joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4959c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
push 0x56f47c
push 0x400
mov ebp, ecx
call fcn.004d07ed
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4959f8
push 3
pop edi
mov ebx, edi
push esi
call fcn.004d0771
pop ecx
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x20
ret 4
xor ebx, ebx
push 2
mov ecx, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov eax, ebx
mov edx, ebx
pop edi
add eax, 0xa
sub edx, 0x400
mov dword [esp + 0x14], eax
inc ecx
mov eax, edx
mov dword [esp + 0x20], edx
cdq
mov dword [esp + 0x18], ecx
mov ecx, eax
cmp dword [esp + 0x18], 1
mov eax, edx
mov dword [esp + 0x1c], eax
jle 0x495a40
mov eax, dword [esp + 0x14]
cdq
add ecx, eax
mov eax, dword [esp + 0x1c]
adc eax, edx
push edi
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push ecx
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 0x24], eax
cmp eax, 0xffffffff
jne 0x495a6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4959e3
push ebx
lea eax, [esp + 0x14]
push eax
push 0x400
push esi
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4959e3
mov eax, 0x400
cmp dword [esp + 0x10], eax
jne 0x4959e3
push ecx
push ecx
mov edx, eax
mov ecx, esi
call fcn.0046e0b0
pop ecx
pop ecx
test eax, eax
jns 0x495abb
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
jmp 0x495a0b
mov ecx, dword [esp + 0x24]
add ecx, 0xffffffc0
mov dword [esp + 0x2c], ebx
add eax, ecx
lea ecx, [esp + 0x2c]
push ebx
push ecx
push eax
push dword [esp + 0x40]
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4959e3
push ebx
lea eax, [esp + 0x14]
push eax
push 0x4a
push ebp
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4959e3
cmp dword [esp + 0x10], ebx
je 0x4959e3
push 0xa
lea eax, [ebp + 0x40]
push str.ADVINSTSFX
push eax
call fcn.004d2104
add esp, 0xc
test eax, eax
jne 0x495b28
cmp dword [ebp + 0xc], 0x64
je 0x495b2f
push 5
jmp 0x4959e2
mov ecx, dword [esp + 0x28]
sub ecx, dword [ebp + 0x10]
mov eax, dword [esp + 0x2c]
sbb eax, ebx
mov dword [ebp + 0x50], ecx
mov dword [ebp + 0x54], eax
jmp 0x4959e5
Function at 0x495bbe
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
mov ebx, ecx
xor ebp, ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov dword [ebx + 0x10], edi
cmp dword [ebx + 4], ebp
jne 0x495bd6
xor eax, eax
jmp 0x495c44
test edi, edi
je 0x495bf7
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
lea ecx, [ebx + 0x14]
call fcn.00422d68
mov eax, dword [edi]
mov ecx, edi
push dword [ebx + 0x14]
call dword [eax + 0x20]
lea eax, [esp + 0x14]
push eax
push ebp
push ebx
push 0x495c4b
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test edi, edi
je 0x495c18
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 4]
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [esp + 0x14]
test ebx, ebx
je 0x495c42
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4961e5
Capabilities:
Delete file

Disassembly:
push 0x1c
mov eax, 0x50d558
call fcn.004d0cf3
mov esi, ecx
mov dword [ebp - 0x24], esi
mov ebx, dword [ebp + 8]
push 0x2e
push dword [ebx]
call fcn.004d3931
pop ecx
pop ecx
test eax, eax
je 0x496396
sub eax, dword [ebx]
sar eax, 1
test eax, eax
jle 0x496396
push eax
lea eax, [ebp - 0x10]
mov ecx, ebx
push eax
call fcn.004450c5
call fcn.00406cde
push eax
lea ecx, [ebp - 0x18]
call fcn.00406b09
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x18]
push dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
push dword [ebx]
push dword [edi]
push 0x534e10
push eax
call fcn.004575ca
mov ecx, dword [esi + 0x10]
add esp, 0x14
test ecx, ecx
je 0x49625e
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
push 0
lea eax, [ebp - 0x28]
push 0x8000008
push eax
lea ecx, [esi + 0xc]
lea edx, [ebp - 0x18]
call fcn.00485ff8
add esp, 0xc
mov byte [ebp + 0xb], 1
lea ecx, [ebp - 0x10]
call fcn.004713f0
test al, al
je 0x496294
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x49635e
call fcn.00406cde
push eax
lea ecx, [ebp - 0x1c]
call fcn.00406b09
or dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0x1c]
mov ecx, edi
call fcn.0048687b
call fcn.00406cde
push eax
lea ecx, [ebp - 0x14]
call fcn.00406b09
or dword [ebp - 4], 0xffffffff
mov edx, 0xca
lea ecx, [ebp - 0x20]
call fcn.00495030
mov eax, dword [ebp - 0x10]
push 0x5c
push eax
mov esi, dword [eax - 0xc]
call fcn.004d3931
pop ecx
pop ecx
test eax, eax
jne 0x4962e8
or eax, 0xffffffff
jmp 0x4962ed
sub eax, dword [ebp - 0x10]
sar eax, 1
mov edi, dword [ebp - 0x20]
lea ecx, [ebp - 0x10]
sub esi, eax
lea eax, [ebp + 8]
push esi
push eax
call fcn.00445117
mov esi, dword [ebp - 0x1c]
push esi
push dword [eax]
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.004575ca
add esp, 0x10
or edi, 0xffffffff
mov dword [ebp - 4], edi
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
xor dl, dl
lea ecx, [ebp - 0x14]
call fcn.0048b036
mov byte [ebp + 0xb], 0
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
mov dword [ebp - 4], edi
lea ecx, [esi - 0x10]
call fcn.00406dd3
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x496373
mov eax, dword [ecx]
push ebx
call dword [eax + 0x18]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00406dd3
mov al, byte [ebp + 0xb]
jmp 0x496398
mov al, 1
call fcn.004d0cbc
ret 8
Function at 0x49649b
Capabilities:
Create thread

Disassembly:
sub esp, 0x28
mov eax, dword [esp + 0x2c]
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
mov dword [esp + 0x20], edi
mov dword [edi + 0x10], eax
cmp dword [eax], ebp
je 0x4964d5
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
lea ecx, [edi + 0x14]
call fcn.00422d68
mov eax, dword [edi + 0x10]
push dword [edi + 0x14]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x10]
lea eax, [esp + 0x3c]
push eax
push ebp
push edi
push 0x496750
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [edi + 0x10]
mov ebx, eax
mov dword [esp + 0x24], ebx
cmp dword [ecx], ebp
je 0x496588
mov ecx, edi
call fcn.004965be
mov esi, dword [edi + 4]
xorps xmm0, xmm0
mov ecx, dword [edi]
mov dword [esp + 0x28], eax
movlpd qword [esp + 0x30], xmm0
mov eax, dword [esi + 4]
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x34]
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x1c], eax
test eax, eax
jle 0x49656b
mov ebx, dword [esp + 0x10]
lea eax, [ecx + 0x78]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x18], eax
push ebx
mov ecx, edi
call fcn.00406740
mov ecx, dword [esp + 0x18]
push dword [eax]
call fcn.004842b2
mov eax, dword [eax + 0xc]
add ebp, eax
adc esi, 0
inc ebx
cmp ebx, dword [esp + 0x1c]
jl 0x496541
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov eax, dword [edi + 0x10]
add ebp, dword [esp + 0x28]
adc esi, dword [esp + 0x2c]
mov ecx, dword [eax]
push esi
push ebp
mov eax, dword [ecx]
call dword [eax]
mov eax, dword [edi + 0x10]
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 8]
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x3c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [esp + 0x3c]
test ebx, ebx
je 0x4965b2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x496b01
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
movzx ebx, word [ebp + 0x10]
push esi
push edi
push 0
push 0x5239d0
push 0x1001
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp + 0x10], eax
lea edi, [eax - 1]
call fcn.00406cde
mov esi, dword [ebp + 8]
mov ecx, esi
push eax
call fcn.00406b09
test edi, edi
jle 0x496b54
push edi
mov ecx, esi
call fcn.00451cbd
push edi
push 0x78
push eax
call fcn.004d1f70
add esp, 0xc
mov ecx, esi
push edi
call fcn.00451c97
mov eax, dword [esi]
cmp dword [eax - 4], 1
jle 0x496b66
push dword [eax - 0xc]
mov ecx, esi
call fcn.00451e0e
push dword [ebp + 0x10]
push dword [esi]
push 0x1001
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x498144
Capabilities:
Get file size
Read file on windows

Disassembly:
push 8
mov eax, 0x50d84b
call fcn.004d0cf3
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, 0xffffffff
je 0x498186
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x498193
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4982ac
inc eax
push 0x56f47c
push eax
call fcn.004d07ed
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4981af
push 8
pop ebx
jmp 0x4982a5
push ebx
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
push dword [ebp - 0x10]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4981d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4982a5
mov ecx, dword [ebp + 0x10]
call fcn.004092da
mov eax, dword [ebp + 8]
test eax, eax
je 0x4982a5
mov ecx, dword [ebp + 0xc]
push str.utf_8
mov byte [eax + esi], bl
call fcn.004506f4
test eax, eax
jne 0x498204
push 0xfde9
jmp 0x49829a
mov ecx, dword [ebp + 0xc]
push str.utf_16
call fcn.004506f4
test eax, eax
jne 0x49824a
mov edi, dword [ebp + 8]
shr edi, 1
call fcn.00406cde
push eax
push edi
push esi
lea ecx, [ebp + 0xc]
call fcn.0044540d
mov ecx, dword [ebp + 0x10]
lea eax, [ebp + 0xc]
push eax
call fcn.0044369a
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
mov edi, dword [ebp - 0x14]
jmp 0x4982a5
mov ecx, dword [ebp + 0xc]
push str.ISO_8859_1
call fcn.004506f4
test eax, eax
jne 0x498262
push 0x6faf
jmp 0x49829a
mov ecx, dword [ebp + 0xc]
push str.US_ASCII
call fcn.004506f4
test eax, eax
jne 0x498299
push dword [ebp + 8]
lea ecx, [ebp + 0xc]
push esi
call fcn.00499d58
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0044369a
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
jmp 0x4982a5
push ebx
mov edx, dword [ebp + 0x10]
mov ecx, esi
call fcn.0046dba0
pop ecx
push esi
call fcn.004d0771
pop ecx
test edi, edi
je 0x4982b7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
call fcn.004d0cbc
ret 0xc
Function at 0x498665
Capabilities:
Get file size

Disassembly:
push 0xc
mov eax, 0x50d86e
call fcn.004d0cf3
mov ebx, ecx
mov edi, dword [ebp + 0x10]
mov ecx, edi
call fcn.00499d1a
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
mov dword [ebp + 0x10], eax
cmp byte [ebx + 0x40], cl
mov byte [ebx + 0x10], 1
cmovne ecx, eax
mov dword [ebp + 0xc], ecx
lea ecx, [ebp - 0x14]
call fcn.00406df5
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
push dword [ebp + 0x14]
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.004985c8
mov esi, eax
mov byte [ebx + 0x10], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4986d8
cmp dword [ebp + 0xc], eax
mov ecx, 0x2ee2
cmovne esi, ecx
test esi, esi
jne 0x4986ee
mov esi, dword [ebx + 4]
cmp esi, dword [edi]
je 0x4986ec
mov ecx, edi
call fcn.00499d1a
mov dword [edi], esi
xor esi, esi
lea eax, [ebp - 0x14]
mov dword [ebp + 0xc], eax
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00406dd3
mov eax, esi
call fcn.004d0cbc
ret 0x10

Function at 0x49870d
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
push dword [edi + 0x64]
lea ebx, [edi + 0x38]
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ebp, dword [esp + 0x20]
push ebp
push dword [esp + 0x20]
mov byte [edi + 0x41], 0
push dword [esp + 0x20]
mov dword [edi + 0x34], 3
push dword [esp + 0x20]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x498799
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x49879b
jmp 0x498784
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x498789
push ebx
lea ecx, [edi + 0xc]
call fcn.004a2a5c
lea ecx, [edi + 0xc]
call fcn.004a2a45
test al, al
jne 0x4987a2
push 0xa
push dword [edi + 0x64]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebx], 0
je 0x498757
cmp dword [edi + 0x30], 0
mov eax, dword [edi + 0x2c]
je 0x49879b
test eax, eax
jle 0x498799
mov dword [ebp], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
mov eax, 0xe0000008
jmp 0x49879b
Function at 0x4987a9
Capabilities:
Query remote server for available data

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
push dword [edi + 0x64]
lea ebx, [edi + 0x38]
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ebp, dword [esp + 0x18]
xor eax, eax
push eax
push eax
push ebp
push dword [esp + 0x20]
mov byte [edi + 0x41], al
mov dword [edi + 0x34], 8
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x498830
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x498832
jmp 0x49881b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x498820
push ebx
lea ecx, [edi + 0xc]
call fcn.004a2a5c
lea ecx, [edi + 0xc]
call fcn.004a2a45
test al, al
jne 0x498839
push 0xa
push dword [edi + 0x64]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebx], 0
je 0x4987ee
cmp dword [edi + 0x30], 0
mov eax, dword [edi + 0x2c]
je 0x498832
test eax, eax
jle 0x498830
mov dword [ebp], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov eax, 0xe0000008
jmp 0x498832
Function at 0x498a6e
Capabilities:
Connect network resource

Disassembly:
push 0x3c
mov eax, 0x50d934
call fcn.004d0cf3
mov dword [ebp - 0x1c], ecx
call fcn.00406cde
push eax
lea ecx, [ebp - 0x14]
call fcn.00406b09
or dword [ebp - 4], 0xffffffff
call fcn.00406cde
push eax
lea ecx, [ebp - 0x10]
call fcn.00406b09
or dword [ebp - 4], 0xffffffff
xor edi, edi
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
mov ebx, dword [ebp + 0x10]
mov esi, edi
call fcn.004700e0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x498ac1
mov eax, dword [ecx]
call dword [eax]
test ebx, ebx
je 0x498b0a
push 0x20
lea eax, [ebp - 0x48]
push edi
push eax
call fcn.004d1f70
mov eax, dword [ebp - 0x18]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x38], edi
add esp, 0xc
mov dword [ebp - 0x44], ecx
cmp dword [eax - 4], ecx
jle 0x498af3
push dword [eax - 0xc]
lea ecx, [ebp - 0x18]
call fcn.00406931
mov eax, dword [ebp - 0x18]
push edi
push ebx
push dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x2c], edi
call dword [sym.imp.MPR.dll_WNetAddConnection2W]
mov esi, eax
test esi, esi
jne 0x498b27
push dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x28]
call fcn.00471420
mov esi, eax
pop ecx
test esi, esi
je 0x498be2
cmp esi, 0x52e
je 0x498b40
cmp esi, 0x56
je 0x498b40
cmp esi, 0x89a
jne 0x498bed
push str.Local_Network_Server
lea ecx, [ebp - 0x20]
call fcn.004093f6
call fcn.00406cde
push eax
lea ecx, [ebp + 0x10]
call fcn.00406b09
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x10]
push eax
push edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
push edi
call fcn.00499bce
mov bl, al
neg bl
sbb bl, bl
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00406dd3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
add bl, 1
jne 0x498be9
mov ebx, dword [ebp - 0x14]
cmp dword [ebx - 4], 1
jle 0x498bbc
push dword [ebx - 0xc]
lea ecx, [ebp - 0x14]
call fcn.00406931
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x14], eax
cmp dword [eax - 4], 1
jle 0x498ac1
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00406931
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x14], eax
jmp 0x498ac1
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
jmp 0x498beb
mov edi, esi
mov esi, edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00406dd3
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00406dd3
mov eax, esi
call fcn.004d0cbc
ret 0x18
Function at 0x499863
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.004d1f70
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x3c]
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
push ecx
push 0
push 0
push dword [eax]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x49989f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4998a9
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x30]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x499fd8
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x50d089
call fcn.004d0cf3
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ebx, [esi + 4]
mov ecx, dword [ebx]
call fcn.0046c390
push ecx
mov ecx, ebx
call fcn.00421253
mov eax, dword [esi + 0x28]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [eax]
push dword [ebx]
call edi
call fcn.00406cde
push eax
lea ecx, [ebp - 0x10]
call fcn.00406b09
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
push 0xdc
call fcn.00409267
push 0x40a
push dword [ebx]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [ebp - 0x10]
push esi
push eax
call edi
mov edi, dword [ebp - 0x14]
push dword [ebx]
lea ecx, [edi + 0x40]
call fcn.0049b3fa
push dword [ebx]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [ebp - 0x18]
push eax
xor eax, eax
push eax
push edi
push 0x49a080
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x30], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00406dd3
xor eax, eax
call fcn.004d0cbc
ret 0x10
Function at 0x49a95d
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
lea ebx, [ecx - 0x40]
xor esi, esi
inc edi
test ecx, ecx
jne 0x49a970
mov ebx, esi
push ebp
push dword [esp + 0x1c]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, dword [esp + 0x20]
mov ebp, eax
or dword [esp + 0x10], 0xffffffff
push ebp
call fcn.0042e866
mov ecx, eax
test ecx, ecx
je 0x49a9be
lea eax, [ebp + 1]
push eax
push ecx
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 0x20]
push 0xffffffffffffffff
mov dword [esp + 0x14], eax
call fcn.00406a87
cmp dword [esp + 0x10], ebp
pop ebp
jge 0x49a9eb
push 0xffffffffffffffff
mov edi, esi
call dword [sym.imp.USER32.dll_MessageBeep]
add ebx, 0x40
je 0x49a9d7
lea esi, [ebx - 0x40]
push dword [esp + 0x18]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
ret 0x18

Function at 0x49ad07
Capabilities:
Hide graphical window

Disassembly:
push edi
test ecx, ecx
je 0x49ad11
lea edi, [ecx - 0x20]
jmp 0x49ad13
xor edi, edi
cmp byte [ecx + 0x1c], 0
je 0x49ad49
push 0xe801
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [esp + 0xc], 2
jne 0x49ad39
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x49ad50
cmp dword [esp + 0xc], 0
jne 0x49ad49
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esp + 0xc], 1
je 0x49ad67
mov ecx, dword [esp + 0x10]
mov eax, ecx
shr eax, 0x10
cwde
push eax
movsx eax, cx
lea ecx, [edi + 0x20]
push eax
call fcn.0049399a
xor eax, eax
pop edi
ret 0x10

Function at 0x49b229
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x56a078]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
and dword [ebp - 0x18], 0
push ebx
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x49b2a5
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
xor ecx, ecx
mov dword [ebp - 8], 2
push ecx
push ecx
push ecx
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ecx
push dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x49b2a5
push 0x80040002
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x49b2a7
xor bl, bl
cmp dword [ebp - 0x1c], 0
je 0x49b2b6
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004d014c
mov esp, ebp
pop ebp
ret
Function at 0x49bf54
Capabilities:
Hide graphical window

Disassembly:
push edi
test ecx, ecx
je 0x49bf5e
lea edi, [ecx - 0x54]
jmp 0x49bf60
xor edi, edi
cmp byte [ecx + 0x1c], 0
je 0x49bf96
push 0xe801
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [esp + 0xc], 2
jne 0x49bf86
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x49bf9d
cmp dword [esp + 0xc], 0
jne 0x49bf96
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esp + 0xc], 1
je 0x49bfb4
mov ecx, dword [esp + 0x10]
mov eax, ecx
shr eax, 0x10
cwde
push eax
movsx eax, cx
lea ecx, [edi + 0x54]
push eax
call fcn.0049c3ce
xor eax, eax
pop edi
ret 0x10
Function at 0x49d4a0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x24
mov eax, dword [0x56a078]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
push esi
push edi
mov ebp, ecx
push 0x3f7
push dword [ebp + 4]
call ebx
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call edi
push 0x3eb
push dword [ebp + 4]
call ebx
mov esi, eax
push 0
push esi
call edi
push 0x3ec
push dword [ebp + 4]
call ebx
push 0
push eax
call edi
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x10]
push eax
lea ebx, [ebp + 0x8c]
xorps xmm0, xmm0
push dword [ebx]
movups xmmword [esp + 0x18], xmm0
call edi
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
push esi
movups xmmword [esp + 0x28], xmm0
call edi
mov eax, dword [esp + 0x2c]
mov ecx, ebx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
push 0x222
push eax
push 0
call fcn.00406477
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004d014c
add esp, 0x24
ret