joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492f80
Capabilities:
Reference http user-agent string

Disassembly:
push 0xffffffffffffffff
push 0x51dba0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
mov eax, dword [0x94f978]
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x7c]
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebp
mov dword [esp + 0x78], 0
call fcn.0048f4c0
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x30]
lea edx, [esp + 0x4c]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
mov byte [esp + 0x47], 1
mov byte [esp + 0x4a], 2
mov byte [esp + 0x48], 7
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebp
call fcn.0048f4b0
test ah, 8
je 0x493012
mov dword [esp + 0x40], 0x2bc
test ah, 0x10
je 0x49301c
mov byte [esp + 0x44], 1
test ah, 0x20
je 0x493026
mov byte [esp + 0x45], 1
test ah, 0x40
je 0x493030
mov byte [esp + 0x46], 1
mov eax, dword [esp + 0x84]
test eax, eax
jne 0x493048
mov ecx, ebp
call fcn.0048f4f0
mov dword [esp + 0x30], eax
jmp 0x4930a7
push 0
lea ecx, [esp + 0x20]
call fcn.00516428
mov ecx, dword [ebx + 0x5c]
mov edx, dword [ebx + 0x58]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
mov byte [esp + 0x80], 1
call fcn.004a88f0
add esp, 0xc
mov ecx, ebp
call fcn.0048f4f0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], eax
call fcn.00516356
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], edx
mov byte [esp + 0x74], 0
call fcn.0051649a
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, dword [esp + 0x80]
push eax
call fcn.005166d0
lea ecx, [esp + 0x10]
mov dword [esp + 0x74], 0xffffffff
call fcn.0050f8b6
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x68
ret 0xc
Function at 0x493d70
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x20
lea edx, [esp + 0x10]
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x34]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.00493e10
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov edi, dword [esp + 0x10]
xor ebp, ebp
xor ebx, ebx
cmp edi, 0xffffffff
je 0x493df2
cmp edi, dword [esp + 0x18]
jg 0x493dca
push edi
mov ecx, esi
call fcn.0048fe50
push eax
push ebp
mov ecx, esi
call fcn.00490010
mov ebp, eax
mov eax, dword [esp + 0x18]
inc edi
cmp edi, eax
jle 0x493dae
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp edi, eax
jg 0x493df2
push edi
mov ecx, esi
call fcn.0048fd70
push eax
push ebx
mov ecx, esi
call fcn.00490140
mov ebx, eax
mov eax, dword [esp + 0x1c]
inc edi
cmp edi, eax
jle 0x493dd6
mov eax, dword [esp + 0x34]
pop edi
pop esi
mov dword [eax], ebp
mov dword [eax + 4], ebx
pop ebp
pop ebx
add esp, 0x20
ret 0xc

Function at 0x494010
Capabilities:
Reference http user-agent string

Disassembly:
push esi
push edi
mov esi, ecx
push 0
call fcn.00512b61
mov edi, eax
mov eax, dword [esp + 0xc]
cmp eax, 5
ja case.default.0x494026
jmp dword [eax*4 + 0x494094]
dec edi
jmp case.default.0x494026
inc edi
jmp case.default.0x494026
sub edi, 5
jmp case.default.0x494026
add edi, 5
jmp case.default.0x494026
mov edi, dword [esp + 0x10]
push 1
mov ecx, esi
call fcn.004902d0
mov ecx, esi
call fcn.00491f40
xor eax, eax
push 1
test edi, edi
setl al
dec eax
push 0xffffffffffffffff
and eax, edi
mov ecx, esi
push eax
mov dword [esi + 0x44c], 0
call fcn.00494ba0
mov ecx, dword [esi + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, esi
call fcn.00491f40
mov dword [esi + 0x44c], 1
pop edi
pop esi
ret 0xc

Function at 0x4940b0
Capabilities:
Reference http user-agent string

Disassembly:
push esi
push edi
mov esi, ecx
push 1
call fcn.00512b61
mov edi, eax
mov eax, dword [esp + 0xc]
cmp eax, 5
ja case.default.0x4940c6
jmp dword [eax*4 + 0x494134]
dec edi
jmp case.default.0x4940c6
inc edi
jmp case.default.0x4940c6
sub edi, 0xa
jmp case.default.0x4940c6
add edi, 0xa
jmp case.default.0x4940c6
mov edi, dword [esp + 0x10]
push 1
mov ecx, esi
call fcn.004902d0
mov ecx, esi
call fcn.00491f40
xor eax, eax
push 1
test edi, edi
setl al
dec eax
mov ecx, esi
and eax, edi
mov dword [esi + 0x44c], 0
push eax
push 0xffffffffffffffff
call fcn.00494ba0
mov ecx, dword [esi + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, esi
call fcn.00491f40
mov dword [esi + 0x44c], 1
pop edi
pop esi
ret 0xc
Function at 0x494170
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x51dc80
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.00490320
mov ebx, eax
test ebx, ebx
je 0x4942bf
mov ecx, ebx
call fcn.0048d5c0
mov edi, eax
mov ecx, ebx
mov dword [esp + 0x14], edi
call fcn.0048d600
test edi, edi
mov dword [esp + 0x18], eax
je 0x4942bf
test eax, eax
je 0x4942bf
push 1
mov ecx, esi
call fcn.00512b61
mov ecx, ebx
mov edi, eax
call fcn.0048d680
push 0
mov ecx, esi
add edi, eax
call fcn.00512b61
mov ecx, ebx
mov ebp, eax
call fcn.0048d690
xor ebx, ebx
lea ecx, [esp + 0x2c]
push ebx
add ebp, eax
call fcn.00516428
mov eax, dword [esi + 0x5c]
mov ecx, dword [esi + 0x58]
push eax
lea edx, [esp + 0x30]
push ecx
push edx
mov dword [esp + 0x54], ebx
call fcn.004a88f0
add esp, 0xc
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x10]
push eax
call fcn.0048fd40
mov eax, dword [esp + 0x50]
push 1
mov byte [esp + 0x4c], 1
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x20]
mov dword [esp + 0x24], edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_DPtoLP]
lea edx, [esp + 0x24]
mov ecx, esi
push edx
call fcn.00491e90
mov edx, dword [esp + 0x1c]
mov ecx, eax
mov eax, dword [ecx]
sub edx, eax
mov eax, dword [esp + 0x20]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x1c], edx
sub eax, ecx
cmp edx, ebx
mov dword [esp + 0x20], eax
jl 0x4942a5
cmp eax, ebx
jl 0x4942a5
cmp edi, dword [esp + 0x14]
jge 0x4942a5
push edi
mov ecx, esi
call fcn.0048fd70
push eax
push ebx
mov ecx, esi
call fcn.00490140
mov ecx, dword [esp + 0x20]
cmp ecx, ebx
jl 0x49429a
cmp ecx, eax
jl 0x4942d6
mov ebx, eax
mov eax, dword [esp + 0x14]
inc edi
cmp edi, eax
jl 0x49427d
lea ecx, [esp + 0x10]
call fcn.0048fd60
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xffffffff
call fcn.0051649a
xor eax, eax
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 0xc
cmp edi, dword [esp + 0x14]
jge 0x4942a5
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x18]
mov ebx, ebp
mov dword [edx], edi
xor edi, edi
cmp ebp, eax
jge 0x4942a5
push ebx
mov ecx, esi
call fcn.0048fe50
push eax
push edi
mov ecx, esi
call fcn.00490010
mov ecx, dword [esp + 0x1c]
cmp ecx, edi
jl 0x49430b
cmp ecx, eax
jl 0x494318
mov edi, eax
mov eax, dword [esp + 0x18]
inc ebx
cmp ebx, eax
jl 0x4942ee
jmp 0x4942a5
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0x10]
mov dword [eax], ebx
call fcn.0048fd60
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xffffffff
call fcn.0051649a
mov eax, 1
jmp 0x4942c1
Function at 0x495ae0
Capabilities:
Open clipboard
Reference http user-agent string
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x51dd78
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
call fcn.00490320
test eax, eax
je 0x495be8
lea ecx, [esp + 0xc]
call fcn.00464430
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.00490320
mov ecx, eax
call fcn.0048da10
test eax, eax
je 0x495bcf
mov eax, dword [esp + 0x1c]
test eax, eax
mov ebp, eax
je 0x495bcf
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x495bcf
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
neg esi
push edi
push ebx
sbb esi, esi
and esi, edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, ebp
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.00464630
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
pop edi
jne 0x495bb1
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x495bcf
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [0x960808]
push ebx
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], 0x9236e8
call fcn.00464630
mov ecx, dword [esp + 0x20]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10
Function at 0x495c40
Capabilities:
Open clipboard
Read clipboard data
Reference http user-agent string

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.00490320
test eax, eax
je 0x495d2f
mov ecx, edi
call fcn.00490320
mov ecx, eax
call fcn.0048d8b0
test eax, eax
jne 0x495d2f
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x495d2f
mov eax, dword [0x960808]
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
jne 0x495ca2
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
lea ecx, [esp + 0x10]
mov ebp, dword [esp + 0x24]
push 1
push ecx
mov ecx, dword [edi + 0x44]
lea edx, [esp + 0x1c]
shr ecx, 4
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x2c]
and ecx, 1
push eax
push ecx
push ebp
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov ecx, edi
call fcn.00490320
mov ecx, eax
call fcn.0048daf0
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [esp + 0x28]
mov eax, 1
cmp ecx, eax
jne 0x495d2f
cmp ebx, eax
jne 0x495d2f
cmp dword [esp + 0x10], eax
jne 0x495d15
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xcc]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [edi]
push eax
mov eax, dword [esp + 0x24]
push ecx
push ebp
push eax
mov ecx, edi
call dword [edx + 0xc0]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x496060
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x51dde0
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push ebx
push ebp
mov ebp, dword [esp + 0x8c]
xor ebx, ebx
cmp ebp, ebx
je 0x496238
mov eax, dword [esp + 0x90]
push esi
push edi
push eax
lea ecx, [esp + 0x24]
push 0x943480
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x4c]
add esp, 0xc
rep stosd dword es:[edi], eax
mov edi, 0x943474
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x5c]
mov eax, ecx
mov esi, edi
mov edi, edx
mov byte [esp + 0x57], 1
shr ecx, 2
mov byte [esp + 0x5a], 2
mov byte [esp + 0x58], 7
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x14], ebx
and ecx, 3
mov dword [esp + 0x10], 0x9236c4
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x40], 0x28
lea ecx, [esp + 0x40]
mov dword [esp + 0x84], ebx
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
lea ecx, [esp + 0x14]
call fcn.005166d0
mov esi, dword [esp + 0x8c]
lea eax, [esp + 0x10]
push eax
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x28]
mov dword [esp + 0x94], eax
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea edx, [esp + 0x18]
dec ecx
push edx
push ecx
mov ecx, dword [esi + 8]
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
cmp ebp, 1
je 0x49619a
cmp ebp, 4
je 0x49619a
cmp ebp, 2
je 0x49617b
cmp ebp, 5
je 0x49617b
mov ecx, dword [esp + 0x90]
mov eax, dword [esp + 0x18]
mov ebx, dword [ecx + 8]
sub ebx, eax
jmp 0x4961a3
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x18]
mov edi, dword [ecx]
mov eax, dword [ecx + 8]
sub eax, edi
sub eax, edx
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
add ebx, edi
jmp 0x4961a3
mov ecx, dword [esp + 0x90]
mov ebx, dword [ecx]
cmp ebp, 1
je 0x4961ba
cmp ebp, 2
je 0x4961ba
cmp ebp, 3
je 0x4961ba
mov ebp, dword [ecx + 0xc]
add ebp, 0x28
jmp 0x4961c6
mov ebp, dword [ecx + 4]
mov ecx, dword [esp + 0x1c]
sub ebp, ecx
sub ebp, 0x28
push 1
mov ecx, esi
call fcn.00515e00
mov edx, dword [esi]
push 0
mov ecx, esi
call dword [edx + 0x30]
mov dword [esp + 0x90], eax
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi]
lea eax, [esp + 0x20]
not ecx
dec ecx
push ecx
push eax
push ebp
push ebx
mov ecx, esi
call dword [edx + 0x5c]
mov eax, dword [esp + 0x90]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x30]
mov eax, dword [esp + 0x94]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x28]
mov dword [esp + 0x10], 0x9236b8
lea ecx, [esp + 0x10]
mov dword [esp + 0x84], 1
call fcn.00516727
pop edi
pop esi
mov ecx, dword [esp + 0x74]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x78
ret 0x10
Function at 0x496d20
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51dee8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
or esi, 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0050fe84
mov eax, dword [ebp + 0xc]
mov edx, 1
mov dword [ebp - 4], 0
cmp eax, esi
mov byte [ebp - 4], dl
jne 0x496d91
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
cmp eax, edx
jne 0x496d83
mov eax, dword [ecx]
push closesocket
push 0
call dword [eax + 0x3c]
jmp 0x496da7
mov edx, dword [ecx]
push closesocket
push 0
call dword [edx + 0x40]
jmp 0x496da7
mov ecx, dword [ebp + 0x10]
push edx
cmp ecx, edx
mov ecx, dword [ebp + 8]
push eax
mov edi, dword [ecx]
jne 0x496da4
call dword [edi + 0x3c]
jmp 0x496da7
call dword [edi + 0x40]
mov dword [ebp - 4], esi
call fcn.0050fec2
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x498a30
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x51e008
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x498a69
inc eax
mov dword [esi + 0x10], eax
jmp 0x498b7c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x498a7d
mov eax, 0xffffffc7
jmp 0x498b7e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x498a8e
cmp dword [esi + 8], eax
jne 0x498a7d
cmp dword [esi + 8], eax
jne 0x498aa7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x498aa7
mov eax, 0xffffffc7
jmp 0x498b7e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x498abb
push eax
mov ecx, ebx
call fcn.00498260
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00464430
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x498aec
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00464450
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.004979d0
test eax, eax
mov dword [esp + 0x38], eax
je 0x498b1f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x923718
call fcn.00464630
mov eax, dword [esp + 0x38]
jmp 0x498b7e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00498890
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x498b63
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.004988b0
mov esi, eax
test esi, esi
jne 0x498b93
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00498890
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x498b35
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x923718
call fcn.00464630
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x923718
call fcn.00464630
mov eax, esi
jmp 0x498b7e
Function at 0x49aa28
Capabilities:
Reference http user-agent string

Disassembly:
push 0xffffffffffffffff
push 0x51e1be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.00510ea0
mov dword [esi], method.CButton.virtual_0
mov eax, dword [0x94f978]
lea edi, [esi + 0x60]
mov dword [esp + 0x1c], 0
mov dword [edi], eax
mov ecx, dword [0x94f978]
lea ebp, [esi + 0x64]
mov dword [ebp], ecx
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push 0xf
mov byte [esp + 0x20], 2
mov dword [esi], 0x9238b8
call ebx
push eax
mov ecx, esi
call fcn.0049b160
push 0x12
call ebx
push eax
mov ecx, esi
call fcn.0049b190
xor eax, eax
push 0x944014
mov ecx, edi
mov dword [esi + 0x40], eax
mov dword [esi + 0x4c], 2
mov dword [esi + 0x3c], eax
call fcn.0050f9f3
push 0x944008
mov ecx, ebp
call fcn.0050f9f3
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x49b1c0
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
mov edi, ecx
push 0x2e
call esi
push 0x2d
mov ebp, eax
call esi
push 0xa
mov ebx, eax
call esi
lea ecx, [ebx + ebx*4]
cmp eax, ecx
jle 0x49b1f0
push 0xa
call esi
mov dword [esp + 0x10], eax
jmp 0x49b1f4
mov dword [esp + 0x10], ecx
push 9
call esi
lea ecx, [ebp + ebp*4]
cmp eax, ecx
jle 0x49b206
push 9
call esi
jmp 0x49b208
mov eax, ecx
mov ecx, dword [esp + 0x10]
cmp ecx, eax
mov dword [esp + 0x10], ecx
jg 0x49b218
mov dword [esp + 0x10], eax
mov ecx, dword [edi + 0x1c]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x14]
push eax
push ecx
call esi
mov edx, dword [edi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.005112cb
test eax, eax
je 0x49b249
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.00516296
mov eax, dword [edi + 0x1c]
lea edx, [esp + 0x14]
push edx
push eax
call esi
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.00516296
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
sub edx, ebp
push edx
mov edx, dword [esp + 0x1c]
mov ecx, eax
sub eax, esi
sub ecx, ebx
add ebp, edx
push ecx
sub eax, ebx
push ebp
add edi, 0x50
push eax
push edi
call dword [sym.imp.USER32.dll_SetRect]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x49c5c0
Capabilities:
Reference http user-agent string

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, esi
push edi
cdq
mov ecx, eax
mov eax, 0x66666667
xor ecx, edx
sub ecx, edx
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov edi, edx
mov ecx, 0xa
cdq
idiv ecx
mov eax, dword [esp + 0x10]
test esi, esi
jge 0x49c5f8
mov byte [eax], 0x2d
inc eax
test edx, edx
jne 0x49c611
push edi
push 0x944084
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
pop edi
pop esi
ret 8
push edx
push edi
push str._d._d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
pop edi
pop esi
ret 8
Function at 0x49cc30
Capabilities:
Reference http user-agent string

Disassembly:
push esi
push 0
call fcn.00511259
test eax, eax
jne 0x49cc3e
pop esi
ret
mov esi, dword [esp + 8]
lea ecx, [eax + 4]
push esi
call fcn.0050f268
test eax, eax
jne 0x49cc63
push eax
push eax
push 0x8002
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x49cc63
pop esi
ret
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, eax
call fcn.00512c59
pop esi
ret

Function at 0x49cfe0
Capabilities:
Reference http user-agent string

Disassembly:
push 0xffffffffffffffff
push 0x51e618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], method.CWnd.virtual_0
mov dword [esp + 0x10], 0
call fcn.0049d630
mov eax, dword [esi + 0xc0]
test eax, eax
je 0x49d021
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esi + 0xa8]
test eax, eax
je 0x49d034
push eax
call fcn.0050f620
add esp, 4
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x49d047
push eax
call fcn.0050f620
add esp, 4
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.00511959
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x49d070
Capabilities:
Reference http user-agent string

Disassembly:
push esi
mov esi, ecx
call fcn.0049d630
mov eax, dword [esi + 0xc0]
test eax, eax
je 0x49d089
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esi + 0xa8]
test eax, eax
je 0x49d09c
push eax
call fcn.0050f620
add esp, 4
mov eax, dword [esi + 0xb0]
test eax, eax
je 0x49d0af
push eax
call fcn.0050f620
add esp, 4
mov ecx, esi
call fcn.0049d0c0
pop esi
ret
Function at 0x49d1b0
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, ecx
mov dword [ebp], 0
mov dword [eax], 0
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x14]
push edi
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esi + 0xd0]
sub edi, ebx
mov ebx, dword [esp + 0x24]
sub ebx, edx
cmp eax, 2
mov dword [esp + 0x30], edi
mov dword [esp + 0x10], ebx
jne 0x49d304
mov ecx, dword [esp + 0x34]
mov eax, dword [esi + 0xd4]
mov dword [ecx], eax
mov eax, dword [esp + 0x38]
mov edx, dword [esi + 0xd8]
mov dword [eax], edx
mov ecx, dword [esi + 0xd4]
cmp ecx, edi
jge 0x49d243
mov eax, edi
sub eax, ecx
mov ecx, dword [esp + 0x2c]
cdq
sub eax, edx
sar eax, 1
mov dword [ecx], eax
mov edi, dword [esi + 0xd4]
mov dword [esp + 0x30], edi
mov ecx, dword [esi + 0xd8]
cmp ecx, ebx
mov dword [esp + 0x14], ecx
jge 0x49d26d
mov eax, ebx
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp], eax
mov ecx, dword [esi + 0xd8]
mov ebx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
mov eax, dword [esi + 0xd4]
cmp eax, edi
mov dword [esp + 0x18], eax
jg 0x49d283
cmp ecx, ebx
jle 0x49d336
fild dword [esp + 0x18]
fild dword [esp + 0x30]
fdiv st(1)
fild dword [esp + 0x10]
fidiv dword [esp + 0x14]
fstp qword [esp + 0x18]
fcom qword [esp + 0x18]
fnstsw ax
test ah, 1
jne 0x49d2aa
fstp st(0)
fld qword [esp + 0x18]
fxch st(1)
fmul st(1)
call fcn.004fdc38
mov edx, dword [esp + 0x34]
mov dword [edx], eax
fild dword [esi + 0xd8]
fmul st(1)
call fcn.004fdc38
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
fstp st(0)
mov dword [ecx], eax
mov eax, edi
sub eax, dword [edx]
cdq
sub eax, edx
mov edx, eax
mov eax, dword [esp + 0x2c]
sar edx, 1
mov esi, dword [eax]
add esi, edx
mov dword [eax], esi
mov edi, dword [ecx]
mov eax, ebx
mov ecx, dword [ebp]
sub eax, edi
pop edi
cdq
sub eax, edx
pop esi
sar eax, 1
add ecx, eax
mov dword [ebp], ecx
pop ebp
pop ebx
add esp, 0x18
ret 0x10
test eax, eax
je 0x49d31e
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [eax], edi
pop edi
pop esi
mov dword [ecx], ebx
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [esp + 0x34]
mov edx, dword [esi + 0xd4]
mov dword [eax], edx
mov edx, dword [esp + 0x38]
mov ecx, dword [esi + 0xd8]
mov dword [edx], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10