joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493a20
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5d36a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [esp + 0x34]
push ebx
push ebp
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push connect
push eax
mov dword [esp + 0x2c], ecx
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x493a77
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
add esp, 0x30
ret 4
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 4
mov esi, eax
call fcn.004d9305
add esp, 4
mov dword [esp + 0x44], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x3c], 1
cmp eax, ebx
je 0x493aa8
lea ecx, [esp + 0x1c]
mov dword [eax], ecx
jmp 0x493aaa
xor eax, eax
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x1c], eax
mov dword [esp + 0x3c], 3
lea edx, [esp + 0x44]
push edx
push esi
lea ecx, [esp + 0x24]
mov byte [esp + 0x4c], bl
call fcn.0042c4e0
mov dword [esp + 0x3c], 4
mov dword [esp + 0x10], ebx
cmp esi, 0x36
jb 0x493b6e
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x28]
jne 0x493af5
call fcn.0051d2bd
mov edx, dword [esp + 0x28]
push ebx
lea ecx, [esp + 0x14]
push ecx
push esi
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x493b6e
cmp dword [esp + 0x10], esi
jne 0x493b6e
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x28]
jne 0x493b21
call fcn.0051d2bd
mov ecx, dword [esp + 0x28]
push esi
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0048eba0
mov ebp, eax
mov dword [esp + 0x3c], 5
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x493b4b
push eax
call fcn.004d9334
add esp, 4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], 0xffffffff
mov edx, dword [esp + 0x1c]
push edx
call fcn.004d9334
add esp, 4
jmp 0x493b7f
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.004287c0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x34]
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 4
Function at 0x497b80
Capabilities:
Check for time delay via gettickcount
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x50]
push edi
mov dword [esp + 0x10], eax
mov dword [esi + 0x50], 0x69
xor ebx, ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, dword [esp + 0x12c]
cmp ebp, ebx
mov dword [esp + 0x14], eax
jle 0x497cca
jmp 0x497bc0
mov ecx, dword [esi + 8]
push 0xfc
lea edx, [esp + 0x2c]
push ebx
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ecx
call fcn.0051d400
mov eax, dword [esp + 0x13c]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push ebx
lea edx, [esp + 0x28]
push edx
push ebx
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jl 0x497cd9
mov eax, dword [esi + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x497cd9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x134]
ja 0x497cd9
cmp dword [esp + 0x20], 1
jne 0x497bc0
cmp dword [esi + 0x24], ebx
jne 0x497c62
mov edx, dword [esp + 0x128]
push ebx
mov ecx, ebp
sub ecx, edi
push ecx
mov ecx, dword [esi + 8]
lea eax, [edi + edx]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
jmp 0x497c7e
mov eax, dword [esp + 0x128]
mov edx, ebp
sub edx, edi
push edx
mov edx, dword [esi + 0x20]
lea ecx, [edi + eax]
push ecx
push edx
call fcn.004c4070
add esp, 0xc
cmp eax, ebx
jle 0x497c86
add edi, eax
jmp 0x497ca9
jne 0x497c8d
cmp dword [esi + 0x24], ebx
je 0x497ca9
cmp dword [esi + 0x24], ebx
je 0x497ca9
push eax
mov eax, dword [esi + 0x20]
push eax
call fcn.004c61b0
add esp, 8
cmp eax, 2
je 0x497ca9
cmp eax, 3
jne 0x497cd9
mov edx, dword [esi + 0xc]
mov ecx, dword [esp + 0x10]
push ebx
push edx
mov dword [esi + 0x50], ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x497cd9
cmp edi, ebp
jl 0x497bc0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x114
ret 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x114
ret 0x10
Function at 0x497cf0
Capabilities:
Check for time delay via gettickcount
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x114
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x50]
push edi
mov dword [esp + 0x10], eax
mov dword [esi + 0x50], 0x6a
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [esp + 0x12c]
mov dword [esp + 0x14], eax
test ebx, ebx
jle 0x497ea1
jmp 0x497d30
mov ecx, dword [esi + 8]
push 0xfc
lea edx, [esp + 0x2c]
push 0
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ecx
call fcn.0051d400
mov eax, dword [esp + 0x13c]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
lea edx, [esp + 0x2c]
push edx
push 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jl 0x497eb7
mov eax, dword [esi + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x497eb0
cmp dword [esp + 0x20], 0
jne 0x497dc6
cmp ebp, ebx
jge 0x497ea1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x134]
ja 0x497eb7
jmp 0x497e99
cmp dword [esi + 0x24], 0
jne 0x497df0
mov ecx, dword [esp + 0x138]
mov eax, dword [esp + 0x128]
push ecx
mov edx, ebx
sub edx, ebp
push edx
mov edx, dword [esi + 8]
lea ecx, [eax + ebp]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
jmp 0x497e31
test byte [esp + 0x138], 2
je 0x497e15
mov ecx, dword [esp + 0x128]
mov eax, ebx
sub eax, ebp
push eax
mov eax, dword [esi + 0x20]
lea edx, [ecx + ebp]
push edx
push eax
call fcn.004c4020
jmp 0x497e2e
mov edx, dword [esp + 0x128]
mov ecx, ebx
sub ecx, ebp
push ecx
mov ecx, dword [esi + 0x20]
lea eax, [edx + ebp]
push eax
push ecx
call fcn.004c3fd0
add esp, 0xc
mov edi, eax
test edi, edi
jle 0x497e3b
add ebp, edi
jmp 0x497e62
je 0x497ec7
test edi, edi
jge 0x497e62
cmp dword [esi + 0x24], 0
je 0x497eb7
mov edx, dword [esi + 0x20]
push edi
push edx
call fcn.004c61b0
add esp, 8
cmp eax, 2
je 0x497e62
cmp eax, 3
jne 0x497eb7
mov eax, dword [esp + 0x10]
mov dword [esi + 0x50], eax
test edi, edi
jle 0x497e77
test byte [esp + 0x138], 2
jne 0x497ece
cmp dword [esi + 0x24], 0
je 0x497e99
test byte [esp + 0x138], 2
jne 0x497e99
mov ecx, dword [esi + 0x20]
push ecx
call fcn.004c3d20
add esp, 4
test eax, eax
jl 0x497eb7
je 0x497ece
cmp ebp, ebx
jl 0x497d30
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x114
ret 0x14
mov edx, dword [esp + 0x10]
mov dword [esi + 0x50], edx
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x114
ret 0x14
mov eax, dword [esp + 0x10]
mov dword [esi + 0x50], eax
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x114
ret 0x14
Function at 0x497ee0
Capabilities:
Check for time delay via gettickcount
Send data
Send data on socket

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x50]
mov dword [esp + 0x10], eax
mov dword [edi + 0x50], 0x6b
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], eax
test ebp, ebp
jle 0x498000
nop
cmp dword [edi + 0x24], 0
jne 0x497f33
mov edx, dword [esp + 0x1c]
push 0
mov ecx, ebp
sub ecx, ebx
push ecx
mov ecx, dword [edi + 8]
lea eax, [ebx + edx]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
jmp 0x497f97
mov eax, dword [esp + 0x1c]
mov edx, ebp
sub edx, ebx
push edx
mov edx, dword [edi + 0x20]
lea ecx, [ebx + eax]
push ecx
push edx
call fcn.004c4070
mov esi, eax
add esp, 0xc
test esi, esi
je 0x497ff3
mov eax, dword [edi + 0x10]
test eax, eax
je 0x497f64
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
test esi, esi
jge 0x497f88
mov eax, dword [edi + 0x20]
push esi
push eax
call fcn.004c61b0
add esp, 8
sub eax, 0
je 0x497f84
sub eax, 2
je 0x497f84
sub eax, 1
jne 0x497ff3
xor esi, esi
jmp 0x497fa8
jle 0x497f97
mov ecx, dword [edi + 0x20]
push esi
push ecx
call fcn.004c61b0
add esp, 8
test esi, esi
jge 0x497fa8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x497ff0
mov edx, dword [esp + 0x10]
mov dword [edi + 0x50], edx
test esi, esi
jle 0x497fb5
add ebx, esi
cmp ebx, ebp
jge 0x498000
mov eax, dword [esp + 0x24]
mov ecx, dword [edi + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x497ff3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x28]
jbe 0x497f10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret 0x10
mov dword [edi + 0x4c], eax
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret 0x10
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 8
ret 0x10
Function at 0x498010
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x50]
mov dword [esp + 0x10], eax
mov dword [edi + 0x50], 0x6c
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x14], eax
test ebx, ebx
jle 0x498106
nop
cmp dword [edi + 0x24], 0
jne 0x498112
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
push ecx
mov edx, ebx
sub edx, ebp
push edx
mov edx, dword [edi + 8]
lea ecx, [eax + ebp]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jge 0x49807d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x498199
mov eax, dword [esp + 0x10]
mov dword [edi + 0x50], eax
test esi, esi
jle 0x498176
add ebp, esi
test esi, esi
jle 0x498099
test byte [esp + 0x2c], 2
jne 0x498106
cmp ebp, ebx
jge 0x4980db
mov ecx, dword [esp + 0x24]
mov edx, dword [edi + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4981a9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x28]
ja 0x4981a9
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x4980db
mov eax, dword [ecx]
mov edx, dword [eax]
push ebx
push ebp
call edx
cmp dword [edi + 0x24], 0
je 0x4980fe
test byte [esp + 0x2c], 2
jne 0x4980fe
mov eax, dword [edi + 0x20]
push eax
call fcn.004c3d20
add esp, 4
test eax, eax
jl 0x49819c
je 0x498106
cmp ebp, ebx
jl 0x498040
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret 0x18
test byte [esp + 0x2c], 2
je 0x498131
mov ecx, dword [esp + 0x1c]
mov eax, ebx
sub eax, ebp
push eax
mov eax, dword [edi + 0x20]
lea edx, [ecx + ebp]
push edx
push eax
call fcn.004c4020
jmp 0x498147
mov edx, dword [esp + 0x1c]
mov ecx, ebx
sub ecx, ebp
push ecx
mov ecx, dword [edi + 0x20]
lea eax, [edx + ebp]
push eax
push ecx
call fcn.004c3fd0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x49819c
jge 0x49807d
mov edx, dword [edi + 0x20]
push esi
push edx
call fcn.004c61b0
add esp, 8
test eax, eax
je 0x49816f
add eax, 0xfffffffe
cmp eax, 1
ja 0x49819c
xor esi, esi
jmp 0x49807d
jne 0x49808e
cmp dword [edi + 0x24], 0
jne 0x498099
mov dword [edi + 0x4c], 0
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret 0x18
mov dword [edi + 0x4c], eax
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret 0x18
or eax, 0xffffffff
mov dword [edi + 0x4c], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x18
Function at 0x498200
Capabilities:
Check for time delay via gettickcount
Get socket status
Receive data
Receive data on socket

Disassembly:
cmp dword [ecx + 0x14], 0
mov eax, dword [esp + 0xc]
je 0x498229
test eax, eax
jne 0x498211
mov eax, dword [ecx + 0x2c]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x28]
mov dword [esp + 0xc], eax
jmp fcn.00497cf0
test eax, eax
jne 0x498230
mov eax, dword [ecx + 0x2c]
mov edx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
push edx
push eax
mov eax, 0x10624dd3
mul dword [ecx + 0x28]
mov eax, dword [esp + 0x14]
shr edx, 6
push edx
mov edx, dword [esp + 0x14]
push eax
push edx
call fcn.00498010
ret 0x14
Function at 0x499a20
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x5d3c83
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov dword [esp + 0x14], 0
push 0x14
call fcn.004d9305
mov esi, eax
add esp, 4
mov dword [esp + 8], esi
mov byte [esp + 0x14], 1
test esi, esi
je 0x499ac0
push 0
lea ecx, [esp + 0x20]
call fcn.00438c70
push eax
call fcn.00551b3b
add esp, 4
push 0
push 0
push 0
push 0
mov dword [esi], 0x5e62d0
mov dword [esi + 4], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 8], eax
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x4989c0
push 0
push 0
mov dword [esp + 0x1c], 0
call fcn.0052174d
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x499ac2
xor esi, esi
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.004381e0
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x49df40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d4278
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebp
mov ebp, dword [esp + 0x40]
push esi
mov eax, ebp
push edi
mov esi, ecx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49df66
sub eax, edx
sar eax, 1
add eax, 0x400
push eax
lea ecx, [esp + 0x24]
call fcn.00422c70
mov dword [esp + 0x40], 0
cmp dword [esi + 4], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x48], 0
jne 0x49dfa6
xor edi, edi
jmp 0x49dfa9
mov edi, dword [esi + 0xc]
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x2c]
sar eax, 1
jne 0x49dfba
call fcn.0051d2bd
push edi
push 1
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push ecx
push ebp
call fcn.00460600
add esp, 0x1c
test eax, eax
mov eax, dword [esp + 0x48]
je 0x49e03b
test eax, eax
je 0x49e03b
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 8], ecx
mov ecx, esi
mov dword [eax + 0xc], edx
call fcn.004994d0
mov esi, eax
mov dword [esp + 0x40], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.0040e160
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0x38
ret 8
mov dword [esi + 0x50], 0x65
test eax, eax
jne 0x49e04d
mov dword [esi + 0x50], 0x66
mov dword [esp + 0x40], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.0040e160
mov ecx, dword [esp + 0x38]
pop edi
pop esi
or eax, 0xffffffff
mov dword fs:[0], ecx
pop ebp
add esp, 0x38
ret 8
Function at 0x4a9ae0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
push ebx
push esi
push edi
push eax
push ecx
mov ebx, 1
xor esi, esi
mov dword [ebp - 8], esi
push ebx
call fcn.004b3ca0
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add esp, 0xc
test edx, edx
je 0x4a9c92
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, 0xf4240
mov dword [ecx + 0x290], eax
mov dword [edx + 0x294], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push 0x40
push 0x5245f0
push ecx
mov dword [eax + 0x298], esi
call fcn.004ad530
push esi
push eax
call fcn.005246a4
add esp, 0x14
test eax, eax
je 0x4a9b57
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [ebp + 0x20]
mov edx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push esi
push edx
push edi
push eax
call fcn.004b3db0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 4]
push edx
push eax
push ecx
call fcn.004ad5b0
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
push edx
push eax
call fcn.004acf10
add esp, 0x28
test eax, eax
jne 0x4a9b98
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x4a9bda
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [edx + 0xb4], 0x2000
mov ecx, dword [eax + 0xb4]
mov edx, dword [ebp - 4]
push ecx
push edx
call fcn.004b3ed0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
add esp, 8
mov dword [ecx + 0xb0], eax
cmp dword [edx + 0xb0], 0
jne 0x4a9bda
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov dword [eax + 0x98], 0x4ab400
mov eax, dword [ebp - 4]
mov dword [ecx + 0x9c], fcn.004ab450
mov ecx, dword [ebp - 8]
mov dword [eax + 0xa0], edx
test ecx, ecx
jne case.0x4a9c25.0
mov edx, dword [ebp - 4]
push 0x38
add edx, 0x78
push str.1.2.7
push edx
call fcn.005547c0
add eax, 6
add esp, 0xc
cmp eax, 6
ja case.0x4a9c25.5
jmp dword [eax*4 + 0x4a9cdc]
push str.zlib_memory_error
jmp 0x4a9c4e
mov ecx, dword [ebp - 4]
push str.zlib_stream_error
push ecx
jmp 0x4a9c52
mov edx, dword [ebp - 4]
push str.zlib_version_error
push edx
jmp 0x4a9c52
push str.Unknown_zlib_error
mov eax, dword [ebp - 4]
push eax
call fcn.004ad5e0
mov dword [ebp - 8], ebx
add esp, 8
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4a9c9b
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xb0]
mov ecx, dword [ebp - 4]
push eax
push ecx
call fcn.004b3ea0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
push edi
push esi
push eax
mov dword [edx + 0xb0], 0
call fcn.004b3d20
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0xb0]
mov eax, dword [ebp - 4]
mov dword [ecx + 0x84], edx
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0xb4]
mov eax, dword [ebp - 4]
push 0
push 0
push eax
mov dword [ecx + 0x88], edx
call fcn.004b3c50
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ad550
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x4ad56a
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x4ad56a
mov edx, dword [esp + 8]
push edx
push ecx
call eax
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4b0880
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x10
push ebx
mov bl, byte [edx + 8]
cmp bl, 3
je 0x4b0a2a
mov ecx, dword [esp + 0x20]
push ebp
mov ebp, dword [edx]
push esi
xor esi, esi
push edi
mov dword [esp + 0x24], esi
test bl, 2
je 0x4b08d8
movzx eax, byte [edx + 9]
movzx esi, byte [ecx]
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 1]
mov dword [esp + 0x10], edi
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 2]
sub eax, esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov edi, 3
jmp 0x4b08eb
movzx eax, byte [ecx + 3]
movzx edi, byte [edx + 9]
sub edi, eax
mov dword [esp + 0x10], edi
mov edi, 1
test bl, 4
je 0x4b08ff
movzx ecx, byte [ecx + 4]
movzx eax, byte [edx + 9]
sub eax, ecx
mov dword [esp + edi*4 + 0x10], eax
inc edi
xor ecx, ecx
xor eax, eax
cmp edi, ecx
jle case.0x4b0946.3
jmp 0x4b0910
cmp dword [esp + eax*4 + 0x10], ecx
jg 0x4b091c
mov dword [esp + eax*4 + 0x10], ecx
jmp 0x4b0921
mov esi, 1
inc eax
cmp eax, edi
jl 0x4b0910
cmp si, cx
je case.0x4b0946.3
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x4b0946.3
movzx eax, byte [eax + 0x4b0a44]
jmp dword [eax*4 + 0x4b0a30]
mov edx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp edx, ecx
jbe case.0x4b0946.3
lea esp, [esp]
mov cl, byte [eax]
shr cl, 1
and cl, 0x55
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x4b0960
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, dword [edx + 4]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
mov ecx, edx
mov eax, 0xf0
sar eax, cl
mov ebx, 0xf
sar ebx, cl
and al, 0xf0
or al, bl
test edi, edi
jbe case.0x4b0946.3
mov edi, edi
mov bl, byte [esi]
mov cl, dl
shr bl, cl
inc esi
and bl, al
sub edi, 1
mov byte [esi - 1], bl
jne 0x4b09a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x4b0946.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [esp + edx*4 + 0x10]
shr byte [esi - 1], cl
cmp ebx, ebp
jb 0x4b09c6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x4b0946.3
mov edi, edi
xor edx, edx
mov eax, ebx
div edi
movzx ax, byte [esi]
mov ecx, 0x100
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc esi
inc ebx
inc esi
movzx ecx, word [esp + edx*4 + 0x10]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, ebp
jb 0x4b09f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4bb390
Capabilities:
Hash data with crc32

Disassembly:
xor edx, edx
add ecx, 0x24
mov eax, edx
shr eax, 1
test dl, 1
je 0x4bb3a3
xor eax, 0xedb88320
test al, 1
je 0x4bb3b0
shr eax, 1
xor eax, 0xedb88320
jmp 0x4bb3b2
shr eax, 1
test al, 1
je 0x4bb3bf
shr eax, 1
xor eax, 0xedb88320
jmp 0x4bb3c1
shr eax, 1
test al, 1
je 0x4bb3ce
shr eax, 1
xor eax, 0xedb88320
jmp 0x4bb3d0
shr eax, 1
test al, 1
je 0x4bb3dd
shr eax, 1
xor eax, 0xedb88320
jmp 0x4bb3df
shr eax, 1
test al, 1
je 0x4bb3ec
shr eax, 1
xor eax, 0xedb88320
jmp 0x4bb3ee
shr eax, 1
test al, 1
je 0x4bb3fb
shr eax, 1
xor eax, 0xedb88320
jmp 0x4bb3fd
shr eax, 1
test al, 1
je 0x4bb40a
shr eax, 1
xor eax, 0xedb88320
jmp 0x4bb40c
shr eax, 1
mov dword [ecx], eax
inc edx
add ecx, 4
cmp edx, 0x100
jb 0x4bb395
ret

Function at 0x4bb420
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test edx, edx
jbe 0x4bb44d
push ebx
push ebp
movzx ebx, byte [esi]
movzx ebp, al
xor ebx, ebp
shr eax, 8
xor eax, dword [ecx + ebx*4 + 0x24]
dec edx
inc esi
test edx, edx
ja 0x4bb436
pop ebp
pop ebx
mov dword [edi], eax
pop edi
pop esi
ret 0xc
Function at 0x4e02e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4e0327
call fcn.004e31d4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4e0327
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4e0343
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004dfe58
mov esi, eax
test edi, edi
je 0x4e0341
test ebx, ebx
je 0x4e0341
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4e0e0f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4e0e33
cmp dword [edi + 0x54], 0
jne 0x4e0e33
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.004e31d4
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004e0dd0
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4e5608
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5d6b5f
call fcn.00525158
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4e562d
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4e5673
lea ecx, [ebp - 0x10]
call fcn.00402b80
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004d94d5
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401520
mov eax, esi
call fcn.00525230
ret 8