0x542064], eax
call esi
push str.getnameinfo
push dword [0x542074]
mov dword [0x542068], eax
call esi
push str.WSAStringToAddressA
push dword [0x542074]
mov dword [0x54206c], eax
call esi
cmp dword [0x542064], 0
mov dword [0x542070], eax
pop esi
je 0x4ae16b
cmp dword [0x542068], 0
je 0x4ae16b
cmp dword [0x54206c], 0
je 0x4ae16b
test eax, eax
je 0x4ae16b
mov dword [0x54205c], edi
pop edi
movsx eax, word [0x542058]
add esp, 0x190
ret
Function at 0x4b0353
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push 0
push 0
push 0x1304
push dword [ebp]
call dword [sym.imp.USER32.DLL_SendMessageW]
test eax, eax
jle 0x4b03c5
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
cmp ebx, 0xffffffff
jne 0x4b037c
mov ebx, eax
push dword [ebp]
call fcn.004afb1f
push ebx
push dword [ebp]
mov edi, eax
call fcn.004afaf6
add esp, 0xc
mov esi, eax
push 0
push ebx
push 0x130c
push dword [ebp]
call dword [sym.imp.USER32.DLL_SendMessageW]
push 0
push edi
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
push edi
call dword [sym.imp.USER32.DLL_EnableWindow]
push esi
push dword [ebp]
call fcn.004b03e5
pop ecx
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4b1929
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0x5452b4]
call fcn.004d4d57
xor ebp, ebp
mov esi, eax
cmp dword [0x5424d0], ebp
jne 0x4b1a05
xor ebx, ebx
inc ebx
mov dword [0x5424d0], ebx
call fcn.004bcf6c
mov edi, 0xa4
push edi
push ebp
push 0x5424d8
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0x5424d8], 0x13
lea eax, [esp + 0x10]
mov dword [0x5424dc], edi
mov dword [0x5424e8], 0x4b1874
mov dword [0x5424ec], 0x4b1bbf
push eax
mov dword [0x542540], 0x4b184f
mov dword [0x542544], 0x4b1b0a
mov dword [0x5424e4], 0x4b182a
mov dword [0x542568], 0x4b188f
mov dword [0x54257c], ebx
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4b1a05
cmp dword [esp + 0x20], ebx
je 0x4b19ed
cmp dword [esp + 0x20], 2
jne 0x4b1a05
cmp dword [esp + 0x14], 5
jae 0x4b19f5
mov dword [0x54257c], ebp
jmp 0x4b1a05
jne 0x4b1a05
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
and dword [0x54257c], eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.004c4096
mov eax, dword [esp + 0x140]
push ebp
push dword [0x540d88]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebp
push str.BUTTON
push ebp
call dword [sym.imp.USER32.DLL_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x4b1adb
push dword [esp + 0x128]
push dword [0x5452d0]
call fcn.004d53d6
mov edi, dword [esp + 0x13c]
mov esi, eax
mov dword [esi + 0x10], edi
test edi, edi
je 0x4b1aaa
push edi
call fcn.004cf66f
test eax, eax
je 0x4b1aaa
push ebp
push ebp
push edi
call fcn.004cf2b9
mov dword [esi + 0x18], eax
jmp 0x4b1aad
mov dword [esi + 0x18], ebp
push 0x4b1579
push 0xfffffffffffffffc
push ebx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], ebp
call dword [sym.imp.USER32.DLL_SetWindowLongW]
push 0x5424d8
push ebx
push esi
push dword [esp + 0x134]
mov dword [0x5424d4], eax
call fcn.004bd272
mov ebx, eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x114
ret 0x1c