joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a98c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffef4
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, 0x1000
mov esi, 0x4e006c
lea edi, [ebp - 0x10c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4e0170
lea edi, [ebp - 0x110c]
mov ecx, 0x400
rep movsd dword es:[edi], dword [esi]
test eax, eax
jne 0x4a9941
lea eax, [ebp - 0x110c]
push eax
push edx
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
jne 0x4a991f
xor eax, eax
jmp 0x4a999e
lea edx, [ebp - 0x10c]
push edx
push 0
push 0x4e1aca
lea ecx, [ebp - 0x110c]
push ecx
call sub.KERNEL32.DLL_GetTempFileNameA
test eax, eax
jne 0x4a995d
xor eax, eax
jmp 0x4a999e
lea edx, [ebp - 0x10c]
push edx
push 0
push 0x4e1ace
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
test eax, eax
jne 0x4a995d
xor eax, eax
jmp 0x4a999e
lea edx, [ebp - 0x10c]
push edx
call fcn.00479a2c
pop ecx
lea ecx, [ebp - 0x10c]
add eax, ecx
lea edx, [ebp - 8]
push edx
push eax
lea eax, [ebp - 0x10c]
push eax
push ebx
call fcn.0040f7c0
add esp, 0x10
mov ecx, dword [ebx]
cmp ecx, dword [ebx + 4]
sete al
and eax, 1
and eax, 0xff
cmp eax, 1
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a9ba4
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x4e1170
lea edi, [ebp - 0x18]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push 0x28
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
je 0x4a9c2a
mov dword [ebp - 0x18], 1
lea eax, [ebp - 0x14]
push eax
push str.SeDebugPrivilege
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
test eax, eax
je 0x4a9c22
mov dword [ebp - 0xc], 2
lea edx, [ebp - 4]
push edx
push 0
push 0x10
lea ecx, [ebp - 0x18]
push ecx
push 0
push dword [ebp - 8]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
call sub.KERNEL32.DLL_GetLastError
test eax, eax
sete bl
and ebx, 1
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ab1f4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4ab205
or eax, 0xffffffff
pop ebx
pop ebp
ret
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
inc eax
jne 0x4ab213
xor eax, eax
pop ebx
pop ebp
ret
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x4ab7d8
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, dword [ebp + 8]
push 8
push 0
lea eax, [ebp - 8]
push eax
call fcn.004798f8
add esp, 0xc
cmp ebx, 0xffffffff
je 0x4ab829
lea edx, [ebp - 8]
push edx
push ebx
call sub.KERNEL32.DLL_GetFileSizeEx
test eax, eax
je 0x4ab80d
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
jmp 0x4ab83b
call sub.KERNEL32.DLL_GetLastError
push eax
push 0x4e4c3c
call fcn.0047c794
add esp, 8
mov eax, 0xffffffff
xor edx, edx
jmp 0x4ab83b
push 0x4e4c60
call fcn.0047c794
pop ecx
mov eax, 0xffffffff
xor edx, edx
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4ab840
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4ab851
or eax, 0xffffffff
pop ebx
pop ebp
ret
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4ab862
or eax, 0xffffffff
pop ebx
pop ebp
ret
test al, 0x10
je 0x4ab86e
mov eax, 1
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x4ab874
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4ab88f
or eax, 0xffffffff
jmp 0x4ab963
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x4ab8a7
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0x4ab8ae
xor eax, eax
jmp 0x4ab963
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
lea esi, [ebp - 0x108]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x108]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00479a2c
pop ecx
mov edi, eax
xor esi, esi
lea ebx, [ebp - 0x108]
cmp edi, esi
jle 0x4ab927
mov al, byte [ebx]
cmp al, 0x2f
je 0x4ab8f8
cmp al, 0x5c
jne 0x4ab921
mov byte [ebp - 1], al
mov byte [ebx], 0
push 0
lea edx, [ebp - 0x108]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
mov cl, byte [ebp - 1]
test eax, eax
mov byte [ebx], cl
jne 0x4ab921
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0x4ab927
inc esi
inc ebx
cmp edi, esi
jg 0x4ab8ee
cmp edi, esi
jne 0x4ab960
mov al, byte [ebp + edi - 0x109]
cmp al, 0x2f
je 0x4ab95c
cmp al, 0x5c
je 0x4ab95c
push 0
lea edx, [ebp - 0x108]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x4ab958
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0x4ab960
xor eax, eax
jmp 0x4ab963
xor eax, eax
jmp 0x4ab963
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ac34c
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push 1
call fcn.004ac894
pop ecx
cmp eax, 1
sete al
and eax, 1
mov dword [0x4e4d04], eax
push esp
push 0x202
call sub.WSOCK32.DLL_WSAStartup
test eax, eax
je 0x4ac387
push str.WSAStartup_failed____n
call fcn.0047c794
pop ecx
or eax, 0xffffffff
jmp 0x4ac38f
inc dword [0x4e4d00]
xor eax, eax
add esp, 0x190
ret

Function at 0x4ac55c
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.WSOCK32.DLL_connect
test eax, eax
jne 0x4ac578
xor eax, eax
jmp 0x4ac57b
or eax, 0xffffffff
pop ebp
ret

Function at 0x4ac580
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov edx, dword [ebp + 0x18]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.WSOCK32.DLL_sendto
cmp eax, 0xffffffff
jne 0x4ac5aa
or edx, 0xffffffff
jmp 0x4ac5b2
add dword [0x4e4d08], eax
mov edx, eax
mov eax, edx
pop ebp
ret

Function at 0x4ac5b8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.DLL_send
cmp eax, 0xffffffff
jne 0x4ac5da
or edx, 0xffffffff
jmp 0x4ac5e2
add dword [0x4e4d08], eax
mov edx, eax
mov eax, edx
pop ebp
ret

Function at 0x4ac5e8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov edx, dword [ebp + 0x18]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.WSOCK32.DLL_recvfrom
cmp eax, 0xffffffff
jne 0x4ac612
or edx, 0xffffffff
jmp 0x4ac61a
add dword [0x4e4d0c], eax
mov edx, eax
mov eax, edx
pop ebp
ret

Function at 0x4ac720
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.DLL_gethostbyname
test eax, eax
jne 0x4ac790
call sub.WSOCK32.DLL_WSAGetLastError
call sub.WSOCK32.DLL_WSAGetLastError
sub eax, 0x2af9
je 0x4ac74c
dec eax
je 0x4ac773
dec eax
je 0x4ac766
dec eax
je 0x4ac759
jmp 0x4ac77e
push str.HOST_NOT_FOUND
call fcn.0047c794
pop ecx
jmp 0x4ac77e
push str.NO_ADDRESS
call fcn.0047c794
pop ecx
jmp 0x4ac77e
push str.NO_RECOVERY
call fcn.0047c794
pop ecx
jmp 0x4ac77e
push str.TRY_AGAIN
call fcn.0047c794
pop ecx
push str.gethostbyname_return_NULL_
call fcn.0047c794
pop ecx
or eax, 0xffffffff
pop ebp
ret
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
pop ebp
ret
Function at 0x4ae014
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
or edi, 0xffffffff
cmp dword [0x4e4e8c], 0
jne 0x4ae036
call fcn.004ad964
or eax, 0xffffffff
jmp 0x4ae0e5
mov edx, dword [0x4e4e90]
push edx
call fcn.004ad4d4
pop ecx
push 0x4eeeac
call fcn.004aca94
pop ecx
test eax, eax
je 0x4ae05f
mov ebx, eax
cmp esi, dword [ebx + 8]
je 0x4ae05f
mov eax, dword [eax]
test eax, eax
jne 0x4ae052
test eax, eax
jne 0x4ae074
mov eax, dword [0x4e4e90]
push eax
call fcn.004ad4fc
pop ecx
or eax, 0xffffffff
jmp 0x4ae0e5
mov ebx, eax
push eax
push 0x4eeeac
call fcn.004ac9f4
add esp, 8
mov eax, dword [0x4e4e90]
push eax
call fcn.004ad4fc
pop ecx
push 0
mov edx, dword [ebx + 0x14]
mov ecx, dword [edx]
push ecx
call sub.KERNEL32.DLL_TerminateThread
test eax, eax
je 0x4ae0ae
mov eax, dword [ebx + 0x14]
mov edx, dword [eax]
push edx
call sub.KERNEL32.DLL_CloseHandle
xor edi, edi
push 0x32
call fcn.004adff4
pop ecx
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x4ae0c4
push eax
call fcn.004acf4c
pop ecx
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x4ae0d2
push eax
call fcn.004acc40
pop ecx
mov edx, dword [ebx + 0x14]
push edx
call fcn.004acc40
pop ecx
push ebx
call fcn.004acc40
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4ae4dc
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4ae4ed
or eax, 0xffffffff
pop ebx
pop ebp
ret
push 0
mov edx, dword [ebx]
push edx
call sub.KERNEL32.DLL_TerminateThread
test eax, eax
je 0x4ae50f
mov ecx, dword [ebx]
push ecx
call sub.KERNEL32.DLL_CloseHandle
push ebx
call fcn.004acc40
pop ecx
xor eax, eax
pop ebx
pop ebp
ret
or eax, 0xffffffff
pop ebx
pop ebp
ret
Function at 0x4afad0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push esi
call fcn.00479a2c
pop ecx
mov edi, eax
lea eax, [ebp - 4]
push eax
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileGloballyOpenPortsList
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x4afb1d
push edi
push esi
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
jne 0x4afb13
mov bl, 1
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x4afb37
call sub.KERNEL32.DLL_GetLastError
push eax
push str.Failed_to_create_key._err_d.
push 0x4e6638
push 3
call fcn.0048c898
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4b0008
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov byte [ebx + 0x12d], al
mov edx, dword [ebx + 0x204]
sub edx, dword [ebx + 0x208]
mov dword [ebx + 0x129], edx
push dword [ebx + 0x125]
push dword [ebx + 0x121]
push dword [ebx + 0x132]
push dword [ebx + 0x12e]
mov cx, word [ebx + 0x10e]
push ecx
call sub.WSOCK32.DLL_htons
movzx eax, ax
push eax
cmp byte [ebp + 0xc], 2
jne 0x4b0065
mov edx, str.Master
jmp 0x4b006a
mov edx, str.Init
push edx
push str._s_BCast__hu__u._03u___u._u_
push 0x4e684f
push 7
call fcn.0048c898
add esp, 0x24
xor esi, esi
mov eax, esi
shl eax, 4
cmp dword [ebx + eax + 0x168], 0
je 0x4b016a
mov edx, esi
shl edx, 4
push esi
lea esi, [ebx + edx + 0x164]
lea edi, [ebp - 0x14]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop esi
mov di, 0x10e5
push edi
call sub.WSOCK32.DLL_htons
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
push 0x40
lea edx, [ebx + 0x120]
push edx
push dword [ebx + 0x160]
call sub.WSOCK32.DLL_sendto
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x40
je 0x4b0154
call fcn.004ae5cc
push eax
push dword [ebp - 4]
mov ecx, esi
shl ecx, 4
mov ax, word [ebx + ecx + 0x166]
push eax
call sub.WSOCK32.DLL_htons
movzx edx, ax
push edx
mov ecx, esi
shl ecx, 4
xor eax, eax
mov al, byte [ebx + ecx + 0x16b]
push eax
mov edx, esi
shl edx, 4
xor ecx, ecx
mov cl, byte [ebx + edx + 0x16a]
push ecx
mov eax, esi
shl eax, 4
xor edx, edx
mov dl, byte [ebx + eax + 0x169]
push edx
mov ecx, esi
shl ecx, 4
xor eax, eax
mov al, byte [ebx + ecx + 0x168]
push eax
movzx edx, di
push edx
push esi
push str._d__hu:It_will_not_be_block_____bcast:_d._d._d._d:_hu__ret_d__err_d._n
push 0x4e687f
push 3
call fcn.0048c898
add esp, 0x30
inc edi
cmp di, 0x10e9
jbe 0x4b00b0
inc esi
cmp esi, 0xa
jl 0x4b0081
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b09c8
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff8d0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x118]
mov eax, dword [0x4e5bc0]
mov dword [ebp - 8], eax
mov eax, dword [0x4e5bc4]
mov dword [ebp - 4], eax
mov edx, dword [0x4e5bc8]
mov dword [ebp - 0x10], edx
mov edx, dword [0x4e5bcc]
mov dword [ebp - 0xc], edx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
push esi
mov esi, 0x4e5bd0
lea edi, [ebp - 0x730]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop esi
xor eax, eax
mov dword [esi], eax
xor eax, eax
jmp 0x4b0a2f
mov edx, dword [esi + eax*4 + 4]
cmp edx, dword [ebx + 0x160]
je 0x4b0a33
inc eax
cmp eax, dword [esi]
jb 0x4b0a22
cmp eax, dword [esi]
jne 0x4b0a48
cmp dword [esi], 0x40
jae 0x4b0a48
mov ecx, dword [ebx + 0x160]
mov dword [esi + eax*4 + 4], ecx
inc dword [esi]
mov dword [ebp - 8], 1
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4b0b35
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
push esi
lea edi, [ebp - 0x21c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
lea edi, [ebp - 0x320]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x320]
push edx
push 0
lea ecx, [ebp - 0x21c]
push ecx
mov eax, dword [ebx + 0x160]
inc eax
push eax
call sub.WSOCK32.DLL_select
cmp eax, 1
jl 0x4b0b1e
lea edx, [ebp - 0x320]
push edx
push dword [ebx + 0x160]
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
je 0x4b0ad5
push str.FD_ERROR__need_REBUILD____
push 0x4e6b22
push 3
call fcn.0048c898
add esp, 0xc
jmp 0x4b0b35
mov dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x330]
push eax
push 0
push 0x400
lea edx, [ebp - 0x730]
push edx
push dword [ebx + 0x160]
call sub.WSOCK32.DLL_recvfrom
test eax, eax
jle 0x4b0b35
lea ecx, [ebp - 0x330]
push ecx
push eax
lea eax, [ebp - 0x730]
push eax
push ebx
call fcn.004afcd8
add esp, 0x10
jmp 0x4b0b35
inc eax
jne 0x4b0b35
push str.Select_return__1_______._n
push 0x4e6b44
push 3
call fcn.0048c898
add esp, 0xc
cmp byte [ebx + 1], 0
je 0x4b0a59
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b1ea4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call sub.KERNEL32.DLL_AllocConsole
mov eax, dword [0x4e9ea0]
add eax, 0x18
push eax
push 0x4e6ef6
push 0x4e6eee
call fcn.0047bde0
add esp, 0xc
mov edx, dword [0x4e9ea0]
add edx, 0x30
push edx
push 0x4e6f00
push str.CONOUT_
call fcn.0047bde0
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x4b1e10
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
pop ecx
pop ebp
ret
Function at 0x4b1f78
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe44
push ebx
push esi
push edi
mov eax, 0x4e7724
call fcn.00479eb8
lea edx, [ebp - 0x1bc]
push edx
push 2
call sub.WSOCK32.DLL_WSAStartup
mov word [ebp - 0x1c], 8
push 0x4af30c
call sub.KERNEL32.DLL_SetUnhandledExceptionFilter
call fcn.004b1f00
mov ebx, 4
mov word [ebp - 0x1c], 8
mov esi, 1
xor edi, edi
push str.c:loglevel.log
call fcn.004ab1f4
pop ecx
test eax, eax
jle 0x4b1fe6
mov ebx, 9
mov esi, 1
mov edi, 1
call fcn.004b1ea4
push edi
push ebx
push esi
call fcn.0048c40c
add esp, 0xc
push 0x320
call fcn.00477a88
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4b201d
mov word [ebp - 0x1c], 0x20
push dword [ebp - 4]
call fcn.004af398
pop ecx
mov word [ebp - 0x1c], 0x14
mov edx, dword [ebp - 4]
jmp 0x4b2020
mov edx, dword [ebp - 4]
mov dword [0x4eeec8], edx
test edx, edx
jne 0x4b204f
push str.Failed_to_new_CGuest.
push 0x4e6f3b
push 3
call fcn.0048c898
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0x2c]
mov dword fs:[0], ecx
jmp 0x4b214a
push 0x1f4
call fcn.004ae8b8
pop ecx
push dword [0x4eeec8]
call fcn.004af59c
pop ecx
test al, al
jne 0x4b20be
push str.Failed_to_Create_CGuest._n
push 0x4e6f58
push 3
call fcn.0048c898
add esp, 0xc
mov eax, dword [0x4eeec8]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b20a5
mov word [ebp - 0x1c], 0x38
push 3
push dword [ebp - 8]
call fcn.004af4b8
add esp, 8
mov word [ebp - 0x1c], 0x2c
xor edx, edx
mov dword [0x4eeec8], edx
xor eax, eax
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
jmp 0x4b214a
push 0
push str.TimerFn
push dword [0x4eeec8]
push 0x4b1d84
push 0xffffffffffffffff
push 0x1f4
call fcn.004aecd0
add esp, 0x18
mov dword [0x4eeecc], eax
push str.12:41:39
push str.Nov_25_2011
push str.GameAd_start__Build__s:_s
push 0x4e6f81
push 5
call fcn.0048c898
add esp, 0x14
push dword [0x4eeec8]
call fcn.004b0b48
pop ecx
push 0
call sub.KERNEL32.DLL_ExitProcess
mov word [ebp - 0x1c], 0
jmp 0x4b213e
mov al, 1
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b2f80
Capabilities:
Copy file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
push edi
mov esi, 0x4e7860
lea edi, [ebp - 0x400]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0
push 0x10
push 0x400
lea eax, [ebp - 0x400]
push eax
push esi
push 0
call sub.URLMON.DLL_URLDownloadToCacheFileA
mov ebx, eax
test ebx, ebx
je 0x4b2fe6
call sub.KERNEL32.DLL_GetLastError
push eax
push ebx
push esi
push str.Failed_to_down_cache__s__ret_err_d__last_err_u._n
push 0x4e7fbc
push 4
call fcn.0048c898
add esp, 0x18
xor eax, eax
jmp 0x4b3024
push 0
push edi
lea edx, [ebp - 0x400]
push edx
call sub.KERNEL32.DLL_CopyFileA
mov ebx, eax
test ebx, ebx
jne 0x4b301d
call sub.KERNEL32.DLL_GetLastError
push eax
push edi
lea eax, [ebp - 0x400]
push eax
push str.Failed_to_copy__s___s._last_err_u._n
push 0x4e7ff9
push 4
call fcn.0048c898
add esp, 0x18
dec ebx
sete al
and eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b6374
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
lea eax, [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
push 0x1000
lea ecx, [ebp - 0x1000]
push ecx
call fcn.0047d4c0
add esp, 0x10
lea eax, [ebp - 0x1000]
push eax
call sub.KERNEL32.DLL_OutputDebugStringA
mov esp, ebp
pop ebp
ret
Function at 0x401430
Capabilities:
Get file version info
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, dword [0x41501c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
mov edi, edx
mov dword [ebp - 0x64], edi
je 0x40161c
cmp word [esi], 0
je 0x40161c
test edi, edi
je 0x40161c
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push esi
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x5c], eax
je 0x40161c
push 0
push esi
mov dword [ebp - 0x54], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x401519
push ebx
call fcn.0040c916
add esp, 4
push eax
push ebx
xor ebx, ebx
push ebx
push esi
mov dword [ebp - 0x58], eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40150d
mov edx, dword [ebp - 0x58]
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x60]
push ecx
push 0x40f594
push edx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x50], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40150d
mov eax, dword [ebp - 0x60]
movzx ecx, word [eax + 0xc]
movzx edx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
push edx
movzx edx, word [eax + 0xa]
push ecx
push edx
push 0x40f598
push 0x78
push edi
call dword [sym.imp.MSVCR80.dll__snwprintf]
add esp, 0x1c
mov dword [ebp - 0x54], 1
mov eax, dword [ebp - 0x58]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
mov eax, edi
mov word [edi + 0xee], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401527
mov esi, dword [ebp - 0x5c]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [ebp - 0x4c]
push ecx
sub eax, edx
push 0x40
lea edx, [ebp - 0x48]
push edx
sar eax, 1
push esi
mov ebx, eax
call edi
test eax, eax
je 0x401601
cmp dword [ebp - 0x4c], 0x40
jne 0x401601
mov eax, dword [ebp - 0xc]
push 0
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x4c]
push ecx
push 0xf8
lea edx, [ebp - 0x180]
push edx
push esi
call edi
test eax, eax
je 0x401601
cmp dword [ebp - 0x4c], 0xf8
jne 0x401601
cmp ebx, 0x78
jae 0x401601
mov eax, dword [ebp - 0x178]
lea ecx, [ebp - 0x50]
push ecx
mov dword [ebp - 0x50], eax
call dword [sym.imp.MSVCR80.dll__gmtime32]
mov esi, eax
mov ecx, 9
lea edi, [ebp - 0x88]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x80]
push edx
mov edx, dword [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0x78]
push ecx
mov ecx, dword [ebp - 0x74]
push edx
add eax, 1
push eax
mov eax, dword [ebp - 0x64]
add ecx, 0x76c
push ecx
mov edx, 0x78
push str.__04d__02d__02d__02d:_02d:_02d_GMT
sub edx, ebx
push edx
lea ecx, [eax + ebx*2]
push ecx
call dword [sym.imp.MSVCR80.dll__snwprintf]
mov esi, dword [ebp - 0x5c]
add esp, 0x28
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x54]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040c926
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0040c926
mov esp, ebp
pop ebp
ret
Function at 0x401c70
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1078
call fcn.0040d2b0
mov eax, dword [0x41501c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x5c
mov esi, ecx
mov dword [ebp - 0x1018], eax
xor eax, eax
lea ecx, [ebp - 0x1078]
push ebx
push ecx
mov dword [ebp - 0x101c], ebx
mov byte [ebp - 0x14], bl
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
call sub.MSVCR80.dll_memset
push 0x410464
push esi
mov dword [ebp - 0x1078], 0x67452301
mov dword [ebp - 0x1074], 0xefcdab89
mov dword [ebp - 0x1070], 0x98badcfe
mov dword [ebp - 0x106c], 0x10325476
mov dword [ebp - 0x1068], ebx
mov dword [ebp - 0x1064], ebx
mov dword [ebp - 0x1020], ebx
call dword [sym.imp.MSVCR80.dll__wfopen]
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x401d65
mov edi, dword [sym.imp.MSVCR80.dll_fread]
push esi
push 0x1000
lea edx, [ebp - 0x1014]
push 1
push edx
call edi
add esp, 0x10
cmp eax, ebx
je 0x401d5b
mov edi, edi
push eax
lea eax, [ebp - 0x1078]
push eax
lea eax, [ebp - 0x1014]
call fcn.0040c470
push esi
push 0x1000
lea ecx, [ebp - 0x1014]
push 1
push ecx
call edi
add esp, 0x18
cmp eax, ebx
jne 0x401d30
push esi
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
lea edx, [ebp - 0x14]
push edx
lea esi, [ebp - 0x1078]
call fcn.0040c740
mov eax, dword [ebp - 0x1018]
push ebx
push eax
mov ebx, 0x10
lea edi, [ebp - 0x14]
call fcn.00401bb0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1018]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c926
mov esp, ebp
pop ebp
ret