joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459d54
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x459d6f
mov esi, dword [eax + 4]
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
push edi
call sub.WSOCK32.dll_getsockname
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d12a8], eax
lea eax, [ebp - 0xbc]
push eax
mov edx, dword [0x4d12a8]
push edx
call fcn.0045ae24
add esp, 8
lea ecx, [ebp - 0xbc]
push ecx
push ebx
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0xa0]
push eax
mov edx, dword [ebp + 0x10]
push edx
push edi
push esi
push str.Sock_ID_lu_getsockname__u_0x_p_0x_p_______d___s_
push ecx
call fcn.0049d914
add esp, 0x20
lea eax, [ebp - 0xa0]
mov edx, dword [0x4bef10]
mov ecx, dword [0x4bef0c]
push eax
push 0
push edx
push ecx
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x45a3dc
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x45a3f7
mov esi, dword [eax + 4]
mov eax, dword [ebp + 0x18]
push eax
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
call sub.WSOCK32.dll_recv
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d12a8], eax
lea eax, [ebp - 0xbc]
push eax
mov edx, dword [0x4d12a8]
push edx
call fcn.0045ae24
add esp, 8
lea ecx, [ebp - 0xbc]
push ecx
push ebx
mov eax, dword [ebp + 0x18]
push eax
lea eax, [ebp - 0xa0]
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
push esi
push str.Sock_ID_lu_recv__u_0x_p__d__d_______d___s_
push eax
call fcn.0049d914
add esp, 0x24
lea edx, [ebp - 0xa0]
mov ecx, dword [0x4bef10]
mov eax, dword [0x4bef0c]
push edx
push 0
push ecx
push eax
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x45a47c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x45a497
mov esi, dword [eax + 4]
mov eax, dword [ebp + 0x20]
push eax
mov edx, dword [ebp + 0x1c]
push edx
mov ecx, dword [ebp + 0x18]
push ecx
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
push edi
call sub.WSOCK32.dll_recvfrom
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d12a8], eax
lea eax, [ebp - 0xbc]
push eax
mov edx, dword [0x4d12a8]
push edx
call fcn.0045ae24
add esp, 8
lea ecx, [ebp - 0xbc]
push ecx
push ebx
mov eax, dword [ebp + 0x20]
push eax
mov edx, dword [ebp + 0x1c]
push edx
mov ecx, dword [ebp + 0x18]
push ecx
lea ecx, [ebp - 0xa0]
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
push edi
push esi
push str.Sock_ID_lu_recvfrom__u_0x_p__d__d_0x_p_0x_p_______d___s_
push ecx
call fcn.0049d914
add esp, 0x2c
lea eax, [ebp - 0xa0]
mov edx, dword [0x4bef10]
mov ecx, dword [0x4bef0c]
push eax
push 0
push edx
push ecx
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x45a52c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x45a547
mov esi, dword [eax + 4]
mov eax, dword [ebp + 0x18]
push eax
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
call sub.WSOCK32.dll_send
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d12a8], eax
lea eax, [ebp - 0xbc]
push eax
mov edx, dword [0x4d12a8]
push edx
call fcn.0045ae24
add esp, 8
lea ecx, [ebp - 0xbc]
push ecx
push ebx
mov eax, dword [ebp + 0x18]
push eax
lea eax, [ebp - 0xa0]
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
push edi
push esi
push str.Sock_ID_lu_send__u_0x_p__d__d_______d___s_
push eax
call fcn.0049d914
add esp, 0x24
lea edx, [ebp - 0xa0]
mov ecx, dword [0x4bef10]
mov eax, dword [0x4bef0c]
push edx
push 0
push ecx
push eax
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x45a5cc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x45a5e7
mov esi, dword [eax + 4]
mov eax, dword [ebp + 0x20]
push eax
mov edx, dword [ebp + 0x1c]
push edx
mov ecx, dword [ebp + 0x18]
push ecx
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
push edi
call sub.WSOCK32.dll_sendto
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d12a8], eax
lea eax, [ebp - 0xbc]
push eax
mov edx, dword [0x4d12a8]
push edx
call fcn.0045ae24
add esp, 8
lea ecx, [ebp - 0xbc]
push ecx
push ebx
mov eax, dword [ebp + 0x20]
push eax
mov edx, dword [ebp + 0x1c]
push edx
mov ecx, dword [ebp + 0x18]
push ecx
lea ecx, [ebp - 0xa0]
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
push edi
push esi
push str.Sock_ID_lu_sendto__u_0x_p__d__d_0x_p__d_______d___s_
push ecx
call fcn.0049d914
add esp, 0x2c
lea eax, [ebp - 0xa0]
mov edx, dword [0x4bef10]
mov ecx, dword [0x4bef0c]
push eax
push 0
push edx
push ecx
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x45ab88
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x45aba3
mov esi, dword [eax + 4]
push edi
call sub.WSOCK32.dll_gethostbyname
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d12a8], eax
lea eax, [ebp - 0xbc]
push eax
mov edx, dword [0x4d12a8]
push edx
call fcn.0045ae24
add esp, 8
lea ecx, [ebp - 0xbc]
push ecx
push ebx
push edi
push esi
push str.Sock_ID_lu_gethostbyname__s______0x_p___s_
lea eax, [ebp - 0xa0]
push eax
call fcn.0049d914
add esp, 0x18
lea edx, [ebp - 0xa0]
mov ecx, dword [0x4bef10]
mov eax, dword [0x4bef0c]
push edx
push 0
push ecx
push eax
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45ac10
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x45ac2b
mov esi, dword [eax + 4]
mov eax, dword [ebp + 0x10]
push eax
push edi
call sub.WSOCK32.dll_gethostname
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d12a8], eax
lea eax, [ebp - 0xbc]
push eax
mov edx, dword [0x4d12a8]
push edx
call fcn.0045ae24
add esp, 8
lea ecx, [ebp - 0xbc]
push ecx
push ebx
mov eax, dword [ebp + 0x10]
push eax
push edi
push esi
push str.Sock_ID_lu_gethostname__s__d_______d___s_
lea edx, [ebp - 0xa0]
push edx
call fcn.0049d914
add esp, 0x1c
lea ecx, [ebp - 0xa0]
mov eax, dword [0x4bef10]
mov edx, dword [0x4bef0c]
push ecx
push 0
push eax
push edx
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45aca0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test eax, eax
je 0x45acbb
mov esi, dword [eax + 4]
mov eax, dword [ebp + 0x10]
push eax
push edi
call sub.WSOCK32.dll_WSAStartup
mov ebx, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [0x4d12a8], eax
lea eax, [ebp - 0xbc]
push eax
mov edx, dword [0x4d12a8]
push edx
call fcn.0045ae24
movzx edx, di
add esp, 8
lea ecx, [ebp - 0xbc]
push ecx
push ebx
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0xa0]
push eax
push edx
push esi
push str.Sock_ID_lu_WSAStartup_0x_X_0x_p_______d___s_
push ecx
call fcn.0049d914
add esp, 0x1c
lea eax, [ebp - 0xa0]
mov edx, dword [0x4bef10]
mov ecx, dword [0x4bef0c]
push eax
push 0
push edx
push ecx
call sub.USER32.dll_SendMessageA
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45c2cc
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ebx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dl, al
mov ecx, edx
mov ebx, edx
sar ebx, 1
sar ecx, 0
and bl, 1
and cl, 1
shl ecx, 5
shl ebx, 3
add cl, bl
mov ebx, edx
sar ebx, 2
and bl, 1
shl ebx, 2
add cl, bl
mov ebx, edx
sar ebx, 3
and bl, 1
add ebx, ebx
add cl, bl
mov ebx, edx
sar edx, 5
sar ebx, 4
and dl, 1
and bl, 1
shl edx, 4
add cl, bl
add cl, dl
mov edx, dword [ebp + 8]
shl edx, 6
mov eax, ecx
and eax, 0xff
lea ecx, [edx + 0x4c08b0]
xor edx, edx
mov al, byte [ecx + eax]
xor ecx, ecx
mov dl, al
mov cl, al
sar ecx, 2
sar edx, 3
and cl, 1
add ecx, ecx
and dl, 1
add dl, cl
xor ecx, ecx
mov cl, al
and eax, 0xff
sar ecx, 1
sar eax, 0
and cl, 1
shl ecx, 2
and al, 1
shl eax, 3
add dl, cl
add dl, al
mov eax, edx
pop ebx
pop ebp
ret
Function at 0x4751ba
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0x4c5788
call fcn.0049af0c
mov word [ebp - 0x14], 8
push dword [ebp + 8]
call fcn.0047418c
pop ecx
push dword [ebp + 0x10]
push ebx
call sub.USER32.dll_LoadIconA
mov edx, dword [ebp + 8]
mov dword [edx], eax
test ebx, ebx
setne cl
and ecx, 1
mov eax, dword [ebp + 8]
mov byte [eax + 4], cl
push 0x7fe3
push dword [ebp + 8]
call fcn.004741ef
add esp, 8
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebp + 8]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x480933
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
cmp word [ebx + 0x10], 0xffff
je 0x4809a3
mov eax, dword [ebx + 0x10]
shr eax, 0x10
test ax, ax
je 0x480957
push dword [ebx + 0x10]
call fcn.004a4f68
pop ecx
push dword [ebx + 0xc]
call sub.USER32.dll_GetWindowTextLengthA
mov esi, eax
test esi, esi
jge 0x480979
push 0
push 0x4c7eaa
call fcn.00497430
add esp, 8
mov dword [ebx + 0x10], eax
jmp 0x4809a3
lea eax, [esi + 1]
push eax
call fcn.004a4fc0
pop ecx
mov dword [ebx + 0x10], eax
mov edx, dword [ebx + 0x10]
mov byte [edx], 0
mov ecx, dword [ebx + 0x10]
mov byte [ecx + esi], 0
lea eax, [esi + 1]
mov edx, dword [ebx + 0x10]
push eax
push edx
push dword [ebx + 0xc]
call sub.USER32.dll_GetWindowTextA
pop esi
pop ebx
pop ebp
ret

Function at 0x48871d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push dword [edi + 0x10]
mov eax, dword [edi]
push dword [eax + 0xc]
push 0x7ff8
push dword [edi]
call fcn.004807a1
add esp, 0x10
test eax, eax
je 0x488753
test eax, eax
setg dl
and edx, 1
mov eax, edx
jmp 0x488809
mov bl, 1
cmp dword [edi + 0x10], 0
je 0x488807
mov esi, dword [edi + 0x10]
mov dword [ebp - 4], esi
push 0xf0
push dword [ebp - 4]
mov eax, dword [edi]
mov edx, dword [eax + 0x6c]
push dword [edx + 8]
call sub.KERNEL32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x488807
mov dword [ebp - 8], esi
push dword [ebp - 8]
mov ecx, dword [edi]
mov eax, dword [ecx + 0x6c]
push dword [eax + 8]
call sub.KERNEL32.dll_LoadResource
test eax, eax
je 0x488807
push eax
call sub.KERNEL32.dll_LockResource
mov esi, eax
test esi, esi
je 0x4887fc
jmp 0x4887f3
mov ax, word [esi]
mov word [ebp - 0xa], ax
add esi, 2
mov dx, word [esi]
mov word [ebp - 0xc], dx
add esi, 2
mov ecx, dword [esi]
mov dword [ebp - 0x10], ecx
add esi, 4
mov dword [ebp - 0x14], esi
movzx eax, word [ebp - 0xc]
mov dword [ebp - 0x18], eax
movzx edx, word [ebp - 0xa]
mov dword [ebp - 0x1c], edx
push dword [ebp - 0x14]
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
mov ecx, dword [edi]
push dword [ecx + 0xc]
call sub.USER32.dll_SendDlgItemMessageA
inc eax
jne 0x4887f0
xor ebx, ebx
add esi, dword [ebp - 0x10]
test bl, bl
je 0x4887fc
cmp byte [esi], 0
jne 0x4887a9
mov eax, dword [edi]
push dword [eax + 0x68]
call fcn.004831e1
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x488cae
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 5], 0
jne 0x488cd7
cmp byte [ebx + 0x1b], 0
je 0x488ccd
push dword [ebx]
call sub.KERNEL32.dll_LockResource
mov dword [ebx + 5], eax
jmp 0x488cd7
push dword [ebx]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebx + 5], eax
mov eax, dword [ebx + 5]
cmp dword [eax], 0x28
je 0x488cf5
push dword [ebx]
call sub.KERNEL32.dll_GlobalUnlock
push 0
push 0x7fdc
call fcn.004743e1
add esp, 8
mov edx, dword [ebx + 5]
cmp dword [edx + 0x10], 3
jne 0x488d12
mov ecx, dword [ebx + 5]
add ecx, 0x28
mov dword [ebx + 9], ecx
mov eax, dword [ebx + 5]
add eax, 0x34
mov dword [ebx + 0xd], eax
jmp 0x488d20
xor edx, edx
mov dword [ebx + 9], edx
mov ecx, dword [ebx + 5]
add ecx, 0x28
mov dword [ebx + 0xd], ecx
mov eax, dword [ebx + 5]
cmp dword [eax + 0x20], 0
je 0x488d31
mov edx, dword [ebx + 5]
mov ecx, dword [edx + 0x20]
jmp 0x488d41
mov eax, dword [ebx + 5]
mov dx, word [eax + 0xe]
push edx
call fcn.0049753c
pop ecx
mov ecx, eax
mov dword [ebx + 0x15], ecx
mov eax, dword [ebx + 0x15]
shl eax, 2
add eax, dword [ebx + 0xd]
mov dword [ebx + 0x11], eax
cmp dword [ebx + 0x15], 0
jne 0x488d5b
xor edx, edx
mov dword [ebx + 0xd], edx
mov word [ebx + 0x19], 0
pop ebx
pop ebp
ret

Function at 0x4894a1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 2
push dword [ebp + 0x10]
push edi
call sub.KERNEL32.dll_FindResourceA
mov esi, eax
test esi, esi
je 0x4894c7
push esi
push edi
call sub.KERNEL32.dll_LoadResource
jmp 0x4894c9
xor eax, eax
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x4894d4
xor eax, eax
jmp 0x4894e8
mov byte [ebx + 0x1b], 1
push ebx
call fcn.00488cae
pop ecx
push ebx
call fcn.00488d64
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x48a20f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0xfffffffffffffff0
mov eax, dword [ebx]
push dword [eax + 0xc]
call sub.USER32.dll_GetWindowLongA
test al, 4
je 0x48a257
call fcn.00497dc4
mov edi, eax
mov edx, dword [edi + 0x10]
cmp edx, 1
sete cl
and ecx, 1
test cl, cl
jne 0x48a257
call fcn.00497dc4
mov edi, eax
cmp dword [edi + 0x10], 0
sete al
and eax, 1
test al, al
je 0x48a285
test esi, esi
jne 0x48a268
mov edx, dword [ebx]
push dword [edx + 0xc]
call sub.USER32.dll_GetWindowTextLengthA
mov esi, eax
inc esi
push esi
call fcn.004a4fc0
pop ecx
mov edi, eax
mov eax, esi
mov edx, edi
push eax
push edx
mov ecx, dword [ebx]
push dword [ecx + 0xc]
call sub.USER32.dll_GetWindowTextA
mov eax, edi
jmp 0x48a2b3
push 0
push 0
push 0xbd
push dword [ebx]
call fcn.004807a1
add esp, 0x10
test esi, esi
je 0x48a2ad
push 0x42
push esi
push eax
call sub.KERNEL32.dll_LocalReAlloc
test eax, eax
jne 0x48a2ad
xor eax, eax
jmp 0x48a2b3
push eax
call sub.KERNEL32.dll_LocalLock
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x490ccd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0xc]
shr eax, 4
inc eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
push 6
push dword [ebp - 0xc]
push dword [esi + 8]
call sub.KERNEL32.dll_FindResourceA
mov edi, eax
test edi, edi
je 0x490d75
mov dword [ebp - 0x10], edi
push dword [ebp - 0x10]
push dword [esi + 8]
call sub.KERNEL32.dll_LoadResource
mov dword [ebp - 4], eax
test eax, eax
je 0x490d75
push dword [ebp - 4]
call sub.KERNEL32.dll_LockResource
mov edi, eax
test eax, eax
je 0x490d65
mov eax, dword [ebp + 0xc]
and eax, 0xf
jmp 0x490d2d
add ebx, ebx
add edi, ebx
mov bx, word [edi]
add edi, 2
movzx ebx, bx
mov edx, eax
add eax, 0xffffffff
test edx, edx
jne 0x490d29
test ebx, ebx
je 0x490d65
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push edi
push 0
push 0
call sub.KERNEL32.dll_WideCharToMultiByte
mov ebx, eax
test ebx, ebx
jbe 0x490d65
mov eax, dword [ebp + 0x10]
mov byte [eax + ebx], 0
push dword [ebp - 4]
call sub.KERNEL32.dll_FreeResource
test ebx, ebx
je 0x490d75
mov eax, ebx
jmp 0x490da4
cmp esi, dword [0x4cc944]
je 0x490d96
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [0x4cc944]
call fcn.00490ccd
add esp, 0x10
jmp 0x490da4
cmp dword [ebp + 0x14], 0
je 0x490da2
mov edx, dword [ebp + 0x10]
mov byte [edx], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4935a7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x4935c9
mov eax, dword [ebx + 0x14]
push eax
push edx
mov edx, dword [ebx]
push dword [edx + 0xc]
call sub.USER32.dll_GetWindowTextA
jmp 0x4935d9
dec eax
jne 0x4935d9
mov eax, edx
push eax
mov edx, dword [ebx]
push dword [edx + 0xc]
call sub.USER32.dll_SetWindowTextA
mov eax, dword [ebx + 0x14]
pop ebx
pop ebp
ret

Function at 0x497f08
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov eax, 0x4cd29c
push ebx
call fcn.0049af0c
mov word [ebp - 0x18], 8
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00496a84
add esp, 8
inc dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [edx], 0x4cd400
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x12], 0
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x13], edx
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x17], 0
mov ebx, dword [ebp + 8]
add ebx, 0x18
call fcn.00497e39
test al, al
je 0x497fbd
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x497fbd
mov word [ebp - 0x18], 0x20
mov eax, dword [ebp - 4]
mov dword [eax], 0x4ad79c
inc dword [ebp - 0xc]
inc dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [edx], 0x4cd3f0
mov ecx, dword [ebp - 4]
mov byte [ecx + 8], 0
push 0
push 0
push 0
call sub.KERNEL32.dll_CreateMutexA
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x497fb7
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
jne 0x497fb7
mov ecx, dword [ebp - 4]
mov byte [ecx + 8], 1
mov word [ebp - 0x18], 0x14
inc dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov byte [eax + 0x3c], 0
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, dword [ebp + 8]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49bd60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xff
mov eax, dword [ebp + 8]
push eax
push 0x4d2ba0
call fcn.0049edc0
add esp, 0xc
lea edx, [ebp - 8]
push 0
push 0
push 0
push edx
push 0x4d2ba0
call fcn.0049bfb4
add esp, 0x14
push 0x4ce8f0
lea ecx, [ebp - 8]
push ecx
call fcn.004986dc
add esp, 8
mov byte [0x4d2ba0], 0
push 0
push 0
push 0
push 0
push 0
push 0xff
push 0x4d2ba0
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.dll_GetVolumeInformationA
test eax, eax
je 0x49bdd3
mov eax, 0x4d2ba0
jmp 0x49bdd5
xor eax, eax
pop ecx
pop ecx
pop ebp
ret
Function at 0x49bddc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
test byte [ebx + 8], 8
je 0x49be01
cmp dword [ebx + 4], 0xfffffffe
jne 0x49be01
or eax, 0xffffffff
jmp 0x49bf39
test byte [ebx + 8], 8
je 0x49be6e
cmp dword [ebx + 4], 0xffffffff
jne 0x49be6e
mov dword [esi + 8], 8
mov edx, dword [ebx + 0xc]
push edx
call fcn.0049bd60
pop ecx
mov edi, eax
test edi, edi
je 0x49be56
add esi, 0x10
xor eax, eax
push esi
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx + 4], 0xfffffffe
xor eax, eax
jmp 0x49bf39
call fcn.0049f478
test eax, eax
jne 0x49be66
xor eax, eax
jmp 0x49bf39
or eax, 0xffffffff
jmp 0x49bf39
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x49be7b
cmp eax, 0xfffffffe
jne 0x49bea2
mov dword [ebx + 4], 0xffffffff
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 0xc]
push ecx
call sub.KERNEL32.dll_FindFirstFileA
mov edi, eax
mov dword [ebx + 4], edi
cmp edi, 0xffffffff
setne al
and eax, 1
jmp 0x49beb2
lea edx, [ebp - 0x148]
push edx
mov ecx, dword [ebx + 4]
push ecx
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x49bec8
call fcn.0049f478
test eax, eax
jne 0x49bec3
xor eax, eax
jmp 0x49bf39
or eax, 0xffffffff
jmp 0x49bf39
mov eax, dword [ebp - 0x148]
test al, 0x16
je 0x49bedc
mov edx, dword [ebx + 8]
and edx, eax
test dl, 0x16
je 0x49be6e
mov ecx, dword [ebp - 0x148]
mov dword [esi + 8], ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x134]
push edx
call sub.KERNEL32.dll_FileTimeToLocalFileTime
lea ecx, [esi + 0xc]
push ecx
lea eax, [esi + 0xe]
push eax
lea edx, [ebp - 8]
push edx
call sub.KERNEL32.dll_FileTimeToDosDateTime
mov ecx, dword [ebp - 0x128]
xor eax, eax
mov dword [esi + 4], ecx
add esi, 0x10
push esi
lea edi, [ebp - 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret