joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c8f0
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx + 0x58]
test eax, eax
je 0x45cace
mov eax, dword [eax + 0x80]
test eax, eax
je 0x45cace
cmp dword [eax], 0
je 0x45cace
mov ecx, dword [ebx]
test ecx, ecx
je 0x45cace
mov eax, dword [ecx]
call dword [eax + 0x78]
mov ecx, dword [ebx]
test ecx, ecx
je 0x45cace
mov eax, dword [ecx]
call dword [eax + 0x78]
test eax, eax
je 0x45cace
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x45cace
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [ebx]
test ecx, ecx
je 0x45c96e
mov eax, dword [ecx]
call dword [eax + 0x78]
mov edi, eax
mov dword [ebp - 4], eax
jmp 0x45c973
xor edi, edi
mov dword [ebp - 4], edi
mov ecx, dword [edi + 0x28]
mov eax, dword [ecx]
mov eax, dword [eax + 0x50]
call eax
test al, al
jne 0x45c99c
push 1
push 0
mov ecx, str.Copying_text_was_denied__copying_as_image_only_
call fcn.00489000
push eax
mov ecx, ebx
call fcn.00467aa0
jmp 0x45ca85
mov ecx, dword [edi + 0x28]
mov eax, dword [ecx]
mov eax, dword [eax + 0x3c]
call eax
test al, al
jne 0x45ca85
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x45c9d2
push 0x4ef72c
call fcn.0048f640
push 0
mov esi, eax
call fcn.004bf8aa
add esp, 4
jmp 0x45ca4c
lea ecx, [ebp - 0x70]
call fcn.00401260
mov eax, dword [ebx + 0x58]
mov ecx, dword [eax + 0x80]
mov dword [ebp - 0xc], ecx
mov eax, dword [ecx]
mov dword [ebp - 8], eax
test eax, eax
je 0x45ca2e
xor ebx, ebx
mov eax, dword [ecx + 0xc]
lea esi, [ebx + 8]
sub esp, 0x20
add esi, eax
mov edi, esp
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
mov ecx, edi
push dword [eax + ebx]
call fcn.0047c2d0
test eax, eax
je 0x45ca1f
push eax
lea ecx, [ebp - 0x70]
call fcn.004565b0
mov ecx, dword [ebp - 0xc]
add ebx, 0x28
sub dword [ebp - 8], 1
jne 0x45c9f1
mov ebx, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 0x70]
call fcn.0042faa0
push 0
mov esi, eax
call fcn.004bf8aa
add esp, 4
lea ecx, [ebp - 0x70]
call fcn.00401280
test esi, esi
je 0x45ca60
xor eax, eax
cmp ax, word [esi]
je 0x45ca60
mov dl, 1
mov ecx, esi
call fcn.00417af0
cmp dword [ebp - 0x14], 0
jle 0x45ca7c
call dword [sym.imp.USER32.dll_CloseClipboard]
push esi
call fcn.004bf8aa
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.004bf8aa
add esp, 4
mov eax, dword [ebx + 0x58]
mov ecx, dword [edi + 0x28]
fld dword [edi + 0x70]
push 0
mov eax, dword [eax + 0x80]
mov edx, dword [ecx]
push 2
fstp dword [ebp - 0x14]
mov esi, dword [eax + 0xc]
fld dword [ebp - 0x14]
lea eax, [esi + 8]
push eax
push dword [edi + 0x78]
push ecx
fstp dword [esp]
push dword [esi]
call dword [edx + 0x18]
mov esi, eax
test esi, esi
je 0x45cac8
mov ecx, dword [esi]
call fcn.00417b90
push ecx
mov ecx, esi
call fcn.00401610
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ce70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], ebx
mov ecx, dword [edi]
test ecx, ecx
je 0x45ce8b
mov eax, dword [ecx]
call dword [eax + 0x78]
mov dl, 1
mov ecx, edi
call fcn.0045bf30
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [edi + 0x150], ebx
mov dword [edi + 0x154], eax
mov dword [edi + 0x158], 0
push 0x10
mov dword [edi + 0x15c], 0
mov byte [edi + 0x14c], 1
mov dword [edi + 0x12c], 3
call esi
mov bx, ax
shr ebx, 0xf
push 0x11
and bl, 1
call esi
shr eax, 0xf
test al, 1
je 0x45ceee
test bl, bl
je 0x45cf73
mov ecx, dword [edi]
test ecx, ecx
je 0x45cefd
mov eax, dword [ecx]
call dword [eax + 0x78]
mov esi, eax
jmp 0x45ceff
xor esi, esi
push dword [ebp + 8]
mov ecx, esi
push dword [ebp - 4]
call fcn.0047a7a0
mov edx, dword [esi]
mov ebx, eax
push ebx
mov ecx, esi
mov edx, dword [edx + 0x64]
call edx
test al, al
je 0x45cf73
push dword [ebp + 8]
lea eax, [ebp - 0x18]
mov ecx, esi
push dword [ebp - 4]
push ebx
push eax
call fcn.0047ab20
fld qword [ebp - 0x10]
sub esp, 0x10
mov esi, dword [esi + 0x1c]
mov ecx, esi
fstp qword [esp + 8]
fld qword [ebp - 0x18]
fstp qword [esp]
push ebx
call fcn.0048ed40
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], eax
test eax, eax
jns 0x45cf69
mov ecx, dword [esi + 0x20]
lea eax, [ebp + 8]
push 0
push eax
push ebx
call fcn.0048ec00
mov eax, dword [ebp + 8]
inc eax
add dword [esi + 0x14], eax
mov dword [edi + 0x12c], 5
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_SetCapture]
push 0
push 0x14
push 2
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_SetTimer]
push 0
mov ecx, edi
call fcn.0046b610
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45d970
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov esi, ecx
push 0
push 0
push 0xb8
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [esi], 0x4f4fbc
mov dword [esi + 8], eax
call edi
push 0
push 0
test eax, eax
push 0xe
setne al
push ebx
mov byte [esi + 0xc], al
call edi
mov dword [ebp + 0xc], eax
inc eax
push 2
push eax
mov dword [ebp + 8], eax
call fcn.004bf417
mov edi, eax
add esp, 8
test edi, edi
je 0x45d9de
push edi
push dword [ebp + 8]
push 0xd
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov word [edi + eax*2], cx
mov dword [esi + 0x10], edi
mov eax, esi
pop edi
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x45e110
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, edx
mov dl, 1
push edi
mov edi, ecx
call fcn.0045e0b0
push 0x1c
call fcn.004bcd25
add esp, 4
mov ecx, eax
push dword [edi + 0x70]
push esi
push edi
call fcn.0045d970
push 0
push 0
push 0xb9
push dword [edi + 0x70]
mov esi, eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x10]
test eax, eax
je 0x45e18f
xor ecx, ecx
cmp cx, word [eax]
je 0x45e18f
push dword [ebp + 8]
mov ecx, esi
call fcn.0045da00
push 0
push 0
push esi
push 0x45de30
push 0
push 0
mov dword [edi + 0x34c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x34c], eax
mov dword [esi + 0x18], eax
pop edi
pop esi
pop ecx
pop ebp
ret
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 8]
pop edi
pop esi
pop ecx
pop ebp
ret
Function at 0x460e80
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [0x569808]
xor eax, eax
test edx, edx
je 0x460fc8
push edi
mov edi, dword [0x569814]
push esi
mov esi, dword [edi + eax*4]
cmp dword [esi + 0x54], ecx
je 0x460ec5
inc eax
cmp eax, edx
jb 0x460ea8
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 0x30], 0x100
xor ecx, ecx
mov dword [ebp - 0x34], 0xf
lea edi, [ebp - 0x28]
mov dword [ebp - 8], ecx
push ebx
mov dword [ebp - 0x38], ecx
xor ebx, ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
cmp dword [esi], eax
jbe 0x460f29
mov eax, dword [esi + 0xc]
mov eax, dword [eax + ebx*4]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x38]
push str._s__s_r_n
push eax
call fcn.0040bfe0
inc ebx
add esp, 0x10
cmp ebx, dword [esi]
jb 0x460f02
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 0x2c]
test edi, edi
je 0x460f9c
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x460f96
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x460f44
sub ecx, edx
sar ecx, 1
lea ebx, [ecx + 1]
lea eax, [ebx + ebx]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x460f90
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x460f80
push edi
mov edx, ebx
mov ecx, eax
call fcn.0041a480
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov edi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x28]
pop ebx
cmp edi, eax
je 0x460fc6
push edi
test ecx, ecx
jne 0x460fc1
call fcn.004bf8aa
add esp, 4
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx]
call dword [eax + 0xc]
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
Function at 0x461480
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x569ce0]
cmp ecx, 0xffffffff
je 0x4614b3
xor eax, eax
test ecx, ecx
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
mov dword [0x569ce0], 1
call fcn.00461370
test al, al
je 0x4614e0
mov dword [0x569ce0], 0
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004bef30
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x20c]
call fcn.0041ce70
push 0x208
mov esi, eax
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004bef30
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x46154d
xor edi, edi
jmp 0x46155e
lea eax, [ebp - 0x414]
push eax
call fcn.004c91a0
add esp, 4
mov edi, eax
test esi, esi
je 0x46158f
test edi, edi
je 0x46158f
mov ecx, esi
call fcn.0041cc50
cmp eax, esi
jbe 0x46158f
xor ecx, ecx
mov edx, esi
mov word [eax - 2], cx
mov ecx, edi
call fcn.0041cff0
test al, al
jne 0x4615b3
mov ecx, esi
call fcn.0041cc50
cmp eax, esi
ja 0x461571
mov bl, 1
push edi
call fcn.004bf8aa
push esi
call fcn.004bf8aa
mov ecx, dword [ebp - 4]
add esp, 8
mov al, bl
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
mov dword [0x569ce0], 0
xor bl, bl
jmp 0x461591
Function at 0x4615d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
test edi, edi
jne 0x4615fb
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
mov eax, dword [0x56c884]
test eax, eax
je 0x46163d
lea ecx, [ebp - 0x230]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x46163d
test byte [ebp - 0x230], 0x10
je 0x46163d
mov ecx, dword [0x56c884]
mov edx, edi
call fcn.0041cdf0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
call fcn.00461480
test al, al
je 0x46165c
mov ecx, edi
call fcn.0041d3c0
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004bef30
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x801a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x4616b0
xor esi, esi
xor edi, edi
push esi
call fcn.004bf8aa
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, edi
xor ecx, ebp
pop esi
pop ebx
pop edi
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
call fcn.004c91a0
mov esi, eax
add esp, 4
test esi, esi
je 0x461692
mov edx, 0x4ef17c
mov ecx, esi
call fcn.0041cdf0
push esi
mov ebx, eax
call fcn.004bf8aa
add esp, 4
mov esi, ebx
test ebx, ebx
je 0x461692
mov ecx, ebx
call fcn.0041d9d0
test al, al
je 0x461692
mov edx, edi
mov ecx, ebx
call fcn.0041cdf0
mov edi, eax
jmp 0x461694
Function at 0x461e40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 4], ebx
push esi
cmp edx, 0x201
ja 0x461eeb
je 0x461ed4
sub edx, 7
je 0x461eaf
sub edx, 1
je 0x461ea7
sub edx, 0xf8
jne 0x461ea7
cmp dword [ebp + 8], 8
jne 0x461ea7
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
shr eax, 0xf
test al, 1
je 0x461ea7
push 0x10
call esi
shr eax, 0xf
test al, 1
jne 0x461ea7
push 0
push 0
push 0x8002
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x56ce74], 0
jne 0x462032
push 0
push 0
push 0x8001
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, ebx
mov al, 1
pop esi
setne byte [0x56ce74]
pop ebx
mov esp, ebp
pop ebp
ret
sub edx, 0x202
je 0x461ff8
sub edx, 0x7dff
je 0x461fe0
sub edx, 1
jne 0x461ea7
push edi
call fcn.00418280
push 0
push 0
push 0xb0
push ebx
mov esi, eax
call dword [sym.imp.USER32.dll_SendMessageW]
movzx edi, ax
test edi, edi
je 0x461f5a
cmp word [esi + edi*2 - 2], 0x7f
lea eax, [esi + edi*2]
jne 0x461f5a
lea ecx, [eax - 2]
call fcn.00419500
add eax, eax
lea ecx, [esi + edi*2]
push eax
push ecx
lea eax, [ecx - 2]
push eax
call fcn.004bdaf0
add esp, 0xc
push esi
push 0
push 0xc
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
dec edi
mov eax, edi
mov dword [ebp - 8], eax
test edi, edi
jle 0x461fb2
lea ebx, [esi - 2]
lea ebx, [ebx + edi*2]
lea esp, [esp]
movzx eax, word [ebx]
push eax
call fcn.004c9250
add esp, 4
test eax, eax
je 0x461f8a
dec edi
sub ebx, 2
test edi, edi
jg 0x461f70
jmp 0x461fac
test edi, edi
jle 0x461fac
lea ebx, [esi - 2]
lea ebx, [ebx + edi*2]
movzx eax, word [ebx]
push eax
call fcn.004c9250
add esp, 4
test eax, eax
jne 0x461fac
dec edi
sub ebx, 2
test edi, edi
jg 0x461f94
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 8]
push eax
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xb1
push ebx
call edi
push 0
push 0
push 0x303
push ebx
call edi
push esi
call fcn.004bf8aa
add esp, 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push 0
push 0xb1
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x56ce74], 0
je 0x462032
push 0
push 0
push 0xb0
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
shr ecx, 0x10
cmp ax, cx
jne 0x46202b
push 0
push 0
push 0x8001
push ebx
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [0x56ce74], 0
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4623c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x56b084]
mov dword [ebp - 8], 0
push ebx
mov ebx, ecx
push esi
push edi
test eax, eax
je 0x462432
lea ecx, [ebp - 8]
push ecx
push 0x4ef0f8
push eax
call fcn.0041b090
add esp, 0xc
test eax, eax
je 0x462432
mov eax, dword [ebp - 8]
test eax, eax
je 0x462432
mov edx, eax
lea esi, [edx + 2]
lea ecx, [ecx]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x462400
sub edx, esi
sar edx, 1
cmp edx, 1
jbe 0x462432
cmp eax, str.file
je 0x462432
push str.file
push eax
call fcn.004c8f6f
add esp, 8
test eax, eax
sete al
test al, al
je 0x462468
push 0
mov edx, str.:Zone.Identifier
mov ecx, ebx
call fcn.00419a10
add esp, 4
mov esi, eax
push esi
push 0xffffffffffffffff
push str.ZoneId
push str.ZoneTransfer
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
mov edi, eax
call fcn.004bf8aa
add esp, 4
cmp edi, 3
jl 0x46247e
push dword [ebp - 8]
mov bl, 1
call fcn.004bf8aa
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x46248f
push ebx
call fcn.004c91a0
add esp, 4
mov ebx, eax
jmp 0x462491
xor ebx, ebx
test ebx, ebx
je 0x46250e
mov eax, ebx
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4624a0
sub eax, edx
sar eax, 1
cmp eax, 2
jbe 0x46250e
lea eax, [ebx + 4]
push 0x3a
push eax
call fcn.004be064
add esp, 8
test eax, eax
je 0x46250e
push 0x3a
push ebx
call fcn.004be7ed
xor ecx, ecx
mov edx, str.:Zone.Identifier
push ecx
mov word [eax], cx
mov ecx, ebx
call fcn.00419a10
add esp, 0xc
mov esi, eax
push esi
push 0xffffffffffffffff
push str.ZoneId
push str.ZoneTransfer
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
mov edi, eax
call fcn.004bf8aa
add esp, 4
cmp edi, 3
jl 0x462491
mov byte [ebp - 1], 1
jmp 0x462512
mov byte [ebp - 1], 0
push ebx
call fcn.004bf8aa
mov bl, byte [ebp - 1]
add esp, 4
push dword [ebp - 8]
call fcn.004bf8aa
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x462d40
Capabilities:
Hide graphical window
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x56800c]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x1c], ebx
mov ecx, dword [ebx]
test ecx, ecx
jne 0x462d67
mov al, 1
jmp 0x462d92
mov eax, dword [ecx]
call dword [eax + 0x78]
test eax, eax
jne 0x462d74
xor al, al
jmp 0x462d92
mov ecx, dword [ebx]
test ecx, ecx
je 0x462d81
mov eax, dword [ecx]
call dword [eax + 0x78]
jmp 0x462d83
xor eax, eax
mov ecx, dword [eax + 0x28]
mov eax, dword [ecx]
mov eax, dword [eax + 0x3c]
call eax
test al, al
sete al
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
movzx edi, al
neg edi
mov byte [esp + 0xf], al
sbb edi, edi
and edi, 5
push edi
push dword [ebx + 0x6c]
call esi
push edi
push dword [ebx + 0x74]
call esi
push edi
push dword [ebx + 0x70]
call esi
cmp byte [esp + 0xf], 0
je 0x462f1c
mov ecx, str.Find:
call fcn.00489000
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0
push 0xc
push dword [ebx + 0x6c]
mov dword [esp + 0x20], eax
call esi
lea eax, [esp + 0x4c]
mov dword [esp + 0x14], 0
push eax
push dword [ebx + 0x74]
xor edi, edi
mov dword [esp + 0x28], edi
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x462e19
mov eax, dword [esp + 0x54]
sub eax, dword [esp + 0x4c]
mov edi, dword [esp + 0x58]
sub edi, dword [esp + 0x50]
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edi
lea eax, [esp + 0x5c]
push eax
push 0xbc4
push 0x433
push dword [ebx + 0x64]
call esi
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x4c]
push dword [esp + 0x10]
add eax, 0xa
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x6c]
sub eax, edi
cdq
sub eax, edx
mov edx, dword [ebx + 0x6c]
mov esi, eax
sar esi, 1
mov dword [esp + 0x28], esi
call fcn.00417770
mov eax, dword [esp + 0x50]
add esp, 4
add eax, 6
mov dword [esp + 0x10], eax
push 0x2d
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x28], eax
mov eax, edi
sub eax, ebx
inc eax
cdq
push 1
sub eax, edx
sar eax, 1
push ebx
push dword [esp + 0x18]
lea edi, [eax + esi]
mov eax, dword [esp + 0x28]
mov esi, dword [sym.imp.USER32.dll_MoveWindow]
push edi
push dword [esp + 0x28]
push dword [eax + 0x6c]
call esi
mov eax, dword [esp + 0x10]
add eax, dword [esp + 0x18]
push 0
push dword [esp + 0x24]
push dword [esp + 0x1c]
push dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push dword [eax + 0x74]
call esi
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
push 0
push ebx
mov ebx, dword [esp + 0x18]
lea eax, [edx + edx]
sub ecx, eax
push ecx
push edi
mov edi, dword [esp + 0x2c]
lea eax, [edx + ebx]
add eax, dword [esp + 0x28]
push eax
push dword [edi + 0x70]
call esi
mov eax, dword [esp + 0x14]
add eax, 0xc
mov dword [esp + 0x2c], 0x20
add eax, ebx
mov dword [esp + 0x30], 0x40
mov word [esp + 0x3e], ax
lea eax, [esp + 0x2c]
push eax
push 0x1b3
push 0x440
push dword [edi + 0x64]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
Function at 0x463b30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
test cl, cl
jne 0x463b57
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004bef30
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 0xa
jne 0x463b47
cmp dword [ebp - 0x114], 0x295a
mov ecx, dword [ebp - 4]
seta al
xor ecx, ebp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
Function at 0x466130
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ecx + 0x5c]
push 0
push 0
push 0xe
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 8], eax
inc eax
push 2
push eax
mov dword [ebp - 4], eax
call fcn.004bf417
mov esi, eax
add esp, 8
test esi, esi
jne 0x46616f
push esi
call fcn.004bf8aa
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp - 4]
push 0xd
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 8]
xor ecx, ecx
push esi
mov word [esi + eax*2], cx
call fcn.004bf8aa
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4666c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x56be3c]
push ebx
push esi
push edi
cmp byte [eax + 0xed], 0
mov edi, ecx
mov ecx, dword [edi + 4]
mov dword [ebp - 0x1c], ecx
jne 0x4666f9
cmp byte [edi + 0x105], 0
jne 0x4666f9
mov eax, 1
jmp 0x4666fb
xor eax, eax
cmp ecx, eax
jle 0x4667d0
cmp byte [edi + 0x104], 1
je 0x46672f
push 5
push dword [edi + 0x100]
mov byte [edi + 0x104], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
mov dl, 1
mov ecx, edi
call fcn.00408730
add esp, 4
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push dword [edi + 0x100]
call dword [sym.imp.USER32.dll_GetClientRect]
test eax, eax
je 0x46674b
mov ebx, dword [ebp - 0xc]
sub ebx, dword [ebp - 0x14]
mov eax, dword [0x56be3c]
mov ecx, dword [edi + 0x5c]
mov dword [ebp - 0x18], ecx
mov esi, dword [eax + 0x6c]
cmp esi, 0x64
jge 0x466763
mov esi, 0x64
push 0x60
call fcn.0041f360
mov eax, dword [eax + 4]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MulDiv]
call esi
mov ecx, dword [ebp - 0x18]
push 0x60
mov dword [ebp - 0x20], eax
call fcn.0041f360
mov ecx, dword [eax + 8]
push ecx
push 0x18
call esi
mov esi, eax
lea eax, [ebx - 3]
cdq
idiv dword [ebp - 0x1c]
mov ecx, eax
mov eax, dword [ebp - 0x20]
cmp eax, ecx
jle 0x4667a0
mov eax, ecx
movzx ecx, si
shl ecx, 0x10
movzx eax, ax
or ecx, eax
push ecx
push 0
push 0x1329
push dword [edi + 0x100]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
cmp byte [edi + 0x104], 0
je 0x4667fc
push 0
push dword [edi + 0x100]
mov byte [edi + 0x104], 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
mov dl, 1
mov ecx, edi
call fcn.00408730
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bcb15
mov esp, ebp
pop ebp
ret