joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fb1de
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
call fcn.004b88a0
lea ebx, [esi + 0x28]
xor edi, edi
mov ecx, ebx
mov dword [esp + 0x20], edi
mov dword [esi + 0x24], 0x4fdbc0
call fcn.004e2200
lea ebp, [esi + 0x30]
mov byte [esp + 0x20], 1
mov ecx, ebp
call fcn.004c2760
push edi
lea ecx, [esi + 0x54]
mov byte [esp + 0x24], 2
call fcn.004992c0
mov al, byte [esp + 0x13]
lea edx, [esi + 0x44]
mov byte [esi + 0xa0], al
or eax, 0xffffffff
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
xor ecx, ecx
mov dword [esi], 0x500cb4
mov dword [esi + 0x24], 0x500ca4
mov dword [ebx], 0x500c78
mov dword [ebp], 0x500c70
mov dword [esi + 0xb0], eax
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [edx], ecx
mov eax, esi
pop edi
pop esi
mov dword [edx + 4], ecx
pop ebp
pop ebx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4c4940
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
cmp eax, 0x3fe
push edi
mov ebx, ecx
jne 0x4c4a2d
lea esi, [ebx + 0x20]
mov ecx, 0x82
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x18]
push 0x104
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call fcn.00478650
mov ecx, dword [ebx + 0x14]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 4
push 0
push 0
push 0xf0
push 0x406
push ecx
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, dword [sym.imp.MSVCRT.dll_wcslen]
cmp eax, 1
je 0x4c49c5
push esi
call ebp
mov edx, dword [ebx + 0x14]
add esp, 4
neg eax
sbb eax, eax
neg eax
push eax
push 1
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebx + 0x14]
push 0x3ff
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4c4a80
lea ecx, [ebx + 0x228]
push ecx
call ebp
add esp, 4
test eax, eax
je 0x4c4a14
push esi
call ebp
add esp, 4
test eax, eax
je 0x4c4a14
mov edx, dword [ebx + 0x14]
mov eax, 1
push eax
push eax
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov edx, dword [ebx + 0x14]
xor eax, eax
push eax
push 1
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop esi
pop ebp
pop ebx
ret 8
cmp eax, 0x3ff
jne 0x4c4a80
lea esi, [ebx + 0x228]
mov ecx, 0x412
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x18]
push 0x824
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call fcn.00478650
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ecx, dword [ebx + 0x14]
add esp, 8
neg eax
sbb eax, eax
neg eax
push eax
push 1
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x4c4ff0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004c5db0
mov ax, word [0x52a480]
mov ecx, 0x81
mov word [esp + 0x10], ax
xor eax, eax
lea edi, [esp + 0x12]
push 0
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x14]
push 0x3fe
stosw word es:[edi], ax
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push ecx
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov edx, dword [esi + 0x14]
push 0
push 0xffffffffffffffff
push edx
call edi
push eax
call ebx
mov eax, dword [esi + 0x14]
push 0
push 0x406
push eax
call edi
push eax
call ebx
mov edx, dword [0x607afc]
mov ebp, dword [sym.imp.USER32.dll_LoadStringW]
lea ecx, [esp + 0x10]
push 0x104
push ecx
push 0xea9a
push edx
call ebp
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [0x607afc]
lea edx, [esp + 0x10]
push 0x104
push edx
push 0xea9b
push eax
call ebp
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0x407
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [esi + 0x14]
push 5
push 0x41d
push eax
call edi
push eax
call ebx
mov edx, dword [0x607afc]
lea ecx, [esp + 0x10]
push 0x104
push ecx
push 0xea6d
push edx
call ebp
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0x10]
push eax
push 0x41d
push ecx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
lea edi, [esi + 0x1270]
push 1
push 0x5aff
push 0xd0721f
mov ecx, edi
call fcn.004487c0
mov edx, dword [esi + 0x14]
push 0x41d
push edx
mov ecx, edi
call fcn.00448cb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x4c5120
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x22c
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [0x608128]
push edi
mov eax, dword [esi + 8]
push eax
call fcn.004d4c70
mov dword [esp + 0x10], eax
mov ax, word [0x52a480]
mov word [esp + 0x34], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x36]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x14]
push 0
stosw word es:[edi], ax
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x406
push ecx
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov eax, dword [0x607afc]
mov ebp, dword [sym.imp.USER32.dll_LoadStringW]
lea edx, [esp + 0x34]
push 0x104
push edx
push 0xea69
push eax
call ebp
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0x34]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [0x607afc]
lea eax, [esp + 0x34]
push 0x104
push eax
push 0xea71
push ecx
call ebp
mov eax, dword [esi + 0x14]
mov ebp, dword [sym.imp.USER32.dll_SetDlgItemTextW]
lea edx, [esp + 0x34]
push edx
push 0x407
push eax
call ebp
mov ecx, dword [esi + 0x14]
push 5
push 0x41d
push ecx
call edi
push eax
call ebx
mov eax, dword [0x607afc]
lea edx, [esp + 0x34]
push 0x104
push edx
push 0xea6d
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0x34]
push ecx
push 0x41d
push edx
call ebp
push 1
push 0x5aff
lea ecx, [esi + 0x1270]
push 0xd0721f
call fcn.004487c0
mov eax, dword [esi + 0x14]
push 0x41d
push eax
lea ecx, [esi + 0x1270]
call fcn.00448cb0
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4c533c
mov ecx, dword [esi + 0x14]
push 5
push 0x408
push ecx
call edi
push eax
call ebx
mov edx, dword [esi + 0x14]
push 5
push 0x3ff
push edx
call edi
push eax
call ebx
mov ecx, dword [esi + 0x14]
lea eax, [esi + 0x228]
push eax
push 0x3ff
push ecx
call ebp
mov eax, dword [esi + 0x14]
lea edx, [esp + 0x24]
push edx
push 0x406
push eax
call edi
mov ebp, dword [sym.imp.USER32.dll_GetWindowRect]
push eax
call ebp
mov edx, dword [esi + 0x14]
mov ebx, dword [sym.imp.USER32.dll_ScreenToClient]
lea ecx, [esp + 0x24]
push ecx
push edx
call ebx
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0x2c]
push eax
push ecx
call ebx
mov edx, dword [esi + 0x14]
push 0x407
push edx
call edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], eax
push ecx
push eax
call ebp
mov eax, dword [esi + 0x14]
lea edx, [esp + 0x14]
push edx
push eax
call ebx
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push edx
call ebx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 5
push 0
add eax, 3
push 0
push eax
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi + 0x14]
push 0x405
push eax
call edi
lea ecx, [esp + 0x14]
mov edi, eax
push ecx
push edi
call ebp
lea edx, [esp + 0x14]
mov eax, dword [esi + 0x14]
push edx
push eax
call ebx
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push edx
call ebx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
push 5
push 0
add eax, 0xfffffffe
push 0
push eax
push ecx
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x22c
ret
Function at 0x4c5350
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x208
mov ax, word [0x52a480]
push esi
mov esi, ecx
push edi
mov word [esp + 8], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x14]
push 0
push 0x406
push ecx
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x607afc]
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
lea edx, [esp + 8]
push 0x104
push edx
push 0xea6d
push eax
call edi
mov edx, dword [esi + 0x14]
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [0x607afc]
lea eax, [esp + 8]
push 0x104
push eax
push 0xea72
push ecx
call edi
mov eax, dword [esi + 0x14]
lea edx, [esp + 8]
push edx
push 0x407
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
pop edi
pop esi
add esp, 0x208
ret
Function at 0x4c53f0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x22c
mov ax, word [0x52a480]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov word [esp + 0x34], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x36]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x14]
push 0
stosw word es:[edi], ax
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x406
push ecx
call edi
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebx
mov eax, dword [0x607afc]
mov ebp, dword [sym.imp.USER32.dll_LoadStringW]
lea edx, [esp + 0x34]
push 0x104
push edx
push 0xeaa0
push eax
call ebp
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0x34]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [0x607afc]
lea eax, [esp + 0x34]
push 0x104
push eax
push 0xea71
push ecx
call ebp
mov eax, dword [esi + 0x14]
lea edx, [esp + 0x34]
push edx
push 0x407
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, dword [esi + 0x14]
push 5
push 0x41d
push ecx
call edi
push eax
call ebx
mov eax, dword [0x607afc]
lea edx, [esp + 0x34]
push 0x104
push edx
push 0xea6d
push eax
call ebp
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0x34]
push ecx
push 0x41d
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
lea ebp, [esi + 0x1270]
push 1
push 0x5aff
push 0xd0721f
mov ecx, ebp
call fcn.004487c0
mov eax, dword [esi + 0x14]
push 0x41d
push eax
mov ecx, ebp
call fcn.00448cb0
mov ecx, dword [esi + 0x14]
push 5
push 0x408
push ecx
call edi
push eax
call ebx
mov edx, dword [esi + 0x14]
push 5
push 0x3ff
push edx
call edi
push eax
call ebx
mov ecx, dword [esi + 0x14]
lea eax, [esi + 0x228]
push eax
push 0x3ff
push ecx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [esi + 0x14]
lea edx, [esp + 0x24]
push edx
push 0x406
push eax
call edi
mov ebp, dword [sym.imp.USER32.dll_GetWindowRect]
push eax
call ebp
mov edx, dword [esi + 0x14]
mov ebx, dword [sym.imp.USER32.dll_ScreenToClient]
lea ecx, [esp + 0x24]
push ecx
push edx
call ebx
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0x2c]
push eax
push ecx
call ebx
mov edx, dword [esi + 0x14]
push 0x407
push edx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], eax
push ecx
push eax
call ebp
mov eax, dword [esi + 0x14]
lea edx, [esp + 0x10]
push edx
push eax
call ebx
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edx
call ebx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
push 5
push 0
add eax, 3
push 0
push eax
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi + 0x14]
push 0x405
push eax
call edi
lea ecx, [esp + 0x10]
mov edi, eax
push ecx
push edi
call ebp
mov eax, dword [esi + 0x14]
lea edx, [esp + 0x10]
push edx
push eax
call ebx
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edx
call ebx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
push 5
push 0
add eax, 0xfffffffe
push 0
push eax
push ecx
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x22c
ret
Function at 0x4c6b60
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.MSVCRT.dll__beginthreadex]
mov eax, dword [esi + 0x1b30]
test eax, eax
jne 0x4c6b93
lea eax, [esi + 0x1b34]
push eax
push 0
push 0
push 0x4cc630
push 0
push 0
call edi
add esp, 0x18
mov dword [esi + 0x1b30], eax
mov eax, dword [esi + 0x1b28]
test eax, eax
jne 0x4c6bbc
lea ecx, [esi + 0x1b2c]
push ecx
push 0
push 0
push 0x4cc6c0
push 0
push 0
call edi
add esp, 0x18
mov dword [esi + 0x1b28], eax
mov eax, dword [esi + 0x1b38]
test eax, eax
jne 0x4c6be4
push str.ParseEvent
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
mov dword [esi + 0x1b38], eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
ret

Function at 0x4c6d10
Capabilities:
Check if file exists

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4fb47b
push eax
mov dword fs:[0], esp
sub esp, 0x4c0
push ebx
mov ebx, dword [esp + 0x4d4]
push ebp
push esi
test ebx, ebx
push edi
mov esi, ecx
je 0x4c6e6e
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
cmp eax, 0x32
jae 0x4c6e6e
mov eax, dword [esp + 0x4e4]
test eax, eax
je 0x4c6e6e
mov al, byte [esi + 4]
test al, al
jne 0x4c6e6e
mov eax, dword [esi + 8]
test eax, eax
jne 0x4c6e6e
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
push ebx
push 0x50f4e4
lea eax, [esi + 0x28]
push 0x31
push eax
call edi
mov ecx, dword [esp + 0x4f4]
add esp, 0x10
lea ebp, [esi + 0x8c]
push ecx
push 0x50f4e4
push 0x31
push ebp
call edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x26]
mov word [esp + 0x24], 0
rep stosd dword es:[edi], eax
add esp, 0x10
lea edx, [esp + 0x14]
mov ecx, esi
push 0x104
push edx
stosw word es:[edi], ax
call fcn.004cda30
lea eax, [esp + 0x10]
mov edi, 2
push eax
mov dword [esp + 0x14], edi
call fcn.004ce5e0
add esp, 4
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x4c6e5b
cmp dword [esp + 0x10], edi
jne 0x4c6e5b
lea ecx, [esp + 0x21c]
call fcn.004ebc10
lea edx, [esp + 0x14]
lea ecx, [esp + 0x21c]
push edx
mov dword [esp + 0x4dc], 0
call fcn.004ec190
push eax
push ebp
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x4c6e89
lea eax, [esp + 0x14]
push 1
push eax
call fcn.004cf160
mov ecx, eax
call fcn.004de510
lea ecx, [esp + 0x21c]
mov dword [esp + 0x4d8], 0xffffffff
call fcn.004ebc90
mov ecx, dword [esp + 0x4e4]
mov dword [esi + 0x1c], edi
push ecx
push ebx
mov ecx, esi
call fcn.004c6bf0
mov ecx, dword [esp + 0x4d0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4cc
ret 8
lea ecx, [esp + 0x21c]
mov dword [esp + 0x4d8], 0xffffffff
call fcn.004ebc90
jmp 0x4c6e6e
Function at 0x4c7810
Capabilities:
Delete file

Disassembly:
mov eax, 0x32e10
call fcn.004ba380
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x18], 3
jne 0x4c7853
cmp dword [esi], 2
je 0x4c7853
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4c7845
push 1
call fcn.004cf160
mov ecx, eax
call fcn.004de910
mov ecx, esi
call fcn.004c66f0
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x32e10
ret 0x10
mov ebx, dword [esp + 0x32e20]
test ebx, ebx
jne 0x4c786c
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x32e10
ret 0x10
mov al, byte [0x66abcc]
test al, 1
jne 0x4c7897
mov dl, al
mov ecx, 0x608130
or dl, 1
mov byte [0x66abcc], dl
call fcn.004159f0
push 0x4c7aa0
call fcn.004ba3e2
add esp, 4
push ebp
push edi
mov ecx, 0x608130
call fcn.00415fb0
mov ecx, 0x608130
call fcn.00416300
mov ecx, 0x608130
call fcn.00415fd0
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
mov ecx, 0x412
xor eax, eax
mov edi, 0x665610
push 0x50f4e4
push 0x824
push 0x665610
rep stosd dword es:[edi], eax
call ebx
add esp, 0x10
add esi, 0xf0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x528430
push esi
call dword [sym.imp.MSVCRT.dll__wfopen]
add esp, 8
test eax, eax
je 0x4c790a
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push esi
mov ecx, 0x82
xor eax, eax
mov edi, 0x665200
push 0x50f4e4
push 0x104
rep stosd dword es:[edi], eax
push 0x665200
call ebx
mov esi, dword [esp + 0x32e34]
mov ebp, dword [esp + 0x32e3c]
add esp, 0x10
mov dword [0x60a594], 1
test esi, esi
mov dword [0x60a7cc], 0x4c7a40
mov dword [0x60a7c8], 0
je 0x4c7a04
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
cmp ebp, 2
mov edx, eax
jne 0x4c79cb
xor eax, eax
mov ecx, 0xcb84
lea edi, [esp + 0x10]
push eax
rep stosd dword es:[edi], eax
push eax
lea eax, [edx + edx*2]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x60a5b4
mov dword [0x60a5b0], ecx
mov ecx, 0x82
mov dword [0x60a5ac], edx
push str.application_x_www_form_urlencoded
rep stosd dword es:[edi], eax
jmp 0x4c79f0
mov eax, dword [esp + 0x32e30]
mov ecx, 0x82
mov dword [0x60a5b0], eax
xor eax, eax
mov edi, 0x60a5b4
mov dword [0x60a5ac], esi
rep stosd dword es:[edi], eax
push str.multipart_form_data__boundary___________________________7d81d4371304a2
push 0x50f4e4
push 0x104
push 0x60a5b4
call ebx
add esp, 0x10
mov ecx, 0x608130
mov dword [0x60a7d4], 0x7530
call fcn.00415f00
pop edi
cmp ebp, 1
pop ebp
jne 0x4c7a29
mov ecx, 0x608130
call fcn.00416300
pop esi
mov eax, 1
pop ebx
add esp, 0x32e10
ret 0x10
Function at 0x4c7be0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb500
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x314
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x117]
mov byte [ebp - 0x118], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x10], esp
lea eax, [esi + 0xf0]
push 0x5284c0
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCRT.dll__wfopen]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4c7dbe
push ebx
lea ecx, [ebp - 0x118]
push 0x104
push ecx
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
test eax, eax
je 0x4c7cfa
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea edx, [ebp - 0x118]
push 0x5284bc
push edx
call edi
test eax, eax
jne 0x4c7d41
mov ecx, 0x81
lea edi, [ebp - 0x31e]
mov dword [esi + 0x24], eax
mov word [ebp - 0x320], ax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esi + 0x28]
lea ecx, [ebp - 0x320]
push eax
push 0x103
push ecx
call fcn.004bac30
add esp, 0xc
lea edx, [ebp - 0x320]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
je 0x4c7d09
lea eax, [ebp - 0x320]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4c7d09
push eax
push str.Create_File_failure_
mov ecx, esi
call fcn.004cc800
mov ecx, esi
mov dword [esi + 0x24], 0xc
call fcn.004c7370
mov ecx, esi
call fcn.004c7520
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
jmp 0x4c7dbe
push 1
call fcn.004ce490
add esp, 4
lea ecx, [ebp - 0x320]
push ecx
mov ecx, esi
call fcn.004c7ae0
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x118]
push str.VERSION_LOW
push edx
call edi
test eax, eax
jne 0x4c7d5c
mov dword [esi + 0x24], 6
jmp 0x4c7d99
lea eax, [ebp - 0x118]
push str.USERNAME_ILLEGA
push eax
call edi
test eax, eax
jne 0x4c7d77
mov dword [esi + 0x24], 9
jmp 0x4c7d99
lea ecx, [ebp - 0x118]
push str.PASSWORD_ILLEGAL
push ecx
call edi
test eax, eax
jne 0x4c7d92
mov dword [esi + 0x24], 0xa
jmp 0x4c7d99
mov dword [esi + 0x24], 0xb
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, esi
push 1
push str.Login_failure_
call fcn.004cc800
jmp 0x4c7dbe
push 0
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 8], 0
call fcn.004cdb00
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
or eax, 0xffffffff
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c7df0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x414
push ebp
push esi
push edi
lea eax, [esp + 0xc]
xor edi, edi
mov esi, ecx
push eax
mov dword [esp + 0x10], edi
call fcn.004ce5e0
mov eax, dword [esp + 0x10]
add esp, 4
cmp eax, 2
jne 0x4c7f8b
push ebx
call fcn.004cf160
mov ecx, eax
call fcn.004de890
mov word [esp + 0x14], di
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push 0x103
push ecx
mov ecx, esi
stosw word es:[edi], ax
call fcn.004cd9d0
lea edx, [esp + 0x14]
mov ebp, 1
push edx
push ebp
call fcn.004ce840
mov ebx, eax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x226]
mov word [esp + 0x224], 0
add esp, 8
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x21c]
push 0x104
push eax
mov ecx, esi
call fcn.004cda30
cmp ebx, ebp
pop ebx
jne 0x4c7f6d
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [esp + 0x10]
push ecx
call edi
cmp eax, ebp
je 0x4c7ec5
lea edx, [esp + 0x10]
push edx
push ebp
call fcn.004ce8f0
lea eax, [esp + 0x18]
push eax
push ebp
call fcn.004ce860
add esp, 0x10
lea ecx, [esp + 0x218]
push ecx
call edi
cmp eax, ebp
je 0x4c7ef2
mov dword [esi + 0x20], ebp
call fcn.004cf160
push ebp
mov ecx, esi
mov dword [eax + 0x14], ebp
call fcn.004cc810
pop edi
pop esi
pop ebp
add esp, 0x414
ret 4
lea edx, [esp + 0x218]
push edx
call fcn.004cf160
mov ecx, eax
call fcn.004de550
test eax, eax
je 0x4c7f14
call fcn.004cf160
cmp dword [eax + 0x14], ebp
je 0x4c7f31
call fcn.004cf160
mov dword [eax + 0x14], ebp
lea eax, [esp + 0x218]
push ebp
push eax
call fcn.004cf160
mov ecx, eax
call fcn.004de510
lea ecx, [esp + 0x10]
push ecx
push 0
call fcn.004ce8d0
add esp, 8
cmp eax, ebp
jne 0x4c7f58
push ebp
mov ecx, esi
call fcn.004cc810
pop edi
pop esi
pop ebp
add esp, 0x414
ret 4
push 0
mov ecx, esi
call fcn.004cc810
pop edi
pop esi
pop ebp
add esp, 0x414
ret 4
call fcn.004cf160
cmp dword [eax + 0x14], ebp
jne 0x4c7f8b
lea edx, [esp + 0x218]
push edx
call fcn.004cf160
mov ecx, eax
call fcn.004d6470
pop edi
pop esi
pop ebp
add esp, 0x414
ret 4