joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413000
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x4f
push 0xde
mov eax, dword [ebp + 8]
push eax
call fcn.00412940
add esp, 0xc
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4130e5
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4130d9
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
jmp 0x413080
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0x10
jge 0x4130b5
push 0x103
mov edx, dword [ebp - 0x18]
imul edx, edx, 0xd
add edx, 0x9a
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
test eax, eax
jne 0x4130b1
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x4130b3
jmp 0x4130b5
jmp 0x413077
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [ebp - 0x14]
push edx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x413170
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x4131f3
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4131e9
push 0x48b7d4
lea edx, [ebp - 0x214]
push edx
call fcn.00474343
add esp, 8
test eax, eax
jne 0x4131d5
mov eax, dword [ebp - 0x230]
push eax
push 0x413200
push 0
call dword [sym.imp.USER32.dll_EnumChildWindows]
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4131a9
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x413250
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push 0
push 0
lea edx, [ebp - 0xc]
push edx
push 0x4132c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4132af
push 0x2710
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4132a5
push 0x48b648
call fcn.00411fc0
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x415c30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov dword [ebp - 4], 0x48ad94
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x415d0a
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x415ce3
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x14]
je 0x415ce3
lea eax, [ebp - 0x228]
push eax
push 0x104
push 0xd
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x48ada4
lea edx, [ebp - 0x228]
push edx
call fcn.0041e970
add esp, 8
test eax, eax
je 0x415ce3
mov dword [ebp - 0x22c], 0
lea eax, [ebp - 0x22c]
push eax
push 0x415bc0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_EnumChildWindows]
cmp dword [ebp - 0x22c], 0
je 0x415ce3
mov eax, 1
jmp 0x415d0c
push 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x415d0a
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 8]
jne 0x415c5f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x415d10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x415d90
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x415d86
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x214]
push eax
call fcn.00474343
add esp, 8
test eax, eax
jne 0x415d72
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 4], ecx
jmp 0x415d86
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x415d50
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x416100
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [ebp + 8]
jne 0x416213
mov eax, dword [ebp + 8]
push eax
call fcn.00416250
add esp, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416220
add esp, 4
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00412940
add esp, 0xc
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x416213
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x416207
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x14], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0
jmp 0x4161b3
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0x10
jge 0x4161e3
push 0xc
mov edx, dword [ebp - 0x1c]
imul edx, edx, 7
add edx, 5
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
cmp eax, dword [ebp - 0x10]
je 0x4161df
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x4161e1
jmp 0x4161e3
jmp 0x4161aa
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [ebp - 0x18]
push edx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x416280
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [ebp + 8]
jne 0x416394
mov eax, dword [ebp + 8]
push eax
call fcn.00416250
add esp, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00416220
add esp, 4
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00412940
add esp, 0xc
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x416394
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x416388
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x14], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0
jmp 0x416333
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0x10
jge 0x416364
push 0xb
mov edx, dword [ebp - 0x1c]
lea eax, [edx*8 + 5]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.GDI32.dll_GetPixel]
cmp eax, dword [ebp - 0x10]
je 0x416360
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x416362
jmp 0x416364
jmp 0x41632a
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x18]
push eax
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x416d30
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x416efb
mov dword [ebp - 0x38], str.http:__aq.qq.com_007
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.00474a10
add esp, 4
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x28]
ja 0x416ef1
push 0x1c
lea edx, [ebp - 0x54]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp eax, 0x1c
je 0x416dab
jmp 0x416ef1
cmp dword [ebp - 0x44], 0x1000
jne 0x416ee3
cmp dword [ebp - 0x40], 4
jne 0x416ee3
cmp dword [ebp - 0x3c], 0x20000
jne 0x416ee3
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x48]
cmp dword [ebp - 0x58], eax
jae 0x416ee3
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x48]
sub ecx, dword [ebp - 0x58]
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x60], 0x2000
jbe 0x416e02
mov dword [ebp - 0x68], 0x2000
jmp 0x416e08
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x68], edx
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x5c], eax
push 0x2000
push 0
push 0xa527e0
call fcn.00474100
add esp, 0xc
push 0
mov ecx, dword [ebp - 0x5c]
push ecx
push 0xa527e0
mov edx, dword [ebp - 0x58]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x416ed2
mov dword [ebp - 0x64], 0
jmp 0x416e55
mov ecx, dword [ebp - 0x64]
add ecx, 1
mov dword [ebp - 0x64], ecx
cmp dword [ebp - 0x5c], 0x2000
jne 0x416e67
mov dword [ebp - 0x6c], 0
jmp 0x416e70
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x6c], edx
mov eax, 0x1000
sub eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x64], eax
jge 0x416ed2
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x64]
add eax, 0xa527e0
push eax
call fcn.00474f0f
add esp, 0xc
test eax, eax
jne 0x416ecd
push 0
push 0
push 0x14
call fcn.00411ba0
add esp, 0xc
push 0x48b518
call fcn.00411fc0
add esp, 4
push 0x48b530
call fcn.00411fc0
add esp, 4
mov dword [ebp - 8], 1
jmp 0x416ef1
jmp 0x416e4c
mov ecx, dword [ebp - 0x58]
add ecx, 0x1000
mov dword [ebp - 0x58], ecx
jmp 0x416dd5
mov edx, dword [ebp - 0x54]
add edx, dword [ebp - 0x48]
mov dword [ebp - 0xc], edx
jmp 0x416d81
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x417c40
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
push 0x44
push 0
lea eax, [ebp - 0x260]
push eax
call fcn.00474100
add esp, 0xc
mov dword [ebp - 0x260], 0x44
push 0x104
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x468]
push eax
call fcn.004740dd
add esp, 8
push str._rasphone.exe
lea ecx, [ebp - 0x468]
push ecx
call fcn.004740ac
add esp, 8
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x46c], edx
cmp dword [ebp - 0x46c], 0
je 0x417cbf
cmp dword [ebp - 0x46c], 1
je 0x417cd5
jmp 0x417ce9
push 0x48b91c
lea eax, [ebp - 0x468]
push eax
call fcn.004740ac
add esp, 8
jmp 0x417ce9
push 0x48b924
lea ecx, [ebp - 0x468]
push ecx
call fcn.004740ac
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x468]
push eax
call fcn.004740ac
add esp, 8
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x260]
push edx
lea eax, [ebp - 0x208]
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x468]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x417d48
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esp, ebp
pop ebp
ret

Function at 0x417f10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x48b950
lea ecx, [ebp - 0x208]
push ecx
call fcn.00417f50
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x417f50
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
cmp dword [ebp + 0xc], 0
je 0x41800b
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x458]
push ecx
call fcn.004740dd
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x458]
push eax
call fcn.004740ac
add esp, 8
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x458]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0xffffffff
je 0x418009
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x458]
push ecx
call fcn.004740dd
add esp, 8
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x458]
push eax
call fcn.004740ac
add esp, 8
lea ecx, [ebp - 0x458]
push ecx
call fcn.00418020
add esp, 4
lea edx, [ebp - 0x250]
push edx
mov eax, dword [ebp - 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x417fac
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x418017
mov edx, dword [ebp + 8]
push edx
call fcn.00418020
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x418020
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x208]
push ecx
call fcn.004740dd
add esp, 8
push 0x48b94c
lea edx, [ebp - 0x208]
push edx
call fcn.004743d2
add esp, 4
lea eax, [ebp + eax*2 - 0x206]
push eax
call fcn.004740dd
add esp, 8
push 0x1e
push 0
lea ecx, [ebp - 0x228]
push ecx
call fcn.00474100
add esp, 0xc
mov dword [ebp - 0x224], 3
lea edx, [ebp - 0x208]
mov dword [ebp - 0x220], edx
mov eax, 0x614
mov word [ebp - 0x218], ax
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esp, ebp
pop ebp
ret

Function at 0x4180b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x48b954
lea ecx, [ebp - 0x208]
push ecx
call fcn.004743d2
add esp, 4
lea edx, [ebp + eax*2 - 0x21e]
push edx
call fcn.004740dd
add esp, 8
push str.DNF.
lea eax, [ebp - 0x208]
push eax
call fcn.00417f50
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x418110
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.RoamingTencentLogsTASLogin.tlg
lea ecx, [ebp - 0x208]
push ecx
call fcn.004743d2
add esp, 4
lea edx, [ebp + eax*2 - 0x21e]
push edx
call fcn.004740dd
add esp, 8
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.00417f50
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x4182c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push 0x44
push 0
lea eax, [ebp - 0x260]
push eax
call fcn.00474100
add esp, 0xc
mov dword [ebp - 0x260], 0x44
push str.cmd.exe__c
lea ecx, [ebp - 0x208]
push ecx
call fcn.004740dd
add esp, 8
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x260]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x208]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x418350
push 0xffffffffffffffff
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x418590
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push 0x48b9ec
push 0x48b9f0
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x418648
mov eax, dword [ebp + 8]
imul eax, eax, 0x208
add eax, 0x888c38
push eax
push 0x48b9fc
mov ecx, dword [ebp - 4]
push ecx
call fcn.004767e0
add esp, 0xc
push 0
push 0
push 0x104
lea edx, [ebp - 0x110]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
imul eax, eax, 0x208
add eax, 0x8c99e8
push eax
push 0
push 0x3a8
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 4]
push ecx
push 1
lea edx, [ebp - 0x110]
push edx
call fcn.00474a10
add esp, 4
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00474cee
add esp, 0x10
push 0x48ba04
mov ecx, dword [ebp - 4]
push ecx
call fcn.004767e0
add esp, 8
mov edx, dword [ebp - 4]
push edx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x419510
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0xa0cd80], 0
je 0x419537
push 0
mov eax, dword [0xa0cd80]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [0xa0cd80]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret

Function at 0x419790
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0x48bbac
call fcn.00410680
add esp, 4
test eax, eax
jne 0x4197b1
push 0
push 0x48bbbc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.config
mov eax, dword [ebp + 8]
push eax
call fcn.004740dd
add esp, 8
push 0x48bbdc
mov ecx, dword [ebp + 8]
push ecx
call fcn.004740ac
add esp, 8
push 0x48bbe0
mov edx, dword [ebp + 8]
push edx
call fcn.004740ac
add esp, 8
pop ebp
ret

Function at 0x4198d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0x48c11c
call fcn.00410680
add esp, 4
test eax, eax
jne 0x4198f1
push 0
push str.status
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call fcn.00419940
call fcn.004199c0
call fcn.00419a40
call fcn.00419ac0
call fcn.00419b40
call fcn.00419bc0
call fcn.00419c40
call fcn.00419c90
call fcn.00419ce0
call fcn.00419d30
call fcn.00419d80
call fcn.00419dd0
call fcn.00419e20
call fcn.00419e70
call fcn.00419ec0
pop ebp
ret

Function at 0x419c40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x48bfa4
push str.statusFatigue
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419c85
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x8c99e4]
push ecx
push 4
push 0x909188
call fcn.00474cee
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x419c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x48c058
push str.statusFatigueTime
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419cd5
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x8c99e4]
push ecx
push 0x24
push 0x98a578
call fcn.00474cee
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x419ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x48c070
push str.statusBanned
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419d25
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x8c99e4]
push ecx
push 4
push 0x909a70
call fcn.00474cee
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x419d30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x48c084
push str.statusOldIp
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419d73
mov eax, dword [ebp - 4]
push eax
push 0x100
push 4
push 0x8c83e0
call fcn.00474cee
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x419d80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x48c098
push str.statusOldIpDialTime
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419dc3
mov eax, dword [ebp - 4]
push eax
push 0x100
push 8
push 0x90a240
call fcn.00474cee
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x419dd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x48c0b4
push str.statusNextOldIpIndex
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419e10
mov eax, dword [ebp - 4]
push eax
push 1
push 4
push 0x8c87f4
call fcn.00474cee
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x419e20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x48c0d0
push str.statusCycleLoginTime
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419e65
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x8c99e4]
push ecx
push 8
push 0xa0d560
call fcn.00474cee
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x419e70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x48c0ec
push str.statusCycleLoginCount
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419eb5
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x8c99e4]
push ecx
push 4
push 0xa0e700
call fcn.00474cee
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x419ec0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x48c108
push str.statusLoginIp
call fcn.00473682
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x419f03
mov eax, dword [ebp - 4]
push eax
push 0x1f4
push 4
push 0xa4f838
call fcn.00474cee
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call fcn.00473438
add esp, 4
mov esp, ebp
pop ebp
ret