joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f210
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov eax, 0x4a9bdf
call fcn.004a8fb4
push ecx
push ecx
push ebx
push edi
xor ebx, ebx
push ebx
xor edi, edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x10]
push eax
push 0x4af95c
push 1
push ebx
push 0x4af97c
mov byte [ebp - 4], 1
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jl 0x46f2c0
mov eax, dword [esi + 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x50]
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x24]
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x2c]
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x1c]
push dword [esi + 0x18]
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x44]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push 0x4af9bc
push eax
call dword [ecx]
cmp eax, ebx
jl 0x46f2c0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push 1
push eax
push ecx
call dword [edx + 0x18]
cmp eax, ebx
jl 0x46f2c0
inc edi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x46f2d6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x46f2e7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x46fbee
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, 0x4ac8dd
call fcn.004a8fb4
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
call fcn.00408657
cmp eax, 0xc
jne 0x46fcd3
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.0046f08b
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x14]
mov dword [esp], 0x4c1ed0
push eax
call fcn.00408240
mov eax, dword [0x4dd02c]
mov ecx, 0x4dd02c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
push dword [esi]
lea eax, [ebp - 0x18]
push dword [ebp - 0x14]
push str._s_s.lnk
call fcn.004084e0
add esp, 0xc
lea edi, [esi + 0x1c]
lea eax, [ebp - 0x18]
call fcn.00406f98
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x10]
push eax
call fcn.0046f172
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
call fcn.0046f210
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x46fcb4
push dword [esi]
lea ecx, [ebp - 0x10]
push str._s.lnk
call fcn.0042b68c
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.0046fbb4
add esp, 0x10
push dword [ebp - 0x10]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004079f6
lea eax, [edi - 0x10]
call fcn.004079f6
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004079f6
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4709f7
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
xor esi, esi
cmp dword [ebp + 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
je 0x470a95
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x470a95
cmp ebx, esi
je 0x470a95
push edi
mov dword [eax], esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebx], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, esi
je 0x470a94
push edi
call fcn.0047709e
cmp eax, esi
pop ecx
mov dword [ebp - 0x10], eax
je 0x470a94
push eax
push edi
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x470a8b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4bae94
push dword [ebp - 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x470a8b
cmp dword [ebp - 8], esi
jbe 0x470a84
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov dword [edx], ecx
mov dword [ebx], eax
mov dword [ebp - 0x14], 1
push dword [ebp - 0x10]
call fcn.0047a32e
pop ecx
pop edi
mov eax, dword [ebp - 0x14]
pop esi
leave
ret
Function at 0x471a30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x471a4c
mov eax, dword [ebp - 4]
jmp 0x471b27
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x471b02
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
mov edi, edi
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4b65e8]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4b65e8]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4b65e8]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4b65e8]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4b65e8]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x4b65e8]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x4b65e8]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4b65e8]
dec ebp
jne 0x471a6c
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x471b1e
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x4b65e8]
dec ecx
jne 0x471b0c
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4749e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4ac006
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4d82fc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esi], 0x4c20a8
push 0x400
mov dword [esi + 8], 0x400
call fcn.0047709e
xor edi, edi
mov dword [esi + 4], eax
mov dword [esi + 0xc], edi
mov dword [esp + 0x18], edi
push 0x400
mov dword [esi + 0x14], 0x400
call fcn.0047709e
add esp, 8
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov word [esi + 0x2c], di
mov dword [esi + 0x30], 1
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x474b20
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4aa436
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
push ebx
push esi
push edi
mov eax, dword [0x4d82fc]
xor eax, esp
push eax
lea eax, [esp + 0x9c]
mov dword fs:[0], eax
mov eax, dword [0x4dd02c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4dd02c
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0xb0]
push 0xfde9
push ecx
lea edx, [esp + 0x20]
xor ebx, ebx
lea eax, [esp + 0x24]
mov dword [esp + 0xac], ebx
push edx
mov dword [esp + 0x24], eax
call fcn.00409138
mov byte [esp + 0xa4], 1
mov eax, dword [esp + 0x18]
cmp eax, ebx
mov esi, eax
jne 0x474ba0
xor eax, eax
jmp 0x474ba9
push eax
call fcn.004778b0
add esp, 4
push eax
push esi
lea eax, [esp + 0x1c]
call fcn.0040945e
mov byte [esp + 0xa4], bl
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
cmp eax, ecx
je 0x474bd0
push eax
call fcn.00479fe9
add esp, 4
mov edi, dword [esp + 0x14]
mov eax, dword [edi - 0xc]
movzx ecx, ax
movzx edx, ax
xor eax, eax
cmp ecx, ebx
mov dword [esp + 0x10], edx
jle 0x474bf2
xor byte [eax + edi], 0x88
add eax, 1
cmp eax, ecx
jl 0x474be7
mov esi, dword [esp + 0xac]
lea eax, [esp + 0x10]
add esi, 4
push eax
mov ebx, 2
call fcn.00475ba0
movzx ebx, word [esp + 0x10]
push edi
call fcn.00475ba0
lea eax, [edi - 0x10]
mov dword [esp + 0xa4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x474c3d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x98
ret 8
Function at 0x4753c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4adc7e
mov eax, dword fs:[0]
push eax
sub esp, 0x138
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d82fc]
xor eax, esp
push eax
lea eax, [esp + 0x14c]
mov dword fs:[0], eax
mov edi, ecx
push 0x400
or ebp, 0xffffffff
mov dword [esp + 0x24], 0x4c2098
mov dword [esp + 0x2c], 0x400
call fcn.0047709e
mov dword [esp + 0x28], eax
xor eax, eax
add esp, 4
mov dword [esp + 0x2c], eax
mov dword [esp + 0x154], eax
mov eax, dword [0x4dd02c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4dd02c
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0x30], esi
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x158], 1
call fcn.00470ac0
mov ecx, dword [esp + 0x164]
mov edx, dword [esp + 0x160]
mov eax, dword [esp + 0x15c]
push ecx
push edx
push eax
lea ecx, [edi + 0x14]
push ecx
mov ebx, 2
lea ecx, [esp + 0x30]
mov byte [esp + 0x164], bl
call fcn.00475db0
mov eax, dword [esp + 0x2c]
cmp eax, 7
jbe 0x475564
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
mov dword [esp + 0x18], edx
mov dx, word [ecx + 4]
mov word [esp + 0x1c], dx
mov dl, byte [ecx + 6]
add eax, 0xfffffff9
push eax
add ecx, 7
push ecx
push 0
mov byte [esp + 0x2a], dl
call fcn.00471a30
add esp, 0xc
cmp dword [esp + 0x1b], eax
jne 0x475564
movzx eax, word [esp + 0x18]
cmp eax, dword [esp + 0x2c]
jne 0x475564
cmp byte [esp + 0x1a], bl
jne 0x475564
push 0x4c2084
lea esi, [esp + 0x28]
call fcn.00475ba0
mov ecx, dword [esp + 0x24]
add ecx, 7
push ecx
lea edx, [esp + 0x34]
push edx
call fcn.00408fcf
lea eax, [esp + 0x48]
mov dword [esp + 0x44], eax
call dword [0x4d80ac]
mov esi, dword [esp + 0x30]
push eax
push esi
lea ecx, [esp + 0x4c]
push ecx
call fcn.0042b5e7
mov byte [esp + 0x154], 3
mov edx, dword [esp + 0x44]
push edx
add edi, 0x10
push edi
call fcn.00407e8c
mov byte [esp + 0x154], bl
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0x48]
cmp eax, ecx
je 0x475545
push eax
call fcn.00479fe9
add esp, 4
mov edi, dword [edi]
push edi
lea ebx, [esp + 0x38]
call fcn.00470bb0
test eax, eax
je 0x475564
mov edx, ebx
push edx
call fcn.00471780
cmp eax, 1
jne 0x475564
xor ebp, ebp
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x158], 1
call fcn.00470b40
lea eax, [esi - 0x10]
mov byte [esp + 0x154], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47559a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0x20], 0x4c2098
je 0x4755b3
push eax
call fcn.0047a32e
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x14c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret 0xc
Function at 0x47734c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4d82fc]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0047728b
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0047a340
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x47739b
cmp dword [ebp - 0x1c], 5
jb 0x4773b3
jmp 0x4773af
cmp dword [ebp - 0x10], 1
jne 0x4773b3
cmp dword [ebp - 0x1c], 4
ja 0x4773af
jne 0x4773b3
cmp dword [ebp - 0x18], 0
jbe 0x4773b3
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4afaac
call fcn.0046b649
test eax, eax
jge 0x4773d4
mov byte [0x4de058], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0047f247
add ebp, 0x78
leave
ret

Function at 0x47781c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4dd048], 0
push esi
jne 0x47778f
call fcn.004776ba
test eax, eax
je 0x4777d2
mov eax, dword [0x4dd048]
cmp eax, 1
jne 0x4777b0
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4777d2
pop esi
ret
push eax
call dword [0x4dd050]
test eax, eax
jne 0x47781a
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4777d6
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4dd048]
call dword [0x4dd050]
mov edi, eax
test edi, edi
je 0x4777fd
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x477819
lea edi, [esi + 0xff0]
push esi
push dword [0x4dd048]
call dword [0x4dd04c]
add esi, 0x10
cmp esi, edi
jb 0x477803
mov eax, esi
pop edi
pop esi
ret
jmp 0x47777c
Function at 0x47a077
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x47a0b4
cmp dword [ebp + 0x14], edi
je 0x47a0b4
cmp ecx, edi
jne 0x47a0bb
call fcn.004802b9
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00479d11
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x47a0cf
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x47a0f0
cmp ebx, 0xffffffff
je 0x47a0df
push ebx
push edi
push ecx
call fcn.0047a340
add esp, 0xc
cmp esi, edi
je 0x47a09c
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x47a09c
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x47a10c
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x47a113
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x47a204
test word [esi + 0xc], 0x10c
je 0x47a167
mov eax, dword [esi + 4]
test eax, eax
je 0x47a167
jl 0x47a265
cmp ebx, eax
mov edi, ebx
jb 0x47a138
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x47a20c
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004796f8
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x47a1fc
cmp ebx, dword [ebp - 0xc]
jb 0x47a1d4
cmp dword [ebp - 0xc], 0
je 0x47a191
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x47a186
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x47a18d
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x47a19c
mov eax, SysReAllocString
cmp ebx, eax
ja 0x47a19c
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x47a238
push eax
push dword [ebp - 8]
push esi
call fcn.0047c43e
pop ecx
push eax
call fcn.004862c5
add esp, 0xc
test eax, eax
je 0x47a277
cmp eax, 0xffffffff
je 0x47a265
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x47a1fc
push esi
call fcn.00485be4
cmp eax, 0xffffffff
pop ecx
je 0x47a269
cmp dword [ebp - 4], 0
je 0x47a238
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x47a11b
mov eax, dword [ebp + 0x14]
jmp 0x47a0b6
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x47a223
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0047a340
add esp, 0xc
call fcn.004802b9
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x47a0ac
cmp dword [ebp + 0xc], 0xffffffff
je 0x47a24e
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0047a340
add esp, 0xc
call fcn.004802b9
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x47a0ac
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x47a0b6
or dword [esi + 0xc], 0x10
jmp 0x47a269
Function at 0x47d5db
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x47d608
call fcn.004802cc
mov dword [eax], esi
call fcn.004802b9
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00479d11
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x47d5e4
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x47d637
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004802df
pop ecx
call fcn.004802b9
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x47d65e
test al, 1
je 0x47d65e
test byte [esp + 0xc], 2
je 0x47d65e
call fcn.004802cc
mov dword [eax], 5
call fcn.004802b9
mov dword [eax], 0xd
jmp 0x47d62e
xor eax, eax
pop esi
ret

Function at 0x47f247
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d82fc]
jne 0x47f251
repz ret
jmp fcn.0048e4fc

Function at 0x48371a
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4d8bf0]
je 0x483735
inc edi
cmp edi, 0x17
jb 0x483726
cmp edi, 0x17
jae 0x4838b5
push ebp
push 3
call fcn.00490100
cmp eax, 1
pop ecx
je 0x483881
push 3
call fcn.00490100
test eax, eax
pop ecx
jne 0x483769
cmp dword [0x4d8158], 1
je 0x483881
cmp ebx, 0xfc
je 0x4838b4
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4dd140
push ebp
call fcn.0047d6dd
add esp, 0xc
test eax, eax
je 0x48379f
push esi
push esi
push esi
push esi
push esi
call fcn.00479c15
add esp, 0x14
push 0x104
mov esi, 0x4dd159
push esi
push 0
mov byte [0x4dd25d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4837e3
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0047d6dd
add esp, 0xc
test eax, eax
je 0x4837e3
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00479c15
add esp, 0x14
push esi
call fcn.004778b0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x483828
push esi
call fcn.004778b0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4dd454
push 0x4b0c54
sub ecx, eax
push ecx
push eax
call fcn.0047eb7f
add esp, 0x14
test eax, eax
je 0x483828
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00479c15
add esp, 0x14
jmp 0x48382a
xor esi, esi
push 0x4b0c50
push ebx
push ebp
call fcn.0047eb0e
add esp, 0xc
test eax, eax
je 0x48384a
push esi
push esi
push esi
push esi
push esi
call fcn.00479c15
add esp, 0x14
push dword [edi*8 + 0x4d8bf4]
push ebx
push ebp
call fcn.0047eb0e
add esp, 0xc
test eax, eax
je 0x48386c
push esi
push esi
push esi
push esi
push esi
call fcn.00479c15
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0048ff43
add esp, 0xc
jmp 0x4838b4
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4838b4
cmp ebp, 0xffffffff
je 0x4838b4
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4d8bf4]
push dword [esi]
call fcn.004778b0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x48ff43
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0048319b
xor ebx, ebx
cmp dword [0x4ddbf8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x490019
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4900f9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4900f9
push eax
call fcn.0048312d
mov dword [esp], 0x4b1878
push edi
mov dword [0x4ddbf8], eax
call esi
push eax
call fcn.0048312d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4ddbfc], eax
call esi
push eax
call fcn.0048312d
mov dword [0x4ddc00], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0047e5f2
test eax, eax
pop ecx
pop ecx
je 0x48ffe7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00479c15
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x490019
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0048312d
cmp eax, ebx
pop ecx
mov dword [0x4ddc08], eax
je 0x490019
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0048312d
pop ecx
mov dword [0x4ddc04], eax
mov eax, dword [0x4ddc04]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x49009e
cmp dword [0x4ddc08], ecx
je 0x49009e
push eax
call fcn.004831a4
push dword [0x4ddc08]
mov esi, eax
call fcn.004831a4
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x49009e
cmp edi, ebx
je 0x49009e
call esi
cmp eax, ebx
je 0x49006b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x49006b
test byte [ebp - 0x18], 1
jne 0x49009e
lea eax, [ebp - 0x10]
push eax
call fcn.0047e629
test eax, eax
pop ecx
je 0x490086
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00479c15
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x490095
or dword [ebp + 0x10], 0x200000
jmp 0x4900d9
or dword [ebp + 0x10], 0x40000
jmp 0x4900d9
mov eax, dword [0x4ddbfc]
cmp eax, dword [ebp - 8]
je 0x4900d9
push eax
call fcn.004831a4
cmp eax, ebx
pop ecx
je 0x4900d9
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4900d9
mov eax, dword [0x4ddc00]
cmp eax, dword [ebp - 8]
je 0x4900d9
push eax
call fcn.004831a4
cmp eax, ebx
pop ecx
je 0x4900d9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4ddbf8]
call fcn.004831a4
cmp eax, ebx
pop ecx
je 0x4900f9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4900fb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4951c4
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4d82fc]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x495205
cmp byte [ebp - 0x194], 2
jne 0x4951ff
cmp byte [ebp - 0x193], 2
je 0x495208
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 2
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f247
leave
ret
Function at 0x49ceb6
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x49cee5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0xffffffe7
add eax, 0x51
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x49d006
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x164]
test ecx, ecx
je 0x49d026
push dword [esi + 0xf4]
push dword [esp + 0xc]
push dword [esp + 0xc]
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
jl 0x49d05f
cmp eax, 2
jg 0x49d05f
push dword [esi + 0xf0]
imul eax, eax, 3
push 1
add eax, 0x4b2d78
push 2
push eax
call fcn.0047c232
push dword [esi + 0xf0]
push 1
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.0047c232
add esp, 0x20
xor eax, eax
ret

Function at 0x49d225
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + eax*4 + 0x12c]
push edi
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [ebp + 0x18]
and dword [edi], 0
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x49d297
push ebx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2733
jne 0x49d271
and dword [ebp + 8], 0
mov dword [edi], 0x51
jmp 0x49d296
push ebx
push esi
call fcn.004a63d6
push eax
push str.Send_failure:__s
push dword [esi]
call fcn.0049d191
mov eax, dword [esi]
mov dword [eax + 0x855c], ebx
add esp, 0x14
mov dword [edi], 0x37
pop ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebp
ret