joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452574
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x694
push ebx
xor ebx, ebx
push ebp
mov ebp, dword [esp + 0x6ac]
push esi
mov esi, dword [esp + 0x6a4]
mov edx, dword [esi + 4]
push edi
xor eax, eax
push ebx
mov word [esp + 0x50], ax
mov eax, dword [esi]
push edx
xor ecx, ecx
push eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov word [esp + 0x262], cx
mov dword [esp + 0x488], ebx
mov dword [esp + 0x2c], 1
call fcn.0041557c
mov edx, dword [esp + 0x6b8]
add esp, 0xc
lea ecx, [esp + 0x490]
push ecx
push edx
push esi
call fcn.004523ce
test eax, eax
je 0x45260c
lea eax, [ebx + 6]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x694
ret 0x10
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x1f]
push 1
push ecx
call fcn.004151b0
mov edx, dword [esi]
push edx
push 1
lea eax, [esp + 0x30]
push 4
push eax
call fcn.004151b0
mov ecx, dword [esi]
mov edi, dword [esp + 0x38]
push ecx
push 1
lea edx, [esp + 0x40]
push 4
push edx
xor edi, 0x87bc
call fcn.004151b0
mov ecx, dword [esi]
mov eax, dword [esp + 0x48]
push ecx
push 1
lea edx, [esp + 0x50]
xor eax, 0x87bc
push 4
push edx
mov dword [ebp], eax
call fcn.004151b0
mov eax, dword [esp + 0x58]
add esp, 0x40
xor eax, 0xa685
push 1
mov dword [esp + 0x28], eax
mov eax, dword [esi]
push 0x10
push eax
call fcn.0041557c
mov ecx, dword [ebp]
add esp, 0xc
push ecx
call fcn.004138ba
add esp, 4
push edi
mov dword [esp + 0x20], eax
call fcn.004138ba
mov edx, dword [esi]
add esp, 4
push edx
push 1
mov ebp, eax
push edi
push ebp
call fcn.004151b0
mov eax, dword [esi + 8]
add esp, 0x10
add eax, 0x53a40357
push eax
push edi
push ebp
call fcn.0044afdc
push edi
push ebp
lea ecx, [esp + 0x28]
push ecx
call fcn.0043535d
mov edx, dword [esp + 0x24]
cmp edx, dword [esp + 0x20]
je 0x4526fd
mov eax, dword [esp + 0x1c]
push eax
call fcn.00413a88
add esp, 4
push ebp
call fcn.00413a88
add esp, 4
mov eax, 0xa
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x694
ret 0x10
cmp byte [esp + 0x17], 1
jne 0x45275b
xor ecx, ecx
mov eax, 1
mov word [esp + 0x4c], cx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
xor edx, edx
push ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov word [esp + 0x25a], dx
mov dword [esp + 0x480], ebx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], eax
call fcn.0044b195
push ebp
call fcn.00413a88
jmp 0x452769
mov edx, dword [esp + 0x1c]
push edx
call fcn.00413a88
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 0x6b4]
mov ecx, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebp
mov dword [eax], ecx
xor eax, eax
pop ebx
add esp, 0x694
ret 0x10
Function at 0x453b94
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10c
push ebx
xor ebx, ebx
push esi
mov esi, dword [esp + 0x118]
mov cl, 1
cmp byte [eax], bl
je 0x453bb2
mov byte [esi + 0x14], cl
cmp byte [eax + 2], bl
je 0x453bba
mov byte [esi + 0x16], cl
cmp byte [eax + 3], bl
je 0x453bc2
mov byte [esi + 0x17], cl
cmp byte [esi + 0x14], bl
je 0x453bcf
cmp byte [esi + 0x1a], bl
je 0x453bcf
mov byte [esi + 0x14], bl
cmp byte [esi + 0x15], bl
je 0x453bdc
cmp byte [esi + 0x1b], bl
je 0x453bdc
mov byte [esi + 0x15], bl
cmp byte [esi + 0x16], bl
je 0x453be9
cmp byte [esi + 0x1c], bl
je 0x453be9
mov byte [esi + 0x16], bl
cmp byte [esi + 0x17], bl
je 0x453bf6
cmp byte [esi + 0x1d], bl
je 0x453bf6
mov byte [esi + 0x17], bl
cmp byte [esi + 0x18], bl
je 0x453c03
cmp byte [esi + 0x1e], bl
je 0x453c03
mov byte [esi + 0x18], bl
cmp dword [esi + 0x20], ebx
je 0x453c6b
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov cl, byte [esi + 0x1a]
cmp cl, bl
jne 0x453c21
mov byte [esp + 0xb4], bl
mov al, byte [esi + 0x1b]
cmp al, bl
jne 0x453c2f
mov byte [esp + 0xb5], bl
cmp cl, bl
jne 0x453c3b
cmp al, bl
jne 0x453c3b
mov byte [esp + 0x24], bl
cmp byte [esi + 0x1c], bl
jne 0x453c44
mov byte [esp + 0x25], bl
cmp byte [esi + 0x1d], bl
jne 0x453c4d
mov byte [esp + 0x26], bl
cmp cl, bl
jne 0x453c55
mov byte [esp + 0x6f], bl
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_SetKeyboardState]
pop esi
pop ebx
add esp, 0x10c
ret 8
push ebp
push edi
lea edx, [esp + 0x10]
push edx
call fcn.00444fc0
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
call edi
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x453ca5
push 0xa0
call ebp
mov edx, 0x8000
test dx, ax
je 0x453cc4
cmp byte [esi + 0x1a], bl
jne 0x453cc4
push 0xa0
lea eax, [esp + 0x14]
push eax
call fcn.0044c7a0
lea ecx, [esp + 0x10]
push ecx
push esi
call fcn.0044c379
push 0xa1
call edi
mov edx, 0x8000
test dx, ax
jne 0x453ce6
push 0xa1
call ebp
mov ecx, 0x8000
test cx, ax
je 0x453d05
cmp byte [esi + 0x1b], bl
jne 0x453d05
push 0xa1
lea edx, [esp + 0x14]
push edx
call fcn.0044c7a0
lea eax, [esp + 0x10]
push eax
push esi
call fcn.0044c379
push 0x11
call edi
mov ecx, 0x8000
test cx, ax
jne 0x453d21
push 0x11
call ebp
mov edx, 0x8000
test dx, ax
je 0x453d3d
cmp byte [esi + 0x1c], bl
jne 0x453d3d
push 0x11
lea eax, [esp + 0x14]
push eax
call fcn.0044c7a0
lea ecx, [esp + 0x10]
push ecx
push esi
call fcn.0044c379
push 0x12
call edi
mov edx, 0x8000
test dx, ax
jne 0x453d59
push 0x12
call ebp
mov ecx, 0x8000
test cx, ax
je 0x453d75
cmp byte [esi + 0x1d], bl
jne 0x453d75
push 0x12
lea edx, [esp + 0x14]
push edx
call fcn.0044c7a0
lea eax, [esp + 0x10]
push eax
push esi
call fcn.0044c379
push 0x5b
call edi
mov ecx, 0x8000
test cx, ax
jne 0x453d91
push 0x5b
call ebp
mov edx, 0x8000
test dx, ax
je 0x453dad
cmp byte [esi + 0x1e], bl
jne 0x453dad
push 0x5b
lea eax, [esp + 0x14]
push eax
call fcn.0044c7a0
lea ecx, [esp + 0x10]
push ecx
push esi
call fcn.0044c379
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10c
ret 8
Function at 0x456354
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esi]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esi + 0x160], ecx
mov dword [esi + 0x164], edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp eax, dword [esi + 0x168]
jne 0x4563a8
cmp ecx, dword [esi + 0x16c]
je 0x4563c6
cmp dword [esp + 0x24], 1
mov dword [esi + 0x168], eax
mov dword [esi + 0x16c], ecx
jl 0x4563c6
push ecx
push eax
push esi
push 0xfffffffffffffff5
push ebx
call fcn.00451aa9
mov ecx, dword [ebx + 0x18]
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push ecx
call ebp
mov edx, dword [ebx + 0x1c]
movzx edi, ax
push edx
shr edi, 0xf
call ebp
movzx ebp, ax
shr ebp, 0xf
cmp edi, dword [esi + 0x170]
je 0x456466
cmp dword [esp + 0x24], 1
jl 0x456466
cmp byte [esi + 0x19c], 0
je 0x456466
test edi, edi
je 0x45640f
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push esi
push 0xfffffffffffffff9
jmp 0x456459
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
push esi
push 0xfffffffffffffff8
push ebx
call fcn.00451aa9
cmp byte [esi + 0x178], 0
je 0x45645f
mov ecx, dword [esi]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x1000000
je 0x45644c
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
push esi
push 0xfffffffffffffffa
jmp 0x456459
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
push esi
push 0xfffffffffffffff4
push ebx
call fcn.00451aa9
mov byte [esi + 0x178], 0
mov eax, dword [esp + 0x24]
test eax, eax
je 0x456474
mov dword [esi + 0x170], edi
cmp ebp, dword [esi + 0x174]
je 0x4564a7
cmp eax, 1
jl 0x4564a7
test ebp, ebp
je 0x456494
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push esi
push 0xfffffffffffffff7
jmp 0x4564a1
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
push esi
push 0xfffffffffffffff6
push ebx
call fcn.00451aa9
cmp dword [esp + 0x24], 0
je 0x4564b4
mov dword [esi + 0x174], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x457f49
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2020
call fcn.00425210
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.0040c060
lea ecx, [esp + 0x20]
call fcn.0040c060
mov eax, dword [esp + 0x2034]
push eax
xor ebp, ebp
call fcn.00453081
mov esi, eax
movzx eax, word [esi]
xor bl, bl
test ax, ax
je 0x458074
nop
inc ebp
cmp ax, 0x25
jne 0x458049
cmp word [esi + ebp*2], ax
jne 0x457fad
push 0x25
lea eax, [esp + 0x14]
mov bl, 1
call fcn.00403470
inc ebp
jmp 0x458053
push 0x4848e8
lea eax, [esp + 0x24]
call fcn.004021e0
movzx eax, word [esi + ebp*2]
cmp ax, 0x25
je 0x457fe7
lea esp, [esp]
test ax, ax
je 0x457fe7
movzx eax, ax
push eax
lea eax, [esp + 0x24]
call fcn.00403470
movzx eax, word [esi + ebp*2 + 2]
inc ebp
cmp ax, 0x25
jne 0x457fc9
cmp word [esi + ebp*2], 0
je 0x458093
mov eax, dword [esp + 0x20]
push 0xfff
lea edx, [esp + 0x34]
push edx
xor ecx, ecx
push eax
inc ebp
mov word [esp + 0x3c], cx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
lea eax, [esp + 0x10]
je 0x458024
lea edi, [esp + 0x30]
call fcn.0040d330
mov bl, 1
jmp 0x458053
mov edi, 0x48b7e0
mov bl, 1
call fcn.0040d330
lea ecx, [esp + 0x20]
push ecx
lea eax, [esp + 0x14]
call fcn.0040c140
lea eax, [esp + 0x10]
call fcn.0040d330
jmp 0x458053
push eax
lea eax, [esp + 0x14]
call fcn.00403470
movzx eax, word [esi + ebp*2]
test ax, ax
jne 0x457f89
test bl, bl
je 0x458074
mov esi, dword [esp + 0x2034]
lea edi, [esp + 0x10]
call fcn.0040e640
lea ecx, [esp + 0x20]
call fcn.00402620
lea ecx, [esp + 0x10]
call fcn.00402620
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2020
ret 4
mov edi, 0x48b7e0
lea eax, [esp + 0x10]
call fcn.0040d330
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x14]
call fcn.0040c140
jmp 0x458064
Function at 0x4580e1
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
sub esp, 0x264
push ebp
mov ebp, dword [esp + 0x278]
push esi
mov esi, dword [esp + 0x274]
push edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
call fcn.0040c060
lea ecx, [esp + 0x18]
call fcn.0040c060
lea ecx, [esp + 0x38]
call fcn.0040c060
push str.SOFTWAREClasses_
lea eax, [esp + 0x2c]
call fcn.004021e0
mov edi, dword [esp + 0x274]
lea eax, [esp + 0x28]
call fcn.0040d330
mov edi, str.CLSID
lea eax, [esp + 0x28]
call fcn.0040d330
push 0x4848e8
lea eax, [esp + 0x1c]
call fcn.004021e0
test esi, esi
je 0x458187
cmp word [esi], 0x5c
je 0x458187
cmp word [esi + 2], 0x5c
je 0x458187
push 0x48a9e4
lea eax, [esp + 0x1c]
call fcn.004021e0
mov edi, esi
lea eax, [esp + 0x18]
call fcn.0040d330
test ebp, ebp
je 0x4581e5
push 0x20
lea eax, [esp + 0x4c]
push 0
push eax
call fcn.004131f0
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea esi, [esp + 0x3c]
mov dword [esp + 0x50], 0
call fcn.0040df50
mov edi, str.IPC_
mov eax, esi
call fcn.0040d330
mov eax, dword [esp + 0x284]
mov edx, dword [esp + 0x38]
push 0
push ebp
push eax
lea ecx, [esp + 0x54]
push ecx
mov dword [esp + 0x6c], edx
call sub.MPR.dll_WNetAddConnection2W
mov esi, eax
test esi, esi
jne 0x458298
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push reloc.WSOCK32.dll_bind
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov esi, eax
test esi, esi
jne 0x458298
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push eax
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x458291
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x6c]
push edx
push 0
push 0
push 0
push eax
mov dword [esp + 0x28], 0x1fe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x45828a
mov eax, dword [esp + 0x10]
shr eax, 1
xor ecx, ecx
lea edi, [esp + 0x68]
mov dword [esp + 0x10], eax
mov word [esp + eax*2 + 0x68], cx
call fcn.0040fff0
mov edx, dword [esp + 0x27c]
mov edi, eax
push edx
push edi
call dword [sym.imp.ole32.dll_CLSIDFromString]
push edi
mov esi, eax
call fcn.004137d3
add esp, 4
mov eax, dword [esp + 0xc]
push eax
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call ebp
lea ecx, [esp + 0x38]
call fcn.00402620
lea ecx, [esp + 0x18]
call fcn.00402620
lea ecx, [esp + 0x28]
call fcn.00402620
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x264
ret
Function at 0x4582bf
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x24c
push ebx
push ebp
mov ebp, dword [esp + 0x258]
push esi
push edi
lea ecx, [esp + 0x30]
call fcn.0040c060
fld1
lea eax, [esp + 0x24]
fstp qword [esp + 0x28]
push eax
push ebp
call dword [sym.imp.ole32.dll_StringFromIID]
mov esi, eax
test esi, esi
jl 0x4584c0
mov edi, dword [esp + 0x24]
call fcn.0040fff0
mov esi, eax
push str.interface_
lea eax, [esp + 0x34]
call fcn.004021e0
mov edi, esi
lea eax, [esp + 0x30]
call fcn.0040d330
mov edi, str.TypeLib
lea eax, [esp + 0x30]
call fcn.0040d330
push esi
call fcn.004137d3
mov ecx, dword [esp + 0x28]
add esp, 4
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4584c0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x54]
push edx
push eax
push eax
push eax
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x2c], 0x1fe
call ebx
mov esi, eax
test esi, esi
jne 0x4584b5
mov eax, dword [esp + 0x14]
shr eax, 1
xor ecx, ecx
lea edi, [esp + 0x50]
mov dword [esp + 0x14], eax
mov word [esp + eax*2 + 0x50], cx
call fcn.0040fff0
lea edx, [esp + 0x40]
mov edi, eax
push edx
push edi
call dword [sym.imp.ole32.dll_CLSIDFromString]
push edi
mov esi, eax
call fcn.004137d3
add esp, 4
test esi, esi
jl 0x4584b5
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x54]
push ecx
push 0
push 0
push str.Version
push edx
mov dword [esp + 0x2c], 0x1fe
call ebx
test eax, eax
jne 0x458410
mov eax, dword [esp + 0x14]
shr eax, 1
lea edx, [esp + 0x50]
xor ecx, ecx
push edx
mov dword [esp + 0x18], eax
mov word [esp + eax*2 + 0x54], cx
call fcn.00413f97
fstp qword [esp + 0x2c]
add esp, 4
fld1
lea eax, [esp + 0x20]
push eax
push 0
sub esp, 0x10
fstp qword [esp + 8]
fld qword [esp + 0x40]
fstp qword [esp]
call fcn.00415a50
fnstcw word [esp + 0x2a]
add esp, 0x10
movzx eax, word [esp + 0x1a]
or eax, 0xc00
mov dword [esp + 0x20], eax
fldcw word [esp + 0x20]
fistp dword [esp + 0x20]
mov cx, word [esp + 0x20]
movzx edx, cx
push edx
fldcw word [esp + 0x1e]
lea edx, [esp + 0x4c]
fld qword [esp + 0x34]
fnstcw word [esp + 0x1e]
movzx eax, word [esp + 0x1e]
or eax, 0xc00
mov dword [esp + 0x24], eax
fldcw word [esp + 0x24]
fistp dword [esp + 0x24]
mov ax, word [esp + 0x24]
movzx ecx, ax
push ecx
fldcw word [esp + 0x22]
push edx
call dword [sym.imp.OLEAUT32.dll_RegisterTypeLib]
mov esi, eax
test esi, esi
jl 0x4584b5
mov edx, dword [esp + 0x264]
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
push edx
push ebp
push eax
mov eax, dword [ecx + 0x18]
call eax
mov esi, eax
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x30]
call fcn.00402620
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x24c
ret
Function at 0x4584d6
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x284
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x20]
mov esi, 0x80004002
xor ebx, ebx
mov dword [esp + 0x14], 0x28
call fcn.0040c060
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x1c]
push eax
push 0x20019
push ebx
push str.interface
push accept
call ebp
test eax, eax
jne 0x45861b
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x20]
push 0
push 0
push 0
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x4c]
push eax
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x458610
mov eax, dword [esp + 0x14]
xor edx, edx
mov word [esp + eax*2 + 0x38], dx
push str.interface_
lea eax, [esp + 0x24]
mov dword [esp + 0x18], 0x1fe
call fcn.004021e0
lea edi, [esp + 0x38]
lea eax, [esp + 0x20]
call fcn.0040d330
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 0
push edx
push accept
call ebp
test eax, eax
jne 0x4585fe
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x8c]
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4585f3
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x29c]
shr eax, 1
xor ecx, ecx
mov dword [esp + 0x14], eax
mov word [esp + eax*2 + 0x88], cx
push edx
lea eax, [esp + 0x8c]
push eax
call fcn.004115d0
add esp, 8
test eax, eax
jne 0x4585f3
mov ecx, dword [esp + 0x298]
push ecx
push edi
call dword [sym.imp.ole32.dll_IIDFromString]
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x458610
inc ebx
mov dword [esp + 0x14], 0x28
jmp 0x45851d
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x20]
call fcn.00402620
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x284
ret
Function at 0x4607e9
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push 0x4848e8
call fcn.004021e0
push ebx
call fcn.00438992
test al, al
je 0x46080c
xor al, al
pop ebx
ret 8
mov eax, dword [ebx]
push ebp
push esi
push edi
push 0
push 0
push 0xe
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
test edi, edi
jne 0x460829
mov edi, 0x7fff
xor ecx, ecx
lea ebp, [edi + 1]
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
add esp, 4
mov esi, eax
mov eax, dword [ebx]
push esi
push ebp
push 0xd
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
test eax, eax
mov eax, dword [esp + 0x18]
mov word [esi + edi*2], cx
jne 0x460880
push 0x4848e8
call fcn.004021e0
push esi
call fcn.004112ef
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret 8
push esi
call fcn.004021e0
push esi
call fcn.004112ef
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret 8
Function at 0x461604
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
mov edx, dword [ebx]
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0xb0
push edx
call esi
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x10]
jb 0x461637
pop esi
xor al, al
pop ebx
pop ecx
ret 8
mov ecx, dword [ebx]
push edi
push 0
push 0
push 0xe
push ecx
call esi
mov edi, eax
test edi, edi
je 0x4616c2
cmp edi, dword [esp + 0xc]
jb 0x4616c2
cmp edi, dword [esp + 0x14]
jb 0x4616c2
push ebp
xor ecx, ecx
lea ebp, [edi + 1]
mov eax, ebp
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
add esp, 4
mov esi, eax
mov eax, dword [ebx]
push esi
push ebp
push 0xd
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop ebp
test eax, eax
je 0x4616b9
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x461696
xor ecx, ecx
mov word [esi + eax*2], cx
mov edx, dword [esp + 0xc]
lea eax, [esi + edx*2]
push eax
mov eax, dword [esp + 0x1c]
call fcn.004021e0
push esi
call fcn.004112ef
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
pop ecx
ret 8
push esi
call fcn.004112ef
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 8
Function at 0x4647a2
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
lea ecx, [esp + 0x10]
push ecx
mov eax, 2
push ebp
mov word [ebx], ax
call fcn.0045a407
mov eax, dword [eax]
push eax
call sub.WSOCK32.dll_inet_addr
lea esi, [esp + 0x10]
mov edi, eax
call fcn.00401330
cmp edi, 0xffffffff
jne 0x464814
push 0x48a844
push ebp
call fcn.0044cd47
add esp, 8
test al, al
je 0x464814
push 0
push 1
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
add eax, ecx
call fcn.004040e0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret 0x10
push 0
push 2
jmp 0x4647f2
mov eax, dword [esp + 0x30]
lea ecx, [eax - 1]
mov dword [ebx + 4], edi
cmp ecx, 0xfffe
ja 0x46480e
push eax
call sub.WSOCK32.dll_htons
pop edi
pop esi
mov word [ebx + 2], ax
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret 0x10

Function at 0x465d41
Capabilities:
Parse url

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
mov esi, dword [esp + 0x64]
push edi
mov edi, dword [esp + 0x6c]
push 0x38
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.004131f0
add esp, 0xc
lea ecx, [esp + 0x24]
mov ebx, 1
push ecx
push 0
push esi
mov dword [esp + 0x30], 0x7c
mov dword [esp + 0x50], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x58], ebx
call fcn.004112d5
add esp, 4
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x465dae
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret 8
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
push 0
push edx
mov ecx, edi
call fcn.00403fb0
mov eax, dword [esp + 0x34]
push 0
push eax
mov eax, dword [esp + 0x40]
lea ecx, [edi + 0x10]
call fcn.00403fb0
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
push 0
push ecx
lea ecx, [edi + 0x20]
call fcn.00403fb0
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
push 0
push edx
lea ecx, [edi + 0x30]
call fcn.00403fb0
mov eax, dword [esp + 0x50]
push 0
lea esi, [edi + 0x40]
push eax
mov eax, dword [esp + 0x5c]
mov ecx, esi
call fcn.00403fb0
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x5c]
push 0
lea ebp, [edi + 0x50]
push ecx
mov ecx, ebp
call fcn.00403fb0
push ebp
lea edx, [esp + 0x18]
push edx
push esi
call fcn.0044cd63
push eax
lea esi, [edi + 0x60]
call fcn.0040df50
lea ecx, [esp + 0x14]
call fcn.00402620
mov ax, word [esp + 0x3c]
mov word [edi + 0x78], ax
mov eax, dword [esp + 0x30]
mov dword [edi + 0x74], eax
sub eax, ebx
je 0x465e7f
sub eax, ebx
je 0x465e6c
mov dword [edi + 0x70], 3
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret 8
mov dword [edi + 0x70], 2
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret 8
mov dword [edi + 0x70], ebx
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x54
ret 8
Function at 0x465fc3
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
cmp byte [esi + 0xd0], 0
je 0x466001
test al, al
je 0x466001
lea eax, [esi + 0xd4]
push eax
call fcn.00434b61
push esi
push 0
push 0x465fb6
call fcn.00415702
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], eax
sete al
pop esi
ret 8
push eax
push esi
call fcn.00465e8e
pop esi
ret 8

Function at 0x465fe6
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
cmp byte [esi + 0xd0], 0
je 0x466001
test al, al
je 0x466001
lea eax, [esi + 0xd4]
push eax
call fcn.00434b61
push esi
push 0
push 0x465fb6
call fcn.00415702
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], eax
sete al
pop esi
ret 8
push eax
push esi
call fcn.00465e8e
pop esi
ret 8