joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449538
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov word [eax + 4], 0xffff
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov word [eax + 0x10], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0x20
mov dword [eax + 0x60], 0x20
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
mov dword [eax + 0x6c], 2
mov dword [eax + 0x70], 2
mov dword [eax + 0x74], 0x1388
mov dword [eax + 0x78], 0x1f4
mov dword [eax + 0x7c], 0x1f4
mov dword [eax + 0x80], 0
mov dword [eax + 0x84], 0
mov dword [eax + 0x88], 0x1f4
mov dword [eax + 0x8c], 0
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
mov dword [eax + 0x98], 0
mov word [eax + 0x90], dx
mov dword [eax + 0x9c], 0
mov dword [eax + 0x94], 0x8000
pop ebp
jmp fcn.0044948a

Function at 0x449bfa
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
cmp dword [ebp + 8], 2
sete al
inc eax
push 0
mov esi, dword [ebp + 0xc]
push eax
push 2
call sub.WS2_32.DLL_socket
mov ebx, eax
mov dword [ebp - 0x20], 1
or eax, 0xffffffff
mov dword [ebp - 0x24], 0x40000
cmp ebx, 0xffffffff
je 0x449cd6
cmp dword [ebp + 8], 2
jne 0x449c61
lea eax, [ebp - 0x20]
push eax
push 0x8004667e
push ebx
call sub.WS2_32.DLL_ioctlsocket
lea eax, [ebp - 0x24]
push 4
push eax
push 0x1002
push 0xffff
push ebx
call sub.WS2_32.DLL_setsockopt
cld
xor eax, eax
lea edi, [ebp - 0x1c]
mov ecx, 4
test esi, esi
rep stosd dword es:[edi], eax
mov word [ebp - 0x1c], 2
je 0x449c8d
movzx eax, word [esi + 4]
push eax
call sub.WS2_32.DLL_htons
mov word [ebp - 0x1a], ax
mov eax, dword [esi]
mov dword [ebp - 0x18], eax
jmp 0x449c9a
mov word [ebp - 0x1a], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x1c]
push 0x10
push eax
push ebx
call sub.WS2_32.DLL_bind
inc eax
je 0x449cc9
cmp dword [ebp + 8], 1
sete dl
xor eax, eax
test esi, esi
setne al
test edx, eax
je 0x449cd4
push 0x7fffffff
push ebx
call sub.WS2_32.DLL_listen
inc eax
jne 0x449cd4
push ebx
call sub.WS2_32.DLL_closesocket
or eax, 0xffffffff
jmp 0x449cd6
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x449d89
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x449db0
mov word [ebp - 0x14], 2
movzx eax, word [ebx + 4]
push eax
call sub.WS2_32.DLL_htons
mov word [ebp - 0x12], ax
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
cmp ebx, 1
push 0
sbb eax, eax
push 0
not eax
and eax, 0x10
push eax
xor eax, eax
test ebx, ebx
je 0x449dc8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push 0
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call sub.WS2_32.DLL_WSASendTo
inc eax
jne 0x449df3
call sub.WS2_32.DLL_WSAGetLastError
cmp eax, 0x2733
sete al
movzx eax, al
dec eax
jmp 0x449df6
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x449e89
Capabilities:
Get socket status

Disassembly:
push ebp
mov edx, 0x3e8
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x228
mov ecx, edx
mov eax, dword [ebp + 0x10]
xor edx, edx
div ecx
imul edx, edx, 0x3e8
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x234], eax
mov eax, dword [esi]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x230], edx
test al, 1
je 0x449ee5
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], 1
test al, 2
je 0x449f18
xor eax, eax
mov edx, dword [ebp - 0x11c]
cmp eax, edx
jae 0x449f01
cmp dword [ebp + eax*4 - 0x118], ebx
je 0x449f01
inc eax
jmp 0x449ef1
cmp eax, edx
jne 0x449f18
cmp eax, 0x3f
ja 0x449f18
mov dword [ebp + eax*4 - 0x118], ebx
inc eax
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x234]
lea edi, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x11c]
push 0
push edi
push eax
lea eax, [ebx + 1]
push eax
call sub.WS2_32.DLL_select
or edx, 0xffffffff
test eax, eax
jl 0x449f6b
mov dword [esi], 0
je 0x449f69
push edi
push ebx
call sub.WS2_32.DLL___WSAFDIsSet
test eax, eax
je 0x449f55
or dword [esi], 1
lea ecx, [ebp - 0x11c]
push ecx
push ebx
call sub.WS2_32.DLL___WSAFDIsSet
test eax, eax
je 0x449f69
or dword [esi], 2
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x47d8da
Capabilities:
Hash data with crc32

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x47db24
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ecx, eax
test esi, esi
not ecx
jmp 0x47d912
test dl, 3
je 0x47d914
mov al, byte [edx]
inc edx
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x581080]
dec esi
jne 0x47d8fa
mov ebx, edx
cmp esi, 0x1f
jbe 0x47dac7
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x581880]
xor eax, dword [edx*4 + 0x581c80]
movzx edx, cl
xor eax, dword [edx*4 + 0x581480]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x581080]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x581880]
xor eax, dword [edx*4 + 0x581c80]
movzx edx, cl
xor eax, dword [edx*4 + 0x581480]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x581080]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x581880]
xor eax, dword [edx*4 + 0x581c80]
movzx edx, cl
xor eax, dword [edx*4 + 0x581480]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x581080]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x581880]
xor eax, dword [edx*4 + 0x581c80]
movzx edx, cl
xor eax, dword [edx*4 + 0x581480]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x581080]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x581880]
xor eax, dword [edx*4 + 0x581c80]
movzx edx, cl
xor eax, dword [edx*4 + 0x581480]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x581080]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x581880]
xor eax, dword [edx*4 + 0x581c80]
movzx edx, cl
xor eax, dword [edx*4 + 0x581480]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x581080]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
shr ecx, 0x10
mov eax, dword [eax*4 + 0x581880]
xor eax, dword [edx*4 + 0x581c80]
movzx edx, cl
xor eax, dword [edx*4 + 0x581480]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x581080]
xor ecx, dword [ebx]
add ebx, 4
movzx eax, ch
movzx edx, cl
mov eax, dword [eax*4 + 0x581880]
xor eax, dword [edx*4 + 0x581c80]
sub esi, 0x20
shr ecx, 0x10
movzx edx, cl
xor eax, dword [edx*4 + 0x581480]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x581080]
jmp 0x47d916
cmp esi, 3
jbe 0x47db05
xor ecx, dword [ebx]
sub esi, 4
movzx eax, ch
movzx edx, cl
mov eax, dword [eax*4 + 0x581880]
add ebx, 4
shr ecx, 0x10
xor eax, dword [edx*4 + 0x581c80]
movzx edx, cl
xor eax, dword [edx*4 + 0x581480]
mov edx, ecx
shr edx, 8
mov ecx, eax
xor ecx, dword [edx*4 + 0x581080]
jmp 0x47dac7
mov edx, ebx
test esi, esi
je 0x47db20
mov al, byte [edx]
inc edx
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x581080]
dec esi
jmp 0x47db09
mov eax, ecx
not eax
pop ebx
pop esi
pop ebp
ret
Function at 0x47e88b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
mov edi, dword [ebp + 8]
test edi, edi
je 0x47e8aa
mov ebx, dword [edi + 0x1c]
test ebx, ebx
je 0x47e8aa
cmp dword [edi + 0x20], 0
je 0x47e8aa
cmp dword [edi + 0x24], 0
jne 0x47e8b4
mov eax, 0xfffffffe
jmp 0x47e9b4
mov dword [edi + 0x2c], 2
mov eax, dword [ebx + 8]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x14], 0
mov dword [edi + 8], 0
mov dword [edi + 0x18], 0
mov dword [ebx + 0x14], 0
test eax, eax
jns 0x47e8e9
neg eax
mov dword [ebx + 0x18], eax
mov edx, dword [ebx + 0x18]
cmp edx, 1
sbb eax, eax
and eax, 0x47
add eax, 0x2a
cmp edx, 2
mov dword [ebx + 4], eax
jne 0x47e90c
push 0
push 0
push 0
call fcn.0047d8da
jmp 0x47e917
push 0
push 0
push 0
call fcn.00480200
add esp, 0xc
mov dword [edi + 0x30], eax
mov dword [ebx + 0x28], 0
push ebx
call fcn.004805bf
pop edi
mov ecx, dword [ebx + 0x4c]
mov eax, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x44]
add eax, eax
cld
mov dword [ebx + 0x3c], eax
mov word [edi + ecx*2 - 2], 0
xor eax, eax
lea ecx, [ecx + ecx - 2]
rep stosb byte es:[edi], al
imul edx, dword [ebx + 0x84], 0xc
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x5c], 0
movzx eax, word [edx + 0x5830c2]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0
movzx eax, word [edx + 0x5830c0]
mov dword [ebx + 0x8c], eax
mov dword [ebx + 0x78], 2
movzx eax, word [edx + 0x5830c4]
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x60], 2
movzx eax, word [edx + 0x5830c6]
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x48], 0
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x47efb8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, eax
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x74]
mov edx, dword [esi + 0x3c]
sub edx, eax
mov eax, dword [ebp - 0x14]
add eax, dword [esi + 0x2c]
mov dword [ebp - 0x10], edx
sub eax, 0x106
mov edx, dword [esi + 0x6c]
sub dword [ebp - 0x10], edx
cmp edx, eax
jb 0x47f054
push dword [ebp - 0x14]
mov edx, dword [esi + 0x38]
mov eax, dword [ebp - 0x14]
add eax, edx
push eax
push edx
call fcn.0048e820
mov edx, dword [ebp - 0x14]
mov ecx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edx
add esp, 0xc
sub dword [esi + 0x6c], edx
lea eax, [eax + ecx*2]
sub dword [esi + 0x5c], edx
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x47f026
mov ebx, edx
sub bx, word [ebp - 0x14]
dec ecx
mov word [eax], bx
jne 0x47f013
mov ecx, dword [ebp - 0x14]
mov eax, dword [esi + 0x40]
lea eax, [eax + ecx*2]
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x47f048
mov ebx, edx
sub bx, word [ebp - 0x14]
dec ecx
mov word [eax], bx
jne 0x47f035
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov ebx, dword [esi]
mov eax, dword [ebx + 4]
test eax, eax
je 0x47f10c
mov edx, dword [esi + 0x6c]
mov edi, eax
mov dword [ebp - 0x18], edx
mov edx, dword [esi + 0x38]
add dword [ebp - 0x18], edx
mov edx, dword [esi + 0x74]
add dword [ebp - 0x18], edx
cmp eax, dword [ebp - 0x10]
jbe 0x47f07d
mov edi, dword [ebp - 0x10]
xor edx, edx
test edi, edi
je 0x47f0cb
sub eax, edi
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x47f0a0
push edi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.00480200
jmp 0x47f0b0
cmp eax, 2
jne 0x47f0b6
push edi
push dword [ebx]
push dword [ebx + 0x30]
call fcn.0047d8da
add esp, 0xc
mov dword [ebx + 0x30], eax
push edi
push dword [ebx]
push dword [ebp - 0x18]
call fcn.0048e820
add dword [ebx], edi
add dword [ebx + 8], edi
add esp, 0xc
mov edx, edi
mov eax, dword [esi + 0x74]
add eax, edx
mov dword [esi + 0x74], eax
cmp eax, 2
jbe 0x47f0f7
mov ebx, dword [esi + 0x6c]
mov edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [ebx + edx]
mov dword [esi + 0x48], eax
movzx edx, byte [edx + ebx + 1]
shl eax, cl
xor eax, edx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp dword [esi + 0x74], 0x105
ja 0x47f10c
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x47efc9
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x484c7c
Capabilities:
Set global application hook

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x5894a0], 0
jne 0x484ccb
mov dword [0x5894d0], 1
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [0x589480], eax
push eax
push 0
push 0x484945
push 3
call sub.USER32.dll_SetWindowsHookExA
mov dword [0x589470], eax
push 1
call sub.WINMM.DLL_timeBeginPeriod
push 0x4847cb
call fcn.004012d0
mov dword [0x5894a0], 1
leave
ret
Function at 0x484ccd
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
jmp 0x484db0
mov ecx, dword [ebp - 0x20]
sub ecx, 0x100
cmp ecx, 5
ja 0x484d6d
mov eax, 1
shl eax, cl
test al, 0x33
je 0x484d6d
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10
jb 0x484d6d
cmp eax, 0x12
jbe 0x484d0b
sub eax, 0x5b
cmp eax, 1
ja 0x484d6d
mov dword [0x589490], 0
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x484d28
or dword [0x589490], 1
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x484d3b
or dword [0x589490], 2
push 0x12
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x484d4e
or dword [0x589490], 4
push 0x5b
call sub.USER32.dll_GetKeyState
test ax, ax
js 0x484d66
push 0x5c
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x484d6d
or dword [0x589490], 8
mov eax, dword [ebp - 0x24]
call fcn.004847ea
test eax, eax
je 0x484da1
push dword [ebp - 0x24]
jmp 0x484d7f
push ebx
call sub.USER32.dll_GetParent
mov ebx, eax
test eax, eax
je 0x484da1
call fcn.004847ea
test eax, eax
jne 0x484d7e
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.USER32.dll_IsDialogMessageA
test eax, eax
jne 0x484db0
lea ebx, [ebp - 0x24]
push ebx
call sub.USER32.dll_TranslateMessage
push ebx
call sub.USER32.dll_DispatchMessageA
lea eax, [ebp - 0x24]
push 1
push 0
push 0
push 0
push eax
call sub.USER32.dll_PeekMessageA
test eax, eax
jne 0x484cd9
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x484dce
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xff
push 0xffffffffffffffff
push 0
push 0
push 0
call sub.USER32.dll_MsgWaitForMultipleObjects
leave
jmp fcn.00484ccd

Function at 0x485061
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xa
push 0
push 0
push dword [ebp + 8]
push 0
push 0
call sub.SHELL32.DLL_ShellExecuteA
leave
cmp eax, 0x20
setg al
movzx eax, al
ret

Function at 0x4852df
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.WS2_32.DLL_WSAStartup
push 0x4852d6
call fcn.004012d0
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [0x597de0], eax
lea edx, [eax + 0x20]
add eax, 0x40
mov dword [0x597e00], edx
mov dword [0x597df0], eax
leave
ret

Function at 0x485513
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call sub.WS2_32.DLL_gethostbyname
mov ecx, eax
xor eax, eax
test ecx, ecx
je 0x48553b
movsx edx, word [ecx + 8]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
movsx edx, word [ecx + 0xa]
mov dword [eax], edx
mov eax, dword [ecx + 0xc]
leave
ret
Function at 0x48553d
Capabilities:
Connect socket

Disassembly:
push ebp
or eax, 0xffffffff
mov ebp, esp
push edi
sub esp, 0x10
cmp dword [ebp + 0x10], 2
jne 0x48558b
cld
xor eax, eax
lea edi, [ebp - 0x14]
mov ecx, 4
rep stosd dword es:[edi], eax
movzx eax, word [ebp + 0x18]
mov word [ebp - 0x14], 2
push eax
call sub.WS2_32.DLL_htons
push dword [ebp + 0x14]
push dword [ebp + 0xc]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
call fcn.0048e820
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [ebp + 8]
call sub.WS2_32.DLL_connect
mov edi, dword [ebp - 4]
leave
ret

Function at 0x48c710
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x48c746
mov dword [0x5976f0], eax
mov edx, 0x48c6f0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0048d1f0
test eax, eax
sete al
movzx eax, al
mov dword [0x52a3c0], eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x52a3c0], eax
leave
ret
Function at 0x48c830
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], 0x48ba00
mov dword [ebp - 0x24], 0x491664
mov dword [ebp - 0x1c], 0x48c8f0
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.0048d9a0
cmp dword [0x52a3c0], 0
mov dword [ebp - 0x44], 0x597700
je 0x48c8d0
jl 0x48c910
mov dword [ebp - 0x3c], 1
mov eax, dword [0x5976f0]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x48c9b3
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.0048da80
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x597740]
mov eax, 0xffffffff
test edx, edx
je 0x48c92a
mov eax, dword [0x52a3c4]
test eax, eax
je 0x48c96a
xor eax, eax
test eax, eax
jne 0x48c960
mov edi, dword [0x52a3c0]
test edi, edi
js 0x48c960
mov dword [ebp - 0x44], 0x597700
mov ebx, dword [0x52a3c0]
test ebx, ebx
je 0x48c8d0
jmp 0x48c87e
xor esi, esi
mov dword [0x52a3c0], esi
jmp 0x48c938
mov dword [esp], 0x52a3c8
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.dll_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x48c9f1
mov eax, dword [0x52a3c4]
test eax, eax
jne 0x48c928
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x52a3c4]
test eax, eax
je 0x48c98d
jmp 0x48c928
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x48c9e5
mov dword [esp + 4], eax
mov eax, dword [0x5976f0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x48ca1a
test edx, edx
je 0x48ca05
mov dword [ebp - 0x3c], 1
call fcn.0048b540
call fcn.0048c710
mov eax, 1
mov dword [0x52a3c4], eax
jmp 0x48c928
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x48c8c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
jmp 0x48c9e1
Function at 0x48ca30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
push esi
push ebx
sub esp, 0x120
mov ebx, dword [esp + 0x130]
call sub.msvcrt.dll__errno
mov dword [eax], 0
test ebx, ebx
je 0x48cc59
cmp byte [ebx], 0
je 0x48cc24
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
cmp eax, 0xffffffff
je 0x48cc4a
test al, 0x10
je 0x48cc24
mov dword [esp + 4], ebx
mov eax, 0x104
lea esi, [esp + 0x10]
mov dword [esp + 8], eax
mov dword [esp], esi
call sub.msvcrt.dll__fullpath
mov ecx, esi
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [ecx]
add ecx, 4
lea edx, [ebx - 0x1010101]
not ebx
and edx, ebx
mov eax, edx
and eax, 0x80808080
je 0x48caa0
and edx, 0x8080
jne 0x48cac6
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, esi
lea edx, [ecx + 0x233]
mov dword [esp], edx
call sub.msvcrt.dll_malloc
test eax, eax
mov ebx, eax
je 0x48cc3b
mov dword [esp + 4], esi
lea esi, [eax + 0x22c]
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
cmp byte [ebx + 0x22c], 0
je 0x48cbc0
mov dword [esp], esi
mov ecx, 0x2f
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strrchr
mov edi, eax
mov ecx, esi
lea esi, [esi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov eax, edx
and eax, 0x80808080
je 0x48cb20
and edx, 0x8080
jne 0x48cb46
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, esi
lea edx, [ecx + ebx + 0x22b]
cmp edi, edx
je 0x48cbc0
mov dword [esp], esi
mov edi, 0x5c
mov dword [esp + 4], edi
call sub.msvcrt.dll_strrchr
mov edi, eax
mov ecx, esi
lea esi, [esi]
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
not eax
and edx, eax
mov eax, edx
and eax, 0x80808080
je 0x48cb70
and edx, 0x8080
jne 0x48cb96
shr eax, 0x10
add ecx, 2
add al, al
sbb ecx, 3
sub ecx, esi
lea edx, [ecx + ebx + 0x22b]
cmp edi, edx
je 0x48cbc0
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov word [eax + esi], 0x5c
lea esi, [esi]
lea edi, [edi]
mov dword [esp], esi
mov edi, 0xffffffff
call sub.msvcrt.dll_strlen
mov word [eax + esi], 0x2a
xor ecx, ecx
xor esi, esi
mov dword [ebx + 0x224], edi
xor edx, edx
xor eax, eax
mov dword [ebx + 0x228], ecx
mov edi, 0x104
xor ecx, ecx
mov dword [ebx + 0x118], esi
lea esi, [ebx + 0x120]
mov word [ebx + 0x11c], dx
mov word [ebx + 0x11e], ax
mov dword [esp + 8], edi
mov dword [esp], esi
mov dword [esp + 4], ecx
call sub.msvcrt.dll_memset
add esp, 0x120
mov eax, ebx
pop ebx
pop esi
pop edi
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
xor eax, eax
add esp, 0x120
pop ebx
pop esi
pop edi
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x48cc31
call sub.msvcrt.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x48cc31
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x48cc31