joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5e1e
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and word [ebp - 0x1c], 0
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x1a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0
sub esp, 0x10
lea esi, [ebp + 8]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004f0665
add esp, 0x14
test eax, eax
jne 0x4b5e83
movzx eax, word [ebp + 0x14]
push eax
movzx eax, word [ebp + 0x12]
push eax
movzx eax, word [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xe]
push eax
movzx eax, word [ebp + 0xa]
push eax
movzx eax, word [ebp + 8]
push eax
push str.:3:An_invalid_date_was_passed_into_SetLastTimeInternetAccess__:__04d__02d__02d____02d:_02d._02d
call fcn.00426c01
add esp, 0x1c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
xor esi, esi
mov ebx, str.ints.dat
push 0x3c5
push str..Security.c
push ebx
push 0
call fcn.00489f49
pop ecx
pop ecx
mov edx, 0x530484
mov ecx, eax
call fcn.0042d2c6
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 8], eax
jne 0x4b5efc
push 0x15e
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 3
jl 0x4b5e8a
movzx eax, word [ebp + 0x14]
push eax
movzx eax, word [ebp + 0x12]
push eax
movzx eax, word [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xe]
push eax
movzx eax, word [ebp + 0xa]
push eax
movzx eax, word [ebp + 8]
push eax
push ebx
push 0
call fcn.00489f49
pop ecx
pop ecx
push eax
push str.:7:SetLastTimeInternetAccess___FAILED:_fopen___s____wb___FAILED:__04d__02d__02d____02d:_02d._02d
call fcn.004265da
add esp, 0x20
jmp 0x4b5e7c
lea esi, [ebp + 8]
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0046297d
mov ecx, eax
call fcn.00467c70
test eax, eax
mov dword [ebp - 0xc], eax
jne 0x4b5f24
push str.:7:SetLastTimeInternetAccess___was_called_before_the_TAMS_server_ip_address_was_initialized__
call fcn.00426c01
pop ecx
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov cl, byte [ebp + eax - 0x1c]
push dword [ebp - 8]
add cl, al
movzx eax, cl
push eax
call fcn.00512df5
cmp eax, 0xffffffff
pop ecx
pop ecx
je 0x4b5f7e
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x14
jb 0x4b5f28
xor eax, eax
push 0x64
inc eax
call fcn.004603fd
mov esi, eax
test esi, esi
pop ecx
jl 0x4b5f79
push dword [ebp - 8]
call fcn.00512297
cdq
mov ecx, 0xff
idiv ecx
push edx
call fcn.00512df5
dec esi
pop ecx
pop ecx
jns 0x4b5f5e
xor esi, esi
inc esi
jmp 0x4b5fb9
movzx eax, word [ebp + 0x14]
push eax
movzx eax, word [ebp + 0x12]
push eax
movzx eax, word [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xe]
push eax
movzx eax, word [ebp + 0xa]
push eax
movzx eax, word [ebp + 8]
push eax
push dword [ebp - 4]
push ebx
push 0
call fcn.00489f49
pop ecx
pop ecx
push eax
push str.:9:SetLastTimeInternetAccess___FAILED:_fputc___s___FAILED:_idx___d:__04d__02d__02d____02d:_02d._02d
call fcn.004265da
add esp, 0x24
xor esi, esi
mov ecx, dword [ebp - 8]
call fcn.0042d70e
mov eax, esi
jmp 0x4b5e7e
Function at 0x4b8482
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
mov ebx, ecx
mov esi, edx
push 0
push eax
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x114], esi
mov byte [ebp - 0x110], 0
call fcn.005117f0
and word [ebp - 0x130], 0
xor eax, eax
lea edi, [ebp - 0x12e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
test ebx, ebx
stosw word es:[edi], ax
jne 0x4b84ea
test esi, esi
jne 0x4b84ea
xor eax, eax
inc eax
jmp 0x4b866f
push str.S7.tim
lea edi, [ebp - 0x110]
call fcn.004682da
test ebx, ebx
pop ecx
jne 0x4b8511
lea eax, [ebp - 0x130]
mov dword [ebp - 0x11c], eax
xor edx, edx
mov ecx, eax
jmp 0x4b8527
test esi, esi
jne 0x4b8536
lea eax, [ebp - 0x130]
mov dword [ebp - 0x114], eax
mov esi, ebx
mov edx, eax
xor ecx, ecx
lea edi, [ebp - 0x130]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004b867e
and dword [ebp - 0x120], 0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x190
lea esi, [edi - 0x64]
push 0x664
push str..ServerPAULA.c
mov edx, 0x530484
lea ecx, [ebp - 0x110]
call fcn.0042d2c6
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x118], eax
jne 0x4b85cf
call fcn.00512297
cdq
mov ecx, edi
idiv ecx
add edx, esi
js 0x4b85a2
call fcn.00512297
cdq
mov ecx, edi
idiv ecx
add edx, esi
cmp edx, 0x7fffffff
jge 0x4b85a2
call fcn.00512297
cdq
mov ecx, edi
idiv ecx
add edx, esi
push edx
jmp 0x4b85a4
push 0xa
call ebx
inc dword [ebp - 0x120]
cmp dword [ebp - 0x120], 3
jl 0x4b854b
lea eax, [ebp - 0x110]
push eax
push str.:4:SetLastSA7TimeStamp___FAILED:_fopen___s___FAILED.
call fcn.004265da
pop ecx
pop ecx
xor eax, eax
jmp 0x4b866f
mov esi, dword [ebp - 0x11c]
xor ebx, ebx
inc ebx
push ebx
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004f0665
add esp, 0x14
test eax, eax
je 0x4b860a
mov esi, dword [ebp - 0x114]
push ebx
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004f0665
add esp, 0x14
test eax, eax
jne 0x4b8615
push str.:5:SetLastSA7TimeStamp___is_saving_INVALID_time_stamps_provided_by_the_caller__
call fcn.00426c01
pop ecx
push dword [ebp - 0x118]
mov esi, ebx
push ebx
push 0x10
push dword [ebp - 0x11c]
call fcn.005110f1
add esp, 0x10
cmp eax, ebx
jne 0x4b864d
push dword [ebp - 0x118]
push ebx
push 0x10
push dword [ebp - 0x114]
call fcn.005110f1
add esp, 0x10
cmp eax, ebx
je 0x4b864f
xor esi, esi
mov ecx, dword [ebp - 0x118]
call fcn.0042d70e
test esi, esi
jne 0x4b866d
push str.:3:SetLastSA7TimeStamp___FAILED:_fwrite___FAILED.
call fcn.004265da
jmp 0x4b85c7
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
Function at 0x4b867e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
mov esi, ecx
mov ebx, edx
push 0
push eax
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x118], ebx
mov byte [ebp - 0x110], 0
call fcn.005117f0
and word [ebp - 0x12c], 0
xor eax, eax
lea edi, [ebp - 0x12a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosw word es:[edi], ax
push str.S7.tim
lea edi, [ebp - 0x110]
call fcn.004682da
test esi, esi
pop ecx
jne 0x4b86f7
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x11c], eax
test ebx, ebx
jne 0x4b8707
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x118], eax
and dword [ebp - 0x114], 0
mov esi, 0x15e
lea ebx, [esi - 0x64]
push 0x6a1
push str..ServerPAULA.c
mov edx, 0x530488
lea ecx, [ebp - 0x110]
call fcn.0042d2c6
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x4b87b5
lea edi, [ebp - 0x110]
call fcn.0042ad00
test eax, eax
je 0x4b878f
call fcn.00512297
cdq
mov ecx, esi
idiv ecx
add edx, ebx
js 0x4b8778
call fcn.00512297
cdq
mov ecx, esi
idiv ecx
add edx, ebx
cmp edx, 0x7fffffff
jge 0x4b8778
call fcn.00512297
cdq
mov ecx, esi
idiv ecx
add edx, ebx
push edx
jmp 0x4b877a
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 3
jl 0x4b8716
lea edi, [ebp - 0x110]
call fcn.0042ad00
test eax, eax
je 0x4b885c
mov eax, edi
push eax
push str.:4:GetLastSA7TimeStamp___FAILED:_fopen___s___FAILED.
call fcn.004265da
pop ecx
jmp 0x4b885b
mov esi, dword [ebp - 0x11c]
xor ebx, ebx
push edi
inc ebx
push ebx
push 0x10
push esi
mov dword [ebp - 0x114], ebx
call fcn.00511c63
add esp, 0x10
cmp eax, ebx
jne 0x4b87eb
push edi
push ebx
push 0x10
push dword [ebp - 0x118]
call fcn.00511c63
add esp, 0x10
cmp eax, ebx
je 0x4b87f2
and dword [ebp - 0x114], 0
mov ecx, edi
call fcn.0042d70e
push ebx
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004f0665
add esp, 0x14
test eax, eax
je 0x4b8851
mov esi, dword [ebp - 0x118]
push ebx
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004f0665
add esp, 0x14
test eax, eax
je 0x4b8851
cmp dword [ebp - 0x114], 0
jne 0x4b884d
push 0
lea ecx, [ebp - 0x110]
call fcn.0042b397
pop ecx
push eax
push str.:3:GetLastSA7TimeStamp___FAILED:_fread___FAILED:_File_size___u
jmp 0x4b87aa
mov eax, ebx
jmp 0x4b885e
push str.:3:GetLastSA7TimeStamp___FAILED:_One_of_the_time_stamps_read_is_invalid.
call fcn.004265da
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
Function at 0x4b886d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
xor ebx, ebx
lea eax, [ebp - 0x10f]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x118], edi
mov byte [ebp - 0x110], 0
call fcn.005117f0
add esp, 0xc
cmp edi, ebx
jne 0x4b88b4
xor eax, eax
jmp 0x4b89e0
mov esi, 0x188
push esi
push ebx
push edi
call fcn.005117f0
add esp, 0xc
push str.eod.tim
lea edi, [ebp - 0x110]
call fcn.004682da
mov dword [ebp - 0x114], ebx
pop ecx
mov ebx, 0xfa
push 0x6ee
push str..ServerPAULA.c
mov edx, 0x530488
lea ecx, [ebp - 0x110]
call fcn.0042d2c6
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x4b8987
lea edi, [ebp - 0x110]
call fcn.0042ad00
test eax, eax
je 0x4b8960
call fcn.00512297
mov edi, 0x226
cdq
mov ecx, edi
idiv ecx
add edx, ebx
js 0x4b8949
call fcn.00512297
cdq
mov ecx, edi
idiv ecx
add edx, ebx
cmp edx, 0x7fffffff
jge 0x4b8949
call fcn.00512297
cdq
idiv edi
add edx, ebx
push edx
jmp 0x4b894b
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 3
jl 0x4b88e0
lea edi, [ebp - 0x110]
call fcn.0042ad00
test eax, eax
je 0x4b88ad
mov eax, edi
push eax
push str.:4:LoadEODTimeStampDB___FAILED:_fopen___s___FAILED.
call fcn.004265da
pop ecx
pop ecx
jmp 0x4b88ad
push edi
push 1
push esi
push dword [ebp - 0x118]
call fcn.00511c63
add esp, 0x10
cmp eax, 1
mov ecx, edi
je 0x4b89d8
call fcn.0042d70e
push esi
push 0
lea ecx, [ebp - 0x110]
call fcn.0042b397
pop ecx
push eax
push str.:6:LoadEODTimeStampDB___FAILED:_fread___FAILED:_File_size___u__s_b__u
call fcn.004265da
add esp, 0xc
push esi
push 0
push dword [ebp - 0x118]
call fcn.005117f0
add esp, 0xc
jmp 0x4b88ad
call fcn.0042d70e
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
Function at 0x4b89ef
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x10f]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x118], esi
mov byte [ebp - 0x110], 0
call fcn.005117f0
add esp, 0xc
test esi, esi
jne 0x4b8a35
xor eax, eax
jmp 0x4b8b15
push str.eod.tim
lea edi, [ebp - 0x110]
call fcn.004682da
and dword [ebp - 0x114], 0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
pop ecx
mov edi, 0x226
mov esi, 0x12c
push 0x721
push str..ServerPAULA.c
mov edx, 0x530484
lea ecx, [ebp - 0x110]
call fcn.0042d2c6
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x11c], eax
jne 0x4b8adf
call fcn.00512297
cdq
mov ecx, edi
idiv ecx
add edx, esi
js 0x4b8ab4
call fcn.00512297
cdq
mov ecx, edi
idiv ecx
add edx, esi
cmp edx, 0x7fffffff
jge 0x4b8ab4
call fcn.00512297
cdq
mov ecx, edi
idiv ecx
add edx, esi
push edx
jmp 0x4b8ab6
push 0xa
call ebx
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 3
jl 0x4b8a5d
lea eax, [ebp - 0x110]
push eax
push str.:4:SaveEODTimeStampDB___FAILED:_fopen___s___FAILED.
call fcn.004265da
pop ecx
pop ecx
jmp 0x4b8a2e
push eax
xor esi, esi
inc esi
push esi
push 0x188
push dword [ebp - 0x118]
call fcn.005110f1
add esp, 0x10
cmp eax, esi
je 0x4b8b08
push str.:6:SaveEODTimeStampDB___FAILED:_fwrite___FAILED.
call fcn.004265da
pop ecx
xor esi, esi
mov ecx, dword [ebp - 0x11c]
call fcn.0042d70e
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
Function at 0x4c0a3b
Capabilities:
Terminate process

Disassembly:
push ecx
test esi, esi
mov eax, dword [0x6d6b6c]
push ebx
push edi
jne 0x4c0a5a
test eax, eax
je 0x4c0aad
push eax
call fcn.004a8fca
and dword [0x6d6b6c], esi
pop ecx
jmp 0x4c0aad
test eax, eax
jne 0x4c0a6c
call fcn.004a8f27
test eax, eax
mov dword [0x6d6b6c], eax
je 0x4c0ab0
lea edi, [esi + 0x130]
mov ebx, dword [edi]
call fcn.004a939f
test eax, eax
jne 0x4c0a8a
push dword [edi]
mov eax, dword [0x6d6b6c]
call fcn.004a9020
pop ecx
xor ebx, ebx
cmp dword [esi], ebx
jle 0x4c0aad
lea edi, [esi + 4]
mov eax, dword [edi]
call fcn.004c1690
test eax, eax
je 0x4c0aa5
mov ecx, dword [edi]
call fcn.004c0c2b
inc ebx
add edi, 4
cmp ebx, dword [esi]
jl 0x4c0a93
xor eax, eax
inc eax
pop edi
pop ebx
pop ecx
ret
Function at 0x4c1926
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push 0x13c
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x24c]
push edi
push eax
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x250], edi
call fcn.005117f0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x10f]
push edi
push eax
mov byte [ebp - 0x110], 0
call fcn.005117f0
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x25c], eax
or eax, 0xffffffff
cmp dword [ebp - 0x25c], eax
je 0x4c1b48
mov dword [ebp - 0x254], edi
mov edi, 0x104
lea edx, [ebp - 0x224]
call fcn.004c3b34
test eax, eax
jne 0x4c1a44
cmp byte [ebp - 0x224], 0x2e
je 0x4c1a44
test byte [ebp - 0x250], 0x10
jne 0x4c1a44
push dword [ebp - 0x260]
lea ecx, [ebp - 0x224]
call fcn.004c5907
test eax, eax
pop ecx
je 0x4c1a44
push dword [ebp - 0x258]
mov ecx, edi
lea eax, [ebp - 0x110]
call fcn.004c3b66
pop ecx
call fcn.004c3eab
lea eax, [ebp - 0x224]
push eax
mov eax, edi
lea esi, [ebp - 0x110]
call fcn.004c3c36
pop ecx
mov eax, esi
call fcn.0042c581
add dword [ebp - 0x254], eax
test ebx, ebx
je 0x4c1a44
push eax
lea eax, [ebp - 0x224]
push eax
push str._n_s:__d
push ebx
call fcn.0042c9fd
add esp, 0x10
lea eax, [ebp - 0x250]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4c19b8
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x14], 0
je 0x4c1b42
test ebx, ebx
je 0x4c1a8d
push dword [ebp - 0x254]
push str._n___Line_count_for_this_subdir:__ld
push ebx
call fcn.0042c9fd
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
or eax, 0xffffffff
cmp esi, eax
je 0x4c1b48
lea edx, [ebp - 0x224]
call fcn.004c3b34
test eax, eax
jne 0x4c1b2c
cmp byte [ebp - 0x224], 0x2e
je 0x4c1b2c
test byte [ebp - 0x250], 0x10
je 0x4c1b2c
test ebx, ebx
je 0x4c1ae7
lea eax, [ebp - 0x224]
push eax
push str._n_n__Subfolder___s_:
push ebx
call fcn.0042c9fd
add esp, 0xc
push dword [ebp - 0x258]
mov ecx, edi
lea eax, [ebp - 0x110]
call fcn.004c3b66
pop ecx
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x110]
call fcn.004c3fde
pop ecx
push 1
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x110]
push eax
call fcn.004c1926
add esp, 0x10
add dword [ebp - 0x254], eax
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4c1aad
mov eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
Function at 0x4c1b57
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
push 0x13c
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x250]
push esi
push eax
mov dword [ebp - 0x254], esi
call fcn.005117f0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x113]
push esi
push eax
mov byte [ebp - 0x114], 0
call fcn.005117f0
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
mov edi, str.E:User_MainMy_DocumentsVisual_Studio_2005ProjectsPAULA.c
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x25c], eax
or eax, 0xffffffff
cmp dword [ebp - 0x25c], eax
je 0x4c1c84
mov dword [ebp - 0x258], esi
test byte [ebp - 0x254], 0x10
jne 0x4c1c57
cmp byte [ebp - 0x228], 0x2e
je 0x4c1c57
push edi
mov ecx, 0x104
lea eax, [ebp - 0x114]
call fcn.004c3b66
pop ecx
call fcn.004c3eab
lea eax, [ebp - 0x228]
push eax
mov eax, 0x104
lea esi, [ebp - 0x114]
call fcn.004c3c36
mov edx, dword [ebp - 0x260]
pop ecx
mov ecx, esi
call fcn.004c1c92
mov esi, eax
test esi, esi
jge 0x4c1c4f
lea eax, [ebp - 0x228]
push eax
push str._nWARNING:_The_file___s__could_not_be_checked.
push dword [ebp - 0x260]
xor esi, esi
inc esi
call fcn.0042c9fd
add esp, 0xc
test esi, esi
jle 0x4c1c57
add dword [ebp - 0x258], esi
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4c1bdc
push dword [ebp - 0x25c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.0051291c
leave
ret
Function at 0x4c23a0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov ebx, 0x248
xor esi, esi
push ebx
inc esi
push esi
call fcn.00511988
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x4c23d0
push ebx
push esi
push str.:4:CreateSprite__d__FAILED:_calloc__d__FAILED:_could_not_allocate_memory_for_handle:_OUT_OF_MEMORY_
call fcn.004265da
add esp, 0xc
xor eax, eax
jmp 0x4c24c0
push 0x30
push esi
call fcn.00511988
test eax, eax
pop ecx
pop ecx
mov dword [edi + 0x70], eax
jne 0x4c23fa
push 0x30
push esi
push esi
push str.:4:CreateSprite__d__FAILED:_calloc__d___d__FAILED:_could_not_allocation_memory_for_the_frames:_OUT_OF_MEMORY_
call fcn.004265da
push edi
call fcn.00511758
add esp, 0x14
jmp 0x4c23c9
cmp dword [0x6d6db8], 0
mov dword [edi + 0x5c], esi
jne 0x4c2437
call fcn.004a8f27
test eax, eax
mov dword [0x6d6db8], eax
jne 0x4c2437
mov eax, dword [edi + 0x70]
test eax, eax
je 0x4c2422
push eax
call fcn.00511758
pop ecx
push edi
call fcn.00511758
mov dword [esp], str.:7:CreateSprite___FAILED:_CreatePtrList___FAILED____
call fcn.004265da
pop ecx
jmp 0x4c23c9
fld1
or dword [edi + 0x68], 0xffffffff
and dword [edi + 0x40], 0
fstp dword [edi + 0x44]
mov eax, 0xffff8000
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
call fcn.00412d51
cmp eax, 0xffffffff
mov dword [edi + 0x7c], eax
je 0x4c2460
test eax, eax
jne 0x4c2471
push str._GetLastError_
push str.:7:CreateSprite___encountered_an_exception:_GetStdHandle_STD_OUTPUT_HANDLE__FAILED:__s
call fcn.004265da
pop ecx
pop ecx
lea ebx, [edi + 0x88]
push str..Sprite.c
push ebx
call fcn.0043266e
test eax, eax
pop ecx
pop ecx
jne 0x4c2493
push str.:5:CreateSprite___EAP:_InitializeLock___FAILED.
call fcn.004265da
pop ecx
mov esi, str.A_sprite_handle_had_to_be_forced_to_unlock___
mov eax, ebx
call fcn.0043296d
mov eax, 0x7d0
mov ecx, ebx
call fcn.004329aa
mov eax, dword [0x6d6db8]
push edi
call fcn.004a9020
pop ecx
mov eax, edi
call fcn.004c399c
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x4c7204
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp + 0x88], eax
push ebx
push esi
push edi
mov esi, ecx
push 1
push 0x1f4
mov dword [ebp - 0x80], esi
call fcn.00511988
mov edi, eax
xor ebx, ebx
cmp edi, ebx
pop ecx
pop ecx
jne 0x4c7244
xor eax, eax
jmp 0x4c7328
push 5
pop eax
push eax
push 0x10
mov dword [edi + 8], eax
call fcn.00511988
cmp eax, ebx
pop ecx
pop ecx
mov dword [edi], eax
jne 0x4c7263
push edi
call fcn.00511758
pop ecx
jmp 0x4c723d
mov eax, dword [0x6db654]
cmp eax, ebx
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
jne 0x4c727c
call fcn.004a8f27
mov dword [0x6db654], eax
push edi
call fcn.004a9020
cmp dword [0x6db654], ebx
pop ecx
jne 0x4c729b
push dword [edi]
call fcn.00511758
push edi
call fcn.00511758
pop ecx
jmp 0x4c7260
cmp esi, ebx
je 0x4c72d7
mov esi, 0x103
push esi
lea eax, [ebp - 0x7b]
push ebx
push eax
mov byte [ebp - 0x7c], bl
call fcn.005117f0
push dword [ebp - 0x80]
mov ecx, esi
lea eax, [ebp - 0x7c]
call fcn.004c3b66
mov esi, eax
call fcn.004c3e68
mov eax, esi
push eax
push 0x18
lea eax, [edi + 0x10]
pop ecx
call fcn.004c3b66
add esp, 0x14
mov eax, dword [ebp + 0x94]
mov dword [edi + 0x2c], eax
call fcn.004f16be
lea ebx, [edi + 0x34]
push str..StringList.c
push ebx
mov dword [edi + 0x30], eax
call fcn.0043266e
test eax, eax
pop ecx
pop ecx
jne 0x4c7307
push str.:5:CreateStringList___EAP:_InitializeLock___FAILED.
call fcn.004265da
pop ecx
mov esi, str.A_String_List_handle_had_to_be_forced_to_unlock___
mov eax, ebx
call fcn.0043296d
mov eax, 0x7d0
mov ecx, ebx
call fcn.004329aa
mov eax, edi
call fcn.004c919a
mov eax, edi
mov ecx, dword [ebp + 0x88]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
add ebp, 0x8c
leave
ret
Function at 0x4c922b
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
jne 0x4c9246
push 1
push 0
push esi
call fcn.0042cf64
add esp, 0xc
mov eax, esi
jmp fcn.0042a76b
push esi
call fcn.0042d28a
mov dword [esp], str._ECHO_OFF
push esi
call fcn.0042c9fd
push str._nREG_ADD__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___v__EnableLUA___t_REG_DWORD__d_0__f
push esi
call fcn.0042c9fd
add esp, 0x10
ret

Function at 0x4c94b3
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
xor ecx, ecx
mov dword [ebp - 4], esi
call fcn.00415cc5
test eax, eax
jne 0x4c94f8
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4c94ef
xor eax, eax
inc eax
jmp 0x4c94fa
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
leave
ret

Function at 0x4c94fd
Capabilities:
Get proxy

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push closesocket
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4c9531
xor eax, eax
jmp 0x4c95ca
push 1
push str.MigrateProxy
push dword [ebp - 4]
call fcn.00411ff4
add esp, 0xc
mov esi, eax
push str.AutoConfigProxy
push dword [ebp - 4]
mov eax, str.wininet.dll
and esi, 1
call fcn.00411e22
push 1
push str.ProxyEnable
push dword [ebp - 4]
and esi, eax
call fcn.00411ff4
add esp, 0x14
push edi
push str.EnableAutodial
push dword [ebp - 4]
and esi, eax
call fcn.00411ff4
add esp, 0xc
and esi, eax
cmp dword [ebp + 8], edi
push str.ProxyServer
push dword [ebp - 4]
mov eax, str.10.28.98.35:80
je 0x4c959a
mov eax, str.proxy.apgnapa.com:80
call fcn.00411e22
pop ecx
pop ecx
push str.ProxyOverride
push dword [ebp - 4]
and esi, eax
mov eax, str.10.__local_
call fcn.00411e22
push edi
push str.ProxyHttp1.1
push dword [ebp - 4]
and esi, eax
call fcn.00411ff4
add esp, 0x14
and eax, esi
pop edi
pop esi
leave
ret