joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b20a0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x114
mov eax, dword [0x6f7d14]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x124]
push edi
test byte [esi + 0x18], 2
je 0x4b2220
nop dword [eax]
mov ebx, dword [esi + 0x24]
test ebx, ebx
jne 0x4b2102
push 0xfde8
call dword [sym.KomManager.exe_xmlMallocAtomic]
mov ebx, eax
add esp, 4
mov dword [esi + 0x24], ebx
test ebx, ebx
je 0x4b223b
mov dword [esi + 0x34], 0xfde8
mov dword [esi + 0x30], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov edi, dword [esi + 0x30]
lea eax, [ebx + 0x1000]
mov ebp, dword [esi + 0x2c]
mov dword [esp + 0x10], edi
cmp edi, eax
jbe 0x4b213d
mov eax, dword [esp + 0x10]
sub edi, ebx
sub ebp, eax
push ebp
push eax
push ebx
call fcn.00633990
sub dword [esi + 0x30], edi
add esp, 0xc
sub dword [esi + 0x28], edi
sub dword [esi + 0x2c], edi
mov eax, dword [esi + 0x30]
mov edi, eax
mov ebp, dword [esi + 0x2c]
mov ebx, dword [esi + 0x24]
mov edx, dword [esi + 0x34]
lea eax, [ebp + 0x1000]
lea ecx, [edx + ebx]
cmp ecx, eax
jae 0x4b2189
mov eax, dword [esi + 0x28]
sub eax, ebx
mov dword [esp + 0x10], eax
lea eax, [edx + edx]
push eax
push ebx
mov dword [esi + 0x34], eax
call dword [sym.KomManager.exe_xmlRealloc]
add esp, 8
mov dword [esi + 0x24], eax
test eax, eax
je 0x4b225c
mov ecx, dword [esp + 0x10]
sub ebp, ebx
add ebp, eax
add ecx, eax
sub edi, ebx
mov dword [esi + 0x2c], ebp
add edi, eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x30], edi
push 0
push 0x1000
push ebp
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_recv]
mov dword [esi + 0x38], eax
test eax, eax
jg 0x4b229f
je 0x4b2220
cmp eax, 0xffffffff
jne 0x4b21d1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x70
jg 0x4b21c6
je 0x4b21d1
cmp eax, 0xb
je 0x4b21d1
cmp eax, 0x6c
jmp 0x4b2287
sub eax, 0x2733
jne 0x4b2284
mov eax, dword [0x6f67c8]
lea ecx, [esp + 0x14]
push ecx
push 0
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x24]
mov eax, dword [esi + 0x14]
push 0
mov dword [esp + 0x2c], eax
inc eax
push ecx
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jge 0x4b2216
call fcn.00636c72
cmp dword [eax], 4
jne 0x4b2220
test byte [esi + 0x18], 2
jne 0x4b20d0
xor eax, eax
mov ecx, dword [esp + 0x120]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0062fc3e
add esp, 0x114
ret
push str.allocating_input
push 0
push 0
push 2
push 0xa
call sym.KomManager.exe___xmlSimpleError
add esp, 0x14
mov dword [esi + 0x38], 0xffffffff
or eax, 0xffffffff
jmp 0x4b2222
push str.allocating_input_buffer
push 0
push 0
push 2
push 0xa
call sym.KomManager.exe___xmlSimpleError
push ebx
call dword [sym.KomManager.exe_xmlFree]
add esp, 0x18
mov dword [esi + 0x38], 0xffffffff
or eax, 0xffffffff
jmp 0x4b2222
sub eax, 0x17
je 0x4b2220
push str.recv_failed_n
push 0
push 0xa
call fcn.00472980
add esp, 0xc
or eax, 0xffffffff
jmp 0x4b2222
add dword [esi + 0x2c], eax
jmp 0x4b2222
Function at 0x4b26d0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x114
mov eax, dword [0x6f7d14]
xor eax, esp
mov dword [esp + 0x110], eax
mov ecx, dword [esp + 0x11c]
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
mov dword [esp + 8], ecx
push edi
test byte [ebp + 0x18], 1
mov edi, dword [esp + 0x12c]
je 0x4b27c8
test ecx, ecx
je 0x4b27c8
test edi, edi
jle 0x4b27c8
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0
mov eax, edi
sub eax, esi
push eax
lea eax, [ecx + esi]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x4b273f
add esi, eax
jmp 0x4b278a
cmp eax, 0xffffffff
jne 0x4b2754
call ebx
cmp eax, 0xb
je 0x4b2754
call ebx
cmp eax, 0x2733
jne 0x4b2794
mov eax, dword [0x6f67c8]
lea ecx, [esp + 0x14]
push ecx
push 0
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x24]
mov eax, dword [ebp + 0x14]
push ecx
mov dword [esp + 0x2c], eax
inc eax
push 0
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 1
call dword [sym.imp.WS2_32.dll_select]
cmp esi, edi
jge 0x4b27ad
mov ecx, dword [esp + 0x10]
jmp 0x4b2723
push str.send_failed_n
push 0
push 0xa
call fcn.00472980
or eax, 0xffffffff
add esp, 0xc
test esi, esi
cmove esi, eax
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0062fc3e
add esp, 0x114
ret
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0062fc3e
add esp, 0x114
ret

Function at 0x4b2800
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x6f7d14]
xor eax, esp
mov dword [esp + 0x190], eax
cmp dword [0x6fe0b8], 0
jne 0x4b28d3
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4b28d3
push str.no_proxy
mov dword [0x6fe0c0], 0x15
call fcn.0064501c
add esp, 4
test eax, eax
je 0x4b285e
cmp byte [eax], 0x2a
jne 0x4b285e
cmp byte [eax + 1], 0
je 0x4b28d3
push str.ftp_proxy
call fcn.0064501c
add esp, 4
test eax, eax
jne 0x4b2880
push str.FTP_PROXY
call fcn.0064501c
add esp, 4
test eax, eax
je 0x4b2889
push eax
call sym.KomManager.exe_xmlNanoFTPScanProxy
add esp, 4
push str.ftp_proxy_user
call fcn.0064501c
add esp, 4
test eax, eax
je 0x4b28a9
push eax
call dword [sym.KomManager.exe_xmlMemStrdup]
add esp, 4
mov dword [0x6fe0c4], eax
push str.ftp_proxy_password
call fcn.0064501c
add esp, 4
test eax, eax
je 0x4b28c9
push eax
call dword [sym.KomManager.exe_xmlMemStrdup]
add esp, 4
mov dword [0x6fe0c8], eax
mov dword [0x6fe0b8], 1
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0062fc3e
add esp, 0x194
ret
Function at 0x4b3160
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0xcc
mov eax, dword [0x6f7d14]
xor eax, esp
mov dword [esp + 0xc8], eax
push esi
mov esi, dword [esp + 0xd4]
test esi, esi
je 0x4b3209
cmp dword [esi + 0x2c], 0xffffffff
je 0x4b3209
push str.QUIT_r_n
lea eax, [esp + 8]
push 0xc8
push eax
call fcn.0043df20
lea ecx, [esp + 0x10]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b31a8
push 0
sub ecx, edx
lea eax, [esp + 8]
push ecx
push eax
push dword [esi + 0x2c]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
test esi, esi
jns 0x4b31f1
push str.send_failed
push 0
push 9
call fcn.00472980
add esp, 0xc
mov eax, esi
pop esi
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.0062fc3e
add esp, 0xcc
ret
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc8]
xor ecx, esp
call fcn.0062fc3e
add esp, 0xcc
ret
mov ecx, dword [esp + 0xcc]
or eax, 0xffffffff
pop esi
xor ecx, esp
call fcn.0062fc3e
add esp, 0xcc
ret
Function at 0x4b37e0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x194
mov eax, dword [0x6f7d14]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x19c]
push esi
mov esi, dword [esp + 0x19c]
push edi
test esi, esi
je 0x4b38d7
cmp dword [esi + 0x2c], 0xffffffff
je 0x4b38d7
test eax, eax
je 0x4b38be
push eax
push str.CWD__s_r_n
lea eax, [esp + 0x10]
push 0x190
push eax
call fcn.0043df20
lea ecx, [esp + 0x18]
mov byte [esp + 0x1a7], 0
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b3845
push 0
sub ecx, edx
lea eax, [esp + 0xc]
push ecx
push eax
push dword [esi + 0x2c]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jns 0x4b388f
push str.send_failed
push 0
push 9
call fcn.00472980
add esp, 0xc
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0062fc3e
add esp, 0x194
ret
push esi
call fcn.004b4850
add esp, 4
cmp eax, 4
je 0x4b38d7
cmp eax, 2
jne 0x4b38be
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0062fc3e
add esp, 0x194
ret
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0062fc3e
add esp, 0x194
ret
mov ecx, dword [esp + 0x198]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.0062fc3e
add esp, 0x194
ret

Function at 0x4b3900
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x194
mov eax, dword [0x6f7d14]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x19c]
push esi
mov esi, dword [esp + 0x19c]
push edi
test esi, esi
je 0x4b39f7
cmp dword [esi + 0x2c], 0xffffffff
je 0x4b39f7
test eax, eax
je 0x4b39f7
push eax
push str.DELE__s_r_n
lea eax, [esp + 0x10]
push 0x190
push eax
call fcn.0043df20
lea ecx, [esp + 0x18]
mov byte [esp + 0x1a7], 0
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b3965
push 0
sub ecx, edx
lea eax, [esp + 0xc]
push ecx
push eax
push dword [esi + 0x2c]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jns 0x4b39af
push str.send_failed
push 0
push 9
call fcn.00472980
add esp, 0xc
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0062fc3e
add esp, 0x194
ret
push esi
call fcn.004b4850
add esp, 4
cmp eax, 4
je 0x4b39f7
cmp eax, 2
jne 0x4b39de
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0062fc3e
add esp, 0x194
ret
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0062fc3e
add esp, 0x194
ret
mov ecx, dword [esp + 0x198]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.0062fc3e
add esp, 0x194
ret
Function at 0x4b3d20
Capabilities:
Get socket status

Disassembly:
sub esp, 0x214
mov eax, dword [0x6f7d14]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
test esi, esi
je 0x4b3e0d
cmp dword [esi + 0x2c], 0xffffffff
je 0x4b3e0d
push edi
push dword [esi + 0x30]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
call edi
mov eax, dword [esi + 0x2c]
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x11c], eax
push ecx
push 0
lea ecx, [esp + 0x120]
mov dword [esp + 0x20], eax
push ecx
inc eax
mov dword [esi + 0x30], 0xffffffff
push eax
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x20], 0
mov dword [esp + 0x128], 1
mov dword [esp + 0x24], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x4b3de7
jne 0x4b3dd9
push dword [esi + 0x2c]
call edi
mov dword [esi + 0x2c], 0xffffffff
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0062fc3e
add esp, 0x214
ret
push esi
call fcn.004b4850
add esp, 4
cmp eax, 2
je 0x4b3dc0
push dword [esi + 0x2c]
call edi
pop edi
mov dword [esi + 0x2c], 0xffffffff
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0062fc3e
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
or eax, 0xffffffff
pop esi
xor ecx, esp
call fcn.0062fc3e
add esp, 0x214
ret
Function at 0x4b4120
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x130
mov eax, dword [0x6f7d14]
xor eax, esp
mov dword [esp + 0x12c], eax
push esi
mov esi, dword [esp + 0x138]
push edi
mov edi, dword [esp + 0x140]
test esi, esi
je 0x4b41bf
test edi, edi
jne 0x4b4151
cmp dword [esi + 0xc], edi
je 0x4b41bf
push esi
call sym.KomManager.exe_xmlNanoFTPGetConnection
add esp, 4
mov dword [esi + 0x30], eax
cmp eax, 0xffffffff
je 0x4b41bf
push str.TYPE_I_r_n
lea eax, [esp + 0xc]
push 0x12c
push eax
call fcn.0043df20
lea ecx, [esp + 0x14]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b4180
push 0
sub ecx, edx
lea eax, [esp + 0xc]
push ecx
push eax
push dword [esi + 0x2c]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4b41d9
push str.send_failed
push 0
push 9
call fcn.00472980
add esp, 0xc
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x30], 0xffffffff
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.0062fc3e
add esp, 0x130
ret
push esi
call fcn.004b4850
add esp, 4
cmp eax, 2
jne 0x4b41af
test edi, edi
jne 0x4b41ee
mov edi, dword [esi + 0xc]
push edi
push str.RETR__s_r_n
lea eax, [esp + 0x10]
push 0x12c
push eax
call fcn.0043df20
lea ecx, [esp + 0x18]
mov byte [esp + 0x143], 0
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4b4215
push 0
sub ecx, edx
lea eax, [esp + 0xc]
push ecx
push eax
push dword [esi + 0x2c]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x4b419e
push esi
call fcn.004b4850
add esp, 4
cmp eax, 1
jne 0x4b41af
mov eax, dword [esi + 0x30]
mov ecx, dword [esp + 0x134]
pop edi
pop esi
xor ecx, esp
call fcn.0062fc3e
add esp, 0x130
ret
Function at 0x4b4270
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov eax, 0x1110
call fcn.00630750
mov eax, dword [0x6f7d14]
xor eax, esp
mov dword [esp + 0x110c], eax
mov eax, dword [esp + 0x1120]
push ebx
mov ebx, dword [esp + 0x111c]
push ebp
mov ebp, dword [esp + 0x1124]
push esi
mov esi, dword [esp + 0x1120]
push edi
xor edi, edi
test esi, esi
je 0x4b43b2
test eax, eax
jne 0x4b42bf
cmp dword [esi + 0xc], edi
je 0x4b43b2
test ebx, ebx
je 0x4b43b2
push eax
push esi
call sym.KomManager.exe_xmlNanoFTPGetSocket
add esp, 8
cmp eax, 0xffffffff
je 0x4b43b2
nop word [eax + eax]
mov eax, dword [esi + 0x30]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x28], eax
push ecx
inc eax
mov dword [esp + 0x20], 1
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x4b43a2
jne 0x4b4345
push esi
call sym.KomManager.exe_xmlNanoFTPCheckResponse
add esp, 4
test eax, eax
js 0x4b43a2
cmp eax, 2
jne 0x4b4372
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x30], 0xffffffff
xor eax, eax
jmp 0x4b43b5
push 0
push 0x1000
lea eax, [esp + 0x124]
push eax
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
js 0x4b4385
push edi
lea eax, [esp + 0x120]
push eax
push ebp
call ebx
add esp, 0xc
test edi, edi
jne 0x4b42e0
push esi
call sym.KomManager.exe_xmlNanoFTPCloseConnection
add esp, 4
jmp 0x4b43b5
push str.recv_failed
push 0
push 9
call fcn.00472980
push edi
lea eax, [esp + 0x12c]
push eax
push ebp
call ebx
add esp, 0x18
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x30], 0xffffffff
or eax, 0xffffffff
mov ecx, dword [esp + 0x111c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0062fc3e
add esp, 0x1110
ret

Function at 0x4b43d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4b4428
mov eax, dword [esi + 0x30]
cmp eax, 0xffffffff
je 0x4b4424
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x4b4428
mov edx, dword [esp + 0x10]
test edx, edx
jle 0x4b4424
push edi
push 0
push edx
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jg 0x4b441f
jns 0x4b4416
push str.recv_failed
push 0
push 9
call fcn.00472980
add esp, 0xc
push esi
call sym.KomManager.exe_xmlNanoFTPCloseConnection
add esp, 4
mov eax, edi
pop edi
pop esi
ret
xor eax, eax
pop esi
ret
or eax, 0xffffffff
pop esi
ret
Function at 0x4b4850
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 8], 0xffffffff
push esi
push edi
test ebp, ebp
je 0x4b4a73
cmp dword [ebp + 0x2c], 0xffffffff
je 0x4b4a73
cmp dword [ebp + 0x2c], 0xffffffff
je 0x4b4a73
mov ecx, dword [ebp + 0x440]
cmp ecx, 0x400
ja 0x4b4a73
mov eax, dword [ebp + 0x444]
cmp eax, 0x400
ja 0x4b4a73
cmp ecx, eax
jg 0x4b4a73
lea esi, [ebp + 0x3c]
test ecx, ecx
jle 0x4b48e5
sub eax, ecx
push eax
lea eax, [esi + ecx]
push eax
push esi
call fcn.00633990
mov eax, dword [ebp + 0x440]
add esp, 0xc
sub dword [ebp + 0x444], eax
xor ecx, ecx
mov eax, dword [ebp + 0x444]
mov ebx, eax
mov dword [ebp + 0x440], 0
mov dword [esp + 0x18], ebx
jmp 0x4b48eb
mov ebx, eax
mov dword [esp + 0x18], eax
mov edx, 0x400
sub edx, eax
jne 0x4b48f8
xor eax, eax
jmp 0x4b492a
push 0
push edx
lea eax, [esi + ecx]
push eax
push dword [ebp + 0x2c]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
js 0x4b4a52
add dword [ebp + 0x444], eax
mov ecx, dword [ebp + 0x444]
mov byte [ecx + esi], 0
mov ebx, dword [ebp + 0x444]
mov dword [esp + 0x18], ebx
test ebx, ebx
jne 0x4b4936
test eax, eax
je 0x4b4a73
mov eax, dword [ebp + 0x440]
add esi, ebx
add eax, 0x3c
add eax, ebp
cmp eax, esi
jae 0x4b49e2
nop dword [eax + eax]
mov ecx, esi
sub ecx, eax
cmp ecx, 3
jl 0x4b49a6
mov dl, byte [eax]
mov cl, dl
sub cl, 0x30
cmp cl, 9
ja 0x4b49a6
mov ch, byte [eax + 1]
mov cl, ch
movsx edx, dl
sub cl, 0x30
cmp cl, 9
ja 0x4b49a6
mov bl, byte [eax + 2]
mov cl, bl
sub cl, 0x30
cmp cl, 9
ja 0x4b49a6
movsx ecx, ch
lea edx, [edx + edx*4]
lea ecx, [ecx + edx*2]
lea edx, [ecx + ecx*4]
movsx ecx, bl
lea ecx, [ecx + edx*2]
add ecx, 0xffffeb30
cmp byte [eax + 3], 0x2d
jne 0x4b49a2
neg ecx
test ecx, ecx
jg 0x4b4a10
cmp eax, esi
jae 0x4b49bc
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, 0xa
je 0x4b49cb
inc eax
cmp eax, esi
jb 0x4b49b0
mov eax, dword [esp + 0x18]
mov dword [ebp + 0x440], eax
jmp 0x4b4873
cmp eax, esi
jae 0x4b49bc
cmp dl, 0xd
lea ecx, [eax + 1]
cmove ecx, eax
mov eax, ecx
cmp eax, esi
jb 0x4b4950
mov ecx, dword [esp + 0x10]
test ecx, ecx
js 0x4b4873
sub eax, ebp
sub eax, 0x3c
mov dword [ebp + 0x440], eax
mov eax, 0x51eb851f
imul ecx
pop edi
sar edx, 5
pop esi
mov eax, edx
shr eax, 0x1f
pop ebp
add eax, edx
pop ebx
pop ecx
ret
mov dword [esp + 0x10], ecx
add eax, 3
mov ecx, eax
sub ecx, ebp
sub ecx, 0x3c
mov dword [ebp + 0x448], ecx
cmp eax, esi
jae 0x4b4a32
cmp byte [eax], 0xa
je 0x4b4a32
inc eax
cmp eax, esi
jb 0x4b4a28
mov dl, byte [eax]
mov bl, dl
cmp dl, 0xa
jne 0x4b4a3e
mov bl, byte [eax + 1]
lea ecx, [eax + 1]
cmp dl, 0xa
cmovne ecx, eax
cmp bl, 0xd
lea eax, [ecx + 1]
cmovne eax, ecx
jmp 0x4b49e2
push str.recv_failed
push 0
push 9
call fcn.00472980
add esp, 0xc
push dword [ebp + 0x2c]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebp + 0x2c], 0xffffffff
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
Function at 0x4e62e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4e6310
cmp dword [esp + 8], 0
je 0x4e6310
push esi
call sym.KomManager.exe_xmlStrlen
push 0
push eax
push esi
call sym.KomManager.exe_xmlParserInputBufferCreateStatic
add esp, 0x10
test eax, eax
je 0x4e6310
pop esi
mov dword [esp + 8], eax
jmp sym.KomManager.exe_xmlTextReaderSetup
or eax, 0xffffffff
pop esi
ret

Function at 0x4e63a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
js 0x4e63ce
cmp dword [esp + 4], 0
je 0x4e63ce
push 0
push eax
call sym.KomManager.exe_xmlParserInputBufferCreateFd
add esp, 8
test eax, eax
je 0x4e63ce
mov dword [eax + 8], 0
mov dword [esp + 8], eax
jmp sym.KomManager.exe_xmlTextReaderSetup
or eax, 0xffffffff
ret
Function at 0x4ef5b4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x4ef5f9
call fcn.004f62f1
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4ef5f9
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4ef615
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0050c8aa
mov ebx, eax
test edi, edi
je 0x4ef613
test esi, esi
je 0x4ef613
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4f0046
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x4f0104
cmp dword [esi + 0x20], 0
je 0x4f0104
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4f0104
cmp dword [ebp + 8], 0
je 0x4f0104
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.004f62f1
push str.AFX_DIALOG_LAYOUT
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4f00d5
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4f0104
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.005139a8
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x4f00f5
test edi, edi
je 0x4f00f5
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x4f0100
mov ecx, esi
call fcn.004efde8
mov eax, ebx
jmp 0x4f0106
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4f4b27
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x65cd41
call fcn.00630b2e
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x4f4b4d
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4f4bad
call fcn.004ebf17
push eax
lea ecx, [ebp - 0x10]
call fcn.0040ebe0
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x66bac0]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.006464fb
push eax
call fcn.0040c8a0
add esp, 0x14
test esi, esi
je 0x4f4ba0
push esi
call fcn.00646470
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040f050
mov eax, ebx
call fcn.00630af7
ret 8
Function at 0x4fc82e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x4fc878
call fcn.004f62f1
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4fc875
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4fc8c8
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x4fc8a5
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call dword [0x66bac0]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x4fc8a5
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x4fc8c6
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call dword [0x66bac0]
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x5086ea
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x50873d
push esi
push dword [ebp + 8]
call fcn.005088d0
mov edi, eax
test edi, edi
je 0x508738
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x508738
mov eax, dword [ebp - 8]
jmp 0x50874f
mov eax, dword [ebp + 0x10]
jmp 0x50874f
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
leave
ret 0xc

Function at 0x508ea6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebx + 0x84], edi
test edi, 0xffff0000
jne 0x508ed1
cmp dword [ebx + 0x80], 0
jne 0x508ed1
movzx eax, di
mov dword [ebx + 0x80], eax
call fcn.004f62f1
push 5
push edi
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov edi, eax
mov ecx, ebx
push edi
call fcn.00509162
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8