joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d1ae
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x150
mov eax, dword [0x5c4e68]
xor eax, esp
mov dword [esp + 0x14c], eax
push ebx
push esi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [esp + 0x4d]
push ebx
push eax
mov byte [esp + 0x54], bl
call fcn.005117f0
push 0x3f
lea eax, [esp + 0x19]
push ebx
push eax
mov byte [esp + 0x20], bl
call fcn.005117f0
add esp, 0x18
cmp edi, ebx
je 0x42d274
mov eax, edi
call fcn.004c3ab2
push 0x21e88e
lea eax, [esi - 0x25]
call fcn.004603fd
push eax
push str.P2_Tmp__d
lea eax, [esp + 0x14]
push 0x40
push eax
call fcn.004c53b7
add esp, 0x14
lea eax, [esp + 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x42d23e
push str._GetLastError_
push str.:2:CreateTempFile___FAILED:_GetTempPath___FAILED:__s
jmp 0x42d26d
push edi
push ebx
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x42d263
mov edx, edi
call fcn.004c3b34
test eax, eax
jne 0x42d263
mov eax, edi
jmp 0x42d276
push str._GetLastError_
push str.:2:CreateTempFile___FAILED:_GetTempFileName___FAILED:__s
call fcn.004265da
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [esp + 0x154]
pop esi
pop ebx
xor ecx, esp
call fcn.0051291c
mov esp, ebp
pop ebp
ret
Function at 0x42da43
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x107]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x108], bl
call fcn.005117f0
push 0x1c8
push 1
call fcn.00511988
mov edi, eax
add esp, 0x14
cmp edi, ebx
jne 0x42daa0
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x42db84
mov eax, dword [0x5e198c]
cmp eax, ebx
jne 0x42dab3
call fcn.004a8f27
mov dword [0x5e198c], eax
push edi
call fcn.004a9020
cmp dword [0x5e198c], ebx
pop ecx
jne 0x42dad6
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
call fcn.00511758
pop ecx
jmp 0x42db84
push 0xc
lea eax, [edi + 4]
push ebx
push eax
mov dword [edi], ebx
call fcn.005117f0
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [edi + 0x18], eax
push 0x40
lea eax, [edi + 0x24]
pop ecx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
call fcn.004c3b66
push dword [ebp - 0x10c]
mov ecx, 0x104
lea eax, [ebp - 0x108]
call fcn.004c3b66
mov esi, eax
call fcn.004c3e68
mov eax, esi
push eax
push 0x40
lea eax, [edi + 0x64]
pop ecx
call fcn.004c3b66
mov eax, dword [ebp + 0x18]
add esp, 0x18
mov dword [edi + 0xa4], eax
mov dword [edi + 0xb0], ebx
call fcn.004f16be
mov dword [edi + 0xb4], eax
lea eax, [edi + 0xb8]
call fcn.004c3ab2
push ebx
push ebx
push edi
push 0x42da03
push dword [ebp + 8]
mov dword [edi + 0xac], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [edi + 0xa8], eax
jne 0x42db86
mov eax, edi
call fcn.0042d9bd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret 0x14

Function at 0x42db97
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [0x5e198c]
push edi
xor ebx, ebx
call fcn.004a92db
xor edi, edi
jmp 0x42dbcc
cmp edi, 0x56ce
jge 0x42dbd4
cmp ebp, dword [eax + 0xa8]
je 0x42dbd2
mov esi, dword [0x5e198c]
call fcn.004a933c
inc edi
test eax, eax
jne 0x42dbb0
jmp 0x42dbd4
mov ebx, eax
mov eax, ebx
call fcn.0042d9bd
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x43442d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5e2218]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
mov esi, 0x90
jne 0x4344ae
push esi
lea eax, [ebp - 0x9c]
push edi
push eax
mov dword [ebp - 0xa0], edi
call fcn.005117f0
lea ebx, [esi + 4]
push ebx
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.005117f0
add esp, 0x18
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4344a3
push str._GetLastError_
push str.:8:ToggleNumLock___FAILED_to_initialize:_GetVersionEx___FAILED:__s
call fcn.004265da
pop ecx
pop ecx
mov eax, dword [ebp - 0x90]
mov dword [0x5e2218], eax
xor ebx, ebx
inc ebx
cmp eax, ebx
jne 0x4344e0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor byte [ebp - 0x78], bl
push 2
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
add esi, eax
jmp 0x4344ff
push edi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push ebx
push 0x45
push esi
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 3
push 0x45
push esi
call edi
mov esi, ebx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret

Function at 0x434550
Capabilities:
Log keystrokes via polling

Disassembly:
push dword [esp + 4]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx eax, ax
movzx eax, ax
shr eax, 0xf
ret
Function at 0x437b77
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.005117f0
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0x114], 0x103
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x437c04
push str._GetLastError_
lea eax, [ebp - 0x110]
push eax
push str.:8:WarnIfNotAdminUser___encountered_a_problem:_GetUserName___FAILED:_szUserName____s_:__s
call fcn.004265da
add esp, 0xc
lea edx, [ebp - 0x110]
call fcn.004c3b34
test eax, eax
je 0x437c04
lea eax, [ebp - 0x110]
push str.Unknown
push eax
call fcn.005123e0
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.0051291c
leave
ret
Function at 0x43b7d8
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
call fcn.0048a119
push eax
call fcn.0042adad
add esp, 0xc
test eax, eax
jne 0x43b803
push ebx
push ebx
push ebx
call fcn.0048a119
pop ecx
pop ecx
mov ecx, eax
call fcn.0042b0ca
pop ecx
push 0x9dd
push str..Installation.c
mov edi, str.edt12.dat
push edi
push ebx
call fcn.0048a119
pop ecx
pop ecx
mov edx, 0x530484
mov ecx, eax
call fcn.0042d2c6
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
jne 0x43b848
push edi
push ebx
call fcn.0048a119
push eax
push str.:5:Install_FAILED:___s__could_not_be_opened_for_writing_
call fcn.00426c01
add esp, 0x10
xor eax, eax
jmp 0x43b864
push esi
push 1
lea eax, [esp + 0x18]
push 0x10
push eax
call fcn.005110f1
add esp, 0x10
mov ecx, esi
call fcn.0042d70e
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret
Function at 0x4420a1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
call fcn.00410257
mov ecx, dword [ebp + 8]
call fcn.004101cf
call fcn.00415ba6
cmp dword [0x5d9c9c], 3
jl 0x44214c
push str._KILL
push dword [0x5d9ca4]
call fcn.00512a33
test eax, eax
pop ecx
pop ecx
jne 0x44213a
push eax
mov ecx, fcn.004583a7
call fcn.0040fe48
pop ecx
mov ecx, dword [0x5d9ca8]
push 1
push 1
call fcn.00410b74
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x442115
push dword [0x5d9ca8]
push str._n__s__was_successfully_terminated.
call fcn.00416ae0
pop ecx
pop ecx
jmp 0x442129
push esi
push dword [0x5d9ca8]
push str._n__s__could_not_be_terminated:_exit_code__d
call fcn.00416ae0
add esp, 0xc
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.0051287a
push str._TESTPCL
push dword [0x5d9ca4]
call fcn.00512a33
pop ecx
pop ecx
call fcn.004423e6
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x442158
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
xor ebp, ebp
push edi
xor eax, eax
cmp dword [eax*4 + 0x6bc528], ebp
je 0x442170
inc eax
cmp eax, 2
jl 0x442161
xor ebx, ebx
cmp eax, 2
mov edi, 0x6cc5c
jge 0x442242
mov esi, eax
imul esi, esi, 0x6cc5c
add esi, 0x5e2c70
inc ebx
mov dword [eax*4 + 0x6bc528], ebx
push edi
push ebp
push esi
call fcn.005117f0
add esp, 0xc
push 0x64
lea ecx, [esi + 0x4c0]
lea eax, [esi + 0x32c]
pop edx
mov dword [eax - 0x194], ecx
mov dword [eax], ecx
add eax, 4
dec edx
jne 0x4421b0
push ebp
push ebp
mov dword [esi + 0x37608], ebx
call fcn.0048a119
push eax
push 0x5304c0
mov edi, 0x104
lea eax, [esi + 0x240c]
push edi
push eax
call fcn.004c53b7
add esp, 0x18
push str.PaulaConfig.cfg
push ebp
push ebp
call fcn.00489f49
pop ecx
pop ecx
push eax
mov ebx, 0x533dd4
push ebx
lea eax, [esi + 0x22a8]
push edi
push eax
call fcn.004c53b7
add esp, 0x14
push str.PaulaEmpConfig.cfg
push ebp
push ebp
call fcn.00489f49
pop ecx
pop ecx
push eax
push ebx
lea eax, [esi + 0x21a4]
push edi
push eax
call fcn.004c53b7
add esp, 0x14
xor eax, eax
call fcn.0044229d
cmp eax, ebp
jne 0x44227d
push str.:9:CreatePaula___encountered_a_serious_exception._The_paula_pointer_register_could_not_be_obtained.__The_paula_object_has_been_created_but_will_not_be_able_to_be_deleted_
call fcn.00426c01
jmp 0x442283
push edi
inc ebx
push ebx
call fcn.00511988
mov esi, eax
cmp esi, ebp
pop ecx
pop ecx
jne 0x442196
push str._n_nERROR:_OUT_OF_MEMORY__Could_not_create_PAULA_object_
call fcn.004147da
pop ecx
push edi
push str.:9:CreatePaula___FAILED:_Out_of_memory:_calloc_1___d__FAILED.
call fcn.004265da
pop ecx
pop ecx
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x442297
push esi
call fcn.004a9020
pop ecx
push esi
call fcn.004583b3
pop ecx
mov ecx, 0x45b32b
call fcn.004622a3
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x453495
Capabilities:
Delete file

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esp + 8], ebx
push esi
push edi
jne 0x4534d8
mov esi, str.MsSa7Pw.flg
push esi
push ebx
mov dword [0x6bd0e4], ebx
call fcn.0048a119
pop ecx
pop ecx
mov edi, eax
call fcn.0042ad00
test eax, eax
je 0x4534d0
push esi
push ebx
call fcn.0048a119
pop ecx
pop ecx
pop edi
pop esi
pop ebx
jmp fcn.0042a76b
xor eax, eax
inc eax
jmp 0x453577
cmp dword [0x6bd0e4], ebx
jne 0x4534d0
push 0x2e2f
push str..MainPAULA.c
mov esi, str.MsSa7Pw.flg
push esi
push ebx
call fcn.0048a119
pop ecx
pop ecx
mov edx, 0x53048c
mov ecx, eax
call fcn.0042d2c6
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x453560
push str.PAULA__please_ask_the_user_to_provide_the_password_for_SA7.__Thanks___KB.
push edi
call fcn.0051213b
mov edx, dword [esp + 0x1c]
pop ecx
pop ecx
call fcn.004c3b34
test eax, eax
jne 0x453542
mov eax, dword [esp + 0x14]
push ebx
call fcn.004c63cb
pop ecx
push eax
push 0x5302b4
push edi
call fcn.0051213b
add esp, 0xc
jmp 0x45354f
push 0x530220
push edi
call fcn.0051213b
pop ecx
pop ecx
mov ecx, edi
call fcn.0042d70e
xor eax, eax
inc eax
mov dword [0x6bd0e4], eax
jmp 0x453577
push esi
push ebx
call fcn.0048a119
push eax
push str.:5:FlagMissingSA7Password___FAILED:_fopen___s___FAILED_
call fcn.004265da
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x46091b
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp + 0x88], eax
mov eax, dword [ebp + 0x98]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
push edi
mov dword [ebp - 0x80], eax
jg 0x46094f
mov esi, 0x200
push 1
push 0x1f0
call fcn.00511988
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
jne 0x46096a
xor eax, eax
jmp 0x460a5a
lea eax, [esi + 0xa]
push eax
push 1
call fcn.00511988
cmp eax, ebx
pop ecx
pop ecx
mov dword [edi], eax
jne 0x460986
push edi
call fcn.00511758
pop ecx
jmp 0x460963
inc dword [0x6bef18]
mov eax, dword [0x6bef18]
mov dword [edi + 0x2c], eax
mov eax, dword [0x6bef14]
cmp eax, ebx
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 8], esi
jne 0x4609b0
call fcn.004a8f27
mov dword [0x6bef14], eax
push edi
call fcn.004a9020
cmp dword [0x6bef14], ebx
pop ecx
jne 0x4609cf
push dword [edi]
call fcn.00511758
push edi
call fcn.00511758
pop ecx
jmp 0x460983
lea ebx, [edi + 0x30]
push str..Message.c
push ebx
call fcn.0043266e
test eax, eax
pop ecx
pop ecx
jne 0x4609ee
push str.:5:CreateMessage___EAP:_InitializeLock___FAILED.
call fcn.004265da
pop ecx
mov esi, str.A_Message_handle_had_to_be_forced_to_unlock___
mov eax, ebx
call fcn.0043296d
mov eax, 0x7d0
mov ecx, ebx
call fcn.004329aa
cmp dword [ebp - 0x80], 0
mov eax, dword [ebp + 0x94]
mov dword [edi + 0x10], eax
je 0x460a51
push 0x103
lea eax, [ebp - 0x7b]
push 0
push eax
mov byte [ebp - 0x7c], 0
call fcn.005117f0
push dword [ebp - 0x80]
mov ecx, 0x104
lea eax, [ebp - 0x7c]
call fcn.004c3b66
mov esi, eax
call fcn.004c3e68
mov eax, esi
push eax
push 0x16
lea eax, [edi + 0x14]
pop ecx
call fcn.004c3b66
add esp, 0x14
mov eax, edi
call fcn.00461c99
mov eax, edi
mov ecx, dword [ebp + 0x88]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
add ebp, 0x8c
leave
ret
Function at 0x4613f8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0x100000
mov esi, eax
mov dword [esp + 0x10], edi
call fcn.004c3b34
test eax, eax
je 0x461424
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00460b80
test eax, eax
je 0x46141b
mov ecx, dword [ebp + 8]
push 0
call fcn.0042b397
cmp eax, edi
pop ecx
jae 0x46144c
test eax, eax
mov dword [esp + 0x10], eax
jg 0x46144c
mov dword [esp + 0x10], 0x400
mov eax, esi
call fcn.00461c83
test eax, eax
je 0x46141b
mov ecx, dword [ebp + 8]
push 0x435
push str..Message.c
mov edx, 0x53e444
call fcn.0042d2c6
test eax, eax
pop ecx
pop ecx
mov dword [esp + 0x14], eax
jne 0x461481
mov eax, esi
call fcn.00461c99
jmp 0x46141b
mov ebx, dword [esp + 0x10]
lea eax, [ebx + 0x400]
push 1
push eax
call fcn.00511988
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x461478
push dword [esp + 0x14]
push ebx
jmp 0x4614ee
and dword [esp + 0xc], 0
test ebx, ebx
jle 0x4614e6
mov eax, dword [esi + 0xc]
inc eax
cmp eax, dword [esi + 8]
jl 0x4614bf
mov eax, esi
call fcn.00461c2b
test eax, eax
je 0x461504
mov eax, dword [esi + 0xc]
mov edx, dword [esp + 0xc]
mov dl, byte [edx + edi]
mov ecx, dword [esi]
mov byte [eax + ecx], dl
inc dword [esi + 0xc]
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 4]
jle 0x4614dc
mov dword [esi + 4], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jl 0x4614ab
push dword [esp + 0x14]
push dword [esp + 0x14]
push 1
push edi
call fcn.00511c63
mov ebx, eax
add esp, 0x10
test ebx, ebx
jg 0x4614a2
xor ebx, ebx
inc ebx
jmp 0x461506
xor ebx, ebx
mov ecx, dword [esp + 0x14]
call fcn.0042d70e
mov eax, esi
call fcn.00461c99
push edi
call fcn.00511758
pop ecx
mov eax, ebx
jmp 0x46141d
Function at 0x461561
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov esi, eax
je 0x4615cd
cmp byte [ebx], 0
je 0x4615cd
call fcn.00460b80
test eax, eax
je 0x4615cd
mov eax, esi
call fcn.00461c83
test eax, eax
je 0x4615cd
cmp dword [ebp + 0xc], edi
mov dword [ebp - 4], 1
mov ecx, ebx
je 0x4615d4
push edi
call fcn.0042b397
test eax, eax
pop ecx
jbe 0x4615a8
mov dword [ebp - 4], edi
push 0x4ad
mov edx, 0x5304c8
mov ecx, ebx
push str..Message.c
call fcn.0042d2c6
mov ebx, eax
cmp ebx, edi
pop ecx
pop ecx
jne 0x4615e0
mov eax, esi
call fcn.00461c99
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 0x4b2
mov edx, 0x53048c
jmp 0x4615b4
cmp dword [esi + 4], edi
jle 0x461650
cmp dword [ebp + 0xc], edi
je 0x4615fc
cmp dword [ebp - 4], edi
jne 0x4615fc
push ebx
push 0xa
call fcn.00512df5
pop ecx
xor edi, edi
pop ecx
inc edi
push ebx
push dword [esi + 4]
push 1
push dword [esi]
call fcn.005110f1
mov ecx, dword [esi + 4]
add edi, eax
add esp, 0x10
cmp edi, ecx
jge 0x461650
mov eax, dword [esi]
call fcn.004c3b56
test eax, eax
jne 0x461650
inc dword [0x6bef1c]
cmp dword [0x6bef1c], 2
jge 0x461644
push ecx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.:4:PrintMessageToFile___s____d__FAILED:_fprintf____d____d_FAILED.
call fcn.00426c01
add esp, 0x14
mov ecx, ebx
call fcn.0042d70e
jmp 0x4615c6
mov ecx, ebx
call fcn.0042d70e
mov eax, esi
call fcn.00461c99
xor eax, eax
inc eax
jmp 0x4615cf
Function at 0x4619f8
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [0x6dee48]
push esi
push edi
xor esi, esi
xor eax, eax
lea edi, [ebp - 0xa]
mov word [ebp - 0xc], si
mov dword [ebp - 4], ebx
stosw word es:[edi], ax
mov dword [ebp - 0x10], esi
call fcn.00412cb9
mov edi, eax
call fcn.00412c21
mov dword [ebp - 8], eax
call fcn.00412d51
cmp ebx, esi
mov dword [ebp - 0x18], eax
jne 0x461a7a
mov eax, dword [ebp - 8]
imul eax, edi
add eax, dword [ebp - 8]
mov esi, edi
imul esi, esi, 5
add esi, eax
push str..Message.c
push 0x5ed
mov ecx, esi
call fcn.0046091b
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
jne 0x461a7d
push esi
push str.:7:MessageCaptureScreen___FAILED:_CreateMessage__d__FAILED.
call fcn.004265da
pop ecx
pop ecx
jmp 0x461bbc
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 4]
call fcn.00460b80
test eax, eax
je 0x461bae
mov eax, esi
call fcn.00461c83
test eax, eax
je 0x461bae
lea esi, [edi + 1]
imul esi, dword [ebp - 8]
add esi, 0xa
jmp 0x461ab8
mov eax, dword [ebp - 4]
call fcn.00461c2b
test eax, eax
je 0x461b93
mov eax, dword [ebx + 8]
sub eax, dword [ebx + 0xc]
sub eax, 0xa
cmp eax, esi
jl 0x461aa8
xor esi, esi
cmp dword [ebp - 8], esi
jle 0x461b68
mov word [ebp - 0xc], si
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebx + 0xc]
add eax, dword [ebx]
mov word [ebp - 0xa], si
push dword [ebp - 0xc]
push edi
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
test eax, eax
jne 0x461b1a
inc dword [0x6bf128]
cmp dword [0x6bf128], 5
jge 0x461b1a
push str._GetLastError_
push dword [0x6bf128]
push str.:4:MessageCaptureScreen___FAILED__d_of_5:_ReadConsoleOutputCharacter___FAILED:__s
call fcn.00426c01
add esp, 0xc
xor edx, edx
cmp dword [ebp - 0x10], edx
jbe 0x461b5e
mov eax, dword [ebx + 0xc]
add eax, dword [ebx]
lea ecx, [eax + edx]
mov al, byte [ecx]
call fcn.004c4d2d
test eax, eax
je 0x461b37
mov byte [ecx], 0x7e
inc edx
cmp edx, dword [ebp - 0x10]
jb 0x461b21
mov eax, dword [ebp - 0x10]
test eax, eax
jbe 0x461b5e
add dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx]
mov byte [eax + ecx], 0xa
inc dword [ebx + 0xc]
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebx + 4]
jle 0x461b5e
mov dword [ebx + 4], eax
inc esi
cmp esi, dword [ebp - 8]
jl 0x461ad4
mov eax, dword [ebx + 0xc]
xor ecx, ecx
cmp eax, dword [ebx + 8]
push 0x62f
setg cl
push str..Message.c
push ecx
call fcn.00425f1f
mov eax, dword [ebp - 4]
add esp, 0xc
call fcn.00461c99
mov eax, dword [ebp - 4]
jmp 0x461bbe
push dword [ebx + 0xc]
push dword [ebx + 8]
push str.:5:MessageCaptureScreen___FAILED:_EnlargeString___FAILED:_CurSize___d__CurPos___d
call fcn.004265da
mov eax, dword [ebp - 4]
add esp, 0xc
call fcn.00461c99
cmp dword [ebp - 0x14], 0
je 0x461bbc
mov eax, dword [ebp - 4]
call fcn.00460a72
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x463089
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5c4e68]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x6c2944], edi
jne 0x463220
push 0x103
lea eax, [ebp - 0x10f]
push edi
push eax
mov dword [ebp - 0x114], edi
mov byte [ebp - 0x110], 0
call fcn.005117f0
add esp, 0xc
push str.FtpMode.dat
push edi
push edi
call fcn.0048a119
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x110]
push 0x533dd4
push eax
call fcn.00511173
push 0x66f
mov ebx, str..Network.c
mov esi, 0x530488
push ebx
mov edx, esi
lea ecx, [ebp - 0x110]
call fcn.0042d2c6
add esp, 0x18
cmp eax, edi
mov dword [ebp - 0x118], eax
jne 0x463182
lea edi, [ebp - 0x110]
call fcn.0042ad00
test eax, eax
je 0x463220
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x674
push ebx
mov edx, esi
mov ecx, edi
call fcn.0042d2c6
test eax, eax
pop ecx
pop ecx
jne 0x463220
cmp dword [0x6c29ac], eax
jne 0x463220
call fcn.0042ad00
push eax
mov eax, edi
push eax
push eax
push str.:7:GetDefaultFtpMode___FAILED:_fopen___s____rb___FAILED:_DoesFileExist___s___returns__d
call fcn.00426c01
add esp, 0x10
mov dword [0x6c29ac], 1
jmp 0x463220
push eax
push 1
lea eax, [ebp - 0x114]
push 4
push eax
mov dword [ebp - 0x114], 0xfffe4df9
call fcn.00511c63
add esp, 0x10
cmp eax, 1
jae 0x4631d4
push edi
lea ecx, [ebp - 0x110]
call fcn.0042b397
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
push str.:8:GetDefaultFtpMode___FAILED:_fread___s___FAILED:_The_file_may_be_invalid:_The_file_holds_only_one_INT_and_its_size_is__ld.
call fcn.004265da
mov ecx, dword [ebp - 0x118]
add esp, 0xc
call fcn.0042d70e
jmp 0x463220
mov ecx, dword [ebp - 0x118]
call fcn.0042d70e
mov eax, dword [ebp - 0x114]
lea ecx, [eax + 3]
cmp ecx, 6
ja 0x46320b
cmp eax, edi
je 0x46320b
jle 0x4631fb
mov dword [0x6bf884], edi
jmp 0x463220
cmp eax, edi
jge 0x463220
mov dword [0x6bf884], 0x8000000
jmp 0x463220
push eax
lea eax, [ebp - 0x110]
push eax
push str.:9:GetDefaultFtpMode___FAILED:_At_initialization__the_mode_read_from_the_save_file___s__is_INVALID:_Valid_values_are__3___2___1__1__2__3:_The_mode_read___d.
call fcn.004265da
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, dword [0x6bf884]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051291c
leave
ret
Function at 0x464545
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
push edi
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 4], edi
xor esi, esi
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, 0x7a
jne 0x464599
push 1
push dword [ebp - 4]
call fcn.00511988
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
jne 0x46458e
push 1
push dword [ebp - 4]
push str.:8:GetRouteGateway___FAILED:_calloc__d___d___FAILED:_Out_of_memory_
call fcn.004265da
add esp, 0xc
xor eax, eax
jmp 0x464648
push edi
lea eax, [ebp - 4]
push eax
push esi
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, edi
je 0x4645f7
cmp eax, 0x32
je 0x4645df
cmp eax, 0x57
je 0x4645c8
cmp eax, 0x7a
je 0x4645be
push str._GetLastError_
push str.:7:GetRouteGateway___FAILED:__s
call fcn.004265da
pop ecx
jmp 0x4645e9
push dword [ebp - 4]
push str.:8:GetRouteGateway___FAILED:_Buffer_size___ld:_The_buffer_pointed_to_by_the_pIpForwardTable_parameter_is_not_large_enough._The_required_size_is_returned_in_the_DWORD_variable_pointed_to_by_the_pdwSize_parameter.
jmp 0x4645b6
push dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push esi
push str.:8:GetRouteGateway__p___p__d___0__FAILED:_ERROR_INVALID_PARAMETER:_The_pdwSize_parameter_is_NULL__or_GetIpForwardTable_is_unable_to_write_to_the_memory_pointed_to_by_the_pdwSize_parameter.
call fcn.004265da
add esp, 0x10
jmp 0x4645ea
push str.:9:GetRouteGateway___FAILED:_This_function_is_not_supported_on_the_operating_system_in_use_on_the_local_system.
call fcn.004265da
pop ecx
cmp esi, edi
je 0x464587
push esi
call fcn.00511758
pop ecx
jmp 0x464587
cmp dword [esi], edi
jle 0x46463f
lea ebx, [esi + 4]
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x46460b
cmp dword [ebx + 0x10], eax
jne 0x46462c
mov ecx, dword [ebx]
cmp ecx, dword [ebp + 8]
jne 0x46462c
cmp dword [ebx + 0xc], 0
jne 0x464638
xor eax, eax
call fcn.00467c17
push eax
push str.:2:GetRouteGateway___encountered_an_undefined_gateway_for_ip_address__s_
call fcn.00426c01
pop ecx
pop ecx
inc edi
add ebx, 0x38
cmp edi, dword [esi]
jl 0x4645fe
xor edi, edi
jmp 0x46463f
imul edi, edi, 0x38
mov edi, dword [edi + esi + 0x10]
push esi
call fcn.00511758
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret