joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c940
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
cmp dword [ebp + 8], 0
je 0x47c9f0
add esp, 0xfffffffc
mov eax, dword [0x591990]
push eax
push 0x47c8c8
lea ebx, [ebp - 0x100]
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0xfffffff4
push ebx
call sub.KERNEL32.dll_OutputDebugStringA
add esp, 0x1c
lea ebx, [ebp - 0x200]
add esp, 0xfffffff4
push 0x5f20c0
call sub.KERNEL32.dll_EnterCriticalSection
mov eax, dword [0x591990]
add esp, 0xc
test eax, eax
je 0x47c9b8
add esp, 0xfffffff4
push 0x5f20c0
call sub.KERNEL32.dll_LeaveCriticalSection
push dword [0x5919b0]
call sub.KERNEL32.dll_Sleep
add esp, 0xc
jmp 0x47c980
add esp, 0xfffffff4
push 0x5f20c0
call sub.KERNEL32.dll_LeaveCriticalSection
add esp, 0xfffffff8
mov eax, dword [0x591990]
push eax
push 0x47c8f8
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0x20
add esp, 0xfffffff4
push ebx
call sub.KERNEL32.dll_OutputDebugStringA
add esp, 0xfffffffc
call fcn.0047c638
jmp 0x47ca60
push dword [0x5919b0]
mov eax, dword [0x591990]
push eax
push 0x47c914
lea ebx, [ebp - 0x300]
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0xfffffff4
push ebx
call sub.KERNEL32.dll_OutputDebugStringA
mov eax, dword [0x4c523c]
add esp, 0x1c
cmp dword [eax + 0xc], 0
je 0x47ca2c
add esp, 0xfffffff4
push 0
jmp 0x47ca35
add esp, 0xfffffff4
push dword [0x5919b0]
call sub.KERNEL32.dll_Sleep
add esp, 0xc
add esp, 0xfffffffc
mov eax, dword [0x591990]
push eax
push 0x47c92a
lea ebx, [ebp - 0x400]
push ebx
call sub.USER32.dll_wsprintfA
add esp, 0xfffffff4
push ebx
call sub.KERNEL32.dll_OutputDebugStringA
mov ebx, dword [ebp - 0x418]
leave
ret
Function at 0x48ce54
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push ebx
mov ebx, dword [ebp + 8]
lea edi, [ebx + 0x3c060]
xor eax, eax
cld
mov ecx, 0x4000
rep stosd dword es:[edi], eax
mov edx, dword [ebx + 0x4c09c]
shl edx, 3
movzx eax, word [edx + 0x4d5be2]
mov dword [ebx + 0x4c098], eax
movzx eax, word [edx + 0x4d5be0]
mov dword [ebx + 0x4c0a0], eax
movzx eax, word [edx + 0x4d5be6]
mov dword [ebx + 0x4c094], eax
mov dword [ebx + 0x4c084], 0
mov dword [ebx + 0x4c068], 0
add esp, 0xfffffffc
push dword [ebx]
push 0x10000
lea edi, [ebx + 0x4020]
push edi
mov eax, dword [ebx + 4]
call eax
mov dword [ebx + 0x4c090], eax
add esp, 0x10
test eax, eax
je 0x48cedb
cmp eax, 0xffffffff
jne 0x48cef4
mov dword [ebx + 0x4c08c], 1
mov dword [ebx + 0x4c090], 0
jmp 0x48cf58
mov dword [ebx + 0x4c08c], 0
cmp eax, 0x105
ja 0x48cf29
lea esi, [esi]
add esp, 0xfffffff4
push ebx
call fcn.0048d0b4
add esp, 0x10
cmp dword [ebx + 0x4c090], 0x105
ja 0x48cf29
cmp dword [ebx + 0x4c08c], 0
je 0x48cf08
mov dword [ebx + 0x4c06c], 0
xor ecx, ecx
lea esi, [esi]
mov eax, dword [ebx + 0x4c06c]
shl eax, 5
movzx edx, byte [ecx + edi]
xor eax, edx
and eax, 0x7fff
mov dword [ebx + 0x4c06c], eax
inc ecx
cmp ecx, 1
jbe 0x48cf38
lea esp, [ebp - 0x18]
pop ebx
pop edi
leave
ret
Function at 0x48d1e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x4c090], 0
je 0x48d43c
cmp dword [ebx + 0xc], 0
jne 0x48d43c
lea eax, [ebx + 0x4020]
mov dword [ebp - 8], eax
lea edx, [ebx + 0x2c060]
mov dword [ebp - 0xc], edx
lea esi, [esi]
mov edx, dword [ebx + 0x4c06c]
shl edx, 5
mov ecx, dword [ebx + 0x4c084]
mov esi, dword [ebp - 8]
movzx eax, byte [esi + ecx + 2]
xor edx, eax
and edx, 0x7fff
mov dword [ebx + 0x4c06c], edx
and ecx, 0x7fff
movzx eax, word [ebx + edx*2 + 0x3c060]
mov dword [ebx + 0x4c070], eax
mov edx, dword [ebp - 0xc]
mov word [edx + ecx*2], ax
mov edx, dword [ebx + 0x4c06c]
movzx eax, word [ebx + 0x4c084]
mov word [ebx + edx*2 + 0x3c060], ax
mov edx, dword [ebx + 0x4c070]
test edx, edx
je 0x48d2b1
mov eax, dword [ebx + 0x4c084]
sub eax, edx
cmp eax, 0x7efa
ja 0x48d2b1
add esp, 0xfffffff8
push edx
push ebx
call fcn.0048cf60
mov dword [ebx + 0x4c07c], eax
mov edx, dword [ebx + 0x4c090]
add esp, 0x10
cmp eax, edx
jbe 0x48d2b1
mov dword [ebx + 0x4c07c], edx
mov eax, dword [ebx + 0x4c07c]
cmp eax, 2
jbe 0x48d3bc
add esp, 0xfffffffc
add eax, 0xfffffffd
push eax
mov eax, dword [ebx + 0x4c088]
mov ecx, dword [ebx + 0x4c084]
sub ecx, eax
mov eax, ecx
push eax
push ebx
call fcn.0048eae8
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x4c07c]
sub dword [ebx + 0x4c090], eax
add esp, 0x10
cmp eax, dword [ebx + 0x4c098]
ja 0x48d384
dec eax
mov dword [ebx + 0x4c07c], eax
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
lea esi, [esi]
mov edx, dword [ebx + 0x4c084]
lea eax, [edx + 1]
mov dword [ebx + 0x4c084], eax
mov eax, dword [ebx + 0x4c06c]
shl eax, 5
lea ecx, [edx + 1]
movzx edx, byte [edi + edx + 3]
xor eax, edx
and eax, 0x7fff
mov dword [ebx + 0x4c06c], eax
and ecx, 0x7fff
movzx eax, word [ebx + eax*2 + 0x3c060]
mov dword [ebx + 0x4c070], eax
mov word [esi + ecx*2], ax
mov edx, dword [ebx + 0x4c06c]
movzx eax, word [ebx + 0x4c084]
mov word [ebx + edx*2 + 0x3c060], ax
mov eax, dword [ebx + 0x4c07c]
lea edx, [eax - 1]
mov dword [ebx + 0x4c07c], edx
cmp eax, 1
jne 0x48d30c
inc dword [ebx + 0x4c084]
jmp 0x48d3e7
add eax, dword [ebx + 0x4c084]
mov dword [ebx + 0x4c084], eax
mov dword [ebx + 0x4c07c], 0
mov ecx, dword [ebp - 8]
movzx edx, byte [eax + ecx]
mov dword [ebx + 0x4c06c], edx
shl edx, 5
movzx eax, byte [ecx + eax + 1]
xor edx, eax
mov dword [ebx + 0x4c06c], edx
jmp 0x48d3e7
add esp, 0xfffffffc
mov eax, dword [ebx + 0x4c084]
mov esi, dword [ebp - 8]
movzx eax, byte [eax + esi]
push eax
push 0
push ebx
call fcn.0048eae8
mov dword [ebp - 4], eax
dec dword [ebx + 0x4c090]
inc dword [ebx + 0x4c084]
add esp, 0x10
cmp dword [ebp - 4], 0
je 0x48d414
add esp, 0xfffffff8
push 0
push ebx
call fcn.0048e7d8
mov eax, dword [ebx + 0x4c084]
mov dword [ebx + 0x4c068], eax
jmp 0x48d411
add esp, 0xfffffff4
push ebx
call fcn.0048d0b4
add esp, 0x10
cmp dword [ebx + 0x4c090], 0x105
ja 0x48d429
cmp dword [ebx + 0x4c08c], 0
je 0x48d408
cmp dword [ebx + 0x4c090], 0
je 0x48d43c
cmp dword [ebx + 0xc], 0
je 0x48d220
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x48f140
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push ebx
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
add esp, 0xfffffffc
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
mov dword [ebx], eax
add esp, 4
cmp eax, 0xffffffff
je 0x48f1f1
add esp, 0xfffffff8
push 0
push eax
call sub.KERNEL32.dll_GetFileSize
mov edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
add esp, 8
cmp edx, 0xffffffff
jne 0x48f19c
add esp, 0xfffffff4
push dword [ebx]
call sub.KERNEL32.dll_CloseHandle
jmp 0x48f1f1
add esp, 0xfffffff8
push 0
push 0
push 0
push 2
push 0
push dword [ebx]
call sub.KERNEL32.dll_CreateFileMappingA
mov dword [esi], eax
add esp, 8
test eax, eax
jne 0x48f1c8
add esp, 0xfffffff4
push dword [ebx]
call sub.KERNEL32.dll_CloseHandle
jmp 0x48f1f1
add esp, 0xfffffff4
push 0
push 0
push 0
push 4
push eax
call sub.KERNEL32.dll_MapViewOfFile
add esp, 0xc
test eax, eax
jne 0x48f1f3
add esp, 0xfffffff4
push dword [esi]
call sub.KERNEL32.dll_CloseHandle
push dword [ebx]
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
lea esp, [ebp - 0x18]
pop ebx
pop esi
leave
ret
Function at 0x4b586c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x4d810c], 0
je 0x4b589c
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [0x596590]
xor edx, edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
fild qword [ebp - 8]
fmul qword [0x4b5864]
jmp 0x4b58b2
mov dword [0x4d810c], 1
call sub.KERNEL32.dll_GetTickCount
mov dword [0x596590], eax
fldz
leave
ret
Function at 0x4b774c
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
cmp edx, 0xd
je 0x4b77db
cmp edx, 8
jne 0x4b7774
mov eax, dword [0x4d8154]
test eax, eax
jle 0x4b77be
dec eax
mov dword [0x4d8154], eax
jmp 0x4b77be
cmp ebx, 0xffffffff
jne 0x4b7786
cmp dword [0x4d8154], 0
jne 0x4b7a69
cmp edx, 0xa
jne 0x4b7810
mov eax, dword [0x4d8158]
cmp eax, 0xa
jne 0x4b77c8
cmp dword [0x4d8154], 0
je 0x4b77b4
mov dword [0x4d8154], 0
jmp 0x4b7a69
mov dword [0x4d8154], 0
mov eax, 1
jmp 0x4b7a6e
cmp byte [0x4d8158], 0
jge 0x4b77e4
mov dword [0x4d8158], 0xa
xor eax, eax
jmp 0x4b7a6e
cmp eax, 0x20
je 0x4b77db
mov dword [0x4d8158], 0xa
mov eax, dword [0x4d8154]
lea edx, [eax + 1]
mov dword [0x4d8154], edx
mov eax, edx
cmp eax, dword [0x4d8160]
jle 0x4b7884
jmp 0x4b789a
cmp edx, 0xc
jne 0x4b7838
mov dword [0x4d8158], 0xa
cmp dword [0x4d8154], 0
je 0x4b77be
mov dword [0x4d8154], 0
jmp 0x4b7a69
test ebx, ebx
jne 0x4b7846
cmp edx, 0x20
je 0x4b7855
cmp edx, 9
je 0x4b7855
cmp ebx, 0xfffffffe
je 0x4b7855
cmp ebx, 0x21
jne 0x4b78b0
cmp edx, 0x21
jne 0x4b78b0
cmp dword [0x4d8158], 0x20
je 0x4b77db
mov dword [0x4d8158], 0x20
mov eax, dword [0x4d8154]
lea edx, [eax + 1]
mov dword [0x4d8154], edx
mov eax, edx
cmp eax, dword [0x4d8160]
jg 0x4b7890
mov eax, 0x20
jmp 0x4b7a6e
mov dword [0x4d8158], 0x20
mov dword [0x4d8154], 0
mov eax, 0xd
jmp 0x4b7a6e
mov esi, dword [0x4d8158]
mov dword [0x4d8158], edx
test ebx, ebx
jne 0x4b78cb
lea eax, [edx - 0xa0]
cmp eax, 0x3f
ja 0x4b78d4
mov eax, edx
or al, 0x80
mov dword [0x4d8158], eax
test ebx, ebx
jne 0x4b78e0
inc dword [0x4d8154]
jmp 0x4b78e7
add dword [0x4d8154], 2
mov ecx, dword [0x4d8154]
mov eax, dword [0x4d8160]
cmp ecx, eax
jle 0x4b77be
add eax, 0xa
cmp ecx, eax
jl 0x4b7918
test ebx, ebx
jne 0x4b7a5f
mov dword [0x4d8154], 1
jmp 0x4b7a69
test ebx, ebx
jne 0x4b7a00
cmp edx, 0xde
je 0x4b77be
cmp edx, 0xdf
je 0x4b77be
cmp edx, 0xa4
je 0x4b77be
cmp edx, 0xa3
je 0x4b77be
cmp edx, 0xa1
je 0x4b77be
cmp edx, 0xb0
je 0x4b77be
lea eax, [edx - 0xa0]
cmp eax, 0x3f
ja 0x4b7984
mov dword [0x4d8154], 1
jmp 0x4b7a69
cmp edx, 0x29
je 0x4b77be
cmp edx, 0x5d
je 0x4b77be
cmp edx, 0x7d
je 0x4b77be
cmp edx, 0x2e
je 0x4b77be
cmp edx, 0x2c
je 0x4b77be
cmp edx, 0x21
je 0x4b77be
cmp edx, 0x3f
je 0x4b77be
cmp edx, 0x2f
je 0x4b77be
cmp edx, 0x3a
je 0x4b77be
cmp edx, 0x3b
je 0x4b77be
cmp esi, 0xa
je 0x4b79f2
cmp esi, 0x20
je 0x4b79f2
mov edx, esi
test dl, dl
jge 0x4b77be
mov dword [0x4d8154], 1
jmp 0x4b7a69
cmp ebx, 0x21
jne 0x4b7a5f
cmp edx, 0x22
je 0x4b77be
cmp edx, 0x23
je 0x4b77be
cmp edx, 0x24
je 0x4b77be
cmp edx, 0x25
je 0x4b77be
cmp edx, 0x27
je 0x4b77be
cmp edx, 0x28
je 0x4b77be
cmp edx, 0x29
je 0x4b77be
cmp edx, 0x2a
je 0x4b77be
cmp edx, 0x2b
je 0x4b77be
cmp edx, 0x2c
je 0x4b77be
mov dword [0x4d8154], 2
mov eax, 0xa
pop ebx
pop esi
leave
ret
Function at 0x4b7b9c
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push edi
push esi
push ebx
mov esi, dword [ebp + 8]
mov dword [0x4d8178], 0
mov dword [ebp - 0x50], 0x3d
mov dword [ebp - 0x4c], 0x3f
mov edi, 2
jmp 0x4b7c51
cmp edx, 0x3f
jne 0x4b7c50
inc edi
cmp edi, 0x13
jg 0x4b7c91
add esp, 0xfffffff4
push esi
call fcn.004b5b9c
mov ebx, eax
mov dword [ebp + edi*4 - 0x50], ebx
add esp, 0x10
cmp ebx, 0xffffffff
je 0x4b7c91
cmp ebx, 0x62
je 0x4b7c00
cmp ebx, 0x42
jne 0x4b7c0c
mov dword [0x4d8178], 0x42
jmp 0x4b7c20
cmp ebx, 0x71
je 0x4b7c16
cmp ebx, 0x51
jne 0x4b7c91
mov dword [0x4d8178], 0x51
inc edi
cmp edi, 0x13
jg 0x4b7c91
add esp, 0xfffffff4
push esi
call fcn.004b5b9c
mov ebx, eax
mov dword [ebp + edi*4 - 0x50], ebx
add esp, 0x10
cmp ebx, 0xffffffff
je 0x4b7c91
cmp ebx, 0x3f
je 0x4b7c91
mov dword [0x4d8178], 0
jmp 0x4b7c91
inc edi
cmp edi, 0x13
jg 0x4b7c91
add esp, 0xfffffff4
push esi
call fcn.004b5b9c
mov edx, eax
lea eax, [ebp - 0x50]
mov ebx, edx
mov dword [eax + edi*4], ebx
add esp, 0x10
cmp ebx, 0xffffffff
je 0x4b7c91
cmp ebx, 0x3d
je 0x4b7c91
cmp ebx, 0x1f
jg 0x4b7bcc
cmp ebx, 0xd
je 0x4b7bcc
cmp ebx, 0xa
je 0x4b7bcc
cmp dword [0x4d8178], 0
je 0x4b7ca4
cmp ebx, 0xffffffff
je 0x4b7ca4
cmp edi, 0x14
jne 0x4b7cdc
add esp, 0xfffffff8
push esi
push ebx
call fcn.004b5bbc
xor esi, esi
add esp, 0x10
cmp esi, edi
jge 0x4b7ce6
lea eax, [ebp - 0x50]
mov dword [ebp - 0x54], eax
lea esi, [esi]
add esp, 0xfffffff8
mov eax, dword [ebp - 0x54]
push dword [eax + esi*4]
push 0
mov eax, dword [0x4d8168]
call eax
add esp, 0x10
inc esi
cmp esi, edi
jl 0x4b7cc0
jmp 0x4b7ce6
mov eax, dword [0x4d814c]
mov dword [0x600cf0], eax
mov eax, ebx
lea esp, [ebp - 0x78]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x4ba9dc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, dword [0x4d8374]
mov dword [0x59ec70], eax
mov dword [0x59ec60], eax
mov dword [0x59ec40], 0
add esp, 0xfffffff4
push 0x4ba9cb
call sub.msvcrt.dll_getenv
mov dword [0x59ec50], eax
mov dl, byte [ebx]
cmp dl, 0x2d
jne 0x4baa28
mov dword [0x59ec20], 2
inc ebx
jmp 0x4baa56
cmp dl, 0x2b
jne 0x4baa3c
mov dword [0x59ec20], 0
inc ebx
jmp 0x4baa56
test eax, eax
je 0x4baa4c
mov dword [0x59ec20], 0
jmp 0x4baa56
mov dword [0x59ec20], 1
mov eax, ebx
mov ebx, dword [ebp - 0x18]
leave
ret

Function at 0x4bbb9c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
push edi
push esi
push ebx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cmp dword [0x4d8380], 0
je 0x4bbbd8
add esp, 0xfffffff8
lea eax, [ebp - 0x1a0]
push eax
push 0x101
call sub.WSOCK32.DLL_WSAStartup
mov dword [0x4d8380], 0
add esp, 8
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
add esp, 0xfffffff4
push esi
call sub.WSOCK32.DLL_inet_addr
mov ebx, eax
mov dword [ebp - 0xc], ebx
add esp, 0xc
cmp ebx, 0xffffffff
jne 0x4bbc35
add esp, 0xfffffff4
push esi
call sub.WSOCK32.DLL_gethostbyname
mov edx, eax
add esp, 0xc
test edx, edx
je 0x4bbc89
mov eax, dword [edx + 0xc]
movsx edx, word [edx + 0xa]
lea ecx, [ebp - 0xc]
add esp, 0xfffffffc
push edx
push dword [eax]
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0x10
add esp, 0xfffffff4
movzx eax, di
push eax
call sub.WSOCK32.DLL_htons
mov word [ebp - 0xe], ax
mov word [ebp - 0x10], 2
add esp, 0xfffffff8
push 6
push 1
push 2
call sub.WSOCK32.DLL_socket
mov ebx, eax
add esp, 0x14
cmp ebx, 0xffffffff
je 0x4bbc8e
add esp, 0xfffffffc
push 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.WSOCK32.DLL_connect
mov esi, eax
add esp, 4
cmp esi, 0xffffffff
je 0x4bbc80
mov eax, ebx
jmp 0x4bbc8e
add esp, 0xfffffff4
push ebx
call sub.WSOCK32.DLL_closesocket
mov eax, 0xffffffff
lea esp, [ebp - 0x1b8]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x4bbc9c
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x110], 1
lea edx, [ebx + 1]
add esp, 0xfffffff4
push 0
push 0
push 0
lea eax, [ebp - 0x110]
push eax
push edx
call sub.WSOCK32.DLL_select
add esp, 0xc
test eax, eax
jle 0x4bbce8
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call sub.WSOCK32.DLL_recv
nop
mov ebx, dword [ebp - 0x128]
leave
ret
Function at 0x4bd0d8
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push edi
push esi
cmp dword [0x4d85c4], 0
jg 0x4bd259
add esp, 0xfffffff8
push dword [ebp + 8]
push dword [0x4d98ac]
call sub.KERNEL32.dll_WaitForSingleObject
add esp, 8
test eax, eax
jne 0x4bd1de
lea eax, [ebp - 0x84]
push eax
push 1
lea eax, [ebp - 0x80]
push eax
push dword [0x4d98ac]
call sub.KERNEL32.dll_PeekConsoleInputA
cmp dword [ebp - 0x84], 0
je 0x4bd1de
lea eax, [ebp - 0x84]
push eax
push 1
lea eax, [ebp - 0x80]
push eax
push dword [0x4d98ac]
call sub.KERNEL32.dll_ReadConsoleInputA
movzx eax, word [ebp - 0x80]
cmp eax, 2
je 0x4bd218
jg 0x4bd168
cmp eax, 1
je 0x4bd178
jmp 0x4bd23d
cmp eax, 4
je 0x4bd228
jmp 0x4bd23d
cmp word [ebp - 0x76], 0x14
je 0x4bd1de
cmp word [ebp - 0x76], 0x90
je 0x4bd1de
cmp word [ebp - 0x76], 0x91
je 0x4bd1de
cmp dword [ebp - 0x7c], 0
jne 0x4bd1bc
movzx eax, word [ebp - 0x76]
add ax, 0xfff0
cmp ax, 2
ja 0x4bd1de
movzx eax, word [ebp - 0x76]
cmp eax, dword [0x59f4b0]
jne 0x4bd1de
mov eax, dword [0x4d838c]
cmp byte [eax + 0x67], 0
jne 0x4bd1e8
jmp 0x4bd1de
movzx eax, word [ebp - 0x76]
add ax, 0xfff0
cmp ax, 2
ja 0x4bd1e8
mov eax, dword [0x4d838c]
cmp byte [eax + 0x67], 0
je 0x4bd1e8
movzx eax, word [ebp - 0x76]
mov dword [0x59f4b0], eax
xor eax, eax
jmp 0x4bd25e
mov dword [0x59f4b0], 0
cmp byte [ebp - 0x72], 0
jne 0x4bd20b
add esp, 0xfffffff8
push 2
movzx eax, word [ebp - 0x76]
push eax
call sub.USER32.dll_MapVirtualKeyA
test eax, eax
jl 0x4bd1de
movzx eax, word [ebp - 0x78]
mov dword [0x4d85c4], eax
jmp 0x4bd249
cmp dword [ebp - 0x70], 1
jne 0x4bd231
cmp dword [ebp - 0x78], 0
je 0x4bd1de
jmp 0x4bd231
mov eax, dword [0x4d838c]
mov byte [eax + 0xe], 1
mov dword [0x4d85c4], 1
jmp 0x4bd249
mov dword [0x4d85c4], 0
jmp 0x4bd1de
mov edi, 0x601000
lea esi, [ebp - 0x80]
cld
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov eax, 1
lea esp, [ebp - 0xa8]
pop esi
pop edi
leave
ret
Function at 0x4befc0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, dword [0x4d838c]
cmp byte [eax], 0
jne 0x4befe7
call fcn.004bfcc8
mov eax, dword [0x4d8390]
mov byte [eax + 0x48], 1
mov eax, dword [0x4d838c]
mov byte [eax], 1
mov eax, dword [0x4d838c]
cmp byte [eax + 0x10], 0
je 0x4beff7
call fcn.004bfcc8
cmp dword [0x4d8390], 0
jne 0x4bf008
xor eax, eax
jmp 0x4bf0ea
mov eax, dword [0x4d838c]
cmp byte [eax + 6], 0
je 0x4bf02c
cmp byte [eax + 2], 0
jne 0x4bf01f
cmp byte [eax + 4], 0
je 0x4bf02c
call fcn.004bc968
test al, al
jne 0x4bf0e5
mov eax, dword [0x4d8390]
cmp byte [eax + 0x48], 0
je 0x4bf048
add esp, 0xfffffff4
push eax
call fcn.004c099c
add esp, 0x10
jmp 0x4bf0a1
mov eax, dword [0x4d838c]
cmp byte [eax + 6], 0
jne 0x4bf06e
add esp, 0xfffffff4
push 0x4befaf
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
je 0x4bf06e
call fcn.004c0db8
jmp 0x4bf0a1
xor ebx, ebx
jmp 0x4bf079
inc ebx
mov eax, dword [0x4d838c]
cmp ebx, dword [eax + 0x40]
jge 0x4bf0a1
mov eax, dword [0x4d8390]
mov eax, dword [eax + 0x58]
cmp dword [eax + ebx*4], 0xffffffff
je 0x4bf078
add esp, 0xfffffff4
push ebx
call fcn.004c0c94
add esp, 0x10
test al, al
je 0x4bf078
mov edx, dword [0x4d838c]
mov ecx, dword [0x4d8390]
mov eax, dword [edx + 0x1c]
cmp eax, dword [ecx]
jne 0x4bf0bc
mov eax, dword [edx + 0x20]
cmp eax, dword [ecx + 4]
je 0x4bf0e5
add esp, 0xfffffff8
mov eax, dword [0x4d8390]
push dword [eax + 4]
push dword [eax]
call fcn.004c0b88
mov ecx, dword [0x4d838c]
mov edx, dword [0x4d8390]
mov eax, dword [edx]
mov dword [ecx + 0x1c], eax
mov eax, dword [edx + 4]
mov dword [ecx + 0x20], eax
mov eax, 1
mov ebx, dword [ebp - 0x18]
leave
ret

Function at 0x4c015c
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
add esp, 0xfffffff8
push dword [0x6010a0]
push dword [0x4d98a8]
call sub.KERNEL32.dll_SetConsoleScreenBufferSize
add esp, 0xfffffff4
push 0x6010aa
push 1
push dword [0x4d98a8]
call sub.KERNEL32.dll_SetConsoleWindowInfo
add esp, 0xfffffffc
push dword [0x6010a0]
push dword [0x4d98a8]
call sub.KERNEL32.dll_SetConsoleScreenBufferSize
add esp, 0xfffffff4
push 0x6010aa
push 1
push dword [0x4d98a8]
call sub.KERNEL32.dll_SetConsoleWindowInfo
mov eax, dword [0x4d838c]
add esp, 0x24
cmp byte [eax + 0x65], 0
je 0x4c021e
mov word [ebp - 8], 0
movzx eax, word [ebp - 8]
mov dword [ebp - 8], eax
movzx ecx, word [0x6010a2]
dec ecx
shl ecx, 0x10
lea eax, [ebp - 8]
mov edx, dword [eax + 4]
movzx edx, dx
mov dword [eax + 4], edx
or dword [eax + 4], ecx
movzx edx, word [0x6010a0]
dec edx
mov word [eax + 4], dx
add esp, 0xfffffff4
push eax
push 0
push dword [0x6010a0]
push dword [0x4d98b0]
push dword [0x4d98a8]
call sub.KERNEL32.dll_WriteConsoleOutputA
add esp, 0xc
test eax, eax
jne 0x4c021e
xor eax, eax
jmp 0x4c0245
add esp, 0xfffffff4
push dword [0x4d98a8]
call sub.KERNEL32.dll_SetConsoleActiveScreenBuffer
add esp, 0xfffffff4
push dword [0x4d98b8]
push dword [0x4d98ac]
call sub.KERNEL32.dll_SetConsoleMode
mov eax, 1
mov ebx, dword [ebp - 0x28]
leave
ret
Function at 0x4c099c
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
push esi
push ebx
mov eax, dword [0x4d8390]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4c09bc
xor eax, eax
jmp 0x4c0aec
mov edx, dword [ebp + 8]
mov byte [edx + 0x48], 0
mov dword [ebp - 0x18], 0
movzx eax, word [0x4d839c]
or eax, 0x10000
mov dword [ebp - 0x14], eax
mov word [ebp - 8], 0
movzx edx, word [0x4d839c]
dec edx
mov word [ebp - 4], dx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x4d8398]
jge 0x4c0ae7
lea edi, [ebp - 8]
mov edx, dword [ebp - 0x10]
cmp dword [ebp + 8], edx
je 0x4c0a32
mov ecx, dword [edx + 0x54]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x54]
mov eax, dword [0x4d839c]
shl eax, 2
add esp, 0xfffffffc
push eax
mov eax, dword [ebp - 0xc]
push dword [edx + eax*4]
push dword [ecx + eax*4]
call sub.msvcrt.dll_memcpy
add esp, 0x10
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x54]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax + edx*4]
shl edx, 0x10
mov eax, dword [ebp - 8]
and eax, 0xffff
mov dword [ebp - 8], eax
or dword [ebp - 8], edx
mov eax, dword [edi + 4]
and eax, 0xffff
mov dword [edi + 4], eax
or dword [edi + 4], edx
xor ecx, ecx
cmp ecx, dword [0x4d839c]
jge 0x4c0a96
mov esi, dword [0x4d839c]
lea edx, [ecx*4]
mov al, byte [ebx + ecx*4]
mov byte [edx + 0x59f6d0], al
mov eax, dword [ebx + ecx*4]
shr eax, 0x13
movzx eax, byte [eax + 0x601120]
mov word [edx + 0x59f6d2], ax
inc ecx
cmp ecx, esi
jl 0x4c0a6d
add esp, 0xfffffff4
push edi
mov eax, dword [ebp - 0x18]
push eax
mov edx, dword [ebp - 0x14]
push edx
push 0x59f6d0
push dword [0x4d98a8]
call sub.KERNEL32.dll_WriteConsoleOutputA
mov eax, dword [0x4d838c]
add esp, 0xc
cmp byte [eax + 6], 0
je 0x4c0ad5
cmp byte [eax + 2], 0
jne 0x4c0acc
cmp byte [eax + 4], 0
je 0x4c0ad5
call fcn.004bc968
test al, al
jne 0x4c0ae7
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x4d8398]
jl 0x4c0a04
mov eax, 1
lea esp, [ebp - 0x38]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x4c0b88
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edx, dword [0x4d838c]
cmp dword [edx + 0x1c], eax
jne 0x4c0ba5
cmp dword [edx + 0x20], ebx
je 0x4c0bbc
shl eax, 0x10
movzx ecx, bx
or ecx, eax
add esp, 0xfffffff8
push ecx
push dword [0x4d98a8]
call sub.KERNEL32.dll_SetConsoleCursorPosition
mov eax, 1
mov ebx, dword [ebp - 0x18]
leave
ret
Function at 0x4c0c94
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
push esi
push ebx
cmp dword [0x4d8390], 0
je 0x4c0dac
mov edx, dword [0x4d8390]
mov eax, dword [edx + 0x58]
mov ecx, dword [ebp + 8]
mov ebx, dword [eax + ecx*4]
mov eax, dword [edx + 0x5c]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x54]
mov eax, dword [eax + ecx*4]
lea esi, [eax + ebx*4]
mov edi, dword [ebp - 0xc]
sub edi, ebx
inc edi
mov dword [ebp - 0x14], 0
movzx eax, di
or eax, 0x10000
mov dword [ebp - 0x10], eax
shl ecx, 0x10
movzx eax, word [ebp - 8]
mov dword [ebp - 8], eax
or dword [ebp - 8], ecx
lea eax, [ebp - 8]
mov edx, dword [eax + 4]
movzx edx, dx
mov dword [eax + 4], edx
or dword [eax + 4], ecx
mov word [ebp - 8], bx
mov edx, dword [ebp - 0xc]
mov word [eax + 4], dx
xor ecx, ecx
cmp ecx, edi
jge 0x4c0d42
mov ebx, 0x601120
lea esi, [esi]
lea edx, [ecx*4]
mov al, byte [esi + ecx*4]
mov byte [edx + 0x59f6d0], al
mov eax, dword [esi + ecx*4]
shr eax, 0x13
movzx eax, byte [eax + ebx]
mov word [edx + 0x59f6d2], ax
inc ecx
cmp ecx, edi
jl 0x4c0d1c
add esp, 0xfffffff4
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov eax, dword [ebp - 0x10]
push eax
push 0x59f6d0
push dword [0x4d98a8]
call sub.KERNEL32.dll_WriteConsoleOutputA
mov edx, dword [0x4d8390]
mov eax, dword [edx + 0x58]
mov ecx, dword [ebp + 8]
mov dword [eax + ecx*4], 0xffffffff
mov eax, dword [edx + 0x5c]
mov dword [eax + ecx*4], 0xffffffff
mov eax, dword [0x4d838c]
add esp, 0xc
cmp byte [eax + 6], 0
je 0x4c0dac
cmp byte [eax + 2], 0
jne 0x4c0d98
cmp byte [eax + 4], 0
je 0x4c0dac
call fcn.004bc968
test al, al
je 0x4c0dac
mov eax, 1
jmp 0x4c0dae
xor eax, eax
lea esp, [ebp - 0x38]
pop ebx
pop esi
pop edi
leave
ret