joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405220
Capabilities:
Write clipboard data

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x18], edi
jne 0x405244
push esi
call fcn.00405500
test eax, eax
jne 0x405244
push 0x4a7ba8
call fcn.00405330
pop edi
pop esi
ret 4
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x40527e
cmp dword [esi + 0x18], edi
je 0x40526f
cmp dword [esi + 8], edi
je 0x405264
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [esi + 8], edi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], edi
mov dword [esi], edi
push 0x4a7bcc
call fcn.00405330
pop edi
pop esi
ret 4
mov ecx, dword [esi + 4]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp ecx, edi
je 0x4052c1
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x4052e9
cmp dword [esp + 0x10], 0xd
push ebx
jne 0x4052a0
cmp word [eax], di
jmp 0x4052a3
cmp byte [eax], 0
push ecx
sete bl
call ebp
test bl, bl
mov dword [esi + 0xc], edi
mov dword [esi + 0x14], edi
pop ebx
je 0x4052e9
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 4], eax
cmp dword [esi + 0x18], edi
je 0x4052de
cmp dword [esi + 8], edi
je 0x4052d3
mov edx, dword [esi]
push edx
call ebp
mov dword [esi + 8], edi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], edi
mov dword [esi], edi
pop ebp
pop edi
mov eax, 1
pop esi
ret 4
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x405301
mov dword [esi + 4], edi
jmp 0x4052c1
cmp dword [esi + 0x18], edi
je 0x40531e
cmp dword [esi + 8], edi
je 0x405313
mov ecx, dword [esi]
push ecx
call ebp
mov dword [esi + 8], edi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [esi + 0x18], edi
mov dword [esi], edi
push 0x4a7bdc
call fcn.00405330
pop ebp
pop edi
pop esi
ret 4

Function at 0x405400
Capabilities:
Read clipboard data

Disassembly:
sub esp, 0x108
test esi, esi
je 0x405410
mov dword [esi], 0
lea eax, [edi - 0xc000]
cmp eax, 0x3fff
ja 0x4054df
push 0x104
lea ecx, [esp + 4]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetClipboardFormatNameA]
push 0xb
lea edx, [esp + 4]
push 0x4a7bf0
push edx
call fcn.0049353e
add esp, 0xc
test eax, eax
je 0x4054d6
lea eax, [esp]
push 0x4a7bfc
push eax
call fcn.00492c11
add esp, 8
test eax, eax
je 0x4054d6
lea ecx, [esp]
push 0x4a7c08
push ecx
call fcn.00492c11
add esp, 8
test eax, eax
je 0x4054d6
lea edx, [esp]
push 0x4a7c14
push edx
call fcn.00492c11
add esp, 8
test eax, eax
je 0x4054d6
lea eax, [esp]
push 0x4a7c1c
push eax
call fcn.00492c11
add esp, 8
test eax, eax
je 0x4054d6
lea ecx, [esp]
push 0x4a7c2c
push ecx
call fcn.00492c11
add esp, 8
test eax, eax
je 0x4054cc
lea edx, [esp]
push 0x4a7c40
push edx
call fcn.00492c11
add esp, 8
test eax, eax
jne 0x4054e3
test esi, esi
je 0x4054d6
mov dword [esi], 1
xor eax, eax
add esp, 0x108
ret
mov byte [esp], 0
push edi
call dword [sym.imp.USER32.dll_GetClipboardData]
add esp, 0x108
ret
Function at 0x406160
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
cmp dword [0x4ba000], 0
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0x4a7df0
mov dword [esp + 0x14], 0x405c50
mov dword [esp + 0x18], 0x4a7de4
mov dword [esp + 0x1c], 0x405f30
mov dword [esp + 0x20], 0x4a7dd4
mov dword [esp + 0x24], fcn.00405c00
je 0x4061bf
movzx eax, word [esp + 0x244]
mov eax, dword [eax*8 + 0x4b7410]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x230
ret 4
push 0x104
lea ecx, [esp + 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4062b7
lea edx, [esp + 0x138]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.004945f8
push 0x4a7e1c
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call fcn.004947de
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x406236
push 0x4a7df0
push esi
call ebx
test eax, eax
jne 0x406282
push esi
call ebp
lea eax, [esp + 0x138]
push eax
lea ecx, [esp + 0x2c]
push 0x10c
push ecx
call fcn.004945f8
push 0x4a7e24
lea edx, [esp + 0x38]
push 0x10c
push edx
call fcn.004947de
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call edi
mov esi, eax
test esi, esi
je 0x4062b7
push 0x4a7df0
push esi
call ebx
test eax, eax
jne 0x406282
push esi
call ebp
jmp 0x4062b7
xor edi, edi
mov ecx, dword [esp + edi*8 + 0x10]
push ecx
push esi
call ebx
mov dword [esp + edi*8 + 0x14], eax
test eax, eax
je 0x40627d
inc edi
cmp edi, 3
jl 0x406284
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [0x4b7410], edx
mov dword [0x4b7418], eax
mov dword [fcn.00405c00], ecx
movzx edx, word [esp + 0x244]
mov eax, dword [edx*8 + 0x4b7410]
pop edi
pop esi
pop ebp
mov dword [0x4ba000], 1
pop ebx
add esp, 0x230
ret 4
Function at 0x40a9a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_recv]
push edi
xor ebx, ebx
jmp 0x40a9b0
mov ecx, dword [esi + 0x2c]
cmp ebx, ecx
jae 0x40a9cf
mov eax, dword [esi + 0x24]
lea ebx, [ebx]
cmp byte [eax + ebx], 0
je 0x40aa57
inc ebx
cmp ebx, ecx
jb 0x40a9c0
cmp ecx, dword [esi + 0x28]
jne 0x40aa19
mov eax, dword [esi + 0x28]
lea ecx, [eax + eax]
test eax, eax
jne 0x40a9e3
mov ecx, 0x800
cmp dword [esi + 0x30], 0
jne 0x40aa44
mov edi, eax
test eax, eax
jne 0x40a9f4
mov edi, 0x800
cmp edi, ecx
jae 0x40a9fe
add edi, edi
cmp edi, ecx
jb 0x40a9f8
cmp edi, eax
jbe 0x40aa19
mov eax, dword [esi + 0x24]
push edi
push eax
call fcn.0049328d
add esp, 8
test eax, eax
je 0x40aa3d
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], edi
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x24]
push 0
sub ecx, eax
push ecx
add edx, eax
mov eax, dword [esi + 0x10]
push edx
push eax
call ebp
cmp eax, 0xffffffff
je 0x40aa44
add dword [esi + 0x2c], eax
jmp 0x40a9b0
mov dword [esi + 0x30], 1
push 0x4a88e0
call fcn.0040af50
add esp, 4
pop edi
pop ebp
pop ebx
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40aa61
mov dword [eax], ebx
pop edi
pop ebp
xor eax, eax
pop ebx
ret 4

Function at 0x40aa70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
push edi
mov ebx, ecx
mov ecx, dword [ebx + 0x3c]
push 0xa
lea eax, [esp + 0x10]
push eax
add ecx, 0x26
push ecx
call fcn.004928a2
lea edx, [esp + 0x18]
push 0
push edx
call fcn.00494720
push 0x4a894c
lea esi, [eax + 1]
push 0x4a8974
push esi
call fcn.00493c7e
mov edx, dword [ebx + 0x10]
add esp, 0x20
add esi, eax
lea eax, [esp + 0xc]
push 0
sub esi, eax
push esi
mov esi, dword [sym.imp.WSOCK32.dll_send]
mov ecx, eax
push ecx
push edx
call esi
cmp eax, 0xffffffff
je 0x40ab23
cmp dword [ebx + 0x40], 0
lea edi, [ebx + 0x34]
jne 0x40ab23
mov ecx, dword [edi + 8]
inc ecx
call fcn.0040b800
test eax, eax
jne 0x40ab23
mov eax, dword [edi]
add eax, dword [edi + 8]
mov cl, byte [0x4a8978]
mov byte [eax], cl
inc dword [edi + 8]
mov edx, dword [ebx + 0x3c]
mov eax, dword [edi]
mov ecx, dword [ebx + 0x10]
push 0
push edx
push eax
push ecx
call esi
cmp eax, 0xffffffff
je 0x40ab23
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x4bc3d8
call fcn.0040aee0
mov edx, dword [0x4bca60]
mov eax, dword [0x4bb448]
push 0x10014
push edx
push 0x4a88e0
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x40ab5d
push 0
push 4
mov ecx, 0x4bc460
call fcn.00420790
pop edi
pop esi
mov eax, 0x3e6
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40afa0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push ebp
push edi
mov edi, ecx
xor ecx, ecx
cmp eax, 0xffffffff
jne 0x40afba
mov eax, edi
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40afb1
sub eax, ebx
mov ebp, eax
cmp eax, 2
jbe 0x40b036
lea edx, [eax - 3]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
mov edi, edi
movzx eax, byte [edi]
movzx ebx, byte [edi + 1]
shl eax, 8
or eax, ebx
movzx ebx, byte [edi + 2]
shl eax, 8
or eax, ebx
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + 0x4a7c50]
mov byte [esi + ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + 0x4a7c50]
mov byte [esi + ecx + 1], bl
mov ebx, eax
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [ebx + 0x4a7c50]
and eax, 0x3f
mov byte [esi + ecx + 2], bl
mov al, byte [eax + 0x4a7c50]
mov byte [esi + ecx + 3], al
add edi, 3
add ecx, 4
sub ebp, 3
dec edx
jne 0x40afd0
test ebp, ebp
je 0x40b0aa
movzx eax, byte [edi]
shl eax, 0x10
cmp ebp, 1
jbe 0x40b04e
movzx edx, byte [edi + 1]
shl edx, 8
or eax, edx
mov edx, eax
shr edx, 0x12
and edx, 0x3f
movzx edx, byte [edx + 0x4a7c50]
mov byte [ecx + esi], dl
mov edx, eax
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + 0x4a7c50]
mov byte [ecx + esi + 1], dl
cmp ebp, 1
jbe 0x40b096
shr eax, 6
and eax, 0x3f
mov al, byte [eax + 0x4a7c50]
pop edi
pop ebp
mov byte [ecx + esi + 2], al
mov word [ecx + esi + 3], 0x3d
lea eax, [ecx + 4]
pop ebx
ret
pop edi
mov al, 0x3d
pop ebp
mov byte [ecx + esi + 2], al
mov word [ecx + esi + 3], 0x3d
lea eax, [ecx + 4]
pop ebx
ret
pop edi
pop ebp
mov byte [ecx + esi], 0
mov eax, ecx
pop ebx
ret

Function at 0x40c000
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
xor ebx, ebx
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
cmp edi, ebx
jne 0x40c04f
mov edi, dword [esi + 4]
cmp edi, ebx
je 0x40c074
mov eax, dword [edi + 0x10]
dec eax
mov dword [edi + 0x10], eax
jne 0x40c041
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x40c038
push eax
call fcn.00492c28
add esp, 4
push edi
call fcn.00492988
add esp, 4
pop edi
pop ebp
mov dword [esi + 4], ebx
mov byte [esi + 8], bl
mov eax, esi
pop ebx
ret 4
push esi
xor cl, cl
call fcn.0040c080
mov ebx, dword [esi + 4]
push edi
call fcn.00404e20
mov eax, dword [esi + 4]
mov eax, dword [eax]
push edi
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, dword [esi + 4]
mov dword [ecx + 8], eax
pop edi
pop ebp
mov eax, esi
pop ebx
ret 4
Function at 0x4108a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
xor al, al
cmp dword [0x4bb578], 0
push esi
push edi
mov byte [esp + 0x1e], al
je 0x4108c4
mov byte [esp + 0x1e], 1
mov al, byte [esp + 0x1e]
cmp dword [0x4bb57c], 0
je 0x4108d3
or al, 2
mov byte [esp + 0x1e], al
cmp byte [ebp + 8], al
je 0x410ae0
test al, al
jne 0x410916
cmp byte [ebp + 0xc], al
jne 0x410916
push 0x4ba348
push 0
push 0
push 0x410bd0
push 0x2000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4bbc78], eax
test eax, eax
je 0x4109a7
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
movzx ebx, byte [ebp + 8]
xor eax, eax
xor esi, esi
cmp byte [ebp + 0xc], al
sete al
mov edi, eax
mov ecx, dword [0x4ba348]
push edi
push ebx
push 0x417
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageA]
test eax, eax
jne 0x41094c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x32
jl 0x410926
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [esp + 0x1f], 0
call edi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x4109b3
push 1
push 0x417
push 0x417
push 0
lea edx, [esp + 0x34]
push edx
call esi
test eax, eax
je 0x410a1a
cmp dword [esp + 0x2c], 0
je 0x4109c2
mov byte [esp + 0x1f], 1
call fcn.00410f50
test al, al
jne 0x4109c2
cmp byte [ebp + 0xc], al
jne 0x410aae
mov byte [ebp + 8], al
jmp 0x410961
call fcn.00410f70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x4109fe
call fcn.00410f50
test al, al
jne 0x410a1a
cmp byte [ebp + 0xc], 0
jne 0x410aa7
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4bb578], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
je 0x410a52
test byte [esp + 0x1e], 1
jne 0x410a6b
push 0x4a9bc8
push 0
push 0
call esi
mov dword [0x4bbc70], eax
jmp 0x410a6b
mov ecx, dword [0x4bbc78]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0x20], 0x103
jne 0x410a32
call edi
sub eax, ebx
cmp eax, 0x1f4
ja 0x4109c2
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x410961
mov edx, dword [0x4bbc78]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov dword [0x4bbc78], 0
call fcn.00410f70
jmp 0x4109d2
test byte [esp + 0x1e], 1
je 0x410a6b
mov eax, dword [0x4bbc70]
push eax
call edi
mov dword [0x4bbc70], 0
cmp dword [0x4bb57c], 0
je 0x410a8d
test byte [esp + 0x1e], 2
jne 0x410aa7
push 0x4a9bd4
push 0
push 0
call esi
mov dword [0x4bbc74], eax
jmp 0x410aa7
test byte [esp + 0x1e], 2
je 0x410aa7
mov ecx, dword [0x4bbc74]
push ecx
call edi
mov dword [0x4bbc74], 0
cmp byte [esp + 0x1f], 0
je 0x410ae0
fldz
sub esp, 8
fstp qword [esp]
mov dword [0x4b79dc], 0
push 0
push 0
push 0x10000
push 0x4a9be0
call fcn.00484510
add esp, 0x18
mov dword [0x4b79dc], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412560
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x804
cmp byte [0x4bcc94], 0
push ebx
push ebp
mov ebp, dword [esp + 0x814]
push esi
push edi
jne 0x4126c9
cmp dword [0x4bbc90], 0
jne 0x412592
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4bbc90], eax
mov ebx, 1
add dword [0x4bcc98], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x4bcc98]
mov esi, dword [0x4b79f0]
mov ecx, eax
sub ecx, dword [0x4bbc90]
mov dword [0x4bbc94], eax
cmp edx, dword [0x4b79ec]
jbe 0x4125c8
cmp ecx, esi
jb 0x412626
xor ebx, ebx
cmp ecx, esi
jbe 0x4125e5
mov dword [0x4bcc98], 0
mov dword [0x4bbc90], eax
test ebx, ebx
jne 0x4126c9
mov esi, dword [esp + 0x818]
mov cl, byte [esi + 0xf]
push 0
push 0
mov byte [0x4bca5d], cl
inc byte [ebp + 0x16]
mov edx, dword [0x4bc9ec]
push 0
push edx
push ebp
call fcn.0047a540
dec byte [ebp + 0x16]
test eax, eax
jne 0x412696
mov byte [ebp + 0x1b], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x804
ret 8
push ecx
push edx
push 0x4aa0a0
mov esi, 0x800
lea edi, [esp + 0x1c]
call fcn.0047f710
add esp, 0xc
call fcn.00411490
fldz
sub esp, 8
fstp qword [esp]
push 0
push 0
mov eax, edi
push 4
push eax
mov byte [0x4bcc94], bl
mov dword [0x4b79dc], 0
call fcn.00484510
add esp, 0x18
cmp eax, 7
jne 0x41267f
push 0
push 4
mov ecx, 0x4bc460
call fcn.00420790
mov eax, dword [0x4bbc94]
mov dword [0x4b79dc], ebx
mov byte [0x4bcc94], 0
jmp 0x4125ce
cmp byte [ebp + 0x1b], 0
je 0x4126c9
mov byte [ebp + 0x1b], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 0xc]
cmp eax, 0x3e8
ja 0x4126c9
movzx eax, word [esi + 4]
mov ecx, dword [0x4bb448]
push 0
push eax
push 0x312
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x804
ret 8
Function at 0x420320
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x4b79e8]
add eax, 4
imul eax, eax, 0xe8
push ebx
push ebp
push esi
push edi
push eax
call fcn.004931f9
add esp, 4
mov dword [0x4ba010], eax
test eax, eax
jne 0x420349
pop edi
pop esi
pop ebp
pop ebx
ret
mov esi, dword [0x4b7a70]
push 0x403de0
mov edi, eax
push 0x4ef6d80
mov ecx, 0x3a
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4bb448]
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0xe
push ecx
mov dword [0x4b7a70], eax
call edi
cmp dword [0x4bc460], 0
jne 0x42038b
mov ebx, 1
jmp 0x420466
mov edx, dword [0x4b7a70]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [edx + 0xcc], 0
call esi
cmp byte [0x4bb5a4], 0
mov ecx, dword [0x4b7a70]
mov dword [ecx + 0xbc], eax
mov dword [ecx + 0xc0], 0x64
jne 0x4203db
mov eax, dword [0x4bb448]
push 0x403c40
push 0x64
push 0xb
push eax
call edi
test eax, eax
setne cl
mov byte [0x4bb5a4], cl
mov byte [0x4bca7d], 1
call esi
mov esi, 1
add dword [0x4bb5bc], esi
push 0x4a8220
mov dword [0x4bcaa4], eax
mov dword [0x4bcaa0], eax
call fcn.0040b890
mov ecx, dword [0x4bc460]
push 0
push 0
push esi
call fcn.00431e00
mov ebx, eax
mov eax, dword [0x4bc3dc]
sub eax, 0xc
mov dword [0x4bc3dc], eax
cmp eax, dword [0x4bc3d8]
jb 0x420436
mov eax, dword [eax]
mov dword [0x4bc3ec], eax
mov dword [0x4bc7d4], eax
sub dword [0x4bb5bc], esi
cmp byte [0x4bb5a4], 0
je 0x42045f
mov edx, dword [0x4bb448]
push 0xb
push edx
call dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x42045f
mov byte [0x4bb5a4], 0
mov byte [0x4bca7d], 0
mov ebp, dword [0x4b7a70]
cmp dword [ebp + 0xe4], 0
je 0x4204c0
mov eax, dword [ebp + 0xe4]
cmp dword [eax + 8], 6
jne 0x42048b
mov eax, dword [eax]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp + 0xe4]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4204a1
push eax
call fcn.00492c28
add esp, 4
mov ecx, dword [ebp + 0xe4]
push ecx
call fcn.00492988
mov dword [ebp + 0xe4], 0
mov ebp, dword [0x4b7a70]
add esp, 4
mov eax, ebp
call fcn.00401000
mov edx, dword [0x4bbc50]
push 1
push 0
push 0xffffffffffffffff
mov byte [ebp + 0xcc], 1
push 0x4a7950
mov ecx, 0x3a
mov esi, ebp
mov edi, 0x4ba100
rep movsd dword es:[edi], dword [esi]
push edx
mov byte [ebp + 0xcc], 1
mov dword [ebp + 0xc0], 0
mov word [ebp + 0xcd], 1
mov dword [ebp + 0x2c], connect
call fcn.004828b0
mov eax, dword [0x4b8c98]
cmp word [eax], 0
jne 0x420558
cmp dword [0x4bbcbc], 0
jne 0x420558
cmp dword [0x4bb578], 0
jne 0x420558
cmp dword [0x4bb57c], 0
jne 0x420558
cmp byte [0x4bb585], 0
jne 0x420558
neg ebx
sbb ebx, ebx
and ebx, 5
push 0
inc ebx
push ebx
mov ecx, 0x4bc460
call fcn.00420790
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x420790
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x14], ecx
mov dword [ecx + 0x5d4], eax
cmp byte [0x4bcca7], bl
jne 0x420959
cmp byte [ecx + 0x61c], bl
je 0x420959
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x4bbc50]
push ebx
push 1
mov dword [0x4bd720], eax
call fcn.00401270
push 0x7f
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.00496040
mov eax, dword [0x4b7a70]
inc dword [0x4bb5bc]
add eax, 0xe8
mov edi, eax
mov byte [esp + 0xc3], bl
mov ecx, 0x3a
mov esi, 0x4ba100
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
mov dword [0x4b7a70], eax
mov dword [eax + 0x2c], ebx
push ebx
mov eax, 0x4bc460
call fcn.00420220
mov dword [0x4bca90], ebx
mov dword [0x4bca94], ebx
cmp dword [0x4bb5ec], ebx
je 0x420853
mov eax, dword [0x4b8c90]
cmp eax, ebx
je 0x420847
mov eax, dword [eax]
cmp eax, ebx
jne 0x42084c
mov eax, 0x4a7935
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edi, dword [0x4b79dc]
push 0x4a973c
mov dword [0x4b79dc], ebx
mov byte [0x4bcca7], 1
call fcn.0040b890
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 0x5c8]
mov byte [esp + 0x13], 1
mov byte [0x4b9034], bl
cmp ecx, ebx
je 0x42089e
call fcn.004012f0
test eax, eax
je 0x42089e
cmp byte [0x4b9034], bl
jne 0x42089e
mov byte [esp + 0x13], bl
mov byte [0x4b9034], 1
cmp byte [esp + 0x13], bl
je 0x4208f7
mov dword [esp + 0x20], ebx
call fcn.0044f480
mov dword [esp + 0x18], eax
mov eax, dword [0x4bd720]
cdq
mov dword [esp + 0x2c], edx
xor edx, edx
cmp dword [esi + 0x5c8], ebx
mov dword [esp + 0x28], eax
sete dl
lea eax, [esp + 0x18]
lea ebx, [esi + 0x594]
mov dword [esp + 0x30], 1
push edx
push 2
push eax
call fcn.0047a6e0
xor ebx, ebx
cmp eax, 3
jne 0x4208f7
mov byte [esp + 0x13], bl
mov eax, dword [0x4bc3dc]
sub eax, 0xc
mov dword [0x4bc3dc], eax
cmp eax, dword [0x4bc3d8]
jb 0x420918
mov eax, dword [eax]
mov dword [0x4bc3ec], eax
mov dword [0x4bc7d4], eax
mov byte [0x4bcca7], bl
cmp byte [esp + 0x13], bl
jne 0x42094b
cmp dword [ebp + 8], 0xffffffff
jle 0x42094b
lea ecx, [esp + 0x38]
push ecx
call fcn.00403ab0
add esp, 4
mov dword [0x4b79dc], edi
mov eax, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push edx
push eax
push esi
call fcn.004209a0
cmp byte [0x4b9034], bl
jne 0x42098e
cmp eax, 6
jne 0x42098e
mov ecx, dword [0x4bb3d8]
cmp byte [ecx], bl
je 0x420979
mov edx, dword [ebp + 0xc]
mov dword [0x4bd720], edx
pop edi
pop esi
mov byte [0x4b9034], 1
mov eax, 8
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
push edx
push eax
push ecx
call fcn.004209a0
int3
Function at 0x42c700
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x20c
push ebx
push ebp
mov ebp, dword [esp + 0x218]
mov ecx, dword [ebp + 0x604]
push esi
mov ebx, eax
push edi
mov eax, 0x4acc54
call fcn.0042c7c0
lea eax, [esp + 0x118]
push 0
push eax
call fcn.0044fbc0
push 0x4acc5c
lea ecx, [esp + 0x124]
push ecx
push 0x4acc70
mov esi, 0x105
lea edi, [esp + 0x24]
call fcn.0047f710
add esp, 0x14
mov edx, edi
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42c790
test al, 0x10
je 0x42c790
lea eax, [esi + 0x102]
call fcn.0047c730
mov dword [ebx + 8], eax
test eax, eax
je 0x42c790
lea ecx, [esi + 1]
push ecx
mov edx, edi
push edx
push eax
call fcn.0049b620
add esp, 0xc
mov dword [ebx + 0xc], esi
jmp 0x42c797
mov dword [ebx + 8], 0x4a7935
mov ecx, dword [ebp + 0x610]
add ebx, 0x10
mov eax, 0x4acc54
call fcn.0042c7c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret 4

Function at 0x42c7c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x108
push esi
push edi
push eax
push ecx
push 0x4acc70
mov esi, 0x105
lea edi, [esp + 0x14]
call fcn.0047f710
add esp, 0xc
mov edx, edi
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42c821
test al, 0x10
je 0x42c821
lea eax, [esi + 0x102]
call fcn.0047c730
mov dword [ebx], eax
test eax, eax
je 0x42c821
lea ecx, [esi + 1]
push ecx
mov edx, edi
push edx
push eax
call fcn.0049b620
add esp, 0xc
pop edi
mov dword [ebx + 4], esi
pop esi
add esp, 0x108
ret
pop edi
mov dword [ebx], 0x4a7935
pop esi
add esp, 0x108
ret