joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a78
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x81414c]
jne 0x401a82
repz ret
jmp fcn.004025b5

Function at 0x40b18e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x81414c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004043e4
and dword [ebp - 0x14], 0
cmp dword [0x8167d8], 0
mov dword [ebp - 0x18], eax
jne 0x40b241
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b2e9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40b2e9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x8167d8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x8167dc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x8167e0], eax
call edi
push eax
call esi
mov dword [0x8167e8], eax
test eax, eax
je 0x40b241
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x8167e4], eax
mov eax, dword [0x8167e4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b29a
cmp dword [0x8167e8], ecx
je 0x40b29a
push eax
call esi
push dword [0x8167e8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b29a
test ebx, ebx
je 0x40b29a
call edi
test eax, eax
je 0x40b291
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b291
test byte [ebp - 8], 1
jne 0x40b29a
or dword [ebp + 0x10], 0x200000
jmp 0x40b2cd
mov eax, dword [0x8167dc]
cmp eax, dword [ebp - 0x18]
je 0x40b2cd
push eax
call esi
test eax, eax
je 0x40b2cd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b2cd
mov eax, dword [0x8167e0]
cmp eax, dword [ebp - 0x18]
je 0x40b2cd
push eax
call esi
test eax, eax
je 0x40b2cd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x8167d8]
call esi
test eax, eax
je 0x40b2e9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b2eb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401a78
leave
ret
Function at 0x80cc10
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x81414c]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], eax
cmp dword [ebp + 0xc], esi
jle 0x80cceb
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [ebp + 0xc], 0x2d
jne 0x80cc78
push 0
push str.lavufixajedapinenaliketuxuzikow_yopipocefibitonehaduyufatavub_jizosuxamuludofu_zamovipezafamid_muhayaju
call edi
push str.xicerijanudivudo
push str.xidicukapixifoga
push str.tidawudawujerusenohohicazoguvikehetadafeviwocubivicasadiyoz
push str.beziwuwiyufopidisaxewodozunabuvizikupajidagakiwubiwahixukecuzidufowilayobayaxihelazepixikuhejim
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
call fcn.0080cb60
mov ecx, dword [esp + 0xc]
xor byte [ecx + esi], al
cmp dword [ebp + 0xc], 0xf
jne 0x80cce1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor eax, eax
push eax
lea edx, [esp + 0x24]
push edx
push 0x812020
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
xor ecx, ecx
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
mov word [esp + 0x28], cx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push 0x812024
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x80cc4b
cmp dword [ebp + 0xc], 0x2d
jne 0x80cd05
mov dword [0x8178d0], 0xa62e7790
mov dword [0x8178d4], 0xffffffff
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401a78
mov esp, ebp
pop ebp
ret
Function at 0x80d0d0
Capabilities:
Access the windows event log
Manipulate console buffer
Set file attributes

Disassembly:
sub esp, 0xc
mov eax, dword [0x8178c4]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
mov dword [esp + 0x14], 0x1540b5
lea esp, [esp]
cmp eax, 0xcc1
jne 0x80d110
push 0
call ebp
mov eax, dword [0x8178c4]
mov dword [0x81752c], 0x8e468c60
cmp eax, 0x3dc
jne 0x80d14b
push 0
push 0x8121a0
call esi
xor eax, eax
lea edx, [esp + 0x18]
push edx
push eax
push eax
push eax
push eax
mov dword [esp + 0x24], eax
call edi
push str.guyojolegulob
push 0
push 0
call ebx
mov eax, dword [0x8178c4]
dec dword [esp + 0x14]
jne 0x80d100
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
xor esi, esi
mov ebp, 0xec58acac
or ebx, 0xffffffff
cmp eax, 0x997
jne 0x80d173
push 0
push 0
call edi
mov eax, dword [0x8178c4]
cmp esi, 0x846373
jne 0x80d18a
mov eax, dword [0x815ad0]
add eax, 0xa231
mov dword [0x8178c4], eax
cmp eax, 0x141
jne 0x80d19d
mov dword [0x816d18], ebp
mov dword [0x816d1c], ebx
inc esi
cmp esi, 0x123c962
jl 0x80d161
call fcn.0080cd60
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 0x10
Function at 0x40c49d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
cmp byte [0x5005a0], 0
je 0x40c4d1
jmp 0x40c4b0
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 2
jae 0x40c4d1
add eax, 0x7e4
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40c4ad
mov esp, ebp
pop ebp
ret 4
Function at 0x40d5a4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
call fcn.004373c7
call fcn.00420275
push 0x4b2c50
call fcn.004233ed
push 0x4b313c
call fcn.004233ed
push 0x4c3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_SetParent]
xor ecx, ecx
push ecx
movzx eax, byte [0x500c97]
push eax
mov ax, word [0x500c95]
push eax
push ecx
push ecx
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4

Function at 0x4158ec
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
imul eax, eax, 4
add eax, 0x4b5fd0
push dword [eax]
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4b6a68]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetParent]
mov esp, ebp
pop ebp
ret 4

Function at 0x418ed4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
call fcn.00418e90
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x419102
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x41915a
mov dword [ebp - 0xc], 0
jmp 0x419125
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x419154
cmp dword [ebp - 0xc], 5
jle 0x419152
xor eax, eax
jmp 0x419161
jmp 0x419156
jmp 0x419158
jmp 0x41911c
jmp 0x41915e
xor eax, eax
jmp 0x419161
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x41923c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x419274
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x419274
xor eax, eax
jmp 0x419277
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x4193a5
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x4193db
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4193db
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x419704
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
xor eax, eax
mov dword [ebp - 0x6c], eax
call fcn.00426ae0
mov dword [ebp - 0x70], eax
cmp byte [0x4ac63c], 3
je 0x419744
cmp word [ebp + 0xc], 0x56b
jne 0x419744
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
test cx, cx
jne 0x419744
push dword [ebp + 8]
mov ecx, 0x496f38
call fcn.00438fc1
test eax, eax
jne 0x419749
jmp 0x41992a
push 0
call fcn.004759bc
add esp, 4
mov ecx, 0x496f38
call fcn.0045386e
call fcn.0041e5f6
mov eax, dword [ebp + 8]
cmp eax, 3
ja case.default.0x41976e
jmp dword [eax*4 + 0x41992e]
cmp dword [0x496f54], 0
je 0x4197e7
cmp dword [ebp - 0x70], 0
je 0x4197e7
mov ecx, 0x4b0770
call fcn.0040d288
mov ecx, eax
call fcn.0041b7e2
nop
nop
nop
nop
nop
call fcn.0048196d
mov dword [ebp - 0x68], eax
push eax
call fcn.00406764
add esp, 4
push eax
push 0x48b47c
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x64]
push ecx
call fcn.00534747
nop
nop
nop
push 0
push dword [ebp - 0x68]
push 0x48b4c0
call fcn.0052ad1c
nop
nop
nop
xor eax, eax
mov dword [0x496f54], eax
push 1
jmp 0x41985f
cmp dword [0x496f50], 0
je 0x41985d
cmp dword [ebp - 0x70], 0
je 0x41985d
mov ecx, 0x4b0770
call fcn.0040d288
mov ecx, eax
call fcn.0041b7e2
nop
nop
nop
nop
nop
call fcn.0048196d
mov dword [ebp - 0x68], eax
push eax
call fcn.00406764
add esp, 4
push eax
push 0x48b494
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x64]
push edx
call fcn.00534747
nop
nop
nop
push 0
push dword [ebp - 0x68]
push 0x48b4c0
call fcn.0052ad1c
nop
nop
nop
xor eax, eax
mov dword [0x496f50], eax
push 0
call fcn.00461cf6
jmp 0x4198d9
cmp dword [0x496f4c], 0
je 0x4198d4
cmp dword [ebp - 0x70], 0
je 0x4198d4
mov ecx, 0x4b0770
call fcn.0040d288
mov ecx, eax
nop
call fcn.0041b7e2
call fcn.0045f670
mov dword [ebp - 0x68], eax
push eax
call fcn.00406764
add esp, 4
push eax
push 0x48b4ac
lea edx, [ebp - 0x64]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x64]
push eax
call fcn.00534747
nop
nop
nop
push 0
push dword [ebp - 0x68]
push 0x48b4c0
call fcn.0052ad1c
nop
nop
nop
xor eax, eax
mov dword [0x496f4c], eax
call fcn.00461c8f
nop
nop
jmp case.default.0x41976e
push 1
mov ecx, 0x492f90
call fcn.0041856a
mov dword [ebp - 0x6c], eax
test eax, eax
je case.default.0x41976e
push 0
push dword [0x4b7508]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.0042c858
add esp, 4
mov dword [0x4ae4c0], 1
cmp dword [ebp - 0x6c], 0
jne 0x41992a
mov byte [0x496f48], 0
call fcn.0042c88d
push eax
call fcn.004759bc
mov esp, ebp
pop ebp
ret
Function at 0x41993e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
call fcn.0045386e
mov ecx, 0x500a6e
mov dword [ecx], 0x496f30
mov dword [ecx + 4], 0x496f58
mov dword [ecx + 8], 0x496f5c
mov dword [ecx + 0xc], 0x496f34
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
inc ecx
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
jmp 0x419989
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 4
jae 0x4199c1
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + eax*4], 0
jne 0x419986
push eax
push 0x4195aa
push dword [0x4b6a68]
push 0x129
push dword [0x4b6a60]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx + edx*4], eax
jmp 0x419986
mov dword [ebp - 8], 0x1b8
mov dword [ebp - 0xc], 0x280
call fcn.00437c50
mov byte [ebp - 4], 0
jmp 0x4199dd
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jae 0x419a49
push 1
push 0x32
push 0x32
mov edx, dword [ebp - 8]
sub edx, 0x32
push edx
mov eax, dword [ebp - 4]
imul edx, eax, 0x32
add edx, 0x32
mov ecx, dword [ebp - 0xc]
sub ecx, edx
push ecx
mov ecx, dword [ebp - 0x18]
push dword [ecx + eax*4]
call dword [sym.imp.USER32.dll_MoveWindow]
cmp dword [ebp + 8], 0
jne 0x419a49
push 5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
push dword [ecx + eax*4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x101
push 0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
push dword [ecx + eax*4]
call dword [sym.imp.USER32.dll_RedrawWindow]
cmp dword [ebp + 8], 0
jne 0x4199da
push 0
call fcn.00423971
jmp 0x4199da
call fcn.004768c0
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x10], 0
mov esp, ebp
pop ebp
ret 4
Function at 0x421897
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], ecx
mov cl, byte [ecx + 1]
call fcn.004061f9
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x10]
cmp byte [ecx], 0x56
je 0x4218c8
cmp byte [ecx], 0x55
je 0x4218c8
push dword [ecx + 0xd]
push dword [ecx + 1]
call fcn.00435829
add esp, 8
jmp 0x4218d2
mov ecx, dword [ebp - 0x14]
push 2
call fcn.00406670
mov ecx, dword [ebp - 0x10]
mov cl, byte [ecx + 0xd]
call fcn.004061f9
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00403b96
push 8
mov ecx, 0x4b1b18
call fcn.0042c45f
push 1
push 8
mov ecx, 0x4b69b0
call fcn.0047467a
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x254]
and eax, 0xc0
cmp eax, 0xc0
je 0x421948
mov ecx, dword [ebp - 0x18]
call fcn.00403360
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x2cb
call fcn.0040659b
mov eax, dword [ebp - 0x10]
push dword [eax + 0x2cc]
push dword [eax + 0x2cb]
mov ecx, 0x4b4250
call fcn.0045503f
call fcn.00421aa3
mov ecx, 0x4b4250
call fcn.0045461c
mov ecx, dword [ebp - 0x14]
call fcn.0043fcc9
mov ecx, dword [ebp - 0x14]
call fcn.00403360
mov edx, dword [eax]
mov dword [ebp - 4], edx
push edx
lea ecx, [ebp - 0x20]
push ecx
call fcn.0044fa1f
add esp, 8
push dword [ebp - 4]
call fcn.0044fa7e
add esp, 4
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], eax
mov eax, 0x3000
call fcn.004015b1
mov dword [ebp - 8], eax
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00406991
movzx eax, byte [ebp - 0x1f]
push eax
mov al, byte [ebp - 0x20]
push eax
call fcn.004036f9
call fcn.0040159c
mov ecx, dword [ebp - 0x10]
cmp byte [ecx + 2], 1
jne 0x421a02
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
add eax, 0x3000
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00406991
call fcn.0041e5f6
sub dword [ebp - 0x1c], 8
sub dword [ebp - 0x18], 8
push dword [ebp - 0xc]
mov eax, dword [ebp - 8]
add eax, 0x3000
push eax
mov ecx, dword [ebp - 0x10]
push dword [ecx + 1]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.004238fe
jmp 0x421a25
sub dword [ebp - 0x1c], 8
sub dword [ebp - 0x18], 8
push eax
mov eax, dword [ebp - 0x10]
push dword [eax + 1]
push 0x40
push 0x40
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.0045135a
call fcn.0041e5f6
call fcn.0042c4e0
call fcn.0047eb97
mov dword [ebp - 0x14], eax
push 1
push 0x27
mov ecx, 0x4b69b0
call fcn.0047467a
cmp byte [0x505fdc], 0
jne 0x421a64
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ecx]
call fcn.00484002
push ecx
push 0x48b8a8
push 2
call fcn.0042f699
add esp, 0xc
call fcn.0047eb97
sub eax, dword [ebp - 0x14]
mov ecx, 0x14
sub ecx, eax
cmp ecx, 0
jle 0x421a83
push ecx
mov ecx, 0x4b1b18
call fcn.0042c45f
call fcn.0042c4e0
push 0
push dword [ebp - 8]
push 0x40
push 0x40
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.00451913
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x42c223
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, 0x4b6930
call fcn.0042c430
mov dword [ebp - 0xc], 0
push 0
call fcn.0042b81b
add esp, 4
mov ecx, 0x4ac63c
call fcn.004cee12
mov dword [ebp - 8], eax
push 0
call fcn.004759bc
add esp, 4
mov eax, dword [ebp - 8]
cmp eax, 3
je 0x42c29a
mov ecx, 0x4b6a98
call fcn.004848b5
test eax, eax
jne 0x42c295
push 1
mov ecx, 0x4b6a98
call fcn.00475e67
call fcn.00476870
mov ecx, 0x4b0770
call fcn.00418c30
push eax
call fcn.00476715
add esp, 4
call fcn.00476882
mov edx, dword [ebp - 8]
cmp edx, 4
ja case.default.0x42c2a6
jmp dword [edx*4 + 0x42c3e4]
call fcn.00429898
movzx eax, ax
jmp 0x42c2e8
call fcn.0040be47
jmp 0x42c2e8
call fcn.00413e25
test al, al
je 0x42c2db
mov ecx, 0x4b2b98
call fcn.004332d8
call fcn.00429898
movzx eax, ax
jmp 0x42c2e8
mov ecx, 0x4b2b98
call fcn.00433325
nop
nop
nop
mov dword [ebp - 0xc], eax
jmp case.default.0x42c2a6
mov dword [0x4abf9c], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x7fffffff
div ecx
push edx
call fcn.0047fb05
add esp, 4
mov ecx, 0x4b3d08
call fcn.0044f058
and eax, 0xff
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 4
ja case.0x42c33d.1
mov eax, dword [ebp - 0x14]
jmp dword [eax*4 + 0x42c3f8]
mov ecx, dword [ebp - 0xc]
or ecx, 0x20
mov dword [ebp - 0xc], ecx
jmp 0x42c388
mov dword [ebp - 4], 1
push 0
mov ecx, 0x4b3d08
call fcn.0040be38
jmp 0x42c388
mov edx, dword [ebp - 0xc]
or edx, 0x40
mov dword [ebp - 0xc], edx
jmp 0x42c388
call fcn.0047b4f7
mov eax, dword [ebp - 0xc]
or al, 8
mov dword [ebp - 0xc], eax
jmp 0x42c388
push 0
call fcn.004759bc
add esp, 4
cmp dword [ebp - 4], 1
jne 0x42c397
mov dword [ebp - 4], 0
jmp 0x42c3a3
mov ecx, 0x492f90
call fcn.00417980
jmp 0x42c3a8
jmp 0x42c301
jmp case.default.0x42c2a6
mov dword [0x4abf9c], 0
mov byte [0x4aab94], 0
call fcn.0040bb87
mov ecx, dword [ebp - 0xc]
and ecx, 0x6c
test ecx, ecx
je 0x42c3d8
push 0
mov ecx, 0x4b6a98
call fcn.00475e67
jmp 0x42c3dd
jmp 0x42c229
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x42c479
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
call fcn.0047eb97
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jge 0x42c498
call fcn.0047eb97
mov dword [ebp - 8], eax
jmp 0x42c4a0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
sub eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x437250
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 7
call fcn.0047cae3
add esp, 4
call fcn.0047d340
push 0
push 0xa
push 0
call fcn.0047d1f1
add esp, 0xc
push 0
call fcn.0047cae3
add esp, 4
push dword [0x4b6a68]
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_SetParent]
pop ebp
ret

Function at 0x439fa6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 0x10]
cmp al, 0
je 0x439fcd
cmp al, 1
jne 0x439fc3
dec eax
mov dword [ebp - 4], eax
push eax
push 0x5d
push 0x2b
push 0x44
jmp 0x439ff6
mov dword [ebp - 4], eax
sub al, 6
push eax
push 0x5e
jmp 0x439ff2
mov byte [ebp - 4], 6
cmp byte [0x505fcc], 1
je 0x439fe3
sub byte [ebp - 4], 2
jmp 0x439fe3
inc dword [ebp + 0x10]
mov al, byte [ebp - 4]
cmp byte [ebp + 0x10], al
jae 0x43a055
push 0xff
push 0x10
push 0x1a
push 0x48
push 0
push dword [ebp + 0x14]
call fcn.00450b93
push eax
push 1
push dword [ebp + 0x18]
call fcn.00450b93
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00435116
cmp dword [ebp + 8], 0
jne 0x43a055
push 5
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push dword [ecx + eax*4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x101
push 0
push 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push dword [ecx + eax*4]
call dword [sym.imp.USER32.dll_RedrawWindow]
cmp dword [ebp + 8], 0
jne 0x43a053
push 0
call fcn.00423971
jmp 0x439fe0
call fcn.004768c0
mov esp, ebp
pop ebp
ret 0x14

Function at 0x43f039
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0
add ecx, 0x13
jmp 0x43f046
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp ax, 0xc8
jae 0x43f05c
imul edx, eax, 3
mov edx, dword [ecx + edx]
cmp byte [ebp + 8], dl
jne 0x43f043
jmp 0x43f05e
mov al, 0xff
mov esp, ebp
pop ebp
ret 4
Function at 0x44a3f6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov byte [ecx + 0x18], al
inc eax
mov dword [ecx + 0x14], eax
push 0
push dword [0x4b5fdc]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x44f058
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [0x497738]
mov dword [ebp - 4], eax
test eax, eax
je 0x44f077
mov ecx, dword [ebp - 8]
call fcn.0044d092
jmp 0x44f07f
mov ecx, dword [ebp - 8]
call fcn.0044d2ca
mov byte [0x4aab94], 0
mov dword [0x497738], 0
mov ecx, dword [ebp - 8]
call fcn.0044a3f6
mov ecx, dword [ebp - 8]
call fcn.0044a971
mov ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [ecx + 1]
test edx, edx
jne 0x44f0d3
cmp dword [ebp - 4], 0
jne 0x44f0d3
mov ecx, 0x492f90
call fcn.0044f7b0
test eax, eax
je 0x44f0d3
push 0
mov ecx, 0x492f90
call fcn.004180c1
call fcn.0047eac4
jmp 0x44f0b2
mov ecx, dword [ebp - 8]
call fcn.00449ef0
mov ecx, dword [ebp - 8]
call fcn.0044a37a
mov ecx, dword [ebp - 8]
call fcn.00449eca
mov ecx, dword [ebp - 8]
call fcn.00449ea4
push 1
mov ecx, 0x4b6bc0
call fcn.00476176
mov ecx, 0x4b0770
call fcn.00482938
and eax, 0x8000
test eax, eax
je 0x44f13d
mov ecx, dword [ebp - 8]
call fcn.0044a88a
push 8
mov eax, dword [0x4b5fd8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x51c], 0
mov ecx, dword [ebp - 8]
call fcn.0044a6db
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 8]
call fcn.0044eec5
mov eax, dword [ebp - 8]
mov al, byte [eax + 1]
mov esp, ebp
pop ebp
ret