joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b36b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.00487690
mov dword [esp], 0xc8
mov dword [esp + 4], 0x96
push dword [0xa62a24]
call fcn.0046b7d7
mov ebx, eax
push dword [0xa62a24]
call fcn.0046bbe7
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 8], ebx
push dword [0xa62a24]
call fcn.0046b846
mov ebx, eax
push dword [0xa62a24]
call fcn.0046c065
mov edi, eax
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
add ebx, edi
mov edi, dword [esp + 4]
mov eax, edi
mov ecx, 2
cdq
idiv ecx
mov edi, eax
sub ebx, edi
mov dword [esp + 0xc], ebx
push reloc.WS2_32.dll_connect
push dword [0xa6277c]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0
call fcn.0046bbf5
push 0xa
call fcn.0047d1d9
push eax
push 0x1a
push 0xaa
push 0xf
push 0xf
push 6
call fcn.004667a7
push 8
call fcn.0047d1d9
push eax
push 0x1a
push 0xaa
push 0x2d
push 0xf
push 4
call fcn.004667a7
push 9
call fcn.0047d1d9
push eax
push 0x1a
push 0xaa
push 0x4b
push 0xf
push 5
call fcn.004667a7
push dword [0xa62a08]
push 0x14
push 0xaa
push 0x78
push 0xf
push 7
call fcn.0046504d
call fcn.0042c354
call fcn.0046bae6
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x41b551
call fcn.0046f044
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x41b54e
push dword [esp + 0x20]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x41b54d
call fcn.0046f026
push eax
mov ebx, 6
cmp ebx, dword [esp]
jne 0x41b51b
mov eax, str.https:__msfree.su_donates.html
push eax
call fcn.0045f235
add esp, 0xc
jmp 0x41b5a6
mov ebx, 4
cmp ebx, dword [esp]
jne 0x41b52c
add esp, 0xc
jmp 0x41b5a6
mov ebx, 5
cmp ebx, dword [esp]
jne 0x41b53d
add esp, 0xc
jmp 0x41b5a6
mov ebx, 7
cmp ebx, dword [esp]
jne 0x41b54c
add esp, 0xc
jmp 0x41b5a6
pop eax
pop eax
pop eax
jmp 0x41b55b
push 0
call fcn.0046c073
push 0x1b
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x41b57e
call fcn.0046c091
mov ebx, eax
and ebx, ebx
jne 0x41b57e
call fcn.0042c354
jmp 0x41b5a6
push 0xd
call sub.USER32.dll_GetKeyState
mov ebx, eax
cmp ebx, 1
jle 0x41b5a1
call fcn.0046c091
mov ebx, eax
and ebx, ebx
jne 0x41b5a1
call fcn.0042c354
jmp 0x41b5a6
jmp 0x41b4cb
push 0
call fcn.0046b487
xor eax, eax
add esp, 0x10
pop edi
pop ebx
ret 4
Function at 0x4287c2
Capabilities:
Hide graphical window

Disassembly:
push ebx
call fcn.00487690
push dword [esp + 8]
call fcn.0046b5d3
and eax, eax
je 0x4288b3
mov ebx, dword [esp + 8]
cmp ebx, dword [0xa62a24]
jne 0x428846
push dword [0xa62a28]
call fcn.0046b5d3
and eax, eax
je 0x428804
push 1
push dword [0xa62a28]
call fcn.0046b933
push 0
push dword [0xa62a24]
call fcn.0046b933
push 9
push dword [0xa62a24]
call fcn.0046b5e5
push eax
call sub.USER32.dll_ShowWindow
push dword [0xa62a24]
call fcn.0046b5e5
push eax
call sub.USER32.dll_SetForegroundWindow
push dword [0xa62a24]
call fcn.0046c073
mov ebx, dword [esp + 8]
cmp ebx, dword [0xa62a28]
jne 0x4288b3
push dword [0xa62a24]
call fcn.0046b5d3
and eax, eax
je 0x428871
push 1
push dword [0xa62a24]
call fcn.0046b933
push 0
push dword [0xa62a28]
call fcn.0046b933
push 9
push dword [0xa62a28]
call fcn.0046b5e5
push eax
call sub.USER32.dll_ShowWindow
push dword [0xa62a28]
call fcn.0046b5e5
push eax
call sub.USER32.dll_SetForegroundWindow
push dword [0xa62a28]
call fcn.0046c073
xor eax, eax
pop ebx
ret 4
Function at 0x43dd62
Capabilities:
Query service status

Disassembly:
push ebp
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x43dd68
call fcn.00487690
mov edx, dword [esp + 0x30]
lea ecx, [esp]
call fcn.00442000
lea eax, [esp + 4]
push 0xf003f
push 0
push 0
call sub.ADVAPI32.dll_OpenSCManagerW
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 0
je 0x43ddef
push 0xf01ff
push dword [esp + 4]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_OpenServiceW
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 0
je 0x43dddd
lea eax, [esp + 4]
push eax
push dword [esp + 0x28]
call sub.ADVAPI32.dll_QueryServiceStatus
push dword [esp + 0x24]
call sub.ADVAPI32.dll_CloseServiceHandle
push dword [esp + 0x20]
call sub.ADVAPI32.dll_CloseServiceHandle
lea ebp, [esp + 4]
mov eax, dword [ebp + 4]
jmp 0x43ddf1
xor eax, eax
push dword [esp]
call fcn.004876f0
add esp, 0x28
pop ebp
ret 4
Function at 0x43eed1
Capabilities:
Terminate process

Disassembly:
push ebx
xor eax, eax
push eax
push eax
call fcn.00487690
push dword [esp + 0x10]
push 0
push 1
call sub.KERNEL32.dll_OpenProcess
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, ebx
je 0x43ef1a
push 1
push dword [esp + 4]
call sub.KERNEL32.dll_TerminateProcess
and eax, eax
je 0x43ef12
mov dword [esp + 4], 1
push dword [esp]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [esp + 4]
jmp 0x43ef22
add esp, 8
pop ebx
ret 4

Function at 0x441136
Capabilities:
Get graphical window text

Disassembly:
push ebx
xor eax, eax
push eax
call fcn.00487690
push dword [esp + 0xc]
call fcn.004426d0
mov ebx, dword [0xa6307c]
and ebx, ebx
jne 0x441172
push 0
push 0
call sub.USER32.dll_FindWindowW
mov dword [0xa63080], eax
mov dword [0xa6307c], 1
jmp 0x441187
push 2
push dword [0xa63080]
call sub.USER32.dll_GetWindow
mov dword [0xa63080], eax
mov ebx, dword [0xa63080]
and ebx, ebx
je 0x441221
push 0xfffffff0
push dword [0xa63080]
call sub.USER32.dll_GetWindowLongW
mov ebx, eax
and ebx, 0x10000000
cmp ebx, 0x10000000
jne 0x44121f
push 0xffffffec
push dword [0xa63080]
call sub.USER32.dll_GetWindowLongW
mov ebx, eax
and ebx, 0x80
cmp ebx, 0x80
je 0x44121f
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.004874f0
pop edx
push eax
push 0x100
call fcn.00484bf0
lea eax, [esp + 4]
push eax
call fcn.00487590
push 0x100
push dword [esp + 4]
push dword [0xa63080]
call sub.USER32.dll_GetWindowTextW
push dword [esp]
mov edx, 0x55a098
pop ecx
call fcn.00442660
jne 0x44121f
jmp 0x441239
jmp 0x44122b
mov dword [0xa6307c], 0
mov ebx, dword [0xa63080]
and ebx, ebx
jne 0x441148
mov edx, dword [esp]
push edx
call fcn.004874f0
pop edx
push eax
push edx
call fcn.00487530
pop eax
push eax
call fcn.004426a0
pop edx
add eax, edx
jmp 0x441260
push dword [esp]
call fcn.004876f0
add esp, 4
pop ebx
ret

Function at 0x4432a1
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x443339
push edi
push 0xa64ab4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0xa63198]
test edi, edi
je 0x44330d
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x443306
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0xa63198
call fcn.004873d6
pop ecx
pop ecx
jmp 0x443308
mov edi, dword [edi]
test edi, edi
jne 0x4432dd
pop ebx
mov eax, dword [0xa5ce64]
mov esi, eax
inc eax
push 0x10
push 0xa63198
mov dword [0xa5ce64], eax
call fcn.00487416
pop ecx
pop ecx
push 0xa64ab4
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x443341
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push edi
call fcn.00443255
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, 0xa64ab4
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0xa63198]
jmp 0x443372
cmp dword [esi + 0xc], edi
je 0x443378
mov esi, dword [esi]
test esi, esi
jne 0x44336b
jmp 0x443390
add esi, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0xa63198
call fcn.004873d6
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret 4

Function at 0x44471f
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x444774
push dword [esp + 0x10]
push 0x44469e
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0xa63200]
test esi, esi
je 0x4447cd
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x44476c
cmp byte [esi + 0x10], 0
je 0x44476c
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x444748
jmp 0x4447cd
mov esi, dword [0xa63200]
test esi, esi
je 0x4447cd
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x4447c6
cmp byte [esi + 0x11], 0
je 0x4447a2
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x4447b9
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0xa63200
call fcn.004873d6
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x444781
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x45eb12
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0xa64e10]
call fcn.00486a99
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x45ec12
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x45eb68
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x45eb60
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x45eba8
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x45ebea
push 0x22
pop edx
cmp cx, dx
je 0x45eb9a
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x45eb8a
xor ecx, ecx
cmp word [eax], cx
je 0x45ebea
mov ecx, eax
add eax, 2
jmp 0x45ebec
test dx, dx
je 0x45ebf2
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x45eb9a
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x45ebe0
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x45ebea
cmp cx, dx
je 0x45ebdd
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x45ebcd
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x45ebb2
jmp 0x45eb9a
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x45ebf4
xor edx, edx
cmp dword [ebp], ebx
jne 0x45ebfd
test edi, edi
jne 0x45ec1a
test edx, edx
je 0x45ec02
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x45eb56
test edi, edi
jne 0x45ec2b
mov eax, ebx
jmp 0x45ec2f
test esi, esi
je 0x45ec2b
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x45ec2f
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x45f37a
Capabilities:
Read file on windows

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0x10], esi
jle 0x45f3ce
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push 0
push eax
mov eax, dword [esp + 0x20]
sub eax, esi
push eax
lea eax, [esi + ebp]
push eax
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x45f3bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x45f3c8
add esi, dword [esp + 0x10]
cmp esi, dword [esp + 0x18]
jl 0x45f38d
jmp 0x45f3cc
add esi, dword [esp + 0x10]
pop ebp
pop ebx
mov eax, esi
pop esi
ret 0xc

Function at 0x45f448
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebx, eax
cmp dword [esp + 0x24], 0x18
je 0x45f4f7
cmp dword [esp + 0x24], 2
je 0x45f4f7
push 0x2000
push edi
push dword [0xa6256c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
jmp 0x45f4ca
cmp dword [esp + 0x18], 2
jne 0x45f4e2
test ebx, ebx
jne 0x45f4b3
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0xa6256c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x45f4e2
cmp ax, 0xd
je 0x45f4ca
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call ebp
test eax, eax
jne 0x45f48a
push dword [esp + 0x28]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.00522150
jmp 0x45f57d
push eax
push 0
push dword [0xa6256c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
jmp 0x45f549
cmp dword [esp + 0x18], 1
jne 0x45f561
test ebx, ebx
jne 0x45f538
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0xa6256c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x45f561
cmp al, 0xd
je 0x45f549
mov byte [esi + edi], al
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call ebp
test eax, eax
jne 0x45f510
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x28]
mov byte [esi + edi], 0
push esi
jne 0x45f578
call fcn.005221a0
jmp 0x45f57d
call fcn.005220f0
push esi
push 0
push dword [0xa6256c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x4607d7
Capabilities:
Delete file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
test esi, esi
je 0x460839
cmp word [esi], di
je 0x460839
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.0049bac0
push dword [esp + 0x1c]
mov ebx, eax
push ebx
call dword [esp + 0x20]
push esi
push ebx
call fcn.0049bd70
add esp, 0x10
test eax, eax
jne 0x460838
push 0x24
push 8
push dword [0xa6256c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword [esp + 0x10]
mov dword [ecx + 0x14], edi
mov edi, ecx
mov dword [ecx], ebx
mov dword [ecx + 8], 1
mov dword [ecx + 0x20], eax
mov dword [eax + 4], ecx
pop ebx
mov eax, edi
pop edi
pop esi
ret 0x10

Function at 0x4611d0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0xa63424], 0
jne 0x4611de
call fcn.00461150
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0xa63428]
call esi
test eax, eax
jne 0x461201
call fcn.00461150
push dword [0xa63428]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x461210
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x461270
mov ebx, 0x10
test edi, edi
jns 0x461279
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x461242
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x461290
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0xa63424], 0
jne 0x46129e
call fcn.00461150
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0xa63428]
call esi
mov edx, eax
test edx, edx
jne 0x4612c5
call fcn.00461150
push dword [0xa63428]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x4612f8
mov ebx, 0x10
test esi, esi
jns 0x461301
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x461310
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x462ea5
Capabilities:
Create thread
Reference http user-agent string

Disassembly:
push edi
xor edi, edi
cmp dword [esp + 0xc], edi
je 0x462f92
push ebx
push ebp
push esi
push 0x60
push 8
push dword [0xa6256c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [esp + 0x18]
mov esi, eax
xor ebp, ebp
inc ebp
or dword [esi + 4], 0xffffffff
mov dword [esi], ebp
call sub.MSVCRT.dll__wcsdup
mov dword [esi + 8], eax
mov dword [esp], str.Mozilla_5.0_Gecko_41.0_Firefox_41.0
call sub.MSVCRT.dll__wcsdup
mov ebx, dword [esp + 0x24]
pop ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x40], eax
mov dword [esi + 0x24], ecx
mov eax, dword [0xa5cf10]
mov dword [esi + 0x28], eax
mov eax, dword [0xa63488]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x54], ebx
mov dword [esi + 0x4c], eax
test cl, 1
je 0x462f7f
test ebx, ebx
je 0x462f49
push ebx
push edi
push dword [0xa6256c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x48], eax
test eax, eax
je 0x462f44
push ebx
push dword [esp + 0x20]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
cmp dword [esi + 0x48], edi
je 0x462f76
lea eax, [esp + 0x18]
push eax
push edi
push esi
push 0x462f98
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x462f6e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x462f72
mov ebp, dword [esp + 0x18]
test ebp, ebp
jne 0x462f8d
push esi
call fcn.00462a0b
pop ecx
jmp 0x462f8f
mov eax, dword [esp + 0x1c]
push esi
mov dword [esi + 0x48], eax
call fcn.00462a9c
pop ecx
mov edi, esi
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
ret 0x18

Function at 0x463164
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push 0x4630b3
push 0x10
push 0x2c
call fcn.00486d7a
push 0
push 0
push 8
mov dword [0xa63494], eax
call fcn.00486b04
cmp word [0xa6348c], 0
mov dword [0xa64e88], eax
jne 0x463249
push edi
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
inc edi
test eax, eax
jne 0x4631bc
mov word [0xa6348c], di
jmp 0x4631c4
xor eax, eax
mov word [0xa6348c], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0xa634a8], eax
test eax, eax
je 0x463248
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x53b378
push eax
call esi
push 0x53b384
push dword [0xa634a8]
mov dword [0xa63498], eax
call esi
push str.getnameinfo
push dword [0xa634a8]
mov dword [0xa6349c], eax
call esi
push str.WSAStringToAddressA
push dword [0xa634a8]
mov dword [0xa634a0], eax
call esi
cmp dword [0xa63498], 0
mov dword [0xa634a4], eax
pop esi
je 0x463248
cmp dword [0xa6349c], 0
je 0x463248
cmp dword [0xa634a0], 0
je 0x463248
test eax, eax
je 0x463248
mov dword [0xa63490], edi
pop edi
add esp, 0x190
ret
Function at 0x463cb0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0xa64aac]
call fcn.00486ca7
mov ebx, eax
test ebx, ebx
je 0x463d14
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x463cd9
push dword [esp + 0xc]
push ebx
call eax
jmp 0x463d14
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.00487950
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.00487cd0
pop edi
pop esi
pop ebx
ret 8

Function at 0x464a70
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push 0
push 0
push 0x1304
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x464ae2
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
cmp ebx, 0xffffffff
jne 0x464a99
mov ebx, eax
push dword [ebp]
call fcn.0046423c
push ebx
push dword [ebp]
mov edi, eax
call fcn.00464213
add esp, 0xc
mov esi, eax
push 0
push ebx
push 0x130c
push dword [ebp]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
push dword [ebp]
call fcn.00464b02
pop ecx
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4665e6
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
push edi
push dword [0xa64e94]
call fcn.00486a99
xor ebp, ebp
mov esi, eax
cmp dword [0xa63830], ebp
jne 0x4666c2
xor ebx, ebx
inc ebx
mov dword [0xa63830], ebx
call fcn.0046acfa
mov edi, 0xa4
push edi
push ebp
push 0xa63838
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [0xa63838], 0x13
lea eax, [esp + 0x10]
mov dword [0xa6383c], edi
mov dword [0xa63848], 0x466531
mov dword [0xa6384c], 0x46687c
push eax
mov dword [0xa638a0], 0x46650c
mov dword [0xa638a4], 0x4667c7
mov dword [0xa63844], 0x4664e7
mov dword [0xa638c8], 0x46654c
mov dword [0xa638dc], ebx
mov dword [esp + 0x14], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4666c2
cmp dword [esp + 0x20], ebx
je 0x4666aa
cmp dword [esp + 0x20], 2
jne 0x4666c2
cmp dword [esp + 0x14], 5
jae 0x4666b2
mov dword [0xa638dc], ebp
jmp 0x4666c2
jne 0x4666c2
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
and dword [0xa638dc], eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.0046fe7d
mov eax, dword [esp + 0x140]
push ebp
push dword [0xa62570]
or eax, 0x50010000
push 0xffffffffffffffff
push dword [esi]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push dword [esp + 0x148]
push eax
push ebp
push str.BUTTON
push ebp
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x466798
push dword [esp + 0x128]
push dword [0xa64aac]
call fcn.00486ce6
mov edi, dword [esp + 0x13c]
mov esi, eax
mov dword [esi + 0x10], edi
test edi, edi
je 0x466767
push edi
call fcn.0047f369
test eax, eax
je 0x466767
push ebp
push ebp
push edi
call fcn.0047eede
mov dword [esi + 0x18], eax
jmp 0x46676a
mov dword [esi + 0x18], ebp
push 0x466236
push 0xfffffffffffffffc
push ebx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x1c], ebp
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0xa63838
push ebx
push esi
push dword [esp + 0x134]
mov dword [0xa63834], eax
call fcn.0046aec8
mov ebx, eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x114
ret 0x1c