joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47def0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x5159c4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x500644
lea ecx, [ebp - 4]
call fcn.00413a00
lea eax, [ebp - 0x80c]
push eax
call fcn.0043bc50
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004c62e0
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.00413b20
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
push 0x500648
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x47e06a
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.0040d270
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x47e00c
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x47dfe8
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.00413a00
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0x70
call fcn.00430750
lea ecx, [ebp - 0x818]
call fcn.00413a40
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.0040d270
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x47df9c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00413a00
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0x70
call fcn.00430750
lea ecx, [ebp - 0x81c]
call fcn.00413a40
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x50065c
lea ecx, [ebp - 4]
push ecx
call fcn.00415220
add esp, 0xc
jmp 0x47df4e
mov ecx, dword [ebp - 0x824]
add ecx, 0x70
call fcn.0047f3c0
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.00413a40
lea ecx, [ebp - 4]
call fcn.00413a40
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c62c9
mov esp, ebp
pop ebp
ret
Function at 0x47e0b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x5159c4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x500664
lea ecx, [ebp - 4]
call fcn.00413a00
lea eax, [ebp - 0x80c]
push eax
call fcn.0043bc50
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004c62e0
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.00413b20
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
push 0x500668
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x47e230
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.0040d270
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x47e1cf
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x47e1ab
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.00413a00
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0x8c
call fcn.00430750
lea ecx, [ebp - 0x818]
call fcn.00413a40
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.0040d270
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x47e15c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00413a00
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0x8c
call fcn.00430750
lea ecx, [ebp - 0x81c]
call fcn.00413a40
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x500678
lea ecx, [ebp - 4]
push ecx
call fcn.00415220
add esp, 0xc
jmp 0x47e10e
mov ecx, dword [ebp - 0x824]
add ecx, 0x8c
call fcn.0047f3c0
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.00413a40
lea ecx, [ebp - 4]
call fcn.00413a40
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c62c9
mov esp, ebp
pop ebp
ret
Function at 0x47e4c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x5159c4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x500684
lea ecx, [ebp - 4]
call fcn.00413a00
lea eax, [ebp - 0x80c]
push eax
call fcn.0043bc50
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004c62e0
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.00413b20
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
push 0x500688
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x47e640
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.0040d270
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x47e5df
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x47e5bb
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.00413a00
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0xa8
call fcn.00430750
lea ecx, [ebp - 0x818]
call fcn.00413a40
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.0040d270
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x47e56c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00413a00
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0xa8
call fcn.00430750
lea ecx, [ebp - 0x81c]
call fcn.00413a40
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x50069c
lea ecx, [ebp - 4]
push ecx
call fcn.00415220
add esp, 0xc
jmp 0x47e51e
mov ecx, dword [ebp - 0x824]
add ecx, 0xa8
call fcn.0047f3c0
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.00413a40
lea ecx, [ebp - 4]
call fcn.00413a40
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c62c9
mov esp, ebp
pop ebp
ret
Function at 0x47e690
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x5159c4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x5006a4
lea ecx, [ebp - 4]
call fcn.00413a00
lea eax, [ebp - 0x80c]
push eax
call fcn.0043bc50
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004c62e0
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.00413b20
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
push 0x5006a8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x47e810
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.0040d270
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x47e7af
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x47e78b
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.00413a00
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0xc4
call fcn.00430750
lea ecx, [ebp - 0x818]
call fcn.00413a40
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.0040d270
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x47e73c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00413a00
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0xc4
call fcn.00430750
lea ecx, [ebp - 0x81c]
call fcn.00413a40
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x5006bc
lea ecx, [ebp - 4]
push ecx
call fcn.00415220
add esp, 0xc
jmp 0x47e6ee
mov ecx, dword [ebp - 0x824]
add ecx, 0xc4
call fcn.0047f3c0
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.00413a40
lea ecx, [ebp - 4]
call fcn.00413a40
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c62c9
mov esp, ebp
pop ebp
ret
Function at 0x47e860
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
push eax
push str._AD_:_d
call fcn.004139b0
add esp, 8
cmp dword [ebp + 8], 0
jne 0x47e88a
lea ecx, [ebp + 0x20]
call fcn.00413a40
jmp 0x47e9a3
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 6
ja case.default.0x47e89d
mov edx, dword [ebp - 0x18]
jmp dword [edx*4 + 0x47e9a8]
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x10
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x47e89d
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x47e89d
push 0
push 0
push 0x12
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp case.default.0x47e89d
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 4], 0
je 0x47e922
lea ecx, [ebp - 8]
call fcn.00481a80
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 8]
call fcn.00482100
lea ecx, [ebp - 8]
call fcn.00481aa0
jmp case.default.0x47e89d
push ecx
mov ecx, esp
lea edx, [ebp + 0x20]
push edx
call fcn.004139e0
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov edx, dword [ebp + 0x14]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 0x18]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x1c]
mov dword [eax + 0xc], edx
call fcn.0047eef0
add esp, 0x14
jmp case.default.0x47e89d
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.0047f0d0
add esp, 8
push 0
push 0
push 0
mov edx, dword [ebp - 0x10]
imul edx, edx, 0xfffffffd
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
jmp case.default.0x47e89d
mov ecx, dword [ebp + 8]
push ecx
call fcn.0047f190
add esp, 4
lea ecx, [ebp + 0x20]
call fcn.00413a40
mov esp, ebp
pop ebp
ret
Function at 0x47e9d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x5159c4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x5006e0
lea ecx, [ebp - 4]
call fcn.00413a00
lea eax, [ebp - 0x80c]
push eax
call fcn.0043bc50
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004c62e0
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.00413b20
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
push 0x5006e4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x47eb50
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.0040d270
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x47eaef
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x47eacb
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.00413a00
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0xe0
call fcn.00430750
lea ecx, [ebp - 0x818]
call fcn.00413a40
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.0040d270
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x47ea7c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00413a00
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0xe0
call fcn.00430750
lea ecx, [ebp - 0x81c]
call fcn.00413a40
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x5006f4
lea ecx, [ebp - 4]
push ecx
call fcn.00415220
add esp, 0xc
jmp 0x47ea2e
mov ecx, dword [ebp - 0x824]
add ecx, 0xe0
call fcn.0047f3c0
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.00413a40
lea ecx, [ebp - 4]
call fcn.00413a40
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c62c9
mov esp, ebp
pop ebp
ret
Function at 0x47eba0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x5159c4]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x824], ecx
mov dword [ebp - 0x810], 1
push 0x5006fc
lea ecx, [ebp - 4]
call fcn.00413a00
lea eax, [ebp - 0x80c]
push eax
call fcn.0043bc50
add esp, 4
xor ecx, ecx
mov word [ebp - 0x808], cx
push 0x7fe
push 0
lea edx, [ebp - 0x806]
push edx
call fcn.004c62e0
add esp, 0xc
lea ecx, [ebp - 0x80c]
call fcn.00413b20
push eax
push 0x104
lea eax, [ebp - 0x808]
push eax
push 0
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
push 0x500700
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp eax, 1
jbe 0x47ed20
push 0x3b
lea ecx, [ebp - 0x808]
push ecx
call fcn.0040d270
add esp, 8
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x47ecbf
mov edx, dword [ebp - 0x814]
movzx eax, word [edx + 2]
test eax, eax
je 0x47ec9b
mov ecx, dword [ebp - 0x814]
add ecx, 2
push ecx
lea ecx, [ebp - 0x818]
call fcn.00413a00
lea edx, [ebp - 0x818]
push edx
mov ecx, dword [ebp - 0x824]
add ecx, 0xfc
call fcn.00430750
lea ecx, [ebp - 0x818]
call fcn.00413a40
xor eax, eax
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
push 0x3b
lea edx, [ebp - 0x808]
push edx
call fcn.0040d270
add esp, 8
mov dword [ebp - 0x814], eax
jmp 0x47ec4c
lea eax, [ebp - 0x808]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00413a00
lea ecx, [ebp - 0x81c]
push ecx
mov ecx, dword [ebp - 0x824]
add ecx, 0xfc
call fcn.00430750
lea ecx, [ebp - 0x81c]
call fcn.00413a40
mov edx, dword [ebp - 0x810]
add edx, 1
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
push eax
push 0x500718
lea ecx, [ebp - 4]
push ecx
call fcn.00415220
add esp, 0xc
jmp 0x47ebfe
mov ecx, dword [ebp - 0x824]
add ecx, 0xfc
call fcn.0047f3c0
xor edx, edx
cmp edx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x820], eax
lea ecx, [ebp - 0x80c]
call fcn.00413a40
lea ecx, [ebp - 4]
call fcn.00413a40
mov eax, dword [ebp - 0x820]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004c62c9
mov esp, ebp
pop ebp
ret
Function at 0x47f190
Capabilities:
Check for time delay via gettickcount
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov dword [ebp - 0x34], 0
push 0x2c
push 0
lea eax, [ebp - 0x30]
push eax
call fcn.004c62e0
add esp, 0xc
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x20], 0x400000
mov dword [ebp - 0xc], str.NOUSE_NOUSE
mov dword [ebp - 0x2c], 0x47f2c0
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
mov edx, dword [ebp - 0x20]
push edx
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47f2b0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetParent]
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x38], eax
push 1
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x47f26b
cmp dword [ebp - 0x50], 0x12
jne 0x47f257
jmp 0x47f2a3
lea edx, [ebp - 0x54]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x47f27b
jmp 0x47f2a3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x38]
cmp eax, 0x3e8
jb 0x47f29a
push 0x5007d4
call fcn.004139b0
add esp, 4
jmp 0x47f2a3
mov edx, 1
test edx, edx
jne 0x47f237
push str.ClosePopWndBySetParent
call fcn.004139b0
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x480bb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
call fcn.0043bc50
add esp, 4
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
push 0x258
push str.checkmaxX
push 0x500ae4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x518ca8], eax
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
push 0x258
push str.checkmaxY
push 0x500b08
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x518cac], eax
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
push 0x32
push str.checkminY
push 0x500b2c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x518cb0], eax
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
push 0x258
push str.checkExplmaxX
push 0x500b58
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x518cb4], eax
lea ecx, [ebp - 4]
call fcn.00413b20
push eax
push 0x258
push str.checkExplmaxY
push str.PopWnd
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [0x518cb8], eax
mov dword [ebp - 8], 1
lea ecx, [ebp - 4]
call fcn.00413a40
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x482010
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x14]
push eax
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x48206b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x48204d
xor eax, eax
jmp 0x4820f1
lea ecx, [ebp - 0x14]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x48206b
xor eax, eax
jmp 0x4820f1
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x18], 2
lea edx, [ebp - 0x20]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0x10
lea edx, [ebp - 0x24]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4820c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4820f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x4820ec
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4820f1
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x482100
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x482139
mov ecx, dword [ebp - 0xc]
call fcn.00482010
mov ecx, dword [ebp + 8]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x482143
xor eax, eax
jmp 0x482172
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x48216f
mov ecx, dword [ebp - 0xc]
call fcn.00482010
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x482430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x500e20
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x482475
cmp dword [ebp - 8], 0
je 0x4824c8
mov dword [ebp - 4], 4
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 4
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0x500e64
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4824b7
mov dword [ebp - 0xc], 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4824d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x5159c4]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 2
push 0
push 0
push 0
push str.SOFTWARE360Safe_tpiAdPopBlocker
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x482531
cmp dword [ebp - 8], 0
je 0x4825ed
mov dword [ebp - 4], 4
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 4
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 4]
push eax
push 0
push 0x500ebc
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], 1
push 0x80
push 0
lea edx, [ebp - 0xa0]
push edx
call fcn.004c62e0
add esp, 0xc
push str.safemonAdPopBlocker.tpi
push 0x80
lea eax, [ebp - 0xa0]
push eax
call fcn.00422b70
lea ecx, [ebp - 0xa0]
push ecx
call fcn.004c635a
add esp, 4
lea edx, [eax + eax + 2]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0xa0]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
push 0x500f04
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4825dc
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004c62c9
mov esp, ebp
pop ebp
ret

Function at 0x482600
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x500f18
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x482645
cmp dword [ebp - 8], 0
je 0x482698
mov dword [ebp - 4], 4
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 4
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0x500f58
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x482687
mov dword [ebp - 0xc], 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret