joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4405d0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49c811
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x4c7650]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
xor edi, edi
mov dword [ebp - 0x10], edi
mov dword [esi + 8], edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov eax, dword [0x4c72d4]
mov edx, dword [eax + 0xc]
mov ecx, 0x4c72d4
call edx
add eax, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [0x4c72d4]
mov edx, dword [eax + 0xc]
mov ecx, 0x4c72d4
call edx
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], ecx
push esi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x28], eax
call fcn.004051c0
push 0x4e2c50
lea ecx, [ebp - 0x1c]
call fcn.004051c0
push edi
push edi
lea edx, [ebp - 0x28]
push edx
push 0x440790
push edi
push edi
call fcn.0047e1bd
add esp, 0x18
mov esi, eax
push esi
lea ecx, [ebp - 0x18]
call fcn.00476dc0
mov eax, dword [ebp + 0x14]
push eax
push esi
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x44069a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
push eax
call fcn.00405350
lea esi, [eax + 0x10]
add esp, 4
mov dword [ebp + 0xc], esi
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
mov edi, dword [ebp + 8]
push ecx
push edi
call fcn.00440ea0
lea eax, [esi - 0x10]
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4406e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00476de0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x440716
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x440735
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4427e0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x4c7650]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4d08fc], 0
jne 0x442833
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x44281c
push str.adb:_could_not_initialize_Winsock_n
call fcn.00441b20
push 0x4427d0
call fcn.0047a87e
add esp, 4
mov dword [0x4d08fc], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004799e1
mov esp, ebp
pop ebp
ret

Function at 0x442850
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4c7650]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, 0x4a82b0
call fcn.004421e0
mov esi, eax
xor edi, edi
cmp esi, edi
je 0x4428dd
cmp dword [0x4d08fc], edi
jne 0x442885
call fcn.004427e0
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov eax, 2
push ebx
mov word [ebp - 0x18], ax
call dword [sym.imp.WSOCK32.dll_htons]
push 0x7f000001
mov word [ebp - 0x16], ax
call dword [sym.imp.WSOCK32.dll_htonl]
push edi
push 1
push 2
mov dword [ebp - 0x14], eax
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
jne 0x4428f1
cmp dword [esi + 4], edi
je 0x4428dd
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
add esp, 4
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi], edi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004799e1
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [esi + 0xc], eax
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
jns 0x442931
cmp dword [esi + 4], edi
je 0x4428dd
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
add esp, 4
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi], edi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004799e1
mov esp, ebp
pop ebp
ret
push ebx
push 0x4a6a35
mov eax, esi
call fcn.004421a0
push eax
lea ecx, [esi + 0x18]
push str._d_lo_client:_s_d_
push ecx
call fcn.0047a69d
add esp, 0x14
mov eax, esi
call fcn.004421a0
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004799e1
mov esp, ebp
pop ebp
ret

Function at 0x4435f0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push edi
push str.shell:
call fcn.00445ba0
mov esi, eax
add esp, 4
test esi, esi
jns 0x443626
push 0x4e29a0
push str.error:__s_n
mov edi, 0x4e2c64
call fcn.00441fe0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 8
call fcn.0047a895
add esp, 4
push eax
push 0
push 0x443400
mov dword [eax], esi
mov dword [eax + 4], 0
call fcn.0047eaa7
add esp, 0xc
push esi
call fcn.00443310
add esp, 4
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x44819c
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
xor edi, edi
call esi
test ax, ax
jns 0x4481b2
push 8
pop edi
push 2
call esi
test ax, ax
jns 0x4481be
or edi, 1
push 1
call esi
test ax, ax
jns 0x4481ca
or edi, 2
push 0x10
call esi
test ax, ax
jns 0x4481d6
or edi, 4
push 0x12
call esi
test ax, ax
jns 0x4481e2
or edi, 0x20
mov eax, edi
pop edi
pop esi
ret
Function at 0x44a0ca
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi]
cmp eax, ecx
je 0x44a0f0
cmp ebx, dword [esi + 0x54]
je 0x44a0f0
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x54]
cmp ebx, eax
je 0x44a1b9
test eax, eax
je 0x44a147
push 7
pop ecx
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x14
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [esp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ecx]
push edx
call dword [eax + pe_nt_image_headers32]
mov ecx, dword [esi + 0x54]
push 0
push 0
push str.killfocus
mov edi, esi
call fcn.0044a6f2
and dword [esi + 0x54], 0
test ebx, ebx
je 0x44a1b9
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
cmp eax, esi
jne 0x44a1b9
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc0]
test al, al
je 0x44a1b9
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xcc]
test al, al
je 0x44a1b9
push 7
pop ecx
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov dword [esi + 0x54], ebx
mov dword [esp + 8], 0x15
mov dword [esp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [esp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [ecx]
push edx
call dword [eax + pe_nt_image_headers32]
mov ecx, dword [esi + 0x54]
push 0
push 0
push str.setfocus
mov edi, esi
call fcn.0044a6f2
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x456ad5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test ecx, ecx
jne 0x456ae7
xor eax, eax
jmp 0x456bb7
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x456b9b
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4a7e98]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4a7e98]
movzx ebx, byte [ecx + 2]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4a7e98]
movzx ebx, byte [ecx + 3]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4a7e98]
movzx ebx, byte [ecx + 4]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4a7e98]
movzx ebx, byte [ecx + 5]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4a7e98]
movzx ebx, byte [ecx + 6]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4a7e98]
movzx ebx, byte [ecx + 7]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4a7e98]
add ecx, 8
sub edi, 8
dec esi
jne 0x456afe
pop ebx
test edi, edi
je 0x456bb4
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x4a7e98]
inc ecx
dec edi
jne 0x456b9f
not eax
pop esi
pop edi
pop ebp
ret

Function at 0x457386
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x4573b6
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4573b1
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x4573de
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x4573c7
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.0047c8d0
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret

Function at 0x458051
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [esi], 0
push edi
jne 0x4580c8
cmp dword [esi + 4], 0xffffffff
jne 0x4580c8
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4b0ca8
push edi
call fcn.0047f4bc
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
jne 0x45809a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x45809a
mov eax, 0x2000000
jmp 0x4580cd
mov edi, dword [ebp + 0x10]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004571ca
add esp, 0xc
test eax, eax
jne 0x4580b8
mov eax, dword [ebp + 8]
jmp 0x4580cd
push eax
call fcn.0045762e
mov dword [esi], eax
mov eax, dword [0x4e2ae0]
pop ecx
jmp 0x4580cd
mov eax, 0x1000000
pop edi
pop ebp
ret 0xc
Function at 0x45968c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x4d4], ebx
je 0x4596f6
cmp dword [ebp + 8], 0x100
jne 0x4596e5
cmp word [ebp + 0xc], 0xd
jne 0x4596e5
cmp byte [esi + 0x4da], bl
je 0x4596ca
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4596e5
cmp byte [esi + 0x4db], bl
jne 0x4596e5
push edi
mov edi, dword [esi + 0x40]
cmp edi, ebx
je 0x4596e0
push ebx
push ebx
push str.return
mov ecx, esi
call fcn.0044a6f2
xor eax, eax
pop edi
jmp 0x4596f9
mov eax, dword [esi + 0x4d4]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop esi
pop ebx
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4615cf
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2d0
mov eax, 0x49b4a0
call fcn.00481051
mov eax, dword [ebp + 8]
mov edi, ecx
mov esi, edi
mov dword [ebp - 0x2d8], edi
mov dword [ebp - 0x2d4], eax
call fcn.00461847
call fcn.0044879d
push eax
lea eax, [ebp - 0x9c]
call fcn.0044c6e9
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.004487a3
mov edx, eax
call fcn.0044c82f
test al, al
je 0x461720
push dword [ebp - 0x2d4]
lea eax, [ebp - 0x9c]
call fcn.0044c903
push ebx
push 0x80
push 3
push ebx
push 1
push connect
lea eax, [ebp - 0x9c]
call fcn.0044c68e
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d0], eax
push ebx
cmp eax, 0xffffffff
jne 0x461682
push 0x4b15d4
mov eax, edi
call fcn.00461e19
mov bl, al
lea ecx, [ebp - 0x9c]
call fcn.0044c70c
mov al, bl
call fcn.0048109b
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
jne 0x46169d
push ebx
push str.File_is_empty
mov eax, dword [ebp - 0x2d8]
jmp 0x461666
cmp edi, 0x400000
jbe 0x4616ad
push ebx
push str.File_too_large
jmp 0x461695
push edi
mov dword [ebp - 0x2d4], ebx
call fcn.00477302
pop ecx
push ebx
mov esi, eax
lea eax, [ebp - 0x2d4]
push eax
push edi
push esi
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2d4], edi
je 0x461705
push esi
call fcn.00479b81
mov esi, dword [ebp - 0x2d8]
pop ecx
call fcn.00461847
push ebx
push str.Could_not_read_file
mov eax, esi
jmp 0x461666
push edi
push esi
push dword [ebp - 0x2d8]
call fcn.00461543
push esi
mov bl, al
call fcn.00479b81
pop ecx
jmp 0x46166d
mov eax, edx
lea ecx, [ebp - 0x9c]
call fcn.0044c8f1
call fcn.004487a9
test al, al
je 0x46173d
call fcn.004487af
jmp 0x461754
push 2
push ebx
lea eax, [ebp - 0x9c]
call fcn.0044c68e
push eax
call fcn.004585f4
add esp, 0xc
mov dword [ebp - 0x2d0], eax
cmp eax, ebx
jne 0x461769
push ebx
push str.Error_opening_zip_file
jmp 0x461664
mov edx, dword [ebp - 0x2d4]
lea eax, [ebp - 0x2cc]
push eax
push dword [ebp - 0x2d0]
lea ecx, [ebp - 0x2dc]
call fcn.00458650
pop ecx
pop ecx
test eax, eax
je 0x461798
push ebx
push str.Could_not_find_ziped_file
jmp 0x461664
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x2d4], eax
cmp eax, ebx
jne 0x4617b3
push ebx
push str.File_is_empty
jmp 0x461664
cmp eax, 0x400000
jbe 0x4617c5
push ebx
push str.File_too_large
jmp 0x461664
push eax
call fcn.00477302
pop ecx
push dword [ebp - 0x2d4]
mov esi, eax
mov eax, dword [ebp - 0x2d0]
push esi
push dword [ebp - 0x2dc]
call fcn.00458720
add esp, 0xc
cmp eax, ebx
je 0x461820
cmp eax, 0x600
je 0x461820
push esi
call fcn.00479b81
pop ecx
call fcn.004487a9
test al, al
jne 0x461815
mov edi, dword [ebp - 0x2d0]
call fcn.00458755
mov edi, dword [ebp - 0x2d8]
push ebx
push str.Could_not_unzip_file
jmp 0x461664
call fcn.004487a9
test al, al
jne 0x46183a
mov edi, dword [ebp - 0x2d0]
call fcn.00458755
mov edi, dword [ebp - 0x2d8]
push dword [ebp - 0x2d4]
push esi
push edi
jmp 0x46170d
Function at 0x4695c8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x4695ed
cmp eax, edi
jge 0x4695e5
mov eax, esi
call fcn.00468f86
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edi, dword [esi + 8]
xor ecx, ecx
test edi, edi
jle 0x46961a
mov eax, dword [esi + 0xc]
push ebx
mov dl, byte [esi + 0xc]
sub edi, 8
mov byte [ebp + ecx - 4], dl
shr eax, 8
mov ebx, edi
inc ecx
mov dword [esi + 0xc], eax
test ebx, ebx
jg 0x4695fa
mov dword [esi + 8], ebx
pop ebx
cmp ecx, 4
jge 0x469639
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x469627
xor eax, eax
jmp 0x46962f
mov dl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, dl
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x46961d
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x46966b
mov eax, str.zlib_corrupt
call fcn.004667ca
jmp 0x4696a6
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x46967b
mov eax, str.read_past_buffer
jmp 0x469664
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x469690
mov ecx, edi
call fcn.00468fbc
test eax, eax
je 0x4696a6
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0047c8d0
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret

Function at 0x46f01a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4c7650]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
push edi
je 0x46f088
cmp dword [esi + 0x10], 0
je 0x46f088
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.004848c0
mov ebx, esp
test ebx, ebx
je 0x46f088
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0x10]
push ebx
add eax, 0x1b8
call fcn.0044c878
mov esi, dword [esi + 0x10]
mov eax, dword [esi]
push 0
push 0
push str.textchanged
mov ecx, esi
call dword [eax + 0x1c]
mov ecx, esi
mov edi, eax
call fcn.0044a6f2
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004799e1
leave
ret
Function at 0x47328b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x4c7650]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x10], eax
and dword [eax + 0x5b8], 0
cmp dword [ebx + 4], 0
push esi
push edi
jne 0x473318
lea eax, [ebp - 0xa4]
push eax
mov eax, ebx
call fcn.00473396
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0xa4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
push 0x40000000
movsd dword es:[edi], dword [esi]
call dword [eax + 0x1c]
call fcn.0044c68e
push eax
push ebx
call fcn.0044bf2d
mov ecx, dword [ebx + 0x10]
mov eax, ecx
call fcn.004637a9
mov esi, eax
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, esi
mov esi, eax
call fcn.0044ad18
push 1
push dword [eax]
push 0x30
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
lea edx, [ebp - 0x90]
push edx
call dword [eax + 0x28]
call fcn.0044c82f
lea ecx, [ebp - 0x90]
mov byte [ebp - 0x91], al
call fcn.0044c70c
cmp byte [ebp - 0x91], 0
mov esi, 0x5a8
je 0x473357
mov eax, dword [ebx + 0x10]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebx + 0x10]
add eax, esi
push eax
push 0
push 0x1002
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov byte [ebx + 0x18], 1
xor ecx, ebp
pop ebx
call fcn.004799e1
leave
ret 8
Function at 0x474930
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49d588
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x4c7650]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor ebx, ebx
lea esi, [esp + 0xc]
mov dword [esp + 0xc], 0x4e2e24
mov byte [esp + 0x10], bl
call fcn.00438ea0
mov dword [esp + 0x20], ebx
mov eax, dword [0x4e2af0]
cmp eax, ebx
jne 0x4749ca
push 0x18
call fcn.0047a58d
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x4749c3
push ebx
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
push 1
push ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
push esi
push 0x474820
push ebx
push ebx
mov dword [esi + 4], eax
call fcn.0047e1bd
mov dword [esi], eax
add esp, 0x18
mov eax, esi
jmp 0x4749c5
xor eax, eax
mov dword [0x4e2af0], eax
mov dword [esp + 0x20], 0xffffffff
mov esi, eax
cmp byte [esp + 0x10], bl
je 0x474a0e
mov eax, dword [esp + 0xc]
mov ecx, connect
mov edx, eax
lock xadd dword [edx], ecx
test ecx, 0x40000000
jne 0x474a0e
cmp ecx, 0x80000000
jle 0x474a0e
mov ecx, eax
lock bts dword [ecx], 0x1e
jb 0x474a0e
call fcn.00431f60
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474ea0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4981b0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4c7650]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 0x10], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
cmp eax, ebx
jbe 0x475023
push eax
call fcn.00477302
mov esi, eax
add esp, 4
mov dword [ebp - 0x24], esi
mov edx, dword [ebp - 0x10]
mov eax, dword [edi]
push esi
push edx
push ebx
push eax
mov dword [ebp - 4], ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x475013
mov eax, dword [0x4c72d4]
mov edx, dword [eax + 0xc]
mov ecx, 0x4c72d4
mov dword [ebp + 0xc], ebx
call edx
lea edi, [eax + 0x10]
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
push ecx
push str.VarFileInfoTranslation
push esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x474f97
mov ecx, dword [ebp + 8]
push 0x4aa0c0
call fcn.00405910
lea eax, [edi - 0x10]
mov byte [ebp - 4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x474f79
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
call fcn.004799d6
mov eax, dword [ebp + 8]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
movzx ecx, word [eax + 2]
push edx
movzx edx, word [eax]
push ecx
push edx
lea eax, [ebp - 0x14]
push 0x4a2a6c
push eax
call fcn.004052b0
mov edi, dword [ebp - 0x14]
add esp, 0x14
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x18]
push edx
push edi
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x474ff4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
push eax
call fcn.00405910
lea eax, [edi - 0x10]
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x474f6d
lea eax, [edi - 0x10]
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x475013
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.004799d6
add esp, 4
mov esi, dword [ebp + 8]
push 0x4aa0c0
mov ecx, esi
call fcn.00405910
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4982a0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4c7650]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x4c72d4]
mov edx, dword [eax + 0xc]
mov ecx, 0x4c72d4
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
xor esi, esi
push eax
mov ecx, edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
call fcn.00475250
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004051c0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x475392
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0x10]
push esi
push 0x80
push 4
push esi
push 1
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 2
push 0
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
push 0
lea edx, [ebp - 0x18]
push edx
add ecx, ecx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4753fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret