joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487fe0
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x542340
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
push edi
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x488186
mov ecx, dword [esi]
mov dword [esp + 0x14], ecx
call fcn.00441810
test eax, eax
je 0x488186
mov edx, dword [esi + 0x2178]
lea ebx, [esi + 0x2178]
mov ecx, 0x1000
sub ecx, edx
cmp eax, ecx
jl 0x488037
mov eax, ecx
mov ecx, dword [esi + 0x2c]
push 0
push eax
lea eax, [edx + esi + 0x1074]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
test edi, edi
jle 0x48819b
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov ecx, dword [esi + 0x18]
sub eax, ecx
mov ecx, dword [esi + 0x10]
push eax
mov eax, edi
cdq
push edx
push eax
call fcn.00420370
call ebp
mov ecx, dword [esp + 0x14]
push edi
mov dword [esi + 0x18], eax
call fcn.004388a0
mov eax, dword [ebx]
add eax, edi
mov dword [ebx], eax
mov edx, dword [0x591288]
mov dword [esp + 0x28], edx
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], 0
mov edi, 1
cmp dword [eax], 0
je 0x488175
test edi, edi
je 0x488175
lea ecx, [esp + 0x28]
lea edx, [esi + 0x1074]
push ecx
push ebx
lea eax, [esi + 0x2194]
push edx
push eax
call fcn.00481530
add esp, 0x10
test eax, eax
je 0x488167
push 3
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.0050d172
mov ecx, dword [esi + 8]
call fcn.0047db40
mov eax, dword [esp + 0x28]
push 0x58ca64
push eax
call fcn.004f00c4
add esp, 8
test eax, eax
jne 0x48813f
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0x10]
call fcn.0041fd40
push 0x20
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call fcn.0050d91e
test eax, eax
jl 0x488131
mov ecx, dword [esi + 0x10]
push 1
call fcn.00421080
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.0050d3fd
mov ecx, dword [esi + 0x10]
call fcn.004210a0
test eax, eax
jne 0x488169
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.0050d172
push esi
call fcn.00487520
add esp, 8
jmp 0x488169
xor edi, edi
mov eax, dword [esi + 0x14]
cmp dword [eax], 0
jne 0x4880a9
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.0050d3fd
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
cmp edi, 0xffffffff
jne 0x4881c5
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x488186
mov eax, 2
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
test edi, edi
jne 0x488186
mov ecx, dword [esi + 0x2c]
push ecx
call dword [sym.imp.WSOCK32.dll_closesocket]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x2c], edi
pop edi
pop esi
pop ebp
mov eax, 6
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret
Function at 0x4881f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x4882a7
mov ebp, dword [esi]
mov ecx, ebp
call fcn.00441810
test eax, eax
je 0x4882a7
cmp eax, 0x1000
jb 0x48821f
mov eax, 0x1000
mov ecx, dword [esi + 0x2c]
push 0
push eax
lea eax, [esi + 0x1074]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
test edi, edi
jle 0x488272
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ecx, dword [esi + 0x18]
sub eax, ecx
mov ecx, dword [esi + 0x10]
push eax
mov eax, edi
cdq
push edx
push eax
call fcn.00420370
call ebx
push edi
mov ecx, ebp
mov dword [esi + 0x18], eax
call fcn.004388a0
mov dword [esi + 0x2178], edi
pop ebx
pop edi
pop esi
mov eax, 9
pop ebp
ret
cmp edi, 0xffffffff
jne 0x48828d
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4882a7
pop edi
pop esi
mov eax, 2
pop ebp
ret
test edi, edi
jne 0x4882a7
mov edx, dword [esi + 0x2c]
push edx
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [esi + 0x2c], edi
pop edi
pop esi
mov eax, 8
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebp
ret
Function at 0x4889e0
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x54238f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x4c]
xor ebx, ebx
push edi
mov eax, dword [esi + 0x30]
mov edi, dword [sym.imp.WSOCK32.dll_closesocket]
cmp eax, ebx
mov dword [esp + 0x18], ebx
je 0x488a19
push eax
call edi
mov dword [esi + 0x30], ebx
push ebx
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, ebx
mov dword [esi + 0x30], eax
jne 0x488a40
mov esi, dword [esp + 0x4c]
push 0x596660
mov ecx, esi
call fcn.0050d46b
jmp 0x488bb7
lea ecx, [esp + 0x14]
push 4
push ecx
push 4
push 0xffff
push eax
mov dword [esp + 0x28], 1
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
jl 0x488af8
push ebx
mov word [esp + 0x20], 2
call dword [sym.imp.WSOCK32.dll_htonl]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x30]
lea edx, [esp + 0x1c]
push 0x10
push edx
push eax
mov word [esp + 0x2a], bx
call dword [sym.imp.WSOCK32.dll_bind]
test eax, eax
jge 0x488a97
mov ecx, dword [esi + 0x30]
push ecx
jmp 0x488af3
mov ecx, dword [esi + 0x30]
mov ebp, dword [sym.imp.WSOCK32.dll_getsockname]
lea edx, [esp + 0x50]
lea eax, [esp + 0x1c]
push edx
push eax
push ecx
mov dword [esp + 0x5c], 0x10
call ebp
test eax, eax
jl 0x488aef
mov edx, dword [esi + 0x28]
lea eax, [esp + 0x50]
lea ecx, [esp + 0x2c]
push eax
push ecx
push edx
mov dword [esp + 0x5c], 0x10
call ebp
test eax, eax
jge 0x488adb
mov eax, dword [esi + 0x30]
push eax
jmp 0x488af3
mov ecx, dword [esi + 0x30]
mov ebp, 1
push ebp
push ecx
call dword [sym.imp.WSOCK32.dll_listen]
test eax, eax
jge 0x488b0d
mov edx, dword [esi + 0x30]
push edx
call edi
mov dword [esi + 0x30], ebx
mov esi, dword [esp + 0x4c]
push 0x596660
mov ecx, esi
call fcn.0050d46b
jmp 0x488bb7
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0x30]
push 8
push 0x472
mov dword [eax + 0xc], ecx
mov edx, dword [esi + 0x34]
mov dword [edx + 0x2c], ebx
mov eax, dword [esi + 0x34]
mov dword [eax + 0x30], ebx
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x30]
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov eax, dword [0x591288]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1f]
mov edx, dword [esp + 0x1e]
mov eax, dword [esp + 0x33]
and ecx, 0xff
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x36]
and eax, 0xff
push edx
mov edx, dword [esp + 0x39]
push eax
mov eax, dword [esp + 0x3c]
and ecx, 0xff
and edx, 0xff
push ecx
and eax, 0xff
push edx
push eax
lea ecx, [esp + 0x28]
push str.PORT__d__d__d__d__d__d
push ecx
mov dword [esp + 0x64], ebp
call fcn.005060bb
mov esi, dword [esp + 0x6c]
add esp, 0x20
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.0050d172
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], ebp
mov byte [esp + 0x44], bl
call fcn.0050d3fd
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x4930f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x543068
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push edi
mov edi, ecx
push 0
push 0
mov eax, dword [edi + 0x1c]
push 0x1032
push eax
call ebp
test eax, eax
je 0x4932bc
mov ecx, dword [0x591288]
push ebx
push esi
mov dword [esp + 0x10], ecx
mov edx, dword [edi + 0x1c]
mov ebx, 2
push ebx
push 0xffffffffffffffff
push 0x100c
push edx
mov dword [esp + 0x3c], 0
call ebp
mov esi, eax
test esi, esi
jl 0x49323f
cmp dword [edi + 0x24078], ebx
jne 0x493183
push esi
mov ecx, edi
call fcn.00508142
test eax, eax
je 0x493219
mov eax, dword [eax]
lea ecx, [esp + 0x10]
push eax
call fcn.0050d7d9
jmp 0x493219
push 1
lea ecx, [esp + 0x24]
push esi
push ecx
mov ecx, edi
call fcn.00508058
mov ebp, eax
push 0
lea edx, [esp + 0x20]
push esi
push edx
mov ecx, edi
mov byte [esp + 0x38], 1
call fcn.00508058
push 0x588490
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x34], bl
push eax
call fcn.0050d692
push ebp
lea ecx, [esp + 0x18]
push eax
push ecx
mov byte [esp + 0x38], 3
call fcn.0050d62c
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 4
call fcn.0050d815
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 3
call fcn.0050d3fd
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call fcn.0050d3fd
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 1
call fcn.0050d3fd
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c], 0
call fcn.0050d3fd
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [edi + 0x1c]
push ebx
push esi
push 0x100c
push edx
call ebp
mov esi, eax
test esi, esi
jl 0x49323f
push 0x5881a4
lea ecx, [esp + 0x14]
call fcn.0050d7d9
jmp 0x49315a
mov eax, dword [edi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4932a9
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
inc eax
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, dword [esp + 0x10]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0050d3fd
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x4937d0
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
push 3
push 0xffffffffffffffff
mov eax, dword [esi + 0x1c]
push 0x100c
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x49380d
push eax
mov ecx, esi
call fcn.00508142
test eax, eax
je 0x49380d
mov ecx, dword [eax]
push 1
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop esi
ret
Function at 0x4967d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5436f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov eax, dword [esi + 0x24078]
mov dword [esp + 0x18], 1
cmp eax, 5
jne 0x4968e8
mov eax, dword [esp + 0x20]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4968e8
mov ecx, dword [esi + 0x1c]
push 3
push 0xffffffffffffffff
push 0x100c
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x4968e8
push eax
mov ecx, esi
call fcn.00508142
mov esi, eax
test esi, esi
je 0x4968e8
mov edx, dword [0x591288]
mov dword [esp + 4], edx
mov eax, dword [esi]
mov byte [esp + 0x18], 2
push eax
mov eax, dword [esp + 0x28]
push eax
call fcn.004ee0f0
add esp, 8
test eax, eax
je 0x4968b4
lea ecx, [esp + 0x20]
push 0x588788
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.0050d692
push esi
push eax
lea eax, [esp + 0x10]
mov byte [esp + 0x20], 3
push eax
call fcn.0050d62c
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x1c], 4
call fcn.0050d536
lea ecx, [esp + 8]
mov byte [esp + 0x18], 3
call fcn.0050d3fd
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 2
call fcn.0050d3fd
jmp 0x4968c2
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 8]
call fcn.0050d536
mov edx, dword [esp + 4]
push 1
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 4]
mov byte [esp + 0x18], 1
call fcn.0050d3fd
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.0050d3fd
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call fcn.0050d3fd
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 8

Function at 0x499ef0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x100
push ebx
mov ebx, dword [sym.imp.USER32.dll_FindWindowExA]
push ebp
push esi
push edi
push 0
push str.32770
push 0
mov edi, ecx
push 0
call ebx
mov esi, eax
test esi, esi
je 0x499f46
mov ebp, dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [esp + 0x10]
push 0xff
push eax
push esi
call ebp
push esi
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, dword [edi + 0x1c]
je 0x499f55
push 0
push str.32770
push esi
push 0
call ebx
mov esi, eax
test esi, esi
jne 0x499f1b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x100
ret 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x100
ret 4
Function at 0x49cd60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x544070
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
xor esi, esi
push edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], vtable.CPen.0
push 0x12
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push esi
push esi
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x14]
call fcn.005174d8
mov ebp, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
mov ecx, ebp
call fcn.005163bd
mov edi, dword [esp + 0x34]
mov dword [esp + 0x30], eax
mov ebx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
sub ebx, ecx
cmp ebx, esi
jle 0x49cdfc
mov ecx, dword [edi + 4]
mov edx, dword [edi]
add ecx, esi
add edx, esi
push ecx
lea eax, [esp + 0x1c]
push edx
push eax
mov ecx, ebp
call fcn.00516a76
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
add ecx, esi
sub edx, esi
push ecx
push edx
mov ecx, ebp
call fcn.00516ac2
inc esi
cmp esi, ebx
jl 0x49cdcd
mov eax, dword [esp + 0x30]
mov ecx, ebp
push eax
call fcn.005163bd
mov dword [esp + 0x10], vtable.CGdiObject.0
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 1
call fcn.0051752f
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc

Function at 0x49ce40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x54409e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CMenu.0
mov dword [esi + 4], edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], 0x54e184
mov dword [esi + 0x28], 0x554f20
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], 0xa
lea ecx, [esi + 0x4c]
mov byte [esp + 0x18], 2
call fcn.00508cb2
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
mov dword [esi + 0x58], 0x10
mov dword [esi + 0x5c], 0xf
push 4
mov dword [esi], method.CMenu.virtual_0
call ebx
push 7
mov dword [esi + 0x44], eax
call ebx
push 0xe
mov dword [esi + 0x54], eax
call ebx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x48], eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov dword [esi + 8], 0xa
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a5390
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ebx, dword [esi + 8]
mov ecx, ebx
call fcn.00434250
mov ecx, ebx
call fcn.00441810
test eax, eax
jne 0x4a53b9
mov ecx, ebx
call fcn.00434260
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edx, dword [esi + 0x1078]
mov ecx, 0x10400
sub ecx, edx
cmp eax, ecx
jl 0x4a53cc
mov eax, ecx
mov ecx, dword [esi + 0x30]
push 0
push eax
lea eax, [edx + esi + 0x2224]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
test edi, edi
jle 0x4a5448
call ebp
mov ecx, dword [esi + 0x20]
sub eax, ecx
mov ecx, dword [esi + 0x18]
push eax
mov eax, edi
cdq
push edx
push eax
call fcn.00420370
call ebp
push edi
mov ecx, ebx
mov dword [esi + 0x20], eax
call fcn.004388a0
add dword [esi + 0x1078], edi
mov ecx, ebx
call fcn.00434260
mov ecx, esi
call fcn.004a4eb0
sub eax, 0
je 0x4a54c8
dec eax
je 0x4a54be
dec eax
je 0x4a54b4
mov edx, dword [esi + 0x1c]
cmp dword [edx], 0
jne 0x4a546b
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
ret
cmp edi, 0xffffffff
jne 0x4a5415
mov ecx, ebx
call fcn.00434260
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4a541c
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
call ebp
mov ecx, dword [esi + 0x20]
mov edi, eax
mov eax, dword [esi + 0x24]
sub edi, ecx
cmp edi, eax
jbe 0x4a53b2
mov ecx, dword [esi + 0x18]
call fcn.0041fd30
test eax, eax
je 0x4a5498
mov eax, dword [esi + 0x24]
shl eax, 1
cmp edi, eax
jbe 0x4a53b2
mov ecx, dword [esi + 0x18]
push edi
push 0
push 0
call fcn.00420370
mov ecx, dword [esi + 0x10]
push 2
push 0xef22
call fcn.0047dac0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
ret

Function at 0x4a68e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x544abe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x418
push 0x58db20
lea ecx, [esp + 0x42c]
mov dword [esp + 0x424], 0
call fcn.00505d35
test eax, eax
je 0x4a6949
lea ecx, [esp + 0x428]
mov dword [esp + 0x420], 0xffffffff
call fcn.0050d3fd
xor eax, eax
mov ecx, dword [esp + 0x418]
mov dword fs:[0], ecx
add esp, 0x424
ret
mov eax, dword [esp + 0x428]
lea ecx, [esp]
mov eax, dword [eax - 8]
add eax, 0xfffffffb
push eax
push ecx
lea ecx, [esp + 0x430]
call fcn.00505bc9
push eax
lea ecx, [esp + 0x42c]
mov byte [esp + 0x424], 1
call fcn.0050d536
lea ecx, [esp]
mov byte [esp + 0x420], 0
call fcn.0050d3fd
lea ecx, [esp + 4]
call fcn.004d1cf0
mov eax, dword [esp + 0x428]
lea edx, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x428], 2
call fcn.004d1e80
mov eax, dword [esp + 0x42c]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov byte [esp + 0x420], 0
mov dword [eax], ecx
lea ecx, [esp + 4]
mov dword [eax + 4], edx
call fcn.004d1d30
lea ecx, [esp + 0x428]
mov dword [esp + 0x420], 0xffffffff
call fcn.0050d3fd
mov ecx, dword [esp + 0x418]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x424
ret
Function at 0x4a8500
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x544d98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebp
push esi
push edi
mov esi, ecx
mov eax, dword [0x591288]
mov dword [esp + 0x34], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push ecx
lea edx, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov byte [esp + 0x44], 6
call fcn.0050d172
lea eax, [esp + 0x30]
push eax
call fcn.0043e840
add esp, 0x10
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x38], 7
call fcn.0050d536
lea ecx, [esp + 0x24]
mov byte [esp + 0x34], 6
call fcn.0050d3fd
lea ecx, [esp + 0x10]
push 0
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x38]
push ecx
push edx
push eax
call fcn.0043ed30
mov ecx, dword [esp + 0x28]
mov edi, eax
add esp, 0x1c
mov eax, dword [ecx - 8]
test eax, eax
jne 0x4a85dd
lea edx, [esp + 0x18]
lea ecx, [esp + 0xc]
push edx
call fcn.0050d536
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
call fcn.0050d536
test edi, edi
je 0x4a86bf
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x28]
push edx
push eax
call fcn.0050d62c
mov eax, dword [eax]
mov ecx, esi
push eax
push 0x487
mov byte [esp + 0x3c], 8
call fcn.0051370e
lea ecx, [esp + 0x24]
mov byte [esp + 0x34], 6
call fcn.0050d3fd
mov ecx, dword [esp + 0xc]
push ecx
push 0x4ef
mov ecx, esi
call fcn.0051370e
mov edx, dword [esp + 0x10]
mov ecx, esi
push edx
push 0x4f0
call fcn.0051370e
mov eax, dword [esp + 0xc]
mov eax, dword [eax - 8]
test eax, eax
jne 0x4a8659
mov ecx, dword [esi + 0x8c]
test ecx, ecx
je 0x4a8655
push eax
jmp 0x4a8665
test eax, eax
je 0x4a866c
mov eax, dword [esi + 0x8c]
test eax, eax
jne 0x4a866c
push 1
mov ecx, esi
call fcn.004a7c50
push 0x3f1
mov ecx, esi
call fcn.005135e5
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
push 0
push 0
mov ecx, dword [edi + 0x1c]
push 0xf0
push ecx
call ebp
test eax, eax
mov eax, dword [esi + 0x8c]
je 0x4a86ac
test eax, eax
jne 0x4a86bf
mov edx, dword [edi + 0x1c]
push 0
push 0
push 0xf1
push edx
jmp 0x4a86bd
test eax, eax
je 0x4a86bf
mov eax, dword [edi + 0x1c]
push 0
push 1
push 0xf1
push eax
call ebp
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 5
call fcn.0050d3fd
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 4
call fcn.0050d3fd
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 3
call fcn.0050d3fd
lea ecx, [esp + 0xc]
mov byte [esp + 0x34], 2
call fcn.0050d3fd
lea ecx, [esp + 0x1c]
mov byte [esp + 0x34], 1
call fcn.0050d3fd
lea ecx, [esp + 0x20]
mov byte [esp + 0x34], 0
call fcn.0050d3fd
lea ecx, [esp + 0x3c]
mov dword [esp + 0x34], 0xffffffff
call fcn.0050d3fd
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x2c
ret 4
Function at 0x4a8740
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x544e07
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov dword [esp + 0x20], 0
mov eax, dword [0x591288]
mov dword [esp + 0x30], 1
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push ecx
lea edx, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
mov byte [esp + 0x40], 7
call fcn.0050d172
lea eax, [esp + 0x28]
push eax
call fcn.0043e840
add esp, 0x10
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x34], 8
call fcn.0050d536
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 7
call fcn.0050d3fd
lea ecx, [esp + 0x14]
push 0x20000000
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x34]
push ecx
push edx
push eax
call fcn.0043ed30
add esp, 0x1c
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 8]
call fcn.0050d815
mov esi, dword [esp + 0x38]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.0050d172
mov dword [esp + 0x20], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 6
call fcn.0050d3fd
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 5
call fcn.0050d3fd
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 4
call fcn.0050d3fd
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 3
call fcn.0050d3fd
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call fcn.0050d3fd
lea ecx, [esp + 4]
mov byte [esp + 0x30], 1
call fcn.0050d3fd
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 0
call fcn.0050d3fd
mov ecx, dword [esp + 0x28]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x30
ret 8

Function at 0x4aa1b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5451b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0041b940
mov eax, dword [0x591288]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x2c], eax
mov ecx, dword [0x591288]
mov dword [esi + 0x40], ecx
mov edx, dword [0x591288]
mov dword [esi + 0x44], edx
mov eax, dword [0x591288]
mov dword [esi + 0x48], eax
mov ecx, dword [0x591288]
mov dword [esi + 0x4c], ecx
mov edx, dword [0x591288]
mov dword [esi + 0x5c], edx
mov eax, dword [0x591288]
mov dword [esi + 0x60], eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [esi + 0x30], ecx
push edx
mov ecx, esi
mov byte [esp + 0x18], 7
mov dword [esi], 0x555ac8
call fcn.0041c220
mov ecx, dword [esp + 0xc]
or eax, 0xffffffff
mov dword [esi + 0x50], eax
mov dword [esi + 0x38], edi
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x28], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8