joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e5f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x58093b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x218]
mov dword fs:[0], eax
call fcn.0053e3f5
mov ecx, dword [eax + 4]
call fcn.00538a3c
push 0
mov dword [esp + 0x224], 0
call fcn.0046d4c0
push 0
push 0x20
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x46e66b
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.0046d690
lea ecx, [esp + 0xb]
mov dword [esp + 0x220], 0xffffffff
call fcn.00424530
mov ecx, dword [esp + 0x218]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00552101
add esp, 0x220
ret

Function at 0x46e6b0
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x214
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x20c], eax
push 0
push 0
push 0x2a
push 0
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 1
call fcn.0046d4c0
push 0
push 0x21
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x46e6fe
push 0
push 0
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0046d690
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00552101
add esp, 0x214
ret
Function at 0x46ea20
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5808fb
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x214]
mov dword fs:[0], eax
call fcn.0053e3f5
mov ecx, dword [eax + 4]
call fcn.00538a3c
lea eax, [esp + 8]
push eax
push 0x104
mov dword [esp + 0x224], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x46ea93
push 0
push 1
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0046d690
lea ecx, [esp + 7]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00424530
mov ecx, dword [esp + 0x214]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00552101
add esp, 0x21c
ret

Function at 0x46ead0
Capabilities:
Delete registry key
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x208], eax
push 0
push 8
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x46eb09
push 0
push 0
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0046d690
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00552101
add esp, 0x20c
ret

Function at 0x46eb70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x208], eax
push 0
push 0x13
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x46eba9
push 0
push 0
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0046d690
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00552101
add esp, 0x20c
ret
Function at 0x46ebc0
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x57bdd8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
call fcn.00530e1f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x46ebfe
push 0x80004005
call fcn.00401f70
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov esi, 1
push esi
lea ecx, [esp + 0x14]
push str.Machine_d
push ecx
call fcn.00405480
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
push str.SoftwareMicrosoftTelnet
push SysReAllocStringLen
call edi
push esi
lea eax, [esp + 0x14]
push str.Service_d
push eax
call fcn.00405480
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push ecx
push str.SoftwareMicrosoftTelnet
push SysReAllocStringLen
call edi
push esi
lea edx, [esp + 0x14]
push str.TermType_d
push edx
call fcn.00405480
mov ebx, dword [esp + 0x1c]
add esp, 0xc
push ebx
push str.SoftwareMicrosoftTelnet
push SysReAllocStringLen
call edi
add esi, 1
cmp esi, 8
jle 0x46ec21
push str.LastMachine
push str.SoftwareMicrosoftTelnet
push SysReAllocStringLen
call edi
push str.LastService
push str.SoftwareMicrosoftTelnet
push SysReAllocStringLen
call edi
push str.LastTermType
push str.SoftwareMicrosoftTelnet
push SysReAllocStringLen
call edi
lea eax, [ebx - 0x10]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46ecec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x46ed00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x214], eax
lea eax, [esp + 4]
push eax
push 0x591c28
push 1
push 0
push str._J7_
mov dword [esp + 0x18], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x46ed57
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 8]
add eax, 0xfffffffe
mov edi, edi
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x46ed70
mov ecx, dword [str.History]
mov edx, dword [0x5a9b48]
mov dword [eax], ecx
mov ecx, dword [0x5a9b4c]
mov dword [eax + 4], edx
mov edx, dword [0x5a9b50]
mov dword [eax + 8], ecx
mov cx, word [0x5a9b54]
push 1
mov dword [eax + 0xc], edx
push 0
lea edx, [esp + 0x10]
mov word [eax + 0x10], cx
push edx
mov ecx, esi
call fcn.0046d690
push 0
push 0x22
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x46eddf
push 1
push 0
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0046d690
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00552101
mov esp, ebp
pop ebp
ret
Function at 0x46ee50
Capabilities:
Link many functions at runtime

Disassembly:
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.TGHistoryDllTest
push eax
mov dword [esi], eax
call edi
mov ecx, dword [esi]
push str.TGHistoryCreate
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi]
push str.TGHistoryDelete
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi]
push str.TGHistoryCreateWnd
push eax
call edi
mov ecx, dword [esi]
push str.TGHistoryMoveWindow
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi]
push str.TGHistorySetFillType
push edx
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi]
push str.TGHistorySetLineColor
push eax
call edi
mov ecx, dword [esi]
push str.TGHistorySearchKeywordChange
push ecx
mov dword [esi + 0x2c], eax
call edi
mov edx, dword [esi]
push str.TGHistorySetIconDir
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x1c], eax
mov eax, dword [esi]
push str.TGHistorySetCallBack
push eax
call edi
mov ecx, dword [esi]
push str.TGHistoryKillThread
push ecx
mov dword [esi + 0x28], eax
call edi
mov edx, dword [esi]
push str.TGHistoryPreTranslateMsg
push edx
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x30], eax
mov eax, dword [esi]
push str.TGHistorySetAppName
push eax
call edi
mov ecx, dword [esi]
push str.TGHistoryGetMaxHits
push ecx
mov dword [esi + 0x34], eax
call edi
cmp dword [esi], 0
mov dword [esi + 0x38], eax
pop edi
je 0x46ef72
cmp dword [esi + 4], 0
je 0x46ef72
cmp dword [esi + 8], 0
je 0x46ef72
cmp dword [esi + 0x10], 0
je 0x46ef72
cmp dword [esi + 0x14], 0
je 0x46ef72
cmp dword [esi + 0xc], 0
je 0x46ef72
cmp dword [esi + 0x28], 0
je 0x46ef72
test eax, eax
je 0x46ef72
cmp dword [esi + 0x18], 0
je 0x46ef72
cmp dword [esi + 0x1c], 0
je 0x46ef72
cmp dword [esi + 0x20], 0
je 0x46ef72
cmp dword [esi + 0x24], 0
je 0x46ef72
cmp dword [esi + 0x2c], 0
je 0x46ef72
cmp dword [esi + 0x30], 0
je 0x46ef72
cmp dword [esi + 0x34], 0
je 0x46ef72
mov eax, 1
ret
xor eax, eax
ret
Function at 0x487b10
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x585678
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
cmp dword [ebp + 0x90f8], 0
jne 0x487bbf
lea ecx, [esp + 0x14]
call fcn.00538d38
lea esi, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.00460ed0
mov ebx, esi
mov edi, 0x5f23cc
call fcn.004aacf0
mov ebx, 0x5f29cc
call fcn.00453560
push str.TGSearch
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
mov dword [ebp + 0x9100], eax
je 0x487bae
lea eax, [ebp + 0x90fc]
push eax
push 0
push ebp
push 0x487c60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 0x90f8], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.00538dd6
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x489fb0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x57b877
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
push ebp
push edi
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x240]
xor edi, edi
push edi
push edi
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x48a172
push esi
lea ecx, [esp + 0x14]
call fcn.00402390
lea ebx, [esp + 0x10]
mov dword [esp + 0x238], edi
call fcn.0045f6a0
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x20]
call fcn.00402390
push 0x5958a8
push eax
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x244], 1
call fcn.00401ba0
mov ecx, ebx
push ecx
push eax
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x250], 2
call fcn.00401ae0
push str..url
push eax
lea eax, [esp + 0x40]
mov bl, 3
push eax
mov byte [esp + 0x25c], bl
call fcn.00401ba0
add esp, 0x24
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], 4
call fcn.00402310
mov byte [esp + 0x238], bl
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48a0b4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x238], 2
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48a0dc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x238], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48a104
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x238], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48a12c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
push ebp
push ecx
call fcn.004b9c80
add esp, 8
test eax, eax
je 0x48a143
mov edi, 1
mov dword [esp + 0x238], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48a16e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test edi, edi
jne 0x48a180
push 0
push 0
push 0x5ad560
call fcn.00539414
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.00552101
add esp, 0x22c
ret 4
Function at 0x48b8f0
Capabilities:
Enumerate threads
Terminate thread

Disassembly:
sub esp, 0x130
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x12c], eax
push esi
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.ZwQueryInformationThread
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 4
mov dword [0x5f1948], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 8], esi
je 0x48ba20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
push esi
mov dword [esp + 0x1c], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x48ba20
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenThread]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ecx]
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x1c]
je 0x48ba06
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x2c], ecx
jne 0x48ba06
push eax
push 0
push 0x1f03ff
call ebx
mov esi, eax
test esi, esi
je 0x48ba06
push 0
push 4
lea edx, [esp + 0x18]
push edx
push 9
push esi
call dword [0x5f1948]
mov ecx, dword [esp + 0x10]
push 0xff
lea eax, [esp + 0x40]
push eax
push ecx
call edi
push eax
call sub.PSAPI.DLL_GetMappedFileNameA
lea edx, [esp + 0x3c]
push 0x5ad5d4
push edx
call fcn.00554720
add esp, 8
test eax, eax
jne 0x48b9f9
lea eax, [esp + 0x3c]
push 0x5ad5e4
push eax
call fcn.00554720
add esp, 8
test eax, eax
je 0x48ba06
push 0
push esi
call ebp
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x48b980
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x130]
pop esi
xor ecx, esp
call fcn.00552101
add esp, 0x130
ret
Function at 0x48d960
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5866a0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
push str._binSnapShot.exe
lea eax, [esp + 8]
push 0x5f2878
push eax
call fcn.00401ba0
add esp, 0xc
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 4]
call fcn.004600b0
test eax, eax
je 0x48d9ee
mov ecx, dword [esp + 4]
push 5
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x48dab1
push str.TencentTTPlugins1SnapShotSnapShot.exe
lea ecx, [esp + 0xc]
push 0x5f23ec
push ecx
call fcn.00401ba0
add esp, 0xc
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 1
call fcn.00402310
mov byte [esp + 0x18], 0
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48da39
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 4]
call fcn.004600b0
test eax, eax
je 0x48da5e
mov ecx, dword [esp + 4]
push 5
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [esi + 0x20]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0
push 0x5add30
call fcn.00539414
mov eax, dword [esi + 0x568c]
push 0
push 0
push 0xffffffffffffffff
push 1
push 1
push 0
push 0
push str.http:__www.tgsoso.com_faq.htm
push eax
call fcn.004d7180
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48dabd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x49d7e0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x108
mov eax, dword [0x5e95e0]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xff
lea eax, [esp + 4]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x49d82f
lea ecx, [esp]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x49d82f
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
mov ecx, 0x5f2c58
call fcn.004055e0
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00552101
add esp, 0x108
ret
Function at 0x4a19e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x577458
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], vtable.CBitmap.0
lea esi, [ebp + 8]
mov edi, 1
mov dword [esp + 0x34], ebx
call fcn.00459ef0
xor eax, eax
cmp dword [ebp + 0x10], ebx
jle 0x4a1a52
cmp eax, ebx
jl 0x4a1b18
cmp eax, dword [esi + 8]
jge 0x4a1b18
mov ecx, dword [esi + 4]
lea ecx, [ecx + eax*4]
add eax, 1
mov dword [ecx], ebx
cmp eax, dword [ebp + 0x10]
jl 0x4a1a31
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
mov ebx, str.BtnSearchLane.bmp
mov ecx, 0x5f2dc8
call fcn.004e6bd0
test eax, eax
je 0x4a1ad9
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
push 0
cdq
push 0
sub eax, edx
push 0x19
mov ebx, eax
push ecx
sar ebx, 1
push ebx
mov ecx, ebp
call fcn.0053d09b
mov edx, dword [esp + 0x1c]
mov eax, dword [ebp + 4]
push 0xff00ff
push edx
push eax
call fcn.0053e3f5
mov eax, dword [eax + 0x78]
mov ecx, dword [eax]
call fcn.00443530
mov ecx, dword [esp + 0x24]
lea edi, [ebp + 0x1c]
mov dword [edi + 0x40], ecx
lea ecx, [ebp + 0x20]
mov dword [edi + 0x24], 0
mov dword [edi], ebp
mov dword [edi + 0x3c], ebx
mov eax, dword [ecx + 8]
push 0
push eax
call fcn.0053989a
cmp dword [esi + 8], 0
jle 0x4a1b18
mov esi, dword [esi + 4]
mov dword [esi], edi
mov ebp, dword [ebp + 0x10]
xor eax, eax
test ebp, ebp
jle 0x4a1ae9
add eax, 1
cmp eax, ebp
jl 0x4a1ae2
mov dword [esp + 0x34], 0xffffffff
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], vtable.CGdiObject.0
call fcn.00537399
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
call fcn.00530cad
int3
Function at 0x4a2c90
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x577428
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
mov eax, dword [0x5e95e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
cmp dword [esp + 0x34], 2
mov ebx, dword [edi]
jne 0x4a2cc4
mov ebx, dword [edi + 8]
sub ebx, 6
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], vtable.CPen.0
mov eax, dword [esp + 0x30]
mov dword [esp + 0x28], ecx
mov eax, dword [eax + 4]
push eax
push 1
push ecx
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x14]
call fcn.00537346
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0053741e
mov edx, dword [edi + 4]
push edx
mov dword [esp + 0x34], eax
lea ebp, [ebx + 2]
push ebp
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00536d88
mov ecx, dword [edi + 0xc]
push ecx
push ebp
mov ecx, esi
call fcn.00536a70
mov edx, dword [edi + 4]
push edx
lea ebp, [ebx + 3]
push ebp
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00536d88
mov ecx, dword [edi + 0xc]
push ecx
push ebp
mov ecx, esi
call fcn.00536a70
mov edx, dword [edi + 4]
add edx, 1
push edx
lea ebp, [ebx + 1]
push ebp
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00536d88
mov ecx, dword [edi + 4]
add ecx, 1
push ecx
lea eax, [ebx + 5]
push eax
mov ecx, esi
call fcn.00536a70
mov edx, dword [edi + 4]
push edx
push ebx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00536d88
mov ecx, dword [edi + 4]
lea eax, [ebx + 6]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x3c], eax
call fcn.00536a70
mov edx, dword [edi + 0xc]
sub edx, 1
push edx
push ebp
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00536d88
mov ecx, dword [edi + 0xc]
sub ecx, 1
push ecx
lea eax, [ebx + 5]
push eax
mov ecx, esi
call fcn.00536a70
mov edx, dword [edi + 0xc]
push edx
push ebx
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00536d88
mov ecx, dword [edi + 0xc]
mov edx, dword [esp + 0x34]
push ecx
push edx
mov ecx, esi
call fcn.00536a70
mov eax, dword [esp + 0x30]
push eax
mov ecx, esi
call fcn.0053741e
lea ecx, [esp + 0x10]
call fcn.00537399
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.CGdiObject.0
call fcn.00537399
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x4a4b40
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esi]
mov ecx, dword [esi + 8]
push ebx
push ebp
push edi
mov edi, dword [esp + 0x18]
push eax
push 1
push ecx
push edi
call fcn.00555bc1
mov ecx, dword [esi + 8]
add esp, 0x10
cmp eax, 1
mov eax, ecx
sete bl
cdq
idiv dword [esi + 0x18]
test bl, bl
mov byte [esp + 0xe], bl
mov dword [esi + 0x1c], eax
je 0x4a4c94
mov edx, dword [esi + 0x24]
add dword [esi + 0x14], ecx
push 0xffffffffffffffff
push eax
push 0x18
push ecx
mov eax, esp
mov dword [eax], edx
push ecx
mov eax, esp
mov dword [eax], str.read
lea eax, [esi + 0x20]
push eax
mov dword [esp + 0x28], eax
call fcn.004a3070
mov ecx, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
add esp, 0x18
xor ebp, ebp
xor eax, eax
cmp ecx, 1
sete byte [esp + 0xf]
test ebx, ebx
je 0x4a4c4a
xor edx, edx
sub ebx, 1
cmp byte [esp + 0xf], dl
je 0x4a4bcc
cmp byte [edi], dl
jmp 0x4a4bd0
cmp word [edi], 0
sete dl
test edx, edx
je 0x4a4bfc
test eax, eax
je 0x4a4bf3
cmp edi, eax
je 0x4a4bf3
imul ecx, ebp
mov edx, edi
sub edx, eax
push edx
push eax
sub eax, ecx
push eax
call fcn.00555260
add esp, 0xc
mov ecx, dword [esi + 0x18]
lea eax, [ecx + edi]
add ebp, 1
add edi, ecx
test ebx, ebx
jne 0x4a4bbd
test eax, eax
je 0x4a4c1f
cmp edi, eax
je 0x4a4c1f
mov ecx, dword [esi + 0x18]
imul ecx, ebp
sub edi, eax
push edi
push eax
sub eax, ecx
push eax
call fcn.00555260
add esp, 0xc
test ebp, ebp
je 0x4a4c4a
mov edx, dword [esp + 0x10]
push 0xffffffffffffffff
push ebp
push 1
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
push edx
mov dword [eax], str.nulls_removed
call fcn.004a3070
add esp, 0x18
sub dword [esi + 0x1c], ebp
cmp dword [esi + 0x18], 1
jle 0x4a4c87
test byte [esi + 4], 0x80
je 0x4a4c87
mov eax, dword [esi + 0x1c]
mov ecx, dword [esp + 0x18]
call fcn.004a3cf0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
mov dword [eax], 0
push ecx
mov eax, esp
mov dword [eax], str.endian_swap
mov eax, dword [esp + 0x24]
push eax
call fcn.004a3070
add esp, 0x18
mov al, byte [esp + 0xe]
pop edi
pop ebp
pop ebx
add esp, 8
ret 4
push esi
call fcn.004a4990
pop edi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret 4