joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4867a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9f13
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x55b090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x274], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x278], esi
push 0x51a9b8
mov dword [ebp - 0x270], 0
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__18]
push 0x208
lea eax, [ebp - 0x26c]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x270], 1
call sub.VCRUNTIME140.dll_memset
mov eax, 0x64
mov dword [ebp - 0x56], 0x2e0032
mov word [ebp - 0x52], ax
add esp, 0xc
mov eax, 0x4b
mov dword [ebp - 0x5e], 0x65006e
mov word [ebp - 0x64], ax
xor eax, eax
mov word [ebp - 0x4c], ax
mov byte [ebp - 0x12], al
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x62], 0x720065
push eax
mov dword [ebp - 0x50], 0x6c006c
mov dword [ebp - 0x5a], 0x33006c
mov word [ebp - 0x1f], 0x7564
mov word [ebp - 0x24], 0x6547
mov word [ebp - 0x1c], 0x4665
mov word [ebp - 0x19], 0x656c
mov word [ebp - 0x21], 0x6f4d
mov dword [ebp - 0x16], 0x57656d61
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x1d], 0x6c
mov byte [ebp - 0x17], 0x4e
mov byte [ebp - 0x22], 0x74
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4868ba
push 0x104
lea ecx, [ebp - 0x26c]
push ecx
push 0
call eax
mov eax, 0x64
mov dword [ebp - 0x48], 0x680053
mov word [ebp - 0x38], ax
xor eax, eax
mov word [ebp - 0x32], ax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x3c], 0x2e0069
mov dword [ebp - 0x40], 0x700061
mov dword [ebp - 0x44], 0x77006c
mov dword [ebp - 0x36], 0x6c006c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x486972
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1b], 0x4e656c69
push eax
push edi
mov dword [ebp - 0x24], 0x68746150
mov dword [ebp - 0x20], 0x646e6946
mov word [ebp - 0x14], 0x57
mov word [ebp - 0x17], 0x6d61
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x1c], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48696b
lea ecx, [ebp - 0x26c]
push ecx
call eax
push eax
mov ecx, esi
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
xor eax, eax
mov dword [ebp - 0x2c], 0x650078
mov word [ebp - 0x28], ax
mov ecx, esi
push 0x51a9b8
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x65002e
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00482396
mov esp, ebp
pop ebp
ret
Function at 0x4870d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed133
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x55b090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x274], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x278], esi
push 0x51a9b8
mov dword [ebp - 0x270], 0
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__18]
push 0x208
lea eax, [ebp - 0x26c]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x270], 1
call sub.VCRUNTIME140.dll_memset
mov eax, 0x64
mov dword [ebp - 0x56], 0x2e0032
mov word [ebp - 0x52], ax
add esp, 0xc
mov eax, 0x4b
mov dword [ebp - 0x5e], 0x65006e
mov word [ebp - 0x64], ax
xor eax, eax
mov word [ebp - 0x4c], ax
mov byte [ebp - 0x12], al
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x62], 0x720065
push eax
mov dword [ebp - 0x50], 0x6c006c
mov dword [ebp - 0x5a], 0x33006c
mov word [ebp - 0x1f], 0x7564
mov word [ebp - 0x24], 0x6547
mov word [ebp - 0x1c], 0x4665
mov word [ebp - 0x19], 0x656c
mov word [ebp - 0x21], 0x6f4d
mov dword [ebp - 0x16], 0x57656d61
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x1d], 0x6c
mov byte [ebp - 0x17], 0x4e
mov byte [ebp - 0x22], 0x74
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4871ea
push 0x104
lea ecx, [ebp - 0x26c]
push ecx
push 0
call eax
mov eax, 0x64
mov dword [ebp - 0x48], 0x680053
mov word [ebp - 0x38], ax
xor eax, eax
mov word [ebp - 0x32], ax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x3c], 0x2e0069
mov dword [ebp - 0x40], 0x700061
mov dword [ebp - 0x44], 0x77006c
mov dword [ebp - 0x36], 0x6c006c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4872a2
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1b], 0x4e656c69
push eax
push edi
mov dword [ebp - 0x24], 0x68746150
mov dword [ebp - 0x20], 0x646e6946
mov word [ebp - 0x14], 0x57
mov word [ebp - 0x17], 0x6d61
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x1c], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48729b
lea ecx, [ebp - 0x26c]
push ecx
call eax
push eax
mov ecx, esi
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
xor eax, eax
mov dword [ebp - 0x2c], 0x650078
mov word [ebp - 0x28], ax
mov ecx, esi
push 0x51a9b8
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x65002e
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00482396
mov esp, ebp
pop ebp
ret
Function at 0x4874c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f34f3
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x55b090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x274], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x278], esi
push 0x51a9b8
mov dword [ebp - 0x270], 0
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__18]
push 0x208
lea eax, [ebp - 0x26c]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x270], 1
call sub.VCRUNTIME140.dll_memset
mov eax, 0x64
mov dword [ebp - 0x56], 0x2e0032
mov word [ebp - 0x52], ax
add esp, 0xc
mov eax, 0x4b
mov dword [ebp - 0x5e], 0x65006e
mov word [ebp - 0x64], ax
xor eax, eax
mov word [ebp - 0x4c], ax
mov byte [ebp - 0x12], al
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x62], 0x720065
push eax
mov dword [ebp - 0x50], 0x6c006c
mov dword [ebp - 0x5a], 0x33006c
mov word [ebp - 0x1f], 0x7564
mov word [ebp - 0x24], 0x6547
mov word [ebp - 0x1c], 0x4665
mov word [ebp - 0x19], 0x656c
mov word [ebp - 0x21], 0x6f4d
mov dword [ebp - 0x16], 0x57656d61
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0x1d], 0x6c
mov byte [ebp - 0x17], 0x4e
mov byte [ebp - 0x22], 0x74
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4875da
push 0x104
lea ecx, [ebp - 0x26c]
push ecx
push 0
call eax
mov eax, 0x64
mov dword [ebp - 0x48], 0x680053
mov word [ebp - 0x38], ax
xor eax, eax
mov word [ebp - 0x32], ax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x3c], 0x2e0069
mov dword [ebp - 0x40], 0x700061
mov dword [ebp - 0x44], 0x77006c
mov dword [ebp - 0x36], 0x6c006c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x487692
lea eax, [ebp - 0x24]
mov dword [ebp - 0x1b], 0x4e656c69
push eax
push edi
mov dword [ebp - 0x24], 0x68746150
mov dword [ebp - 0x20], 0x646e6946
mov word [ebp - 0x14], 0x57
mov word [ebp - 0x17], 0x6d61
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x1c], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48768b
lea ecx, [ebp - 0x26c]
push ecx
call eax
push eax
mov ecx, esi
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
xor eax, eax
mov dword [ebp - 0x2c], 0x650078
mov word [ebp - 0x28], ax
mov ecx, esi
push 0x51a9b8
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x65002e
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__13]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00482396
mov esp, ebp
pop ebp
ret
Function at 0x48a480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x48a605
cmp dword [edi + 0x18], 0
je 0x48a605
cmp dword [edi + 0x7c], 0
je 0x48a4a6
call fcn.00416d50
lea eax, [esp + 0xc]
mov ecx, edi
push eax
lea eax, [esp + 0xc]
push eax
lea edx, [esp + 0x18]
call fcn.004455c0
add esp, 8
test eax, eax
je 0x48a4cd
pop edi
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push ebp
mov ebp, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push esi
push 0x84
call ebp
mov esi, eax
add esp, 4
test esi, esi
je 0x48a514
push 0x4000
call ebp
mov ecx, dword [esp + 0x14]
add esp, 4
mov dword [esi + 0x44], ecx
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], 0
test eax, eax
jne 0x48a521
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop esi
pop ebp
pop edi
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], 0
mov ecx, dword [edi + 0x34]
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], 0
mov eax, dword [edi + 0x34]
mov dword [esi + 0x64], eax
mov eax, dword [edi]
mov dword [esi + 0x60], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], 0
test ecx, ecx
je 0x48a57c
lea ecx, [esi + 4]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
call fcn.004d03e0
test eax, eax
jne 0x48a57c
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x5c], eax
mov al, byte [edi + 0x30]
and al, 1
mov byte [esi + 0x6c], al
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x48a59f
mov al, byte [edi + 0x39]
jmp 0x48a5a2
mov al, byte [edi + 0x3f]
mov byte [esi + 0x80], al
mov ecx, 0xc
xor eax, eax
cmp byte [esi + 0x6c], al
cmovne eax, ecx
mov dword [esi + 0x7c], eax
mov dword [esi + 0x70], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
test ebx, ebx
je 0x48a5e4
mov dl, byte [ebx]
test dl, dl
je 0x48a5e4
lea ecx, [esi + 0x70]
call fcn.004dad50
add ebx, 1
jne 0x48a5d1
mov eax, dword [esp + 0x18]
add eax, 0x1e
add eax, dword [edi + 0x78]
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 8], 0
mov dword [edi + 0x7c], esi
pop esi
pop ebp
pop edi
pop ebx
add esp, 0xc
ret
pop edi
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
Function at 0x48e860
Capabilities:
Hash data using sha256

Disassembly:
push ecx
push edi
push dword [esp + 0x14]
mov edi, ecx
push dword [esp + 0x14]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0x4c], 0x6a09e667
mov dword [edi + 0x50], 0xbb67ae85
mov dword [edi + 0x54], 0x3c6ef372
mov dword [edi + 0x58], 0xa54ff53a
mov dword [edi + 0x5c], 0x510e527f
mov dword [edi + 0x60], 0x9b05688c
mov dword [edi + 0x64], 0x1f83d9ab
mov dword [edi + 0x68], 0x5be0cd19
call fcn.004ba540
push dword [esp + 0xc]
mov ecx, edi
call fcn.00434f70
mov eax, dword [esp + 0xc]
pop edi
pop ecx
ret 0xc
Function at 0x4a2e70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
mov edx, ecx
xor eax, eax
mov dword [esp], edx
nop word [eax + eax]
mov byte [eax + edx], al
inc eax
cmp eax, 0x100
jl 0x4a2e80
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
push edi
movzx eax, al
xor edi, edi
xor bh, bh
mov dword [esp + 0x14], eax
mov esi, 0xff
xor ebp, ebp
lea ecx, [ebp + 1]
cmp esi, ecx
jbe 0x4a2ec4
nop dword [eax]
lea ecx, [ecx*2 + 1]
cmp ecx, esi
jb 0x4a2eb0
jmp 0x4a2ec4
mov edx, dword [esp + 0x10]
movzx eax, bh
mov bh, byte [eax + edx]
lea eax, [edi + 1]
add bh, byte [edi + str.qfeeatjyjbybsvlrkysxgzvjino]
mov edx, dword [esp + 0x14]
cmp eax, edx
jb 0x4a2ee1
add bh, byte [esp + 0x20]
cmp eax, edx
sbb edi, edi
movzx edx, bh
inc ebp
and edi, eax
and edx, ecx
cmp ebp, 0xb
jbe 0x4a2ef6
mov eax, edx
xor edx, edx
div esi
cmp edx, esi
ja 0x4a2ec0
mov eax, dword [esp + 0x10]
movzx ecx, dl
mov edx, eax
mov bl, byte [esi + eax]
mov al, byte [ecx + edx]
mov byte [esi + edx], al
mov byte [ecx + edx], bl
sub esi, 1
jne 0x4a2ea3
movzx eax, byte [edx + 1]
mov byte [edx + 0x100], al
movzx eax, byte [edx + 3]
mov byte [edx + 0x101], al
movzx eax, byte [edx + 5]
mov byte [edx + 0x102], al
movzx eax, byte [edx + 7]
mov byte [edx + 0x103], al
movzx eax, bh
pop edi
pop esi
pop ebp
movzx eax, byte [eax + edx]
mov byte [edx + 0x104], al
mov eax, edx
pop ebx
add esp, 8
ret 8
Function at 0x4b2f60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test edx, edx
jne 0x4b2f67
xor eax, eax
ret
push esi
mov esi, dword [esp + 8]
not ecx
cmp esi, 8
jb 0x4b3027
push edi
mov edi, esi
shr edi, 3
nop dword [eax]
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x521200]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x521200]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x521200]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x521200]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x521200]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x521200]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x521200]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x521200]
sub edi, 1
jne 0x4b2f80
pop edi
test esi, esi
je 0x4b304a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x521200]
sub esi, 1
jne 0x4b3030
not ecx
mov eax, ecx
pop esi
ret
Function at 0x4b3730
Capabilities:
Hide graphical window

Disassembly:
push ebp
lea ebp, [esp - 0x424]
sub esp, 0x424
push 0xffffffffffffffff
push 0x4dd839
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x55b090]
xor eax, ebp
mov dword [ebp + 0x420], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x400
lea eax, [ebp + 0x20]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x14]
mov edx, 0x51ae00
call fcn.004c6fd0
push 0x200
lea ecx, [ebp + 0x20]
mov dword [ebp - 4], 0
push ecx
push dword [eax]
mov ecx, 0x56d704
call fcn.004b3ed0
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, dword [edi + 0x340]
lea ebx, [edi + 0x340]
mov edx, dword [eax + 0x17c]
cmp eax, vtable.CLabel.0
jne 0x4b3956
test ebx, ebx
jne 0x4b37df
xor ecx, ecx
jmp 0x4b37e2
mov ecx, dword [ebx + 0x20]
call fcn.00424c10
test eax, eax
je 0x4b37fd
mov ecx, dword [ebx + 0x20]
lea edx, [ebp + 0x20]
call fcn.004f6650
mov ecx, ebx
call fcn.004252d0
mov ebx, dword [ebp - 0x10]
mov edi, dword [sym.imp.mfc140u.dll_CWnd::ShowWindow]
push 0
lea ecx, [ebx + 0xcf8]
call edi
push 0
lea ecx, [ebx + 0x958]
call edi
push 0
lea ecx, [ebx + 0xb20]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebx + 0x16c]
call esi
push 0
push dword [ebx + 0x208]
call esi
push 0
push dword [ebx + 0x2a4]
call esi
push 0
lea ecx, [ebx + 0x478]
call edi
push 0
lea ecx, [ebx + 0x5b0]
call edi
push 0
lea ecx, [ebx + 0x820]
call edi
push 0
lea ecx, [ebx + 0x6e8]
call edi
lea eax, [ebp + 0x10]
push eax
push dword [ebx + 0x360]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp + 0x10]
mov ecx, ebx
mov ebx, dword [sym.imp.mfc140u.dll_CWnd::ScreenToClient]
push eax
call ebx
mov edx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
add edx, 0x96
mov eax, dword [ebp + 0x18]
add edi, 0x96
mov esi, dword [ebp + 0x10]
add eax, 0x96
push 1
mov dword [ebp + 0x1c], edx
add esi, 0x96
sub edx, edi
mov dword [ebp + 0x18], eax
push edx
sub eax, esi
mov dword [ebp + 0x14], edi
push eax
push edi
mov edi, dword [ebp - 0x10]
push esi
mov dword [ebp + 0x10], esi
lea ecx, [edi + 0x340]
call dword [sym.imp.mfc140u.dll_CWnd::MoveWindow]
lea eax, [ebp]
push eax
push dword [edi + 0xd0]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp]
mov ecx, edi
push eax
call ebx
mov esi, dword [ebp + 4]
mov ecx, dword [ebp + 0xc]
add esi, 0x96
mov edx, dword [ebp]
add ecx, 0x96
add edx, 0x96
mov dword [ebp + 4], esi
mov dword [ebp + 0xc], ecx
mov dword [ebp], edx
mov eax, dword [ebp + 8]
sub ecx, esi
push 1
add eax, 0x96
push ecx
mov dword [ebp + 8], eax
sub eax, edx
push eax
push esi
push edx
push dword [edi + 0xd0]
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x420]
xor ecx, ebp
call fcn.00482396
lea esp, [ebp + 0x424]
pop ebp
ret
lea eax, [ebp + 0x20]
mov ecx, ebx
push eax
call edx
jmp 0x4b37fd
Function at 0x4bc8a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
lea ebp, [esp - 0x460]
sub esp, 0x460
push 0xffffffffffffffff
push 0x4e3ee8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x55b090]
xor eax, ebp
mov dword [ebp + 0x45c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x18], edi
push 0x40
lea eax, [ebp + 4]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x18], edi
mov dword [ebp], vtable.CMD5Checksum.0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x44], 0
mov dword [ebp + 0x4c], 0x67452301
mov dword [ebp + 0x50], 0xefcdab89
mov dword [ebp + 0x54], 0x98badcfe
mov dword [ebp + 0x58], 0x10325476
mov byte [ebp - 4], 1
mov eax, dword [esi]
lea ecx, [ebp + 0x5c]
push 0x400
push ecx
mov ecx, esi
call dword [eax + 0x40]
lea ecx, [ebp]
test eax, eax
jle 0x4bc955
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.00431700
jmp 0x4bc932
push edi
call fcn.0050a3e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x45c]
xor ecx, ebp
call fcn.00482396
lea esp, [ebp + 0x460]
pop ebp
ret
Function at 0x4cceb0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e3f18
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x55b090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x70], ebx
push 0
push dword [ebp + 8]
mov dword [ebp - 0x70], ebx
push edi
call dword [sym.imp.mfc140u.dll_AfxIsValidAddress]
push 0x40
lea eax, [ebp - 0x68]
mov dword [ebp - 0x6c], vtable.CMD5Checksum.0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0x67452301
mov dword [ebp - 0x1c], 0xefcdab89
mov dword [ebp - 0x18], 0x98badcfe
mov dword [ebp - 0x14], 0x10325476
push dword [ebp + 8]
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 0
push edi
call fcn.00431700
push ebx
lea ecx, [ebp - 0x6c]
call fcn.0050a3e0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00482396
mov esp, ebp
pop ebp
ret
Function at 0x4d0f50
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f247a
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x55b090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
push 0x1bb
mov edx, 0x536490
lea ecx, [ebp - 0x24]
xor bl, bl
call fcn.004c6fd0
mov dword [ebp - 4], 0
sub esp, 0x18
mov edi, dword [eax]
mov edx, esp
mov ecx, edi
xor eax, eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
lea eax, [ecx + 2]
mov dword [ebp - 0x14], eax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d0fc0
sub ecx, dword [ebp - 0x14]
sar ecx, 1
push ecx
push edi
mov ecx, edx
call fcn.0045b530
mov ecx, esi
call fcn.004d6770
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov al, byte [esi + 0x18]
test al, al
je 0x4d112d
mov edx, 0x5363ec
lea ecx, [ebp - 0x24]
call fcn.004c6fd0
mov dword [ebp - 4], 1
mov edx, dword [eax]
mov ecx, edx
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d1030
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x3c]
call fcn.0045b530
lea ecx, [ebp - 0x24]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov dword [ebp - 4], 3
lea edx, [ebp - 0x3c]
cmp dword [ebp - 0x28], 8
push ecx
cmovae edx, dword [ebp - 0x3c]
mov ecx, dword [esi + 0x20]
push 0x4883000
sub esp, 0xc
push 0x525684
call fcn.004c8250
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
mov edi, eax
call fcn.0045b090
test edi, edi
je 0x4d110b
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 4
push eax
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.00459b50
or dword [ebp - 0x18], 0x180
lea eax, [ebp - 0x18]
add esp, 4
mov edx, 0x1f
mov ecx, edi
push eax
call fcn.00457f10
push 0
push 0
push 0
xor edx, edx
mov ecx, edi
call fcn.00495800
add esp, 0x10
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 4
mov edx, 0x20000013
mov ecx, edi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004f48a0
add esp, 0xc
movzx ebx, bl
cmp dword [ebp - 0x14], 0xc8
mov eax, 1
cmove ebx, eax
mov ecx, edi
call fcn.0043c970
mov al, byte [esi + 0x18]
test al, al
je 0x4d112d
mov ecx, dword [esi + 0x20]
call fcn.0043c970
mov ecx, dword [esi + 0x1c]
call fcn.0043c970
mov byte [esi + 0x18], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00482396
mov esp, ebp
pop ebp
ret