joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c010
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4a5641
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ed3dc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2c]
xor ebx, ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], fcn.0046ef1b
mov dword [edi + 0x2c], fcn.0046ec38
mov dword [edi + 0x30], fcn.0046f0cc
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 4], ebx
mov dword [edi + 0x34], ebx
mov dword [esp + 0x24], ebx
lea esi, [edi + 0x38]
mov dword [edi], vtable.t_layoutGrid.0
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
lea ebp, [edi + 0x68]
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
mov byte [esp + 0x24], 6
call fcn.0040e470
mov dword [edi + 0x9c], eax
mov byte [eax + 0x21], 1
mov eax, dword [edi + 0x9c]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x9c]
mov dword [eax], eax
mov eax, dword [edi + 0x9c]
mov dword [eax + 8], eax
mov dword [edi + 0xa0], ebx
push 1
mov byte [esp + 0x28], 7
call fcn.00414ae0
push 1
mov esi, ebp
call fcn.00414ae0
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x40cc00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a4ac8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push ebp
push edi
mov eax, dword [0x4ed3dc]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edi, dword [esi + 8]
mov ebp, dword [esi + 0xc]
sub edi, dword [esi]
sub ebp, dword [esi + 4]
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 0x5c]
mov edx, dword [esp + 0x58]
push ebp
push edi
push eax
lea ecx, [esp + 0x34]
push ecx
push edx
mov dword [esp + 0x64], ebx
call fcn.0040ca50
test al, al
je 0x40ccc8
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x58]
cmp byte [eax + 0xec], bl
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebp
jne 0x40cc9e
mov eax, dword [eax + 0xb0]
jmp 0x40cca4
mov eax, dword [eax + 0xb4]
push 2
lea edx, [esp + 0x38]
push edx
mov edx, dword [esp + 0x30]
push ebx
lea ecx, [esp + 0x1c]
push ecx
push edx
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x38]
push edx
push ebx
push eax
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x40ccf6
mov ecx, dword [esp + 0x30]
push ecx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x40cceb
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x44
ret 8
Function at 0x40ce70
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
cmp ebx, dword [edi + 0x140]
jne 0x40cea7
mov eax, dword [ebp + 0x10]
cmp eax, dword [edi + 0x144]
jne 0x40cea7
mov edx, dword [edi]
mov eax, dword [edx + 0x80]
push 1
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
or eax, 0xffffffff
cmp byte [edi + 0xb8], 0
mov dword [edi + 0x144], eax
mov dword [edi + 0x140], eax
jne 0x40cfb8
xor esi, esi
cmp dword [edi + 8], esi
jle 0x40cee8
mov ecx, dword [edi + 4]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ecx + esi*4]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
push eax
mov eax, dword [ebp + 8]
push ebx
push eax
call edx
add esi, 1
cmp esi, dword [edi + 8]
jl 0x40ceca
cmp dword [edi + 0xbc], 1
je 0x40d027
mov ecx, dword [ebp + 0x10]
mov eax, dword [edi]
mov edx, dword [eax + 0x60]
push ecx
push ebx
mov ecx, edi
call edx
test eax, eax
je 0x40cf98
cmp byte [edi + 0x34], 0
jne 0x40cf1e
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
mov byte [edi + 0x34], 1
call edx
cmp byte [0x4f20d5], 0
jne 0x40d027
push ebx
mov ebx, dword [ebp + 0x10]
call fcn.00411bf0
test eax, eax
jge 0x40cf7b
cmp byte [edi + 0xb8], 0
je 0x40cf5e
push 0x7f86
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp byte [edi + 0x34], 0
je 0x40d027
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
mov byte [edi + 0x34], 0
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0xbc]
test al, 2
je 0x40cfd1
lea esi, [edi + 0xc8]
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x40cfec
test al, 1
je 0x40d027
lea esi, [edi + 0xc8]
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
mov dword [edi + 0xbc], 2
cmp byte [edi + 0x7c], 0
je 0x40d000
mov ecx, dword [edi + 0x2c]
mov eax, dword [edi + 0x30]
sub ecx, dword [edi + 0x24]
sub eax, dword [edi + 0x28]
jmp 0x40d004
xor eax, eax
xor ecx, ecx
mov edx, dword [edi]
mov edx, dword [edx + 0x50]
push 1
push eax
mov eax, dword [edi + 0xcc]
sub eax, dword [edi + 0xc4]
push ecx
mov ecx, dword [esi]
sub ecx, dword [edi + 0xc0]
push eax
push ecx
mov ecx, edi
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40d280
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x5c
push ebx
xor eax, eax
xor ecx, ecx
test edx, edx
push edi
je 0x40d292
mov eax, dword [edx]
mov ecx, dword [edx + 4]
push 2
push ecx
push eax
call dword [sym.imp.USER32.dll_MonitorFromPoint]
lea ecx, [esp + 0x38]
push ecx
push eax
mov dword [esp + 0x40], 0x28
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x40d2d5
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
mov dword [esi], edx
mov edx, dword [esp + 0x58]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
pop edi
pop ebx
add esp, 0x5c
ret
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
push 1
mov ebx, eax
call edi
xor edx, edx
xor ecx, ecx
mov dword [esi], ecx
mov dword [esi + 4], edx
push edx
mov dword [esi + 8], ebx
push 0x4d9638
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
mov dword [esi + 0xc], eax
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x40d346
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.USER32.dll_IntersectRect]
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_SubtractRect]
pop edi
pop ebx
add esp, 0x5c
ret
Function at 0x40d530
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x40d694
cmp byte [esi + 0xf4], 0
mov byte [esi + 0xd2], 1
je 0x40d5af
mov eax, esi
call fcn.0040c980
cmp byte [0x4f20d6], 0
je 0x40d58a
mov eax, dword [esi + 0xb0]
push 0x5b
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0xb0]
push 0x25f
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0x70]
test ecx, ecx
jne 0x40d5c4
mov edi, dword [esi + 0x24]
mov ebx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
jmp 0x40d5d0
mov edi, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 0x10]
sub eax, edi
sub ecx, ebx
cmp byte [esi + 0xec], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
jne 0x40d5ed
mov eax, dword [esi + 0xb0]
jmp 0x40d5f3
mov eax, dword [esi + 0xb4]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x40d61d
cmp byte [esi + 0xec], al
jne 0x40d60e
mov eax, dword [esi + 0xb0]
jmp 0x40d614
mov eax, dword [esi + 0xb4]
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [esi + 0xec], 0
jne 0x40d62e
mov eax, dword [esi + 0xb0]
jmp 0x40d634
mov eax, dword [esi + 0xb4]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0x2714
push edx
push ecx
push ebx
push edi
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push 1
push 0
lea eax, [edi + edx]
mov edx, dword [esi + 0xb0]
mov dword [esi + 0x11c], edi
mov dword [esi + 0x120], ebx
push 0
add ecx, ebx
mov dword [esi + 0x124], eax
push edx
mov dword [esi + 0x128], ecx
call dword [sym.imp.USER32.dll_RedrawWindow]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
mov edx, dword [eax + 0xa0]
push 0
mov byte [esi + 0xd2], 0
mov byte [esi + 0x34], 0
mov byte [esi + 0xd0], 0
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x74]
push 0
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x80]
push 1
mov ecx, esi
call edx
mov ecx, esi
call fcn.004120a0
mov eax, dword [esi + 0xb0]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40fe60
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x22c
mov eax, dword [0x4ed3dc]
xor eax, esp
mov dword [esp + 0x224], eax
push ebp
push edi
xor eax, eax
xor edi, edi
push 0x206
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x26]
push edi
push eax
mov dword [esp + 0x18], edi
mov word [esp + 0x2c], di
call fcn.00470e10
mov edx, dword [esi + 4]
add esp, 0xc
push 0x104
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 4]
push edi
push edi
push 0x31
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 4]
push ecx
mov ebp, eax
call dword [sym.imp.USER32.dll_GetDC]
push ebp
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
push edi
call ebp
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40fee7
sub eax, edx
push 0x400
lea edx, [esp + 0x10]
push edx
sar eax, 1
push eax
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [esp + 0x1c]
push ecx
push edi
call ebp
mov edx, dword [esi + 4]
push edi
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0xc]
mov dword [ebx + 4], ecx
mov ecx, dword [esp + 0x22c]
pop edi
pop ebp
mov dword [ebx], eax
xor ecx, esp
mov eax, ebx
call fcn.0046ec29
add esp, 0x22c
ret
Function at 0x4123d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 0x10], esi
je 0x412551
cmp dword [edi + 0x14], esi
je 0x412551
lea eax, [esp + 0x30]
push eax
push edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
call fcn.00412640
cmp dword [edi + 0x18], 0x5a
jge 0x41241d
mov eax, dword [edi + 0x10]
mov dword [esp + 0x10], eax
jmp 0x412426
mov ecx, dword [edi + 0x14]
mov dword [esp + 0x10], ecx
mov eax, ecx
mov ecx, dword [eax + 0x28]
sub ecx, dword [eax + 0x20]
mov edx, dword [ebp + 8]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
sub edi, dword [esp + 0x30]
sub ebx, dword [esp + 0x34]
mov dword [esp + 0x48], ecx
mov ecx, dword [eax + 0x2c]
sub ecx, dword [eax + 0x24]
mov eax, dword [edx + 4]
push eax
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x60], esi
call dword [sym.imp.USER32.dll_GetDC]
push 0x20
push ebx
push edi
lea esi, [esp + 0x5c]
mov dword [esp + 0x20], eax
call fcn.00410700
add esp, 0xc
test al, al
mov eax, dword [esp + 0x14]
push eax
jne 0x4124ab
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
call fcn.00410810
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0xc]
mov ecx, dword [esp + 0x4c]
mov eax, dword [eax]
push edx
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x58]
push edx
push 0
push 0
push eax
push ebx
push edi
push 0
push 0
push ecx
call dword [sym.imp.MSIMG32.dll_AlphaBlend]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
xor edx, edx
push edx
push ebx
push edi
push ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edx
mov edx, dword [esi + 4]
push eax
push edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], ebx
call dword [sym.imp.USER32.dll_MoveWindow]
mov edx, dword [esp + 0x50]
push 2
lea eax, [esp + 0x60]
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
push edx
mov edx, dword [esi + 4]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x40]
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
mov eax, dword [esi + 4]
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea esi, [esp + 0x50]
call fcn.00410810
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41b310
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a4868
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x4ed3dc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
push 1
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x14], bl
call dword [sym.imp.GDI32.dll_SetBkMode]
mov dword [esp + 0x20], ebx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x30], ebx
mov eax, dword [esi]
mov eax, dword [eax]
push ecx
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call eax
lea esi, [esp + 0xc]
call fcn.0040fff0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41f1f0
Capabilities:
Create directory

Disassembly:
sub esp, 0x244
mov eax, dword [0x4ed3dc]
xor eax, esp
mov dword [esp + 0x23c], eax
push 0x206
lea eax, [esp + 0x36]
push 0
push eax
mov word [esp + 0x3c], 0
call fcn.00470e10
add esp, 0xc
mov ecx, esi
call fcn.00499a60
push eax
lea ecx, [esp + 0x34]
push 0x104
push ecx
call fcn.0046fdc1
lea edx, [esp + 0x3c]
push 0x5c
push edx
call fcn.0046ebf9
add esp, 0x14
test eax, eax
jne 0x41f274
mov ecx, esi
call fcn.00499a40
push eax
push 0x4dbe84
push edi
call fcn.0049d170
add esp, 0xc
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.0046ec29
add esp, 0x244
ret
mov word [eax], 0
lea eax, [esp]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.00474132
add esp, 8
test eax, eax
je 0x41f2e7
push 0
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41f2c7
lea eax, [esp + 0x30]
push eax
push 0x4dbe98
push edi
call fcn.0049d170
add esp, 0xc
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.0046ec29
add esp, 0x244
ret
push 0x10000000
lea ecx, [esp + 0x34]
push 1
push ecx
call fcn.00499460
lea edx, [esp + 0x3c]
push 1
push edx
call fcn.00499710
add esp, 0x14
mov ecx, dword [esp + 0x23c]
xor ecx, esp
mov al, 1
call fcn.0046ec29
add esp, 0x244
ret
Function at 0x41f700
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a53c0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
mov eax, dword [0x4ed3dc]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [esp + 0x30]
push ecx
xor esi, esi
push str.UserManager
mov dword [esp + 0x14], esi
call fcn.00403b00
add esp, 4
mov ecx, eax
call fcn.00467d60
push esi
push esi
push esi
push esi
push esi
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x60], esi
call fcn.0049aa90
lea ecx, [esp + 0x2c]
mov byte [esp + 0x48], 2
call fcn.00499a80
push esi
push esi
push esi
push esi
push esi
push str.env.ini
lea ecx, [esp + 0x34]
call fcn.0049a5c0
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x10]
call fcn.0049aa70
lea ecx, [esp + 0x1c]
call fcn.00499a80
push esi
push esi
push esi
push esi
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.0049aa90
lea ecx, [esp + 0xc]
call fcn.00499a80
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x420610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a5060
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x4ed3dc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push str.UserManager
call fcn.00403b00
add esp, 4
push 0
push 0
push 0
push 0
push 0x4dbef8
add eax, 0x5d8
push eax
lea ecx, [esp + 0x34]
call fcn.0049a5c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0
call fcn.0049be10
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push 0x4d7918
push ecx
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 1
call fcn.0049c020
mov ecx, eax
call fcn.0049c020
mov ecx, eax
call fcn.0049c050
push 0
push 0
lea ecx, [esp + 0x14]
call fcn.0049b9c0
mov esi, dword [ebp + 8]
push eax
push esi
lea ecx, [esp + 0x2c]
call fcn.00499f90
test al, al
jne 0x4206f4
push 0x4dbf20
mov ecx, esi
call fcn.0049cc40
mov ecx, eax
call fcn.0049ccb0
lea ecx, [esp + 0xc]
call fcn.0049ba50
lea ecx, [esp + 0x1c]
call fcn.00499a80
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0xc]
call fcn.0049ba50
lea ecx, [esp + 0x1c]
call fcn.00499a80
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x423260
Capabilities:
Connect to http server

Disassembly:
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x608], 0
push edi
mov edi, eax
jne 0x42328d
mov ecx, dword [esp + 0x10]
push 0x4dd330
call fcn.0049cc40
mov ecx, eax
call fcn.0049ccb0
pop edi
xor al, al
pop ebx
pop ecx
ret 0x14
push ebp
mov ebp, dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
mov esi, dword [esp + 0x20]
mov eax, dword [esi]
test eax, eax
je 0x4232a8
push eax
call ebp
mov dword [esi], 0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
test eax, eax
je 0x4232bb
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esp + 0x24]
mov ecx, dword [ebx + 0x608]
push 0
push 0
push 3
push 0x4c996c
push 0x4c996c
push 0x50
push eax
or edi, 0x84480100
push ecx
mov dword [esp + 0x30], edi
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esi], eax
je 0x4233bd
cmp byte [ebx], 0
jne 0x423393
lea ebp, [ebx + 0x208]
mov ecx, ebp
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x423307
sub ecx, edi
sar ecx, 1
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
je 0x423348
mov ecx, ebp
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x423323
sub ecx, esi
sar ecx, 1
push ecx
push ebp
push 0x2b
push eax
call edi
test eax, eax
jne 0x423344
push 0x4dd340
jmp 0x4233c2
mov esi, dword [esp + 0x1c]
lea edx, [ebx + 0x408]
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423353
sub eax, ebx
sar eax, 1
je 0x423393
mov eax, edx
lea ebp, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423370
sub eax, ebp
sar eax, 1
push eax
push edx
mov edx, dword [esi]
push 0x2c
push edx
call edi
test eax, eax
jne 0x423393
push 0x4dd354
jmp 0x4233c2
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov edx, dword [esi]
push 0
push eax
push 0
push 0
push 0
push ecx
push 0x4dcc60
push edx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
test eax, eax
mov esi, dword [esp + 0x20]
mov dword [esi], eax
jne 0x4233dc
push 0x4dcc8c
mov ecx, dword [esp + 0x1c]
call fcn.0049ce30
mov ecx, eax
call fcn.0049ccb0
pop esi
pop ebp
pop edi
xor al, al
pop ebx
pop ecx
ret 0x14
mov ebx, dword [esp + 0x18]
call fcn.00423440
test al, al
jne 0x423406
push 0x4dd36c
mov ecx, ebx
call fcn.0049cc40
mov ecx, eax
call fcn.0049ccb0
pop esi
pop ebp
pop edi
xor al, al
pop ebx
pop ecx
ret 0x14
pop esi
pop ebp
pop edi
mov al, 1
pop ebx
pop ecx
ret 0x14

Function at 0x4234d0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, eax
mov eax, dword [esp + 0x1c]
mov esi, dword [eax]
test esi, esi
mov dword [esp + 0x18], 0
jbe 0x423510
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
lea ecx, [esp + 0x18]
push ecx
push esi
push edi
push ebp
call ebx
test eax, eax
je 0x42351f
mov eax, dword [esp + 0x18]
test eax, eax
je 0x423510
sub esi, eax
add edi, eax
test esi, esi
ja 0x4234f2
mov eax, dword [esp + 0x1c]
sub dword [eax], esi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
push 0x4dd39c
call fcn.0049ce30
mov ecx, eax
call fcn.0049ccb0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 0xc
Function at 0x427060
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebp
push esi
push edi
mov edi, eax
mov eax, dword [edi + 4]
add eax, eax
add eax, eax
push eax
lea ebp, [ebx + 4]
lea esi, [eax + 4]
call fcn.0046ef1b
add esp, 4
test eax, eax
mov dword [esp + 0xc], eax
jne 0x42708f
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x10
ret
mov ecx, dword [edi]
mov dword [eax], ecx
mov ecx, dword [ecx + 8]
mov edx, 1
jmp 0x4270a4
mov ebp, dword [esp + 0x10]
test ecx, ecx
je 0x4270bd
jmp 0x4270b0
mov dword [eax + edx*4], ecx
mov ecx, dword [ecx + 8]
add edx, 1
test ecx, ecx
jne 0x4270b0
mov ecx, dword [eax + edx*4 - 4]
sub edx, 1
mov dword [ebp], esi
mov eax, dword [ecx]
add ebp, 4
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
lea ebp, [esi + ebx]
jmp 0x4270e0
movzx edi, word [eax]
mov word [ebp], di
add eax, 2
add ebp, 2
test di, di
jne 0x4270e0
movsx eax, word [ecx + 0x10]
lea esi, [esi + eax*2 + 2]
mov ax, word [ecx + 0x12]
mov word [esi + ebx], ax
mov edi, dword [ecx + 4]
add esi, 2
test edi, edi
je 0x427159
lea esp, [esp]
mov ax, word [edi + 6]
add ax, ax
mov word [esi + ebx], ax
mov ecx, dword [edi]
movzx eax, ax
movzx ebp, ax
push ebp
add esi, 2
push ecx
lea edx, [esi + ebx]
push edx
call fcn.004715d0
movzx eax, word [edi + 4]
add esi, ebp
mov word [esi + ebx], ax
mov cl, byte [edi + 8]
add esi, 2
mov byte [esi + ebx], cl
mov edi, dword [edi + 0xc]
add esp, 0xc
add esi, 1
test edi, edi
jne 0x427110
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
test edx, edx
mov eax, dword [esp + 0xc]
mov ecx, dword [ecx + 0xc]
jg 0x4270a0
test ecx, ecx
jne 0x4270a0
push eax
call fcn.0046f0cc
add esp, 4
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x10
ret