joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c7870
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ff85
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x577018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov ecx, dword [esi + 0x88]
mov dword [ebp - 0x24], esi
mov eax, dword [ecx]
mov eax, dword [eax + 0x34]
call eax
test al, al
jne 0x4c7a32
mov ecx, dword [esi + 0x84]
mov eax, dword [ecx + 0x30]
or eax, dword [ecx + 0x34]
jne 0x4c7930
lea eax, [ebp - 0x40]
push eax
call fcn.004ca400
cmp dword [eax + 0x14], 8
jb 0x4c78d7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x4c7918
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4c790e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c7a57
push ecx
push edx
call fcn.00517162
add esp, 8
sub esp, 0x18
mov eax, esp
push 0xd
push eax
call fcn.004c3170
mov ecx, dword [esi + 0x204]
call fcn.004c2e90
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0x84]
push eax
call fcn.004ca400
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x88]
push 8
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x4c7996
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4c798c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c7a5c
push ecx
push edx
call fcn.00517162
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 0x204]
cmp dword [ecx + 0x4e0], 1
jne 0x4c7a32
push 2
call fcn.004be960
mov ecx, esi
call fcn.004c72f0
mov esi, dword [esi + 0x204]
mov eax, dword [esi + 0x4e0]
cmp eax, 5
je 0x4c7a39
cmp eax, 6
je 0x4c7a39
cmp byte [esi + 0x3b8], 1
jbe 0x4c7a39
mov ecx, dword [esi + 0x538]
call fcn.004cc110
test al, al
je 0x4c7a39
mov ecx, esi
call fcn.004c2190
jmp 0x4c7a39
mov ecx, esi
call fcn.004c72f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00517154
mov esp, ebp
pop ebp
ret 4
call fcn.0051eb64
call fcn.0051eb64
int3
Function at 0x4c7bb0
Capabilities:
Encrypt data via sspi
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x577018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
cmp byte [ebx + 0x96], 0
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x74], esi
je 0x4c7d32
mov ecx, dword [ebx + 0x204]
lea eax, [ebp - 0x60]
push eax
call fcn.004bf1d0
lea ecx, [ebp - 0x60]
mov bl, byte [eax + 4]
call fcn.004bdab0
test bl, bl
mov ebx, dword [ebp - 0x70]
je 0x4c7c09
cmp byte [ebx + 0x210], 0
je 0x4c7d32
mov esi, dword [ebp + 0xc]
cmp esi, dword [ebx + 0x78]
ja 0x4c7cba
mov eax, dword [ebx + 0x74]
add eax, esi
add eax, dword [ebx + 0x70]
push eax
call fcn.00517934
mov ecx, dword [ebx + 0x70]
add esp, 4
mov edi, eax
add ecx, edi
mov dword [ebp - 0x70], edi
push esi
push dword [ebp - 0x74]
push ecx
call fcn.005190f0
mov ecx, dword [ebx + 0x70]
add esp, 0xc
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], 7
lea eax, [ecx + edi]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], eax
add eax, esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x74]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x6c]
push 0
push eax
push 0
lea eax, [ebx + 0x214]
mov dword [ebp - 0x2c], 1
push eax
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 4
call dword [sym.imp.Secur32.dll_EncryptMessage]
test eax, eax
jns 0x4c7cd0
push edi
call fcn.00517611
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00517154
mov esp, ebp
pop ebp
ret 8
mov edi, dword [ebp - 0x24]
add edi, dword [ebp - 0x30]
add edi, dword [ebp - 0x3c]
push 0
push edi
push dword [ebp - 0x70]
push dword [ebx + 0xc]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
call fcn.00516ae0
push 0
push 0x2710
push edx
push eax
call fcn.0053aaa0
push dword [ebp - 0x70]
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], edx
call fcn.00517611
mov eax, dword [ebp + 0xc]
or ecx, 0xffffffff
add esp, 4
cmp esi, edi
cmovne eax, ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00517154
mov esp, ebp
pop ebp
ret 8
push 0
push dword [ebp + 0xc]
push esi
push dword [ebx + 0xc]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
call fcn.00516ae0
push 0
push 0x2710
push edx
push eax
call fcn.0053aaa0
mov ecx, dword [ebp - 4]
mov dword [ebx + 0x10], eax
xor ecx, ebp
pop edi
mov eax, esi
mov dword [ebx + 0x14], edx
pop esi
pop ebx
call fcn.00517154
mov esp, ebp
pop ebp
ret 8
Function at 0x4c8dd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.005182f0
mov eax, dword [0x577018]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
nop dword [eax]
push 0
push 0x4000
lea eax, [ebp - 0x400c]
push eax
push dword [edi + 0xc]
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.00516ae0
push 0
push 0x2710
push edx
push eax
call fcn.0053aaa0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
test ebx, ebx
jg 0x4c8df0
je 0x4c8e79
cmp esi, 0x2733
je 0x4c8e64
cmp esi, 0x8c
je 0x4c8e64
cmp esi, 0xb
je 0x4c8e64
cmp esi, 0x2734
je 0x4c8e64
cmp esi, 0x70
je 0x4c8e64
cmp esi, 0x2735
je 0x4c8e64
cmp esi, 0x67
je 0x4c8e64
cmp esi, 4
jne 0x4c8e79
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00517154
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00517154
mov esp, ebp
pop ebp
ret 4
Function at 0x4c9d20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5401dd
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x577018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], esi
lea eax, [ebp + 0x24]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 0xc]
mov dword [esi], vtable.NeatSegment.0
mov byte [esi + 8], 1
call fcn.00402a10
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x2c], eax
xor eax, eax
mov dword [esi + 0x38], edi
sub edi, ebx
mov dword [esi + 0x3c], ecx
sbb ecx, dword [ebp + 0x14]
add edi, 1
mov word [edx + 0x4a], ax
mov eax, dword [ebp + 0x20]
adc ecx, 0
mov dword [edx + 0x4c], eax
mov eax, edx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov si, word [ebp + 0xc]
mov word [edx + 0x48], si
mov edx, dword [ebp + 8]
mov dword [eax + 0x44], ecx
movzx ecx, word [eax + 0x4a]
mov dword [eax + 0x50], 1
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], 0
mov dword [eax + 0x40], edi
cmp dword [edx + 0xa0], 1
movzx eax, si
mov esi, dword [ebp - 0x10]
cmove ecx, eax
mov word [esi + 0x4a], cx
mov ecx, dword [ebp + 0x38]
cmp ecx, 0x10
jb 0x4c9e1c
mov edx, dword [ebp + 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4c9e12
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4c9e32
push ecx
push edx
call fcn.00517162
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x34
call fcn.0051eb64
int3
Function at 0x4c9eb0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x577018]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov dword [esi + 0x38], eax
sub eax, dword [esi + 0x28]
mov dword [esi + 0x3c], ecx
sbb ecx, dword [esi + 0x2c]
add eax, 1
mov dword [esi + 0x40], eax
adc ecx, 0
mov dword [esi + 0x44], ecx
cmp dword [esi + 0x34], ecx
jl 0x4c9f12
jg 0x4c9ef3
cmp dword [esi + 0x30], eax
jb 0x4c9f12
cmp dword [esi + 0x50], 2
je 0x4c9f12
push ecx
mov ecx, dword [esi + 0x54]
push eax
mov dword [esi + 0x50], 2
call fcn.004cab50
mov ecx, dword [esi + 0x54]
call fcn.004cd070
cmp byte [ebp + 0x10], 0
je 0x4ca00c
mov edi, dword [esi + 0x54]
cmp dword [edi + 0xa0], 1
jne 0x4ca00c
movzx ebx, word [esi + 0x4a]
lea ecx, [edi + 0xa4]
lea esi, [edi + 0xbc]
mov edx, esi
call fcn.00408c90
mov ecx, dword [edi + 0x9c]
push 6
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [edi + 0x9c]
mov eax, ebx
push 0
push 0
mov edx, dword [ecx]
lea eax, [eax + eax*2]
shl eax, 3
push eax
call dword [edx + 0x1c]
mov ecx, dword [edi + 0x9c]
lea edx, [esp + 0x10]
push 0x18
push edx
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp eax, 0x18
jne 0x4c9fc4
cmp word [esp + 0x10], bx
jne 0x4c9fc4
mov ecx, dword [edi + 0x9c]
push 1
push 0xffffffffffffffff
push 0xffffffffffffffe8
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov eax, dword [edi + 0x80]
lea edx, [esp + 0x10]
mov ecx, ebx
push 0x18
push edx
mov eax, dword [eax + ecx*4]
mov ecx, dword [eax + 0x38]
mov eax, dword [eax + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [edi + 0x9c]
mov dword [esp + 0x2c], eax
mov eax, dword [ecx]
call dword [eax + 0x14]
jmp 0x4c9ff2
sub esp, 0x18
mov ecx, esp
push 0x21
push str.Can_not_update_Ts_Segment_End_Pos
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.00402bc0
push 0
mov ecx, edi
call fcn.004cf950
mov ecx, dword [edi + 0x9c]
mov eax, dword [ecx]
call dword [eax + 0xc]
cmp dword [esi + 0x14], 8
jb 0x4ca005
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00517154
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cad40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebx + 0x84]
mov esi, dword [ebx + 0x80]
mov dword [esp + 0xc], eax
cmp esi, eax
je 0x4cadf0
nop dword [eax]
cmp byte [ebp + 8], 0
mov edi, dword [esi]
je 0x4cadd3
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.004ca400
cmp dword [eax + 0x14], 8
jb 0x4cad8c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x24]
cmp ecx, 8
jb 0x4cadcf
mov edx, dword [esp + 0x10]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4cadc5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4cae58
push ecx
push edx
call fcn.00517162
add esp, 8
mov eax, dword [esp + 0xc]
test edi, edi
je 0x4cade3
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov eax, dword [esp + 0xc]
add esi, 4
cmp esi, eax
jne 0x4cad70
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp + 8], 0
mov eax, dword [ebx + 0x80]
mov dword [ebx + 0x84], eax
mov eax, dword [ebx + 0x8c]
mov dword [ebx + 0x90], eax
je 0x4cae36
cmp dword [ebx + 0xb8], 8
lea eax, [ebx + 0xa4]
jb 0x4cae1f
mov eax, dword [eax]
push eax
call edi
cmp dword [ebx + 0xd0], 8
lea eax, [ebx + 0xbc]
jb 0x4cae33
mov eax, dword [eax]
push eax
call edi
xor eax, eax
mov dword [ebx + 0x2c], 0xa00
pop edi
pop esi
mov word [ebx + 0x22c], ax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x28], eax
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0051eb64
int3
Function at 0x4cef40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x577018]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
movzx esi, word [ebp + 8]
push edi
mov edi, ecx
lea edx, [edi + 0xbc]
lea ecx, [edi + 0xa4]
call fcn.00408c90
mov ecx, dword [edi + 0x9c]
push 6
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [edi + 0x9c]
push 2
push 0
push 0
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov eax, dword [edi + 0x80]
mov ecx, esi
mov dword [ebp - 0x2c], ecx
push 0x18
mov edx, dword [eax + ecx*4]
movzx eax, word [edx + 0x4a]
mov word [ebp - 0x24], ax
movzx eax, word [edx + 0x48]
mov word [ebp - 0x22], ax
mov eax, dword [edx + 0x4c]
mov dword [ebp - 0x20], eax
mov eax, dword [edx + 0x28]
mov ecx, dword [edx + 0x2c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [edx + 0x38]
mov ecx, dword [edx + 0x3c]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov ecx, dword [edi + 0x9c]
mov dword [ebp - 0x14], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x14]
mov edx, dword [edi + 0x84]
mov bl, 1
mov eax, dword [edi + 0x80]
xor ecx, ecx
sub edx, eax
mov byte [ebp - 0x25], bl
sar edx, 2
test edx, edx
je 0x4cf0e4
xor esi, esi
nop word [eax + eax]
lea ebx, [esi*4]
mov eax, dword [ebx + eax]
mov ebx, dword [ebp - 0x2c]
cmp dword [eax + 0x4c], ebx
lea ebx, [esi*4]
je 0x4cf02c
mov eax, dword [edi + 0x80]
inc ecx
movzx esi, cx
cmp esi, edx
jb 0x4cf000
jmp 0x4cf0e1
cmp esi, 0xffffffff
jle 0x4cf0e1
mov ecx, dword [edi + 0x9c]
push 0
push 0
push 0
mov eax, dword [ecx]
mov byte [ebp - 0x25], 0
call dword [eax + 0x1c]
nop word [eax + eax]
mov ecx, dword [edi + 0x9c]
lea edx, [ebp - 0x24]
push 0x18
push edx
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp eax, 0x18
jne 0x4cf0af
movzx eax, word [ebp - 0x24]
cmp eax, esi
jne 0x4cf050
mov eax, dword [edi + 0x80]
push 1
push 0xffffffffffffffff
push 0xffffffffffffffe8
mov eax, dword [ebx + eax]
mov ecx, dword [eax + 0x38]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x14], ecx
mov ecx, dword [edi + 0x9c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov ecx, dword [edi + 0x9c]
lea edx, [ebp - 0x24]
push 0x18
push edx
mov eax, dword [ecx]
call dword [eax + 0x14]
mov bl, 1
jmp 0x4cf0e4
test eax, eax
jg 0x4cf050
sub esp, 0x18
mov ecx, esp
push 0x28
push str.Can_not_Add__new_Segment_to_config_file.
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
call fcn.00402bc0
push 2
mov ecx, edi
call fcn.004cf950
mov bl, byte [ebp - 0x25]
mov ecx, dword [edi + 0x9c]
mov eax, dword [ecx]
call dword [eax + 0xc]
cmp dword [edi + 0xd0], 8
lea eax, [edi + 0xbc]
jb 0x4cf100
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00517154
mov esp, ebp
pop ebp
ret 4
Function at 0x4cf790
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
lea edi, [ebx + 0xbc]
mov ecx, edi
lea esi, [ebx + 0xa4]
call fcn.004102e0
test al, al
je 0x4cf7de
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4cf7bf
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, esi
mov ecx, edi
call fcn.00408c90
cmp dword [edi + 0x14], 8
jb 0x4cf7d7
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, esi
call fcn.00408d80
mov ecx, eax
mov dword [esp + 0x10], eax
or ecx, edx
mov dword [esp + 0x14], edx
je 0x4cf8be
push 0
push 0x18
push edx
push eax
call fcn.0053aaa0
mov edi, eax
mov esi, edx
mov eax, dword [esp + 0x10]
mov ecx, edi
shld esi, ecx, 1
add ecx, ecx
add edi, ecx
mov ecx, dword [esp + 0x14]
adc edx, esi
shld edx, edi, 3
shl edi, 3
sub eax, edi
sbb ecx, edx
or eax, ecx
jne 0x4cf8b8
mov ecx, dword [ebx + 0x9c]
push 6
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, 0xaaaaaaab
mov ecx, ebx
mul dword [esp + 0x10]
shr edx, 4
cmp dword [ebx + 0xa0], 0
movzx eax, dx
push eax
jne 0x4cf85c
call fcn.004cf3c0
jmp 0x4cf861
call fcn.004cf120
mov ecx, dword [ebx + 0x9c]
mov byte [esp + 0xf], al
mov eax, dword [ecx]
call dword [eax + 0xc]
cmp byte [esp + 0xf], 0
lea eax, [ebx + 0xa0]
je 0x4cf8d3
cmp dword [ebx + 0x34], 0
lea eax, [ebx + 0xa0]
jl 0x4cf8d3
jg 0x4cf891
cmp dword [ebx + 0x30], 0
jbe 0x4cf8d3
cmp dword [ebx + 0x28], 0
jne 0x4cf8af
cmp dword [ebx + 0x2c], 0xa00
jne 0x4cf8af
cmp dword [ebx + 0xa0], 1
lea eax, [ebx + 0xa0]
jne 0x4cf8d3
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea esi, [ebx + 0xa4]
cmp dword [esi + 0x14], 8
jb 0x4cf8c6
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebx + 0xa0]
cmp dword [eax], 0
mov ecx, ebx
mov byte [esp + 0xf], 0
jne 0x4cf8f1
push 1
call fcn.004cad40
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004cbea0
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dc8c0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541f85
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x577018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
sub esp, 0x18
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00408180
mov ecx, esi
call fcn.004084d0
cmp dword [ebp + 0x20], 0
lea eax, [esi + 8]
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [esi], vtable.NeatMKVFile.0
jne 0x4dc948
push 0x402
push eax
call fcn.00408ec0
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ecx
jmp 0x4dc961
push 0x104
push eax
call fcn.00408ec0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x4dc997
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4dc98d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4dc9b5
push ecx
push edx
call fcn.00517162
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517154
mov esp, ebp
pop ebp
ret 0x1c
call fcn.0051eb64
int3
Function at 0x4e1320
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x577018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov edi, ecx
cmp ebx, 0x78
jae 0x4e13b3
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push ebx
cmovae eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x86]
mov byte [ebp - 0x88], 0x81
push eax
mov byte [ebp - 0x87], bl
call fcn.005190f0
add esp, 8
mov ecx, edi
add ebx, 2
call fcn.004c8dd0
test al, al
je 0x4e13b3
push 0
push ebx
lea eax, [ebp - 0x88]
push eax
push dword [edi + 0xc]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
call fcn.00516ae0
push 0
push 0x2710
push edx
push eax
call fcn.0053aaa0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
cmp ebx, esi
jne 0x4e13b3
mov bl, 1
jmp 0x4e13b5
xor bl, bl
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x4e13e5
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4e13db
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e13fa
push ecx
push edx
call fcn.00517162
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00517154
mov esp, ebp
pop ebp
ret 0x18
call fcn.0051eb64
int3
Function at 0x4e4890
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.005182f0
mov eax, dword [0x577018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2008]
push eax
push 0x1000
push 0xd
push dword [ecx + 0xc]
mov dword [ebp - 0x200c], esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x2008]
mov dword [esi + 0x14], 0
lea edx, [ecx + 2]
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e4900
sub ecx, edx
lea eax, [ebp - 0x2008]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00408270
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00517154
mov esp, ebp
pop ebp
ret 4

Function at 0x4e4c40
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54252d
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x577018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0x3c]
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
cmp esi, eax
je 0x4e4c93
cmp dword [ebp + 0x1c], 8
mov ecx, esi
push dword [ebp + 0x18]
cmovae eax, dword [ebp + 8]
push eax
call fcn.00408270
push dword [edi + 0x2c]
call dword [sym.imp.USER32.dll_DestroyIcon]
push dword [edi + 0x30]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [edi + 0x30], 0
mov dword [edi + 0x2c], 0
cmp dword [esi + 0x14], 8
jb 0x4e4cbb
mov esi, dword [esi]
push pe_nt_image_headers32
push 0x2b4
lea eax, [ebp - 0x2c4]
push eax
push 0x80
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2c4]
push 0x101
push 0
push 0
push dword [edi + 0xc]
mov dword [edi + 0x2c], eax
call dword [sym.imp.USER32.dll_RedrawWindow]
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x4e4d29
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e4d1f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e4d46
push ecx
push edx
call fcn.00517162
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00517154
mov esp, ebp
pop ebp
ret 0x18
call fcn.0051eb64
int3
Function at 0x4e4e70
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x577018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push esi
cmovae eax, dword [ebp + 8]
mov esi, ecx
push 0x111
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push 0x80
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push dword [ebp - 0x2b8]
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov ecx, dword [ebp + 0x1c]
mov esi, eax
cmp ecx, 8
jb 0x4e4ef6
mov edx, dword [ebp + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4e4eec
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e4f09
push ecx
push edx
call fcn.00517162
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00517154
mov esp, ebp
pop ebp
ret 0x18
call fcn.0051eb64
int3

Function at 0x4e5d30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54243d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x577018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push dword [ebp + 8]
call fcn.004e4600
mov eax, dword [ebp + 0x1c]
lea ecx, [ebx + 0x14]
push 9
mov dword [ebp - 4], 0
push str.NeatPanel
mov dword [ebx], vtable.NeatPanel.0
mov dword [ebx + 0x2c], eax
call fcn.00402bc0
movd xmm0, dword [ebp + 0x18]
movsd xmm1, qword [0x577b80]
cvtdq2pd xmm0, xmm0
push 0
push 0
push dword [ebx + 8]
mulsd xmm0, xmm1
push dword [ebp + 8]
cvttsd2si esi, xmm0
movd xmm0, dword [ebp + 0x14]
cvtdq2pd xmm0, xmm0
push esi
mulsd xmm0, xmm1
cvttsd2si edx, xmm0
movd xmm0, dword [ebp + 0x10]
cvtdq2pd xmm0, xmm0
push edx
mulsd xmm0, xmm1
cvttsd2si ecx, xmm0
movd xmm0, dword [ebp + 0xc]
cvtdq2pd xmm0, xmm0
push ecx
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
push eax
push 0x5000000d
push 0
push str.STATIC
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push dword [ebx + 0x2c]
mov dword [ebx + 0xc], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [ebx + 0x30], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18