joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473d60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d4d9b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x5010c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x228], ebx
mov eax, dword [0x5169b0]
test al, 1
jne 0x473dd6
or eax, 1
mov dword [0x5169b0], eax
call fcn.00404f80
mov ecx, eax
test ecx, ecx
je 0x473f6b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push 0x4d9050
mov dword [0x5169b4], eax
call fcn.0049fa56
add esp, 4
mov eax, dword [0x5169b4]
cmp dword [eax - 0xc], 0
jne 0x473f36
mov esi, dword [0x51649c]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
test esi, esi
je 0x473e0d
lock inc dword [esi + 4]
mov esi, dword [0x51649c]
mov ecx, dword [0x516498]
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x228], esi
mov dword [ebp - 4], 0
lea edx, [ebp - 0x224]
mov eax, dword [ecx]
push edx
call dword [eax + 0x30]
or edi, 0xffffffff
mov byte [ebp - 4], 2
test esi, esi
je 0x473e5c
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x473e5c
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x473e5c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [ebp - 0x21c]
push eax
push 0x201
push 0
push dword [ebp - 0x224]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x473f14
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004a15c0
add esp, 0xc
mov dword [ebp - 0x220], 1
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push str.DisplayVersion
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x473ef3
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, 0x5169b4
call fcn.00404b80
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x473f36
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [0x5169b4]
add ecx, 0xfffffff0
push ecx
call fcn.00404680
add esp, 4
add eax, 0x10
mov dword [ebx], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049fb4b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404d50
int3
Function at 0x4756f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d50eb
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5010c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 4], 0
mov esi, dword [0x51649c]
test esi, esi
je 0x47573b
lock inc dword [esi + 4]
mov esi, dword [0x51649c]
mov ecx, dword [0x516498]
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], esi
mov byte [ebp - 4], 2
lea edx, [ebp - 0x21c]
mov eax, dword [ecx]
push edx
call dword [eax + 0xec]
or edi, 0xffffffff
mov byte [ebp - 4], 4
test esi, esi
je 0x47578a
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x47578a
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x47578a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a15c0
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [ebp + 8]
push 0x104
push eax
push 0x4ea3d0
push dword [ebp + 0xc]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 0x2a
cmp ax, word [ebp - 0x218]
je 0x475805
lea edx, [ebp - 0x218]
lea esi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4757e0
sub edx, esi
lea eax, [ebp - 0x218]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.00404b80
mov esi, 1
jmp 0x475807
xor esi, esi
mov byte [ebp - 4], 1
mov eax, edi
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x475828
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x475846
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x475865
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049fb4b
mov esp, ebp
pop ebp
ret
Function at 0x476e90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
cmp dword [eax - 0xc], 0
jne 0x476ea1
xor ebx, ebx
jmp 0x476ebd
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
cmp eax, 0x20
mov eax, dword [ebp + 8]
setg bl
add eax, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x476ed5
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x4770e0
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5010c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x477150
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x477144
mov dword [ebp - 0x14], eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049fb4b
mov esp, ebp
pop ebp
ret
Function at 0x477fb0
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d54bd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5010c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 1
push dword [ebp + 8]
push ebx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x478105
cmp dword [ebp - 0x10], 0
je 0x478105
call fcn.00404f80
mov ecx, eax
test ecx, ecx
je 0x478142
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x10]
test edx, edx
js 0x478138
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x478053
push edx
lea ecx, [ebp - 0x14]
call fcn.00404ae0
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
push esi
push 1
push dword [ebp + 8]
push ebx
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
push dword [esi - 8]
push esi
test eax, eax
jne 0x4780da
call fcn.004abf56
add esp, 8
test eax, eax
js 0x478138
cmp eax, dword [esi - 8]
jg 0x478138
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
call fcn.00404f80
mov ecx, eax
test ecx, ecx
je 0x47812e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
mov dword [edi], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x47811a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004abf56
add esp, 8
test eax, eax
js 0x478138
cmp eax, dword [esi - 8]
jg 0x478138
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
add esi, 0xfffffff0
push esi
call fcn.00404680
add esp, 4
add eax, 0x10
jmp 0x4780a8
call fcn.00404f80
mov ecx, eax
test ecx, ecx
je 0x478142
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404d50
push 0x80070057
call fcn.00404d50
push 0x80004005
call fcn.00404d50
int3
Function at 0x478150
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d5506
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5010c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], edx
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
push 0
push 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
mov eax, dword [ebp + 8]
push ecx
push 0
push edx
mov dword [ebp - 0x10], 0
push dword [eax - 0xc]
mov dword [ebp - 0x14], 1
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
je 0x47823b
mov edi, dword [ebp - 0x10]
test edi, edi
je 0x47823b
mov ebx, dword [esi + 4]
mov ecx, ebx
mov edx, dword [esi]
sub ecx, edx
cmp edi, ecx
jae 0x4781e9
lea eax, [edx + edi]
jmp 0x478210
jbe 0x478213
mov eax, dword [esi + 8]
sub eax, edx
cmp edi, eax
jbe 0x4781ff
push ecx
push edi
mov ecx, esi
call fcn.00478750
jmp 0x478213
sub edi, ecx
push edi
push 0
push ebx
call fcn.004a15c0
add esp, 0xc
lea eax, [ebx + edi]
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push 0
push 0
push ecx
push dword [esi]
push dword [ebp - 0x18]
push dword [eax - 0xc]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
test eax, eax
jne 0x47823b
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x47823b
mov dword [esi + 4], eax
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47825d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4789b0
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d55fd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5010c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov esi, dword [0x51649c]
test esi, esi
je 0x4789f1
lock inc dword [esi + 4]
mov esi, dword [0x51649c]
mov ecx, dword [0x516498]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
lea edx, [ebp - 0x1c]
mov eax, dword [ecx]
push edx
call dword [eax + 0x20]
or edi, 0xffffffff
mov byte [ebp - 4], 2
test esi, esi
je 0x478a37
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x478a37
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x478a37
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
call fcn.0047e7b0
mov byte [ebp - 4], 3
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x478a69
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [ebp - 0x10]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
call fcn.00404f80
mov ecx, eax
test ecx, ecx
je 0x478b2b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push str.UserData
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.004048d0
test al, al
jne 0x478aa7
push 8
push str.UserData
lea ecx, [ebp - 0x14]
call fcn.00404b80
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 5
push eax
lea edx, [ebp - 0x10]
mov ecx, ebx
call fcn.0047ea90
mov byte [ebp - 4], 3
add esp, 4
mov edx, dword [ebp - 0x14]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x478ada
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov eax, edi
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x478af8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x478b17
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404d50
int3
Function at 0x478b40
Capabilities:
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d563d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x5010c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x10]
call fcn.004789b0
mov dword [ebp - 4], 0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x478ba0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [ebp - 0x10]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test esi, esi
je 0x478c46
call fcn.00404f80
mov ecx, eax
test ecx, ecx
je 0x478c8f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004048d0
test al, al
jne 0x478bf9
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x478be0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x14]
call fcn.00404b80
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea edx, [ebp - 0x10]
mov ecx, edi
call fcn.0047ea90
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp - 0x14]
add esp, 4
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x478c2f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jmp 0x478c72
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
push eax
call fcn.00404680
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
add esp, 4
mov dword [edi], eax
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x478c7c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404d50
int3
Function at 0x479850
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d581e
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5010c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], edx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
push 0x44
call fcn.0049f7ce
mov edi, eax
add esp, 4
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [ebp - 4], 3
call fcn.00404f80
mov ecx, eax
test ecx, ecx
je 0x479a1f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x18], eax
mov byte [ebp - 4], 4
call fcn.00404f80
mov ecx, eax
test ecx, ecx
je 0x479a1f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x1c], eax
mov byte [ebp - 4], 5
call fcn.00404f80
mov ecx, eax
test ecx, ecx
je 0x479a1f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x20], eax
mov byte [ebp - 4], 6
call fcn.00404f80
mov ecx, eax
test ecx, ecx
je 0x479a1f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 7
lea esi, [edi + 0x28]
mov dword [ebp - 0x20], esi
push 0x20
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0049f7ce
mov dword [ebp - 0x20], edi
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 1
mov dword [edi + 0x40], 0xffffffff
push 0x10
mov dword [ebp - 4], 8
call fcn.0049f7ce
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 0x20], esi
add esp, 8
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
movq qword [esi], xmm0
mov dword [esi + 8], 0
mov dword [esi + 4], 1
mov dword [esi + 8], 1
mov dword [esi], vtable.std::_Ref_count_class_CHttpRequest_.0
mov dword [esi + 0xc], edi
push dword [ebp - 0x10]
lea ecx, [edi + 0x20]
mov dword [ebp - 4], 9
call fcn.00403390
push dword [ebp + 8]
lea ecx, [edi + 0x24]
call fcn.00403390
push dword [ebp + 0xc]
lea ecx, [edi + 0x1c]
call fcn.00403390
push dword [ebp + 0x10]
lea ecx, [edi + 0x18]
call fcn.00403390
mov dword [ebx + 4], 0
mov eax, ebx
mov dword [ebx], edi
mov dword [ebx + 4], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404d50
int3
Function at 0x47c5c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d5e43
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5010c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], 0
mov esi, dword [0x51649c]
test esi, esi
je 0x47c614
lock inc dword [esi + 4]
mov esi, dword [0x51649c]
mov ecx, dword [0x516498]
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], esi
mov byte [ebp - 4], 1
lea edx, [ebp - 0x21c]
mov eax, dword [ecx]
push edx
call dword [eax + 0xec]
or edi, 0xffffffff
mov byte [ebp - 4], 3
test esi, esi
je 0x47c663
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x47c663
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x47c663
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004a15c0
add esp, 0xc
lea eax, [ebp - 0x218]
push dword [ebx + 0x44]
push 0x104
push eax
push 0x4ea3d0
push dword [ebp + 8]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 0x2a
cmp ax, word [ebp - 0x218]
je 0x47c6dc
lea edx, [ebp - 0x218]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x47c6b3
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x218]
sub edx, esi
sar edx, 1
push edx
push eax
call fcn.00404b80
mov esi, 1
jmp 0x47c6de
xor esi, esi
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x47c6ff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x47c71e
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049fb4b
mov esp, ebp
pop ebp
ret 8
Function at 0x47df10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push esi
mov esi, ecx
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x47dfbc
mov dword [esp + 0xc], eax
xorps xmm0, xmm0
mov dword [esp + 0x34], eax
lea eax, [esp + 8]
push eax
movlpd qword [esp + 0x18], xmm0
movlpd qword [esp + 0x24], xmm0
movlpd qword [esp + 0x2c], xmm0
mov dword [esp + 0xc], 0x30
mov dword [esp + 0x20], 0x400000
mov dword [esp + 0x34], str.XDSTMgeTmWnd
mov dword [esp + 0x14], 0x47e170
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [esp + 0x20]
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x58]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x47dfc6
push esi
push 0xffffffffffffffeb
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47e6b0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d60f0
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5010c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x21c], esi
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], esi
push 0
push eax
call fcn.004a15c0
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test edi, edi
je 0x47e728
push edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00404f80
mov ecx, eax
test ecx, ecx
je 0x47e79b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.004048d0
test al, al
jne 0x47e77e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47e760
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00404b80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049fb4b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404d50
int3

Function at 0x47e7b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d60f0
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5010c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x21c], esi
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], esi
push 0
push eax
call fcn.004a15c0
add esp, 0xc
lea eax, [ebp - 0x218]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test edi, edi
je 0x47e828
push edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00404f80
mov ecx, eax
test ecx, ecx
je 0x47e89b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.004048d0
test al, al
jne 0x47e87e
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47e860
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00404b80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049fb4b
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404d50
int3