joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b590
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x100
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
cmp eax, 1
mov eax, dword [esi + 0x1c]
jge 0x46b5c5
test eax, eax
je 0x46b657
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [esi + 0x1c], 0
pop esi
add esp, 0x100
ret
test eax, eax
jne 0x46b612
xor eax, eax
xor ecx, ecx
mov ax, word [esi + 0x46]
mov cx, word [esi + 0x42]
xor edx, edx
push eax
mov dx, word [esi + 0x40]
push ecx
lea eax, [esi + 0x60]
push edx
push eax
push 0x5965b8
push str._s_slogs_04d_02d_02d.log
lea ecx, [esp + 0x1c]
push 0xff
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
lea edx, [esp + 0x24]
push 0x587e28
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 0x28
mov dword [esi + 0x1c], eax
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x46b650
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x46b635
mov eax, dword [esi + 0x28]
test eax, eax
jle 0x46b635
push edx
push 1
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [esi + 0x1c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x28], 0
pop esi
add esp, 0x100
ret

Function at 0x46b990
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x100
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x24]
push edi
test eax, eax
je 0x46bab0
mov esi, dword [esp + 0x114]
test esi, esi
je 0x46bab0
mov edx, dword [esp + 0x11c]
test edx, edx
je 0x46bab0
mov ebp, dword [esp + 0x118]
cmp ebp, 1
jge 0x46b9e8
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
cmp ebp, 1
jl 0x46bab0
cmp ebp, 0x40000
jg 0x46bab0
mov eax, dword [ebx + 0x28]
lea ecx, [eax + ebp]
cmp ecx, 0x40000
jl 0x46ba77
test eax, eax
jle 0x46ba77
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x46ba59
xor eax, eax
xor ecx, ecx
mov ax, word [edx + 6]
mov cx, word [edx + 2]
push eax
xor eax, eax
mov ax, word [edx]
push ecx
lea ecx, [ebx + 0x60]
push eax
push ecx
push 0x5965b8
push str._s_slogs_04d_02d_02d.log
lea edx, [esp + 0x28]
push 0xff
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
lea eax, [esp + 0x30]
push 0x587e28
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 0x28
mov dword [ebx + 0x1c], eax
test eax, eax
je 0x46bab0
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x24]
push ecx
push 1
push edx
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov dword [ebx + 0x28], 0
mov edi, dword [ebx + 0x28]
mov edx, dword [ebx + 0x24]
mov ecx, ebp
add edi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x28]
add ecx, ebp
mov dword [ebx + 0x28], ecx
mov dx, word [0x58368c]
mov eax, ecx
mov ecx, dword [ebx + 0x24]
mov word [eax + ecx], dx
mov eax, dword [ebx + 0x28]
add eax, 2
mov dword [ebx + 0x28], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret 0xc
Function at 0x46bb70
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x110
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x46bbea
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0xe]
mov edx, dword [esp + 0xa]
mov eax, dword [esp + 8]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
lea ecx, [esi + 0x60]
push eax
push ecx
push 0x5965b8
push str._s_slogs_04d_02d_02d.log
lea edx, [esp + 0x30]
push 0xff
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
lea eax, [esp + 0x38]
push 0x587e28
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 0x28
mov dword [esi + 0x1c], eax
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x46bc28
mov eax, dword [esi + 0x24]
test eax, eax
je 0x46bc0d
mov ecx, dword [esi + 0x28]
test ecx, ecx
jle 0x46bc0d
push edx
push 1
push ecx
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
mov ecx, dword [esi + 0x1c]
push ecx
call dword [sym.imp.MSVCRT.dll_fflush]
add esp, 4
mov dword [esi + 0x28], 0
mov dword [esi + 0x38], 1
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
add esp, 0x110
ret
Function at 0x46bc40
Capabilities:
Delete file

Disassembly:
sub esp, 0x150
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
lea edi, [esi + 4]
push edi
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
call dword [sym.imp.MSVCRT.dll_time]
mov ecx, eax
mov eax, 0xc22e4507
imul ecx
add edx, ecx
mov ecx, dword [esp + 0x168]
sar edx, 0x10
mov eax, edx
mov ebp, dword [sym.imp.MSVCRT.dll__snprintf]
shr eax, 0x1f
add edx, eax
add esp, 4
sub edx, ecx
add esi, 0x60
push esi
push 0x5965b8
lea eax, [edx + edx*2]
push str._s_slogs.log
lea ecx, [esp + 0x6c]
push 0xff
lea eax, [eax + eax*4]
push ecx
lea eax, [eax + eax*4]
lea ebx, [eax + eax*8]
shl ebx, 7
call ebp
add esp, 0x14
lea edx, [esp + 0x60]
lea ecx, [esp + 0x20]
push 0
push edx
call sub.MFC42.DLL_CFileFind::FindFile
cmp eax, 1
jne 0x46bd75
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CFileFind::FindNextFileA
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CFileFind::GetFileName
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x60]
push ecx
push esi
push 0x5965b8
push str._s_slogs_s
push 0xff
push edx
call ebp
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x54]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x54]
lea ecx, [esp + 0x78]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__stat]
add esp, 0x20
cmp eax, 0xffffffff
je 0x46bd66
mov eax, dword [esp + 0x58]
test eax, eax
jle 0x46bd66
cmp ebx, eax
jl 0x46bd66
lea edx, [esp + 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x18], 1
je 0x46bce0
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
call fcn.005628e4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x150
ret 4

Function at 0x46be80
Capabilities:
Create directory

Disassembly:
sub esp, 0x100
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x46beac
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [esi + 0x1c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
add esi, 0x60
lea eax, [esp + 8]
push esi
push 0x5965b8
push str._s_slogs
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x1c]
push str..log
push ecx
call fcn.00429260
add esp, 0x1c
lea edx, [esp + 8]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
add esp, 0x100
ret
Function at 0x46c1c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebp, ecx
test edi, edi
je 0x46c289
mov edx, dword [esp + 0x18]
cmp edx, 1
jl 0x46c289
mov esi, dword [ebp + 4]
test esi, esi
je 0x46c23c
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
lea ecx, [eax + edx]
cmp ecx, ebx
jg 0x46c23c
mov ecx, edx
add esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and eax, 0xff
and ecx, 3
mov bl, al
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 4]
mov bh, bl
mov ecx, edx
mov eax, ebx
add edi, esi
mov esi, ecx
shl eax, 0x10
mov ax, bx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp + 8]
mov edi, dword [esp + 0x14]
add eax, edx
mov dword [ebp + 8], eax
jmp 0x46c242
xor esi, esi
test edx, edx
jne 0x46c289
xor ecx, ecx
test edx, edx
jle 0x46c280
mov eax, dword [ebp + 0xa0]
mov bl, byte [ebp + 0x9c]
and eax, 0x7f
mov al, byte [eax + ebp + 0x14]
add al, bl
mov bl, byte [ecx + edi]
xor bl, al
movsx eax, bl
mov byte [ecx + edi], bl
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa0]
inc eax
inc ecx
cmp ecx, edx
mov dword [ebp + 0xa0], eax
jl 0x46c248
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8

Function at 0x46c430
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov al, byte [esi + 0x12c]
test al, al
jne 0x46c458
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.0046c1c0
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov edi, dword [esp + 0x14]
test edi, edi
je 0x46c4c9
mov ebx, dword [esp + 0x18]
cmp ebx, 1
jb 0x46c4c9
push ebx
push edi
mov ecx, esi
call fcn.0046c140
mov ebp, eax
cmp ebp, ebx
je 0x46c47f
pop edi
pop esi
pop ebp
pop ebx
ret 8
xor ecx, ecx
test ebx, ebx
jbe 0x46c4c0
mov edx, dword [esi + 0xa0]
and edx, 0x7f
mov al, byte [edx + esi + 0xa4]
mov dl, byte [esi + 0x9c]
add al, dl
mov dl, byte [ecx + edi]
xor dl, al
mov byte [ecx + edi], dl
mov eax, dword [esi + 0xa0]
movsx edx, dl
inc eax
inc ecx
cmp ecx, ebx
mov dword [esi + 0x9c], edx
mov dword [esi + 0xa0], eax
jb 0x46c485
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8
Function at 0x46f3e0
Capabilities:
Terminate thread

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
mov esi, ecx
je 0x46f4bf
mov edi, dword [esp + 0x18]
mov dword [esp + 0x14], 0
or ebp, 0xffffffff
push 0xbb8
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x46f4bf
push edi
push str._s:_timeout_on_stop
push 4
push 0x596558
call fcn.004aa400
mov eax, dword [esi + 0x114]
add esp, 0x10
cmp eax, ebp
je 0x46f44e
push 2
push eax
call sub.WS2_32.dll_shutdown
mov eax, dword [esi + 0x114]
push eax
call sub.WS2_32.dll_closesocket
mov dword [esi + 0x114], ebp
mov eax, dword [esi + 0x118]
cmp eax, ebp
je 0x46f472
push 2
push eax
call sub.WS2_32.dll_shutdown
mov ecx, dword [esi + 0x118]
push ecx
call sub.WS2_32.dll_closesocket
mov dword [esi + 0x118], ebp
mov eax, dword [esp + 0x14]
mov dword [esi + 0x128], 0
cmp eax, 4
jne 0x46f4a3
push edi
push str._s:_terminated
push 4
push 0x596558
call fcn.004aa400
add esp, 0x10
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, 0x596558
call fcn.004aa7d0
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 5
mov dword [esp + 0x14], eax
jl 0x46f401
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x46fa50
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x604
test eax, eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
je 0x46fc2b
mov ecx, dword [esi + 0x114]
or ebp, 0xffffffff
cmp ecx, ebp
je 0x46fc2b
cmp byte [eax], 0
jne 0x46fa90
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x604
ret 4
mov ecx, str.CWD__s_r_n
test ecx, ecx
je 0x46fc2b
push eax
push ecx
lea edx, [esp + 0x21c]
push 0x3ff
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
mov eax, dword [esi + 0x114]
add esp, 0x10
cmp eax, ebp
lea ebx, [esp + 0x214]
mov dword [esp + 0x10], 0xa
je 0x46fc2b
lea eax, [esp + 0x214]
test eax, eax
je 0x46fc2b
lea edi, [esp + 0x214]
mov ecx, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
test edi, edi
jle 0x46fb3e
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x114]
push 0
push edi
push ebx
push ecx
call sub.WS2_32.dll_send
cmp eax, 1
jge 0x46fb33
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x46fb3b
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
js 0x46fc2b
push 0x32
call ebp
jmp 0x46fb37
add ebx, eax
sub edi, eax
test edi, edi
jg 0x46fafd
or ebp, 0xffffffff
push 0
call dword [sym.imp.MSVCRT.dll_time]
add esp, 4
lea edx, [esp + 0x14]
mov ecx, esi
mov dword [esi + 0x128], eax
push 0x1ff
push edx
call fcn.00470c70
cmp eax, 3
jle 0x46fb97
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
mov bl, 0x2d
cmp byte [esp + 0x17], bl
je 0x46fb81
lea eax, [esp + 0x14]
push eax
call edi
add esp, 4
test eax, eax
jne 0x46fbff
lea ecx, [esp + 0x14]
push 0x1ff
push ecx
mov ecx, esi
call fcn.00470c70
cmp eax, 3
jg 0x46fb6d
mov eax, dword [esi + 0x114]
cmp eax, ebp
je 0x46fbbb
push 2
push eax
call sub.WS2_32.dll_shutdown
mov edx, dword [esi + 0x114]
push edx
call sub.WS2_32.dll_closesocket
mov dword [esi + 0x114], ebp
mov eax, dword [esi + 0x118]
cmp eax, ebp
je 0x46fbdf
push 2
push eax
call sub.WS2_32.dll_shutdown
mov eax, dword [esi + 0x118]
push eax
call sub.WS2_32.dll_closesocket
mov dword [esi + 0x118], ebp
push str.FTP:_read_answer_error
push 1
push 0x596558
mov dword [esi + 0x128], 0
call fcn.004aa400
add esp, 0xc
jmp 0x46fc0a
cmp eax, 0xfa
je 0x46fa7e
mov edx, dword [esp + 0x618]
lea ecx, [esp + 0x14]
push ecx
push edx
push str.FTP:_change_directory_failed___s_____s
push 1
push 0x596558
call fcn.004aa400
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x604
ret 4
Function at 0x470a40
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
test ebx, ebx
mov esi, ecx
je 0x470b7d
push 0x581660
push ebx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x470a83
push ebx
push str.FTP:_cannot_open_file___s_
push 1
push 0x596558
call fcn.004aa400
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
ret 4
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll__filelength]
mov ecx, dword [esi + 0x11c]
add esp, 4
test ecx, ecx
mov dword [esi + 0x120], eax
je 0x470ab5
cmp eax, dword [esi + 0x124]
jle 0x470b21
test ecx, ecx
je 0x470ab5
push ecx
call fcn.004c2eb0
add esp, 4
mov ecx, dword [esi + 0x120]
add ecx, 0x10000
push ecx
call fcn.004c2e90
add esp, 4
mov dword [esi + 0x11c], eax
test eax, eax
jne 0x470b0f
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [esi + 0x124], 0
mov dword [esi + 0x120], 0
push ebx
push str.FTP:_not_enough_memory_for_file___s_
push 1
push 0x596558
call fcn.004aa400
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
ret 4
mov edx, dword [esi + 0x120]
add edx, 0xfffa
mov dword [esi + 0x124], edx
mov eax, dword [esi + 0x120]
mov ecx, dword [esi + 0x11c]
push edi
push 1
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
push edi
jne 0x470b55
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
ret 4
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push ebx
push str.FTP:_cannot_read_file___s_
push 1
push 0x596558
call fcn.004aa400
add esp, 0x10
mov dword [esi + 0x120], 0
pop edi
pop esi
xor eax, eax
pop ebx
ret 4

Function at 0x470c70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
xor edi, edi
test esi, esi
mov ebx, ecx
mov dword [esp + 0x10], 0xa
je 0x470d03
mov ebp, dword [esp + 0x1c]
cmp ebp, 1
jl 0x470d03
cmp dword [ebx + 0x114], 0xffffffff
je 0x470d03
mov byte [esi], 0
mov eax, dword [ebx + 0x114]
push 0
push 1
push esi
push eax
call sub.WS2_32.dll_recv
cmp eax, 1
jge 0x470cd5
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x470ce5
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
js 0x470d03
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x470c9e
mov al, byte [esi]
cmp al, 0xd
je 0x470c9e
cmp al, 0xa
je 0x470ce5
inc edi
inc esi
cmp edi, ebp
jl 0x470c9e
push 0
mov byte [esi], 0
call dword [sym.imp.MSVCRT.dll_time]
add esp, 4
mov dword [ebx + 0x128], eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 8
Function at 0x470d10
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
push ebp
mov ebp, ecx
push esi
or ecx, 0xffffffff
push edi
mov eax, dword [ebp + 0x114]
mov dword [esp + 0x10], 0xa
cmp eax, ecx
je 0x470da1
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x470da1
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
test esi, esi
jle 0x470d83
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x114]
push 0
push esi
push ebx
push eax
call sub.WS2_32.dll_send
cmp eax, 1
jge 0x470d7b
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x470d83
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
js 0x470da1
push 0x32
call edi
jmp 0x470d7f
add ebx, eax
sub esi, eax
test esi, esi
jg 0x470d49
push 0
call dword [sym.imp.MSVCRT.dll_time]
add esp, 4
mov dword [ebp + 0x128], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x476620
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
test ebx, ebx
je 0x476665
cmp ebp, 1
jl 0x476665
cmp ebp, 0xa8c0
jg 0x476665
mov esi, dword [edi + 0x18]
test esi, esi
je 0x476665
push ebp
push ebx
mov ecx, esi
call fcn.00472da0
cmp eax, 1
je 0x476669
mov esi, dword [esi + 0x868]
test esi, esi
jne 0x47664d
xor esi, esi
jmp 0x476676
test esi, esi
je 0x476676
push 1
mov ecx, esi
call fcn.00474cb0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x4766f7
push edi
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x28]
xor ebx, ebx
cmp eax, ebx
je 0x4766bc
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x14], 0x103
je 0x4766bc
mov edx, dword [edi + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x28], ebx
cmp dword [edi + 0x28], ebx
jne 0x4766e2
mov dword [edi + 0x2c], ebx
lea eax, [esp + 0x18]
push eax
push ebx
push edi
push 0x476fd0
push 0x3e800
push ebx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [edi + 0x28], eax
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebp
setne al
pop ebx
ret 8
push ebp
push ebx
push str.HistoryCenter:_unknown_chart__s_d_in_history_synchronization
push 1
push 0x596558
call fcn.004aa400
add esp, 0x14
xor eax, eax
test esi, esi
pop edi
pop esi
pop ebp
pop ebx
setne al
ret 8
Function at 0x47a2b0
Capabilities:
Delete file

Disassembly:
sub esp, 0x108
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov dword [esp + 8], ebp
cmp dword [esi + 0x14b8], ebp
jle 0x47a32c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
mov edi, dword [sym.imp.MSVCRT.dll__snprintf]
mov eax, dword [esi + 0x14b4]
add eax, ebp
cmp dword [eax], 2
jne 0x47a314
lea edx, [eax + 0xc]
lea ecx, [esi + 4]
push edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 4]
push edx
push eax
push ecx
push ecx
push 0x5965b8
push str._shistorydownloads_s_s__04d__02d__s.dat
lea ecx, [esp + 0x30]
push 0x103
push ecx
call edi
add esp, 0x24
lea edx, [esp + 0x14]
push edx
call ebx
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x14b8]
inc eax
add ebp, 0x30
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x47a2d6
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x108
ret
Function at 0x47b460
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x49c
push ebx
push ebp
push esi
mov ebx, ecx
push edi
xor esi, esi
mov ecx, 0xc1
xor eax, eax
lea edi, [esp + 0x1a8]
mov word [esp + 0x1a4], si
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1a4]
mov ecx, 0x593d48
push eax
mov dword [ebx + 0x18], esi
call fcn.0042f040
lea ecx, [ebx + 4]
lea edx, [esp + 0x1c0]
push ecx
push edx
push 0x5965b8
push str._shistory_s_s1.hst
lea eax, [esp + 0xb4]
push 0xff
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0xbc]
push 0x581660
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 0x20
cmp edi, esi
je 0x47b57e
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push edi
push 1
lea edx, [esp + 0x18]
push 0x94
push edx
call ebp
add esp, 0x10
cmp eax, 1
jne 0x47b574
cmp dword [esp + 0x10], 0x190
jne 0x47b574
mov eax, dword [edi + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll__filelength]
mov ecx, eax
mov eax, 0xba2e8ba3
sub ecx, 0x94
add esp, 4
mul ecx
shr edx, 5
lea ecx, [ebx + 0x10]
lea eax, [edx + edx*4]
lea esi, [edx + eax*2]
shl esi, 2
push esi
call fcn.004b96d0
push 0
push 0x94
push edi
call dword [sym.imp.MSVCRT.dll_fseek]
mov eax, dword [ebx + 0x14]
push edi
push 1
push esi
push eax
call ebp
add esp, 0x1c
cmp eax, 1
push edi
jne 0x47b575
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov dword [ebx + 0x18], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x49c
ret
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x49c
ret
Function at 0x47f410
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x340
push ebx
push esi
mov esi, ecx
push edi
push 0x10000
lea ecx, [esp + 0x10]
call fcn.00518190
mov eax, dword [esi + 0x9c]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x47f695
push 0x581660
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x47f695
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push edi
push 1
lea eax, [esp + 0x30]
push 0x90
push eax
call ebx
add esp, 0x10
cmp eax, 1
jne 0x47f4a4
cmp dword [esp + 0x28], 1
jne 0x47f4a4
mov ecx, dword [esi + 0x88]
push ecx
call fcn.00472aa0
mov ecx, dword [esp + 0x78]
add esp, 4
cmp ecx, eax
jne 0x47f4a4
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, esi
call fcn.0047f6b0
jmp 0x47f695
push 0
push 0
push edi
call dword [sym.imp.MSVCRT.dll_fseek]
push edi
push 1
lea edx, [esp + 0xcc]
push 0x94
push edx
call ebx
add esp, 0x1c
cmp eax, 1
jne 0x47f4f0
cmp dword [esp + 0xb8], 0x190
jne 0x47f4f0
mov eax, dword [esi + 0x88]
push eax
call fcn.00472aa0
mov ecx, dword [esp + 0x10c]
add esp, 4
cmp ecx, eax
je 0x47f48e
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esi + 0x2fc]
push 1
call sub.MFC42.DLL_CWnd::EnableWindow
push 1
lea ecx, [esi + 0x278]
call sub.MFC42.DLL_CWnd::EnableWindow
push 1
lea ecx, [esi + 0x1f4]
call sub.MFC42.DLL_CWnd::EnableWindow
push 1
lea ecx, [esi + 0x170]
call sub.MFC42.DLL_CWnd::EnableWindow
push 1
lea ecx, [esi + 0x130]
call sub.MFC42.DLL_CWnd::EnableWindow
mov eax, dword [esi + 0x9c]
lea ecx, [esp + 0xc]
push eax
mov dword [esi + 0x94], 0
call fcn.00518220
test eax, eax
je 0x47f695
mov eax, dword [esi + 0xb0]
xor edi, edi
test eax, eax
jle 0x47f592
lea ecx, [esp + 0x14c]
push 0x1ff
push ecx
lea ecx, [esp + 0x14]
call fcn.005182d0
test eax, eax
je 0x47f695
mov eax, dword [esi + 0xb0]
inc edi
cmp edi, eax
jl 0x47f569
lea edx, [esp + 0x14c]
push 0x1ff
push edx
lea ecx, [esp + 0x14]
call fcn.005182d0
test eax, eax
je 0x47f695
lea eax, [esp + 0x14c]
mov ecx, esi
push eax
call fcn.0047ead0
cmp eax, 1
jne 0x47f5e2
lea ecx, [esp + 0x14c]
push 0x1ff
push ecx
lea ecx, [esp + 0x14]
call fcn.005182d0
test eax, eax
je 0x47f695
mov ecx, dword [esi + 0x90]
test ecx, ecx
je 0x47f610
mov eax, dword [esp + 0x10]
cdq
and edx, 0x1f
add eax, edx
mov edx, dword [esi + 0x98]
sar eax, 5
cmp edx, eax
jge 0x47f65c
test ecx, ecx
je 0x47f610
push ecx
call fcn.004c2eb0
add esp, 4
mov eax, dword [esp + 0x10]
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
add eax, 0x80
lea edx, [eax + eax*4]
lea eax, [eax + edx*2]
shl eax, 2
push eax
call fcn.004c2e90
add esp, 4
mov dword [esi + 0x90], eax
test eax, eax
jne 0x47f646
mov dword [esi + 0x98], eax
jmp 0x47f695
mov eax, dword [esp + 0x10]
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
add eax, 0x78
mov dword [esi + 0x98], eax
lea ecx, [esp + 0x14c]
push ecx
mov ecx, esi
call fcn.0047f070
lea edx, [esp + 0x14c]
push 0x1ff
push edx
lea ecx, [esp + 0x14]
call fcn.005182d0
test eax, eax
jle 0x47f695
mov eax, dword [esi + 0x94]
mov ecx, dword [esi + 0x98]
cmp eax, ecx
jl 0x47f65c
lea ecx, [esp + 0xc]
call fcn.005181d0
pop edi
pop esi
pop ebx
add esp, 0x340
ret