joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458ad0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp eax, 0xfffffffa
mov dword [ebp - 0x10], ebx
mov ebx, ecx
lea ecx, [eax + 5]
jg 0x458ae5
mov ecx, eax
mov dword [ebp - 4], eax
mov eax, 0xfb93e673
mov dword [ebp - 8], esi
mov esi, edx
mul ecx
shr edx, 9
mov dword [ebp - 0xc], edi
imul edi, edx, 0x209
sub ecx, edi
mov edi, dword [0x4bed00]
cmp edi, 2
lea eax, [ecx + 0x69]
mov dword [esi], eax
jge 0x458b41
lea ecx, [ecx*4 + 0x1a4]
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [edx + 0x4c7784]
test ecx, ecx
jne 0x458bca
mov dword [edx + 0x4c7784], 1
mov eax, dword [esi]
jmp 0x458bca
lea eax, [ecx*4 + 0x1a4]
lea edx, [eax*8]
sub edx, eax
lea ecx, [edx + 0x4c7784]
push ecx
call fcn.0046add0
add esp, 4
test eax, eax
jne 0x458bc2
mov edx, dword [esi]
lea eax, [edx*4]
shl edx, 5
sub edx, eax
cmp dword [edx + 0x4c7780], 0
je 0x458c3a
mov dword [edx + 0x4c7784], 0
mov edx, dword [esi]
push 0xffffffffffffffff
lea eax, [edx*4]
shl edx, 5
sub edx, eax
push dword [edx + 0x4c7780]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi]
lea eax, [edx*4]
shl edx, 5
sub edx, eax
lea ecx, [edx + 0x4c7784]
push ecx
call fcn.0046add0
add esp, 4
mov edi, dword [0x4bed00]
mov eax, dword [esi]
cmp edi, 1
je 0x458c1b
mov edx, dword [ebp + 0x14]
lea ecx, [eax*4]
shl eax, 5
sub eax, ecx
mov ecx, dword [eax + 0x4c7798]
xor eax, eax
mov dword [ebx], ecx
test ecx, ecx
je 0x458c13
mov esi, dword [ebp - 4]
cmp esi, dword [ecx + 0x100]
jbe 0x458c02
mov eax, ecx
mov ecx, dword [ecx + 0x28]
test ecx, ecx
mov dword [ebx], ecx
jne 0x458bef
mov dword [edx], eax
xor eax, eax
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
mov dword [edx], 0
jmp 0x458c04
lea edx, [eax*4]
shl eax, 5
sub eax, edx
lea eax, [eax + 0x4c7790]
push eax
call fcn.0046ad80
add esp, 4
mov eax, dword [esi]
jmp 0x458bcf
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [esi]
lea edx, [ecx*4]
shl ecx, 5
sub ecx, edx
mov dword [ecx + 0x4c7780], eax
mov dword [ecx + 0x4c7784], 0
jmp 0x458b89
Function at 0x466bec
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], esi
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], edi
mov edx, eax
mov dword [ecx], 0
cmp dword [0x4d15a0], 0
je 0x466cc1
cmp dword [ebp + 0x20], 2
je 0x466c23
cmp dword [ebp + 0x20], 1
jne 0x466c32
mov eax, 0xffffffff
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
je 0x466c42
cmp dword [ebp + 0x20], 0xfffffffa
je 0x466d86
cmp dword [ebp + 0x20], 0
je 0x466d92
xor ecx, ecx
cmp dword [ebp + 0x18], 0
je 0x466c75
cmp dword [ebp + 0x1c], 0
je 0x466c75
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
call fcn.004a62d0
push edi
call fcn.004a62f0
mov edx, dword [ebp - 0x10]
add esp, 8
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x466cc1
push edi
push esi
push ebx
call fcn.004a62d0
add esp, 0xc
mov esi, eax
mov eax, dword [ebp + 0x14]
cmp esi, 0xffffffff
mov dword [eax], esi
je 0x466db6
push 0
push edi
push 2
push 0x4b3050
call fcn.004a62d0
add esp, 0x10
mov edx, dword [ebp + 0x14]
mov eax, 1
mov byte [esi + ebx], 0xa
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
inc dword [edx]
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], edx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x24]
test ecx, ecx
mov edx, dword [ebp - 0x10]
mov dword [edi], 0
je 0x466ce9
mov edi, dword [ecx + 0x140]
test edi, edi
jne 0x466cee
mov edi, 0x20000
cmp esi, edi
jbe 0x466d62
cmp dword [ebp + 0x20], 0
je 0x466d62
test ecx, ecx
je 0x466d06
mov edi, dword [ecx + 0x140]
test edi, edi
jne 0x466d0b
mov edi, 0x20000
mov dword [ebp - 0x10], edx
push 0
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x466d50
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
add ebx, edx
sub esi, edx
add dword [ecx], edx
cmp dword [ebp + 0x24], 0
je 0x466d45
mov edx, dword [ebp + 0x24]
mov edx, dword [edx + 0x140]
test edx, edx
jne 0x466d4a
mov edx, 0x20000
cmp esi, edx
ja 0x466d50
mov edi, esi
test esi, esi
je 0x466d79
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x18]
jne 0x466d79
test eax, eax
jne 0x466d0e
jmp 0x466d79
push 0
lea ecx, [ebp - 0x18]
push ecx
push esi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edi, edx
mov ecx, 1
jmp 0x466c54
mov dword [ebp - 0x10], edx
call fcn.004a62f0
mov edx, dword [ebp - 0x10]
mov edi, eax
cmp dword [0x4d15a0], 0
je 0x466c79
mov ecx, 1
jmp 0x466c4e
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x467980
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x46a980
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
mov esi, 1
mov dword [ebp - 0x10], 0
push 1
push 0x4cbc94
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x46aa0c
mov eax, 0x51eb851f
mov ecx, esi
imul esi
sar edx, 5
mov eax, esi
sar ecx, 0x1f
sub edx, ecx
imul edi, edx, 0x64
sub eax, edi
jne 0x46aa0c
cmp esi, 0x15f90
jl 0x46aa03
cmp esi, 0x1d4c0
jge 0x46a9e0
mov eax, 0x32
jmp 0x46aa05
cmp esi, 0x2bf20
jge 0x46a9ef
mov eax, 0x64
jmp 0x46aa05
mov eax, 0x1482
cmp esi, 0x57d78
jl 0x46aa05
mov eax, 0xfa
jmp 0x46aa05
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x46aa20
inc esi
cmp esi, 0x57e40
jl 0x46a998
mov eax, dword [ebp - 4]
test eax, eax
je 0x46aa3a
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.00475400
add esp, 4
mov eax, dword [0x4cbc98]
test eax, eax
jne 0x46aa68
cmp dword [0x4bed00], 1
je 0x46aaa8
xor edi, edi
xor esi, esi
call fcn.0046ab40
mov dword [0x4cbc98], 1
cmp dword [0x4bed00], 1
je 0x46aa93
mov dword [0x4cbc94], 0
push dword [0x4cbc90]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46aac3
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.00492165
push edi
push 0x16
call fcn.00492165
add esp, 0x10
jmp 0x46aa68
push 1
push 2
call fcn.00492165
mov esi, eax
push 1
push 0x16
call fcn.00492165
add esp, 0x10
mov edi, eax
jmp 0x46aa50
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.00457180
add esp, 0xc
test eax, eax
je 0x46aaed
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x4bec5c]
mov dword [eax + edx - 4], ecx
mov esi, dword [edx + 0x4bec58]
mov dword [eax + edx - 8], esi
mov edi, dword [edx + 0x4bec54]
mov dword [eax + edx - 0xc], edi
mov ecx, dword [edx + 0x4bec50]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x46aaf5
push dword [ebp - 0x10]
push dword [0x4cbc90]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x10]
jmp 0x46aa82

Function at 0x46ab40
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4cbc84], 0
je 0x46ab50
mov esp, ebp
pop ebp
ret
mov dword [0x4cbc84], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4cbc90], eax
cmp eax, 0xffffffff
jne 0x46ab76
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esp, ebp
pop ebp
ret
push 0x46a960
call fcn.004906a9
push 0x46a920
call fcn.004906a9
add esp, 8
jmp 0x46ab4c
Function at 0x46ab90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
mov esi, 1
mov dword [ebp - 0x10], 0
push 1
push 0x4cbc94
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x46ac1c
mov eax, 0x51eb851f
mov ecx, esi
imul esi
sar edx, 5
mov eax, esi
sar ecx, 0x1f
sub edx, ecx
imul edi, edx, 0x64
sub eax, edi
jne 0x46ac1c
cmp esi, 0x15f90
jl 0x46ac13
cmp esi, 0x1d4c0
jge 0x46abf0
mov eax, 0x32
jmp 0x46ac15
cmp esi, 0x2bf20
jge 0x46abff
mov eax, 0x64
jmp 0x46ac15
mov eax, 0x1482
cmp esi, 0x57d78
jl 0x46ac15
mov eax, 0xfa
jmp 0x46ac15
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x46ac30
inc esi
cmp esi, 0x57e40
jl 0x46aba8
mov eax, dword [ebp - 4]
test eax, eax
je 0x46ac4a
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.00475400
add esp, 4
mov eax, dword [0x4cbc98]
test eax, eax
jne 0x46ac78
cmp dword [0x4bed00], 1
je 0x46acc6
xor edi, edi
xor esi, esi
call fcn.0046ab40
mov dword [0x4cbc98], 1
cmp dword [0x4bed00], 1
je 0x46acb1
mov dword [0x4cbc94], 0
push dword [0x4cbc90]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x46ad01
mov eax, dword [ebp + 8]
mov dword [eax], esi
cmp dword [0x4bed00], 1
je 0x46ace4
xor eax, eax
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.00492165
push edi
push 0x16
call fcn.00492165
add esp, 0x10
jmp 0x46ac78
push 1
push 2
call fcn.00492165
mov esi, eax
push 1
push 0x16
call fcn.00492165
add esp, 0x10
mov edi, eax
jmp 0x46ac60
push 1
push 2
call fcn.00492165
push 1
push 0x16
mov dword [esi + 0x64], eax
call fcn.00492165
add esp, 0x10
mov dword [esi + 0x68], eax
jmp 0x46aca5
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.00457180
add esp, 0xc
test eax, eax
je 0x46ad28
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x4bec5c]
mov dword [eax + edx - 4], ecx
mov esi, dword [edx + 0x4bec58]
mov dword [eax + edx - 8], esi
mov edi, dword [edx + 0x4bec54]
mov dword [eax + edx - 0xc], edi
mov ecx, dword [edx + 0x4bec50]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x46ad30
push dword [ebp - 0x10]
push dword [0x4cbc90]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [ebp - 0x10]
jmp 0x46ac97
Function at 0x46bec0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x7c]
test esi, esi
mov dword [ebp - 0xc], edi
je 0x46c07c
mov edx, dword [0x4bed00]
mov edi, dword [esi + 0x14]
lea eax, [edi*4]
shl edi, 5
sub edi, eax
cmp edx, 2
lea ebx, [edi + 0x4cbcc8]
jge 0x46bf0f
mov eax, dword [ebx]
test eax, eax
jne 0x46bf50
mov dword [edi + 0x4cbcc8], 1
jmp 0x46bf50
push ebx
call fcn.0046add0
add esp, 4
test eax, eax
jne 0x46bf4a
cmp dword [edi + 0x4cbcc4], 0
je 0x46c05c
mov dword [edi + 0x4cbcc8], 0
push 0xffffffffffffffff
push dword [edi + 0x4cbcc4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call fcn.0046add0
add esp, 4
mov edx, dword [0x4bed00]
cmp edx, 1
je 0x46c048
mov eax, dword [esi + 0x18]
dec eax
mov dword [esi + 0x18], eax
test eax, eax
jle 0x46bfbf
mov eax, dword [0x4bed00]
cmp eax, 1
je 0x46bfa4
cmp eax, 2
jge 0x46bf7f
mov dword [edi + 0x4cbcc8], 0
jmp 0x46bf95
mov dword [edi + 0x4cbcc8], 0
push dword [edi + 0x4cbcc4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push dword [edi + 0x4cbcd8]
push dword [edi + 0x4cbcd4]
call fcn.0046adb0
add esp, 8
mov eax, dword [0x4bed00]
jmp 0x46bf6e
mov edx, dword [esi]
test edx, edx
je 0x46bfcb
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x46bfd6
mov dword [eax], edx
jmp 0x46bfdc
mov dword [edi + 0x4cbcc0], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x7c], 0
mov eax, dword [0x4bed00]
cmp eax, 1
je 0x46c02d
cmp eax, 2
jge 0x46c001
mov dword [edi + 0x4cbcc8], 0
jmp 0x46c017
mov dword [edi + 0x4cbcc8], 0
push dword [edi + 0x4cbcc4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 8]
call fcn.00457240
push esi
call fcn.00457240
add esp, 8
jmp 0x46bf95
push dword [edi + 0x4cbcd8]
push dword [edi + 0x4cbcd4]
call fcn.0046adb0
add esp, 8
mov eax, dword [0x4bed00]
jmp 0x46bff0
lea eax, [edi + 0x4cbcd4]
push eax
call fcn.0046ad80
add esp, 4
jmp 0x46bf59
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 0x4cbcc4], eax
mov dword [edi + 0x4cbcc8], 0
jmp 0x46bf33
xor eax, eax
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x48d410
Capabilities:
Delete file

Disassembly:
push esi
push edi
push ebx
push dword [esp + 0x18]
push dword [esp + 0x14]
call fcn.0048dc50
add esp, 8
mov edi, eax
test edi, edi
je 0x48d4d4
push dword [esp + 0x1c]
push dword [esp + 0x18]
call fcn.0048dc50
add esp, 8
mov esi, eax
test esi, esi
je 0x48d4ab
push esi
push edi
call fcn.004927c8
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x48d48c
push edi
call fcn.0048dce0
push esi
call fcn.0048dce0
add esp, 8
test ebx, ebx
jne 0x48d46c
xor eax, eax
pop ebx
pop edi
pop esi
ret
call fcn.00490cca
xor edx, edx
push edx
push edx
push edx
push dword [eax]
push edx
call fcn.004a63e0
add esp, 0x14
call fcn.00490cca
mov eax, dword [eax]
pop ebx
pop edi
pop esi
ret
call fcn.00490cca
cmp dword [eax], 0x11
jne 0x48d453
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
push edi
call fcn.004927c8
add esp, 8
mov ebx, eax
jmp 0x48d453
push edi
call fcn.0048dce0
add esp, 4
call fcn.00490cca
xor edx, edx
push edx
push edx
push edx
push dword [eax]
push edx
call fcn.004a63e0
add esp, 0x14
call fcn.00490cca
mov eax, dword [eax]
pop ebx
pop edi
pop esi
ret
call fcn.00490cca
xor edx, edx
push edx
push edx
push edx
push dword [eax]
push edx
call fcn.004a63e0
add esp, 0x14
call fcn.00490cca
mov eax, dword [eax]
pop ebx
pop edi
pop esi
ret
Function at 0x48da50
Capabilities:
Get disk size

Disassembly:
push esi
push edi
push ebx
push ebp
sub esp, 0x14
mov eax, 0xffffffff
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x28]
mov dword [esi], eax
mov dword [edx], eax
movsx eax, byte [ebx]
cmp eax, 0x20
mov byte [esp + 0x11], 0x3a
mov byte [esp + 0x12], 0x5c
mov byte [esp + 0x13], 0
je 0x48dbff
push eax
call fcn.0048ee83
movsx ecx, al
add esp, 4
lea edx, [ecx - 0x41]
cmp edx, 0x19
ja 0x48dbb1
mov byte [esp + 0x10], al
lea ebx, [esp + 0x10]
lea eax, [esp + 0xc]
lea ebp, [esp]
lea ecx, [esp + 4]
lea edx, [esp + 8]
push eax
push edx
push ecx
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov ebp, eax
test ebx, ebx
je 0x48dad8
lea eax, [esp + 0x10]
cmp ebx, eax
je 0x48dad8
push ebx
call fcn.0049054c
add esp, 4
test ebp, ebp
je 0x48db8c
mov eax, dword [esp]
mul dword [esp + 4]
mov ebx, edx
mov ebp, eax
push ebx
push ebp
push 0
push dword [esp + 0x18]
call fcn.0048f310
mov edi, Ordinal_1
mov ecx, eax
sub ecx, edi
mov edi, 0
sbb edx, edi
jl 0x48db0e
or ecx, edx
jne 0x48db69
mov dword [esi], eax
push ebx
push ebp
xor esi, esi
push esi
push dword [esp + 0x14]
call fcn.0048f310
mov ebx, eax
mov ecx, Ordinal_1
sub ebx, ecx
sbb edx, esi
jl 0x48db2f
or ebx, edx
jne 0x48db42
mov edx, dword [esp + 0x30]
mov dword [edx], eax
mov eax, 1
add esp, 0x14
pop ebp
pop ebx
pop edi
pop esi
ret
mov eax, dword [esp + 0x30]
mov dword [eax], 0xffffffff
call fcn.00490cca
mov ebx, 0x22
mov dword [eax], ebx
xor eax, eax
push eax
push eax
push eax
push ebx
push eax
call fcn.004a63e0
add esp, 0x14
jmp 0x48db35
mov dword [esi], 0xffffffff
call fcn.00490cca
mov esi, 0x22
mov dword [eax], esi
xor eax, eax
push eax
push eax
push eax
push esi
push eax
call fcn.004a63e0
add esp, 0x14
jmp 0x48db10
call fcn.00490cca
mov ebx, 2
mov dword [eax], ebx
xor eax, eax
push eax
push eax
push eax
push ebx
push eax
call fcn.004a63e0
add esp, 0x14
xor eax, eax
add esp, 0x14
pop ebp
pop ebx
pop edi
pop esi
ret
mov byte [esp + 0x10], 0x20
cmp ecx, 0x5c
je 0x48dbc0
cmp ecx, 0x2f
jne 0x48dbdd
cmp cl, byte [ebx + 1]
jne 0x48dbdd
push dword [esp + 0x34]
push ebx
call fcn.0048dc50
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x48dba7
jmp 0x48daa7
call fcn.00490cca
mov edx, 0x16
mov dword [eax], edx
xor eax, eax
push eax
push eax
push eax
push edx
push eax
call fcn.004a63e0
xor eax, eax
add esp, 0x28
pop ebp
pop ebx
pop edi
pop esi
ret
mov byte [esp + 0x10], 0x20
xor ebx, ebx
jmp 0x48daa7

Function at 0x497fa2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4bfd00]
jne 0x497fac
repz ret
jmp fcn.0049e64d
Function at 0x49bb18
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bfd00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004949b4
and dword [ebp - 0x14], 0
cmp dword [0x4d0b1c], 0
mov dword [ebp - 0x18], eax
jne 0x49bbcb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x49bc73
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x49bc73
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4d0b1c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4d0b20], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4d0b24], eax
call edi
push eax
call esi
mov dword [0x4d0b2c], eax
test eax, eax
je 0x49bbcb
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4d0b28], eax
mov eax, dword [0x4d0b28]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x49bc24
cmp dword [0x4d0b2c], ecx
je 0x49bc24
push eax
call esi
push dword [0x4d0b2c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x49bc24
test ebx, ebx
je 0x49bc24
call edi
test eax, eax
je 0x49bc1b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x49bc1b
test byte [ebp - 8], 1
jne 0x49bc24
or dword [ebp + 0x10], 0x200000
jmp 0x49bc57
mov eax, dword [0x4d0b20]
cmp eax, dword [ebp - 0x18]
je 0x49bc57
push eax
call esi
test eax, eax
je 0x49bc57
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x49bc57
mov eax, dword [0x4d0b24]
cmp eax, dword [ebp - 0x18]
je 0x49bc57
push eax
call esi
test eax, eax
je 0x49bc57
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4d0b1c]
call esi
test eax, eax
je 0x49bc73
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x49bc75
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00497fa2
leave
ret

Function at 0x4a2801
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4a2828
call fcn.00490cdd
mov dword [eax], esi
call fcn.00490cca
push 0x16
pop esi
mov dword [eax], esi
call fcn.00495377
mov eax, esi
jmp 0x4a287d
test dword [ebp + 0xc], 0xfffffff9
jne 0x4a280e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4a2855
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00490cf0
pop ecx
call fcn.00490cca
mov eax, dword [eax]
jmp 0x4a287d
test al, 0x10
jne 0x4a287b
test al, 1
je 0x4a287b
test byte [ebp + 0xc], 2
je 0x4a287b
call fcn.00490cdd
mov dword [eax], 5
call fcn.00490cca
mov dword [eax], 0xd
jmp 0x4a284c
xor eax, eax
pop esi
pop ebp
ret
Function at 0x5f38a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5f38bb
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124b8ae0]
pop edx
test eax, eax
je 0x5f398d
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5f397c
test dword [ebp - 0x2a8], 1
jne 0x5f397c
and dword [ebp - 0x2a8], 0x100
jne 0x5f397c
push esi
push edx
push 4
push esi
call dword [edx + 0x122d2bc8]
pop edx
pop esi
test eax, eax
je 0x5f391f
jmp 0x5f397c
cmp word [esi], 0x5a4d
jne 0x5f397c
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5f397c
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d2de8]
pop edx
test eax, eax
je 0x5f397c
lea eax, [ebp - 0x28c]
push eax
call fcn.005f37fc
test eax, eax
jne 0x5f3975
jmp 0x5f397c
mov eax, esi
jmp 0x5f398d
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5f38bb
pop esi
leave
ret 4
Function at 0x4025f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
push 0x422944
push 0x422954
call fcn.00402b80
add esp, 8
mov eax, dword [ebp + 0x14]
add eax, 4
push eax
call fcn.0040c5b5
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40266e
mov ecx, dword [ebp + 0x14]
add ecx, 4
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00401040
add esp, 8
mov eax, dword [ebp - 8]
mov cx, word [ebp + 0xc]
mov word [eax], cx
mov edx, dword [ebp - 8]
movzx eax, word [edx]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp - 8]
mov word [ecx], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 2]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp - 8]
mov word [ecx + 2], ax
jmp 0x402691
push 0x422960
push str.__s__Error__Allocate_memory_error
call fcn.00402b80
add esp, 8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x402719
push 0
mov eax, dword [ebp + 0x14]
add eax, 4
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4026da
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x422994
push str.__s__Error__send_data_packet_error:__ld_0x_X
call fcn.00402b80
add esp, 0x10
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x4026ec
push 0x4229d4
push str.__s__send_data_packet_ok
call fcn.00402b80
add esp, 8
cmp dword [ebp - 8], 0
je 0x4026fe
mov edx, dword [ebp - 8]
push edx
call fcn.0040c3a6
add esp, 4
push str.SendDataPacket
push 0x422a10
call fcn.00402b80
add esp, 8
xor eax, eax
cmp dword [ebp - 4], 0xffffffff
setne al
mov esp, ebp
pop ebp
ret