joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a602
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
push 1
mov ecx, dword [ebp - 0x14]
call fcn.00412100
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x698], 0
mov ecx, dword [ebp - 0x14]
call fcn.0042cba0
mov ecx, dword [ebp - 0x14]
call sub.MFC42.DLL_CCmdTarget::BeginWaitCursor
push 0
call fcn.0040fa80
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
call fcn.005075f7
mov ecx, dword [ebp - 0x14]
call fcn.00405b20
mov ecx, eax
add ecx, 0x468
call fcn.0040fea0
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
mov word [ecx + 0x690], 0
mov dword [ebp - 0x10], 0
jmp 0x49a681
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
jge 0x49a6ce
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.00405b20
mov ecx, eax
add ecx, 0x468
call fcn.0040fec0
mov edx, dword [eax]
mov dword [ebp - 8], edx
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.0049a4ec
mov ecx, dword [ebp - 0x14]
mov dx, word [ecx + 0x690]
add dx, ax
mov eax, dword [ebp - 0x14]
mov word [eax + 0x690], dx
jmp 0x49a678
mov ecx, dword [sym.imp.FAPISHAR.dll_struct_tagStaFavazza__g_aLeFave]
mov dword [ecx + 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [sym.imp.FAPISHAR.dll_struct_tagStaFavazza__g_aLeFave]
mov dword [edx], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
call fcn.00507610
push 0x64
call fcn.00437020
add esp, 4
mov dword [ebp - 0x10], 0
jmp 0x49a710
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 4]
jge 0x49a74a
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.00405b20
mov ecx, eax
add ecx, 0x468
call fcn.0040fec0
mov eax, dword [eax]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x49a748
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.0049a518
jmp 0x49a707
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x584], 0
mov ecx, dword [ebp - 0x14]
call fcn.0049a537
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x6002a8], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x804], 1
mov dword [ebp - 0xc], 0x100
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov dx, word [ecx + 0x690]
test edx, edx
je 0x49a7a9
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x49a7a9
push 0xc
call fcn.00437020
add esp, 4
jmp 0x49a77e
cmp dword [ebp - 0xc], 0
jne 0x49a7c0
push 0
push 0
push str.999_Timeout_while_waiting_for_pending_read
mov ecx, dword [ebp - 0x14]
call fcn.00488a88
push 0
push 0
push 0x468
mov ecx, dword [ebp - 0x14]
call fcn.0043ce20
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x698], 1
mov esp, ebp
pop ebp
ret
Function at 0x49f8f9
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x60032c], eax
push 0
call fcn.0040fa80
mov ecx, eax
call sub.MFC42.DLL_CWnd::EnableWindow
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x53c], 0
je 0x49f93d
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x540], 0
je 0x49f93d
push 0
mov ecx, dword [ebp - 0x14]
call fcn.0047f620
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x524], 0
jne 0x49f9bc
push 0
push str.Disabling_display
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x44]
call dword [edx + 0x24]
mov word [ebp - 8], ax
mov ax, word [ebp - 8]
push eax
push 0x2710
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
call fcn.005081eb
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x49f9a1
push 1
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [edx + 4]
mov dword [ebp - 0x18], eax
jmp 0x49f9a8
mov dword [ebp - 0x18], 0
mov ax, word [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x44
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x44]
call dword [eax + 0x28]
mov ecx, dword [ebp - 0x14]
call fcn.0043ce90
mov ecx, dword [ebp - 0x14]
call fcn.0049a7e2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x600330], eax
mov ecx, dword [ebp - 0x14]
call fcn.00405b20
mov ecx, eax
call fcn.00495a36
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x60033c], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.00405b20
mov ecx, eax
call fcn.00495935
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x5ffea4], eax
mov ecx, dword [ebp - 0x14]
call fcn.0049a602
mov ecx, dword [ebp - 0x14]
call fcn.0043ceb0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a373b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59d9e2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
mov dword [ebp - 0x12c], ecx
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x14
call fcn.00403d90
push eax
mov ecx, dword [ebp - 0x12c]
add ecx, 0x424
call sub.MFC42.DLL_CMapStringToOb::Lookup
test eax, eax
je 0x4a3792
mov eax, dword [ebp - 0x9c]
jmp 0x4a397c
push 0x14
call fcn.00403600
mov dword [ebp - 0x128], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x128], 0
je 0x4a37c2
mov ecx, dword [ebp - 0x128]
call sub.MFC42.DLL_CStringArray::CStringArray
mov dword [ebp - 0x130], eax
jmp 0x4a37cc
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x130]
mov dword [ebp - 0x124], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x98], 0
mov eax, 1
test eax, eax
je 0x4a388f
mov ecx, dword [ebp - 0x98]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
push eax
push str.DEFAULT__s_d
lea ecx, [ebp - 0x11c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5f0a9c
push 0x80
lea edx, [ebp - 0x90]
push edx
push 0x5f0aa8
lea eax, [ebp - 0x11c]
push eax
call fcn.0040acc0
mov ecx, eax
add ecx, 0x108
call fcn.00403d90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx ecx, byte [ebp - 0x90]
cmp ecx, 0x2a
jne 0x4a3869
jmp 0x4a388f
lea edx, [ebp - 0x90]
push edx
mov ecx, dword [ebp - 0x9c]
call fcn.0040ad40
mov eax, dword [ebp - 0x98]
add eax, 1
mov dword [ebp - 0x98], eax
jmp 0x4a37f5
mov ecx, dword [ebp - 0x9c]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x14
call fcn.00403d90
push eax
mov ecx, dword [ebp - 0x12c]
add ecx, 0x424
call fcn.0040ad70
mov ecx, dword [ebp - 0x9c]
call fcn.0040add0
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
call fcn.0050bf27
movsx edx, ax
mov dword [ebp - 0x94], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x94]
jge 0x4a3976
lea ecx, [ebp - 0x120]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 1
cmp dword [ebp - 0x10], 0
je 0x4a3914
push 0
mov ecx, dword [ebp - 0x9c]
call fcn.00405bb0
push eax
lea ecx, [ebp - 0x120]
call fcn.0058dfec
jmp 0x4a3924
push str.0.000
lea ecx, [ebp - 0x120]
call fcn.0058e0f4
mov dword [ebp - 0x98], 0
jmp 0x4a393f
mov ecx, dword [ebp - 0x98]
add ecx, 1
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x94]
sub edx, dword [ebp - 0x10]
cmp dword [ebp - 0x98], edx
jge 0x4a3964
lea eax, [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x9c]
call fcn.0042ac30
jmp 0x4a3930
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.0058df86
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a920a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59df23
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004abd05
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0xd4
call fcn.00403650
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0x5b5efc
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x40], 0x5b5ed0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x84], 0
call fcn.0040fa80
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xe4], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0xec], 0
push 0x5f12c4
push 0
push 0x5f12d0
call fcn.0040acc0
mov ecx, eax
add ecx, 0x108
call fcn.00403d90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0xe8], eax
push 0x1e0
call fcn.00403600
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 0
je 0x4a92d9
mov ecx, dword [ebp - 0x18]
call fcn.00401081
mov dword [ebp - 0x20], eax
jmp 0x4a92e0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xcc], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4af7ec
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e314
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa4
mov dword [ebp - 0xa0], ecx
push 0x5f182c
push 0x80
lea eax, [ebp - 0x90]
push eax
push str.HELPWS32ENGLISHWS32_EN.CHM
mov ecx, dword [ebp - 0xa0]
mov ecx, dword [ecx + 0x80]
call fcn.00405b20
add eax, 0x484
push eax
lea edx, [ebp - 0x94]
push edx
call sub.MFC42.DLL_operator
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xa8]
call fcn.00403d90
push eax
push str.HelpFile
call fcn.0040acc0
mov ecx, eax
add ecx, 0x108
call fcn.00403d90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.0058df86
lea ecx, [ebp - 0x90]
push ecx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::TrimRight
push 3
lea edx, [ebp - 0x98]
push edx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::Right
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0058dfec
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call fcn.0058df86
push 0x5f1864
lea ecx, [ebp - 0x10]
call fcn.00435ff0
test eax, eax
je 0x4af948
mov edx, dword [ebp - 0xa0]
mov ecx, dword [edx + 0x94]
add ecx, 0x14
call fcn.00403d90
push eax
push 0x101
lea eax, [ebp - 0x90]
push eax
call fcn.0040fa80
mov ecx, eax
call fcn.004120d0
push eax
call fcn.00495e6c
add esp, 0x10
mov dword [ebp - 0x9c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0058df86
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d8f5e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x190
push 0x5f4e68
push 0x190
push 0x5f4e74
call fcn.0040acc0
mov ecx, eax
add ecx, 0x108
call fcn.00403d90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
push eax
push 2
mov ecx, dword [ebp - 8]
call fcn.00412150
mov esp, ebp
pop ebp
ret

Function at 0x4d8fad
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0x190
push 0x5f4e84
push 0x190
push str.OscFlashRefresh
call fcn.0040acc0
mov ecx, eax
add ecx, 0x108
call fcn.00403d90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
push eax
push 1
mov ecx, dword [ebp - 8]
call fcn.00412150
mov esp, ebp
pop ebp
ret

Function at 0x4d8ffc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59fd17
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x14]
call fcn.0042ca80
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xcc]
cmp dword [ecx + 0x170], 0
jne 0x4d905d
push 0
push 0
push str.Could_not:_you_are_not_recording_
call sub.MFC42.DLL_AfxMessageBox
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0042caa0
jmp 0x4d914d
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0xcc]
cmp dword [eax + 0x178], 0
je 0x4d9077
mov ecx, dword [ebp - 0x1c]
call fcn.004d915b
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0xcc]
cmp dword [edx + 0x18c], 0
je 0x4d913e
push 0
push str.Write_OSCRECSTOP__ON
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x80]
add ecx, 0x44
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x80]
mov edx, dword [eax + 0x44]
call dword [edx + 0x24]
mov word [ebp - 0x18], ax
mov ax, word [ebp - 0x18]
push eax
push 0x4e20
push 0x5f4edc
push 0x6006d4
push str.OSCRECSTOP
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + 0x80]
add ecx, 0x44
call fcn.0050589a
mov dword [ebp - 0x10], eax
mov dx, word [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x80]
add ecx, 0x44
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x80]
mov edx, dword [eax + 0x44]
call dword [edx + 0x28]
push 0x5f4eec
push 0
push str.OSC_AUTOISOGEN
call fcn.0040acc0
mov ecx, eax
add ecx, 0x108
call fcn.00403d90
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x4d913e
push 0
push 0x3e8
push 0xfafa
mov ecx, dword [ebp - 0x1c]
call fcn.00412150
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0042caa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4fa93d
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a20c2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
mov dword [ebp - 0x1b0], ecx
lea eax, [ebp - 0x1a4]
push eax
mov ecx, dword [ebp - 0x1b0]
add ecx, 8
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const__]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1b0]
mov dword [ecx], 0x5b8078
mov edx, dword [ebp - 0x1b0]
mov dword [edx + 4], 0xffffffff
mov eax, dword [ebp - 0x1b0]
mov byte [eax + 0x30], 0
push 0x60081c
mov ecx, dword [ebp - 0x1b0]
add ecx, 8
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_char_const__]
mov ecx, dword [ebp - 0x1b0]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 0x1b0]
mov byte [edx + 0x18], 1
mov eax, dword [ebp - 0x1b0]
mov byte [eax + 0x24], 1
mov ecx, dword [ebp - 0x1b0]
mov dword [ecx + 0x38], 0
mov edx, dword [ebp - 0x1b0]
mov dword [edx + 0x3c], 0
xor eax, eax
mov al, byte [0x5f6fc5]
cmp eax, 1
jne 0x4faa69
lea ecx, [ebp - 0x19c]
push ecx
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
je 0x4faa55
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x1a8], esp
lea edx, [ebp - 0x1ac]
push edx
push str.SWBaseSocket___WSAStartup___failed:
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov dword [ebp - 0x1b4], eax
push 0
mov ecx, dword [ebp - 0x1b0]
call fcn.004fc127
push 0xffffffffffffffff
call dword [sym.imp.MSVCRT.dll_exit]
push 0x4fa70b
call fcn.0058ef7c
add esp, 4
mov byte [0x5f6fc5], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4fb3ac
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2195
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
cmp dword [eax + 4], 0
jge 0x4fb42a
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x14], esp
lea edx, [ebp - 0x18]
push edx
push str.SWBaseSocket::recv_____No_connection
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 4
call fcn.004fa7bf
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x5c]
or eax, 0xffffffff
jmp 0x4fb502
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 0x34]
call fcn.004fc096
and eax, 0xff
test eax, eax
jne 0x4fb447
or eax, 0xffffffff
jmp 0x4fb502
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x4fb492
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0x24]
push eax
push str.SWBaseSocket::recv___error:
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x34]
call dword [eax + 0x54]
jmp 0x4fb4ff
cmp dword [ebp - 0x10], 0
jne 0x4fb4f0
mov ecx, dword [ebp - 0x34]
mov byte [ecx + 0x30], 1
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x28], esp
lea edx, [ebp - 0x2c]
push edx
push str.SWBaseSocket::recv_____Connection_terminated_by_peer
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], 1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x30], esp
push 6
call fcn.004fa7bf
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x5c]
jmp 0x4fb4ff
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x34]
call dword [eax + 0x58]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ff306
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
cmp dword [ebp + 8], 0
jne 0x4ff32c
push 0
push 0
push 0
push 2
mov ecx, dword [ebp - 0x28]
call fcn.00503136
xor al, al
jmp 0x4ff4b5
mov ecx, dword [ebp - 0x28]
call fcn.004fdba1
mov ecx, dword [ebp - 0x28]
add ecx, 4
call fcn.00501040
mov dword [ebp - 0x14], 0
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_ftell]
add esp, 4
mov dword [ebp - 0x14], eax
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCRT.dll_fseek]
add esp, 0xc
cmp dword [ebp - 0x14], 0
jg 0x4ff395
push 0
push 0
push 0
push 0xc
mov ecx, dword [ebp - 0x28]
call fcn.00503136
xor al, al
jmp 0x4ff4b5
mov eax, dword [ebp - 0x14]
add eax, 1
push eax
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
push 1
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
je 0x4ff3f8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
push 0
push 0
push 0
push 2
mov ecx, dword [ebp - 0x28]
call fcn.00503136
xor al, al
jmp 0x4ff4b5
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov byte [ebp - 0xc], 0xd
mov byte [ebp - 0x18], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x14]
mov byte [ecx], 0
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x4ff476
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0xd
jne 0x4ff458
mov eax, dword [ebp - 8]
mov byte [eax], 0xa
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0xa
jne 0x4ff456
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x4ff474
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dl, byte [ecx]
mov byte [eax], dl
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x4ff415
mov edx, dword [ebp - 8]
mov byte [edx], 0
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x28]
call dword [eax + 8]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [ebp - 0x28]
call fcn.005019b0
and eax, 0xff
neg eax
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret 8
Function at 0x508388
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push str.Application
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5083b5
push 0
push 0
push str.Could_not_register_the_event_source.
call sub.MFC42.DLL_AfxMessageBox
push 0
lea eax, [ebp + 8]
push eax
push 0
push 1
push 0
push 0xff
push 0
push 1
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
jne 0x5083e6
push 0
push 0
push str.Could_not_report_the_event.
call sub.MFC42.DLL_AfxMessageBox
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov esp, ebp
pop ebp
ret 4