joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5900
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffee4
mov dword [esp], 0x11c
push esp
call sub.kernel32.dll_GetVersionExW
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x4c593d
mov al, 4
mov edx, dword [esp + 4]
cmp edx, 6
jne 0x4c592b
mov al, 7
jmp 0x4c5976
cmp edx, 5
jb 0x4c5976
mov al, 5
cmp dword [esp + 8], 1
jb 0x4c5976
mov al, 6
jmp 0x4c5976
cmp eax, 1
jne 0x4c5974
mov al, 1
cmp dword [esp + 4], 4
ja 0x4c5959
cmp dword [esp + 4], 4
jne 0x4c595b
cmp dword [esp + 8], 0xa
jb 0x4c595b
mov al, 2
cmp dword [esp + 4], 4
ja 0x4c5970
cmp dword [esp + 4], 4
jne 0x4c5976
cmp dword [esp + 8], 0x5a
jb 0x4c5976
mov al, 3
jmp 0x4c5976
xor eax, eax
add esp, 0x11c
ret

Function at 0x4d3eac
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0x4d3f44
call sub.user32.dll_RegisterWindowMessageW
mov edi, eax
mov dl, 1
mov eax, dword [0x438e40]
call fcn.00405f8c
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4d3f33
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
push fcn.004d3d48
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4d3f1d
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.004448bc
mov edx, dword [ebp - 4]
push edx
mov edx, dword [ebp - 8]
push edx
push edi
push eax
call sub.user32.dll_PostMessageW
inc esi
dec ebx
jne 0x4d3f00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3f3a
mov eax, dword [ebp - 0xc]
call fcn.00405fbc
ret
Function at 0x4d3fb8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dl, 1
call fcn.00472274
mov dword [ebp - 8], eax
push 0x4d40b0
call sub.user32.dll_RegisterWindowMessageW
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x438e40]
call fcn.00405f8c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d40a0
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetForegroundWindow
call fcn.004d3f68
mov ebx, eax
test ebx, ebx
je 0x4d400f
mov eax, dword [ebp - 4]
push eax
push ebx
call fcn.004d3d48
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x4d4026
mov eax, dword [ebp - 4]
push eax
push fcn.004d3d48
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4d4065
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004448bc
mov ebx, eax
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4d4061
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.user32.dll_PostMessageW
call fcn.0040741c
jmp 0x4d40a7
inc edi
dec esi
jne 0x4d4034
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jle 0x4d408a
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004448bc
mov ebx, eax
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push ebx
call sub.user32.dll_PostMessageW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d40a7
mov eax, dword [ebp - 4]
call fcn.00405fbc
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f05ac
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4f07a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x4c]
cmp dword [eax + 8], 0
jne 0x4f05e6
mov eax, dword [ebx + 0xc]
mov dword [eax + 0x5db], 7
jmp 0x4f0789
mov eax, dword [ebx + 0x4c]
call fcn.004f250c
mov esi, eax
mov dword [ebx + 0x50], esi
mov edx, esi
mov eax, dword [ebx + 0x4c]
call fcn.004f2424
xor edx, edx
push ebp
push 0x4f0782
push dword fs:[edx]
mov dword fs:[edx], esp
movzx eax, byte [0x4f07b4]
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
mov edx, 0x4f07c4
mov eax, 0x4f080c
call fcn.0048f0ec
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x50]
mov ecx, dword [edx + 8]
mov edx, 0x4f0830
call fcn.00426bcc
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0xc]
call fcn.004b8ec0
lea ecx, [ebp - 0x10]
mov edx, 0x4f0850
mov eax, 0x4f086c
call fcn.0048f0ec
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x14]
call fcn.004b8ec0
mov eax, dword [ebx + 0x14]
call fcn.004b986c
lea ecx, [ebp - 0x14]
mov edx, 0x4f0898
mov eax, 0x4f08b4
call fcn.0048f0ec
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x18]
call fcn.004b8ec0
mov eax, dword [ebx + 0x18]
mov dl, 1
call fcn.004b7818
mov eax, dword [ebx + 0x18]
call fcn.004b986c
mov eax, dword [ebx + 0x1c]
call fcn.004b98b4
mov eax, dword [ebx + 0x20]
call fcn.004b98b4
mov eax, dword [ebx + 0x14]
call fcn.004b986c
lea ecx, [ebp - 0x18]
mov edx, 0x4f08e0
mov eax, 0x4f0920
call fcn.0048f0ec
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x24]
call fcn.004b8ec0
mov eax, dword [ebx + 0x24]
call fcn.004b986c
mov eax, dword [ebx + 0x50]
mov edx, dword [eax + 0xc]
mov eax, dword [ebx + 0x28]
call fcn.004b8ec0
mov eax, dword [ebx + 0x28]
mov edx, dword [eax + 0x2e]
call fcn.004ba020
mov eax, dword [ebx + 0x28]
call fcn.004b986c
lea ecx, [ebp - 4]
mov edx, 0x4f0950
mov eax, 0x4f09e0
call fcn.0048f0ec
movzx eax, byte [0x4f09fc]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x50]
mov ecx, dword [eax + 8]
mov edx, 0x4f0830
mov eax, dword [ebp - 4]
call fcn.00426bcc
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.00408058
mov eax, dword [ebx + 0x2c]
mov edx, dword [ebp - 4]
call fcn.004b8ec0
mov eax, dword [ebx + 0x2c]
call fcn.004b986c
lea ecx, [ebp - 0x20]
mov edx, 0x4f0a0c
mov eax, 0x4f0b34
call fcn.0048f0ec
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx]
mov eax, dword [ebx + 0x30]
call fcn.004b986c
mov eax, dword [ebx + 0xc]
call fcn.004b9898
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f0789
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f07ab
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00407c90
ret
Function at 0x51b61c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov byte [ebx], 0
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
je 0x51b646
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x51b704
call fcn.0050cc58
mov dword [ebp - 8], eax
jmp 0x51b659
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x51b774
call fcn.0050cc58
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x51b6e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0050e8cc
test al, al
je 0x51b699
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
jne 0x51b699
mov eax, dword [ebp - 8]
call fcn.00405fbc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, 0x51b7e4
call fcn.0050cc58
mov dword [ebp - 8], eax
jmp 0x51b69c
mov byte [ebx], 1
mov eax, dword [ebp - 8]
call fcn.0050e8cc
test al, al
je 0x51b6c3
mov eax, dword [ebp + 8]
cmp byte [eax + 8], 0
je 0x51b6ba
mov dword [ebp - 4], 0xffffffff
jmp 0x51b6d0
mov dword [ebp - 4], 1
jmp 0x51b6d0
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0050ed90
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b6ed
mov eax, dword [ebp - 8]
call fcn.00405fbc
ret

Function at 0x51b824
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x51b8dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0x51b8f8
lea edx, [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.0041f264
push dword [ebp - 0x10]
push 0x51b948
push 0x51b978
push 0x51b990
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.00408da8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0050cc58
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x51b8bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0050e8cc
test al, al
jne 0x51b8a5
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51b8c2
mov eax, dword [ebp - 8]
call fcn.00405fbc
ret
Function at 0x520ac0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x520ad5
add esp, 0xfffffff0
call fcn.004065b4
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x520cb6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], cl
mov dl, 1
mov eax, dword [0x4d5688]
call fcn.004d61c8
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dl, 1
mov eax, dword [0x51fe98]
call fcn.005201a4
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x38], ebx
mov eax, ebx
call fcn.00520290
mov eax, dword [ebp - 4]
fstp qword [eax + 0x40]
wait
push 0
mov ecx, 0x520cf0
mov dl, 1
mov eax, dword [0x4df8ac]
call fcn.004dfba0
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
push 0x520d0c
call sub.user32.dll_RegisterWindowMessageW
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
push 0x520d2c
call sub.user32.dll_RegisterWindowMessageW
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, 0x520d60
call fcn.004b6098
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 8], ebx
mov eax, ebx
xor edx, edx
call fcn.004b8ca8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, 0x520d88
call fcn.004b9d8c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.004b787c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov dword [ebx + 0x46c], eax
mov dword [ebx + 0x468], 0x521cb8
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
push 0x521aa8
push 0
push 1
push 0
lea ecx, [ebp - 8]
mov eax, ebx
mov edx, 1
call fcn.004b38b0
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
push 0
push 0
push 0
push 0
mov edx, 0x520db8
mov eax, esi
movzx ecx, word [0x520db8]
call fcn.004b42a0
push 0
push 0
push 0
push 0
mov edx, 0x520db8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
movzx ecx, word [0x520db8]
call fcn.004b42a0
push 0
push 0
push 0
push 0
mov edx, 0x520db8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
movzx ecx, word [0x520dbc]
call fcn.004b42a0
push 0
push 0
push 0
push 0
mov edx, 0x520db8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
movzx ecx, word [0x520db8]
call fcn.004b42a0
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d], 0
push 0x520dc0
mov eax, dword [0x539c50]
push eax
call sub.user32.dll_LoadIconW
push eax
push 0x414
push 0x520d60
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x2d]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.004b787c
mov ecx, eax
mov dl, 1
mov eax, dword [0x4d4784]
call fcn.004d4a5c
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x20], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x34], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x520cc0
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x520cd8
call fcn.0040660c
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x5276b0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov byte [ebp - 2], dl
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x5278bb
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x527896
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004d1ba8
mov ecx, ebx
movzx edx, byte [ebp - 2]
movzx eax, byte [ebp - 1]
call fcn.004f644c
test bl, bl
je 0x527709
movzx edx, byte [ebp - 2]
movzx eax, byte [ebp - 1]
call fcn.0051dadc
call fcn.0051b1b8
xor eax, eax
push ebp
push 0x52780e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [0x535e08]
mov eax, dword [eax]
mov cl, 1
mov dl, 1
call fcn.0047fcb8
push 1
mov eax, dword [0x536178]
mov eax, dword [eax]
mov cl, 1
mov dl, 1
call fcn.0047fcb8
push 1
mov eax, dword [0x536030]
mov eax, dword [eax]
mov cl, 1
mov dl, 1
call fcn.0047fcb8
push 1
mov eax, dword [0x535d58]
mov eax, dword [eax]
mov cl, 1
mov dl, 1
call fcn.0047fcb8
push 1
mov eax, dword [0x535ffc]
mov eax, dword [eax]
mov cl, 1
mov dl, 1
call fcn.0047fcb8
push 1
mov eax, dword [0x53618c]
mov eax, dword [eax]
mov cl, 1
mov dl, 1
call fcn.0047fcb8
mov edx, dword [0x535b70]
mov edx, dword [edx]
lea eax, [ebp - 8]
mov ecx, 0x5278d8
call fcn.00408d20
mov eax, dword [ebp - 8]
mov dl, 1
call fcn.00480690
mov edx, dword [0x535b70]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
mov ecx, 0x5278fc
call fcn.00408d20
mov eax, dword [ebp - 0xc]
mov dl, 1
call fcn.00480690
mov edx, dword [0x535b70]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov ecx, 0x527920
call fcn.00408d20
mov eax, dword [ebp - 0x10]
mov dl, 1
call fcn.00480690
mov edx, dword [0x535b70]
mov edx, dword [edx]
lea eax, [ebp - 0x14]
mov ecx, 0x52794c
call fcn.00408d20
mov eax, dword [ebp - 0x14]
mov dl, 1
call fcn.00480690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x527818
xor eax, eax
push ebp
push 0x527852
push dword fs:[eax]
mov dword fs:[eax], esp
mov cl, 1
mov edx, 0x527974
mov eax, 0x80000001
call fcn.00470bb8
mov cl, 1
mov edx, 0x527974
mov eax, 0x80000002
call fcn.00470bb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52785c
mov eax, dword [0x535d10]
mov eax, dword [eax]
mov ecx, 0x5279b0
mov edx, 0x5279d8
call fcn.0047094c
call fcn.004da300
push 0
mov eax, dword [0x5360c0]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 0x527a44
call fcn.00488498
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5278a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5278c2
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00407c90
ret
Function at 0x401180
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, 0x32004
call fcn.00448800
mov eax, dword [0x45d600]
xor eax, esp
mov dword [esp + 0x32000], eax
mov eax, dword [esp + 0x32008]
push eax
lea eax, [esp + 0x14004]
push 0xa000
push eax
call fcn.00435e29
add esp, 0xc
push 0xa000
lea ecx, [esp + 0x1e004]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x1400c]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x1e000]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4011e3
push esi
push edi
push 0
push 0
push 0xa000
sub eax, edx
lea esi, [esp + 0x14014]
mov ecx, esi
push ecx
sar eax, 1
push eax
lea edx, [esp + 0x1e01c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [esp + eax + 0x14008]
mov edx, esi
mov eax, 0x811c9dc5
cmp edx, ecx
jae 0x401240
lea esp, [esp]
movsx edx, byte [esi]
xor eax, edx
inc esi
imul eax, eax, 0x1000193
cmp esi, ecx
jb 0x401230
push eax
lea eax, [esp + 0xc]
push str._08x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x14014]
push ecx
lea edx, [esp + 0x18]
push 0xa000
push edx
call fcn.00435f19
push 0x9fff
lea eax, [esp + 0xa025]
push 0
push eax
mov byte [esp + 0xa02c], 0
call fcn.0043e3a0
lea eax, [esp + 0x2c]
add esp, 0x24
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401290
sub eax, edx
lea ecx, [esp + 0xa008]
push ecx
lea edx, [esp + 0xc]
push edx
mov esi, eax
call fcn.00401140
push eax
call fcn.00401140
push eax
mov eax, esi
call fcn.00430b20
add esp, 0x10
lea ecx, [esp + 0xa008]
push ecx
lea esi, [esp + 0xc]
mov edi, eax
call fcn.004015e0
push 0x453b3c
push 0xa000
push ebx
call fcn.00435e29
mov edx, esi
push edx
push 0xa000
push ebx
call fcn.00435f19
mov ecx, dword [esp + 0x32020]
add esp, 0x18
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0043581d
add esp, 0x32004
ret 4
Function at 0x4020b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44d1bd
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x45d600]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea eax, [esi + 0xc]
xor ebx, ebx
push eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.00405710
lea eax, [esi + 0x838]
mov dword [esp + 0x14], ebx
push eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
call fcn.00405710
mov byte [esi + 0x38], 0x20
mov byte [esi + 0x39], bl
mov dword [esi], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x4025b0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [edi + 0x2c]
sub esp, 0x10
push ebx
push ebp
push esi
test eax, eax
je 0x4025cd
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi + 0x2c], 0
mov eax, dword [edi + 0x24]
mov ebp, dword [eax]
mov esi, dword [edi + 0xc]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], esi
lea ecx, [ecx]
mov ebx, dword [edi + 0x24]
mov eax, dword [edi + 0xc]
test esi, esi
je 0x4025ee
cmp esi, eax
je 0x4025f3
call fcn.00435e19
cmp ebp, ebx
je 0x40263a
test esi, esi
jne 0x402615
call fcn.00435e19
cmp ebp, dword [esi + 0x18]
jne 0x40260a
call fcn.00435e19
cmp dword [ebp + 0x24], 8
jb 0x402619
mov eax, dword [ebp + 0x10]
jmp 0x40261c
mov esi, dword [esi]
jmp 0x402600
lea eax, [ebp + 0x10]
mov ecx, dword [edi + 8]
push eax
push ecx
call dword [sym.imp.HTTPAPI.dll_HttpRemoveUrl]
lea esi, [esp + 0x10]
call fcn.00406c80
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
jmp 0x4025e0
mov eax, dword [edi + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x402651
push eax
call esi
mov dword [edi + 8], 0
mov eax, dword [edi + 0x30]
test eax, eax
je 0x402668
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [edi + 0x30], 0
push 0
push 1
call dword [sym.imp.HTTPAPI.dll_HttpTerminate]
mov edx, dword [edi + 0x34]
push edx
call esi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x402690
Capabilities:
Create thread
Register http server url

Disassembly:
push 0xffffffffffffffff
push 0x44d188
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push ebp
push esi
mov eax, dword [0x45d600]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [edi + 8]
xor ebp, ebp
cmp eax, ebp
jne 0x4026d7
or eax, 0xffffffff
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push ebp
push esi
push eax
call dword [sym.imp.HTTPAPI.dll_HttpAddUrl]
mov ebx, eax
cmp ebx, ebp
je 0x402716
push esi
push str.AddUrl__S_error
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov eax, 0x45e688
call fcn.00433490
add esp, 8
mov eax, ebx
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
xor eax, eax
mov word [esp + 0x50], ax
mov eax, esi
mov dword [esp + 0x64], 7
mov dword [esp + 0x60], ebp
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x402730
sub eax, edx
sar eax, 1
push eax
mov eax, esi
lea esi, [esp + 0x50]
call fcn.00405b80
lea ecx, [esp + 0x2c]
push ecx
lea edx, [edi + 0xc]
push edx
mov ebx, esi
mov dword [esp + 0x78], ebp
call fcn.00404db0
cmp dword [esp + 0x64], 8
jb 0x402773
mov eax, dword [esp + 0x50]
push eax
call fcn.00435e91
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [edi + 0x2c], ebp
jne 0x4027a9
push ebp
push ebp
push edi
push 0x402b90
push ebp
push ebp
call esi
mov dword [edi + 0x2c], eax
cmp eax, ebp
jne 0x4027a9
mov eax, 0xfffffffe
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
push 1
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebp
push ebp
push 1
lea edx, [esp + 0x44]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push ebp
lea ecx, [esp + 0x14]
push ecx
push 1
lea eax, [esp + 0x44]
push str.S:_ML__NW___LW__ML__NR___LW_
mov dword [esp + 0x30], 0xc
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x20], ebp
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x402830
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x402830
push ebp
push eax
mov eax, dword [esp + 0x2c]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
cmp dword [edi + 0x30], ebp
jne 0x402850
push ebp
push ebp
push edi
push 0x402950
push ebp
lea ecx, [esp + 0x34]
push ecx
call esi
mov dword [edi + 0x30], eax
cmp eax, ebp
je 0x402791
cmp dword [edi + 0x34], ebp
jne 0x402874
push str.__ErrorCheckEvent
push 1
push 1
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x34], eax
cmp eax, ebp
je 0x402791
xor eax, eax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
Function at 0x403910
Capabilities:
Send http response

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x178
mov eax, dword [0x45d600]
xor eax, esp
mov dword [esp + 0x174], eax
mov eax, dword [ebp + 8]
push 0x120
lea ecx, [esp + 0x3c]
push 0
push ecx
mov dword [esp + 0x14], eax
call fcn.0043e3a0
mov dx, word [ebp + 0xc]
mov eax, esi
add esp, 0xc
mov word [esp + 0x40], dx
mov dword [esp + 0x44], esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403957
mov dx, word [0x45404c]
sub eax, ecx
mov ecx, dword [0x454048]
mov word [esp + 0x42], ax
mov eax, dword [str.text_html]
mov dword [esp + 0x168], eax
mov eax, dword [str.NO_CACHE]
mov dword [esp + 0x16c], ecx
mov ecx, dword [0x454054]
mov dword [esp + 0x15c], eax
mov eax, 0x30
mov word [esp + 0x170], dx
mov dl, byte [0x454058]
mov dword [esp + 0x160], ecx
lea ecx, [esp + 0x168]
mov word [esp + 4], ax
mov eax, ecx
mov byte [esp + 0x164], dl
mov dword [esp + 0xbc], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4039d0
sub eax, edx
lea edx, [esp + 0x15c]
mov word [esp + 0xb8], ax
mov eax, edx
mov dword [esp + 0x5c], edx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4039f1
sub eax, edx
mov word [esp + 0x58], ax
lea eax, [esp + 4]
mov dword [esp + 0xec], eax
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403a10
sub eax, edx
lea ecx, [esp + 0x15c]
mov word [esp + 0xe8], ax
mov eax, ecx
mov dword [esp + 0x7c], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403a31
sub eax, edx
mov word [esp + 0x78], ax
mov eax, str.Access_Control_Allow_Origin
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x453b94
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403a53
sub eax, edx
mov word [esp + 0xc], ax
mov eax, 0x453b94
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403a70
sub eax, edx
mov word [esp + 0xe], ax
lea edx, [esp + 0xc]
mov eax, 1
mov dword [esp + 0x4c], edx
mov word [esp + 0x48], ax
test edi, edi
je 0x403aca
mov eax, edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403aa5
sub eax, edx
mov ecx, 1
lea edx, [esp + 0x18]
mov dword [esp + 0x24], eax
mov word [esp + 0x148], cx
mov dword [esp + 0x14c], edx
mov edx, dword [ebx + 0x14]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebx + 0x10]
push 0
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x24]
push 0
push edx
push eax
push ecx
call dword [sym.imp.HTTPAPI.dll_HttpSendHttpResponse]
mov ecx, dword [esp + 0x174]
xor ecx, esp
call fcn.0043581d
mov esp, ebp
pop ebp
ret