joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cc70
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x581900]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x194]
push 0x190
push 0
push eax
call fcn.004e69c0
mov eax, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
mov esi, 0x104
cmovns esi, eax
test edi, edi
je 0x45ccff
test esi, esi
jle 0x45ccff
lea eax, [ebp - 0x194]
mov byte [edi], 0
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x45cced
push esi
push edi
call sub.WSOCK32.dll_gethostname
mov esi, eax
call sub.WSOCK32.dll_WSACleanup
test esi, esi
jne 0x45cced
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x45cce2
sub ecx, edx
jne 0x45ccff
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004e50dc
mov esp, ebp
pop ebp
ret

Function at 0x45df50
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x581900]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
mov eax, dword [ebp + 0xc]
push esi
mov esi, 0x66a210
cmovne esi, ecx
push edi
mov edi, 0x80
push 0x66a190
cmovne edi, eax
mov byte [esi], 0
call fcn.004a73a0
add esp, 4
test eax, eax
jne 0x45dfa3
call fcn.004d9850
sub eax, dword [0x6699dc]
cmp eax, 0x493e0
jbe 0x45e016
call fcn.004d9850
push 0x190
mov dword [0x6699dc], eax
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.004e69c0
add esp, 0xc
mov byte [0x66a190], 0
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x45dff3
push 0x80
push 0x66a190
call sub.WSOCK32.dll_gethostname
call sub.WSOCK32.dll_WSACleanup
push 0x3a
push 0x66a190
call fcn.004a8100
push 0x80
push 0x66a190
push 0x66a210
call fcn.004a9a20
add esp, 0x14
push 0x66a190
call fcn.004a73a0
add esp, 4
test eax, eax
je 0x45e09d
push str.:8:GetTerminalName___FAILED:_GetLocalHostName___FAILED_
call fcn.00424a90
add esp, 4
test esi, esi
jne 0x45e042
mov esi, 0x66a310
mov edi, 0x80
push 0x66a290
call fcn.004a73a0
add esp, 4
test eax, eax
jne 0x45e065
call fcn.004d9850
sub eax, dword [0x669ce4]
cmp eax, 0x493e0
jbe 0x45e095
call fcn.004d9850
push 0x80
push 0x66a290
mov dword [0x669ce4], eax
call fcn.0045cd20
push 0x80
push 0x66a290
push 0x66a310
call fcn.004a9a20
add esp, 0x14
push edi
push 0x66a290
jmp 0x45e0a3
push edi
push 0x66a190
push esi
call fcn.004a9a20
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, esi
xor ecx, ebp
pop edi
pop esi
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
Function at 0x462440
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x581900]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x318]
push edi
mov edi, dword [ebp + 8]
push 0x190
push 0
push eax
mov dword [ebp - 0x328], edi
call fcn.004e69c0
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.004e69c0
push 0x104
lea eax, [ebp - 0x188]
push 0
push eax
call fcn.004e69c0
mov eax, dword [ebp + 0x10]
add esp, 0x24
test eax, eax
mov dword [ebp - 0x31c], 0
mov ebx, 0x104
cmovns ebx, eax
test edi, edi
je 0x462654
test esi, esi
je 0x462654
test ebx, ebx
jle 0x462654
call fcn.004d9850
push 0x7e
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x84]
push edi
push eax
mov byte [esi], 0
call fcn.004a9a20
lea eax, [ebp - 0x188]
push eax
call fcn.004a55e0
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x84]
push 0x52be0c
push eax
call fcn.004a8ea0
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x46252f
lea eax, [ebp - 0x31c]
push eax
push 0x52be0c
push 0
call fcn.004a8ea0
add esp, 0xc
mov edi, eax
push edi
call fcn.004a73a0
add esp, 4
test eax, eax
jne 0x462561
push 0x104
lea eax, [ebp - 0x188]
push edi
push eax
call fcn.004a9a20
push 0
lea eax, [ebp - 0x188]
push 0x3a
push eax
call fcn.004a7100
add esp, 0x18
lea eax, [ebp - 0x84]
push eax
call fcn.004638b0
add esp, 4
test eax, eax
je 0x462654
lea eax, [ebp - 0x318]
mov byte [esi], 0
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x462654
lea eax, [ebp - 0x84]
push eax
call fcn.0045e3a0
add esp, 4
mov dword [ebp - 0x320], eax
lea eax, [ebp - 0x320]
push 2
push 4
push eax
call sub.WSOCK32.dll_gethostbyaddr
test eax, eax
je 0x46264f
mov edx, dword [eax]
test edx, edx
je 0x46264f
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4625d0
sub ecx, edi
je 0x46264f
push ebx
push edx
push esi
call fcn.004a9a20
add esp, 0xc
call sub.WSOCK32.dll_WSACleanup
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4625f0
sub ecx, edx
je 0x462654
push ebx
lea eax, [ebp - 0x188]
push eax
push esi
call fcn.004a98f0
add esp, 0xc
call fcn.004d9850
mov edi, dword [ebp - 0x324]
sub eax, edi
cmp eax, 0x1388
jbe 0x46263c
call fcn.004d9850
sub eax, edi
push eax
push esi
push dword [ebp - 0x328]
push str.:4:ResolveIPToHostName___took_too_long_to_resolve__s_to__s:__ums
call fcn.00424a90
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
call sub.WSOCK32.dll_WSACleanup
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
Function at 0x4660a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x581900]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x215d
push str.C:UsersOfficeDocumentsVisual_StudioPAULANetwork.c
push 0x50a5d0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push str.addrchng.flg
push 0
movups xmmword [ebp - 0x14], xmm0
call fcn.0047dbc0
add esp, 8
push eax
call fcn.0042c170
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4661c0
push esi
push 1
lea eax, [ebp - 0x18]
push 4
push eax
call fcn.004e91b7
push esi
push 1
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.004e91b7
push esi
call fcn.0042bfc0
add esp, 0x24
call fcn.0040e900
test eax, eax
jne 0x46616f
push 0x2166
lea eax, [ebp - 0x28]
push str.C:UsersOfficeDocumentsVisual_StudioPAULANetwork.c
push eax
call fcn.004d7a00
movups xmm0, xmmword [ebp - 0x14]
push ecx
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.004d96a0
cdq
add esp, 0x20
xor eax, edx
sub eax, edx
cmp eax, 0x6ddd000
jle 0x46616f
push str.addrchng.flg
push 0
call fcn.0047dbc0
push eax
call fcn.00429a50
add esp, 0xc
push 0x216a
lea eax, [ebp - 0x28]
push str.C:UsersOfficeDocumentsVisual_StudioPAULANetwork.c
push eax
call fcn.004d7a00
movups xmm0, xmmword [ebp - 0x14]
push ecx
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.004d96a0
cdq
add esp, 0x20
xor eax, edx
sub eax, edx
cmp eax, 0x240c8400
jle 0x4661d1
push str.addrchng.flg
push 0
call fcn.0047dbc0
push eax
call fcn.00429a50
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
call fcn.0040e900
test eax, eax
je 0x46622a
push 0x2170
lea eax, [ebp - 0x28]
push str.C:UsersOfficeDocumentsVisual_StudioPAULANetwork.c
push eax
call fcn.004d7a00
movups xmm0, xmmword [ebp - 0x14]
push ecx
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.004d96a0
cdq
add esp, 0x20
xor eax, edx
sub eax, edx
cmp eax, 0x5cb2780
jg 0x4661c0
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x18], 0
jne 0x466216
push 0x2178
lea eax, [ebp - 0x28]
push str.C:UsersOfficeDocumentsVisual_StudioPAULANetwork.c
push eax
call fcn.004d7a00
movups xmm0, xmmword [ebp - 0x14]
push ecx
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.004d96a0
cdq
add esp, 0x20
mov ecx, eax
xor eax, eax
xor ecx, edx
sub ecx, edx
cmp ecx, 0x4b87f00
mov ecx, dword [ebp - 4]
pop esi
setl al
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
Function at 0x46c110
Capabilities:
Reference absolute stream path on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x518
mov eax, dword [0x581900]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.004e69c0
push 0xfb
lea eax, [ebp - 0x50f]
push 0
push eax
call fcn.004e69c0
push 0xf0
lea eax, [ebp - 0xf4]
push 0
push eax
call fcn.004e69c0
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004e69c0
movq xmm0, qword [str.sibs.ark]
mov al, byte [0x53821c]
push str.sybsInst.ark
push 0
movq qword [ebp - 0x518], xmm0
mov byte [ebp - 0x510], al
call fcn.0047d960
lea edx, [ebp - 0x20c]
add esp, 0x38
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x46c1a1
movaps xmm0, xmmword [str.C:HCTCPAULA_si:2:AbbrInvGetFull__d__FAILED:_A_reference_invoice_has_not_yet_been_set.]
lea eax, [ebp - 0x518]
push esi
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0xf8], 0x5c7362
push eax
movups xmmword [ebp - 0x108], xmm0
call fcn.00461800
push 0
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00429b90
push 0
mov esi, eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00429b90
add esp, 0x20
test eax, eax
je 0x46c213
test esi, esi
je 0x46c295
cmp esi, eax
je 0x46c295
push 0x104
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.004e69c0
lea eax, [ebp - 0x20c]
push eax
push str._s.temp
lea eax, [ebp - 0x310]
push 0x104
push eax
call fcn.004a94b0
push 0
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00429860
add esp, 0x28
test eax, eax
jne 0x46c271
push str._GetLastError_
push str.:7:CloneDatabaseFilesToOldFolder___EAP:_Could_not_copy_the_tams_archive_locally:__s
call fcn.00424a90
add esp, 8
push 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call fcn.00429860
lea eax, [ebp - 0x310]
push eax
call fcn.00429a50
add esp, 0x10
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00427800
add esp, 8
pop esi
test eax, eax
jne 0x46c2c4
push str._GetLastError_
lea eax, [ebp - 0x108]
push eax
push str.:8:CloneDatabaseFilesToOldFolder___FAILED:_CreateDirectorySuper___s___FAILED:__s
call fcn.00424a90
add esp, 0xc
push 1
call fcn.00402a70
push 0
push 1
push 0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00402a50
add esp, 0x18
test eax, eax
jg 0x46c342
lea eax, [ebp - 0x414]
push eax
call fcn.004289f0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004289f0
add esp, 4
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
push str.:7:CloneDatabaseFilesToOldFolder___FAILED:_DB_Install_Archive_is_CORRUPT_:_ExpandArchive__s___s__FAILED:_bLocalExist_d__bServerExist_d
call fcn.00424a90
lea eax, [ebp - 0x20c]
push eax
call fcn.00429a50
add esp, 0x18
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
push 2
call fcn.0046e5d0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
Function at 0x46def0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x581900]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push edi
mov edi, dword [ebp + 8]
push 0x100
push 0
push eax
call fcn.004e69c0
add esp, 0xc
test esi, esi
je 0x46df2e
push esi
call fcn.004a55e0
add esp, 4
test edi, edi
jne 0x46df5b
push edi
call fcn.0046caa0
mov edi, eax
mov dword [ebp - 0x10c], 1
add esp, 4
test edi, edi
jne 0x46df65
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10c], 0
push ebx
push str.SELECT_STORE_PROFILE.STORE_NUM__COMPANY.NAME_FROM_STORE_PROFILE__COMPANY_WHERE_STORE_PROFILE.COMPANY_IDCOMPANY.ID
push edi
xor ebx, ebx
call fcn.0046d380
add esp, 8
test eax, eax
je 0x46e04f
push 2
push 9
push 0xff
lea eax, [ebp - 0x104]
mov dword [ebp - 0x108], ebx
push eax
push edi
call fcn.0046d4c0
add esp, 0x14
test eax, eax
je 0x46e05e
mov eax, dword [ebp - 0x108]
cmp eax, 0xde
jge 0x46e05e
test ebx, ebx
jne 0x46e025
lea eax, [ebp - 0x104]
push eax
call fcn.004efdaf
add esp, 4
mov ebx, eax
test esi, esi
je 0x46e01f
lea eax, [ebp - 0x104]
push 0x510e78
push eax
call fcn.004e61d0
add esp, 8
test eax, eax
lea eax, [ebp - 0x104]
je 0x46e011
push dword [ebp + 0x10]
push 0x510e78
push eax
call fcn.004e61d0
add esp, 8
inc eax
push eax
push esi
call fcn.004a9a20
push esi
call fcn.004a9190
add esp, 0x10
jmp 0x46e01f
push eax
push str.:7:GetStoreNumberTAMSii___FAILED:_Store_name_field_not_found:___s_
call fcn.00424a90
add esp, 8
mov eax, dword [ebp - 0x108]
push 2
inc eax
push 9
mov dword [ebp - 0x108], eax
lea eax, [ebp - 0x104]
push 0xff
push eax
push edi
call fcn.0046d4c0
add esp, 0x14
test eax, eax
jne 0x46dfa5
jmp 0x46e05e
push str.:7:GetStoreNumberTAMSii___FAILED:_ExecuteODBCFormat___FAILED.
call fcn.00424a90
add esp, 4
xor ebx, ebx
cmp dword [ebp - 0x10c], 0
je 0x46e070
push edi
call fcn.0046ce60
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, ebx
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
Function at 0x46f7f0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x581900]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x64]
push edi
push 0x40
push 0
push eax
mov dword [ebp - 0x6c], ebx
call fcn.004e69c0
add esp, 0xc
call fcn.004d9850
mov dword [ebp - 0x70], eax
test ebx, ebx
je 0x46f82a
mov dword [ebx], 0
push 0
call fcn.0046caa0
mov edi, eax
add esp, 4
test edi, edi
je 0x46f9a1
push esi
xorps xmm0, xmm0
xor ebx, ebx
push str.SELECT_LOC_FROM_STORE_PROFILE
push edi
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x68], ebx
movups xmmword [ebp - 0x14], xmm0
call fcn.0046d380
add esp, 8
test eax, eax
je 0x46f8b9
push 1
push 9
push 0x1f
lea eax, [ebp - 0x24]
xor esi, esi
push eax
push edi
call fcn.0046d4c0
add esp, 0x14
test eax, eax
je 0x46f8c6
nop word [eax + eax]
cmp esi, 0xde
jge 0x46f8b4
cmp dword [ebp - 0x68], ebx
jne 0x46f89c
lea eax, [ebp - 0x24]
push eax
call fcn.004efdaf
add esp, 4
mov dword [ebp - 0x68], eax
push 1
push 9
push 0x1f
lea eax, [ebp - 0x24]
inc esi
push eax
push edi
call fcn.0046d4c0
add esp, 0x14
test eax, eax
jne 0x46f880
mov eax, dword [ebp - 0x68]
jmp 0x46f8c8
push str.:7:GetStoreLocationIdTAMSii___FAILED:_ExecuteODBCFormat___FAILED.
call fcn.00424a90
add esp, 4
xor eax, eax
push eax
push str.SELECT_TENDER_TYPE_ACCEPTED_FROM_TENDER_TYPE_PROFILE_WHERE_LOC_d
push edi
call fcn.0046d380
add esp, 0xc
test eax, eax
je 0x46f929
push 1
push 9
push 0x3f
lea eax, [ebp - 0x64]
xor esi, esi
push eax
push edi
call fcn.0046d4c0
add esp, 0x14
test eax, eax
je 0x46f938
cmp esi, 0xde
jge 0x46f938
lea eax, [ebp - 0x64]
push eax
call fcn.004a77d0
add esp, 4
test eax, eax
je 0x46f90f
bts ebx, esi
push 1
push 9
push 0x3f
lea eax, [ebp - 0x64]
inc esi
push eax
push edi
call fcn.0046d4c0
add esp, 0x14
test eax, eax
jne 0x46f8f4
jmp 0x46f938
push str.:7:TAMSii_IsTenderTypesEnabled___FAILED:_ExecuteODBCFormat___FAILED.
call fcn.00424a90
add esp, 4
xor ebx, ebx
push edi
call fcn.0046ce60
mov eax, dword [ebp - 0x6c]
add esp, 4
pop esi
test eax, eax
je 0x46f94b
mov dword [eax], ebx
call fcn.004d9850
sub eax, dword [ebp - 0x70]
push eax
push 0
push 0xc
push ebx
call fcn.00457750
add esp, 0xc
push eax
push str.:0:TAMSii_IsTenderTypesEnabled___has_determined__s_in__ums
call fcn.00424fd0
mov eax, ebx
add esp, 0xc
and eax, 3
cmp al, 3
jne 0x46f993
and ebx, 0x1c
xor eax, eax
cmp bl, 0x1c
pop edi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
push ebx
push str.:7:TAMSii_IsTenderTypesEnabled___FAILED:_dwTenderTypesEnabled___d.
call fcn.00424a90
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop ebx
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
Function at 0x497540
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x581900]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, dword [ebp + 0xc]
push 0x104
push 0
push eax
call fcn.004e69c0
lea eax, [ebp - 0x108]
xorps xmm0, xmm0
push str.S7.tim
push eax
movups xmmword [ebp - 0x118], xmm0
call fcn.00461800
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x118]
add esp, 0x14
test esi, esi
cmovne eax, esi
test edi, edi
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x118]
cmovne eax, edi
xor esi, esi
mov dword [ebp - 0x11c], eax
nop word [eax + eax]
push 0x6a6
push str.C:UsersOfficeDocumentsVisual_StudioPAULAServerPAULA.c
lea eax, [ebp - 0x108]
push 0x50a5d0
push eax
call fcn.0042c170
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x497683
lea eax, [ebp - 0x108]
push eax
call fcn.004289f0
add esp, 4
test eax, eax
je 0x497645
call fcn.004eeaba
cdq
mov edi, 0x15e
idiv edi
add edx, 0xfa
js 0x497637
call fcn.004eeaba
cdq
idiv edi
add edx, 0xfa
cmp edx, 0x7fffffff
jge 0x497637
call fcn.004eeaba
cdq
idiv edi
add edx, 0xfa
push edx
jmp 0x497639
push 0xa
call ebx
inc esi
cmp esi, 3
jl 0x4975c0
lea eax, [ebp - 0x108]
push eax
call fcn.004289f0
add esp, 4
test eax, eax
je 0x49774e
lea eax, [ebp - 0x108]
push eax
push str.:4:GetLastSA7TimeStamp___FAILED:_fopen___s___FAILED.
call fcn.00424a90
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
push edi
mov esi, 1
push esi
push 0x10
push dword [ebp - 0x120]
call fcn.004e91b7
mov ebx, dword [ebp - 0x11c]
add esp, 0x10
cmp eax, esi
jne 0x4976b5
push edi
push esi
push 0x10
push ebx
call fcn.004e91b7
add esp, 0x10
cmp eax, esi
je 0x4976b7
xor esi, esi
push edi
call fcn.0042bfc0
mov ecx, dword [ebp - 0x120]
add esp, 4
movups xmm0, xmmword [ecx]
push 1
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call fcn.004d81b0
add esp, 0x14
test eax, eax
je 0x497741
movups xmm0, xmmword [ebx]
push 1
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call fcn.004d81b0
add esp, 0x14
test eax, eax
je 0x497741
test esi, esi
jne 0x49772b
push esi
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00429b90
push eax
push str.:3:GetLastSA7TimeStamp___FAILED:_fread___FAILED:_File_size___u
call fcn.00424a90
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
push str.:3:GetLastSA7TimeStamp___FAILED:_One_of_the_time_stamps_read_is_invalid.
call fcn.00424a90
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
Function at 0x498050
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x581900]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push esi
push edi
push 0x105
push 0
push eax
mov dword [ebp - 0x110], ebx
call fcn.004e69c0
add esp, 0xc
test ebx, ebx
je 0x49816c
push 0x188
push 0
push ebx
call fcn.004e69c0
lea eax, [ebp - 0x10c]
push str.eod.tim
push eax
call fcn.00461800
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x14
xor esi, esi
nop word [eax + eax]
push 0x6f3
push str.C:UsersOfficeDocumentsVisual_StudioPAULAServerPAULA.c
lea eax, [ebp - 0x10c]
push 0x50a5d0
push eax
call fcn.0042c170
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x49817f
lea eax, [ebp - 0x10c]
push eax
call fcn.004289f0
add esp, 4
test eax, eax
je 0x498145
call fcn.004eeaba
cdq
mov edi, 0x226
idiv edi
add edx, 0xfa
js 0x498137
call fcn.004eeaba
cdq
idiv edi
add edx, 0xfa
cmp edx, 0x7fffffff
jge 0x498137
call fcn.004eeaba
cdq
idiv edi
add edx, 0xfa
push edx
jmp 0x498139
push 0xa
call ebx
inc esi
cmp esi, 3
jl 0x4980c0
lea eax, [ebp - 0x10c]
push eax
call fcn.004289f0
add esp, 4
test eax, eax
je 0x49816c
lea eax, [ebp - 0x10c]
push eax
push str.:4:LoadEODTimeStampDB___FAILED:_fopen___s___FAILED.
call fcn.00424a90
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x110]
push edi
push 1
push 0x188
push esi
call fcn.004e91b7
add esp, 0x10
push edi
cmp eax, 1
je 0x4981ea
call fcn.0042bfc0
add esp, 4
lea eax, [ebp - 0x10c]
push 0x188
push 0
push 0
push eax
call fcn.00429b90
add esp, 0xc
push eax
push str.:6:LoadEODTimeStampDB___FAILED:_fread___FAILED:_File_size___u__s_b__u
call fcn.00424a90
push 0x188
push 0
push esi
call fcn.004e69c0
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
call fcn.0042bfc0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
Function at 0x49e1b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x581900]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x67b4d8], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
jne 0x49e327
cmp dword [0x67b5ec], 0
jne 0x49e327
push 0x104
lea eax, [ebp - 0x144]
mov dword [ebp - 0x40], 0x46464952
push 0
push eax
mov dword [ebp - 0x3c], 0x32
mov dword [ebp - 0x38], 0x45564157
mov dword [ebp - 0x34], 0x20746d66
mov dword [ebp - 0x30], 0x10
mov dword [ebp - 0x2c], 0x10001
mov dword [ebp - 0x28], 0x5622
mov dword [ebp - 0x24], 0xac44
mov dword [ebp - 0x20], 0x100002
mov dword [ebp - 0x1c], 0x61746164
mov dword [ebp - 0x18], 0xe
mov dword [ebp - 0x14], 0xfe00fe01
mov dword [ebp - 0x10], 0xff00
mov dword [ebp - 0xc], 0xffff
mov word [ebp - 8], 1
call fcn.004e69c0
lea eax, [ebp - 0x144]
mov dword [0x67b5ec], 1
push eax
call fcn.00428270
add esp, 0x10
test eax, eax
jne 0x49e2a0
mov ax, word [0x549bf0]
movups xmm0, xmmword [str.TempDummySound.wav]
mov word [ebp - 0x134], ax
mov al, byte [0x549bf2]
movups xmmword [ebp - 0x144], xmm0
mov byte [ebp - 0x132], al
push 0x52
push str.C:UsersOfficeDocumentsVisual_StudioPAULASound.c
lea eax, [ebp - 0x144]
push 0x50ab90
push eax
call fcn.0042c170
mov esi, eax
add esp, 0x10
test esi, esi
je 0x49e2d8
push esi
push 0x3a
lea eax, [ebp - 0x40]
push 1
push eax
call fcn.004e9f2f
push esi
call fcn.0042bfc0
add esp, 0x14
lea eax, [ebp - 0x144]
push eax
call fcn.0049e1b0
add esp, 4
test eax, eax
jne 0x49e31d
lea eax, [ebp - 0x144]
push str.SoundsNotifyWinIllegalKey.wav
push eax
call fcn.0047d960
push eax
call fcn.0049e1b0
add esp, 0xc
test eax, eax
jne 0x49e31d
lea eax, [ebp - 0x144]
push eax
push str.:7:CreateSound___FAILED_to_create_the_dummy_protection_sound___s_.
call fcn.00424a90
add esp, 8
mov dword [0x67b5ec], 0
push 1
push 0x724
call fcn.004eea94
mov esi, eax
add esp, 8
test esi, esi
je 0x49e36b
mov eax, dword [0x67b4d8]
test eax, eax
jne 0x49e34f
call fcn.00490e40
mov dword [0x67b4d8], eax
push esi
push eax
call fcn.004913f0
add esp, 8
cmp dword [0x67b4d8], 0
jne 0x49e37d
push esi
call fcn.004eea9f
add esp, 4
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
push edi
lea edi, [esi + 0x564]
push str.C:UsersOfficeDocumentsVisual_StudioPAULASound.c
push edi
call fcn.004335e0
add esp, 8
test eax, eax
jne 0x49e3a3
push str.:5:CreateSound___EAP:_InitializeLock___FAILED.
call fcn.00424a90
add esp, 4
push str.A_Sound_handle_had_to_be_forced_to_unlock___
push edi
call fcn.004339a0
push 0xdac
push edi
call fcn.00433960
push 0x7fa
push edi
call fcn.00433ae0
push ebx
call fcn.004a73a0
add esp, 0x1c
pop edi
test eax, eax
jne 0x49e3fb
push ebx
push esi
call fcn.0049ed10
add esp, 8
test eax, eax
jne 0x49e3fb
push esi
call fcn.0049e620
add esp, 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e50dc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e50dc
mov esp, ebp
pop ebp
ret