joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100017e0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x58
push ebx
push ebp
push esi
mov esi, dword [esp + 0x68]
xor ebx, ebx
xor ebp, ebp
cmp esi, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
jne 0x10001846
lea eax, [esp + 0x14]
push str.AutoWindow.cpp_CalcWindowLevel____pGain__NULL_n
push eax
call fcn.100049dc
add esp, 8
lea ecx, [esp + 0x14]
push ecx
call sub.Log.dll_TimeLog
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [0x1001c796], bl
je 0x100019c7
push ebx
lea eax, [esp + 0x18]
push str.Debug
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
mov ecx, dword [esp + 0x6c]
cmp ecx, ebx
jne 0x1000189a
lea ecx, [esp + 0x14]
push str.AutoWindow.cpp_CalcWindowLevel____pOffset__NULL_n
push ecx
call fcn.100049dc
add esp, 8
lea edx, [esp + 0x14]
push edx
call sub.Log.dll_TimeLog
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [0x1001c796], bl
je 0x100019c7
push ebx
lea ecx, [esp + 0x18]
push str.Debug
push ecx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
cmp dword [esp + 0x70], ebx
jne 0x100018ec
lea edx, [esp + 0x14]
push str.AutoWindow.cpp_CalcWindowLevel____Window__NULL_n
push edx
call fcn.100049dc
add esp, 8
lea eax, [esp + 0x14]
push eax
call sub.Log.dll_TimeLog
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [0x1001c796], bl
je 0x100019c7
push ebx
lea edx, [esp + 0x18]
push str.Debug
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
cmp dword [esp + 0x74], ebx
jne 0x1000193e
lea eax, [esp + 0x14]
push str.AutoWindow.cpp_CalcWindowLevel____Level__NULL_n
push eax
call fcn.100049dc
add esp, 8
lea ecx, [esp + 0x14]
push ecx
call sub.Log.dll_TimeLog
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp byte [0x1001c796], bl
je 0x100019c7
push ebx
lea eax, [esp + 0x18]
push str.Debug
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
mov edx, dword [0x10019b38]
push edi
add edx, 0x3e
sub esi, ecx
mov edi, 3
movsx eax, word [edx]
mov ebx, dword [esp + 0x10]
add edx, 2
add ebx, eax
add ecx, 4
mov dword [esp + 0x10], ebx
mov ebx, dword [esi + ecx - 4]
imul ebx, eax
add ebp, ebx
mov ebx, dword [ecx - 4]
imul ebx, eax
mov eax, ebx
mov ebx, dword [esp + 0x14]
add ebx, eax
dec edi
mov dword [esp + 0x14], ebx
jne 0x1000194f
mov ecx, dword [esp + 0x10]
pop edi
test ecx, ecx
jle 0x10001997
mov eax, ebp
cdq
idiv ecx
mov ebp, eax
mov eax, ebx
cdq
idiv ecx
mov ebx, eax
lea eax, [ebx + 0x200]
cmp eax, 0x400
jle 0x100019ab
mov eax, 0x400
jmp 0x100019b1
test eax, eax
jge 0x100019b1
xor eax, eax
mov ecx, dword [esp + 0x74]
mov word [ecx], ax
mov eax, 0x80000
cdq
idiv ebp
mov edx, dword [esp + 0x70]
mov word [edx], ax
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
Function at 0x100019d0
Capabilities:
Print debug messages

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x50
test edx, edx
jne 0x10001a27
lea eax, [esp]
push str.BiZoom.cpp_CalcCubicCoef____stCoef__NULL_n
push eax
call fcn.100049dc
add esp, 8
lea ecx, [esp]
push ecx
call sub.Log.dll_TimeLog
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [0x1001c796]
test al, al
je 0x10001aa2
push 0
lea eax, [esp + 4]
push str.Debug
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0x50
ret
mov eax, dword [esp + 0x5c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x6c]
lea ecx, [eax + eax]
sub ecx, esi
push edi
fild dword [esp + 0x68]
lea ecx, [ecx + ecx*8]
lea ebp, [eax + eax*4]
mov ebx, ecx
mov ecx, dword [esp + 0x68]
fstp dword [edx]
lea edi, [ecx + ecx*4]
sub eax, esi
lea edi, [ecx + edi*2]
lea eax, [eax + eax*2]
sub ebx, edi
mov edi, dword [esp + 0x74]
sub eax, ecx
lea ebx, [ebx + edi*2]
mov dword [esp + 0x68], ebx
lea ebx, [ecx + esi*2]
fild dword [esp + 0x68]
shl ebx, 1
sub ebx, ebp
fmul dword [0x1000d124]
sub ebx, edi
add eax, edi
mov dword [esp + 0x68], ebx
pop edi
pop esi
pop ebp
fstp dword [edx + 4]
fild dword [esp + 0x5c]
mov dword [esp + 0x5c], eax
pop ebx
fmul dword [0x1000d120]
fstp dword [edx + 8]
fild dword [esp + 0x58]
fmul dword [0x1000d124]
fstp dword [edx + 0xc]
add esp, 0x50
ret

Function at 0x10001ab0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
jne 0x10001b07
lea eax, [esp]
push str.BiZoom.cpp_CalcCubicCoef____stCoef__NULL_n
push eax
call fcn.100049dc
add esp, 8
lea ecx, [esp]
push ecx
call sub.Log.dll_TimeLog
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [0x1001c796]
test al, al
je 0x10001b92
push 0
lea eax, [esp + 4]
push str.Debug
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0x50
ret
fld dword [esp + 0x5c]
fmul dword [0x1000d13c]
fld dword [esp + 0x58]
fmul dword [0x1000d138]
mov ecx, dword [esp + 0x58]
mov dword [eax], ecx
fsubp st(1)
fld dword [esp + 0x60]
fmul dword [0x1000d134]
fsubp st(1)
fld dword [esp + 0x64]
fadd st(0), st(0)
faddp st(1)
fmul dword [0x1000d124]
fstp dword [eax + 4]
fld dword [esp + 0x58]
fadd st(0), st(0)
fld dword [esp + 0x5c]
fmul dword [0x1000d130]
fsubp st(1)
fld dword [esp + 0x60]
fmul dword [0x1000d12c]
faddp st(1)
fsub dword [esp + 0x64]
fmul dword [0x1000d120]
fstp dword [eax + 8]
fld dword [esp + 0x5c]
fmul dword [0x1000d128]
fsub dword [esp + 0x58]
fld dword [esp + 0x60]
fmul dword [0x1000d128]
fsubp st(1)
fadd dword [esp + 0x64]
fmul dword [0x1000d124]
fstp dword [eax + 0xc]
add esp, 0x50
ret
Function at 0x10002a40
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x50
push 0x200000
call fcn.10004aa7
mov ecx, dword [esp + 0x58]
add esp, 4
test ecx, ecx
jne 0x10002aa4
lea eax, [esp]
push str.EdgeEnhance.cpp_PostEdgeEnhance____ImageIn__NULL_n
push eax
call fcn.100049dc
add esp, 8
lea ecx, [esp]
push ecx
call sub.Log.dll_TimeLog
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [0x1001c796]
test al, al
je 0x10002b14
push 0
lea eax, [esp + 4]
push str.Debug
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0x50
ret
mov eax, dword [esp + 0x58]
test eax, eax
jne 0x10002af4
lea ecx, [esp]
push str.EdgeEnhance.cpp_PostEdgeEnhance____ImageOut__NULL_n
push ecx
call fcn.100049dc
add esp, 8
lea edx, [esp]
push edx
call sub.Log.dll_TimeLog
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [0x1001c796]
test al, al
je 0x10002b14
push 0
lea ecx, [esp + 4]
push str.Debug
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0x50
ret
push esi
push edi
mov esi, 0x400
mov edx, 0x400
mov di, word [ecx]
add ecx, 2
mov word [eax], di
add eax, 2
dec edx
jne 0x10002b00
dec esi
jne 0x10002afb
pop edi
pop esi
add esp, 0x50
ret
Function at 0x100036b0
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
sub esp, 0x8c
mov eax, dword [esp + 0x94]
mov dword [esp + 4], 0x80
dec eax
jne 0x10003744
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SOFTWAREVB_and_VBA_Program_SettingsPriamEnviornmentGUI
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push str.InHouseDebug
push ecx
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1000371a
mov byte [0x1001c796], 0
jmp 0x1000372e
lea edx, [esp + 0xc]
push edx
call fcn.10004ed5
add esp, 4
and al, 1
mov byte [0x1001c796], al
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.PriamEnhance.Dll_Loaded
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
add esp, 0x8c
ret 0xc
Function at 0x10004680
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
cdq
sub eax, edx
push ebp
mov ebp, eax
push edi
sar ebp, 1
lea eax, [ebp + ebp]
push eax
call fcn.10004aa7
mov ecx, dword [esp + 0x64]
add esp, 4
test ecx, ecx
jne 0x100046f3
lea ecx, [esp + 8]
push str.Resize.cpp_Minify_2_To_1____ImageIn__NULL_n
push ecx
call fcn.100049dc
add esp, 8
lea edx, [esp + 8]
push edx
call sub.Log.dll_TimeLog
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [0x1001c796]
test al, al
je 0x100047c9
push 0
lea ecx, [esp + 0xc]
push str.Debug
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop ebp
add esp, 0x50
ret
mov edi, dword [esp + 0x64]
test edi, edi
jne 0x10004747
lea edx, [esp + 8]
push str.Resize.cpp_Minify_2_To_1____ImageOut__NULL_n
push edx
call fcn.100049dc
add esp, 8
lea eax, [esp + 8]
push eax
call sub.Log.dll_TimeLog
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [0x1001c796]
test al, al
je 0x100047c9
push edi
lea edx, [esp + 0xc]
push str.Debug
push edx
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop ebp
add esp, 0x50
ret
test eax, eax
je 0x100047b5
test ebp, ebp
jle 0x100047a6
push ebx
push esi
mov dword [esp + 0x64], ebp
mov edx, eax
mov esi, ebp
mov bx, word [ecx]
add ecx, 2
mov word [edx], bx
add edx, 2
mov bx, word [ecx]
add ecx, 2
add word [edx - 2], bx
dec esi
jne 0x10004759
mov edx, eax
mov esi, ebp
mov bx, word [ecx]
add ecx, 2
add word [edx], bx
add edx, 2
mov bx, word [ecx]
add ecx, 2
add word [edx - 2], bx
mov bx, word [edx - 2]
sar ebx, 4
mov byte [edi], bl
inc edi
dec esi
jne 0x10004776
mov edx, dword [esp + 0x64]
dec edx
mov dword [esp + 0x64], edx
jne 0x10004755
pop esi
pop ebx
push eax
call fcn.10004abe
add esp, 4
pop edi
pop ebp
add esp, 0x50
ret
push 0
push str.Debug
push str.Minify_2_To_1___Out_of_Memory_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x100047d0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
cdq
and edx, 3
push ebp
add eax, edx
push edi
mov edi, eax
sar edi, 2
lea eax, [edi*4]
push eax
call fcn.10004aa7
mov ecx, dword [esp + 0x64]
add esp, 4
test ecx, ecx
jne 0x1000484a
lea ecx, [esp + 8]
push str.Resize.cpp_Minify_4_To_1____ImageIn__NULL_n
push ecx
call fcn.100049dc
add esp, 8
lea edx, [esp + 8]
push edx
call sub.Log.dll_TimeLog
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [0x1001c796]
test al, al
je 0x100049ca
push 0
lea ecx, [esp + 0xc]
push str.Debug
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop ebp
add esp, 0x50
ret
mov ebp, dword [esp + 0x64]
test ebp, ebp
jne 0x1000489e
lea edx, [esp + 8]
push str.Resize.cpp_Minify_4_To_1____ImageOut__NULL_n
push edx
call fcn.100049dc
add esp, 8
lea eax, [esp + 8]
push eax
call sub.Log.dll_TimeLog
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [0x1001c796]
test al, al
je 0x100049ca
push ebp
lea edx, [esp + 0xc]
push str.Debug
push edx
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop ebp
add esp, 0x50
ret
test eax, eax
je 0x100049b6
test edi, edi
jle 0x100049a7
push ebx
push esi
mov dword [esp + 0x64], edi
mov edx, eax
mov esi, edi
xor ebx, ebx
add edx, 4
mov bx, word [ecx]
add ecx, 2
mov dword [edx - 4], ebx
xor ebx, ebx
mov bx, word [ecx]
add ecx, 2
add dword [edx - 4], ebx
xor ebx, ebx
mov bx, word [ecx]
add ecx, 2
add dword [edx - 4], ebx
xor ebx, ebx
mov bx, word [ecx]
add ecx, 2
add dword [edx - 4], ebx
dec esi
jne 0x100048b8
mov edx, eax
mov esi, edi
xor ebx, ebx
add edx, 4
mov bx, word [ecx]
add ecx, 2
add dword [edx - 4], ebx
xor ebx, ebx
mov bx, word [ecx]
add ecx, 2
add dword [edx - 4], ebx
xor ebx, ebx
mov bx, word [ecx]
add ecx, 2
add dword [edx - 4], ebx
xor ebx, ebx
mov bx, word [ecx]
add ecx, 2
add dword [edx - 4], ebx
dec esi
jne 0x100048ee
mov edx, eax
mov esi, edi
xor ebx, ebx
add edx, 4
mov bx, word [ecx]
add ecx, 2
add dword [edx - 4], ebx
xor ebx, ebx
mov bx, word [ecx]
add ecx, 2
add dword [edx - 4], ebx
xor ebx, ebx
mov bx, word [ecx]
add ecx, 2
add dword [edx - 4], ebx
xor ebx, ebx
mov bx, word [ecx]
add ecx, 2
add dword [edx - 4], ebx
dec esi
jne 0x10004924
mov edx, eax
mov esi, edi
xor ebx, ebx
add edx, 4
mov bx, word [ecx]
add ecx, 2
add dword [edx - 4], ebx
xor ebx, ebx
mov bx, word [ecx]
add ecx, 2
add dword [edx - 4], ebx
xor ebx, ebx
mov bx, word [ecx]
add ecx, 2
add dword [edx - 4], ebx
xor ebx, ebx
mov bx, word [ecx]
add ecx, 2
add dword [edx - 4], ebx
mov ebx, dword [edx - 4]
shr ebx, 6
mov byte [ebp], bl
inc ebp
dec esi
jne 0x1000495a
mov edx, dword [esp + 0x64]
dec edx
mov dword [esp + 0x64], edx
jne 0x100048b4
pop esi
pop ebx
push eax
call fcn.10004abe
add esp, 4
pop edi
pop ebp
add esp, 0x50
ret
push 0
push str.Debug
push str.Minify_4_To_1___Out_of_Memory_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x100083fa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x1000f3c8
cmp edx, dword [eax]
je 0x1000841c
add eax, 8
inc ecx
cmp eax, 0x1000f458
jl 0x1000840d
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x1000f3c8]
jne 0x1000854a
mov eax, dword [0x1001c7ac]
cmp eax, 1
je 0x10008524
test eax, eax
jne 0x1000844d
cmp dword [0x1001c7b0], 1
je 0x10008524
cmp edx, 0xfc
je 0x1000854a
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10008484
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.100091f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.100087b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x100084c7
lea eax, [ebp - 0x1a4]
push eax
call fcn.100087b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1000d5bc
push edi
call fcn.1000b710
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.100091f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.10009200
lea eax, [ebp - 0xa0]
push 0x1000d59c
push eax
call fcn.10009200
push dword [esi + 0x1000f3cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.10009200
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.1000b67f
add esp, 0x2c
pop edi
jmp 0x1000854a
lea eax, [ebp + 8]
lea esi, [esi + 0x1000f3cc]
push 0
push eax
push dword [esi]
call fcn.100087b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4760d0
Capabilities:
Access peb ldr_data

Disassembly:
add edi, edi
mov ch, 0x8c
stc
invalid
lds esp, [esp + edx*2]
call fcn.00473f2d
adc al, 0x4e
jnp 0x476070
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x4760f1
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.00473f2d
push cs
lcall 0x478b, 0xf88b4be9
cmp al, 0x8b
push esp
pop es
js 0x47610b
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.00473f2d
pop esp
sal byte [ebp - 0x23], 1
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x47611a
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x47611a
call fcn.00473f2d
mov ebx, 0x8b7136c7
pop edx
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.00473f2d
stosb byte es:[edi], al
std
add dword [ebp - 1], 0x75
or bh, bh
jne 0x476163
push dword [ebp]
call fcn.0047472d
jne 0x476175
invalid
mov edx, dword [esi]
push 0x43f
mov ecx, esi
call dword [edx + 0x10]
mov ecx, dword [esi + 8]
push 0x43f
call fcn.004f2d08
mov edi, eax
test edi, edi
je 0x4761b5
mov eax, dword [edi + 0x1d]
cmp eax, dword [ebp + 0x35]
jge 0x476195
cmp eax, dword [ebp + 0x27]
jge 0x4761f5
test byte [esi + 0x10], 2
jne 0x4761a6
mov ecx, dword [edi + 4]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x10]
mov ecx, dword [esi + 8]
push edi
call fcn.004f2c30
mov edi, eax
test edi, edi
jne 0x476188
mov edi, dword [esp + 0x74]
lea ecx, [esp + 0x10]
call fcn.004f29d4
push edi
lea ecx, [esp + 0x14]
call fcn.004f0d98
mov ecx, dword [esp + 0x68]
lea edx, [esp + 0x10]
push edx
push 8
call fcn.0050c9a8
mov ecx, esi
call fcn.00509150
mov ecx, dword [ebx + 0x59]
call fcn.004fbdd0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret 0x10
cmp dword [esp + 0x6c], 0x874
mov edi, dword [edi + 0x1d]
jne 0x4761b9
inc edi
jmp 0x4761b9
Function at 0x4dd2a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x18
mov ecx, eax
call fcn.004014e0
mov eax, dword [ebp - 4]
add eax, 0x24
mov ecx, eax
call fcn.004014e0
mov eax, dword [ebp - 4]
add eax, 0x30
mov ecx, eax
call fcn.004014e0
mov eax, dword [ebp - 4]
add eax, 0x3c
mov ecx, eax
call fcn.004014e0
mov eax, dword [ebp - 4]
add eax, 0x7c
mov ecx, eax
call fcn.004014e0
mov eax, dword [ebp - 4]
add eax, 0x8d
mov ecx, eax
call fcn.004014e0
mov eax, dword [ebp - 4]
add eax, 0x99
mov ecx, eax
call fcn.004014e0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x50], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x54], edx
mov eax, dword [ebp - 4]
mov ecx, 1
mov dword [eax + 0x58], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x5c], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x60], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x48], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0xb7], edx
mov eax, dword [ebp - 4]
mov word [eax + 0x68], 2
movzx eax, word [0x6ea168]
mov ecx, dword [ebp - 4]
mov word [ecx + 0x6a], ax
movzx eax, word [0x6ea16c]
mov ecx, dword [ebp - 4]
mov word [ecx + 0x6c], ax
movzx eax, word [0x6ea170]
mov ecx, dword [ebp - 4]
mov word [ecx + 0x6e], ax
movzx eax, word [0x7009a0]
mov ecx, dword [ebp - 4]
mov word [ecx + 0x70], ax
mov eax, dword [ebp - 4]
mov word [eax + 0x72], 0x5b
mov eax, dword [ebp - 4]
mov word [eax + 0x74], dx
mov eax, dword [ebp - 4]
mov word [eax + 0x76], dx
mov eax, dword [ebp - 4]
mov dword [eax + 0x78], 0xffffffff
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x88]
or eax, 1
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x88], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x88]
and eax, 0xfffffffd
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x88], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x88]
or eax, 4
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x88], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x88]
and eax, 0xfffffff7
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x88], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x88]
and eax, 0xffffffef
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x88], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x88]
or eax, 0x20
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x88], al
mov eax, dword [ebp - 4]
mov dword [eax + 0xbb], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0xbf], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0xc3], edx
mov eax, dword [ebp - 4]
leave
ret
Function at 0x4e1c98
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0xc
mov ebp, ecx
cmp dword [0x6ea15c], 0
je 0x4e1d95
mov dword [esp + 8], 0
cmp dword [ebp + 0x23], 0
je 0x4e1d95
mov ecx, 0x801
call fcn.004dbdb8
mov ebx, eax
push dword [0x6ea15c]
push str.TallyODBC
push str._s__d
push ebx
call fcn.006974c6
add esp, 0x10
push 1
call fcn.006600b8
push ebx
call fcn.0066008e
push 2
call fcn.006600b8
push ebx
call fcn.0066008e
mov dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push 1
push str.Tally_ODBC_Driver
call fcn.006600a3
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SOFTWAREODBCODBC.INIODBC_File_DSN
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e1d87
mov dword [esp + 8], 0x801
mov ecx, 0x801
call fcn.004dbdb8
mov dword [esp], eax
xor ecx, ecx
lea eax, [esp + 8]
push eax
mov edx, dword [esp + 4]
push edx
push ecx
push ecx
push str.DefaultDSNDir
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4e1d75
mov ecx, dword [esp]
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4e1d18
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4e1d03
dec eax
mov dword [esp + 8], eax
mov edx, dword [esp]
cmp byte [edx + eax - 1], 0x5c
je 0x4e1d33
mov byte [edx + eax], 0x5c
mov eax, dword [esp + 8]
inc eax
mov dword [esp + 8], eax
mov edi, edx
mov byte [edi + eax], 0
mov edx, ebx
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x4e1d45
mov edi, dword [esp]
mov edx, str..dsn
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x4e1d61
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp]
call fcn.004db4f8
mov ecx, ebx
call fcn.004db4f8
mov dword [ebp + 0x23], 0
call sub.WSOCK32.dll_WSACleanup
add esp, 0xc
pop ebx
pop ebp
pop esi
pop edi
ret

Function at 0x4e1da4
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push edi
push ecx
mov eax, 0x18c
call fcn.00697340
mov ecx, dword [esp + 0x18c]
mov edi, ecx
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [edi + 0x1b], eax
movzx eax, word [0x6ea15c]
push eax
call sub.WSOCK32.dll_htons
push 0
call sub.WSOCK32.dll_htonl
mov dword [0x6ea15c], 0
add esp, 0x190
pop edi
ret 4
Function at 0x4f5844
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x88
call fcn.00697340
mov dword [esp + 0x80], 0x80
lea eax, [esp + 0x84]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4f5885
xor eax, eax
add esp, 0x88
ret
xor ecx, ecx
lea edx, [esp]
lea eax, [esp + 0x80]
push eax
push edx
push ecx
push ecx
push str.Version
push dword [esp + 0x98]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4f58b4
xor eax, eax
add esp, 0x88
ret
push dword [esp + 0x84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp]
push eax
call fcn.006976ae
pop ecx
movsx eax, ax
add esp, 0x88
ret
Function at 0x4fa6e0
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
push ebp
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
je 0x4fa71f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp ebp, 5
je 0x4fa702
mov eax, ebp
pop ebp
pop esi
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
je 0x4fa71f
mov eax, ebp
pop ebp
pop esi
ret
xor eax, eax
pop ebp
pop esi
ret

Function at 0x4fa724
Capabilities:
Delete file
Set file attributes

Disassembly:
push edi
push esi
push ebp
push ebx
mov ebx, edx
mov eax, 0x700ce0
cmp ecx, eax
je 0x4fa73a
mov ebp, 0x700ce0
jmp 0x4fa73f
mov ebp, 0x700de0
test ecx, ecx
je 0x4fa776
mov esi, ebp
mov edi, ecx
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4fa747
xor eax, eax
movzx edx, byte [ecx + eax]
test edx, edx
je 0x4fa768
movzx edx, byte [ecx + eax + 1]
add eax, 2
test edx, edx
jne 0x4fa753
dec eax
cmp byte [eax + ebp - 1], 0x5c
je 0x4fa778
mov byte [eax + ebp], 0x5c
inc eax
jmp 0x4fa778
xor eax, eax
lea edx, [ebp + eax]
mov byte [eax + ebp], 0
push ebx
push 0x6c4a54
push edx
call fcn.006974c6
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
je 0x4fa7c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 5
jne 0x4fa7c2
push 0x80
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
jne 0x4fa7c2
xor ebx, ebx
mov eax, ebx
pop ebx
pop ebp
pop esi
pop edi
ret