joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4920
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, dword [0x96c978]
sub esp, 8
test eax, eax
push esi
push edi
mov edi, ecx
jne 0x4d495c
call fcn.005196c6
mov esi, dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push esi
push 0x4d4b20
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [0x96c978], eax
jne 0x4d495c
pop edi
pop esi
add esp, 8
ret
mov eax, dword [0x96c970]
mov ecx, dword [0x96c974]
sub ecx, eax
mov dword [esp + 8], edi
sar ecx, 2
cmp ecx, 1
mov esi, eax
jae 0x4d4a73
mov edx, dword [0x96c96c]
test edx, edx
je 0x4d4991
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
ja 0x4d4996
mov ecx, 1
test edx, edx
jne 0x4d499e
xor eax, eax
jmp 0x4d49a3
sub eax, edx
sar eax, 2
add eax, ecx
test eax, eax
mov dword [esp + 0xc], eax
jge 0x4d49af
xor eax, eax
push ebx
lea edx, [eax*4]
push ebp
push edx
call fcn.0050f5f7
mov ebx, dword [0x96c96c]
add esp, 4
mov ebp, eax
cmp ebx, esi
mov edi, ebp
je 0x4d49e3
push ebx
push edi
call fcn.004a0010
add ebx, 4
add esp, 8
add edi, 4
cmp ebx, esi
jne 0x4d49cf
lea eax, [esp + 0x10]
mov ecx, 0x96c968
push eax
push 1
push edi
call fcn.004d5a50
mov ecx, dword [0x96c970]
add edi, 4
push edi
push ecx
push esi
mov ecx, 0x96c968
call fcn.004d5a20
mov edx, dword [0x96c970]
mov eax, dword [0x96c96c]
push edx
push eax
mov ecx, 0x96c968
call fcn.004a0000
mov ecx, dword [0x96c96c]
push ecx
call fcn.0050f620
mov edx, dword [esp + 0x18]
mov ecx, dword [0x96c96c]
add esp, 4
lea eax, [ebp + edx*4]
test ecx, ecx
mov dword [0x96c974], eax
jne 0x4d4a4c
xor eax, eax
jmp 0x4d4a56
mov eax, dword [0x96c970]
sub eax, ecx
sar eax, 2
lea ecx, [ebp + eax*4 + 4]
mov dword [0x96c96c], ebp
pop ebp
pop ebx
pop edi
mov dword [0x96c970], ecx
mov eax, 1
pop esi
add esp, 8
ret
xor dl, dl
cmp dl, 1
jae 0x4d4ac6
lea ecx, [eax + 4]
push ecx
push eax
push eax
mov ecx, 0x96c968
call fcn.004d5a20
mov eax, dword [0x96c970]
lea edx, [esp + 8]
mov ecx, eax
push edx
sub ecx, esi
mov edx, 1
sar ecx, 2
sub edx, ecx
mov ecx, 0x96c968
push edx
push eax
call fcn.004d5a50
mov eax, dword [0x96c970]
cmp esi, eax
je 0x4d4b07
mov ecx, dword [esp + 8]
mov dword [esi], ecx
add esi, 4
cmp esi, eax
jne 0x4d4ab7
jmp 0x4d4b07
push eax
push eax
add eax, 0xfffffffc
mov ecx, 0x96c968
push eax
call fcn.004d5a20
mov eax, dword [0x96c970]
mov ecx, eax
add eax, 0xfffffffc
cmp esi, eax
je 0x4d4af3
mov edx, dword [eax - 4]
sub eax, 4
sub ecx, 4
cmp eax, esi
mov dword [ecx], edx
jne 0x4d4ae4
lea eax, [esi + 4]
cmp esi, eax
je 0x4d4b07
mov ecx, dword [esp + 8]
mov dword [esi], ecx
add esi, 4
cmp esi, eax
jne 0x4d4afa
mov eax, dword [0x96c970]
pop edi
add eax, 4
pop esi
mov dword [0x96c970], eax
mov eax, 1
add esp, 8
ret
Function at 0x4d4b80
Capabilities:
Reference http user-agent string

Disassembly:
push ecx
push esi
mov esi, dword [0x96c970]
push edi
mov edi, dword [0x96c96c]
mov edx, edi
cmp edx, esi
je 0x4d4bd4
cmp dword [edx], ecx
je 0x4d4ba0
add edx, 4
cmp edx, esi
jne 0x4d4b95
cmp edx, esi
je 0x4d4bd4
lea eax, [edx + 4]
mov ecx, esi
cmp eax, esi
je 0x4d4bc7
sub edx, eax
mov esi, dword [eax]
mov dword [edx + eax], esi
add eax, 4
cmp eax, ecx
jne 0x4d4baf
mov edi, dword [0x96c96c]
mov esi, dword [0x96c970]
add esi, 0xfffffffc
mov dword [esp + 8], esi
mov dword [0x96c970], esi
test edi, edi
je 0x4d4be2
sub esi, edi
test esi, 0xfffffffc
jne 0x4d4c00
mov eax, dword [0x96c978]
test eax, eax
je 0x4d4c00
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
test eax, eax
je 0x4d4c00
mov dword [0x96c978], 0
pop edi
mov eax, 1
pop esi
pop ecx
ret

Function at 0x4d4c10
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x96c97c
mov ecx, dword [esp + 0x38]
call fcn.0050f9f3
mov ebp, dword [esp + 0x30]
xor esi, esi
test ebp, ebp
jne 0x4d4c40
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea ebp, [esp + 0x10]
mov ecx, edi
xor ebx, ebx
call fcn.004d4870
test eax, eax
jle 0x4d4ced
push ebx
mov ecx, edi
call fcn.004d4880
mov esi, eax
test esi, esi
je 0x4d4cb9
mov ecx, dword [esp + 0x2c]
mov eax, dword [esi]
cmp eax, ecx
jne 0x4d4cb9
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 8]
sub edx, eax
je 0x4d4cd1
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
sub eax, ecx
je 0x4d4cd1
mov dword [esp + 0x18], ecx
mov edx, dword [esi + 8]
mov dword [esp + 0x1c], edx
mov eax, dword [esi + 0xc]
mov dword [esp + 0x20], eax
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0x18]
mov dword [esp + 0x24], ecx
push edx
mov ecx, edi
call fcn.005162d2
mov eax, dword [ebp + 4]
mov ecx, dword [ebp]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4d4cd1
mov ecx, edi
inc ebx
call fcn.004d4870
cmp ebx, eax
jl 0x4d4c51
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret 0xc
mov ecx, dword [esp + 0x34]
add esi, 0x14
push esi
call fcn.0050f9a3
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x18
ret 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
Function at 0x4d67d0
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
push 1
mov dword [esi + 0x74], 0xffffffff
mov dword [esi + 0x84], edi
mov dword [esi + 0x78], 1
mov dword [esi + 0x70], 0x12
call fcn.004d73b0
mov ecx, dword [esi + 0x44]
lea ebx, [esi + 0x3c]
mov eax, ecx
mov ebp, dword [ebx + 4]
cmp eax, ecx
je 0x4d681b
mov edx, dword [eax]
add eax, 4
mov dword [ebp], edx
add ebp, 4
cmp eax, ecx
jne 0x4d680c
mov eax, dword [ebx + 8]
mov ecx, ebx
push eax
push ebp
call fcn.004a0000
mov dword [ebx + 8], ebp
mov ebp, dword [esi + 0x94]
mov ecx, dword [esi + 0x90]
lea ebx, [esi + 0x8c]
cmp ebp, ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ecx
je 0x4d6868
mov ecx, dword [esp + 0x10]
push ebp
call fcn.004ddcf0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add ebp, 0x10
add edx, 0x10
cmp ebp, eax
mov dword [esp + 0x10], edx
jne 0x4d6848
mov edx, dword [ebx + 8]
mov eax, dword [esp + 0x10]
push edx
push eax
mov ecx, ebx
call fcn.004dde80
mov ecx, dword [esp + 0x10]
mov dword [ebx + 8], ecx
mov ecx, dword [esi + 0xa4]
lea ebx, [esi + 0x9c]
mov eax, ecx
cmp eax, ecx
mov ebp, dword [ebx + 4]
je 0x4d68a3
mov edx, dword [eax]
add eax, 4
mov dword [ebp], edx
add ebp, 4
cmp eax, ecx
jne 0x4d6894
mov eax, dword [ebx + 8]
mov ecx, ebx
push eax
push ebp
call fcn.004a0000
mov dword [ebx + 8], ebp
mov ebx, dword [sym.imp.USER32.dll_SetRectEmpty]
lea ecx, [esi + 0x50]
mov ebp, 1
push ecx
mov dword [esi + 0xbc], ebp
call ebx
lea edx, [esi + 0x60]
push edx
call ebx
push 0x11
mov dword [esi + 0xc0], 0xffffffff
mov dword [esi + 0x4c], edi
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push 0xf
mov dword [esi + 0xc8], eax
call ebx
mov dword [esi + 0xcc], eax
mov ecx, 0xff0000
mov eax, 0xffffff
push 0xf
mov dword [esi + 0xd0], ecx
mov dword [esi + 0xd4], eax
mov dword [esi + 0xd8], eax
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe0], 0xff
mov dword [esi + 0xe4], ecx
mov dword [esi + 0x1f0], 0xb4a791
call ebx
push ebp
mov ecx, esi
mov dword [esi + 0x1f4], eax
call fcn.004d7b70
mov eax, 0x10
push 0x87bc
mov ecx, esi
mov dword [esi + 0x1ec], ebp
mov dword [esi + 0x1e0], edi
mov dword [esi + 0x1e4], edi
mov dword [esi + 0x208], edi
mov dword [esi + 0x20c], edi
mov dword [esi + 0x210], edi
mov dword [esi + 0x218], eax
mov dword [esi + 0x214], eax
mov dword [esi + 0x21c], edi
mov dword [esi + 0x220], edi
mov dword [esi + 0x224], edi
mov dword [esi + 0x228], edi
mov dword [esi + 0x23c], edi
mov dword [esi + 0x240], ebp
mov dword [esi + 0x244], ebp
mov dword [esi + 0x248], edi
call fcn.004db020
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4d7bc0
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x3c
push ebx
mov ebx, ecx
push ebp
push esi
lea ebp, [ebx + 0xc4]
test ebp, ebp
je 0x4d7be0
mov eax, dword [ebp + 4]
test eax, eax
je 0x4d7be0
mov ecx, ebp
call fcn.00516727
mov esi, dword [esp + 0x4c]
push edi
mov ecx, 0xf
lea edi, [esp + 0x10]
lea eax, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
mov ecx, ebp
call fcn.005166d0
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
pop edi
jge 0x4d7c10
neg eax
mov ecx, dword [ebx + 0x208]
add eax, 6
test ecx, ecx
je 0x4d7c38
dec eax
mov ecx, eax
and ecx, reloc.WS2_32.dll_closesocket
jns 0x4d7c2d
dec ecx
or ecx, 0xfffffffc
inc ecx
je 0x4d7c38
mov edx, 4
sub edx, ecx
add eax, edx
push 0
mov ecx, ebx
mov dword [ebx + 0x70], eax
call fcn.004d8c00
push 0xffffffffffffffff
mov ecx, ebx
call fcn.004d9ec0
push 0
mov ecx, ebx
call fcn.004d6c80
push eax
mov ecx, ebx
call fcn.004d6c90
mov ecx, ebx
call fcn.004daaa0
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 4

Function at 0x4d7cb0
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x10
add ecx, 0x50
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, dword [ecx]
mov dword [esp + 8], eax
mov edx, dword [ecx + 4]
mov dword [esp + 0xc], edx
lea edx, [esp + 8]
mov eax, dword [ecx + 8]
push edx
mov dword [esp + 0x14], eax
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x18], ecx
call dword [sym.imp.USER32.dll_InflateRect]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp]
mov edx, dword [esp + 4]
mov dword [eax], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 4], edx
mov edx, dword [esp + 0xc]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
add esp, 0x10
ret 4
Function at 0x4d8430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0x78], ebp
je 0x4d85ed
push ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x90]
cmp eax, ebp
je 0x4d8566
mov ecx, dword [esi + 0x94]
sub ecx, eax
mov eax, dword [esp + 0x14]
sar ecx, 4
cmp eax, ecx
jae 0x4d8566
xor ebx, ebx
mov edx, dword [esi + 0x90]
mov eax, dword [esp + 0x10]
add eax, edx
mov ecx, dword [eax + 4]
cmp ecx, ebp
je 0x4d854d
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
cmp ebx, edx
jae 0x4d854d
mov eax, ecx
mov ecx, esi
mov edi, dword [eax + ebx*4]
push edi
call fcn.004d96a0
mov ebp, eax
test ebp, ebp
je 0x4d8545
push ebp
mov ecx, esi
call fcn.004dab60
test eax, eax
je 0x4d8545
mov edx, dword [esi + 0x74]
cmp edi, edx
je 0x4d8545
mov eax, dword [esp + 0x10]
xor ecx, ecx
test ebx, ebx
sete cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x90]
add eax, ecx
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x4d8506
xor eax, eax
jmp 0x4d850e
mov eax, dword [eax + 8]
sub eax, ecx
sar eax, 2
dec eax
xor ecx, ecx
cmp ebx, eax
lea eax, [edi + 1]
sete cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp eax, edx
sete cl
dec edi
mov dword [esp + 0x30], ecx
xor eax, eax
cmp edi, edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x18]
sete al
push ecx
push edx
mov ecx, ebp
mov dword [esp + 0x3c], eax
call fcn.004db530
inc ebx
xor ebp, ebp
jmp 0x4d8497
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc ecx
add eax, 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x4d8470
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
call fcn.004d99b0
test eax, eax
pop ebx
je 0x4d85ed
mov ecx, dword [esi + 0x74]
push ecx
mov ecx, esi
call fcn.004d96a0
mov edi, eax
cmp edi, ebp
je 0x4d85ed
push edi
mov ecx, esi
call fcn.004dab60
test eax, eax
je 0x4d85ed
mov eax, 1
lea edx, [esi + 0x1f8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x20], edx
call fcn.004d9bf0
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x20], eax
push ecx
mov ecx, esi
call fcn.004d9c60
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push eax
call fcn.004db530
pop edi
pop esi
pop ebp
add esp, 0x28
ret 4
Function at 0x4d8600
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
call fcn.004d6c80
mov ecx, esi
call fcn.004d6c80
push eax
mov ecx, esi
call fcn.004d96a0
push 0xf
mov ebx, eax
call dword [sym.imp.USER32.dll_GetSysColor]
test ebx, ebx
mov edi, eax
je 0x4d8661
mov ecx, esi
call fcn.004d9810
mov edi, eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, ebx
call fcn.004dd630
mov ecx, esi
call fcn.004d7bb0
test eax, eax
jne 0x4d8661
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x4d8661
mov edi, eax
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.004d7cb0
lea ecx, [esp + 0x18]
push edi
push ecx
mov ecx, dword [esp + 0x34]
call fcn.00518d35
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 4
Function at 0x4d8a50
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x78]
xor ebx, ebx
xor ebp, ebp
xor ecx, ecx
test eax, eax
jne 0x4d8a83
mov eax, dword [esp + 0x38]
mov edx, eax
mov dword [edx], edi
pop edi
pop esi
mov dword [edx + 4], ebx
mov dword [edx + 8], ebp
pop ebp
pop ebx
mov dword [edx + 0xc], ecx
add esp, 0x24
ret 4
mov eax, dword [esi + 0x74]
mov ecx, esi
push eax
call fcn.004d96a0
test eax, eax
mov dword [esp + 0x10], eax
je 0x4d8aad
push eax
mov ecx, esi
call fcn.004dab60
test eax, eax
je 0x4d8aad
test esi, esi
je 0x4d8aad
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x4d8aca
mov eax, dword [esp + 0x38]
xor ecx, ecx
mov edx, eax
mov dword [edx], edi
pop edi
pop esi
mov dword [edx + 4], ebx
mov dword [edx + 8], ebp
pop ebp
pop ebx
mov dword [edx + 0xc], ecx
add esp, 0x24
ret 4
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 0x78]
cmp eax, 1
je 0x4d8aed
cmp eax, 2
je 0x4d8aed
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
jmp 0x4d8af5
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
mov ecx, ebx
sub edi, eax
call fcn.004dcf70
mov eax, dword [esi + 0x208]
test eax, eax
jne 0x4d8ba5
mov ecx, esi
call fcn.004d7390
mov ecx, dword [esp + 0x18]
cmp eax, 3
je 0x4d8b64
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
sub ecx, 3
sub edx, 3
add eax, 4
mov dword [esp + 0x18], ecx
test ecx, ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], eax
jge 0x4d8b4c
xor ecx, ecx
mov dword [esp + 0x18], ecx
cmp edx, 0xffffffff
jge 0x4d8b58
or edx, 0xffffffff
mov dword [esp + 0x14], edx
cmp eax, edi
jle 0x4d8bb1
mov eax, edi
mov dword [esp + 0x1c], eax
jmp 0x4d8bb1
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
sub ecx, 3
sub edx, 4
add eax, 4
mov dword [esp + 0x18], ecx
test ecx, ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], eax
jge 0x4d8b8b
xor ecx, ecx
mov dword [esp + 0x18], ecx
test edx, edx
jge 0x4d8b95
xor edx, edx
mov dword [esp + 0x14], edx
lea esi, [edi - 5]
cmp eax, esi
jle 0x4d8bb1
lea eax, [edi + 1]
mov dword [esp + 0x1c], eax
jmp 0x4d8bb1
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x20]
sub eax, edx
sub esi, ecx
push esi
push eax
push ecx
lea eax, [esp + 0x20]
push edx
push eax
mov ecx, ebx
call fcn.004dd060
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x14]
mov ecx, eax
pop edi
pop esi
pop ebp
mov dword [ecx], edx
mov edx, dword [esp + 0xc]
pop ebx
mov dword [ecx + 4], edx
mov edx, dword [esp + 0xc]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x10]
mov dword [ecx + 0xc], edx
add esp, 0x24
ret 4
Function at 0x4d9530
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
test eax, eax
push ebx
push esi
push edi
mov edi, ecx
je 0x4d954e
push eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
jmp 0x4d956d
test edi, edi
je 0x4d9692
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x4d9692
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [edi + 0x90]
test ecx, ecx
jne 0x4d957b
xor eax, eax
jmp 0x4d9586
mov eax, dword [edi + 0x94]
sub eax, ecx
sar eax, 4
mov esi, dword [edi + 0x70]
imul esi, eax
mov eax, dword [edi + 0x78]
add esi, 2
cmp eax, 1
jne 0x4d95ce
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_SetRect]
push edx
push eax
push esi
lea ecx, [edi + 0x50]
push 0
push ecx
call ebx
mov edx, dword [esp + 0x14]
push esi
push edx
push 2
add edi, 0x60
push 0
push edi
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret 4
cmp eax, 2
jne 0x4d9612
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_SetRect]
sub eax, esi
push eax
push ecx
push 0
lea edx, [edi + 0x50]
push 0
push edx
call ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
sub eax, esi
push ecx
push eax
add edi, 0x60
push 0
push edi
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret 4
cmp eax, 3
jne 0x4d964e
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_SetRect]
push edx
push eax
push 0
lea ecx, [edi + 0x50]
push esi
push ecx
call ebx
mov edx, dword [esp + 0x18]
add edi, 0x60
push edx
push esi
push 0
push 2
push edi
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret 4
cmp eax, 4
jne 0x4d9692
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ebx, dword [sym.imp.USER32.dll_SetRect]
sub ecx, esi
push eax
push ecx
push 0
lea edx, [edi + 0x50]
push 0
push edx
call ebx
mov eax, dword [esp + 0x18]
add edi, 0x60
push eax
mov eax, dword [esp + 0x18]
push eax
sub eax, esi
push 0
push eax
push edi
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 4
Function at 0x4d9710
Capabilities:
Reference http user-agent string

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x14
mov edx, dword [eax]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [eax + 4]
push ecx
lea eax, [edi + 0x60]
push edx
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4d97d7
mov dword [esp + 0x10], 0
xor ebp, ebp
mov eax, dword [edi + 0x90]
test eax, eax
je 0x4d97d7
mov ecx, dword [edi + 0x94]
sub ecx, eax
mov eax, dword [esp + 0x10]
sar ecx, 4
cmp eax, ecx
jae 0x4d97d7
xor ebx, ebx
mov edx, dword [edi + 0x90]
mov ecx, dword [edx + ebp + 4]
lea eax, [edx + ebp]
test ecx, ecx
je 0x4d97ba
mov edx, dword [eax + 8]
sub edx, ecx
sar edx, 2
cmp ebx, edx
jae 0x4d97ba
mov eax, ecx
mov ecx, edi
mov esi, dword [eax + ebx*4]
push esi
call fcn.004d96a0
test eax, eax
je 0x4d97b7
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.004dce20
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x14]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4d97cb
inc ebx
jmp 0x4d9763
mov ecx, dword [esp + 0x10]
inc ecx
add ebp, 0x10
mov dword [esp + 0x10], ecx
jmp 0x4d9740
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x14
ret 4

Function at 0x4d9830
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x28
push edi
mov edi, ecx
call fcn.004d9ac0
cmp eax, 1
jne 0x4d991f
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x4d9852
xor eax, eax
pop edi
add esp, 0x28
ret
mov eax, dword [edi + 0x78]
cmp eax, 1
je 0x4d9866
cmp eax, 2
je 0x4d9866
xor eax, eax
pop edi
add esp, 0x28
ret
mov ecx, dword [edi + 0x1c]
push ebx
push ebp
lea eax, [esp + 0x24]
push esi
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
cmp dword [edi + 0x78], 1
jne 0x4d9882
xor esi, esi
jmp 0x4d988e
mov esi, dword [esp + 0x34]
mov eax, dword [edi + 0x218]
sub esi, eax
mov ecx, dword [edi + 0x214]
mov ebp, dword [edi + 0x218]
add ebp, esi
push 0
lea edx, [ecx + ecx]
sub ebp, esi
mov ebx, edx
mov edx, dword [esp + 0x34]
mov eax, edx
sub edx, ecx
sub eax, ebx
push ebp
mov dword [esp + 0x18], edx
lea ebx, [eax + ecx]
add ecx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [edi + 0x218]
sub ebx, eax
add ecx, esi
push ebx
mov dword [esp + 0x30], ecx
push esi
lea ecx, [edi + 0xe8]
push eax
call fcn.00513d1a
push 5
lea ecx, [edi + 0xe8]
call fcn.00513daa
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
sub eax, esi
push 0
push eax
mov eax, dword [esp + 0x28]
sub eax, ecx
add edi, 0x164
push eax
push esi
push ecx
mov ecx, edi
call fcn.00513d1a
push 5
mov ecx, edi
call fcn.00513daa
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
add esp, 0x28
ret
lea ecx, [edi + 0xe8]
test ecx, ecx
je 0x4d9944
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x4d9944
push 0
call fcn.00513daa
push 0
lea ecx, [edi + 0x164]
call fcn.00513daa
mov eax, 1
pop edi
add esp, 0x28
ret
Function at 0x4d9a10
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x30
push esi
push edi
mov edi, dword [esp + 0x3c]
mov esi, ecx
push edi
call fcn.004d99b0
test eax, eax
jne 0x4d9a2d
pop edi
pop esi
add esp, 0x30
ret 4
lea eax, [esi + 0xe8]
test eax, eax
je 0x4d9a3e
mov ecx, dword [eax + 0x1c]
test ecx, ecx
jne 0x4d9a48
pop edi
xor eax, eax
pop esi
add esp, 0x30
ret 4
mov eax, dword [esi + 0x104]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4d9a61
pop edi
pop esi
add esp, 0x30
ret 4
push edi
mov ecx, esi
call fcn.004d96a0
mov edi, eax
test edi, edi
jne 0x4d9a77
pop edi
pop esi
add esp, 0x30
ret 4
mov edx, dword [esi + 0x104]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 8]
mov ecx, edi
push eax
call fcn.004dce20
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.005162d2
lea edx, [esp + 0x18]
lea eax, [esp + 8]
push edx
lea ecx, [esp + 0x2c]
push eax
push ecx
call dword [sym.imp.USER32.dll_IntersectRect]
pop edi
pop esi
add esp, 0x30
ret 4

Function at 0x4d9d90
Capabilities:
Reference http user-agent string

Disassembly:
sub esp, 0x20
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, ecx
test ebp, ebp
je 0x4d9e54
mov eax, dword [ebp + 4]
test eax, eax
je 0x4d9e54
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
test eax, eax
je 0x4d9e54
mov ecx, dword [ebp + 4]
push ebx
lea eax, [esp + 0xc]
push edi
push eax
push 0
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageInfo]
test eax, eax
je 0x4d9df4
mov edx, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
sub edx, edi
sub eax, ecx
mov dword [esi + 0x214], edx
mov dword [esi + 0x218], eax
lea edi, [esi + 0xe8]
push ebp
mov ecx, edi
call fcn.004dfe90
push 3
push 2
push 1
push 0
mov ecx, edi
mov ebx, eax
call fcn.004dfe40
lea edi, [esi + 0x164]
push ebp
mov ecx, edi
and ebx, eax
call fcn.004dfe90
push 7
push 6
push 5
push 4
mov ecx, edi
mov ebp, eax
call fcn.004dfe40
mov ecx, esi
and ebp, eax
call fcn.004daaa0
pop edi
test ebx, ebx
pop ebx
je 0x4d9e54
test ebp, ebp
je 0x4d9e54
pop esi
mov eax, 1
pop ebp
add esp, 0x20
ret 4
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret 4