joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cfef0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x204
mov eax, dword [0x5fe940]
mov dword [esp + 0x200], eax
push esi
lea eax, [esp + 4]
push eax
push 0x200
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x5b95b0
call fcn.00436a80
add esp, 4
push esi
push 1
push 1
push str.cursor_arrowman_normal.spr
mov ecx, 0x879bc8
call fcn.0055cf20
push esi
push 1
push 1
push str.cursor_arrowman_fire_02.spr
mov ecx, 0x879bc8
mov dword [esi + 0x64], eax
call fcn.0055cf20
push esi
push 1
push 1
push str.cursor_arrowman_move_01.spr
mov ecx, 0x879bc8
mov dword [esi + 0x68], eax
call fcn.0055cf20
push esi
push 1
push 1
push str.cursor_arrowman_move_02.spr
mov ecx, 0x879bc8
mov dword [esi + 0x6c], eax
call fcn.0055cf20
push esi
push 1
push 1
push str.cursor_arrowman_fire_01.spr
mov ecx, 0x879bc8
mov dword [esi + 0x70], eax
call fcn.0055cf20
push esi
push 1
push 1
push str.cursor_arrowman_fire_02.spr
mov ecx, 0x879bc8
mov dword [esi + 0x74], eax
call fcn.0055cf20
push esi
push 1
push 1
push str.cursor_arrowman_panel_wait.spr
mov ecx, 0x879bc8
mov dword [esi + 0x78], eax
call fcn.0055cf20
lea ecx, [esp + 4]
push ecx
mov dword [esi + 0x7c], eax
call fcn.00436a80
mov ecx, dword [esp + 0x208]
add esp, 4
pop esi
call fcn.005900c7
add esp, 0x204
ret

Function at 0x4d0086
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5b0658
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x5bbbc0
xor eax, eax
mov dword [esp + 0x14], eax
mov edi, dword [sym.imp.USER32.dll_LoadCursorFromFileA]
mov ecx, eax
mov edx, eax
push str.curcur_r.ani
mov dword [esi], 0x5c9f78
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
mov word [esi + 0x24], ax
mov byte [esi + 0x26], 8
mov byte [esi + 0x27], al
mov dword [esi + 0x8c], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 1
call edi
push str.curcur_ru.ani
mov dword [esi + 0x34], eax
call edi
push str.curcur_u.ani
mov dword [esi + 0x38], eax
call edi
push str.curcur_lu.ani
mov dword [esi + 0x3c], eax
call edi
push str.curcur_l.ani
mov dword [esi + 0x40], eax
call edi
push str.curcur_ld.ani
mov dword [esi + 0x44], eax
call edi
push str.curcur_d.ani
mov dword [esi + 0x48], eax
call edi
push str.curcur_rd.ani
mov dword [esi + 0x4c], eax
call edi
push str.curcur_n.ani
mov dword [esi + 0x50], eax
call edi
push str.curWait.ani
mov dword [esi + 0x54], eax
call edi
push str.curcur_move.ani
mov dword [esi + 0x58], eax
call edi
mov dword [esi + 0x5c], eax
movzx eax, byte [esi + 0x26]
mov ecx, dword [esi + eax*4 + 0x34]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [esi + 0x30], eax
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4d0370
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
mov esi, ecx
cmp byte [esi + 0x26], 8
jne 0x4d03d8
push 1
call ebp
cmp byte [esi + 0x26], 8
jne 0x4d03d8
mov eax, dword [0xaee99c]
test eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x4d03b3
call edi
sub eax, dword [0xaee998]
cmp eax, 0x50
jb 0x4d03d3
mov dword [0xaee99c], 0
jmp 0x4d03cc
call edi
sub eax, dword [0xaee998]
cmp eax, 0x640
jb 0x4d03d3
mov dword [0xaee99c], 1
call edi
mov dword [0xaee998], eax
push 1
call ebp
pop edi
xor eax, eax
mov ax, word [esi + 0x24]
cmp ax, 0x14
lea ecx, [eax + 1]
mov word [esi + 0x24], cx
jb 0x4d03f1
mov word [esi + 0x24], 0
pop esi
pop ebp
ret

Function at 0x4d2590
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x5fe940]
mov dword [esp + 0x94], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
mov ecx, 2
je 0x4d2635
mov eax, dword [esp + 8]
sub eax, 3
je 0x4d262e
dec eax
je 0x4d2605
dec eax
je 0x4d25d9
mov dword [esi + 8], 0
jmp 0x4d2635
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4d25ea
mov dword [esi + 8], 4
jmp 0x4d2635
cmp eax, 1
jne 0x4d25f8
mov dword [esi + 8], 5
jmp 0x4d2635
cmp eax, ecx
jne 0x4d2635
mov dword [esi + 8], 6
jmp 0x4d2635
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4d2616
mov dword [esi + 8], 1
jmp 0x4d2635
cmp eax, 0xa
jne 0x4d2620
mov dword [esi + 8], ecx
jmp 0x4d2635
cmp eax, 0x5a
jne 0x4d2635
mov dword [esi + 8], 3
jmp 0x4d2635
mov dword [esi + 8], 8
mov edx, dword [esi + 8]
xor eax, eax
cmp edx, ecx
mov ecx, dword [esp + 0x98]
setge al
pop esi
call fcn.005900c7
add esp, 0x98
ret
Function at 0x4d2970
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x5fe940]
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x11c]
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 0x118]
lea edx, [esp]
push edx
push 0x20019
push 0
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4d29cf
or eax, 0xffffffff
mov ecx, dword [esp + 0x110]
call fcn.005900c7
add esp, 0x114
ret 0x14
mov ecx, dword [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebp
push esi
mov esi, dword [esp + 0x130]
push edi
mov edi, dword [esp + 0x130]
lea edx, [esp + 0x138]
push edx
push esi
lea eax, [esp + 0x1c]
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
je 0x4d2a22
cmp eax, 0xea
jne 0x4d2a22
mov edx, dword [esp + 0x138]
push edx
push 0x5ca748
push esi
call ebp
add esp, 0xc
mov eax, dword [esp + 0x14]
dec eax
je 0x4d2a66
sub eax, 3
je 0x4d2a33
or esi, 0xffffffff
jmp 0x4d2a6b
lea eax, [esp + 0x138]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push edi
push eax
call ebx
mov ecx, dword [esp + 0x18]
push ecx
push 0x5b5890
push esi
call ebp
add esp, 0xc
mov esi, 4
jmp 0x4d2a6b
mov esi, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x120]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
call fcn.005900c7
add esp, 0x114
ret 0x14
Function at 0x4d2b00
Capabilities:
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x5fe940]
push ebx
push esi
push edi
xor ebx, ebx
push str.Shell32.dll
mov dword [esp + 0x120], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ebx
call fcn.00436f80
mov esi, dword [ebp + 8]
mov edi, eax
add esp, 4
test edi, edi
je 0x4d2b82
mov eax, dword [esp + 0x14]
cmp dword [eax + 8], 3
jle 0x4d2b4c
push str.SHGetSpecialFolderPathA
jmp 0x4d2b51
push str.SHGetSpecialFolderPath
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4d2b77
mov ecx, dword [ebp + 0xc]
push 0
push ecx
push esi
push 0
call eax
test eax, eax
je 0x4d2b77
mov dword [esp + 0x10], 1
mov ebx, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jne 0x4d2be2
mov edx, dword [esp + 0x14]
cmp dword [edx + 8], 4
jge 0x4d2be2
push 0x100
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea eax, [esp + 0x1c]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x5ca760
lea ecx, [esp + 0x1c]
push ecx
call ebx
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x4d2bf9
lea eax, [esp + 0x18]
mov ebx, 1
push eax
push esi
call edi
mov eax, ebx
mov ecx, dword [esp + 0x11c]
call fcn.005900c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
lea ecx, [esp + 0x1c]
push ecx
call edi
push str.Start_MenuPrograms
lea edx, [esp + 0x1c]
push edx
call ebx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x4d2c29
lea ecx, [esp + 0x18]
mov ebx, 1
push ecx
jmp 0x4d2bdf
push 0x5b5931
push esi
call edi
mov ecx, dword [esp + 0x11c]
mov eax, dword [esp + 0x10]
call fcn.005900c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d2f00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x324
mov eax, dword [0x5fe940]
push ebx
push esi
mov dword [esp + 0x328], eax
mov eax, dword [ebp + 0xc]
push edi
mov ebx, ecx
push eax
lea ecx, [esp + 0x22c]
mov esi, 0x100
push ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 1
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 8]
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
lea eax, [esp + 0x234]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4d3111
xor eax, eax
push eax
push eax
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
push eax
mov ecx, 0x40
lea edi, [esp + 0x138]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x13c]
push ecx
push edx
push eax
mov dword [esp + 0x3c], esi
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, eax
cmp esi, 0x103
je 0x4d306f
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4d2fde
mov edx, dword [ebx]
push 0
push eax
lea eax, [esp + 0x130]
push eax
mov ecx, ebx
call dword [edx + 8]
test eax, eax
je 0x4d306f
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push 0
lea ecx, [esp + 0x138]
push ecx
push edx
call edi
mov esi, eax
test esi, esi
jne 0x4d3106
mov eax, dword [esp + 0x10]
dec eax
je 0x4d3051
sub eax, 3
jne 0x4d306f
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push esi
lea eax, [esp + 0x138]
push eax
push ecx
call edi
mov edx, dword [esp + 0x20]
push edx
lea eax, [esp + 0x2c]
push 0x5b5890
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4d30ec
mov edx, dword [ebx]
push 0
push eax
lea eax, [esp + 0x30]
push eax
mov ecx, ebx
call dword [edx + 8]
test eax, eax
jne 0x4d308e
mov ecx, dword [esp + 0x18]
inc ecx
cmp esi, 0x103
mov dword [esp + 0x18], ecx
je 0x4d3106
mov esi, 0x100
jmp 0x4d2f72
mov edx, dword [ebx]
push 1
push str.TRYOUT
lea eax, [esp + 0x30]
push eax
mov ecx, ebx
call dword [edx + 8]
test eax, eax
jne 0x4d30d3
mov edx, dword [ebx]
push 1
push str.TRIAL
lea eax, [esp + 0x30]
push eax
mov ecx, ebx
call dword [edx + 8]
test eax, eax
jne 0x4d30d3
mov edx, dword [ebx]
push 1
push 0x5ca7b0
lea eax, [esp + 0x30]
push eax
mov ecx, ebx
call dword [edx + 8]
test eax, eax
je 0x4d30e1
mov ecx, dword [ebp + 0x18]
movsx eax, word [ecx]
cdq
sub eax, edx
sar eax, 1
mov word [ecx], ax
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x32c]
call fcn.005900c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x32c]
xor eax, eax
call fcn.005900c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4d3640
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x208
mov eax, dword [0x5fe940]
push esi
push edi
mov esi, ecx
mov dword [esp + 0x20c], eax
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x108]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x110]
push eax
mov ecx, esi
call fcn.004d2c50
push 0
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x110]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
mov ecx, esi
call fcn.004d2f00
test eax, eax
jne 0x4d37b2
push eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x110]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push SysReAllocString
mov ecx, esi
call fcn.004d2f00
test eax, eax
jne 0x4d37b2
push eax
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x110]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.004d2f00
test eax, eax
jne 0x4d37b2
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x110]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.004d2f00
test eax, eax
jne 0x4d37b2
push eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x110]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.004d2f00
test eax, eax
jne 0x4d37b2
push eax
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x110]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.004d2f00
test eax, eax
jne 0x4d37b2
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x110]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionRunServicesOnce
push reloc.OLEAUT32.dll_SysReAllocString
mov ecx, esi
call fcn.004d2f00
test eax, eax
jne 0x4d37b2
mov ecx, dword [esp + 0x20c]
call fcn.005900c7
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x20c]
mov eax, 1
call fcn.005900c7
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4d3800
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
mov eax, dword [0x5fe940]
push edi
mov dword [esp + 0x10c], eax
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
push 0x100
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x4d3868
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4d3868
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ecx, dword [esp + 0x10c]
call fcn.005900c7
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x10c]
mov eax, 0x5b5931
call fcn.005900c7
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4d5090
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x764
mov eax, dword [0x5fe940]
push ebx
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x76c], eax
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x68]
rep stosd dword es:[edi], eax
mov ecx, 0x140
lea edi, [esp + 0x268]
rep stosd dword es:[edi], eax
mov ecx, 0x10
lea edi, [esp + 0x28]
push str.whois.krnic.net
mov dword [esp + 0x18], ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4d50f6
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
jmp 0x4d50fb
mov eax, 0x5b5931
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
lea edx, [esp + 0x2c]
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x28]
push eax
call edi
test eax, eax
je 0x4d5285
mov ecx, ebx
call fcn.004d3800
push eax
lea ecx, [esp + 0x6c]
push ecx
call esi
lea edx, [esp + 0x68]
push edx
call edi
test eax, eax
je 0x4d5285
push 0x5cae94
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x4d5285
push 0x2b
mov word [esp + 0x1c], 2
call dword [sym.imp.WS2_32.dll_htons]
lea ecx, [esp + 0x28]
push ecx
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x10
lea edx, [esp + 0x1c]
push edx
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x4d5285
push 0
lea eax, [esp + 0x6c]
push eax
call edi
push eax
lea ecx, [esp + 0x70]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x4d5285
mov ebx, dword [sym.imp.WS2_32.dll_recv]
mov dword [esp + 0x10], 0
lea ebx, [ebx]
xor eax, eax
push eax
push 0x80
lea edx, [esp + 0x170]
push edx
mov ecx, 0x20
lea edi, [esp + 0x174]
push esi
rep stosd dword es:[edi], eax
call ebx
cmp eax, 0xffffffff
je 0x4d524c
lea eax, [esp + 0x268]
push eax
mov byte [esp + 0x1ec], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x4d5228
lea ecx, [esp + 0x168]
push ecx
lea edx, [esp + 0x26c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x4d523e
lea eax, [esp + 0x168]
push eax
lea ecx, [esp + 0x26c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 9
mov dword [esp + 0x10], eax
jl 0x4d51d0
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, dword [esp + 0x14]
lea edx, [esp + 0x268]
push edx
mov ecx, esi
call fcn.004d47f0
test eax, eax
je 0x4d5285
mov eax, 1
mov dword [esi + 0x20], eax
mov ecx, dword [esp + 0x76c]
call fcn.005900c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x76c]
xor eax, eax
call fcn.005900c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d52a0
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x5fe940]
push ebx
push esi
push edi
mov dword [esp + 0x424], eax
mov esi, ecx
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x320]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x320]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.PlaceResource.dx
lea ecx, [esp + 0x324]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
lea edx, [esp + 0x338]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4d5413
push 2
lea eax, [esi + 0x1ac]
push eax
mov ecx, esi
call fcn.004d2b00
cmp dword [esi + 8], 3
jle 0x4d5344
push 0x17
lea ecx, [esi + 0x2ac]
push ecx
mov ecx, esi
call fcn.004d2b00
xor eax, eax
mov ecx, 0xc2
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
push 0
lea edx, [esp + 0x10]
push edx
stosw word es:[edi], ax
push 0x30a
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4d537b
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4d540c
cmp word [esp + 0x14], 0
je 0x4d5394
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x1a]
push edx
mov ecx, esi
call fcn.004d3560
cmp word [esp + 0x218], 0
je 0x4d53b3
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x21e]
push ecx
mov ecx, esi
call fcn.004d3560
cmp word [esp + 0x116], 0
je 0x4d53d2
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x11c]
push eax
mov ecx, esi
call fcn.004d3560
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.004d4e20
test eax, eax
je 0x4d5344
mov ax, word [esp + 0x12]
mov edi, dword [esi + 0x10]
movsx edx, ax
add edi, edx
cmp ax, 0xfff8
mov dword [esi + 0x10], edi
jg 0x4d5344
mov dword [esi + 0x1c], 1
jmp 0x4d5344
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x424]
call fcn.005900c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e1660
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x28
push ebx
push ebp
mov eax, 0x28
push esi
mov ebp, ecx
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], 4
mov dword [esp + 0x20], 5
lea edi, [ebp + 0x84]
lea esi, [ebp + 0x3c]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [edi + 0x20], eax
jae 0x4e16f7
mov eax, dword [edi]
mov edx, dword [esi - 8]
mov ecx, eax
neg ecx
cmp edx, ecx
jg 0x4e16d0
mov dword [esi - 8], eax
mov ecx, dword [esi - 8]
mov eax, dword [esp + ebx + 0x10]
sub ecx, eax
mov dword [esi - 8], ecx
mov ecx, dword [edi]
mov edx, ecx
neg edx
cmp dword [esi], edx
jg 0x4e16e8
mov dword [esi], ecx
sub dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, dword [esp + ebx + 0x24]
mov dword [edi + 0x20], eax
add ebx, 4
add esi, 0x10
add edi, 4
cmp ebx, 0x14
jl 0x4e16b5
mov edx, dword [ebp + 0x98]
add edx, 4
mov eax, edx
cmp eax, 0xff
mov dword [ebp + 0x98], edx
jl 0x4e1727
mov dword [ebp + 0x98], 0xff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x4e26d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
mov eax, dword [0x5fe940]
push esi
mov dword [esp + 0x104], eax
push edi
lea eax, [esp + 8]
push eax
push 0x100
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, dword [esp + 0x110]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov dword [esi + 4], eax
jne 0x4e2715
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x108]
pop edi
pop esi
call fcn.005900c7
add esp, 0x104
ret 4
Function at 0x4fdcc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5b165e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, ecx
xor ecx, ecx
mov dword [esp], eax
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [esp + 0xc], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov byte [esp + 0xc], 1
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov byte [esp + 0xc], 2
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4ff170
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
xor ecx, ecx
test bl, 1
je 0x4ff183
mov ecx, 0x80
mov eax, ebx
shr eax, 1
test al, 1
je 0x4ff18e
or ecx, 0x40
shr eax, 1
test al, 1
je 0x4ff197
or ecx, 0x20
shr eax, 1
test al, 1
je 0x4ff1a0
or ecx, 0x10
shr eax, 1
test al, 1
je 0x4ff1a9
or ecx, 8
shr eax, 1
test al, 1
je 0x4ff1b2
or ecx, 4
shr eax, 1
test al, 1
je 0x4ff1bb
or ecx, 2
test al, 2
je 0x4ff1c2
or ecx, 1
shl ecx, 0x18
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
lea edx, [eax + eax]
xor ecx, edx
mov dword [esi + ebx*4], ecx
mov eax, ecx
xor edx, edx
mov ecx, 0x1f
lea ecx, [ecx]
test al, 1
je 0x4ff28d
mov edi, 1
shl edi, cl
or edx, edi
shr eax, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x4ff280
mov dword [esi + ebx*4], edx
inc ebx
cmp ebx, 0xff
jle 0x4ff177
pop edi
pop esi
pop ebx
ret