joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48dbf0
Capabilities:
Terminate process

Disassembly:
mov al, byte [0x4f3459]
test al, al
jne 0x48dd79
mov byte [0x4f3459], 1
call fcn.0048dbd0
push 0x4eff30
mov byte [0x4f3401], 1
call fcn.0048edc0
push str._____Exiting_program
call fcn.0048edc0
add esp, 8
call fcn.004973b0
call fcn.00499000
call fcn.004911e0
call fcn.0049c200
call fcn.0048df20
call fcn.00493290
mov eax, dword [0x4f3020]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [0x4fa6c0]
test eax, eax
je 0x48dc7d
push str.SPY:_Closing_spy
call fcn.0048edc0
mov eax, dword [0x4fa6c0]
add esp, 4
test eax, eax
je 0x48dc7d
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x4f341c]
push esi
mov esi, dword [sym.imp.USER32.dll_DeleteMenu]
push 0x400
push 0
push ecx
call esi
test eax, eax
je 0x48dcac
mov edx, dword [0x4f341c]
push 0x400
push 0
push edx
call esi
test eax, eax
jne 0x48dc98
push str.WIN:_Closing_window
call fcn.0048edc0
mov eax, dword [0x4f33fc]
add esp, 4
test eax, eax
je 0x48dcc9
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [0x4f341c]
test eax, eax
je 0x48dcd9
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov eax, dword [0x4f33f4]
test eax, eax
je 0x48dce9
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [0x4f3418]
test eax, eax
je 0x48dcf9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4f342c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x48dd0b
push eax
call esi
call fcn.0049c0d0
mov eax, dword [0x62bdc8]
test eax, eax
je 0x48dd2a
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x62bdc8], 0
mov eax, dword [0x4f3430]
test eax, eax
je 0x48dd46
push eax
call fcn.00498a70
add esp, 4
mov dword [0x4f3430], 0
call fcn.00496b20
push str.WIN:_All_done__Have_a_nice_day
call fcn.0048edc0
mov eax, dword [0x62bdd4]
add esp, 4
test eax, eax
je 0x48dd64
push eax
call esi
mov eax, dword [0x4f3438]
test eax, eax
je 0x48dd70
push eax
call esi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
ret
Function at 0x4918f0
Capabilities:
Terminate process

Disassembly:
sub esp, 0xd4
push esi
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x58]
test eax, eax
jne 0x491940
mov ecx, dword [0x4f33fc]
push 0x10010
push 0
push str.This_program_cannot_be_run_under_Win32s._nYou_must_this_program_under_Windows_95_or_Windows_NT.
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 3
call fcn.004b713a
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0xc
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push esi
push 0
mov dword [0x4f3404], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [0x4f3404], 8
jge 0x49198a
mov edx, dword [0x4f33fc]
push 0x10010
push 0
push str.This_program_requires_a_256_color_display_mode.
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 2
call fcn.004b713a
mov eax, dword [esp + 0x58]
dec eax
je 0x4919c0
dec eax
je 0x4919a6
mov ecx, 7
mov esi, str.an_unknown_operating_system
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
jmp 0x4919f2
mov ecx, 5
mov esi, str.Microsoft_Windows_NT
lea edi, [esp + 8]
mov byte [0x4f3402], 1
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4919f2
mov eax, dword [str.Microsoft_Windows]
mov ecx, dword [0x4d1104]
mov edx, dword [0x4d1108]
mov dword [esp + 8], eax
mov eax, dword [0x4d110c]
mov dword [esp + 0xc], ecx
mov cx, word [0x4d1110]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
mov word [esp + 0x18], cx
lea ecx, [esp + 0x5c]
mov al, byte [ecx]
test al, al
je 0x491a62
cmp al, 0x20
je 0x491a04
cmp al, 9
jne 0x491a07
inc ecx
jmp 0x4919f6
mov edi, 0x4cc804
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x60]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
pop ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
and eax, 0xffff
push eax
push ecx
lea eax, [esp + 0x10]
push edx
push eax
push str.WIN:_Running__s_version__u._u__Build__u
call fcn.0048edc0
add esp, 0x14
pop edi
pop esi
add esp, 0xd4
ret
Function at 0x492960
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
push esi
jne 0x49296f
mov ebp, 0x4f3474
mov edx, dword [0x4f3418]
test edx, edx
je 0x4929b3
push ebx
mov esi, 0x4f3478
mov eax, ebp
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x4929a5
test cl, cl
je 0x4929a1
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x4929a5
add eax, 2
add esi, 2
test cl, cl
jne 0x492981
xor eax, eax
jmp 0x4929aa
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
je 0x492a91
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov dword [reloc.WSOCK32.dll_accept], 0x80000001
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4f3478
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test edx, edx
rep movsb byte es:[edi], byte [esi]
je 0x4929eb
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x13
push 0x4c65f8
push ebp
call fcn.004b7060
add esp, 0xc
test eax, eax
jne 0x492a0c
mov dword [reloc.WSOCK32.dll_accept], 0x80000002
add ebp, 0x13
cmp byte [ebp], 0x5c
jne 0x492a37
lea edi, [ebp + 1]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4f2b38
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x492a5e
mov eax, dword [0x4c933c]
mov ecx, dword [str.Jazz_Jackrabbit_2_Special_Edition]
mov edx, dword [str.Epic_MegaGames]
push ebp
push eax
push ecx
push edx
push str.Software_s_s_s_s
push 0x4f2b38
call fcn.004b57c2
add esp, 0x18
lea eax, [esp + 0x10]
mov ecx, dword [reloc.WSOCK32.dll_accept]
push eax
push 0x4f3418
push 0
push 0xf003f
push 0
push 0x4eff30
push 0
push 0x4f2b38
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [0x4f3418]
pop edi
mov eax, dword [esp + 0x10]
pop esi
test eax, eax
pop ebp
jne 0x492aaa
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
neg eax
sbb eax, eax
inc eax
ret
mov edx, dword [reloc.WSOCK32.dll_accept]
push 0x4f2b38
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
inc eax
ret
Function at 0x492ad0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov al, byte [0x4d04b1]
mov dword [esp], 0xff
test al, al
jne 0x492aea
xor eax, eax
add esp, 8
ret
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
push esi
jne 0x492af9
mov ebp, 0x4f3474
mov edx, dword [0x4f3418]
test edx, edx
je 0x492b3d
push ebx
mov esi, 0x4f3478
mov eax, ebp
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x492b2f
test cl, cl
je 0x492b2b
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x492b2f
add eax, 2
add esi, 2
test cl, cl
jne 0x492b0b
xor eax, eax
jmp 0x492b34
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
je 0x492c1b
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov dword [reloc.WSOCK32.dll_accept], 0x80000001
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4f3478
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test edx, edx
rep movsb byte es:[edi], byte [esi]
je 0x492b75
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x13
push 0x4c65f8
push ebp
call fcn.004b7060
add esp, 0xc
test eax, eax
jne 0x492b96
mov dword [reloc.WSOCK32.dll_accept], 0x80000002
add ebp, 0x13
cmp byte [ebp], 0x5c
jne 0x492bc1
lea edi, [ebp + 1]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4f2b38
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x492be8
mov eax, dword [0x4c933c]
mov ecx, dword [str.Jazz_Jackrabbit_2_Special_Edition]
mov edx, dword [str.Epic_MegaGames]
push ebp
push eax
push ecx
push edx
push str.Software_s_s_s_s
push 0x4f2b38
call fcn.004b57c2
add esp, 0x18
lea eax, [esp + 0x10]
mov ecx, dword [reloc.WSOCK32.dll_accept]
push eax
push 0x4f3418
push 0
push 0xf003f
push 0
push 0x4eff30
push 0
push 0x4f2b38
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [0x4f3418]
pop edi
lea eax, [esp + 8]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
push 0x4f32ec
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop esi
pop ebp
test eax, eax
je 0x492c44
xor eax, eax
add esp, 8
ret
mov eax, dword [esp + 0xc]
dec eax
neg eax
sbb eax, eax
not eax
and eax, 0x4f32ec
add esp, 8
ret
Function at 0x492c60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov al, byte [0x4d04b1]
mov dword [esp], 4
test al, al
je 0x492de0
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
push esi
jne 0x492c87
mov ebp, 0x4f3474
mov edx, dword [0x4f3418]
test edx, edx
je 0x492ccb
push ebx
mov esi, 0x4f3478
mov eax, ebp
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x492cbd
test cl, cl
je 0x492cb9
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x492cbd
add eax, 2
add esi, 2
test cl, cl
jne 0x492c99
xor eax, eax
jmp 0x492cc2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
je 0x492da9
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov dword [reloc.WSOCK32.dll_accept], 0x80000001
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4f3478
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test edx, edx
rep movsb byte es:[edi], byte [esi]
je 0x492d03
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x13
push 0x4c65f8
push ebp
call fcn.004b7060
add esp, 0xc
test eax, eax
jne 0x492d24
mov dword [reloc.WSOCK32.dll_accept], 0x80000002
add ebp, 0x13
cmp byte [ebp], 0x5c
jne 0x492d4f
lea edi, [ebp + 1]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4f2b38
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x492d76
mov eax, dword [0x4c933c]
mov ecx, dword [str.Jazz_Jackrabbit_2_Special_Edition]
mov edx, dword [str.Epic_MegaGames]
push ebp
push eax
push ecx
push edx
push str.Software_s_s_s_s
push 0x4f2b38
call fcn.004b57c2
add esp, 0x18
lea eax, [esp + 0x14]
mov ecx, dword [reloc.WSOCK32.dll_accept]
push eax
push 0x4f3418
push 0
push 0xf003f
push 0
push 0x4eff30
push 0
push 0x4f2b38
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [0x4f3418]
pop edi
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x24]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
pop esi
pop ebp
test eax, eax
jne 0x492de0
cmp dword [esp], 4
jne 0x492de0
mov eax, dword [esp + 0x10]
cmp eax, 3
mov eax, dword [esp + 4]
je 0x492de4
mov eax, dword [esp + 0x18]
add esp, 0xc
ret
Function at 0x492df0
Capabilities:
Set registry value

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
test ebp, ebp
push edi
jne 0x492e01
mov ebp, 0x4f3474
mov ebx, dword [0x4f3418]
test ebx, ebx
je 0x492e43
mov esi, 0x4f3478
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x492e36
test cl, cl
je 0x492e32
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x492e36
add eax, 2
add esi, 2
test cl, cl
jne 0x492e12
xor eax, eax
jmp 0x492e3b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x492f1f
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov dword [reloc.WSOCK32.dll_accept], 0x80000001
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4f3478
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
je 0x492e7a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x13
push 0x4c65f8
push ebp
call fcn.004b7060
add esp, 0xc
test eax, eax
jne 0x492e9b
mov dword [reloc.WSOCK32.dll_accept], 0x80000002
add ebp, 0x13
cmp byte [ebp], 0x5c
jne 0x492ec6
lea edi, [ebp + 1]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4f2b38
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x492eed
mov eax, dword [0x4c933c]
mov ecx, dword [str.Jazz_Jackrabbit_2_Special_Edition]
mov edx, dword [str.Epic_MegaGames]
push ebp
push eax
push ecx
push edx
push str.Software_s_s_s_s
push 0x4f2b38
call fcn.004b57c2
add esp, 0x18
lea eax, [esp + 0x14]
mov ecx, dword [reloc.WSOCK32.dll_accept]
push eax
push 0x4f3418
push 0
push 0xf003f
push 0
push 0x4eff30
push 0
push 0x4f2b38
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, dword [0x4f3418]
mov edx, dword [esp + 0x1c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x20]
push 1
push eax
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x492f50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 8]
test ebp, ebp
push esi
jne 0x492f5f
mov ebp, 0x4f3474
mov edx, dword [0x4f3418]
test edx, edx
je 0x492fa3
push ebx
mov esi, 0x4f3478
mov eax, ebp
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x492f95
test cl, cl
je 0x492f91
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x492f95
add eax, 2
add esi, 2
test cl, cl
jne 0x492f71
xor eax, eax
jmp 0x492f9a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
pop ebx
je 0x493081
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov dword [reloc.WSOCK32.dll_accept], 0x80000001
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4f3478
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test edx, edx
rep movsb byte es:[edi], byte [esi]
je 0x492fdb
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x13
push 0x4c65f8
push ebp
call fcn.004b7060
add esp, 0xc
test eax, eax
jne 0x492ffc
mov dword [reloc.WSOCK32.dll_accept], 0x80000002
add ebp, 0x13
cmp byte [ebp], 0x5c
jne 0x493027
lea edi, [ebp + 1]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4f2b38
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x49304e
mov eax, dword [0x4c933c]
mov ecx, dword [str.Jazz_Jackrabbit_2_Special_Edition]
mov edx, dword [str.Epic_MegaGames]
push ebp
push eax
push ecx
push edx
push str.Software_s_s_s_s
push 0x4f2b38
call fcn.004b57c2
add esp, 0x18
lea eax, [esp + 0x10]
mov ecx, dword [reloc.WSOCK32.dll_accept]
push eax
push 0x4f3418
push 0
push 0xf003f
push 0
push 0x4eff30
push 0
push 0x4f2b38
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [0x4f3418]
pop edi
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push 4
push eax
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
pop ebp
ret
Function at 0x494c40
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4f40dc]
sub esp, 0x38
test eax, eax
push esi
push edi
je 0x494c5b
push 0
call eax
add esp, 4
pop edi
pop esi
add esp, 0x38
ret
mov al, byte [0x4f40a5]
cmp al, 1
je 0x494ccb
mov cl, byte [0x4f40c1]
test cl, cl
jne 0x494ccb
test al, al
jne 0x494ddf
mov al, byte [0x4d124c]
mov ecx, 0xe
mov esi, 0x4f4088
lea edi, [esp + 8]
cmp al, 4
rep movsd dword es:[edi], dword [esi]
jne 0x494c96
mov byte [esp + 0x24], 2
jmp 0x494c9f
cmp al, 5
jne 0x494c9f
mov byte [esp + 0x24], 1
mov eax, dword [0x4f40d4]
test eax, eax
je 0x494cb8
lea ecx, [esp + 8]
push ecx
call eax
add esp, 4
pop edi
pop esi
add esp, 0x38
ret
lea edx, [esp + 8]
push edx
call fcn.00493c40
add esp, 4
pop edi
pop esi
add esp, 0x38
ret
or dword [0x4f40e4], 1
call fcn.0048db40
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, eax
mov eax, dword [0x4f412c]
mov byte [0x4f3440], 1
test eax, eax
je 0x494d93
cmp byte [0x4d124c], 5
jne 0x494d93
mov eax, dword [0x4f33fc]
push 0
push eax
call esi
mov ecx, dword [0x4f33fc]
push 0x300
push 0xffffffffffffffec
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [0x4f412c]
mov ecx, dword [0x4f33fc]
push 8
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x50]
test eax, eax
je 0x494d88
mov cl, byte [0x4f40c0]
test cl, cl
jne 0x494d88
xor edx, edx
mov ecx, 0x4d1730
cmp dword [ecx], eax
je 0x494d57
add ecx, 8
inc edx
cmp ecx, str.X_Alignment_error
jl 0x494d47
cmp edx, 0x60
jne 0x494d7b
push eax
push str.Unknown_DirectDraw_error_code__08X
push 0x4f3b84
call fcn.004b57c2
add esp, 0xc
mov dword [0x4f40f0], 0x4f3b84
jmp 0x494d88
mov edx, dword [edx*8 + 0x4d1734]
mov dword [0x4f40f0], edx
mov eax, dword [0x4f412c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edx, dword [0x4f33fc]
push 2
push edx
call esi
mov ecx, dword [0x4f40e4]
and ecx, 0xfffffffe
mov dword [0x4f40e4], ecx
mov al, byte [0x62bcf4]
mov byte [0x4f40f8], al
mov al, byte [0x62bcf4]
test al, al
je 0x494dc5
call fcn.00498660
call fcn.00494f80
call fcn.0048db40
mov ecx, dword [0x4f3408]
sub eax, edi
add ecx, eax
mov dword [0x4f3408], ecx
pop edi
pop esi
add esp, 0x38
ret
Function at 0x494e50
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov bl, cl
mov ecx, dword [0x4f40e4]
push esi
or ecx, 1
push edi
mov dword [0x4f40e4], ecx
call fcn.0048db40
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, eax
mov eax, dword [0x4f412c]
mov byte [0x4f3440], 1
test eax, eax
je 0x494f25
cmp byte [0x4d124c], 5
jne 0x494f25
mov eax, dword [0x4f33fc]
push 0
push eax
call esi
mov ecx, dword [0x4f33fc]
push 0x300
push 0xffffffffffffffec
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [0x4f412c]
mov ecx, dword [0x4f33fc]
push 8
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x50]
test eax, eax
je 0x494f1a
mov cl, byte [0x4f40c0]
test cl, cl
jne 0x494f1a
xor edx, edx
mov ecx, 0x4d1730
cmp dword [ecx], eax
je 0x494ee9
add ecx, 8
inc edx
cmp ecx, str.X_Alignment_error
jl 0x494ed9
cmp edx, 0x60
jne 0x494f0d
push eax
push str.Unknown_DirectDraw_error_code__08X
push 0x4f3b84
call fcn.004b57c2
add esp, 0xc
mov dword [0x4f40f0], 0x4f3b84
jmp 0x494f1a
mov edx, dword [edx*8 + 0x4d1734]
mov dword [0x4f40f0], edx
mov eax, dword [0x4f412c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edx, dword [0x4f33fc]
push 2
push edx
call esi
mov ecx, dword [0x4f40e4]
and ecx, 0xfffffffe
mov dword [0x4f40e4], ecx
mov al, byte [0x62bcf4]
mov byte [0x4f40f8], al
mov al, byte [0x62bcf4]
test al, al
je 0x494f57
call fcn.00498660
test bl, bl
je 0x494f60
call fcn.00494f80
call fcn.0048db40
mov ecx, dword [0x4f3408]
sub eax, edi
add ecx, eax
pop edi
pop esi
mov dword [0x4f3408], ecx
pop ebx
ret
Function at 0x4988b0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
test esi, esi
je 0x498974
mov al, byte [esi + 4]
mov bl, 1
cmp al, bl
jne 0x498974
mov al, byte [esi + 6]
test al, al
jne 0x498974
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x4988e5
pop edi
mov al, bl
pop esi
pop ebx
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x10c]
lea eax, [esp + 0x10]
push 0
push eax
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49890f
cmp dword [esp + 0x10], edi
jne 0x49890f
pop edi
mov al, bl
pop esi
pop ebx
ret
mov al, byte [esi + 5]
test al, al
je 0x49891f
mov byte [esi + 6], bl
pop edi
pop esi
xor al, al
pop ebx
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
jne 0x498938
cmp dword [esp + 0x10], edi
je 0x498938
push str.Unable_to_write_all_bytes
jmp 0x49895e
push 0
push 0x1fe
push 0x4f5d40
push 0x400
call ebx
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x4f5d40
add esi, 7
push esi
push str.fileWrite
push str.Fatal_Error_in__s_on_file___s___error:__s
call fcn.0048d820
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x498980
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
je 0x498a47
mov al, byte [esi + 4]
test al, al
jne 0x498a47
mov al, byte [esi + 6]
test al, al
jne 0x498a47
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x4989b1
pop edi
mov al, 1
pop esi
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x10c]
lea eax, [esp + 0xc]
push 0
push eax
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4989da
cmp dword [esp + 0xc], edi
jne 0x4989da
pop edi
mov al, 1
pop esi
ret
mov al, byte [esi + 5]
push ebx
test al, al
je 0x4989ec
pop ebx
mov byte [esi + 6], 1
pop edi
xor al, al
pop esi
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
jne 0x498a05
cmp dword [esp + 0x10], edi
je 0x498a05
push str.Input_past_end_of_file
jmp 0x498a2b
push 0
push 0x1fe
push 0x4f5d40
push 0x400
call ebx
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x4f5d40
add esi, 7
push esi
push str.fileRead
push str.Fatal_Error_in__s_on_file___s___error:__s
call fcn.0048d820
add esp, 0x10
xor al, al
pop ebx
pop edi
pop esi
ret
pop edi
xor al, al
pop esi
ret

Function at 0x498b80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x498b93
xor al, al
ret
not al
shr al, 4
and al, 1
ret
Function at 0x499770
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
test ebp, ebp
push edi
je 0x4998a9
cmp byte [ebp + 0xc], 5
jae 0x4998a9
cmp dword [ebp], 0x4b434f53
jne 0x4998a9
mov al, byte [ebp + 0xd]
test al, al
je 0x4997df
mov dword [0x4fa06c], 0x17
xor ecx, ecx
mov eax, 0x4d2b90
cmp byte [eax], 0x17
je 0x4997cb
add eax, 8
inc ecx
cmp eax, 0x4d2ba8
jl 0x4997af
mov ecx, dword [0x4fa068]
push ecx
jmp 0x4998e0
mov eax, dword [ecx*8 + 0x4d2b94]
mov ecx, eax
mov dword [0x4fa068], eax
push ecx
jmp 0x4998e0
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x499823
mov bl, byte [esp + 0x20]
mov edi, dword [esp + 0x18]
mov edx, dword [ebp + 8]
push 0
push esi
push edi
push edx
call sub.WSOCK32.dll_send
cmp eax, esi
je 0x499823
cmp eax, 0xffffffff
jne 0x49981b
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x49982a
test bl, bl
je 0x4998f2
jmp 0x49981f
add edi, eax
sub esi, eax
test esi, esi
jg 0x4997ef
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
call sub.WSOCK32.dll_WSAGetLastError
mov esi, eax
xor edx, edx
mov ecx, 0x4d2a1c
cmp dword [ecx], esi
je 0x49984a
add ecx, 0xc
inc edx
cmp ecx, 0x4d2b90
jl 0x499838
jmp 0x499876
lea ecx, [edx + edx*2]
xor eax, eax
shl ecx, 2
mov al, byte [ecx + 0x4d2a19]
mov dword [0x4fa06c], eax
mov eax, dword [ecx + 0x4d2a20]
mov dword [0x4fa068], eax
mov al, byte [ecx + 0x4d2a18]
test al, al
je 0x499876
mov byte [ebp + 0xd], 1
cmp edx, 0x1f
jne 0x4998f2
push esi
push str.Unknown_Error__u
push 0x4f5fcc
call fcn.004b57c2
add esp, 0xc
mov dword [0x4fa06c], 1
mov dword [0x4fa068], 0x4f5fcc
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [0x4fa06c], 0x16
xor ecx, ecx
mov eax, 0x4d2b90
cmp byte [eax], 0x16
je 0x4998cc
add eax, 8
inc ecx
cmp eax, 0x4d2ba8
jl 0x4998ba
jmp 0x4998d9
mov ecx, dword [ecx*8 + 0x4d2b94]
mov dword [0x4fa068], ecx
mov edx, dword [0x4fa068]
push edx
push str.netWrite
push str.NET:__s_failed:__s
call fcn.0048edc0
add esp, 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret