joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4977fc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x497897
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jle 0x497881
call fcn.00493c18
cmp eax, dword [esi]
jae 0x497860
mov edx, dword [esi]
sub edx, eax
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jbe 0x497860
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.00409294
mov ecx, dword [ebp - 0xc]
mov dl, 0xc
mov eax, edi
call fcn.0049919c
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_Sleep
fild dword [ebp - 4]
mov dword [ebp - 0x10], ebx
fild dword [ebp - 0x10]
fdivp st(1)
fmul dword [0x4978a8]
call fcn.00402b98
mov ebx, eax
call fcn.00493c18
add ebx, eax
mov dword [esi], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49789e
lea eax, [ebp - 0xc]
call fcn.00404860
ret
Function at 0x49deec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d00
xor eax, eax
push ebp
push 0x49df37
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d10
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49df3e
lea eax, [ebp - 4]
call fcn.00404860
ret

Function at 0x49df44
Capabilities:
Terminate process

Disassembly:
push ebx
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle_1
pop ebx
ret

Function at 0x49e680
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404d00
mov eax, dword [ebp - 8]
call fcn.00404d00
xor eax, eax
push ebp
push 0x49e78f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.004096d4
test al, al
je 0x49e774
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, 0x49e7a8
call fcn.00404b64
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040977c
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00403200
mov dword [ebp - 0x50], 0x44
mov ebx, 0x8000000
mov eax, dword [ebp - 8]
call fcn.00404d10
mov esi, eax
call fcn.0049e660
cmp eax, 2
jne 0x49e713
add ebx, 0x400
mov word [ebp - 0x20], 0
mov dword [ebp - 0x24], 0x181
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404d10
push eax
push 0
push ebx
push 0xffffffffffffffff
push 0
push 0
push esi
mov eax, dword [ebp - 4]
call fcn.00404d10
push eax
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x49e774
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e796
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404884
ret
Function at 0x49eac4
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
xor edx, edx
mov dword [ebp - 0x98], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49ebf2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x84]
sub eax, 1
jb 0x49eb0b
je 0x49eb1c
jmp 0x49eb85
mov eax, ebx
mov edx, 0x49ec08
call fcn.004048b4
jmp 0x49ebd9
cmp dword [ebp - 0x90], 4
jne 0x49eb77
mov eax, dword [ebp - 0x8c]
cmp eax, 0xa
jne 0x49eb41
mov eax, ebx
mov edx, 0x49ec18
call fcn.004048b4
jmp 0x49ebd9
test eax, eax
jne 0x49eb56
mov eax, ebx
mov edx, 0x49ec2c
call fcn.004048b4
jmp 0x49ebd9
cmp eax, 0x5a
jne 0x49eb69
mov eax, ebx
mov edx, 0x49ec40
call fcn.004048b4
jmp 0x49ebd9
mov eax, ebx
mov edx, 0x49ec08
call fcn.004048b4
jmp 0x49ebd9
mov eax, ebx
mov edx, 0x49ec08
call fcn.004048b4
jmp 0x49ebd9
lea eax, [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa4], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 0x9c], 0
lea edx, [ebp - 0xa8]
mov ecx, 1
mov eax, 0x49ec54
call fcn.0040a164
mov ecx, dword [ebp - 0x98]
mov eax, ebx
mov edx, 0x49ec64
call fcn.00404b64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ebf9
lea eax, [ebp - 0x98]
call fcn.00404860
ret

Function at 0x49f1e8
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, eax
mov eax, esi
call fcn.00404860
mov ebx, 0x101
push ebx
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
jbe 0x49f216
mov edx, esi
mov eax, esp
call fcn.00409be8
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x49f220
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x49f264
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3f0
jne 0x49f264
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x49f2fb
mov eax, 0x400
call fcn.004027ec
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
test ebx, ebx
je 0x49f2f4
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x4c34a4
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x49f2ea
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x49f2e6
mov byte [esp], 1
jmp 0x49f2ea
inc edi
dec ebx
jne 0x49f2cd
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.0040280c
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4a1c50
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4a1cee
xor edx, edx
mov dl, byte [esi + ebx]
shr edx, 2
mov dl, byte [edx + 0x4c34b0]
mov byte [ebp + edi], dl
mov dl, byte [esi + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
xor ecx, ecx
mov cl, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
mov dl, byte [edx + 0x4c34b0]
push edx
pop edx
mov byte [ebp + edi + 1], dl
mov dl, byte [esi + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
xor ecx, ecx
mov cl, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
mov dl, byte [edx + 0x4c34b0]
push edx
pop edx
mov byte [ebp + edi + 2], dl
mov dl, byte [esi + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4c34b0]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4a1c6f
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4a1d04
dec edx
je 0x4a1d39
jmp 0x4a1d8a
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4c34b0]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [eax + 0x4c34b0]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4a1d8a
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4c34b0]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
xor edx, edx
mov dl, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [eax + 0x4c34b0]
mov byte [ebp + edi + 1], al
mov al, byte [esi + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [eax + 0x4c34b0]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a1dec
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x4a1e0b
add edx, 3
sar edx, 2
test edx, edx
jle 0x4a1f18
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
xor ecx, ecx
mov cl, byte [edi + esi]
cmp ecx, 0x3d
jg 0x4a1e41
je 0x4a1e81
sub ecx, 0x2b
je 0x4a1e77
sub ecx, 4
je 0x4a1e7c
dec ecx
sub ecx, 0xa
jb 0x4a1e6a
jmp 0x4a1e84
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4a1e53
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4a1e5d
jmp 0x4a1e84
mov cl, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4a1e84
mov cl, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4a1e84
mov cl, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4a1e84
mov byte [eax], 0x3e
jmp 0x4a1e84
mov byte [eax], 0x3f
jmp 0x4a1e84
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4a1e23
mov al, byte [esp + 4]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
mov dl, byte [esp + 6]
cmp dl, 0xff
je 0x4a1ed5
cmp byte [esp + 7], 0xff
jne 0x4a1ed5
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x4a1f0d
cmp dl, 0xff
je 0x4a1f0d
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x4a1e1a
add esp, 0x10
pop ebp
pop edi
pop esi
ret
Function at 0x4ba720
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404d00
xor eax, eax
push ebp
push 0x4ba87e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [edi + 0x530], ebx
xor edx, edx
mov eax, edi
call fcn.004ba67c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403200
mov dword [ebp - 0x48], 0x44
mov esi, 0x8000000
push 0x4ba898
mov eax, edi
call fcn.00450820
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x50]
call fcn.00409294
push dword [ebp - 0x50]
push 0x4ba8ac
lea eax, [ebp - 0x54]
push eax
mov ecx, dword [edi + 0x534]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004b8c14
push dword [ebp - 0x54]
lea eax, [ebp - 0x4c]
mov edx, 4
call fcn.00404bd8
mov eax, dword [ebp - 0x4c]
call fcn.00404d10
mov ebx, eax
call fcn.0049e660
cmp eax, 2
jne 0x4ba7d9
add esi, 0x400
mov word [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0x181
mov eax, edi
call fcn.004b9110
mov dword [0x4c610c], eax
mov eax, dword [0x4c610c]
mov dword [ebp - 8], eax
lea eax, [edi + 0x50c]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [edi + 0x4d0]
call fcn.00404d10
push eax
push 0
push esi
push 0xffffffffffffffff
push 0
push 0
push ebx
mov eax, dword [edi + 0x520]
call fcn.00404d10
push eax
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x4ba845
mov eax, dword [edi + 0x51c]
call fcn.00427588
jmp 0x4ba85b
push 0
push 2
push 0x805
mov eax, edi
call fcn.00450820
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba885
lea eax, [ebp - 0x54]
mov edx, 3
call fcn.00404884
lea eax, [ebp - 4]
call fcn.00404860
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x438160], 1
mov dword [0x43815c], 1
mov dword [0x438158], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x438014], eax
mov eax, dword [0x43816c]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x438180]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x438168]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x42c064], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x403944
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x134
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x14]
cmp eax, 0xfffffffe
je 0x4039e4
cmp eax, 0xffffffff
jne 0x403a62
mov dword [ebp - 0x10c], 0
lea edx, [ebp - 0x108]
mov eax, 0
mov ecx, 0x40
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x10c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteA]
call eax
sub esp, 0x18
jmp 0x403a63
mov dword [ebp - 0x10c], 0
lea edx, [ebp - 0x108]
mov eax, 0
mov ecx, 0x40
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call eax
sub esp, 0xc
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x10c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.runas
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteA]
call eax
sub esp, 0x18
jmp 0x403a63
nop
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._free
nop
mov edi, dword [ebp - 4]
leave
ret
Function at 0x405873
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x254
mov eax, dword [ebp + 8]
mov dword [0x438048], eax
lea edx, [ebp - 0x20c]
mov eax, 0
mov ecx, pe_nt_image_headers32
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
mov dword [esp], eax
call sym._strlen
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
mov dword [esp + 0x14], 0xff
lea edx, [ebp - 0x20c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov eax, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call eax
sub esp, 0x18
mov eax, dword [0x438044]
mov edx, dword [eax]
mov eax, dword [0x438044]
mov eax, dword [eax + 0x4c]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0xda
mov dword [esp + 0x18], 0x14b
mov dword [esp + 0x14], 0x80000000
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0x80000
lea eax, [ebp - 0x20c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.ew::editAccount
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExW]
call eax
sub esp, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [0x438044]
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_EnableWindow]
call eax
sub esp, 8
mov eax, dword [0x438044]
mov eax, dword [eax + 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
jmp 0x4059b7
lea eax, [ebp - 0x228]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_TranslateMessage]
call eax
sub esp, 4
lea eax, [ebp - 0x228]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_DispatchMessageW]
call eax
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x228]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetMessageW]
call eax
sub esp, 0x10
test eax, eax
jne 0x405991
mov eax, dword [0x438044]
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_EnableWindow]
call eax
sub esp, 8
nop
mov edi, dword [ebp - 4]
leave
ret
Function at 0x40a0ab
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x54
cmp dword [ebp + 8], 0
jne 0x40a0c2
mov eax, 0
jmp 0x40a23b
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0x12]
test ax, ax
jne 0x40a1c6
mov eax, dword [0x438044]
mov eax, dword [eax + 0x2c]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_IsWindowVisible]
call eax
sub esp, 4
test eax, eax
jne 0x40a108
mov eax, dword [0x438044]
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], 6
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov eax, dword [0x438044]
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov eax, dword [0x438044]
mov eax, dword [eax + 0x2c]
lea edx, [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_GetWindowRect]
call eax
sub esp, 8
mov eax, dword [0x438044]
mov eax, dword [eax + 0x2c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
sub ecx, edx
lea ebx, [ecx - 0x7d]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
sub ecx, edx
sub ecx, 0x82
mov edx, dword [ebp + 8]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], 0x7d
mov dword [esp + 0x10], 0x82
mov dword [esp + 0xc], 0x40800000
mov dword [esp + 8], 0
mov dword [esp + 4], str.ew::orderView
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExW]
call eax
sub esp, 0x30
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
jmp 0x40a23b
mov dword [esp], str.Creating_completed_order_view__n
call sym._printf_4
mov eax, dword [ebp + 8]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x50800000
mov dword [esp + 8], 0
mov dword [esp + 4], str.ew::orderView
mov dword [esp], 0
mov eax, dword [sym.imp.USER32.dll_CreateWindowExW]
call eax
sub esp, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4121a1
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
cmp dword [ebp + 8], 0
je 0x4121b6
cmp dword [ebp + 0xc], 0
jne 0x4121c0
mov eax, 0xffffffff
jmp 0x41229f
mov eax, dword [0x43813c]
test eax, eax
jne 0x4121fc
lea eax, [ebp - 0x1b0]
mov dword [esp + 4], eax
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
test eax, eax
je 0x4121f2
mov eax, 0xffffffff
jmp 0x41229f
mov dword [0x43813c], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x41222d
mov eax, 0xffffffff
jmp 0x41229f
mov word [ebp - 0x20], 2
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
sub esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0x1e], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
mov dword [serverInfo.sin_zero], eax
cmp dword [serverInfo.sin_zero], 0xffffffff
jne 0x41229c
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, 0xffffffff
jmp 0x41229f
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x4122a1
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
leave
ret
Function at 0x412300
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 0x2a], 0
mov dword [ebp - 0x26], 0
mov word [ebp - 0x22], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 9
lea edx, [ebp - 0x2a]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x412357
mov eax, 0
jmp 0x4124b4
movzx eax, byte [ebp - 0x2a]
cmp al, 0x45
je 0x412369
mov eax, 0
jmp 0x4124b4
mov dword [ebp - 0xc], 1
jmp 0x412392
lea edx, [ebp - 0x2a]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
cmp al, 0x20
jne 0x41238e
lea edx, [ebp - 0x2a]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0
jmp 0x412398
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 8
jle 0x412372
lea eax, [ebp - 0x2a]
add eax, 1
mov dword [esp], eax
call sym._atoi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x4123b9
mov eax, 0
jmp 0x4124b4
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._calloc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0xc], 8
jg 0x412457
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
lea eax, [ebp - 0x2a]
add eax, edx
movzx eax, byte [eax]
test al, al
je 0x412457
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
lea eax, [ebp - 0x2a]
add eax, edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._strcpy
mov eax, 8
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
jmp 0x412457
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x10]
mov edx, eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add ecx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x412463
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x10]
test eax, eax
jg 0x412418
jmp 0x412464
nop
lea eax, [ebp - 0x128]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._json_loads
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x412499
cmp dword [ebp - 0x20], 0
je 0x412499
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
test eax, eax
je 0x4124b1
cmp dword [ebp - 0x20], 0
je 0x4124aa
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dbg.json_decref
mov eax, 0
jmp 0x4124b4
mov eax, dword [ebp - 0x20]
leave
ret