joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004a6f1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1004a66d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1004a860
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1004a860
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1004a815
jg 0x1004a74d
test eax, eax
je 0x1004a80b
push 1
push 0x1000
call fcn.1003dd4a
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1004a770
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1004a802
push 0x8000
push ebx
call fcn.1004a59e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1004a799
jg 0x1004a794
cmp ecx, 0x1000
jb 0x1004a799
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1003db2e
add esp, 0x10
cmp eax, 0xffffffff
je 0x1004a7de
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1004a794
jl 0x1004a7c5
test ecx, ecx
jne 0x1004a786
push dword [ebp - 0xc]
push ebx
call fcn.1004a59e
push esi
call fcn.1003c375
add esp, 0xc
xor ebx, ebx
jmp 0x1004a86e
cmp byte [edi + 0x24], 0
je 0x1004a7f5
cmp dword [edi + 0x20], 5
jne 0x1004a7f5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1004a800
mov ebx, dword [edi + 0x18]
jmp 0x1004a802
xor ebx, ebx
push esi
call fcn.1003c375
pop ecx
jmp 0x1004a86e
test ecx, ecx
jg 0x1004a7d7
jl 0x1004a815
test eax, eax
jae 0x1004a7d7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1003dfed
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1004a835
cmp byte [edi + 0x1c], 0
je 0x1004a7d7
jmp 0x1004a866
push ebx
call fcn.10046cb6
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1004a7d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1004a86e
cmp byte [edi + 0x1c], 0
je 0x1004a86b
mov ebx, dword [edi + 0x18]
jmp 0x1004a86e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1003dfed
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1004c280
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1004c2ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004c2ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401410
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4d9d5e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [esi + 4]
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
push ebx
push ebx
push ebx
lea ecx, [esi + 0x20]
mov byte [esp + 0x24], 1
call fcn.00481fad
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x34], ecx
mov ecx, dword [esp + 0x28]
push eax
mov dword [esi + 0x3c], ecx
push ecx
mov ecx, edi
mov byte [esp + 0x20], 2
mov dword [esi], method.CCommandLineInfo.virtual_0
mov dword [esi + 0x28], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0x31], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], eax
call fcn.00401110
push ebx
push ebx
push ebx
push ebx
push esi
push 0x401960
call fcn.004b2f9a
push ebx
mov dword [esi + 0x38], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10

Function at 0x401720
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x52a988]
push esi
test eax, eax
mov esi, ecx
je 0x401750
push 0xea
push str.C:NeoAudio_1.5.7AsyncEncoder.cpp
push str.___11s__4d:
call fcn.004244f0
add esp, 0xc
push str.Entering_CAsyncEncoder::WaitForFinished__
call fcn.004244f0
add esp, 4
mov eax, dword [esi + 0x38]
mov byte [esi + 0x30], 1
push 0x186a0
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4017a9
mov eax, dword [0x52a988]
test eax, eax
je 0x40179a
push 0xf4
push str.C:NeoAudio_1.5.7AsyncEncoder.cpp
push str.___11s__4d:
call fcn.004244f0
add esp, 0xc
push str.CAsyncEncoder_TimeOut_
call fcn.004244f0
add esp, 4
mov edx, dword [esi + 0x38]
push 0
mov eax, dword [edx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x52a988]
pop esi
test eax, eax
je 0x4017d5
push 0xfa
push str.C:NeoAudio_1.5.7AsyncEncoder.cpp
push str.___11s__4d:
call fcn.004244f0
add esp, 0xc
push str.Leaving_CAsyncEncoder::WaitForFinished__
call fcn.004244f0
pop ecx
ret
Function at 0x401ff0
Capabilities:
Delete file
Move file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d9e08
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x1a]
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x18], ebp
je 0x402028
push eax
call fcn.00481c1a
add esp, 4
test eax, eax
jne 0x402028
mov dword [esi + 0x1a], ebp
mov edi, dword [esi + 0x16]
mov eax, dword [edi + 0x1a]
cmp eax, ebp
je 0x402042
push eax
call fcn.00481c1a
add esp, 4
test eax, eax
jne 0x402042
mov dword [edi + 0x1a], ebp
mov ecx, dword [esi + 0x16]
cmp ecx, ebp
je 0x402050
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov eax, dword [esp + 0x24]
mov dword [esi + 0x16], ebp
cmp eax, ebp
je 0x402081
lea ecx, [esp + 0x20]
push str..nrm.wav
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.004b28eb
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x24]
jmp 0x402132
cmp dword [esp + 0x28], ebp
je 0x402137
lea eax, [esp + 0x20]
push 0x5164dc
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.004b28eb
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x24]
call fcn.004b2656
lea edx, [esp + 0x20]
push 0x5164dc
lea eax, [esp + 0x2c]
push edx
push eax
call fcn.004b28eb
mov esi, dword [eax]
lea ecx, [esp + 0x20]
push str..nrm.wav
lea edx, [esp + 0x28]
push ecx
push edx
mov byte [esp + 0x24], 1
call fcn.004b28eb
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
lea ecx, [esp + 0x24]
sete bl
call fcn.004b2656
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.004b2656
test bl, bl
je 0x402137
lea eax, [esp + 0x24]
push eax
call fcn.0045b980
add esp, 4
mov ecx, dword [esp + 0x24]
push ebp
push 0x40
push ecx
mov byte [esp + 0x24], 2
call fcn.004c0fde
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x24]
call fcn.004b2656
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.004b2656
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x404670
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4da300
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x52506c]
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], eax
mov ecx, dword [0x52506c]
lea edi, [esi + 4]
mov dword [esp + 0x18], 0
mov dword [edi], ecx
mov edx, dword [0x52506c]
mov dword [esi + 0xc], edx
mov eax, dword [0x52506c]
mov dword [esi + 0x8024], eax
lea ecx, [esi + 0x8028]
mov byte [esp + 0x18], 3
call fcn.004d937c
mov ecx, dword [0x52506c]
mov dword [esi + 0x8040], ecx
mov edx, dword [0x52506c]
mov dword [esi + 0x8044], edx
mov eax, dword [0x52506c]
mov dword [esi + 0x8048], eax
mov ecx, dword [0x52506c]
mov dword [esi + 0x804c], ecx
lea edx, [esp + 8]
mov ecx, 0x534950
push edx
mov byte [esp + 0x1c], 8
call fcn.0042a800
push str.SUBMIT.TXT
push eax
lea eax, [esi + 0x8058]
mov byte [esp + 0x20], 9
push eax
call fcn.004b28eb
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0xb
call fcn.004b2656
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov dword [0x5335dc], ecx
mov dword [esi + 8], eax
test eax, eax
je 0x40478d
mov dword [esi + 8], eax
mov eax, dword [eax + 0x97c]
push eax
push str._08lx
push esi
call fcn.004acb0b
add esp, 0xc
lea edx, [esp + 0x24]
mov ecx, 0x534950
push edx
call fcn.0042a800
push eax
mov ecx, edi
mov byte [esp + 0x1c], 0xc
call fcn.004b278f
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], 0xb
call fcn.004b2656
lea eax, [esp + 0x24]
mov ecx, 0x534950
push eax
call fcn.00404870
mov eax, dword [eax]
mov ecx, dword [0x5335e0]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push ecx
push str.DebugRemote
push str.Debug
call edi
lea ecx, [esp + 0x24]
mov dword [0x5335e0], eax
call fcn.004b2656
lea edx, [esp + 0x24]
mov ecx, 0x534950
push edx
call fcn.00404870
mov eax, dword [eax]
push eax
mov eax, dword [0x5335e4]
push eax
push str.DebugLocal
push str.Debug
call edi
lea ecx, [esp + 0x24]
mov dword [0x5335e4], eax
call fcn.004b2656
lea ecx, [esp + 0x24]
push ecx
mov ecx, 0x534950
call fcn.00404870
mov eax, dword [eax]
mov edx, dword [0x5166c0]
push eax
push edx
push str.CDDBProtoLevel
push str.Debug
call edi
lea ecx, [esp + 0x24]
mov dword [0x5166c0], eax
call fcn.004b2656
mov eax, 1
mov dword [esi + 0x8050], 0
mov dword [esi + 0x10], eax
mov edx, dword [0x5349b0]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [esi + 0x8054], ecx
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x404a70
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4da3f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x52506c]
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov dword [esp + 0x18], eax
mov eax, dword [0x534988]
mov cl, byte [esp + 0x40]
xor ebx, ebx
mov byte [esp + 0x20], cl
lea eax, [eax + eax*4]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
lea eax, [eax + eax*4]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
lea edi, [eax + eax*4]
shl edi, 3
mov ecx, dword [esp + 0x40]
push 0x533538
mov byte [esp + 0x3c], 1
call fcn.004b27df
cmp edi, ebx
jle 0x404b78
mov eax, dword [ebp + 0x802c]
lea edx, [esp + 0x14]
push edx
push 0x4004667f
push eax
call sub.WSOCK32.dll_ioctlsocket
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
cmp eax, ebx
je 0x404b61
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x404b61
dec eax
lea esi, [ebp + 0x8028]
mov dword [esp + 0x14], eax
mov edx, dword [esi]
push ebx
lea eax, [esp + 0x16]
push 1
push eax
mov ecx, esi
call dword [edx + 0x14]
mov al, byte [esp + 0x12]
cmp al, 0xa
je 0x404bf7
cmp al, 0xd
je 0x404b50
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x12]
push ecx
push 1
push edx
lea ecx, [esp + 0x2c]
call fcn.0040e130
mov eax, dword [esp + 0x14]
mov ecx, eax
dec eax
test ecx, ecx
mov dword [esp + 0x14], eax
jne 0x404b1c
jmp 0x404b6e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
add dword [esp + 0x1c], 0x64
cmp dword [esp + 0x1c], edi
jl 0x404ae5
lea ecx, [esp + 0x40]
push 0xc1d
push ecx
mov ecx, 0x5bd568
call fcn.00442120
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 2
call fcn.004b278f
lea ecx, [esp + 0x40]
mov byte [esp + 0x38], 1
call fcn.004b2656
mov edx, dword [esp + 0x18]
push ebx
push ebx
push edx
call fcn.004c0fde
mov eax, dword [esp + 0x24]
push eax
call fcn.004b2d50
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], 0xffffffff
call fcn.004b2656
or eax, 0xffffffff
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x13]
push edx
push 1
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1f], bl
call fcn.0040e130
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x40]
push ecx
mov ecx, esi
call fcn.004b27df
cmp dword [0x5335e0], ebx
je 0x404c4f
push 0xda
push str.C:NeoAudio_1.5.7cddb.cpp
push str.___11s__4d:
call fcn.004244f0
mov edx, dword [esi]
add esp, 0xc
push edx
push str.GetString___s_
call fcn.004244f0
add esp, 8
mov eax, dword [esp + 0x24]
push eax
call fcn.004b2d50
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], 0xffffffff
call fcn.004b2656
xor eax, eax
jmp 0x404be2
Function at 0x40a240
Capabilities:
Copy file
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4daf48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, dword [0x52506c]
push esi
push edi
mov esi, ecx
mov edi, 1
mov dword [esp + 8], eax
push esi
lea ecx, [esp + 0x14]
push 0x5335bc
push ecx
mov dword [esp + 0x44], 0
call fcn.004b2885
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 1
call fcn.004b2bd2
mov eax, dword [esi + 0x8054]
test eax, eax
je 0x40a2ac
mov edx, dword [esp + 0x40]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40a43c
lea ecx, [esp + 0x24]
call fcn.00459f40
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 2
call fcn.00459f40
mov esi, dword [esp + 0x40]
push str..new
lea eax, [esp + 0x18]
push esi
push eax
mov byte [esp + 0x44], 3
call fcn.004b28eb
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 4
call fcn.004b23cb
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 6
call fcn.004b2656
mov ecx, dword [0x534a54]
test ecx, ecx
setg cl
push ecx
lea ecx, [esp + 0x1c]
call fcn.00459f80
mov eax, dword [esi]
push 0
push eax
lea ecx, [esp + 0x2c]
call fcn.00459f90
test eax, eax
jne 0x40a322
xor edi, edi
mov edx, dword [esp + 0xc]
push 1
push edx
lea ecx, [esp + 0x20]
call fcn.00459f90
test eax, eax
jne 0x40a33d
xor edi, edi
jmp 0x40a412
cmp edi, 1
jne 0x40a412
lea eax, [esp + 8]
push ebx
push eax
lea ecx, [esp + 0x2c]
xor bl, bl
call fcn.0045a040
test eax, eax
je 0x40a3e4
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x48]
call fcn.004b23cb
lea ecx, [esp + 0x44]
mov byte [esp + 0x3c], 7
call fcn.004b2bd2
test bl, bl
jne 0x40a39c
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x44]
push edx
call fcn.004ac785
test eax, eax
jl 0x40a395
mov bl, 1
jmp 0x40a3c0
lea eax, [esp + 0xc]
push eax
jmp 0x40a3b7
mov ecx, dword [0x5335bc]
push ecx
lea ecx, [esp + 0x48]
call fcn.004ac785
test eax, eax
jl 0x40a3c0
lea edx, [esp + 0xc]
xor bl, bl
push edx
lea ecx, [esp + 0x20]
call fcn.0045a140
lea ecx, [esp + 0x44]
mov byte [esp + 0x3c], 6
call fcn.004b2656
lea eax, [esp + 0xc]
lea ecx, [esp + 0x28]
push eax
call fcn.0045a040
test eax, eax
jne 0x40a35f
lea ecx, [esp + 0x28]
call fcn.0045a1d0
lea ecx, [esp + 0x1c]
call fcn.0045a1d0
mov esi, dword [esi]
mov ecx, dword [esp + 0x10]
push 0
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ebx
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 3
call fcn.004b2656
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 2
call fcn.0045a030
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 1
call fcn.0045a030
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0
call fcn.004b2656
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call fcn.004b2656
mov ecx, dword [esp + 0x30]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 4
Function at 0x40c220
Capabilities:
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x4db288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x52506c]
push edi
mov edi, ecx
mov dword [esp + 4], eax
push 0
mov dword [esp + 0x20], 0
call fcn.004d8aa9
test eax, eax
jne 0x40c264
push 0xffffffffffffffff
push eax
push 0xbc2
call fcn.004c1016
push ebx
push ebp
push esi
push 0
call sub.WSOCK32.dll_WSASetLastError
push 0
lea esi, [edi + 0x8028]
push 0x3f
push 1
push 0
mov ecx, esi
call fcn.004d8bd7
mov eax, dword [0x5335e0]
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
test eax, eax
je 0x40c2bc
push 0xa87
push str.C:NeoAudio_1.5.7cddb.cpp
push str.___11s__4d:
call fcn.004244f0
mov ecx, dword [ebx]
add esp, 0xc
push ebp
push ecx
push str.Open_SMTP_connection__s_Port_d
call fcn.004244f0
add esp, 0xc
mov eax, dword [ebx]
push ebp
push eax
mov ecx, esi
call fcn.004d8e44
pop esi
pop ebp
test eax, eax
pop ebx
je 0x40c33d
mov eax, dword [edi + 0x802c]
lea edx, [esp + 8]
push 4
push edx
push 8
push 0xffff
push eax
mov dword [esp + 0x1c], 1
call sub.WSOCK32.dll_setsockopt
mov edx, dword [edi + 0x802c]
lea ecx, [esp + 0xc]
push 4
push ecx
push 0x1002
push 0xffff
push edx
mov dword [esp + 0x20], 0x8000
call sub.WSOCK32.dll_setsockopt
lea ecx, [esp + 4]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004b2656
mov eax, 1
pop edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
mov eax, dword [0x52506c]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], eax
push 0
lea ecx, [esp + 0x2c]
push 0
push ecx
push 0x400
mov byte [esp + 0x2c], 1
call sub.WSOCK32.dll_WSAGetLastError
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
lea edx, [esp + 0x10]
push 0xc2e
push edx
mov ecx, 0x5bd568
call fcn.00442120
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x20], 2
call fcn.004b278f
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], 1
call fcn.004b2656
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 4]
push eax
push ecx
lea edx, [esp + 0x2c]
push str._s__s_r_n
push edx
call fcn.004acb0b
mov eax, dword [0x5335dc]
add esp, 0x10
test eax, eax
je 0x40c408
push 0xffffffffffffffff
mov ecx, 0x5335c0
call fcn.00482829
lea eax, [esp + 0x24]
mov ecx, 0x5335d0
push eax
call fcn.004b2a6e
mov ecx, 0x5335c0
call fcn.00482023
mov ecx, dword [0x5335dc]
push 0
push 0
push 0x752
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 0
call fcn.004b2656
lea ecx, [esp + 4]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004b2656
mov ecx, dword [esp + 0x14]
xor eax, eax
pop edi
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x40f2c0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4db8d8
push eax
mov dword fs:[0], esp
sub esp, 0x30
lea eax, [esp]
mov ecx, 0x534950
push ebx
push eax
call fcn.00404870
mov eax, dword [eax]
push eax
push 0
push str.DisableAutoCD
push 0x5175e0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
lea ecx, [esp + 4]
sete bl
call fcn.004b2656
test bl, bl
je 0x40f534
call fcn.0045b2e0
test eax, eax
je 0x40f404
push str.SYSTEMCurrentControlSetServicesCdromAutorun
lea ecx, [esp + 8]
call fcn.004b26c4
lea ecx, [esp + 4]
push 3
push ecx
push reloc.WSOCK32.dll_bind
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], 0
call fcn.004564b0
mov bl, 2
lea ecx, [esp + 4]
mov byte [esp + 0x3c], bl
call fcn.004b2656
mov eax, dword [esp + 0x44]
push 0x533538
test eax, eax
je 0x40f395
lea ecx, [esp + 0x48]
call fcn.004b26c4
mov edx, dword [0x5335f0]
lea eax, [esp + 0x44]
push edx
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 3
call fcn.00456d60
mov byte [esp + 0x3c], bl
lea ecx, [esp + 0x44]
jmp 0x40f3ee
lea ecx, [esp + 0x48]
call fcn.004b26c4
lea ecx, [esp + 0x44]
push 0x5335f0
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 4
call fcn.00457270
lea ecx, [esp + 0x44]
mov byte [esp + 0x3c], bl
call fcn.004b2656
push 0x533538
lea ecx, [esp + 0x48]
call fcn.004b26c4
lea edx, [esp + 0x44]
push 0
push edx
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 5
call fcn.00456cd0
mov byte [esp + 0x3c], bl
lea ecx, [esp + 0x44]
call fcn.004b2656
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0xc]
jmp 0x40f52f
mov al, byte [0x5335ec]
test al, 1
jne 0x40f42f
mov dl, al
mov eax, dword [0x52506c]
or dl, 1
push 0x40f550
mov byte [0x5335ec], dl
mov dword [0x5335e8], eax
call fcn.0048ea2e
add esp, 4
push str.SOFTWAREClassesAudioCD_shell
lea ecx, [esp + 8]
call fcn.004b26c4
lea ecx, [esp + 4]
push 3
push ecx
push reloc.WSOCK32.dll_bind
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 6
call fcn.004564b0
mov bl, 8
lea ecx, [esp + 4]
mov byte [esp + 0x3c], bl
call fcn.004b2656
mov eax, dword [esp + 0x44]
push 0x533538
test eax, eax
je 0x40f4a1
lea ecx, [esp + 0x48]
call fcn.004b26c4
lea edx, [esp + 0x44]
push 0x5335e8
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 9
call fcn.00456eb0
mov byte [esp + 0x3c], bl
lea ecx, [esp + 0x44]
jmp 0x40f51e
lea ecx, [esp + 0x48]
call fcn.004b26c4
lea eax, [esp + 0x44]
push 0x5335e8
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 0xa
call fcn.004574f0
lea ecx, [esp + 0x44]
mov byte [esp + 0x3c], bl
call fcn.004b2656
push 0x533538
lea ecx, [esp + 0xc]
call fcn.004b26c4
push 0x533538
lea ecx, [esp + 0x48]
mov byte [esp + 0x40], 0xb
call fcn.004b26c4
lea ecx, [esp + 8]
lea edx, [esp + 0x44]
push ecx
push edx
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 0xc
call fcn.00456eb0
lea ecx, [esp + 0x44]
mov byte [esp + 0x3c], 0xb
call fcn.004b2656
mov byte [esp + 0x3c], bl
lea ecx, [esp + 8]
call fcn.004b2656
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.00456520
mov ecx, dword [esp + 0x34]
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
Function at 0x417490
Capabilities:
Shutdown system

Disassembly:
push 0xffffffffffffffff
push 0x4dcd40
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x52506c]
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], eax
push str.SeShutdownPrivilege
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.004b26c4
mov eax, dword [eax]
push 1
push eax
mov ecx, esi
call fcn.00417390
test eax, eax
lea ecx, [esp + 0xc]
sete bl
call fcn.004b2656
pop esi
test bl, bl
pop ebx
je 0x41752a
lea ecx, [esp + 4]
push 0xc1a
push ecx
mov ecx, 0x5bd568
call fcn.00442120
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x14], 1
call fcn.004b278f
lea ecx, [esp + 4]
mov byte [esp + 0x10], 0
call fcn.004b2656
mov edx, dword [esp]
push 0
push 0
push edx
call fcn.004c0fde
push 0
push 0xc
call dword [sym.imp.USER32.dll_ExitWindowsEx]
lea ecx, [esp]
mov dword [esp + 0x10], 0xffffffff
call fcn.004b2656
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x418c70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4dd1f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x52506c]
push ebx
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 8], eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0x2c]
mov bl, 3
push 0x5c
mov ecx, esi
mov byte [esp + 0x24], bl
call fcn.004ac763
push eax
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.004ac695
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 4
call fcn.004b278f
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], bl
call fcn.004b2656
mov esi, dword [esp + 0x30]
push 0x5c
mov ecx, esi
call fcn.004ac763
lea ecx, [esp + 0x2c]
push eax
push ecx
mov ecx, esi
call fcn.004ac695
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 5
call fcn.004b278f
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], bl
call fcn.004b2656
lea ecx, [esp + 8]
call fcn.004b2be4
lea ecx, [esp + 0x10]
call fcn.004b2be4
mov edx, dword [esp + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.004ac785
cmp eax, 0xffffffff
je 0x418d75
mov eax, dword [esp + 8]
lea ecx, [esp + 0x2c]
mov eax, dword [eax - 8]
inc eax
push eax
push ecx
mov ecx, esi
call fcn.004ac560
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 6
call fcn.004b278f
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], bl
call fcn.004b2656
jmp 0x418d7f
push esi
lea ecx, [esp + 0x10]
call fcn.004b278f
mov esi, dword [esp + 0x28]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.004b23cb
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.004b2656
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call fcn.004b2656
lea ecx, [esp + 8]
mov byte [esp + 0x20], 0
call fcn.004b2656
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc