joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c459
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [edi + 0x74], 4
mov eax, dword [esi + 0x54]
mov dword [ebp - 4], eax
jne 0x47c47b
or eax, 0x800000
mov dword [ebp - 4], eax
movzx eax, word [edi + 0x78]
xor ebx, ebx
push ebx
push ebx
push dword [edi + 0x70]
push dword [edi + 0x30]
push dword [edi + 0x20]
push eax
push dword [edi + 0x10]
push dword [esi + 4]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi], eax
test eax, eax
jne 0x47c4c7
mov dword [esi + 0x18], 0xb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x47c4c0
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor al, al
jmp 0x47c5e6
push ebx
push dword [ebp - 4]
push ebx
push ebx
push ebx
push dword [edi + 0x60]
push ebx
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov edi, eax
test edi, edi
jne 0x47c4eb
mov dword [esi + 0x18], 0xc
jmp 0x47c5bf
cmp byte [ebp + 0xc], bl
je 0x47c4fb
push dword [ebp + 8]
mov ecx, esi
push edi
call fcn.0047cff2
test dword [ebp - 4], 0x1000
je 0x47c532
lea eax, [ebp + 8]
mov dword [ebp + 8], 4
push eax
lea eax, [ebp + 0xc]
push eax
push 0x1f
push edi
call dword [sym.imp.WININET.dll_InternetQueryOptionW]
or dword [ebp + 0xc], 0x100
lea eax, [ebp + 0xc]
push 4
push eax
push 0x1f
push edi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push ebx
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x47c5b8
push edi
call fcn.0047c418
cmp eax, 0xc8
jne 0x47c5b8
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x20
push eax
lea eax, [ebp - 0x24]
push eax
push 5
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x24]
push eax
call fcn.00425f36
pop ecx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
cmp byte [ebp + 0x10], bl
je 0x47c5a0
mov ecx, esi
push edi
cmp byte [esi + 0x30], bl
je 0x47c597
call fcn.0047cf09
jmp 0x47c59c
call fcn.0047ce31
mov bl, al
jmp 0x47c5d9
mov dword [esi + 0x18], ebx
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x47c5b4
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov bl, 1
jmp 0x47c5d9
mov dword [esi + 0x18], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x47c5d9
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
test edi, edi
je 0x47c5e4
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47cd2b
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
inc ebx
push edi
mov edi, ecx
cmp eax, ebx
jne 0x47cd48
movzx ecx, word [edi + 0x8c]
jmp 0x47cd4c
movzx ecx, word [edi + 0x58]
movzx edx, cx
mov ecx, dword [edi + 0xc0]
cmp dx, bx
jne 0x47cd62
xor esi, esi
push esi
push esi
push esi
push ebx
jmp 0x47cd89
cmp dx, 2
jne 0x47cd83
dec eax
neg eax
sbb eax, eax
and eax, 0xffffffcc
xor esi, esi
push esi
push str._local_
push dword [eax + edi + 0xb0]
push 3
jmp 0x47cd89
xor esi, esi
push esi
push esi
push esi
push esi
push ecx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [edi + 4], eax
test eax, eax
jne 0x47cd9b
xor al, al
jmp 0x47cdbb
cmp byte [edi + 0xdc], 0
je 0x47cdb9
push 8
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
push ecx
push 0x32
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x47ce31
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
mov esi, ecx
push edi
push 0x4c68e4
push dword [esi + 0x34]
call fcn.0042e19b
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x47ce5d
mov dword [esi + 0x18], 0x1f
jmp 0x47ced7
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x47ced0
cmp dword [ebp - 4], 0
je 0x47cea8
push edi
push ebx
push dword [ebp - 4]
lea eax, [ebp - 0x404]
push eax
call fcn.0042d763
mov eax, dword [ebp - 4]
add esp, 0x10
add dword [esi + 8], eax
adc dword [esi + 0xc], 0
test eax, eax
jne 0x47ce63
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x47ceb9
mov dword [esi + 0x18], 0x21
jmp 0x47ced7
and dword [esi + 0x18], 0
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x47cef3
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x47cef3
mov dword [esi + 0x18], 0x20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x47cef1
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor bl, bl
test edi, edi
je 0x47cefe
push edi
call fcn.0042e228
pop ecx
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47cf09
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
inc eax
mov esi, ecx
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov eax, dword [ebp - 8]
test eax, eax
jne 0x47cf3c
mov eax, 0x400
mov dword [ebp - 8], eax
cmp dword [ebp - 4], ebx
je 0x47cf94
test eax, eax
jne 0x47cf49
mov edi, ebx
jmp 0x47cf55
push eax
call fcn.004201ab
mov edi, eax
mov eax, dword [ebp - 8]
pop ecx
lea ecx, [ebp - 4]
push ecx
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x47cfa5
cmp dword [ebp - 4], ebx
je 0x47cf8b
push dword [ebp - 4]
lea ecx, [esi + 0x44]
push edi
call fcn.0047d271
mov eax, dword [ebp - 4]
add dword [esi + 8], eax
adc dword [esi + 0xc], ebx
test eax, eax
je 0x47cf94
mov eax, dword [ebp - 8]
jmp 0x47cf41
push ebx
push edi
call fcn.0042016d
pop ecx
pop ecx
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x47cfd3
mov dword [esi + 0x18], 0x21
jmp 0x47cfb5
push ebx
push edi
call fcn.0042016d
pop ecx
pop ecx
mov dword [esi + 0x18], 0x20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x47cfcf
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor al, al
jmp 0x47cfe9
mov dword [esi + 0x18], ebx
mov ecx, dword [esi + 0xd4]
test ecx, ecx
je 0x47cfe7
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47d0e5
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
push 0x3c
xor esi, esi
lea eax, [ebp - 0x4c]
push esi
push eax
call fcn.00423330
xor eax, eax
mov dword [ebp - 0x4c], 0x7c
inc eax
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x4c]
push eax
push esi
push dword [ebp + 8]
call fcn.0042462e
pop ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x47d13c
xor al, al
jmp 0x47d1f4
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
push edi
push dword [ebp - 0x44]
push esi
push dword [ebp - 0x48]
call fcn.00404035
push dword [ebp - 0x38]
lea ecx, [ebx + 0x10]
push esi
push dword [ebp - 0x3c]
call fcn.00404035
push dword [ebp - 0x2c]
lea ecx, [ebx + 0x20]
push esi
push dword [ebp - 0x30]
call fcn.00404035
push dword [ebp - 0x24]
lea ecx, [ebx + 0x30]
push esi
push dword [ebp - 0x28]
call fcn.00404035
push dword [ebp - 0x1c]
lea ecx, [ebx + 0x40]
push esi
push dword [ebp - 0x20]
call fcn.00404035
push dword [ebp - 0x14]
lea esi, [ebx + 0x50]
push 0
push dword [ebp - 0x18]
mov ecx, esi
call fcn.00404035
push esi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebx + 0x40]
call fcn.004612ea
lea ecx, [ebx + 0x60]
cmp ecx, eax
je 0x47d1b7
push eax
call fcn.0040478a
lea ecx, [ebp - 0x10]
call fcn.004020f8
mov ax, word [ebp - 0x34]
mov word [ebx + 0x78], ax
mov eax, dword [ebp - 0x40]
mov dword [ebx + 0x74], eax
sub eax, 1
je 0x47d1e9
sub eax, 1
je 0x47d1e0
mov dword [ebx + 0x70], 3
jmp 0x47d1f0
mov dword [ebx + 0x70], 2
jmp 0x47d1f0
mov dword [ebx + 0x70], 1
pop edi
mov al, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x47d1fb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0xd0], 0
je 0x47d237
cmp byte [ebp + 8], 0
je 0x47d237
sub esp, 0x10
lea ecx, [esi + 0xd4]
call fcn.0047c0f5
push esi
push 0
push 0x47d2cd
call fcn.0042cd7b
add esp, 0xc
cmp dword [esi + 0x18], 0
sete al
jmp 0x47d23f
push dword [ebp + 8]
call fcn.0047c343
pop esi
pop ebp
ret 4
Function at 0x4825e6
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
or edx, 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
add eax, esi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
mov ebx, eax
imul ebx, dword [ebp + 0x14]
push edi
mov edi, esi
lea eax, [esi + eax*4]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x14]
shl ebx, 2
shl eax, 2
mov dword [ebp + 0xc], eax
movzx eax, byte [esi + 2]
movzx ecx, dl
xor ecx, eax
shr edx, 8
movzx eax, byte [esi + 1]
xor edx, dword [ecx*4 + 0x4c2220]
movzx ecx, dl
xor ecx, eax
shr edx, 8
movzx eax, byte [esi]
add esi, ebx
xor edx, dword [ecx*4 + 0x4c2220]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4c2220]
cmp esi, dword [ebp + 8]
jb 0x48265d
add edi, dword [ebp + 0xc]
mov esi, edi
cmp edi, dword [ebp + 0x10]
jb 0x482619
not edx
mov dword [ebp + 8], edx
fild dword [ebp + 8]
test edx, edx
jns 0x482674
fadd qword [0x4c7f60]
pop edi
fstp qword [ebp - 8]
fld qword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x483112
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, 2
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x14]
mov word [edi], ax
call fcn.0040225b
mov ebx, dword [ebp + 0xc]
lea edx, [ebp - 0x14]
mov ecx, ebx
call fcn.0048342d
push dword [ebp - 0x14]
call dword [sym.imp.WSOCK32.dll_inet_addr]
lea ecx, [ebp - 0x14]
mov dword [ebp + 8], eax
call fcn.004020f8
cmp dword [ebp + 8], 0xffffffff
jne 0x483196
mov esi, dword [ebx + 4]
push str.255.255.255.255
call fcn.0042462e
add esp, 4
cmp esi, eax
jne 0x4831b9
mov ecx, str.255.255.255.255
test esi, esi
je 0x483193
mov edx, dword [ebx]
sub edx, ecx
lea esp, [esp]
mov ax, word [edx + ecx]
cmp ax, word [ecx]
jne 0x4831b9
add ecx, 2
sub esi, 1
jne 0x483182
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [edi + 4], ebx
test eax, eax
jle 0x4831e1
cmp eax, 0xffff
jg 0x4831e1
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov word [edi + 2], ax
mov al, 1
jmp 0x48320e
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add ecx, eax
cmp byte [ecx + 0xd], 0
mov eax, dword [ecx + 8]
je 0x4831cf
mov eax, dword [eax + 0x38]
mov dword [eax + 0x14], 1
cmp byte [ecx + 0xd], 0
mov eax, dword [ecx + 8]
je 0x483208
jmp 0x483205
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 8]
add ecx, esi
cmp byte [ecx + 0xd], 0
je 0x4831f5
mov eax, dword [eax + 0x38]
mov dword [eax + 0x14], 2
cmp byte [ecx + 0xd], 0
mov eax, dword [ecx + 8]
je 0x483208
mov eax, dword [eax + 0x38]
mov byte [eax + 0x18], 0
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x483217
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
and dword [ebx], 0
mov edi, ecx
mov dword [ebx + 4], eax
mov ecx, 0x3e8
mov eax, esi
inc dword [ebx]
cdq
idiv ecx
mov dword [ebp - 8], eax
imul eax, eax, 0x3e8
sub esi, eax
imul eax, esi, 0x3e8
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
cmp byte [ebp + 0x14], al
je 0x483260
push ebx
push eax
jmp 0x483262
push eax
push ebx
push eax
call dword [sym.imp.WSOCK32.dll_select]
mov esi, eax
test esi, esi
jne 0x483290
cmp byte [ebp + 0x14], al
je 0x4832e9
mov eax, dword [edi]
mov ecx, dword [eax + 4]
cmp byte [ecx + edi + 0xd], 0
mov eax, dword [ecx + edi + 8]
je 0x483287
mov eax, dword [eax + 0x38]
mov dword [eax + 0x14], 0x274c
jmp 0x4832d7
jle 0x4832bb
push ebx
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll___WSAFDIsSet]
test eax, eax
jne 0x4832e9
mov eax, dword [edi]
push 0xfffffffffffffffe
pop esi
mov ecx, dword [eax + 4]
cmp byte [ecx + edi + 0xd], 0
mov eax, dword [ecx + edi + 8]
je 0x4832b6
mov eax, dword [eax + 0x38]
mov dword [eax + 0x14], esi
jmp 0x4832d7
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
cmp byte [ecx + edi + 0xd], 0
mov edx, dword [ecx + edi + 8]
je 0x4832d4
mov edx, dword [edx + 0x38]
mov dword [edx + 0x14], eax
cmp byte [ecx + edi + 0xd], 0
mov eax, dword [ecx + edi + 8]
je 0x4832e5
mov eax, dword [eax + 0x38]
mov byte [eax + 0x18], 0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x48cbf0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0xff
push eax
xor esi, esi
lea eax, [ebp - 4]
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x218]
mov edi, ecx
push eax
push esi
mov ebx, edx
push edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x48ccf8
mov eax, ebx
or eax, 0x20019
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 8]
push ecx
push eax
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48cd0c
mov ecx, dword [ebp - 8]
mov edx, ebx
call fcn.0048cbf0
push dword [ebp - 8]
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x48cd0c
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x48cca7
push str.RegDeleteKeyExW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48cca7
mov ebx, dword [ebp - 0xc]
lea ecx, [ebp - 0x218]
push 0
push ebx
push ecx
push edi
call eax
jmp 0x48ccb8
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, dword [ebp - 0xc]
test eax, eax
jne 0x48cd01
test esi, esi
je 0x48ccc7
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0xff
push eax
xor esi, esi
lea eax, [ebp - 4]
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
mov eax, dword [ebp - 0x10]
jne 0x48cc3b
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x48cd0c
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x48ccfa
Function at 0x4950e5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
mov ecx, 0x4d1890
push ebx
push esi
push edi
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00419ae9
test al, al
jne 0x49510e
xor eax, eax
jmp 0x4952e0
mov ecx, dword [ebp - 4]
mov eax, dword [0x4d18f0]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov eax, dword [0x4d1904]
mov eax, dword [eax + ecx*4]
lea ecx, [ebp + 0xc]
mov edi, dword [eax]
mov esi, dword [edi]
mov bl, byte [edi + 0x90]
mov dword [ebp - 8], esi
call fcn.0041a8d7
cmp dword [edi + 0x48], 0
jl 0x49514c
push dword [edi + 0x48]
call fcn.00496f75
cmp bl, 0x12
ja 0x495224
je 0x4951e1
test bl, bl
je 0x4951d1
cmp bl, 4
jbe 0x49526c
cmp bl, 8
je 0x4951b1
cmp bl, 0x10
je 0x49519b
cmp bl, 0x11
jne 0x495107
mov eax, dword [ebp + 0xc]
test eax, eax
js 0x495107
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.00419990
push 1
push 0
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4952ca
cmp dword [ebp + 0xc], 0
jl 0x495107
push dword [ebp + 0xc]
push 0
push 0x111d
jmp 0x4951c5
cmp dword [ebp + 0xc], 0
jl 0x495107
push dword [ebp + 0xc]
push 0
push 0x2001
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4952ca
mov eax, dword [ebp + 0xc]
test eax, eax
jns 0x495290
jmp 0x495107
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jl 0x495107
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.00419990
test byte [edi + 0x92], 0x20
jne 0x4952ca
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi]
call esi
push 5
push dword [edi]
call esi
push dword [edi]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x4952ca
cmp bl, 0x13
je 0x49527c
cmp bl, 0x14
je 0x495177
cmp bl, 0x17
je 0x49526c
cmp bl, 0x18
je 0x49524c
jbe 0x495107
cmp bl, 0x1b
jbe 0x49526c
jmp 0x495107
cmp dword [ebp + 0xc], 0
jl 0x495107
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0xb
push eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [ebp + 0xc]
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.00419990
jmp 0x4952bf
cmp dword [ebp + 0xc], 0xfffffffe
je 0x495107
mov eax, 0xfe000000
cmp dword [ebp + 0xc], eax
jne 0x49529d
push 1
push eax
mov dword [edi + 0x48], eax
call fcn.00419990
jmp 0x4952ca
push dword [ebp + 0xc]
push 0
push 0x1001
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
push dword [ebp + 0xc]
push 0
push 0x1026
push dword [ebp - 8]
call esi
push 1
push edi
push dword [ebp + 8]
call fcn.00497dc8
cmp dword [0x4d1350], 0
je 0x4952dd
cmp bl, 8
jne 0x4952dd
or eax, 0xffffffff
jmp 0x4952e0
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x496b20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
mov ecx, 0x4d1890
push eax
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push dword [ebp + 8]
call fcn.00419ae9
test al, al
jne 0x496b48
xor eax, eax
jmp 0x496c88
mov ecx, dword [ebp - 8]
mov eax, dword [0x4d18f0]
mov edx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 4]
push edi
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [0x4d1904]
mov eax, dword [eax + ecx*4]
mov edi, dword [eax]
mov ecx, dword [edi]
mov dword [ebp + 8], ecx
cmp esi, 0xffffffff
je 0x496bf0
movzx eax, byte [edi + 0x90]
dec eax
sub eax, 1
je 0x496bb7
sub eax, 1
je 0x496bba
sub eax, 3
je 0x496bb2
sub eax, 1
je 0x496bad
sub eax, 3
je 0x496ba5
sub eax, 0xc
jne 0x496bdb
jmp 0x496c86
or esi, 0x4000000
jmp 0x496bdb
or esi, 3
jmp 0x496bdb
or esi, 0xe
jmp 0x496bdb
or esi, 4
push 0
test esi, 0x800
je 0x496bc8
push 1
jmp 0x496bd0
or esi, 0x10000
push 0
push 0xcf
push ecx
call edx
mov ecx, dword [ebp + 8]
or esi, 0x50000000
push esi
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [ebp + 8]
mov ebx, eax
mov esi, dword [ebp + 0x10]
cmp esi, 0xffffffff
je 0x496c2d
push esi
push 0xffffffffffffffec
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov eax, dword [0x4d1904]
mov eax, dword [eax + ecx*4]
mov eax, dword [eax]
cmp byte [eax + 0x90], 0x13
jne 0x496c2d
push esi
push 0
push 0x1036
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
mov al, byte [edi + 0x93]
mov ecx, dword [ebp - 8]
cmp al, 0xff
je 0x496c52
movzx eax, al
cmp eax, dword [ecx + 0x190]
je 0x496c52
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x496c5b
push 1
push edi
push ecx
call fcn.00497dc8
mov al, byte [edi + 0x90]
cmp al, 2
je 0x496c6e
cmp al, 3
je 0x496c6e
cmp esi, 0xffffffff
je 0x496c7f
push 0x27
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowPos]
xor eax, eax
test ebx, ebx
setne al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x498138
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0x44
push 0
mov ebx, 0x4d2fe0
push ebx
call fcn.00423330
push 0x10
push 0
mov esi, 0x4d3024
push esi
call fcn.00423330
add esp, 0x18
mov dword [0x4d2fe0], 0x44
xor eax, eax
inc eax
mov dword [0x4d300c], eax
push esi
push ebx
mov word [0x4d3010], ax
xor eax, eax
push eax
push eax
push 0x20
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop esi
pop ebx
test eax, eax
je 0x49819d
push dword [0x4d3024]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
ret 4

Function at 0x4981a1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 3
mov edi, ecx
mov edx, dword [ebx + 4]
mov dword [ebp + 8], edx
pop esi
cmp dword [ebx + 0x190], eax
je 0x498257
cmp dword [edi + 0x84], esi
jl 0x498251
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
test ecx, ecx
je 0x498242
cmp dword [ecx + 4], edx
jne 0x498242
mov dl, byte [ecx + 0x90]
cmp dl, 0xb
je 0x49823f
mov dh, byte [ecx + 0x93]
movzx eax, dh
cmp eax, dword [ebx + 0x190]
je 0x498211
cmp byte [ebx + 0x198], 0
je 0x49823f
cmp dh, 0xff
je 0x49823f
cmp dl, 0xa
je 0x49823f
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
test byte [eax + 0x92], 0x40
je 0x49823f
cmp byte [eax + 0x90], 0x1a
jne 0x49823f
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp + 8]
inc esi
cmp esi, dword [edi + 0x84]
jle 0x4981d1
mov eax, dword [ebp + 0xc]
push 3
pop esi
mov dword [ebx + 0x190], eax
cmp dword [edi + 0x84], esi
jl 0x4982e4
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
test ecx, ecx
je 0x4982d5
cmp dword [ecx + 4], edx
jne 0x4982d5
cmp byte [ecx + 0x90], 0xb
je 0x4982d5
movzx eax, byte [ecx + 0x93]
cmp eax, dword [ebx + 0x190]
jne 0x4982d5
test byte [ecx + 0x92], 0x20
jne 0x4982d5
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
push 4
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
test byte [eax + 0x92], 0x40
je 0x4982d5
cmp byte [eax + 0x90], 0x1a
jne 0x4982d5
push 1
push dword [eax]
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp + 8]
inc esi
cmp esi, dword [edi + 0x84]
jle 0x498263
mov eax, dword [ebp + 0xc]
push 0
push eax
push 0x130c
push dword [ebx + 0x188]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8