joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453c20
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
imul ecx, eax, 0
movsx edx, byte [ebp + 0xc]
mov eax, dword [ebp + 8]
xor edx, dword [eax + ecx]
and edx, 0xff
mov ecx, 4
imul eax, ecx, 0
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + eax]
shr eax, 8
xor eax, dword [edx*4 + 0x586650]
mov ecx, 4
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + edx], eax
mov edx, 4
shl edx, 0
mov eax, 4
imul ecx, eax, 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + ecx]
and ecx, 0xff
mov eax, dword [ebp + 8]
add ecx, dword [eax + edx]
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], ecx
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
imul eax, dword [edx + ecx], 0x8088405
add eax, 1
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
mov eax, 4
shl eax, 1
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp + 8]
mov ecx, dword [edx + ecx]
shr ecx, 0x18
mov edx, dword [ebp + 8]
xor ecx, dword [edx + eax]
and ecx, 0xff
mov eax, 4
shl eax, 1
mov edx, dword [ebp + 8]
mov eax, dword [edx + eax]
shr eax, 8
xor eax, dword [ecx*4 + 0x586650]
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx], eax
pop ebp
ret

Function at 0x458510
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
movzx edx, byte [ecx]
test edx, edx
je 0x45855f
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x458555
mov edx, dword [ebp + 0x14]
mov byte [edx + 8], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
div dword [ebp + 0xc]
jmp 0x4585b9
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
cmp ecx, dword [edx + 0x18]
jbe 0x45857f
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x14]
mov edx, dword [eax + 0x18]
sub edx, dword [ecx + 0x1c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp + 0x14]
add edx, dword [eax + 0x1c]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00548d90
add esp, 0xc
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0x1c], ecx
mov eax, dword [ebp - 8]
xor edx, edx
div dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x458810
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x458820
xor eax, eax
jmp 0x4589bd
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x45897e
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x586650]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x586650]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x586650]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x586650]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x586650]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x586650]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x586650]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x586650]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x458829
cmp dword [ebp + 0x10], 0
je 0x4589b7
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x586650]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
jne 0x458984
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x4841a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x69c], 0
je 0x484253
cmp dword [ebp + 8], 0x100
jne 0x48421f
movzx ecx, word [ebp + 0xc]
cmp ecx, 0xd
jne 0x48421f
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x6a2]
test eax, eax
je 0x4841f6
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x48421f
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x6a3]
test eax, eax
jne 0x48421f
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x5c], 0
je 0x48421b
push 1
push 0
push 0
push 0
push str.return
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x5c]
call fcn.0042d3e0
xor eax, eax
jmp 0x484258
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x69c]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
call eax
jmp 0x484258
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49a900
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5df040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
movzx eax, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.0044a2d0
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x6d0], 0
je 0x49a99c
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 0x6d0]
call fcn.004997b0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x49a96d
push 0
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x6d0]
call fcn.004301a0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x49a99c
push 0x54
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x6d0]
call fcn.004301a0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423495
mov esp, ebp
pop ebp
ret 0xc

Function at 0x49a9b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5df040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x1c]
test ecx, ecx
jne 0x49a9d5
xor eax, eax
jmp 0x49aa9e
mov edx, dword [ebp - 8]
cmp dword [edx + 0x14], 0
jne 0x49a9e5
xor eax, eax
jmp 0x49aa9e
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
add eax, 1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.00579260
mov dword [ebp - 0x14], esp
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jne 0x49aa18
xor eax, eax
jmp 0x49aa9e
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0x14]
add ecx, 0x1e4
call fcn.0042f900
push 1
push 0
push 0
push 0
push str.textchanged
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x14]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x14]
mov eax, dword [edx + 0x24]
call eax
mov ecx, eax
call fcn.0042d3e0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, dword [eax + 0x14]
mov eax, dword [edx + 0x24]
call eax
mov ecx, eax
call fcn.004272d0
movzx ecx, al
test ecx, ecx
je 0x49aa9c
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0x14]
call fcn.0044a040
xor eax, eax
lea esp, [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423495
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49bc20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5df040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
movzx eax, byte [ebp + 0x18]
push eax
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x10]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x18]
call fcn.0044caf0
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x6d0], 0
je 0x49bcd0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x6d0]
call fcn.004997b0
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x49bca1
push 0
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 0x6d0]
call fcn.004301a0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x49bcd0
push 0x54
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x6d0]
call fcn.004301a0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423495
mov esp, ebp
pop ebp
ret 0x14
Function at 0x49d7f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57f4b0
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x5df040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa8], ecx
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 0x14]
mov dword [eax + 0x6e0], 0
mov ecx, dword [ebp - 0xa8]
cmp dword [ecx + 4], 0
jne 0x49d904
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0xa8]
call fcn.0049d190
mov dword [ebp - 0xb0], 0x40000000
push 0
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x18]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0xc], edx
push 0
mov eax, dword [ebp - 0xb0]
push eax
push 0
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ecx + 0x14]
mov eax, dword [ebp - 0xa8]
mov edx, dword [edx]
mov ecx, dword [eax + 0x14]
mov eax, dword [edx + 0x24]
call eax
mov ecx, eax
call fcn.00426ec0
push eax
mov ecx, dword [ebp - 0xa8]
call fcn.00431130
push 1
mov ecx, dword [ebp - 0xa8]
mov ecx, dword [ecx + 0x14]
call fcn.00442bb0
push eax
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 0x14]
mov ecx, dword [ebp - 0xa8]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x14]
mov eax, dword [edx + 0x24]
call eax
mov ecx, eax
call fcn.00426990
mov ecx, dword [eax]
push ecx
push 0x30
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0xa4]
push ecx
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 0x14]
mov ecx, dword [ebp - 0xa8]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x14]
mov eax, dword [edx + 0x38]
call eax
mov dword [ebp - 0xb4], eax
mov ecx, dword [ebp - 0xb4]
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xb8]
call fcn.004304b0
mov byte [ebp - 0xa9], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4]
call fcn.0042f7d0
movzx edx, byte [ebp - 0xa9]
test edx, edx
je 0x49d981
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax + 0x14]
add ecx, 0x6d0
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 0x14]
add eax, 0x6d0
push eax
push 0
push 0x1002
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0xa8]
mov byte [ecx + 0x1c], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00423495
mov esp, ebp
pop ebp
ret 4
Function at 0x49d9f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5df040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
movzx eax, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.0044a2d0
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x6e8], 0
je 0x49da8c
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 0x6e8]
call fcn.0049d190
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x49da5d
push 0
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x6e8]
call fcn.004301a0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x49da8c
push 0x54
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x6e8]
call fcn.004301a0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423495
mov esp, ebp
pop ebp
ret 0xc

Function at 0x49dbf0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5df040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ecx
movzx eax, byte [ebp + 0x18]
push eax
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x10]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x18]
call fcn.0044caf0
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x6e8], 0
je 0x49dca0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x6e8]
call fcn.0049d190
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x49dc71
push 0
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 0x6e8]
call fcn.004301a0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x49dca0
push 0x54
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 0x6e8]
call fcn.004301a0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00423495
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4c2360
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4c240f
push esi
call fcn.004d8b60
add esp, 4
test al, al
jne 0x4c240f
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4c2387
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.004e1ff0
add esp, 0xc
test eax, eax
je 0x4c23bb
sub eax, esi
push eax
push 0x2e
push esi
call fcn.004e1ff0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4c23bd
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x4c23ee
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.004d58d0
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x4c23d0
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x4c2f50
Capabilities:
Convert ip address from string

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
je 0x4c2f7c
cmp byte [eax], 0
je 0x4c2f7c
lea ecx, [esp + 8]
push ecx
push eax
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
je 0x4c2f76
mov eax, 0x2b
ret
mov eax, dword [esp + 8]
jmp 0x4c2f82
xor eax, eax
mov dword [esp + 8], eax
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
push eax
mov eax, dword [esp + 8]
push dword [eax + 0x920]
call fcn.00511200
add esp, 8
xor eax, eax
ret

Function at 0x4c2fa0
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x48
mov eax, dword [0x5df040]
xor eax, esp
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x50]
push esi
mov esi, dword [esp + 0x50]
test eax, eax
je 0x4c2fe8
cmp byte [eax], 0
je 0x4c2fe8
lea ecx, [esp + 4]
push ecx
push eax
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
je 0x4c2ff9
mov eax, 0x2b
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00423495
add esp, 0x48
ret
push 0x41
lea eax, [esp + 8]
push 0
push eax
call fcn.00548bf0
add esp, 0xc
lea eax, [esp + 4]
push eax
push dword [esi + 0x920]
call fcn.00511230
mov ecx, dword [esp + 0x50]
add esp, 8
xor eax, eax
pop esi
xor ecx, esp
call fcn.00423495
add esp, 0x48
ret
Function at 0x4c8810
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x14
mov eax, dword [0x5df040]
xor eax, esp
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov eax, dword [ecx]
push edi
mov edi, dword [esp + 0x28]
mov eax, dword [eax + 4]
and eax, 0xa
cmp al, 0xa
mov eax, dword [ecx + 0xc]
jne 0x4c8847
mov esi, dword [eax + 0x78]
mov ebx, dword [eax + 0x7c]
mov ebp, dword [eax + 0x80]
jmp 0x4c8853
mov esi, dword [eax + 0x30]
mov ebx, dword [eax + 0x34]
mov ebp, dword [eax + 0x4c0]
test esi, esi
je 0x4c8934
mov eax, dword [edi]
test eax, eax
je 0x4c8890
mov ecx, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4c8883
test dl, dl
je 0x4c887f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4c8883
add ecx, 2
add eax, 2
test dl, dl
jne 0x4c8863
xor eax, eax
jmp 0x4c8888
sbb eax, eax
or eax, 1
test eax, eax
je 0x4c8934
push edi
call fcn.004c87c0
push esi
call dword [0x5df1b8]
mov edx, eax
add esp, 8
mov dword [edi], edx
test edx, edx
je 0x4c88ea
test ebx, ebx
je 0x4c890b
mov ecx, ebx
nop
mov al, byte [esi]
cmp al, byte [ecx]
jne 0x4c88d0
test al, al
je 0x4c88cc
mov al, byte [esi + 1]
cmp al, byte [ecx + 1]
jne 0x4c88d0
add esi, 2
add ecx, 2
test al, al
jne 0x4c88b0
xor eax, eax
jmp 0x4c88d5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4c890b
push ebx
call dword [0x5df1b8]
add esp, 4
mov dword [edi + 4], eax
test eax, eax
jne 0x4c890e
push edi
call fcn.004c87c0
add esp, 4
mov eax, 0x1b
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00423495
add esp, 0x14
ret
mov dword [edi + 4], edx
mov esi, dword [edi]
test esi, esi
je 0x4c896a
cmp byte [esi], 0
je 0x4c896a
mov ebx, dword [sym.imp.WS2_32.dll_inet_pton]
lea eax, [esp + 0x10]
push eax
push esi
push 2
call ebx
test eax, eax
je 0x4c8953
mov dword [edi + 0xc], 1
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword [edi + 0x10], ebp
mov dword [edi + 0x14], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00423495
add esp, 0x14
ret
lea eax, [esp + 0x10]
push eax
push esi
push 0x17
call ebx
test eax, eax
je 0x4c896a
mov dword [edi + 0xc], 2
jmp 0x4c8934
mov ecx, dword [edi]
mov dword [edi + 0xc], 0
cmp byte [ecx], 0
je 0x4c8934
mov esi, ecx
lea edx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4c8980
sub esi, edx
je 0x4c8993
cmp byte [ecx + esi - 1], 0x2e
jne 0x4c8993
dec esi
cmp esi, 0xffff
jae 0x4c8934
lea eax, [esi + 1]
push eax
push 1
call dword [0x5df1bc]
add esp, 8
mov dword [edi + 8], eax
test eax, eax
je 0x4c88ea
push esi
push dword [edi]
push eax
call fcn.004d5930
mov eax, dword [edi + 8]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x4c8934
Function at 0x4d23d0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
test ebx, ebx
jne 0x4d23ea
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push 0x59118c
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x5d0f10
push esi
call fcn.00561eb9
add esp, 8
test eax, eax
je 0x4d2432
test ebp, ebp
je 0x4d2423
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x4d2458
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4d2458
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x4d2532
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d2475
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
call dword [0x5df1ac]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4d2528
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4d2528
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d24b6
sub ecx, edx
sar ecx, 1
mov dword [ebx + ecx*2], 0x5c
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d24d1
sub ecx, edx
sar ecx, 1
add ecx, ecx
sub ecx, esi
add ecx, ebx
nop word [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x4d24f0
test ebp, ebp
je 0x4d251f
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x5df1b0]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push ebx
call dword [0x5df1b0]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret