joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a8c0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x583d2b
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5cca0c]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xc4]
push 1
xor edi, edi
xor ebx, ebx
push 3
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], edi
call fcn.00430200
cmp ebp, 0x3e8
mov dword [esp + 0xb8], edi
mov eax, str.UDP
je 0x46a92e
mov eax, str.Ping
push eax
lea eax, [esp + 0x34]
push eax
call fcn.00442aa0
mov esi, dword [esp + 0xc8]
mov eax, dword [esi + 0x10]
add esp, 8
test eax, eax
mov dword [esp + 0x1c], edi
jbe 0x46aa0c
mov edi, dword [esi + 0xc]
lea ecx, [edi + eax]
cmp edi, ecx
jbe 0x46a961
call fcn.005532de
mov eax, dword [esi + 0xc]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esi + 0x10]
add edi, edx
add ecx, eax
cmp edi, ecx
ja 0x46a977
cmp edi, eax
jae 0x46a97c
call fcn.005532de
mov edx, dword [esi + 0x10]
add edx, dword [esi + 0xc]
mov ebx, edi
mov ebp, edi
shr ebx, 2
and ebp, 3
cmp edi, edx
jb 0x46a995
call fcn.005532de
mov eax, dword [esi + 8]
cmp eax, ebx
ja 0x46a99e
sub ebx, eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + ebx*4]
mov edi, dword [ecx + ebp*4]
push 0x597ed0
push edi
lea ecx, [esp + 0x38]
call fcn.00443700
push eax
call fcn.00442aa0
add esp, 8
cmp edi, dword [esp + 0xc4]
jb 0x46a9cf
add dword [esp + 0x18], 1
jmp 0x46a9e7
cmp dword [esp + 0x20], edi
jbe 0x46a9d9
mov dword [esp + 0x20], edi
cmp dword [esp + 0x24], edi
jae 0x46a9e3
mov dword [esp + 0x24], edi
add dword [esp + 0x14], edi
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 0x10]
add ecx, 1
cmp ecx, eax
mov dword [esp + 0x1c], ecx
jb 0x46a952
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0xc4]
mov edi, dword [esp + 0x14]
mov eax, dword [esi + 0x10]
cmp ebx, eax
jne 0x46aa2b
mov ecx, dword [esp + 0xc8]
mov edx, dword [esp + 0xcc]
mov dword [ecx], ebp
mov dword [edx], 0x64
jmp 0x46aa69
sub eax, ebx
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
test edi, edi
mov ecx, dword [esp + 0xc8]
mov dword [ecx], eax
jbe 0x46aa54
cmp eax, 2
jle 0x46aa54
mov edi, eax
shr edi, 1
cmp edx, edi
jb 0x46aa54
add eax, 1
mov dword [ecx], eax
mov esi, dword [esi + 0x10]
mov eax, ebx
imul eax, eax, 0x64
xor edx, edx
div esi
mov edx, dword [esp + 0xcc]
mov dword [edx], eax
mov edx, dword [edx]
mov eax, dword [ecx]
push edx
push 0x597ec4
push eax
lea ecx, [esp + 0x3c]
push 0x597eb8
push ecx
call fcn.00442aa0
add esp, 8
mov ecx, eax
call fcn.004435a0
push eax
call fcn.00442aa0
add esp, 8
mov ecx, eax
call fcn.004435a0
lea ecx, [esp + 0x7c]
mov dword [esp + 0xb8], 0xffffffff
call fcn.0042dc10
lea edx, [esp + 0x7c]
push edx
mov dword [esp + 0x80], vtable.std::ios_base.0
call fcn.0055177f
add esp, 4
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa8
ret

Function at 0x46b770
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x46b620
push 0
push 0
call fcn.00555225
add esp, 0x18
test eax, eax
je 0x46b792
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x46b7a0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x46b3a0
push 0
push 0
call fcn.00555225
add esp, 0x18
test eax, eax
je 0x46b7c2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x46f270
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x584488
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5cca0c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x30]
push eax
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0
call fcn.00401050
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x48], ecx
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.004010d0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x46f3c0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x5844bb
mov eax, dword fs:[0]
push eax
sub esp, 0x41c
mov eax, dword [0x5cca0c]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push esi
push edi
mov eax, dword [0x5cca0c]
xor eax, esp
push eax
lea eax, [esp + 0x42c]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x2c], ebx
je 0x46f51d
call fcn.0046f2e0
test eax, eax
je 0x46f51d
mov eax, dword [esp + 0x43c]
mov ecx, dword [esi + 0x2c]
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x25], eax
push 0xd
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], 0xd
mov dword [esp + 0x28], ebx
mov byte [esp + 0x2c], 1
mov dword [esp + 0x20], ebx
mov ecx, dword [ecx + 0xc]
push ebx
call ecx
add esp, 0x10
cmp eax, ebx
je 0x46f51d
mov edx, dword [esi + 4]
push 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp edi, ebx
jne 0x46f51d
lea ecx, [esi + 8]
push ecx
lea ecx, [esp + 0x14]
call fcn.00401040
lea ecx, [esp + 0x10]
mov dword [esp + 0x434], ebx
call fcn.00401050
mov edi, dword [esi + 0x20]
cmp edi, ebx
je 0x46f509
mov esi, dword [esi + 0x24]
cmp esi, ebx
jbe 0x46f509
cmp dword [edi], esi
jne 0x46f509
cmp dword [edi + 4], 1
jne 0x46f509
cmp dword [edi], 0x11
jne 0x46f509
push 0x3ff
lea edx, [esp + 0x2d]
push ebx
push edx
mov byte [esp + 0x34], bl
call fcn.00552500
mov eax, dword [edi + 0xd]
mov ecx, dword [edi + 9]
mov edx, dword [edi + 4]
push eax
push ecx
push edx
lea eax, [esp + 0x40]
push 0x598094
push eax
call fcn.00555846
add esp, 0x20
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, dword [edi + 0xd]
lea ecx, [esp + 0x10]
mov dword [esp + 0x434], 0xffffffff
call fcn.004010d0
mov eax, edi
jmp 0x46f520
lea ecx, [esp + 0x10]
mov dword [esp + 0x434], 0xffffffff
call fcn.004010d0
or eax, 0xffffffff
mov ecx, dword [esp + 0x42c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00552d63
add esp, 0x428
ret 4
Function at 0x470810
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x584588
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5cca0c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esp + 0x14], eax
mov dword [esi], vtable.CDialogUIViewBase_class_CDlgRepair__class_WTL::CMemDlgTemplate__class_ATL::CDialogImpl_class_CDlgRepair__class_ATL::CWindow__.0
mov byte [esi + 0x30], al
mov byte [esi + 0x31], al
call fcn.004a1350
mov dword [esi + 0x2c], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x471030
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
test edi, edi
mov ebx, ecx
mov eax, 1
jle 0x47108a
push ebp
mov ebp, dword [esp + 0x1c]
lea esp, [esp]
test eax, eax
jle 0x471072
mov ecx, dword [esp + 0x14]
push ebp
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebx + 4]
lea edx, [esi + ecx]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
add esi, eax
cmp esi, edi
jl 0x471050
cmp eax, 0xffffffff
pop ebp
jne 0x47108a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
mov dword [ebx + 0x1c], eax
pop esi
or eax, 0xffffffff
pop ebx
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
ret 0xc

Function at 0x4710a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
test esi, esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0
jle 0x4710e0
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
nop
mov eax, dword [edi + 4]
push ebx
push esi
push ebp
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x4710ec
mov ecx, dword [esp + 0x10]
add ecx, eax
cmp ecx, esi
mov dword [esp + 0x10], ecx
jl 0x4710c0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi + 0x1c], eax
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 0xc
Function at 0x471210
Capabilities:
Connect socket
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push ebx
push esi
mov esi, ecx
je 0x4712a1
mov ebx, dword [esp + 0x10]
test bx, bx
je 0x4712a1
push edi
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
jne 0x471249
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
mov dword [esi + 0x1c], eax
pop esi
or eax, 0xffffffff
pop ebx
ret 0xc
push ebx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 0xc], ax
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx]
mov ecx, dword [edx]
mov dx, word [esp + 0x18]
mov dword [esi + 8], ecx
lea ecx, [esi + 0x820]
push 0x10
mov word [esi + 0x822], ax
mov eax, dword [esi + 4]
mov word [ecx], dx
mov edx, dword [esi + 8]
push ecx
push eax
mov dword [esi + 0x824], edx
call dword [sym.imp.WS2_32.dll_connect]
mov edi, eax
cmp edi, 0xffffffff
jne 0x471299
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x1c], eax
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
mov eax, 0x598258
lea edx, [esi + 0x20]
sub edx, eax
jmp 0x4712b0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4712b0
pop esi
or eax, 0xffffffff
pop ebx
ret 0xc

Function at 0x471640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x584650
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x5cca0c]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.004b6770
push 0
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x4c], 0
call fcn.004b6790
push eax
mov ecx, esi
mov byte [esp + 0x48], 1
call fcn.004b6940
lea ecx, [esp + 0xc]
mov byte [esp + 0x44], 0
call fcn.004b6820
mov dword [esi + 0x30], 0
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x40
ret
Function at 0x471aa0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x128
mov eax, dword [0x5cca0c]
xor eax, esp
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0x12c]
mov ecx, dword [esp + 0x130]
mov dx, word [esp + 0x134]
push ebx
push esi
push 6
mov ebx, 1
push ebx
push 2
mov dword [esp + 0x18], eax
mov word [esp + 0x128], 2
mov dword [esp + 0x12c], ecx
mov word [esp + 0x12a], dx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x471b21
lea eax, [esp + 8]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x14], ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x471b28
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor al, al
jmp 0x471bcd
push ebp
push edi
mov edi, dword [sym.imp.WINMM.dll_timeGetTime]
call edi
push 0x10
lea ecx, [esp + 0x128]
push ecx
push esi
mov ebp, eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x471b62
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x471b62
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor al, al
jmp 0x471bcb
mov ecx, dword [esp + 0x148]
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov dword [esp + 0x18], edx
imul edx, edx, 0x3e8
sub ecx, edx
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x28]
push eax
push 0
mov dword [esp + 0x30], ebx
push 0
mov dword [esp + 0x38], esi
mov dword [esp + 0x30], ecx
xor bl, bl
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x471bc2
lea ecx, [esp + 0x20]
push ecx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x471bc2
call edi
mov edx, dword [esp + 0x14]
sub eax, ebp
mov dword [edx], eax
mov bl, 1
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov al, bl
pop edi
pop ebp
mov ecx, dword [esp + 0x12c]
pop esi
pop ebx
xor ecx, esp
call fcn.00552d63
add esp, 0x128
ret 0x10

Function at 0x473f30
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x14
mov eax, dword [0x5cca0c]
xor eax, esp
mov dword [esp + 0x10], eax
cmp dword [esp + 0x30], 0x10
mov eax, dword [esp + 0x1c]
jae 0x473f4d
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x473f97
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ecx
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00552de0
add esp, 0xc
cmp dword [esp + 0x30], 0x10
jb 0x473f84
mov edx, dword [esp + 0x1c]
push edx
call fcn.0055215c
add esp, 4
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00552d63
add esp, 0x14
ret
cmp dword [esp + 0x30], 0x10
jb 0x473fab
mov eax, dword [esp + 0x1c]
push eax
call fcn.0055215c
add esp, 4
mov ecx, dword [esp + 0x10]
xor ecx, esp
xor eax, eax
call fcn.00552d63
add esp, 0x14
ret
Function at 0x475810
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x584a51
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x5cca0c]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x5cca0c]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x5c]
xor ebx, ebx
mov edi, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [edi + 0x30]
mov eax, 0x10624dd3
mul ecx
shr edx, 6
xor ecx, ecx
mov eax, edx
add eax, dword [edi + 8]
adc ecx, dword [edi + 0xc]
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.004b6790
lea ecx, [esp + 0x18]
mov dword [esp + 0x54], 1
call fcn.004b6c70
mov ecx, eax
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
lea edi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x4758a0
sub ecx, edi
push ecx
push eax
mov ecx, esi
call fcn.0040c1c0
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 1
mov byte [esp + 0x54], bl
call fcn.004b6820
mov eax, esi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00552d63
add esp, 0x48
ret 4
Function at 0x4808c0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
mov esi, ecx
push esi
push 0x4807c0
push 0
push 0
mov dword [esp + 0x1c], 0
call fcn.00555225
add esp, 0x18
test eax, eax
mov dword [esi + 0x184], eax
pop esi
jne 0x4808f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ecx
ret

Function at 0x480cd0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0xffffffffffffffff
push 0x585778
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5cca0c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
push 0
push 3
push 4
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
lea ebx, [esi + 0xc]
push ebx
push 0x5a3654
push 1
push 0
push 0x5a3724
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x480da5
push 0x5987d8
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
test edi, edi
mov dword [esp + 0x10], edi
jne 0x480d49
push 0x8007000e
call fcn.00401200
mov eax, dword [ebx]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
add esi, 8
push esi
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push eax
mov dword [esp + 0x40], 0
call edx
push edi
mov ebx, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test ebx, ebx
jge 0x480d8e
mov eax, ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov eax, dword [esi]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x48fa70
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x5ce6c8]
push esi
push eax
push 0x488550
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, eax
mov eax, 0x5ce290
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48fa90
sub eax, edx
sar eax, 1
push eax
push 0x5ce290
call fcn.0044a130
mov ecx, eax
call fcn.004ec4c0
mov eax, 0x5ce290
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48fac0
sub eax, edx
sar eax, 1
push eax
push 0x5ce290
call fcn.00444df0
mov ecx, eax
call fcn.0043be10
mov eax, esi
pop esi
ret

Function at 0x48fb00
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x5ce6c8]
push esi
push 0x83
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0
push 0
push 0
push 0x48faf0
push 0
push 0
mov esi, eax
call fcn.00555225
add esp, 0x18
test eax, eax
je 0x48fb3e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
ret
call fcn.0048fa70
mov eax, esi
pop esi
ret
Function at 0x491490
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x5cca0c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
push ebx
push esi
push edi
add eax, 1
mov ebx, edx
push 0x5ceca6
push eax
mov si, cx
mov dword [ebp - 0xc], ebx
call fcn.005553ae
mov edi, eax
add esp, 8
test edi, edi
je 0x4915cb
push 0x40
lea ecx, [ebp - 0x5c]
push 0
push ecx
call fcn.00552500
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp dword [ebp + 0x20], 0x10
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
mov word [ebp - 0x30], si
jae 0x4914f7
lea eax, [ebp + 0xc]
mov edx, dword [ebp + 0x1c]
push edx
push eax
push edi
call fcn.00552de0
mov eax, dword [ebp + 0x1c]
add esp, 0xc
test ebx, ebx
mov byte [eax + edi], 0
je 0x491515
mov dword [ebp - 8], ebx
jmp 0x49151b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
add ebx, 1
cmp ebx, 0x3fffffff
jle 0x491533
xor eax, eax
jmp 0x49154a
lea eax, [ebx + ebx]
call fcn.00553150
mov eax, esp
push 0x3a8
push ebx
push edi
push eax
call fcn.00401140
mov edx, dword [ebp - 8]
push edx
neg si
lea ecx, [ebp - 0x60]
push ecx
push 0
push 0
sbb esi, esi
and esi, 0xf8000000
add esi, 0x8000000
push esi
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push edi
mov esi, eax
call fcn.0055221b
add esp, 4
test esi, esi
je 0x4915a0
cmp dword [ebp - 0xc], 0
jne 0x49159e
mov edx, dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [ebp - 0x1c]
push eax
call edi
test esi, esi
setne bl
cmp dword [ebp + 0x20], 0x10
jb 0x4915b5
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0055215c
add esp, 4
mov al, bl
lea esp, [ebp - 0x6c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00552d63
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x20], 0x10
jb 0x4915dd
mov edx, dword [ebp + 0xc]
push edx
call fcn.0055215c
add esp, 4
xor al, al
lea esp, [ebp - 0x6c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00552d63
mov esp, ebp
pop ebp
ret
Function at 0x492810
Capabilities:
Create thread
Resume thread

Disassembly:
call fcn.00453ee0
cmp dword [eax], 1
je 0x492879
cmp dword [0x5ce4ac], 0
jne 0x492879
push 0
push 4
push 0
push 0x492120
push 0
push 0
call fcn.00555225
add esp, 0x18
test eax, eax
mov dword [0x5ce4ac], eax
je 0x492879
mov dword [0x5ce4a8], 1
call fcn.00453ee0
mov ecx, eax
call fcn.004916e0
push 1
call fcn.00453ee0
mov ecx, eax
call fcn.004906e0
mov eax, dword [0x5ce4ac]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
ret
xor eax, eax
ret

Function at 0x492920
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push 0x1c
xor bl, bl
call fcn.0055289e
add esp, 4
test eax, eax
je 0x492955
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax], 1
mov dword [eax + 4], 0x1c
mov esi, eax
jmp 0x492957
xor esi, esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push 0
push 0
push esi
push 0x4928d0
mov dword [esi + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x28]
push 0
push 0
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
call fcn.00555225
mov edi, eax
add esp, 0x18
test edi, edi
je 0x4929b5
cmp byte [esp + 0x24], 0
mov bl, 1
je 0x4929a8
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
ret
push esi
call fcn.0055215c
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x4948d0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
add eax, 0xffffffff
cmp eax, 5
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], 1
mov dword [esp + 8], 0x1c
mov dword [esp + 0x14], 0x492de0
mov dword [esp + 0x18], fcn.00492ac0
mov dword [esp + 0xc], 0x493fd0
mov dword [esp + 0x10], 0x4940a0
mov dword [esp + 0x1c], 0x493080
ja case.default.0x494922
jmp dword [eax*4 + 0x494a3c]
mov eax, dword [0x5ce6d8]
push str.xunyou_open_url_with_key
push eax
call esi
test eax, eax
je case.default.0x494922
lea ecx, [esp + 4]
push ecx
push 0
push 0
push str.charge_url1
jmp 0x494a00
mov edx, dword [0x5ce6d8]
push str.xunyou_open_url_with_key
push edx
call esi
test eax, eax
je case.default.0x494922
lea ecx, [esp + 4]
push ecx
push 0
push 0
push str.charge_url2
jmp 0x494a00
mov edx, dword [0x5ce6d8]
push str.xunyou_open_url_with_key
push edx
call esi
test eax, eax
je case.default.0x494922
lea ecx, [esp + 4]
push ecx
push 0
push 0
push str.charge_url3
jmp 0x494a00
mov edx, dword [0x5ce6d8]
push str.xunyou_open_url_with_key
push edx
call esi
test eax, eax
je case.default.0x494922
lea ecx, [esp + 4]
push ecx
push 0
push 0
push str.charge_url4
jmp 0x494a00
mov edx, dword [0x5ce6d8]
push str.xunyou_open_url_with_key
push edx
call esi
test eax, eax
je case.default.0x494922
lea ecx, [esp + 4]
push ecx
push 0
push 0
push str.charge_url5
jmp 0x494a00
mov edx, dword [0x5ce6d8]
push str.xunyou_open_url_with_key
push edx
call esi
test eax, eax
je case.default.0x494922
lea ecx, [esp + 4]
push ecx
push 0
push 0
push str.charge_url6
call eax
test eax, eax
je 0x494a35
mov edx, dword [0x5ce6d8]
push str.xunyou_open_url_with_key
push edx
call esi
test eax, eax
je 0x494a30
lea ecx, [esp + 4]
push ecx
push 0
push str.http:__my.xunyou.com_jump.php_action4xyarg_2
push str.charge_url
call eax
pop esi
add esp, 0x1c
ret
mov eax, 5
pop esi
add esp, 0x1c
ret

Function at 0x4950b0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret 0x10

Function at 0x495420
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret 0x10