joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ada00
Capabilities:
Create new key via cryptacquirecontext
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
sub esp, 0x80c
mov eax, dword [0x5b7a9c]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x7cf
lea eax, [esp + 0x49]
push ebx
push eax
mov esi, ecx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x50], bl
call fcn.00540610
add esp, 0xc
push ebx
lea ecx, [esp + 0x48]
lea edx, [esp + 0x1c]
push edx
mov eax, ecx
push eax
push ebx
push ebx
push str.CNCertificate
mov edi, 1
push edi
mov dword [esp + 0x38], ecx
mov dword [esp + 0x34], 0x7d0
call dword [sym.imp.CRYPT32.dll_CertStrToNameW]
test eax, eax
jne 0x4ada7e
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.0053fa67
add esp, 0x80c
ret
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0x28
push edi
push ebx
push str.EPContainer
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], ebx
call ebp
test eax, eax
jne 0x4adabe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x8009000f
jne 0x4adabe
push 0x20
push edi
push ebx
push str.EPContainer
lea edx, [esp + 0x20]
push edx
call ebp
test eax, eax
je 0x4adad8
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push edi
push edi
push ecx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
jne 0x4adadf
xor eax, eax
jmp 0x4adbbf
xor eax, eax
lea edx, [esp + 0x40]
push edx
mov edx, dword [esp + 0x14]
push ebx
push ebx
push ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
lea eax, [esp + 0x34]
push eax
push ebx
lea ecx, [esp + 0x34]
push ecx
push edx
mov dword [esp + 0x44], str.EPContainer
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
call dword [sym.imp.CRYPT32.dll_CertCreateSelfSignCertificate]
push ebx
push 2
lea edi, [esi + 0x30]
push eax
mov dword [edi], eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.CRYPT32.dll_CryptFindCertificateKeyProvInfo]
test eax, eax
je 0x4adb9c
push 0x38
lea ebp, [esi + 0x34]
push ebx
push ebp
call fcn.00540610
add esp, 0xc
mov dword [ebp], 4
mov dword [esi + 0x64], 0x212
cmp dword [edi], ebx
je 0x4adb79
mov dword [esi + 0x38], 1
mov dword [esi + 0x3c], edi
push ebx
add esi, 0x6c
push esi
push ebx
push ebx
push ebp
push ebx
push 2
push str.Schannel
push ebx
call dword [sym.imp.Secur32.dll_AcquireCredentialsHandleW]
test eax, eax
jne 0x4adb9c
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4adbab
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4adbbb
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x818]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0053fa67
add esp, 0x80c
ret
Function at 0x4adca0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
cmp dword [esi + 4], 0
push edi
je 0x4adcd7
call fcn.00512126
test eax, eax
je 0x4adcc0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x74]
call eax
jmp 0x4adcc2
xor eax, eax
mov ecx, dword [esi + 4]
mov edx, dword [eax + 0x20]
push ecx
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 4], 0
cmp dword [esp + 0x1c], 0
je 0x4adce3
mov ebp, dword [esi + 0x20]
jmp 0x4adce6
mov ebp, dword [esi + 0x18]
mov edi, dword [esp + 0x18]
test edi, edi
jle 0x4add31
mov ebx, dword [esp + 0x14]
cmp dword [esi + 0x28], 0
jne 0x4add24
push 0
push edi
push ebx
push ebp
mov dword [esi + 0x28], 1
call dword [sym.imp.WSOCK32.dll_send]
mov dword [esi + 0x28], 0
cmp eax, 0xffffffff
je 0x4add24
test eax, eax
je 0x4add2d
sub edi, eax
add ebx, eax
test edi, edi
jg 0x4adcf2
jmp 0x4add31
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
test edi, edi
jg 0x4add24
cmp dword [esi + 0xc], 0
jle 0x4add70
call fcn.00512126
test eax, eax
je 0x4add4b
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x74]
call eax
jmp 0x4add4d
xor eax, eax
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
imul ecx, ecx, 0x3e8
push 0
push ecx
mov ecx, dword [eax + 0x20]
add edx, 0x2710
push edx
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 4], eax
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0xc
Function at 0x4add80
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push 0xffffffffffffffff
push 0x5640ab
mov eax, dword fs:[0]
push eax
sub esp, 0x188
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b7a9c]
xor eax, esp
push eax
lea eax, [esp + 0x19c]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x1b4]
xor ebx, ebx
mov dword [eax], ebx
cmp dword [esp + 0x1b8], ebx
je 0x4addcc
mov ecx, dword [edi + 0x20]
mov dword [esp + 0x14], ecx
jmp 0x4addd3
mov edx, dword [edi + 0x18]
mov dword [esp + 0x14], edx
cmp dword [edi + 0x28], ebx
jne 0x4adec4
mov eax, 1
mov dword [edi + 0x28], eax
cmp dword [0x5ed71c], ebx
je 0x4adecb
mov ecx, dword [esp + 0x14]
mov ebp, dword [sym.imp.WSOCK32.dll_select]
lea edx, [esp + 0x18]
push edx
push ebx
mov dword [esp + 0xa4], ecx
push ebx
lea ecx, [esp + 0xa4]
push ecx
push eax
mov dword [esp + 0xac], eax
mov dword [esp + 0x2c], 0x1e
mov dword [esp + 0x30], ebx
call ebp
mov esi, eax
cmp esi, ebx
jne 0x4ade99
lea esp, [esp]
push ebx
lea ecx, [esp + 0x24]
call fcn.00457930
lea ecx, [esp + 0x20]
mov dword [esp + 0x1a4], ebx
call fcn.0044e7f0
cmp eax, 1
jne 0x4adea5
cmp dword [esp + 0x94], ebx
je 0x4ade62
mov dword [0x5ed71c], ebx
mov esi, eax
jmp 0x4ade77
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
lea eax, [esp + 0xa4]
push eax
push 1
call ebp
mov esi, eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x1a4], 0xffffffff
mov dword [esp + 0x20], vtable.CMyDialog.0
call fcn.004ff2df
cmp esi, ebx
je 0x4ade30
cmp esi, ebx
jge 0x4adecb
mov dword [edi + 0x28], ebx
xor eax, eax
jmp 0x4adf4c
lea ecx, [esp + 0x20]
mov dword [edi + 0x28], ebx
mov dword [esp + 0x1a4], 0xffffffff
mov dword [esp + 0x20], vtable.CMyDialog.0
call fcn.004ff2df
xor eax, eax
jmp 0x4adf4c
mov eax, dword [edi + 0x10]
xor esi, esi
cmp eax, ebx
mov ebx, dword [esp + 0x1b0]
je 0x4adf10
mov esi, dword [edi + 0x14]
cmp ebx, esi
jge 0x4adee4
mov esi, ebx
mov ebp, dword [esp + 0x1ac]
push esi
push eax
push ebp
call fcn.005402a0
sub dword [edi + 0x14], esi
mov eax, dword [edi + 0x14]
add dword [edi + 0x10], esi
add esp, 0xc
add ebp, esi
sub ebx, esi
test eax, eax
jg 0x4adf17
mov dword [edi + 0x10], 0
jmp 0x4adf17
mov ebp, dword [esp + 0x1ac]
test ebx, ebx
jle 0x4adf32
mov ecx, dword [esp + 0x1bc]
mov edx, dword [esp + 0x14]
push ecx
push ebx
push ebp
push edx
call dword [sym.imp.WSOCK32.dll_recv]
add esi, eax
mov dword [edi + 0x28], 0
cmp esi, 0xffffffff
je 0x4adec4
mov eax, dword [esp + 0x1b4]
mov dword [eax], esi
mov eax, 1
mov ecx, dword [esp + 0x19c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x194
ret 0x14
Function at 0x4ae290
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x5b7a9c]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
mov esi, ecx
cmp dword [esi + 0x24], 0
je 0x4ae2c8
mov eax, 1
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0053fa67
add esp, 0x194
ret
push edi
lea eax, [esp + 8]
push eax
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
mov edi, eax
push edi
mov ecx, esi
call fcn.004ae080
test edi, edi
pop edi
je 0x4ae300
xor eax, eax
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0053fa67
add esp, 0x194
ret
mov ecx, dword [esp + 0x194]
mov eax, 1
mov dword [esi + 0x24], eax
pop esi
xor ecx, esp
call fcn.0053fa67
add esp, 0x194
ret

Function at 0x4ae320
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
mov eax, 2
push esi
mov edi, ecx
mov word [ebx], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x4ae37b
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x4ae365
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
push ecx
push eax
lea ecx, [ebx + 4]
push ecx
call fcn.005402a0
add esp, 0xc
jmp 0x4ae37e
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
mov ecx, edi
call fcn.004ae080
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
mov dword [ebx + 4], eax
mov edi, dword [esp + 0x1c]
test edi, edi
jg 0x4ae41e
mov esi, dword [esp + 0x18]
push 0x5819b8
push esi
call dword [sym.imp.WSOCK32.dll_getservbyname]
test eax, eax
je 0x4ae3b1
mov dx, word [eax + 8]
pop edi
pop esi
mov word [ebx + 2], dx
mov eax, 1
pop ebx
ret 0x10
mov ecx, 0x578c94
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4ae3d8
test dl, dl
je 0x4ae3d4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4ae3d8
add eax, 2
add ecx, 2
test dl, dl
jne 0x4ae3b8
xor eax, eax
jmp 0x4ae3dd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4ae3e6
lea edi, [eax + 0x15]
jmp 0x4ae41e
mov ecx, 0x578bd4
mov eax, esi
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4ae410
test dl, dl
je 0x4ae40c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4ae410
add eax, 2
add ecx, 2
test dl, dl
jne 0x4ae3f0
xor eax, eax
jmp 0x4ae415
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4ae41e
mov edi, 0x16
push edi
call dword [sym.imp.WSOCK32.dll_htons]
pop edi
mov word [ebx + 2], ax
pop esi
mov eax, 1
pop ebx
ret 0x10
Function at 0x4ae440
Capabilities:
Connect socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x5b7a9c]
xor eax, esp
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x20]
push esi
xor eax, eax
push edi
mov edi, dword [esp + 0x20]
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
push eax
mov esi, ecx
mov ecx, dword [esp + 0x28]
push edx
push ecx
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.004ae320
test eax, eax
jne 0x4ae49c
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0053fa67
add esp, 0x14
ret 0x10
cmp dword [esi + 0x28], 0
jne 0x4ae487
push 0x10
lea edx, [esp + 0xc]
mov dword [esi + 0x28], 1
mov eax, dword [edi]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
mov edi, eax
mov dword [esi + 0x28], 0
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
mov ecx, esi
call fcn.004ae080
mov ecx, dword [esp + 0x18]
xor eax, eax
cmp edi, 0xffffffff
pop edi
setne al
pop esi
xor ecx, esp
call fcn.0053fa67
add esp, 0x14
ret 0x10

Function at 0x4ae4f0
Capabilities:
Create tcp socket

Disassembly:
push esi
mov esi, ecx
call fcn.004ad910
mov ecx, esi
call fcn.004ae290
test eax, eax
jne 0x4ae507
pop esi
ret 0xc
push edi
push 6
push 1
push 2
lea edi, [esi + 0x18]
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [edi], eax
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
mov ecx, esi
call fcn.004ae080
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x4ae561
push eax
mov ecx, esi
call fcn.004ad830
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
push ecx
push edx
push edi
mov ecx, esi
call fcn.004ae440
mov edi, eax
test edi, edi
jne 0x4ae55a
mov ecx, esi
call fcn.004ad910
mov eax, edi
pop edi
pop esi
ret 0xc
pop edi
xor eax, eax
pop esi
ret 0xc

Function at 0x4ae570
Capabilities:
Create tcp socket

Disassembly:
push ebx
mov ebx, dword [sym.imp.WSOCK32.dll_shutdown]
push ebp
mov ebp, dword [sym.imp.WSOCK32.dll_closesocket]
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
lea esi, [edi + 0x20]
cmp eax, 0xffffffff
je 0x4ae59d
push 2
push eax
call ebx
mov eax, dword [esi]
push eax
call ebp
mov dword [esi], 0xffffffff
push 6
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [esi], eax
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
mov ecx, edi
call fcn.004ae080
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4ae605
push eax
mov ecx, edi
call fcn.004ad830
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
push esi
mov ecx, edi
call fcn.004ae440
mov edi, eax
test edi, edi
jne 0x4ae5fc
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4ae5fc
push 2
push eax
call ebx
mov ecx, dword [esi]
push ecx
call ebp
mov dword [esi], 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
Function at 0x4ae640
Capabilities:
Create tcp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x30
mov eax, dword [0x5b7a9c]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
push ebx
push esi
push edi
push 6
mov esi, ecx
mov ecx, dword [esp + 0x48]
push 1
push 2
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
lea edi, [esi + 0x1c]
call dword [sym.imp.WSOCK32.dll_socket]
mov ebx, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [edi], eax
call ebx
push eax
mov ecx, esi
call fcn.004ae080
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x4ae6a1
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0053fa67
add esp, 0x30
ret 8
push ebp
push eax
mov ecx, esi
call fcn.004ad830
xor eax, eax
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.WSOCK32.dll_htons]
mov ecx, dword [edi]
mov word [esp + 0x1e], ax
push 0x10
lea eax, [esp + 0x20]
push eax
mov edx, 2
push ecx
mov word [esp + 0x28], dx
mov dword [esp + 0x2c], 0
call dword [sym.imp.WSOCK32.dll_bind]
mov ebp, eax
call ebx
push eax
mov ecx, esi
call fcn.004ae080
cmp ebp, 0xffffffff
jne 0x4ae72c
mov eax, dword [edi]
cmp eax, ebp
je 0x4ae772
push 2
push eax
call dword [sym.imp.WSOCK32.dll_shutdown]
mov edx, dword [edi]
push edx
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [edi], ebp
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0053fa67
add esp, 0x30
ret 8
mov edx, dword [edi]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ecx
push edx
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
mov ebp, eax
call ebx
push eax
mov ecx, esi
call fcn.004ae080
cmp ebp, 0xffffffff
jne 0x4ae789
mov eax, dword [edi]
cmp eax, ebp
je 0x4ae772
push 2
push eax
call dword [sym.imp.WSOCK32.dll_shutdown]
mov eax, dword [edi]
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [edi], ebp
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0053fa67
add esp, 0x30
ret 8
mov ecx, dword [edi]
push 1
push ecx
call dword [sym.imp.WSOCK32.dll_listen]
mov ebp, eax
call ebx
push eax
mov ecx, esi
call fcn.004ae080
cmp ebp, 0xffffffff
je 0x4ae7d5
mov ecx, dword [esi + 0x18]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x30]
lea edi, [esi + 0x18]
push eax
push ecx
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
mov ebp, eax
call ebx
push eax
mov ecx, esi
call fcn.004ae080
cmp ebp, 0xffffffff
jne 0x4ae7f4
push edi
mov ecx, esi
call fcn.004ad890
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0053fa67
add esp, 0x30
ret 8
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov cx, word [esp + 0x1e]
pop ebp
mov dword [eax], edx
mov edx, dword [esp + 0x10]
pop edi
mov word [edx], cx
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0053fa67
add esp, 0x30
ret 8
Function at 0x4b0180
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x828
mov eax, dword [0x5b7a9c]
xor eax, esp
mov dword [esp + 0x824], eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x41c]
push edx
push str.SoftwareMicrosoftInternet_ExplorerView_Source_EditorEditor_Name
xor eax, eax
push reloc.WSOCK32.dll_bind
mov word [esp + 0x428], ax
mov dword [esp + 0x14], 0x208
call esi
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x41c]
push ecx
push str.SoftwareMicrosoftInternet_ExplorerView_Source_EditorEditor_Name
push reloc.WSOCK32.dll_accept
call esi
mov eax, dword [0x5ba2a8]
mov ecx, dword [eax + 0xdc]
push 0x208
lea edx, [esp + 0xc]
push edx
push ecx
call fcn.0044d3e0
push str.eppie.exe
lea edx, [esp + 0x18]
push 0x208
push edx
call fcn.005400bf
add esp, 0x18
lea ecx, [esp + 8]
lea eax, [esp + 0x418]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b0246
test dx, dx
je 0x4b0242
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b0246
add eax, 4
add ecx, 4
test dx, dx
jne 0x4b0220
xor eax, eax
jmp 0x4b024b
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
cmp dword [esp + 0x834], 0
mov esi, ecx
jne 0x4b02d0
cmp dword [esp + 0x830], 0
je 0x4b02ac
test esi, esi
jne 0x4b02d0
lea edx, [esp + 8]
push edx
push str.SoftwareMicrosoftInternet_ExplorerView_Source_EditorEditor_Name
push reloc.WSOCK32.dll_bind
call fcn.00416680
lea eax, [esp + 8]
push eax
push str.SoftwareMicrosoftInternet_ExplorerView_Source_EditorEditor_Name
push reloc.WSOCK32.dll_accept
call fcn.00416680
mov eax, esi
pop esi
mov ecx, dword [esp + 0x824]
xor ecx, esp
call fcn.0053fa67
add esp, 0x828
ret
test esi, esi
je 0x4b02d0
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.SoftwareMicrosoftInternet_ExplorerView_Source_EditorEditor_Name
push reloc.WSOCK32.dll_bind
call edi
push str.SoftwareMicrosoftInternet_ExplorerView_Source_EditorEditor_Name
push reloc.WSOCK32.dll_accept
call edi
pop edi
mov ecx, dword [esp + 0x828]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0053fa67
add esp, 0x828
ret

Function at 0x4b22f0
Capabilities:
Get file system object information

Disassembly:
mov eax, dword [esp + 4]
push 0x2000
push 0
push 0
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
cmp al, 0x4e
jne 0x4b2314
cmp ah, 0x45
je 0x4b231d
cmp al, 0x50
jne 0x4b2328
cmp ah, 0x45
jne 0x4b2328
test cx, cx
je 0x4b2328
mov eax, 1
ret
xor eax, eax
ret
Function at 0x4b5ac0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x5646cb
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x5b7a9c]
xor eax, esp
mov dword [esp + 0x824], eax
push edi
mov eax, dword [0x5b7a9c]
xor eax, esp
push eax
lea eax, [esp + 0x830]
mov dword fs:[0], eax
mov eax, dword [esi]
push 0
push eax
mov edi, ecx
call fcn.00403150
add esp, 8
test eax, eax
jne 0x4b5d03
test edi, edi
je 0x4b5b2d
cmp word [edi], ax
je 0x4b5b2d
push edi
lea eax, [esp + 0x10]
push 0x208
push eax
call fcn.0054013c
add esp, 0xc
jmp 0x4b5b44
push 0
push 0x208
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [0x5ba2a8]
call fcn.004123d0
call fcn.0050830c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4b5b5e
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 8], eax
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
mov dword [esp + 0x838], 0
test ecx, ecx
jge 0x4b5b8c
push 0x80070057
call fcn.00401350
movzx edx, word [eax]
mov edi, 0x5c
cmp di, dx
jne 0x4b5c3a
cmp ecx, 1
jge 0x4b5bac
push 0x80070057
call fcn.00401350
movzx eax, word [eax + 2]
mov ecx, edi
cmp cx, ax
je 0x4b5cd8
mov edx, dword [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
call fcn.004b4820
mov eax, dword [esp + 0xe]
push eax
lea ecx, [esp + 0xc]
call fcn.00405b30
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.00401fe0
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b5ccc
mov ecx, dword [0x5ba2a8]
push eax
push 0x208
lea edx, [esp + 0x424]
push edx
call fcn.004123d0
mov eax, dword [esp + 0x41c]
push eax
lea ecx, [esp + 0xc]
call fcn.004b4820
mov ecx, dword [esp + 0x41e]
push ecx
lea ecx, [esp + 0xc]
call fcn.00405b30
jmp 0x4b5cbc
cmp ecx, 1
jge 0x4b5c49
push 0x80070057
call fcn.00401350
movzx eax, word [eax + 2]
cmp ax, 0x3a
je 0x4b5cd8
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
call fcn.00402260
lea ecx, [esp + 8]
push ecx
call fcn.00414170
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
add esp, 4
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.00401fe0
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b5ccc
mov ecx, dword [0x5ba2a8]
push 1
push 0x208
lea eax, [esp + 0x424]
push eax
call fcn.004123d0
lea ecx, [esp + 0x41c]
push ecx
lea ecx, [esp + 0xc]
call fcn.00402260
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.00401fe0
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00405fa0
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x838], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b5d03
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x830]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x824]
xor ecx, esp
call fcn.0053fa67
add esp, 0x834
ret
Function at 0x4b6d70
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1394
call fcn.00541260
mov eax, dword [0x5b7a9c]
xor eax, esp
mov dword [esp + 0x1390], eax
mov ecx, dword [0x5ba2a8]
push edi
mov edi, dword [esp + 0x139c]
call fcn.00411910
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [edi + 0xbc], eax
mov ecx, dword [edi + 0xb8]
mov cl, byte [ecx + 1]
xor eax, eax
cmp cl, 0xf6
je 0x4b6dbf
add eax, 5
cmp eax, 0x32
jl 0x4b6db2
mov ecx, dword [edi + 0x5d8]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [esp + 0x14]
push edx
push 1
lea eax, [esp + 0x1b]
push eax
push ecx
call ebp
mov ecx, dword [esp + 0x10]
xor ebx, ebx
cmp ecx, 1
jne 0x4b6f1f
mov al, byte [esp + 0xf]
push esi
test al, al
je 0x4b6f0a
xor ebx, ebx
xor esi, esi
mov byte [esp + 0x18], 0
cmp ecx, 1
jne 0x4b6e4c
test al, al
je 0x4b6e48
cmp al, 0xd
je 0x4b6e48
cmp al, 0xa
je 0x4b6e48
cmp esi, 0x1000
jge 0x4b6e48
mov ecx, dword [edi + 0x5d8]
push 0
lea edx, [esp + 0x18]
push edx
mov byte [esp + esi + 0x20], al
push 1
lea eax, [esp + 0x1f]
push eax
inc esi
push ecx
mov byte [esp + esi + 0x2c], 0
call ebp
cmp dword [esp + 0x14], 1
mov al, byte [esp + 0x13]
je 0x4b6e08
test esi, esi
jg 0x4b6e54
cmp al, 0xd
je 0x4b6e54
cmp al, 0xa
jne 0x4b6e67
push 1
push esi
lea edx, [esp + 0x20]
push edx
mov ecx, edi
call fcn.004b37b0
mov al, byte [esp + 0x13]
cmp al, 0xd
jne 0x4b6ed9
mov edx, dword [edi + 0x5d8]
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x1f]
push ecx
push edx
call ebp
mov ebx, 1
cmp dword [esp + 0x14], ebx
jne 0x4b6ef9
mov al, byte [esp + 0x13]
test al, al
je 0x4b6efd
cmp al, 0xd
jne 0x4b6eb9
mov edx, dword [edi + 0x5d8]
push 0
lea eax, [esp + 0x18]
push eax
push ebx
lea ecx, [esp + 0x1f]
push ecx
push edx
call ebp
cmp dword [esp + 0x14], ebx
jne 0x4b6ef9
mov al, byte [esp + 0x13]
test al, al
je 0x4b6efd
cmp al, 0xa
jne 0x4b6efd
mov edx, dword [edi + 0x5d8]
push 0
lea eax, [esp + 0x18]
push eax
push ebx
lea ecx, [esp + 0x1f]
push ecx
push edx
call ebp
jmp 0x4b6ef9
cmp al, 0xa
jne 0x4b6efd
mov edx, dword [edi + 0x5d8]
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x1f]
push ecx
push edx
call ebp
mov ebx, 1
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x14]
cmp ecx, 1
je 0x4b6df2
pop esi
test ebx, ebx
je 0x4b6f1f
push 1
push 0
push 0x57bd68
mov ecx, edi
call fcn.004b2780
mov ecx, edi
call fcn.004b68f0
cmp dword [edi + 0x5ac], 0
pop ebp
pop ebx
push 0
mov dword [edi + 0xbc], 0
push 0
je 0x4b6f74
mov eax, dword [0x5ed05c]
mov ecx, dword [edi + 0x5e4]
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [edi + 0x5ac], 0
xor eax, eax
pop edi
mov ecx, dword [esp + 0x1390]
xor ecx, esp
call fcn.0053fa67
add esp, 0x1394
ret
mov edx, dword [0x5ed050]
mov eax, dword [edi + 0x5e4]
push edx
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x1394]
pop edi
xor ecx, esp
xor eax, eax
call fcn.0053fa67
add esp, 0x1394
ret