joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b330
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x479160]
mov edi, dword [ebp + 8]
push edi
call dword [0x479540]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0042b2a0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x44b3fb
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [0x4795d0]
test eax, eax
je 0x44b3fb
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x44b3ae
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x44b3b9
or bh, 8
and edi, 0x8000000
je 0x44b3d4
mov eax, dword [0x4a005c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [0x47916c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [0x47960c]
test edi, edi
je 0x44b3fb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [0x47916c]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x450a9f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x450ad7
push dword [esi + 0x1c]
call dword [0x479540]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00454048
push eax
push dword [esi + 0x1c]
call dword [0x4795d0]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00454020
jmp 0x450ae3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x450ae7
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x49de78
mov ecx, edi
call fcn.00453d2a
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x450b3a
push dword [esi + 0x1c]
call dword [0x4796ac]
mov esi, eax
test esi, esi
je 0x450b4d
push esi
call dword [0x479540]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.00454048
push eax
push esi
call dword [0x4795d0]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00454020
jmp 0x450b4d
mov ecx, esi
call fcn.004534fd
test eax, eax
je 0x450b4d
push edi
mov ecx, eax
call fcn.00450a9f
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8
Function at 0x40b168
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0040b0a8
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sym._read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x40b1b4
call sym.__errno
cmp dword [eax], 4
je 0x40b188
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40d268
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov edx, eax
je 0x40d298
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [esp + 4], eax
call sym.___mingwthr_key_dtor
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret

Function at 0x40d448
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x44a540]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40d488
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x2c], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x2c], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x40d838
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x44a540]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40d914
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x40d929
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x40d8e8
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x40d880
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x40d890
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x40d8db
test edx, edx
jne 0x40d8ce
test ecx, ecx
je 0x40d878
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x40d938
cmp eax, 8
je 0x40d878
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x30]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40d86a
call sym.___w32_sharedptr_initialize
mov eax, dword [0x44a540]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jns 0x40d85c
call sym._fc_key_init_once
mov eax, dword [0x44a540]
jmp 0x40d85c
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x40d8d3
mov eax, dword [0x44a540]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40d98b
mov edi, dword [eax + 0x2c]
test edi, edi
js 0x40d9b6
mov esi, dword [eax + 0x2c]
test esi, esi
jne 0x40d997
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call sym.___w32_sharedptr_initialize
mov eax, dword [0x44a540]
jmp 0x40d969
mov eax, dword [eax + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40d97a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40d97a
call sym._fc_key_init_once
mov eax, dword [0x44a540]
jmp 0x40d970
Function at 0x40dab8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov eax, dword [0x44a540]
test eax, eax
je 0x40db18
mov esi, dword [eax + 0x2c]
test esi, esi
js 0x40db38
mov ebx, dword [eax + 0x2c]
test ebx, ebx
jne 0x40db58
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
je 0x40dba8
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sym.___w32_sharedptr_initialize
mov eax, dword [0x44a540]
mov esi, dword [eax + 0x2c]
test esi, esi
jns 0x40dada
jmp 0x40db38
call sym._fc_key_init_once
mov eax, dword [0x44a540]
mov ebx, dword [eax + 0x2c]
test ebx, ebx
je 0x40dae1
jmp 0x40db58
mov ebx, dword [eax + 0x30]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
sub esp, 4
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x40db09
lea esi, [esi]
mov eax, dword [0x44a540]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40dbf5
mov ecx, dword [eax + 0x2c]
test ecx, ecx
js 0x40dc01
mov edx, dword [eax + 0x2c]
test edx, edx
jne 0x40dbd6
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
mov eax, dword [eax + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40dbc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40dbc5
call sym.___w32_sharedptr_initialize
mov eax, dword [0x44a540]
jmp 0x40dbb4
call sym._fc_key_init_once
mov eax, dword [0x44a540]
jmp 0x40dbbb
Function at 0x40dc18
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x44a540]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40dcac
mov esi, dword [eax + 0x2c]
test esi, esi
js 0x40dcc8
mov ebx, dword [eax + 0x2c]
test ebx, ebx
jne 0x40dce8
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x40dca0
lea edx, [ebp - 0x14]
mov eax, edi
call sym.__Unwind_RaiseException_Phase2
cmp eax, 7
jne 0x40dd67
mov eax, dword [0x44a540]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40dd3e
mov edx, dword [eax + 0x2c]
test edx, edx
js 0x40dd58
mov edi, dword [eax + 0x2c]
test edi, edi
jne 0x40dd18
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
jmp 0x40dc5d
call sym.___w32_sharedptr_initialize
mov eax, dword [0x44a540]
mov esi, dword [eax + 0x2c]
test esi, esi
jns 0x40dc38
lea esi, [esi]
call sym._fc_key_init_once
mov eax, dword [0x44a540]
mov ebx, dword [eax + 0x2c]
test ebx, ebx
je 0x40dc43
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x30]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40dc46
mov eax, dword [eax + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40dc8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40dc8f
call sym.___w32_sharedptr_initialize
mov eax, dword [0x44a540]
mov edx, dword [eax + 0x2c]
test edx, edx
jns 0x40dc81
nop
lea esi, [esi]
call sym._fc_key_init_once
mov eax, dword [0x44a540]
jmp 0x40dc81
call sym._abort
lea esi, [esi]
lea edi, [edi]
Function at 0x40dd78
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x40de0a
mov eax, dword [0x44a540]
test eax, eax
je 0x40ddfe
mov ebx, dword [eax + 0x2c]
test ebx, ebx
js 0x40de79
mov ecx, dword [eax + 0x2c]
test ecx, ecx
jne 0x40de1f
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call sym.__Unwind_ForcedUnwind_Phase2
cmp eax, 7
jne 0x40de97
mov eax, dword [0x44a540]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x40de6a
mov edx, dword [eax + 0x2c]
test edx, edx
js 0x40de88
mov edi, dword [eax + 0x2c]
test edi, edi
jne 0x40de4b
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call sym.___w32_sharedptr_initialize
mov eax, dword [0x44a540]
jmp 0x40dd9a
mov dword [esp], edi
call sym.__Unwind_SjLj_RaiseException
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x30]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x40ddaf
mov eax, dword [eax + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x40dded
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40dded
call sym.___w32_sharedptr_initialize
mov eax, dword [0x44a540]
jmp 0x40ddd8
call sym._fc_key_init_once
mov eax, dword [0x44a540]
jmp 0x40dda5
call sym._fc_key_init_once
mov eax, dword [0x44a540]
jmp 0x40dde3
call sym._abort
lea esi, [esi]
lea edi, [edi]
Function at 0x415300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init

Function at 0x415c70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], esi
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sym._fread
test eax, eax
mov edx, eax
jle 0x415cc0
movzx eax, byte [esi + eax - 1]
mov dword [ebx + 0x24], eax
mov ebx, dword [ebp - 8]
mov eax, edx
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [ebx + 0x24], 0xffffffff
mov eax, edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x407980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x430358
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00401270
mov dword [esi + 0x30], 0x432780
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esi], 0x4327c4
mov dword [esi + 0x30], 0x4327b8
call fcn.00425edf
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov ecx, dword [esp + 0xc]
add eax, 0x10
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x38], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x419f78
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x419fa6
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x419fad
cmp ebx, dword [eax + 4]
jae 0x419fad
xor eax, eax
jmp 0x41a19d
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x419fbe
xor eax, eax
inc eax
jmp 0x41a19c
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x419fd4
cmp ecx, edx
jae 0x41a119
cmp dword [eax + 4], 0
je 0x419fdd
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x419fc5
cmp dword [ebp + 8], 0
je 0x419fff
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x41a119
cmp eax, esi
jae 0x41a119
mov eax, dword [0x4438f8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x41a024
cmp dword [esi*4 + 0x443900], edi
je 0x41a11d
inc esi
cmp esi, eax
jl 0x41a012
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x4310ec]
test eax, eax
je 0x41a199
cmp dword [ebp - 8], 0x1000000
jne 0x41a199
test byte [ebp - 0xc], 0xcc
je 0x41a0a2
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x41a199
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x41a199
cmp word [eax + 0x18], 0x10b
jne 0x41a199
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x41a199
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x41a0a2
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x41a0a2
test byte [ecx + 0x27], 0x80
jne 0x41a119
push 1
push 0x443940
call dword [0x431320]
test eax, eax
jne 0x419fb6
mov ecx, dword [0x4438f8]
test ecx, ecx
mov edx, ecx
jle 0x41a0d6
lea eax, [ecx*4 + 0x4438fc]
cmp dword [eax], edi
je 0x41a0d6
dec edx
sub eax, 4
test edx, edx
jg 0x41a0ca
test edx, edx
jne 0x41a107
push 0xf
pop ebx
cmp ecx, ebx
jg 0x41a0e3
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x41a0fb
lea eax, [edx*4 + 0x443900]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x41a0e9
cmp ecx, 0x10
jge 0x41a107
inc ecx
mov dword [0x4438f8], ecx
push 0
push 0x443940
call dword [0x431320]
jmp 0x419fb6
xor eax, eax
jmp 0x41a19c
test esi, esi
jle 0x419fb6
mov ebx, dword [0x431320]
push 1
push 0x443940
call ebx
test eax, eax
jne 0x419fb6
cmp dword [esi*4 + 0x443900], edi
je 0x41a173
mov eax, dword [0x4438f8]
lea esi, [eax - 1]
test esi, esi
jl 0x41a161
cmp dword [esi*4 + 0x443900], edi
je 0x41a15d
dec esi
jns 0x41a151
test esi, esi
jge 0x41a171
cmp eax, 0x10
jge 0x41a16c
inc eax
mov dword [0x4438f8], eax
lea esi, [eax - 1]
jmp 0x41a173
je 0x41a18b
xor ecx, ecx
test esi, esi
jl 0x41a18b
lea eax, [ecx*4 + 0x443900]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x41a179
push 0
push 0x443940
call ebx
jmp 0x419fb6
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x424177
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x4241b0
push dword [esi + 0x1c]
call dword [0x431450]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0040a086
push eax
push dword [esi + 0x1c]
call dword [0x431454]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00409f67
pop esi
ret 4
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x425d2b
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x430658
call fcn.00414420
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x425d45
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x1c]
call dword [0x431454]
jmp 0x425d91
call fcn.00425edf
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [0x4312ec]
push dword [ebp + 8]
call dword [0x4312e4]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401da0
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x429791
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x44032c]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [0x4312e4]
mov esi, eax
mov eax, 0x100
cmp esi, eax
ja 0x4297e0
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp + 8]
call dword [0x431454]
cmp eax, esi
jne 0x4297e0
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push eax
call dword [0x431278]
test eax, eax
je 0x4297ec
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x431408]
mov ecx, dword [ebp - 4]
pop esi
call fcn.004136ab
leave
ret 8

Function at 0x42a4ad
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44032c]
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
mov dword [ebp - 4], eax
je 0x42a4fa
push dword [ebp + 8]
call fcn.0042e0b3
mov esi, eax
test esi, esi
je 0x42a522
push edi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [0x43101c]
push esi
mov edi, eax
call dword [0x431020]
xor eax, eax
test edi, edi
sete al
pop edi
jmp 0x42a522
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push 0x431b50
push eax
call dword [0x4313b4]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x4312b8]
mov ecx, dword [ebp - 4]
pop esi
call fcn.004136ab
leave
ret 0xc
Function at 0x42ae77
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1058
call fcn.00413c30
mov edx, dword [ebp + 0xc]
mov eax, dword [0x44032c]
push ebx
xor ecx, ecx
cmp edx, ecx
push esi
mov dword [ebp - 4], eax
push edi
je 0x42af9f
cmp dword [ebp + 8], ecx
je 0x42af9f
mov eax, dword [ebp + 0x18]
mov esi, eax
mov edi, eax
and esi, 0x2e000000
and edi, 0x40000000
test eax, 0x90000000
mov dword [ebp - 0x1054], 0x824
mov dword [ebp - 0x1050], ecx
mov dword [ebp + 0x18], ecx
je 0x42aeed
cmp dword [edx + 0x30], ecx
je 0x42aeed
test eax, 0x2000000
je 0x42aee7
mov dword [ebp + 0x18], 1
jmp 0x42aeed
or edi, 0x80000000
mov ebx, dword [0x4315d4]
push esi
lea eax, [ebp - 0x1054]
push eax
lea eax, [ebp - 0x104c]
push eax
push dword [ebp + 8]
call ebx
test eax, eax
jne 0x42af57
call dword [0x431300]
cmp eax, 0x7a
jne 0x42af9f
mov eax, dword [ebp - 0x1054]
add eax, eax
push eax
call fcn.00425db7
test eax, eax
pop ecx
mov dword [ebp - 0x1058], eax
je 0x42af9f
push esi
lea ecx, [ebp - 0x1054]
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp - 0x1050], 1
call ebx
test eax, eax
jne 0x42af5f
push dword [ebp - 0x1058]
jmp 0x42af99
lea ebx, [ebp - 0x104c]
jmp 0x42af65
mov ebx, dword [ebp - 0x1058]
mov esi, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
push edi
push ebx
call dword [0x4315cc]
cmp dword [ebp + 0x18], edi
mov dword [ebp + 8], eax
je 0x42afbc
push 0x2100000
push edi
push edi
push dword [esi + 0x2c]
call dword [0x431370]
test eax, eax
jge 0x42afb0
cmp dword [ebp - 0x1050], edi
je 0x42af9f
push ebx
call fcn.00425de7
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004136ab
leave
ret 0x14
push dword [esi + 0x2c]
call dword [0x4312e4]
mov dword [esi + 0x30], eax
cmp dword [ebp - 0x1050], edi
je 0x42afcb
push ebx
call fcn.00425de7
pop ecx
mov eax, dword [ebp + 8]
cmp eax, edi
jne 0x42afdd
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0x1000
jmp 0x42afa1
mov cx, word [esi + 0x18]
mov edx, dword [ebp + 0x14]
mov word [edx], cx
mov esi, dword [esi + 0xc]
dec esi
mov ecx, dword [ebp + 0x10]
je 0x42b03b
dec esi
je 0x42b030
dec esi
je 0x42b025
dec esi
je 0x42b01a
dec esi
je 0x42b012
dec esi
je 0x42b00a
dec esi
jne 0x42afd5
mov dword [ecx], 0x1002
jmp 0x42afa1
mov dword [ecx], 0x1006
jmp 0x42afa1
mov dword [ecx], 0x1001
jmp 0x42afa1
mov dword [ecx], 0x100b
jmp 0x42afa1
mov dword [ecx], 3
jmp 0x42afa1
mov dword [ecx], 2
jmp 0x42afa1
mov dword [ecx], 1
jmp 0x42afa1

Function at 0x42b564
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x42b58d
call fcn.0042cd32
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [0x4315b8]
test eax, eax
mov dword [esi + 8], eax
jne 0x42b5b0
push eax
push dword [esi + 4]
call fcn.0042b4f1
push esi
push eax
mov ecx, 0x4431bc
call fcn.0042b37d
mov eax, esi
pop esi
pop ebp
ret 0x18