joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40582a
Capabilities:
Write file on windows

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x405846
Capabilities:
Write file on windows

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al

Function at 0x40586c
Capabilities:
Write file on windows

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
Function at 0x405a00
Capabilities:
Write file on windows

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
invalid

Function at 0x405a2f
Capabilities:
Write file on windows

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
invalid
Function at 0x405a78
Capabilities:
Write file on windows

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
invalid

Function at 0x405aa7
Capabilities:
Write file on windows

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push eax
push esi
Function at 0x405ad6
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, 0x421a98
push 0x4093c8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test esi, esi
mov ebx, 0x400
je 0x405b24
push 1
push 0
push esi
call fcn.00405a00
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
push esi
call ebp
test eax, eax
je 0x405c43
cmp eax, ebx
jg 0x405c43
mov esi, 0x421e98
push ebx
push esi
push dword [esp + 0x1c]
call ebp
test eax, eax
je 0x405c43
cmp eax, ebx
jg 0x405c43
push esi
push edi
push str._s_s_r_n
push 0x421698
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x423710]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405daf
push 4
push 0xc0000000
push esi
call fcn.00405a00
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x405c43
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405c3c
push edi
push esi
push ebp
call fcn.00405a78
test eax, eax
je 0x405c3c
push str._Rename__r_n
push esi
call 0x405965
test eax, eax
jne 0x405bda
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x405c0f
add eax, 0xa
push 0x4093b0
push eax
call 0x405965
mov ebp, eax
test ebp, ebp
je 0x405c0b
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x405bfc
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x405bf6
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x405c11
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x421698
push eax
call fcn.004059bb
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.00405aa7
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x405c48
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x405c6b
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405ad6
pop ecx
pop ecx
inc dword [0x423790]
ret 8
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x40633c
pop dword [ebp - 0x14]
mov eax, 0xbf0e0eea
add eax, 0x41325452
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xcbcfc53
sub dword [ebp - 0x24], 0xbe6ab708
mov dword [ebp - 0x20], 0x5d55f9b4
add dword [ebp - 0x20], 0xd4dd5291
mov dword [ebp - 0x1c], 0x948cc84a
add dword [ebp - 0x1c], 0xb7bf7be4
mov dword [ebp - 0x18], 0xa45a97a0
sub dword [ebp - 0x18], 0xa45a97a0
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x70ec3c68
sub dword [ebp - 0x24], 0xfc79d312
mov dword [ebp - 0x20], 0x5c4a63d5
sub dword [ebp - 0x20], 0x1ade0260
mov dword [ebp - 0x1c], 0xfa67b507
sub dword [ebp - 0x1c], 0x96f8489b
mov dword [ebp - 0x18], 0xb04ff4df
add dword [ebp - 0x18], 0x4fb00b21
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x8b241062
add eax, 0x751c609e
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3b655
push 0
call eax
mov ecx, 0xc7864750
sub ecx, 0xc785ec34
mov edi, eax
mov esi, 0x63f11948
sub esi, 0x63b01948
add esi, dword [ebp - 0x14]
mov ebx, 0x5cfacd73
xor dword [ebp - 8], 0xb5eb52db
mov edx, dword [esi]
xor dword [ebp - 0xc], esi
sub edx, ebx
sub dword [ebp - 0x10], 0x69aa5653
mov dword [edi], edx
mov dword [ebp - 8], 0xde4ab26c
add edi, 0x322a73e7
add edi, 0xcdd58c1d
add esi, 0x2c85d4e4
sub esi, 0x2c85d4e0
loop 0x406453
add eax, 0x15f43
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.0040632d
jmp 0x406676

Function at 0xe172b8
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe172c2
pushal
call 0xe172c8
pop ebp
sub ebp, 0x10
sub ebp, 0xa172b8
jmp 0xe172de
mov eax, 0xa172b8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ce
mov edx, 0xf67944d5
xor byte [eax], dl
inc eax
dec ecx
jne 0xe172f5
jmp 0xe17308
pop esi
sbb byte [esi + 0x5c], bl
jmp 0x55b748e6
Function at 0x401ba0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401be8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 8], esi
call fcn.0044afe0
neg esi
sbb esi, esi
mov dword [esp + 0xc], eax
test esi, fcn.00411040
je 0x401be8
lea eax, [esp + 8]
push eax
mov edx, 0x49a368
call fcn.00401950
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403270
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a0
mov eax, dword [0x4bd514]
xor eax, esp
mov dword [esp + 0x19c], eax
push 0x4c5a98
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x4032b3
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
push 0x4c5a9c
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp byte [ebp + 0xc], 0
je 0x4032ed
push 0
push 0x4c5a9c
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
test eax, eax
je 0x4032ed
mov dword [esp], eax
call fcn.0044afe0
mov ecx, fcn.00411040
mov dword [esp + 4], eax
test ecx, ecx
je 0x4032ed
lea edx, [esp]
push edx
mov edx, str.winsock
call fcn.00401950
mov ecx, dword [esp + 0x19c]
mov eax, dword [ebp + 8]
xor ecx, esp
call fcn.0046544a
mov esp, ebp
pop ebp
ret 8
Function at 0x409790
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48d498
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4bd514]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [0x4bd514]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x24]
mov edi, ecx
mov ecx, dword [ebp + 0x20]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
mov dword [esp + 0xc], ecx
push eax
mov ecx, esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 0
call fcn.004066e0
lea ecx, [esp + 0x10]
push ecx
push ecx
push eax
mov dword [esp + 0x6c], 0
mov esi, dword [esi + 0x10]
push esi
lea edx, [ebp + 0x14]
push edx
lea eax, [ebp + 0xc]
push eax
lea ecx, [esp + 0x48]
push ecx
push edi
call fcn.0040ac00
add esp, 0x1c
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.0044566f
mov dword [esp + 0x34], eax
mov dword [esp + 0x70], 0xffffffff
mov eax, dword [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x28], edx
test eax, eax
je 0x409887
push 0
lea ecx, [esp + 0x30]
mov edi, eax
call fcn.004455c6
mov eax, dword [edi + 4]
test eax, eax
jbe 0x409865
cmp eax, 0xffffffff
jae 0x409865
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x2c]
and esi, edi
call fcn.004455ee
test esi, esi
je 0x409887
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [ebp + 0x10], 0
jne 0x409895
lea ecx, [ebp + 0xc]
call fcn.0040cc30
cmp byte [ebp + 0x18], 0
jne 0x4098a3
lea ecx, [ebp + 0x14]
call fcn.0040cc30
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4098d7
cmp dword [ebp + 0x14], ecx
je 0x4098dd
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x30]
cmp dword [esp + 0x14], edx
je 0x4098e6
cmp dword [esp + 0x10], 0
jne 0x4098e6
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [eax], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 4], edx
jmp 0x4098e9
cmp dword [ebp + 0x14], 0
je 0x4098af
mov eax, dword [esp + 0xc]
or dword [eax], 1
jmp 0x4098b3
or dword [eax], 2
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0046544a
mov esp, ebp
pop ebp
ret 0x20
Function at 0x409920
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48d498
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x4bd514]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [0x4bd514]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x24]
mov edi, ecx
mov ecx, dword [ebp + 0x20]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
mov dword [esp + 0xc], ecx
push eax
mov ecx, esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], 0
call fcn.004066e0
lea ecx, [esp + 0x10]
push ecx
push ecx
push eax
mov dword [esp + 0x6c], 0
mov esi, dword [esi + 0x10]
push esi
lea edx, [ebp + 0x14]
push edx
lea eax, [ebp + 0xc]
push eax
lea ecx, [esp + 0x48]
push ecx
push edi
call fcn.0040ac00
add esp, 0x1c
push eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.00445ab0
mov dword [esp + 0x34], eax
mov dword [esp + 0x70], 0xffffffff
mov eax, dword [esp + 0x30]
add esp, 0x10
mov dword [esp + 0x28], edx
test eax, eax
je 0x409a17
push 0
lea ecx, [esp + 0x30]
mov edi, eax
call fcn.004455c6
mov eax, dword [edi + 4]
test eax, eax
jbe 0x4099f5
cmp eax, 0xffffffff
jae 0x4099f5
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
not esi
lea ecx, [esp + 0x2c]
and esi, edi
call fcn.004455ee
test esi, esi
je 0x409a17
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
cmp byte [ebp + 0x10], 0
jne 0x409a25
lea ecx, [ebp + 0xc]
call fcn.0040cc30
cmp byte [ebp + 0x18], 0
jne 0x409a33
lea ecx, [ebp + 0x14]
call fcn.0040cc30
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x409a67
cmp dword [ebp + 0x14], ecx
je 0x409a6d
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x30]
cmp dword [esp + 0x14], edx
je 0x409a76
cmp dword [esp + 0x10], 0
jne 0x409a76
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [eax], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 4], edx
jmp 0x409a79
cmp dword [ebp + 0x14], 0
je 0x409a3f
mov eax, dword [esp + 0xc]
or dword [eax], 1
jmp 0x409a43
or dword [eax], 2
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0046544a
mov esp, ebp
pop ebp
ret 0x20
Function at 0x40a0c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c11b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4bd514]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.00445605
push 4
mov dword [ebp - 4], 0
call fcn.0043abde
mov edi, eax
add esp, 4
test edi, edi
je 0x40a13c
call fcn.00445429
mov dword [edi], eax
call fcn.004452fe
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.004455c6
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40a132
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.004455ee
jmp 0x40a13e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40e180
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx]
mov edx, dword [esi + 0x3c]
mov ecx, dword [ecx + 4]
push edi
mov edi, dword [esi + 0x40]
push 0x90
push edi
push edx
sub ecx, edi
sub eax, edx
push ecx
push eax
mov dword [esi + 0x34], eax
mov eax, dword [esi + 4]
push 0xffffffffffffffff
push eax
mov dword [esi + 0x38], ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
movzx ecx, byte [esi + 0x30]
mov edx, dword [esi + 4]
push 3
push ecx
push 0xffffff
push edx
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov eax, dword [esi + 4]
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 4]
push 0
push 0x14
push 0xdf
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
push 0
call fcn.00465c16
add esp, 4
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], edx
pop edi
ret
Function at 0x40e480
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov edi, ecx
mov ebx, eax
call dword [sym.imp.sfhtml.dll_HTMLayout_UseElement]
mov esi, eax
neg esi
sbb esi, esi
lea eax, [ebp - 4]
push eax
not esi
push str.close_button
and esi, ebx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.sfhtml.dll_HTMLayoutGetAttributeByName]
cmp dword [ebp - 4], 0
je 0x40e4e1
mov ecx, dword [edi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [edi + 0x28]
push edi
push 0
push 0x464
push edx
mov dword [edi + 0x2c], 6
call dword [sym.imp.USER32.dll_PostMessageW]
mov edi, dword [sym.imp.sfhtml.dll_HTMLayout_UnuseElement]
test esi, esi
je 0x40e4ee
push esi
call edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x40e4f8
push eax
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40e620
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491060
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4bd514]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push str.href
lea esi, [ebp - 0x18]
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.0040ddb0
sub esp, 0x1c
mov byte [ebp - 4], 1
mov edi, esp
mov ecx, eax
mov dword [ebp - 0x10], esp
call fcn.0040dc50
call fcn.0040e510
mov eax, dword [ebp - 0x18]
mov esi, dword [sym.imp.sfhtml.dll_HTMLayout_UnuseElement]
add esp, 0x1c
push eax
call esi
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push str.close_button
push edx
mov dword [ebp - 0x10], 0
call dword [sym.imp.sfhtml.dll_HTMLayoutGetAttributeByName]
cmp dword [ebp - 0x10], 0
je 0x40e6cd
mov eax, dword [ebx + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebx + 0x28]
push ebx
push 0
push 0x464
push ecx
mov dword [ebx + 0x2c], 6
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 8]
test eax, eax
je 0x40e6d7
push eax
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8