joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d17a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56ee86
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x676300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CStatusReport.0
xor eax, eax
xor ebx, ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 1
mov dword [esi + 0x24], eax
call fcn.004f5a61
lea ecx, [esi + 0xc]
mov byte [ebp - 4], bl
call fcn.004f168f
mov eax, dword [esi + 4]
mov dword [ebp - 4], 0xffffffff
cmp eax, 0xffffffff
je 0x4d1831
cmp eax, ebx
je 0x4d1831
push ebx
push eax
call fcn.004f049e
mov eax, dword [esi + 4]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d2580
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
push edi
lea ecx, [ebp + 8]
push ecx
push 0x4004667f
push ebx
mov dword [ebp - 4], eax
mov dword [ebp + 8], 0x1000
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edi, dword [ebp + 0x10]
cmp eax, 0xffffffff
je 0x4d25d8
mov eax, dword [ebp + 8]
test eax, eax
je 0x4d25d8
cmp eax, 0x1000
jle 0x4d25dd
cmp eax, edi
jle 0x4d25dd
mov ecx, dword [esi + 0xc]
add ecx, ecx
add ecx, ecx
cmp eax, ecx
jbe 0x4d25d1
mov eax, ecx
cmp eax, 0x1000
jge 0x4d25dd
mov eax, 0x1000
test edi, edi
js 0x4d25e5
cmp edi, eax
jle 0x4d25e7
mov edi, eax
push edi
push esi
call fcn.004d2410
add esp, 8
cmp eax, 0xffffffff
jne 0x4d2600
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
add eax, dword [esi + 0x10]
push 0
push edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
je 0x4d25f6
test edi, edi
jne 0x4d2622
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add dword [esi + 0x10], edi
mov eax, dword [esi + 0x10]
mov edx, dword [ebp - 4]
cmp eax, edx
je 0x4d2642
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x4d2642
mov ebx, dword [esi + 0x18]
push ebx
push eax
push edx
push esi
call ecx
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d2650
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi]
push edi
xor ebx, ebx
push ebx
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4d267b
pop edi
pop esi
or eax, eax
pop ebx
pop ebp
ret
cmp edi, ebx
jne 0x4d2686
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x10]
mov edx, eax
cmp edi, eax
jb 0x4d269c
mov eax, dword [esi + 4]
mov dword [esi + 0x10], ebx
mov dword [esi], eax
mov dword [esi + 8], ebx
jmp 0x4d26a6
add dword [esi], edi
add dword [esi + 8], edi
sub eax, edi
mov dword [esi + 0x10], eax
mov ecx, dword [esi + 0x10]
cmp ecx, edx
je 0x4d26c0
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x4d26c0
mov ebx, dword [esi + 0x18]
push ebx
push ecx
push edx
push esi
call eax
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d4030
Capabilities:
Resolve dns

Disassembly:
push esi
xor esi, esi
test eax, eax
je 0x4d404f
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
jne 0x4d4049
or eax, 0xffffffff
pop esi
ret
movsx eax, word [esi + 8]
jmp 0x4d4054
mov eax, 2
push 0x10
mov dword [edi + 4], eax
mov dword [edi + 8], 1
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0x10
call fcn.00535e2e
add esp, 4
mov dword [edi + 0x18], eax
test eax, eax
je 0x4d4044
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
test esi, esi
je 0x4d40b7
mov cx, word [esi + 8]
mov word [eax], cx
movsx edx, word [esi + 0xa]
mov ecx, dword [esi + 0xc]
push edx
mov edx, dword [ecx]
push edx
add eax, 4
push eax
call fcn.00534c80
add esp, 0xc
mov dword [edi + 0x1c], 0
xor eax, eax
pop esi
ret
mov ecx, 2
mov word [eax], cx
mov dword [eax + 4], 0
mov dword [edi + 0x1c], 0
xor eax, eax
pop esi
ret

Function at 0x4d4de0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 1
push 2
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4d4e13
push str.socket
call fcn.004d8a70
add esp, 4
or eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push edi
push esi
call fcn.004d3e30
add esp, 4
test eax, eax
js 0x4d4e65
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 4]
push eax
push 8
push 0xffff
push esi
call edi
cmp dword [ebp + 8], 0
je 0x4d4e4d
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0xffff
push esi
call edi
test ebx, ebx
je 0x4d4e84
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x18]
push edx
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x4d4e84
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
mov edi, eax
call dword [sym.imp.WS2_32.dll_closesocket]
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4d4f00
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
test eax, eax
jne 0x4d4f84
test cx, cx
jne 0x4d4f84
push 0
push 1
push 2
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4d4f3c
push str.socket
call fcn.004d8a70
add esp, 4
or eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.004d3e30
add esp, 4
test eax, eax
jns 0x4d4f69
push edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push esi
mov edi, eax
call dword [sym.imp.WS2_32.dll_closesocket]
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp - 4]
push eax
push 8
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push ecx
call fcn.004d4e90
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4d4f9d
pop ebx
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push ecx
call fcn.004d4de0
mov edx, dword [ebx + 0x18]
push edx
mov esi, eax
call fcn.00535ec2
add esp, 8
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4d4fc0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push eax
mov eax, dword [ebp + 0xc]
call fcn.004d4e90
mov esi, eax
add esp, 4
or edi, 0xffffffff
test esi, esi
jne 0x4d4fe0
or eax, edi
pop edi
pop esi
pop ebp
ret
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x18]
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4d5012
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4d5012
cmp eax, 0x2726
je 0x4d5012
cmp eax, 0x2734
jne 0x4d5014
xor edi, edi
mov ecx, dword [esi + 0x18]
push ecx
call fcn.00535ec2
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x4d6ec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.005382c0
mov eax, dword [0x676300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x64]
cmp eax, dword [esi + 0x60]
jl 0x4d6eef
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret
push edi
call fcn.004d23d0
mov edi, eax
test edi, edi
jne 0x4d6f0a
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x64]
mov edx, dword [esi + 0x5c]
push ebx
push 0
push ecx
push edx
call fcn.00536a84
mov eax, dword [esi + 0x5c]
push eax
push 0x2000
lea ecx, [ebp - 0x2004]
push 1
push ecx
call fcn.00535632
mov ebx, eax
add esp, 0x1c
test ebx, ebx
jg 0x4d6f55
push edi
call fcn.004d23e0
add esp, 4
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534bba
mov esp, ebp
pop ebp
ret
push ebx
lea edx, [ebp - 0x2004]
push edx
push edi
call fcn.004d24c0
add esp, 0xc
push edi
test eax, eax
jne 0x4d6f3b
mov eax, dword [esi + 8]
add dword [esi + 0x64], ebx
mov ecx, dword [eax + 0xa0]
push ecx
call fcn.004d26d0
mov edx, dword [esi + 8]
push 0
push 0x4d6fb0
push edx
call fcn.004d6e10
push edi
call fcn.004d23e0
mov ecx, dword [ebp - 4]
add esp, 0x18
pop ebx
xor ecx, ebp
mov eax, 1
pop edi
call fcn.00534bba
mov esp, ebp
pop ebp
ret
Function at 0x4d8860
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56f5c0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x676300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], str.CHtSer
mov dword [ebp - 0x1c], str.Initi
mov dword [ebp - 0x18], eax
call fcn.004ebfc1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov ecx, dword [edi]
mov eax, ecx
mov dword [ebp - 4], 0
lea edx, [eax + 1]
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x4d88c1
sub eax, edx
push eax
push ecx
lea ecx, [esi + 0xc]
call fcn.0040a3f0
mov ecx, dword [edi + 4]
mov eax, ecx
lea edx, [eax + 1]
lea esp, [esp]
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x4d88e0
sub eax, edx
push eax
push ecx
lea ecx, [esi + 0x28]
call fcn.0040a3f0
mov eax, dword [edi + 0x10]
mov dword [esi + 0x44], eax
cmp dword [edi + 8], 0
je 0x4d8913
mov edi, dword [edi + 8]
mov edx, dword [edi]
lea eax, [esi + 8]
push eax
mov eax, dword [edx]
push str.clientcfg.ini
mov ecx, edi
call eax
push esi
lea ecx, [esi + 0x48]
or edi, 0xffffffff
call fcn.004d7b10
test al, al
je 0x4d893e
mov edx, dword [esi]
mov eax, dword [edx + 0x20]
mov ecx, esi
call eax
push esi
lea ecx, [esi + 0xf8]
call fcn.004d7b10
test al, al
je 0x4d893e
xor edi, edi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x14]
cmp dword [ebp - 0x10], 0
je 0x4d896e
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
push eax
push ecx
push str._s_running_time
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.004ebdf1
add esp, 0x14
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004f5a61
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4db300
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56f420
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x676300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x67eb80]
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x28], str.CAddPack
mov dword [ebp - 0x24], str.Initi
mov dword [ebp - 0x20], eax
call fcn.004ebfc1
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [ebp - 0x1c], eax
push 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [edi + 0x1c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], str.CenterClient.zip
mov dword [ebp - 0x10], 0x4da7f0
call fcn.00531d20
push eax
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [edi + 0x1c]
call fcn.004de1a0
push 0
lea edx, [ebp - 0x14]
push edx
lea ecx, [edi + 0x1c]
mov dword [ebp - 0x14], str.PartyClient.zip
mov dword [ebp - 0x10], 0x4da870
call fcn.00531d20
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [edi + 0x1c]
call fcn.004de1a0
call fcn.004e8a80
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
push edi
mov ecx, eax
mov eax, dword [edx]
push str.CombineClient.ini
call eax
push 0x4daf60
push edi
push 0
call fcn.004f045d
add esp, 0xc
test eax, eax
jne 0x4db3f2
push str.Failed_to_start_package_monitor_thread
push str.Package
call fcn.004e8a80
add eax, 0x20
push eax
call fcn.004ebe5c
add esp, 0xc
mov dword [ebp - 4], 1
call ebx
sub eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], 0
je 0x4db41e
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
push eax
push ecx
push str._s_running_time
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.004ebdf1
add esp, 0x14
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.004f5a61
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4dcb40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c980
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x676300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x67eb80]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], str.CClieMan
mov dword [ebp - 0x1c], 0x57ba0c
mov dword [ebp - 0x18], eax
call fcn.004ebfc1
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp - 0x14], eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004dcae0
mov esi, eax
mov dword [ebp - 4], 1
call edi
sub eax, dword [ebp - 0x14]
cmp dword [ebp - 0x10], 0
je 0x4dcbcf
mov ecx, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push str._s_running_time
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004ebdf1
add esp, 0x14
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004f5a61
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4dcc60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56f5c0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x676300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x67eb80]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], str.CDownMan
mov dword [ebp - 0x1c], str.Initi
mov dword [ebp - 0x18], eax
call fcn.004ebfc1
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [esi + 8], ecx
mov ecx, dword [0x67eb84]
lea edi, [esi + 4]
mov dword [ebp - 4], eax
mov dword [edi], eax
cmp ecx, eax
je 0x4dccf8
mov edx, dword [ecx]
mov edx, dword [edx]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x586d44
call edx
test eax, eax
jne 0x4dccf8
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4dccf8
mov eax, dword [ecx]
mov edx, dword [eax + 0x18]
push edi
push 0x586d54
call edx
or edi, 0xffffffff
mov dword [esi + 0x34], edi
mov dword [ebp - 4], 1
call ebx
sub eax, dword [ebp - 0x14]
cmp dword [ebp - 0x10], 0
je 0x4dcd2a
mov ecx, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push str._s_running_time
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004ebdf1
add esp, 0x14
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.004f5a61
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4df0c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56f8a0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x676300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x67eb80]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], str.CFSynClie
mov dword [ebp - 0x1c], 0x57ba0c
mov dword [ebp - 0x18], eax
call fcn.004ebfc1
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp - 0x14], eax
push 1
push 0
push 0
lea ecx, [esi + 0x24]
mov dword [ebp - 4], 0
call fcn.004f16ce
test eax, eax
jne 0x4df17a
mov dword [ebp - 4], 1
call edi
sub eax, dword [ebp - 0x14]
cmp dword [ebp - 0x10], 0
je 0x4df158
mov ecx, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push str._s_running_time
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004ebdf1
add esp, 0x14
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004f5a61
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 1
push 0
push 0
lea ecx, [esi + 0x28]
call fcn.004f16ce
test eax, eax
jne 0x4df195
mov dword [ebp - 4], 2
jmp 0x4df133
push esi
lea ecx, [esi + 0x254]
call fcn.004dcc60
lea ecx, [esi + 8]
call fcn.004df060
mov esi, eax
mov dword [ebp - 4], 3
call edi
sub eax, dword [ebp - 0x14]
cmp dword [ebp - 0x10], 0
je 0x4df1d7
mov ecx, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push str._s_running_time
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004ebdf1
add esp, 0x14
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004f5a61
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4df8f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56f998
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x676300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x67eb80]
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x24], str.CFSynServ
mov dword [ebp - 0x20], 0x57ba0c
mov dword [ebp - 0x1c], eax
call fcn.004ebfc1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
lea ebx, [esi - 4]
lea ecx, [esi + 0xb4]
push ebx
mov dword [ebp - 4], 0
call fcn.004dd520
mov ecx, dword [0x67eb84]
lea edi, [esi + 0xbc]
mov dword [edi], 0
test ecx, ecx
je 0x4df99c
mov eax, dword [ecx]
mov eax, dword [eax]
lea edx, [ebp - 0x10]
push edx
push 0x587040
mov dword [ebp - 0x10], 0
call eax
test eax, eax
jne 0x4df99c
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4df99c
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
push edi
push 0x587050
call eax
mov edi, dword [edi]
test edi, edi
je 0x4df9b1
mov edx, dword [edi]
lea eax, [esi + 0xb4]
push eax
mov eax, dword [edx]
mov ecx, edi
call eax
cmp dword [esi + 0x2c], 0
jne 0x4dfa24
mov ecx, dword [0x67eb7c]
mov edx, dword [ecx]
mov eax, dword [edx]
push ebx
push 1
push 0
push 0
call eax
mov dword [esi + 0x2c], eax
test eax, eax
jne 0x4dfa24
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 0
je 0x4dfa01
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
push eax
push ecx
push str._s_running_time
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.004ebdf1
add esp, 0x14
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.004f5a61
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 0
je 0x4dfa54
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
push eax
push ecx
push str._s_running_time
push edx
lea eax, [ebp - 0x14]
push eax
call fcn.004ebdf1
add esp, 0x14
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.004f5a61
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dfe40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56fa96
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x676300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi + 4], vtable.IFileSyncService.0
mov dword [esi], vtable.CFileSyncService.1.0
mov dword [esi + 4], vtable.CFileSyncService.0
xor edi, edi
push 0x48
mov dword [esi + 0x10], edi
call fcn.00535efc
add esp, 4
cmp eax, edi
je 0x4dfee8
mov dword [esi + 0xc], eax
mov dword [eax], eax
mov eax, dword [esi + 0xc]
mov dword [eax + 4], eax
mov eax, dword [esi + 0xc]
mov dword [eax + 8], eax
mov eax, dword [esi + 0xc]
mov byte [eax + 0x44], 1
mov ecx, dword [esi + 0xc]
mov byte [ecx + 0x45], 1
lea ecx, [esi + 0x18]
mov dword [ebp - 4], edi
call fcn.004f0b02
lea ecx, [esi + 0xb8]
mov byte [ebp - 4], 1
mov dword [esi + 0x30], edi
call fcn.004dd5c0
mov dword [esi + 0xc0], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], edi
call fcn.005376e7
push 0x66ee2c
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call fcn.00537ad4
int3

Function at 0x4dff10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push eax
push 0
push 0
push Ordinal_4
push Ordinal_4
push Ordinal_4
push Ordinal_4
push Ordinal_4
push str.rzxcmg
push str.rzxcmg
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x67e728], eax
test eax, eax
jne 0x4dff55
pop ebp
ret 4
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop ebp
ret 4

Function at 0x4e0380
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56c980
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x676300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x67eb80]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x20], str.CMessNoti
mov dword [ebp - 0x1c], str.Initi
mov dword [ebp - 0x18], eax
call fcn.004ebfc1
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp - 0x14], eax
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004e0320
mov dword [ebp - 4], 1
call edi
sub eax, dword [ebp - 0x14]
cmp dword [ebp - 0x10], 0
je 0x4e040d
mov ecx, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push str._s_running_time
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004ebdf1
add esp, 0x14
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004f5a61
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret