joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ddb02
Capabilities:
Accept command line arguments

Disassembly:
push 0x1c
mov eax, 0x5963ff
call fcn.00584f68
mov dword [ebp - 0x14], ecx
xor esi, esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x18]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_wchar_t__
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call sym.txupd.exe_void___cdecl_Util::Misc::SplitCmdString_class_CTXStringW_const___class_std::vector_class_CTXStringW__class_std::allocator_class_CTXStringW____
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
xor eax, eax
inc eax
cmp dword [ebp - 0x24], esi
mov dword [ebp - 0x10], eax
je 0x4ddbdd
mov edi, dword [ebp - 0x20]
sub edi, dword [ebp - 0x24]
sar edi, 2
cmp edi, eax
jbe 0x4ddbdd
mov esi, dword [sym.imp.MSVCR80.dll_wcsncmp]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x28]
call fcn.004a76a1
mov ecx, eax
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
mov ebx, eax
test ebx, ebx
je 0x4ddbd5
push 6
push str._newfs
push ebx
call esi
add esp, 0xc
test eax, eax
jne 0x4ddba1
mov eax, dword [ebp - 0x14]
mov dword [eax], 2
push 6
push str._oldfs
push ebx
call esi
add esp, 0xc
test eax, eax
jne 0x4ddbbb
mov eax, dword [ebp - 0x14]
mov dword [eax], 1
push 7
push str._testfs
push ebx
call esi
add esp, 0xc
test eax, eax
jne 0x4ddbd5
mov eax, dword [ebp - 0x14]
mov dword [eax], 3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jb 0x4ddb6f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004a8c51
call fcn.00585040
ret
Function at 0x4ddbef
Capabilities:
Get file size
Write file on windows

Disassembly:
push 0x14
mov eax, 0x596422
call fcn.00584f68
mov esi, ecx
lea ebx, [esi + 4]
xor edi, edi
mov ecx, ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ebx
call sym.txupd.exe_public:_bool___thiscall_CTXStringW::IsEmpty_void_const
test al, al
jne 0x4ddd88
lea ecx, [esi + 0xc]
mov dword [ebp - 0x18], ecx
call fcn.004a667d
test eax, eax
jbe 0x4ddd88
cmp dword [esi + 8], 0xffffffff
jne 0x4ddd88
push edi
push edi
push 4
push edi
push 7
push 0x40000000
mov ecx, ebx
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
je 0x4ddd5d
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
jne 0x4ddc86
push edi
lea eax, [ebp - 0x1c]
push eax
push 2
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
mov dword [ebp - 0x14], 0xfeff
mov dword [ebp - 0x1c], edi
call ebx
push 2
push edi
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edi
call fcn.004a667d
test eax, eax
jbe 0x4ddd4c
mov ecx, dword [ebp - 0x18]
push 0x5b42a0
push dword [ebp - 0x14]
call fcn.004a76a1
push eax
lea eax, [ebp - 0x10]
push eax
call sym.txupd.exe_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__
add esp, 0xc
push edi
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], edi
call sym.txupd.exe_public:_int___thiscall_CTXStringW::GetLength_void_const
add eax, eax
push eax
lea ecx, [ebp - 0x10]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push dword [esi + 8]
call ebx
lea ecx, [ebp - 0x10]
call sym.txupd.exe_public:_int___thiscall_CTXStringW::GetLength_void_const
add eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x4ddd14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov ecx, dword [ebp - 0x18]
inc dword [ebp - 0x14]
call fcn.004a667d
cmp dword [ebp - 0x14], eax
jb 0x4ddca6
jmp 0x4ddd4c
mov ecx, dword [ebp - 0x20]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push str.Write_Convert_List_File_Error
push str.FileSystem
push 2
push str.CTXFSControlMgr::SaveConvertList
push 0x9b
push str.....SourceCommonFileSystemFSControlMgr.cpp
call fcn.004587e0
or dword [ebp - 4], 0xffffffff
add esp, 0x1c
lea ecx, [ebp - 0x10]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov ecx, dword [ebp - 0x18]
call fcn.004a6cc7
mov dword [ebp - 0x1c], 1
jmp 0x4ddd88
mov ecx, ebx
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
push str.Open_Convert_List_File_Error
push str.FileSystem
push 2
push str.CTXFSControlMgr::SaveConvertList
push 0xa5
push str.....SourceCommonFileSystemFSControlMgr.cpp
call fcn.004587e0
add esp, 0x1c
mov eax, dword [ebp - 0x1c]
call fcn.00585040
ret
Function at 0x4e4318
Capabilities:
Accept command line arguments

Disassembly:
push 0x20
mov eax, 0x5970e6
call fcn.00584f68
mov esi, ecx
mov dword [ebp - 0x1c], esi
lea ecx, [esi + 0xc]
call fcn.004e3fdd
xor ebx, ebx
lea edi, [esi + 0x30]
mov dword [ebp - 4], ebx
mov dword [edi], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x10]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_wchar_t__
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
call sym.txupd.exe_void___cdecl_Util::Misc::SplitCmdString_class_CTXStringW_const___class_std::vector_class_CTXStringW__class_std::allocator_class_CTXStringW____
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], ecx
je 0x4e43d8
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x28]
sar eax, 2
cmp eax, ecx
mov dword [ebp - 0x18], eax
jbe 0x4e43d8
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
call fcn.004a76a1
mov ecx, eax
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x4e43cd
push 6
push str._perf:
push eax
call dword [sym.imp.MSVCR80.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x4e43cd
push edi
push dword [ebp - 0x14]
call sym.txupd.exe_bool___cdecl_Util::Convert::StringToDWordW_wchar_t_const___unsigned_long_int__
add dword [edi], 6
pop ecx
pop ecx
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jb 0x4e4391
cmp dword [edi], ebx
mov eax, pe_nt_image_headers32
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
jbe 0x4e43f3
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.004a8c51
mov eax, esi
call fcn.00585040
ret
Function at 0x4e4b4c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 8
mov eax, 0x59713e
call fcn.00584f68
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call sym.txupd.exe_public:_int___thiscall_CTXStringW::GetLength_void_const
cmp eax, ebx
lea ecx, [ebp - 0x10]
jg 0x4e4b88
or dword [ebp - 4], 0xffffffff
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
xor eax, eax
call fcn.00585040
ret
lea esi, [eax - 1]
push esi
call sym.txupd.exe_public:_wchar_t___thiscall_CTXStringW::GetAt_int_const
cmp ax, 0x5c
jne 0x4e4bbc
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
call sym.txupd.exe_public:_class_CTXStringW___thiscall_CTXStringW::Left_int_
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0049f0c7
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea ecx, [ebp - 0x10]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4e4bd4
test al, 0x10
jne 0x4e4c3c
push 0x5c
lea ecx, [ebp - 0x10]
call sym.txupd.exe_public:_int___thiscall_CTXStringW::ReverseFind_wchar_t_const
cmp eax, 0xffffffff
lea ecx, [ebp - 0x10]
je 0x4e4b77
push eax
lea eax, [ebp - 0x14]
push eax
call sym.txupd.exe_public:_class_CTXStringW___thiscall_CTXStringW::Left_int_
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call fcn.004e4b4c
pop ecx
push ebx
lea ecx, [ebp - 0x10]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
jne 0x4e4c37
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
mov eax, esi
jmp 0x4e4b82
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
xor esi, esi
inc esi
jmp 0x4e4c24
Function at 0x4e5ab2
Capabilities:
Create thread

Disassembly:
push 0x18
mov eax, 0x5973a2
call fcn.00584f68
mov esi, ecx
xor edi, edi
cmp dword [esi + 0xc], edi
jne 0x4e5acc
call fcn.004e5a97
cmp dword [esi + 4], edi
je 0x4e5ad9
xor eax, eax
call fcn.00585040
ret
push 0x5a3f7c
push str..CTXThreadModel::StartThread
push str.CTXThreadModel::StartThread
push 1
push 0x103
lea eax, [ebp - 0x24]
push str.....SourceCommonThreadModelThreadModel.cpp
push eax
call fcn.004b1d3b
add esp, 0x1c
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push 0x4e5a64
push edi
push edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
cmp eax, edi
jg 0x4e5b36
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004b1dba
mov eax, edi
jmp 0x4e5ad3
cmp dword [esi + 0x10], edi
mov dword [esi + 4], eax
je 0x4e5b47
push 0xfffffffffffffff1
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [esi + 0x18], edi
xor edi, edi
mov dword [esi + 0xc], 1
inc edi
jmp 0x4e5b26

Function at 0x4e5dc7
Capabilities:
Terminate thread

Disassembly:
push 0x14
mov eax, 0x5973c5
call fcn.00584f68
mov esi, ecx
xor eax, eax
inc eax
cmp dword [esi + 4], 0
mov dword [esi + 0x18], eax
je 0x4e5e6a
push 0x5a3f7c
push str..CTXThreadModel::StopThread
mov edi, str.CTXThreadModel::StopThread
push edi
push eax
push 0x151
mov ebx, str.....SourceCommonThreadModelThreadModel.cpp
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.004b1d3b
add esp, 0x1c
push dword [esi + 8]
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4e5e57
push 1
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [ebp + 8]
push eax
push 0x5a48f0
push 0x5ba24c
push 2
push edi
push 0x15a
push ebx
mov dword [ebp + 8], edi
call fcn.00452350
add esp, 0x1c
mov ecx, esi
call fcn.004e5a97
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004b1dba
call fcn.00585040
ret 4

Function at 0x4e5e72
Capabilities:
Terminate thread

Disassembly:
push 0x14
mov eax, 0x5973e8
call fcn.00584f68
mov ebx, ecx
cmp dword [ebx + 4], 0
jne 0x4e5e8d
xor eax, eax
jmp 0x4e5f14
push 0x5a3f7c
push str..CTXThreadModel::WaitThread
mov edi, str.CTXThreadModel::WaitThread
push edi
push 1
push 0x17a
lea eax, [ebp - 0x20]
push str.....SourceCommonThreadModelThreadModel.cpp
push eax
call fcn.004b1d3b
add esp, 0x1c
push dword [ebp + 8]
and dword [ebp - 4], 0
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jne 0x4e5eff
lea eax, [ebp + 8]
push eax
push 0x5a48f0
push 0x5ba24c
push 2
push edi
push 0x187
push str.....SourceCommonThreadModelThreadModel.cpp
mov dword [ebp + 8], edi
call fcn.00452350
add esp, 0x1c
push 1
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, ebx
call fcn.004e5a97
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004b1dba
mov eax, esi
call fcn.00585040
ret 4
Function at 0x4e635d
Capabilities:
Terminate thread

Disassembly:
push 8
mov eax, 0x597432
call fcn.00584f68
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], 0x5ba398
mov eax, dword [esi + 4]
and dword [ebp - 4], 0
test eax, eax
je 0x4e63c0
cmp dword [esi + 0xc], 0
je 0x4e63b9
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ecx, [ebp - 0x10]
push ecx
push 0x5a48f0
push 0x5ba24c
mov eax, str.CTXThreadModel::CTXThreadModel
push 2
push eax
push 0xdb
push str.....SourceCommonThreadModelThreadModel.cpp
mov dword [ebp - 0x10], eax
call fcn.00452350
add esp, 0x1c
mov ecx, esi
call fcn.004e5a97
push dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 0x14]
call edi
add esi, 0x1c
mov ecx, esi
call fcn.004e62f3
mov ecx, esi
call fcn.004e625e
call fcn.00585040
ret
Function at 0x4e6d84
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x7c
mov eax, 0x5975b7
call fcn.00584fd1
lea eax, [ebp - 0x88]
push eax
push 1
xor ebx, ebx
push ebx
push 0x5ba480
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4e6e87
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push str.Version
push dword [ebp - 0x88]
mov dword [ebp - 0x80], 0x64
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4e6e87
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x78]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__
lea ecx, [ebp - 0x7c]
mov dword [ebp - 4], ebx
call sym.txupd.exe_public:_void___thiscall_CTXStringW::constructor_void_
push ebx
push 0x2e
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 1
call sym.txupd.exe_public:_int___thiscall_CTXStringW::Find_wchar_t__int_const
cmp eax, ebx
jl 0x4e6e70
push ebx
push 0x2e
lea ecx, [ebp - 0x78]
call sym.txupd.exe_public:_int___thiscall_CTXStringW::Find_wchar_t__int_const
push eax
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x78]
call sym.txupd.exe_public:_class_CTXStringW___thiscall_CTXStringW::Left_int_
push eax
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 2
call fcn.0049f0c7
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 1
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
lea ecx, [ebp - 0x7c]
call sym.txupd.exe_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const
push eax
call dword [sym.imp.MSVCR80.dll__wtoi]
cmp eax, 5
pop ecx
jl 0x4e6e70
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], bl
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
xor eax, eax
inc eax
jmp 0x4e6e89
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], bl
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call sym.txupd.exe_public:_void___thiscall_CTXStringW::destructor_void_
xor eax, eax
call fcn.00585054
ret
Function at 0x4e6e8f
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1068
call fcn.005848d0
mov eax, dword [0x610304]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
test eax, eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1050], ecx
mov ecx, dword [ebp + 0x14]
push esi
push edi
mov dword [ebp - 0x1068], eax
mov dword [ebp - 0x1064], ecx
je 0x4e6f6c
test ebx, ebx
je 0x4e6f6c
mov eax, dword [ebp + 0x18]
mov edi, dword [sym.imp.WININET.dll_InternetCanonicalizeUrlW]
and dword [ebp - 0x1058], 0
mov esi, eax
and eax, 0xc0000000
mov dword [ebp - 0x1060], eax
and esi, 0x3e000000
push esi
lea eax, [ebp - 0x1054]
push eax
lea eax, [ebp - 0x104c]
push eax
push ebx
mov dword [ebp - 0x1054], 0x824
call edi
test eax, eax
jne 0x4e6f7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4e6f6c
mov eax, dword [ebp - 0x1054]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0058432a
pop ecx
push esi
lea ecx, [ebp - 0x1054]
push ecx
push eax
push ebx
mov dword [ebp - 0x105c], eax
mov dword [ebp - 0x1058], 1
call edi
test eax, eax
jne 0x4e6f85
push dword [ebp - 0x105c]
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00584870
leave
ret
lea edi, [ebp - 0x104c]
jmp 0x4e6f8b
mov edi, dword [ebp - 0x105c]
mov esi, dword [ebp - 0x1068]
push esi
push dword [ebp - 0x1060]
push 0
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
cmp dword [ebp - 0x1058], 0
mov ebx, eax
je 0x4e6fb3
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
pop ecx
test ebx, ebx
je 0x4e6fd9
mov ax, word [esi + 0x18]
mov ecx, dword [ebp - 0x1064]
mov word [ecx], ax
mov eax, dword [esi + 0xc]
lea ecx, [eax - 1]
cmp ecx, 6
ja 0x4e6fd9
mov ecx, dword [ebp - 0x1050]
mov dword [ecx], eax
jmp 0x4e6fe2
mov eax, dword [ebp - 0x1050]
or dword [eax], 0xffffffff
mov eax, ebx
jmp 0x4e6f6e
Function at 0x4f2a50
Capabilities:
Resolve dns

Disassembly:
push 0x1c
mov eax, 0x598c77
call fcn.00584fd1
mov esi, dword [ebp + 8]
test esi, esi
mov ebx, ecx
jne 0x4f2a6f
xor eax, eax
call fcn.00585054
ret 8
push 0x10
lea eax, [ebp - 0x20]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0xffffffffffffffff
xor eax, eax
lea edi, [ebp - 0x28]
push esi
stosb byte es:[edi], al
push dword [ebp - 0x28]
lea ecx, [ebp - 0x24]
call sym.txupd.exe_public:_void___thiscall_CTXStringA::constructor_struct_tagUTF8__wchar_t_const___int_
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call sym.txupd.exe_public:_char_const____thiscall_CTXStringA::operator_char_const__void_const
mov esi, eax
push esi
mov word [ebp - 0x20], 2
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [ebp - 0x1c], eax
jne 0x4f2acb
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4f2ae9
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push dword [ebp + 0xc]
call sub.MSVCR80.dll__byteswap_ushort
pop ecx
push 0x10
lea ecx, [ebp - 0x20]
mov word [ebp - 0x1e], ax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x30]
mov esi, eax
jmp 0x4f2af6
push 0x2726
call dword [sym.imp.WS2_32.dll_WSASetLastError]
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call sym.txupd.exe_public:_void___thiscall_CTXStringA::destructor_void_
mov eax, esi
jmp 0x4f2a67
Function at 0x4f5550
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 4
pop edi
push edi
push str.SeCreateGlobalPrivilege
push esi
call fcn.004f54fc
push edi
push str.SeBackupPrivilege
push esi
call fcn.004f54fc
push edi
push str.SeCreatePagefilePrivilege
push esi
call fcn.004f54fc
push edi
push str.SeCreateSymbolicLinkPrivilege
push esi
call fcn.004f54fc
push edi
push str.SeDebugPrivilege
push esi
call fcn.004f54fc
push edi
push str.SeImpersonatePrivilege
push esi
call fcn.004f54fc
add esp, 0x48
push edi
push str.SeIncreaseBasePriorityPrivilege
push esi
call fcn.004f54fc
push edi
push str.SeIncreaseQuotaPrivilege
push esi
call fcn.004f54fc
push edi
push str.SeLoadDriverPrivilege
push esi
call fcn.004f54fc
push edi
push str.SeManageVolumePrivilege
push esi
call fcn.004f54fc
push edi
push str.SeProfileSingleProcessPrivilege
push esi
call fcn.004f54fc
push edi
push str.SeRemoteShutdownPrivilege
push esi
call fcn.004f54fc
add esp, 0x48
push edi
push str.SeRestorePrivilege
push esi
call fcn.004f54fc
push edi
push str.SeSecurityPrivilege
push esi
call fcn.004f54fc
push edi
push str.SeSystemEnvironmentPrivilege
push esi
call fcn.004f54fc
push edi
push str.SeSystemProfilePrivilege
push esi
call fcn.004f54fc
push edi
push str.SeSystemtimePrivilege
push esi
call fcn.004f54fc
push edi
push str.SeTakeOwnershipPrivilege
push esi
call fcn.004f54fc
add esp, 0x48
xor eax, eax
pop edi
inc eax
pop esi
pop ebp
ret

Function at 0x4f5643
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x610304]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.00584870
leave
ret

Function at 0x4f58fb
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x610304]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x210], 0
push 0x208
lea eax, [ebp - 0x20e]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004f5793
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00584870
leave
ret