joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ad80
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x14
push esi
push edi
push 0x11
push 2
push 2
mov edi, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x48ada9
call sub.WS2_32.dll_WSAGetLastError
pop edi
or eax, esi
pop esi
add esp, 0x14
ret 8
push 1
push 0
add edi, 4
push esi
mov ecx, edi
call fcn.00489270
test eax, eax
je 0x48adcc
push 1
push 2
push esi
mov ecx, edi
call fcn.00489270
test eax, eax
jne 0x48adde
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x14
ret 8
mov edi, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x24]
test bx, bx
jne 0x48adf4
test edi, edi
je 0x48ae89
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x1c], eax
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x18], 2
call ebp
push ebx
mov dword [esp + 0x1c], eax
call dword [sym.imp.WS2_32.dll_htons]
test edi, edi
mov word [esp + 0x16], ax
je 0x48ae3a
cmp edi, 0x100007f
je 0x48ae3a
push edi
call ebp
mov dword [esp + 0x18], eax
push 0x10
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
pop ebp
je 0x48ae65
call sub.WS2_32.dll_WSAGetLastError
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop ebx
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x14
ret 8
push 4
lea edx, [esp + 0x10]
push edx
push 0x1002
push 0xffff
push esi
mov dword [esp + 0x20], 0x800000
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x48ae52
pop ebx
pop edi
mov eax, esi
pop esi
add esp, 0x14
ret 8

Function at 0x48aea0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
mov eax, dword [esi]
push edi
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push eax
mov edi, eax
mov eax, dword [esp + 0x30]
push ebx
push eax
mov dword [esp + 0x40], 0x10
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x48aeea
call sub.WS2_32.dll_WSAGetLastError
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x10
ret 0x14
test eax, eax
jl 0x48af29
je 0x48af29
mov ecx, dword [esp + 0xe]
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
mov edx, dword [esp + 0x30]
mov word [edx], ax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
mov esi, dword [esi]
lea edx, [esi + 1]
cmp edx, edi
jl 0x48af34
push str.Received_a_message_that_was_too_large__n
call fcn.00488820
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x10
ret 0x14
pop edi
mov byte [esi + ebx], 0
pop esi
mov al, 1
pop ebx
add esp, 0x10
ret 0x14
Function at 0x48af50
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0x10
test ax, ax
push esi
jne 0x48af76
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push 0
push esi
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
jmp 0x48afc8
xor edx, edx
mov dword [esp + 4], edx
mov dword [esp + 8], edx
mov dword [esp + 0xc], edx
push eax
mov dword [esp + 0x14], edx
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 6], ax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push 0x10
lea ecx, [esp + 8]
push ecx
push 0
push esi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
push edx
push eax
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x48afe2
call sub.WS2_32.dll_WSAGetLastError
sub eax, 0x2733
neg eax
sbb eax, eax
pop esi
add esp, 0x10
ret 0x14
test eax, eax
jne 0x48affc
push str.no_data_sent_in_send__n
call fcn.00488820
add esp, 4
xor eax, eax
pop esi
add esp, 0x10
ret 0x14
cmp eax, esi
je 0x48b018
push esi
push eax
push str.only__d_out_of__d_bytes_send__n
call fcn.00488820
add esp, 0xc
xor eax, eax
pop esi
add esp, 0x10
ret 0x14
mov eax, 1
pop esi
add esp, 0x10
ret 0x14
Function at 0x48ceb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a98a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esi], 0x4b8d10
mov eax, dword [esi + 0x30]
push eax
call sub.MFC71.DLL_operator_delete
add esp, 4
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.0048c480
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x48cec8
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a98a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esi], 0x4b8d10
mov eax, dword [esi + 0x30]
push eax
call sub.MFC71.DLL_operator_delete
add esp, 4
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.0048c480
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x48cfb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4a9a30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov edx, dword [ecx + 0x30]
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [ecx + 0x2c], eax
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x48d4d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9962
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
call fcn.0048d250
cmp eax, ebx
je 0x48d50f
cmp dword [esi + 0x10], ebx
je 0x48d522
mov al, byte [ebp + 8]
mov byte [esi + 0x14], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x1c]
push 1
lea ecx, [ebp + 8]
push ecx
push 4
push ebx
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x48d50f
push str.SetTTL
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x30]
push edx
lea ecx, [ecx + esi + 4]
mov byte [ebp - 4], 1
call fcn.0048c490
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48d7a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a99b2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x1c]
xor ebx, ebx
cmp eax, 0xffffffff
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], ebx
je 0x48d8a9
mov edx, dword [ebp + 8]
cmp edx, ebx
je 0x48d8a9
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x48d8a9
cmp byte [edi + 0x15], 6
je 0x48d838
cmp dword [edi + 0x20], ebx
jne 0x48d838
lea esi, [ebp + 8]
push esi
lea esi, [ebp - 0x24]
push esi
push ebx
push ecx
push edx
push eax
mov dword [ebp + 8], 0x10
call dword [sym.imp.WS2_32.dll_recvfrom]
mov esi, eax
call fcn.0048c7f0
cmp esi, eax
je 0x48d844
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
lea eax, [edi + 0x28]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
jmp 0x48d844
push ebx
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
call fcn.0048c7f0
cmp esi, eax
jne 0x48d894
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
lea ecx, [ecx + edi + 4]
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x48d894
push str.Receive
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x30]
push edx
lea ecx, [ecx + edi + 4]
mov byte [ebp - 4], 1
call fcn.0048c490
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0048c7f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48dc60
Capabilities:
Create raw socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a9a5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
push edi
or edi, 0xffffffff
cmp eax, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
je 0x48dc95
mov eax, dword [esi]
call dword [eax + 0x10]
mov eax, dword [esi + 0x24]
xor ebx, ebx
cmp eax, ebx
mov eax, dword [esi + 0x10]
mov dword [ebp - 4], ebx
jne 0x48dce1
cmp eax, ebx
mov eax, dword [ebp + 8]
jne 0x48dcd4
cmp eax, 1
je 0x48dcd4
cmp eax, 6
jne 0x48dcc2
push eax
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
jmp 0x48dd18
cmp eax, 0x11
jne 0x48dd1b
push eax
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
jmp 0x48dd18
push eax
push 3
push 2
call dword [sym.imp.WS2_32.dll_socket]
jmp 0x48dd18
cmp eax, ebx
mov eax, dword [ebp + 8]
jne 0x48dd09
cmp eax, 1
je 0x48dd09
cmp eax, 6
jne 0x48dcfb
push 1
push ebx
push ebx
push eax
push 1
jmp 0x48dd10
cmp eax, 0x11
jne 0x48dd1b
push 1
push ebx
push ebx
push eax
push 2
jmp 0x48dd10
push 1
push ebx
push ebx
push eax
push 3
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x1c], edi
jne 0x48dd66
push str.Create
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov edx, dword [esi + 4]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x30]
push ecx
mov byte [ebp - 4], 1
lea ecx, [eax + esi + 4]
call fcn.0048c490
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x10], ebx
je 0x48ddf6
mov dword [ebp + 8], 1
call fcn.0048c7f0
mov edx, dword [esi + 0x1c]
push 4
lea ecx, [ebp + 8]
push ecx
push 2
push ebx
push edx
mov edi, eax
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, edi
jne 0x48ddf6
push str.Create
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 4]
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
lea ecx, [edx + esi + 4]
jmp 0x48dd40
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48ff90
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [eax + 0x38]
mov dl, byte [eax + 0x34]
push ebx
push ebp
push esi
xor esi, esi
test ecx, ecx
push edi
jle 0x48ffca
movzx edi, dl
mov ecx, dword [eax + 0x260]
mov ebx, ecx
shr ebx, 0x18
xor ebx, edi
mov ebp, dword [ebx*4 + 0x4ca628]
shl ecx, 8
xor ecx, ebp
mov dword [eax + 0x260], ecx
mov ecx, dword [eax + 0x38]
inc esi
cmp esi, ecx
jl 0x48ffa3
mov ecx, dword [eax + 0x34]
mov bl, 1
mov byte [eax + ecx + 0x58], bl
mov ecx, dword [eax + 0x38]
mov esi, ecx
dec esi
je 0x49006e
dec esi
je 0x49004a
dec esi
je 0x49003e
mov byte [ecx + eax + 0x54], bl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
inc ecx
mov dword [eax + 0x44], ecx
mov byte [ecx + esi], dl
mov ebp, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
inc ebp
mov dword [eax + 0x44], ebp
mov ecx, ebp
mov byte [ecx + esi], dl
mov ebx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
inc ebx
mov dword [eax + 0x44], ebx
mov ecx, ebx
mov byte [ecx + esi], dl
mov edi, dword [eax + 0x44]
mov dl, byte [eax + 0x38]
mov esi, dword [eax + 0x24]
inc edi
mov dword [eax + 0x44], edi
mov ecx, edi
sub dl, 4
mov byte [ecx + esi], dl
mov ecx, dword [eax + 0x44]
pop edi
pop esi
inc ecx
pop ebp
mov dword [eax + 0x44], ecx
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
inc dword [eax + 0x44]
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
mov esi, dword [eax + 0x44]
inc esi
mov dword [eax + 0x44], esi
mov ecx, esi
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
mov ecx, dword [eax + 0x44]
pop edi
pop esi
inc ecx
pop ebp
mov dword [eax + 0x44], ecx
pop ebx
ret
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [ecx + esi], dl
mov ecx, dword [eax + 0x44]
pop edi
pop esi
inc ecx
pop ebp
mov dword [eax + 0x44], ecx
pop ebx
ret

Function at 0x491220
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [sym.imp.MSVCR71.dll__iob]
push str.1.0.1__23_June_2000
push eax
add ecx, 0x40
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to_me_at:_jseward_acm.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks.__Julian_Seward__21_March_2000._n_n
push ecx
call dword [sym.imp.MSVCR71.dll_fprintf]
add esp, 0x10
push 3
call dword [sym.imp.MSVCR71.dll_exit]
int3
Function at 0x493210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [eax + 0x25c]
test ecx, ecx
jle 0x49141c
push ebx
mov ecx, 0xfffffff8
push esi
mov esi, dword [eax + 0x4c]
mov bl, byte [eax + 0x25b]
mov edx, dword [eax + 0x2c]
mov byte [edx + esi], bl
mov edx, dword [eax + 0x4c]
mov esi, dword [eax + 0x25c]
mov ebx, dword [eax + 0x258]
inc edx
add esi, ecx
mov dword [eax + 0x4c], edx
shl ebx, 8
mov edx, esi
test edx, edx
mov dword [eax + 0x258], ebx
mov dword [eax + 0x25c], esi
jg 0x4913e1
pop esi
pop ebx
ret
push ebx
push ebp
mov ebp, dword [sym.imp.MSVCR71.dll_fprintf]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esi + 0x44]
xor ebx, ebx
cmp edi, ebx
jle 0x493283
mov edx, dword [esi + 0x264]
mov ecx, dword [esi + 0x260]
mov eax, edx
shr eax, 0x1f
add edx, edx
or eax, edx
mov edx, dword [esi + 0x26c]
not ecx
xor eax, ecx
cmp edx, 1
mov dword [esi + 0x260], ecx
mov dword [esi + 0x264], eax
jle 0x49325a
mov dword [esi + 0x4c], ebx
cmp dword [esi + 0x268], 2
jl 0x49327a
push edi
push eax
mov eax, dword [sym.imp.MSVCR71.dll__iob]
push ecx
push edx
add eax, 0x40
push str.____block__d:_crc__0x_8x__combined_CRC__0x_8x__size___d_n
push eax
call ebp
add esp, 0x18
push esi
call fcn.00497560
add esp, 4
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x44]
mov eax, dword [esi + 0x26c]
add ecx, edx
cmp eax, 1
mov dword [esi + 0x2c], ecx
jne 0x4932db
mov ecx, 0x42
mov edi, 8
mov eax, esi
mov dword [esi + 0x25c], ebx
mov dword [esi + 0x258], ebx
call fcn.00491420
mov ecx, 0x5a
call fcn.00491420
mov ecx, 0x68
call fcn.00491420
mov dl, byte [esi + 0x270]
add dl, 0x30
movzx ecx, dl
call fcn.00491420
cmp dword [esi + 0x44], ebx
jle 0x49337d
mov ecx, 0x31
mov edi, 8
mov eax, esi
call fcn.00491420
mov ecx, 0x41
call fcn.00491420
mov ecx, 0x59
call fcn.00491420
mov ecx, 0x26
call fcn.00491420
mov ecx, 0x53
call fcn.00491420
mov ecx, 0x59
call fcn.00491420
mov ebx, dword [esi + 0x260]
mov ecx, ebx
shr ecx, 0x18
mov dword [esp + 0x14], ebx
call fcn.00491420
movzx ecx, byte [esp + 0x16]
call fcn.00491420
movzx ecx, bh
call fcn.00491420
mov ecx, ebx
and ecx, 0xff
call fcn.00491420
xor ecx, ecx
mov edi, 1
call fcn.00491420
mov ecx, dword [esi + 0x1c]
mov edi, 0x18
call fcn.00491420
call fcn.00491520
call fcn.004916f0
mov al, byte [esp + 0x18]
test al, al
je 0x49342e
mov ecx, 0x17
mov edi, 8
mov eax, esi
call fcn.00491420
mov ecx, 0x72
call fcn.00491420
mov ecx, 0x45
call fcn.00491420
mov ecx, 0x38
call fcn.00491420
mov ecx, 0x50
call fcn.00491420
mov ecx, 0x90
call fcn.00491420
mov ebx, dword [esi + 0x264]
mov ecx, ebx
shr ecx, 0x18
mov dword [esp + 0x18], ebx
call fcn.00491420
movzx ecx, byte [esp + 0x1a]
call fcn.00491420
movzx ecx, bh
call fcn.00491420
mov ecx, ebx
and ecx, 0xff
call fcn.00491420
cmp dword [esi + 0x268], 2
jl 0x493423
mov eax, dword [esi + 0x264]
mov ecx, dword [sym.imp.MSVCR71.dll__iob]
push eax
add ecx, 0x40
push str.____final_combined_CRC__0x_x_n
push ecx
call ebp
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
jmp 0x4913d0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x497960
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a9edb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x42c
mov eax, dword [0x4cbba0]
xor eax, esp
push ebx
push ebp
mov ebp, dword [esp + 0x444]
push esi
push edi
mov edi, dword [esp + 0x450]
xor ebx, ebx
push 0xd8
mov dword [esp + 0x43c], eax
mov dword [esp + 0x14], ebx
call sub.MFC71.DLL_operator_new_1
mov esi, eax
push esi
mov dword [esp + 0x2c], esi
call fcn.00497f80
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
push edi
push 0x400
lea ecx, [esp + 0x48]
push 1
mov dword [esp + 0x458], ebx
mov ebx, dword [sym.imp.MSVCR71.dll_fread]
push ecx
call ebx
add esp, 0x18
test eax, eax
jle 0x497a12
lea esp, [esp]
push eax
lea edx, [esp + 0x3c]
push edx
push esi
call fcn.004989f0
push edi
push 0x400
lea eax, [esp + 0x4c]
push 1
push eax
call ebx
add esp, 0x1c
test eax, eax
jg 0x4979f0
lea ecx, [esp + 0x14]
push ecx
push esi
call fcn.00498ab0
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x28]
mov dword [esp + 0x38], edx
mov dword [esp + 0x24], edx
push 0
lea edx, [esp + 0x20]
push edx
push ebp
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x48], edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x34], edi
call fcn.004976c0
add esp, 0x14
test esi, esi
je 0x497a6a
push esi
call sub.MFC71.DLL_operator_delete_1
add esp, 4
mov ecx, dword [esp + 0x43c]
pop edi
pop esi
mov eax, ebp
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x42c]
pop ebx
xor ecx, esp
call fcn.004a17d1
add esp, 0x438
ret
Function at 0x497c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4a9f53
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
mov eax, dword [0x4cbba0]
xor eax, esp
push ebx
push ebp
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x80]
push esi
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x90]
test eax, eax
mov dword [esp + 0x80], 1
lea edi, [esp + 0x34]
je 0x497d0c
mov al, 0x3a
mov byte [esp + 0x34], 0x75
mov byte [esp + 0x35], 0x72
mov byte [esp + 0x36], 0x6e
mov byte [esp + 0x37], al
mov byte [esp + 0x38], 0x73
mov byte [esp + 0x39], 0x68
mov byte [esp + 0x3a], 0x61
mov byte [esp + 0x3b], 0x31
mov byte [esp + 0x3c], al
lea edi, [esp + 0x3d]
mov esi, dword [esp + 0x8c]
mov eax, 7
mov ebp, 0x20
lea ecx, [ecx]
mov dl, byte [esi]
mov cl, al
shr dl, cl
mov ecx, eax
and dl, 1
dec eax
test ecx, ecx
jne 0x497d36
mov eax, 7
inc esi
mov bl, byte [esi]
mov cl, al
shr bl, cl
shl dl, 1
mov ecx, eax
and bl, 1
or dl, bl
dec eax
test ecx, ecx
jne 0x497d50
mov eax, 7
inc esi
mov bl, byte [esi]
mov cl, al
shr bl, cl
shl dl, 1
mov ecx, eax
and bl, 1
or dl, bl
dec eax
test ecx, ecx
jne 0x497d6a
mov eax, 7
inc esi
mov bl, byte [esi]
mov cl, al
shr bl, cl
shl dl, 1
mov ecx, eax
and bl, 1
or dl, bl
dec eax
test ecx, ecx
jne 0x497d84
mov eax, 7
inc esi
mov bl, byte [esi]
mov cl, al
shr bl, cl
shl dl, 1
mov ecx, eax
and bl, 1
or dl, bl
dec eax
test ecx, ecx
jne 0x497d9e
mov eax, 7
inc esi
mov ecx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZ234567]
movzx edx, dl
mov dl, byte [edx + ecx]
mov byte [edi], dl
inc edi
dec ebp
jne 0x497d20
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 1
mov byte [esp + 0x80], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x78]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x68]
pop ebx
xor ecx, esp
call fcn.004a17d1
add esp, 0x74
ret
Function at 0x49aab0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x804
mov eax, dword [0x4cbba0]
mov ecx, dword [esp + 0x808]
xor eax, esp
mov dword [esp + 0x800], eax
lea eax, [esp + 0x80c]
push eax
push ecx
lea edx, [esp + 8]
push 0x800
push edx
call dword [sym.imp.MSVCR71.dll__vsnprintf]
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004a17d1
add esp, 0x804
ret
Function at 0x49ace0
Capabilities:
Get file version info

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push 0
push ebp
mov byte [esi + 3], 0
mov byte [esi + 2], 0
mov byte [esi + 1], 0
mov byte [esi], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [esp + 0x14], eax
je 0x49ad7f
push edi
push eax
call sub.MFC71.DLL_operator_new
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x18]
push edi
push eax
push 0
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x49ad6f
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
push 0x4ad6f0
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
push edi
je 0x49ad70
mov eax, dword [esp + 0x10]
mov cl, byte [eax + 0xa]
mov byte [esi], cl
mov dl, byte [eax + 8]
mov byte [esi + 1], dl
mov cl, byte [eax + 0xe]
mov byte [esi + 2], cl
mov dl, byte [eax + 0xc]
mov byte [esi + 3], dl
call sub.MFC71.DLL_operator_delete
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
push edi
call sub.MFC71.DLL_operator_delete
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
pop esi
xor eax, eax
pop ebp
pop ecx
ret