joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f8e1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x45f901
cmp dword [ebp + 0xc], edi
je 0x45f901
cmp dword [ebp + 0xc], 0xffffffff
je 0x45f901
call fcn.0045fdb7
mov dword [ebp + 8], eax
mov esi, 0x610178
mov edx, esi
call fcn.00485754
test eax, eax
mov ebx, 0x104
jne 0x45f91e
cmp dword [0x60f724], edi
je 0x45f970
push ebx
push edi
push esi
call fcn.004c05d0
add esp, 0xc
push esi
push 0x103
mov dword [0x60f724], edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x45f95d
push edi
push edi
call fcn.0045f646
push eax
push str._sTEMP_
push ebx
push esi
call fcn.00486e10
add esp, 0x18
xor eax, eax
jmp 0x45f9fc
mov eax, esi
call fcn.00485e7f
push esi
call fcn.004bf880
pop ecx
mov dword [0x60fa3c], eax
mov edi, 0x610280
push esi
mov ecx, ebx
mov eax, edi
call fcn.00485786
mov ecx, dword [0x60fa3c]
push esi
mov esi, 0x610388
mov eax, esi
call fcn.00485786
cmp dword [ebp + 8], 0
pop ecx
pop ecx
jne 0x45f9a4
cmp dword [ebp + 0xc], 0xffffffff
je 0x45f9fc
mov eax, edi
jmp 0x45f9fc
cmp dword [ebp + 0xc], 0xffffffff
jne 0x45f9be
push esi
push dword [ebp + 8]
call fcn.004bf9a0
push esi
call fcn.004bf880
add esp, 0xc
jmp 0x45f9f9
push edi
push dword [ebp + 8]
call fcn.004bf9a0
push edi
call fcn.004bf880
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x45f9f9
mov esi, dword [ebp + 8]
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
sub ebx, eax
add eax, esi
push ebx
push eax
call fcn.004c0cfb
add esp, 0x10
test eax, eax
jge 0x45f9f9
mov byte [esi + 0x103], 0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x469786
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push edi
xor edi, edi
push 0x3e
lea eax, [ebp - 0x54]
push edi
push eax
mov dword [ebp - 0x58], edi
call fcn.004c05d0
mov edx, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 4], edi
call fcn.00485754
test eax, eax
jne 0x4698e9
mov ecx, dword [ebp + 8]
push 0x15b4
push str..Printer.c
mov edx, 0x4de3b8
call fcn.0041c35a
mov ebx, eax
cmp ebx, edi
pop ecx
pop ecx
mov dword [ebp - 8], ebx
je 0x4698e9
mov eax, esi
call fcn.0046b5ea
test eax, eax
je 0x4698e2
mov edx, esi
call fcn.0046b5fb
test eax, eax
je 0x4698e2
push 0x42
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.004bfed0
push ebx
push 0x42
lea eax, [ebp - 0x58]
push 1
push eax
call fcn.004bf5f0
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalSize]
add esp, 0x1c
cmp dword [ebp - 0x50], edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
je 0x46987a
push dword [esi + 0xc]
call edi
test eax, eax
mov dword [ebp - 0xc], eax
je 0x469876
push dword [esi + 0xc]
call ebx
test eax, eax
mov dword [ebp - 4], eax
jle 0x469867
push dword [ebp - 8]
lea eax, [ebp - 4]
push 4
push 1
push eax
call fcn.004bf5f0
push dword [ebp - 8]
push dword [ebp - 4]
push 1
push dword [ebp - 0xc]
call fcn.004bf5f0
add esp, 0x20
jmp 0x46986b
and dword [ebp - 0x50], 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x46987a
and dword [ebp - 0x50], 0
cmp dword [ebp - 0x4c], 0
je 0x4698cd
push dword [esi + 0x10]
call edi
mov edi, eax
test edi, edi
je 0x4698c9
push dword [esi + 0x10]
call ebx
test eax, eax
mov dword [ebp - 4], eax
jle 0x4698ba
push dword [ebp - 8]
lea eax, [ebp - 4]
push 4
push 1
push eax
call fcn.004bf5f0
push dword [ebp - 8]
push dword [ebp - 4]
push 1
push edi
call fcn.004bf5f0
add esp, 0x20
jmp 0x4698be
and dword [ebp - 0x4c], 0
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x4698cd
and dword [ebp - 0x4c], 0
mov eax, esi
call fcn.0046b62e
push dword [ebp - 8]
call fcn.0041c787
xor eax, eax
pop ecx
inc eax
jmp 0x4698eb
push ebx
call fcn.0041c787
pop ecx
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x475601
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
cmp ecx, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
jne 0x47564c
mov eax, dword [0x6148c0]
cmp eax, edi
je 0x475632
push eax
call fcn.004bf2a6
pop ecx
mov dword [0x614724], edi
mov dword [0x6148bc], edi
push 0x66c
push 0x191
call fcn.004bf452
pop ecx
mov dword [0x6148c0], eax
jmp 0x47573d
push 0xfb2
push str..Reconcile.c
mov edx, 0x4de27c
call fcn.0041c35a
mov ebx, eax
cmp ebx, edi
mov eax, dword [0x6148c0]
pop ecx
pop ecx
je 0x47573e
cmp eax, edi
je 0x475682
push eax
call fcn.004bf2a6
pop ecx
mov dword [0x6148c0], edi
push ebx
push 1
lea eax, [ebp - 4]
push 4
push eax
mov dword [0x614724], edi
mov dword [0x6148bc], edi
call fcn.004c0915
add esp, 0x10
cmp eax, 1
jae 0x4756b3
push ebx
call fcn.0041c787
mov dword [esp], 0x66c
jmp 0x475637
mov eax, dword [ebp - 4]
mov esi, 0x66c
add eax, 0x191
push esi
push eax
call fcn.004bf452
cmp eax, edi
pop ecx
pop ecx
mov dword [0x6148c0], eax
jne 0x4756dc
push ebx
call fcn.0041c787
xor eax, eax
jmp 0x47573d
mov eax, dword [ebp - 4]
cmp eax, edi
mov dword [ebp - 0xc], edi
jle 0x475727
push ebx
push 1
lea eax, [ebp - 8]
push 2
push eax
call fcn.004c0915
mov eax, dword [0x6148c0]
mov cx, word [ebp - 8]
add eax, edi
mov word [eax], cx
movzx ecx, word [ebp - 8]
push ebx
dec ecx
push 1
dec ecx
push ecx
add eax, 2
push eax
call fcn.004c0915
mov eax, dword [ebp - 4]
add esp, 0x20
inc dword [ebp - 0xc]
add edi, esi
cmp dword [ebp - 0xc], eax
jl 0x4756e6
xor edi, edi
push ebx
mov dword [0x614724], eax
mov dword [0x6148bc], edi
call fcn.0041c787
mov eax, dword [0x6148c0]
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x475743
Capabilities:
Write file on windows

Disassembly:
test ecx, ecx
push esi
push edi
jne 0x475750
xor eax, eax
jmp 0x4757d1
cmp dword [0x614724], 0
mov eax, dword [0x6148c0]
jle 0x4757d1
test eax, eax
je 0x4757d1
push 0xff6
push str..Reconcile.c
mov edx, 0x4de3b8
call fcn.0041c35a
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x475749
push esi
push 1
push 4
push 0x614724
call fcn.004bf5f0
mov edi, dword [0x6148c0]
xor edx, edx
add esp, 0x10
cmp dword [0x614724], edx
mov eax, 0x66c
jle 0x4757b5
mov ecx, edi
mov word [ecx], ax
inc edx
add ecx, eax
cmp edx, dword [0x614724]
jl 0x4757a7
push esi
push dword [0x614724]
push eax
push edi
call fcn.004bf5f0
push esi
call fcn.0041c787
mov eax, dword [0x6148c0]
add esp, 0x14
pop edi
pop esi
ret
Function at 0x476f0c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
xor esi, esi
push 9
xor eax, eax
cmp dword [ebp + 8], esi
mov word [ebp - 0x34], si
pop ecx
lea edi, [ebp - 0x32]
rep stosd dword es:[edi], eax
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
stosw word es:[edi], ax
jne 0x476f65
mov eax, dword [0x6145ac]
cmp eax, esi
je 0x476f4e
push eax
call fcn.004bf2a6
pop ecx
mov dword [0x6142bc], esi
mov dword [0x614434], esi
push 0x28
push 0x3e9
call fcn.004bf452
pop ecx
mov dword [0x6145ac], eax
jmp 0x47706f
mov ecx, dword [ebp + 8]
push 0x143e
push str..Reconcile.c
mov edx, 0x4de27c
call fcn.0041c35a
mov ebx, eax
cmp ebx, esi
mov eax, dword [0x6145ac]
pop ecx
pop ecx
je 0x477070
cmp eax, esi
je 0x476f9e
push eax
call fcn.004bf2a6
pop ecx
mov dword [0x6145ac], esi
push ebx
push 1
lea eax, [ebp - 8]
push 4
push eax
mov dword [0x6142bc], esi
mov dword [0x614434], esi
call fcn.004c0915
add esp, 0x10
cmp eax, 1
jae 0x476fdf
push ebx
call fcn.0041c787
push 0x28
push 0x3e9
call fcn.004bf452
add esp, 0xc
mov dword [0x6145ac], eax
jmp 0x477070
mov eax, dword [ebp - 8]
push 0x28
pop esi
add eax, 0x3e9
push esi
push eax
call fcn.004bf452
xor edi, edi
cmp eax, edi
pop ecx
pop ecx
mov dword [0x6145ac], eax
jne 0x477008
push ebx
call fcn.0041c787
xor eax, eax
jmp 0x47706f
mov eax, dword [ebp - 8]
cmp eax, edi
mov dword [ebp + 8], edi
jle 0x477058
push ebx
push 1
lea eax, [ebp - 0xc]
push 2
push eax
call fcn.004c0915
mov eax, dword [0x6145ac]
mov dword [ebp - 0xc], esi
mov word [edi + eax], si
movzx eax, word [ebp - 0xc]
push ebx
dec eax
dec eax
push 1
push eax
lea eax, [ebp - 0x32]
push eax
call fcn.004c0915
lea eax, [ebp - 0x34]
push eax
call fcn.004757d4
mov eax, dword [ebp - 8]
add esp, 0x24
inc dword [ebp + 8]
add edi, esi
cmp dword [ebp + 8], eax
jl 0x477012
and dword [0x614434], 0
push ebx
mov dword [0x6142bc], eax
call fcn.0041c787
mov eax, dword [0x6145ac]
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x477075
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
cmp ecx, esi
push edi
mov dword [ebp - 4], esi
jne 0x477089
xor eax, eax
jmp 0x477100
cmp dword [0x6142bc], esi
mov eax, dword [0x6145ac]
jle 0x477100
cmp eax, esi
je 0x477100
push 0x1486
push str..Reconcile.c
mov edx, 0x4de3b8
call fcn.0041c35a
mov ebx, eax
cmp ebx, esi
pop ecx
pop ecx
je 0x477085
mov eax, dword [0x6142bc]
push ebx
push 1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push 4
push eax
call fcn.004bf5f0
add esp, 0x10
cmp dword [ebp - 4], esi
jle 0x4770f4
xor edi, edi
mov eax, dword [0x6145ac]
push ebx
push 1
add eax, edi
push 0x28
push eax
call fcn.004bf5f0
add esp, 0x10
inc esi
add edi, 0x28
cmp esi, dword [ebp - 4]
jl 0x4770d6
push ebx
call fcn.0041c787
mov eax, dword [0x6145ac]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x477105
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
test esi, esi
push edi
mov ebx, eax
jge 0x477117
call fcn.0040d2f7
mov esi, eax
test ebx, ebx
jge 0x477122
call fcn.0040d275
mov ebx, eax
test esi, esi
jle 0x477169
test ebx, ebx
jle 0x477169
push 1
push 0x1f8
call fcn.004bf452
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x477169
mov dword [edi], esi
imul esi, ebx
mov eax, esi
cdq
sub eax, edx
sar eax, 1
lea eax, [eax + esi + 0x14]
push eax
push 4
mov dword [edi + 4], ebx
call fcn.004bf452
test eax, eax
pop ecx
pop ecx
mov dword [edi + 0x14], eax
jne 0x47716f
push edi
call fcn.004bf2a6
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
ret
xor eax, eax
test esi, esi
push 7
pop ebx
jle 0x47718c
mov ecx, dword [edi + 0x14]
mov byte [ecx + eax*4], 0x20
mov ecx, dword [edi + 0x14]
mov word [ecx + eax*4 + 2], bx
inc eax
cmp eax, esi
jl 0x477178
mov eax, dword [0x614ccc]
test eax, eax
jne 0x4771b4
call fcn.0046e649
test eax, eax
mov dword [0x614ccc], eax
jne 0x4771b4
push dword [edi + 0x14]
call fcn.004bf2a6
push edi
call fcn.004bf2a6
pop ecx
jmp 0x477168
mov ecx, dword [edi + 0x14]
lea ecx, [ecx + esi*4 + 4]
push 5
mov dword [edi + 0x24], ecx
lea ecx, [esi + 2]
pop edx
cmp ecx, edx
mov dword [edi + 0x20], ecx
jge 0x4771ce
mov dword [edi + 0x20], edx
mov dword [edi + 0x10], ebx
mov byte [edi + 0x1d], bl
push edi
mov ebx, eax
mov byte [edi + 0x1c], 9
call fcn.0046e6fb
lea ebx, [edi + 0x38]
mov dword [esp], str..ScreenBuffer.c
push ebx
call fcn.0041cee3
pop ecx
pop ecx
mov esi, str.A_ScreenBuffer_handle_had_to_be_forced_to_unlock___
mov eax, ebx
call fcn.0041d0de
mov eax, 0x7d0
mov ecx, ebx
call fcn.0041d107
mov eax, edi
call fcn.00479d7d
mov eax, edi
jmp 0x47716b

Function at 0x477303
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, eax
jne 0x477314
xor eax, eax
jmp 0x47733e
push edi
mov edi, 0xef
call fcn.00479d19
test eax, eax
je 0x47733b
mov eax, esi
call fcn.00479d67
test eax, eax
je 0x47733b
cmp dword [esi + 0x14], 0
jne 0x477341
mov eax, esi
call fcn.00479d7d
xor eax, eax
pop edi
pop esi
leave
ret
push ebx
push dword [ebp + 8]
lea ebx, [esi + 4]
mov edi, dword [ebx]
imul edi, dword [esi]
push 4
push 1
push esi
call fcn.004bf5f0
push dword [ebp + 8]
mov dword [ebp - 4], eax
push 4
push 1
push ebx
call fcn.004bf5f0
add dword [ebp - 4], eax
add esp, 0x20
xor ebx, ebx
test edi, edi
jle 0x47738a
mov eax, dword [esi + 0x14]
movsx eax, byte [eax + ebx*4]
push dword [ebp + 8]
push eax
call fcn.004c040f
inc ebx
cmp ebx, edi
pop ecx
pop ecx
jl 0x477373
add dword [ebp - 4], edi
xor ebx, ebx
test edi, edi
jle 0x4773ab
mov eax, dword [esi + 0x14]
movzx eax, byte [eax + ebx*4 + 2]
push dword [ebp + 8]
push eax
call fcn.004c040f
inc ebx
cmp ebx, edi
pop ecx
pop ecx
jl 0x477393
mov eax, esi
call fcn.00479d7d
mov eax, dword [ebp - 4]
add eax, edi
pop ebx
jmp 0x47733d
Function at 0x477923
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
jne 0x47793e
xor eax, eax
jmp 0x4779d1
push esi
push dword [ebp + 8]
lea eax, [ebp - 4]
push 4
push 1
push eax
call fcn.004c0915
push dword [ebp + 8]
lea eax, [ebp - 8]
push 4
push 1
push eax
call fcn.004c0915
mov ecx, dword [ebp - 4]
lea eax, [ecx - 1]
mov edx, 0x7ffd
add esp, 0x20
cmp eax, edx
ja 0x4779ce
mov eax, dword [ebp - 8]
lea esi, [eax - 1]
cmp esi, edx
ja 0x4779ce
call fcn.00477105
mov edi, eax
cmp edi, ebx
je 0x4779ce
mov esi, dword [edi + 4]
imul esi, dword [edi]
test esi, esi
jle 0x4779a9
push dword [ebp + 8]
call fcn.004bfd7e
cmp eax, 0xffffffff
pop ecx
je 0x4779a9
mov ecx, dword [edi + 0x14]
mov byte [ecx + ebx*4], al
inc ebx
cmp ebx, esi
jl 0x477990
xor ebx, ebx
test esi, esi
jle 0x4779ca
push dword [ebp + 8]
call fcn.004bfd7e
cmp eax, 0xffffffff
pop ecx
je 0x4779ca
mov ecx, dword [edi + 0x14]
mov word [ecx + ebx*4 + 2], ax
inc ebx
cmp ebx, esi
jl 0x4779af
mov eax, edi
jmp 0x4779d0
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret
Function at 0x478bbc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x478bc1
push esi
push edi
mov esi, eax
mov edi, 0x693
call fcn.00479d19
test eax, eax
je 0x478c5b
mov eax, esi
call fcn.00479d67
test eax, eax
je 0x478c5b
mov eax, dword [esi + 4]
imul eax, dword [esi]
xor ecx, ecx
test eax, eax
jle 0x478c47
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*4]
cmp byte [eax], 0x20
jne 0x478c05
test word [eax + 2], 0x2000
jne 0x478c05
xor edi, edi
jmp 0x478c0b
xor edi, edi
mov byte [eax], 0x20
inc edi
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*4 + 2]
movzx edx, word [eax]
xor edx, dword [esi + 0x10]
test dl, dl
je 0x478c2c
mov dl, byte [esi + 0x10]
and dx, 0xff
or dx, 0x200
mov word [eax], dx
test edi, edi
je 0x478c3c
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*4 + 2]
or word [eax], 0x2000
mov eax, dword [esi + 4]
imul eax, dword [esi]
inc ecx
cmp ecx, eax
jl 0x478bee
and dword [esi + 8], 0
and dword [esi + 0xc], 0
mov eax, esi
call fcn.00479d7d
xor eax, eax
inc eax
jmp 0x478c5d
xor eax, eax
pop edi
pop esi
ret

Function at 0x479d8a
Capabilities:
Write file on windows

Disassembly:
push 0x10
push 0x51c3f0
call fcn.004c652c
or dword [ebp - 0x1c], 0xffffffff
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x479e46
push 1
mov esi, 0xfffc
push esi
call fcn.004bf452
mov edi, eax
push 1
push esi
call fcn.004bf452
mov esi, eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push 0xffffffffffffffff
push 0xffdc
push edi
call fcn.004c155a
add esp, 0x24
xor ecx, ecx
mov dword [ebp - 0x20], ecx
lea eax, [edi + ecx]
mov dl, byte [eax]
cmp dl, 0xd
je 0x479e39
cmp dl, 0xa
je 0x479e39
add ecx, esi
mov byte [ecx], 0x1c
mov byte [ecx + 1], 0x1d
mov byte [ecx + 2], 0x1e
mov byte [ecx + 3], 0x1f
add ecx, 4
push ecx
call fcn.00479fc9
pop ecx
push dword [ebp + 8]
push esi
call fcn.004bf880
pop ecx
push eax
push 1
push esi
call fcn.004bf5f0
add esp, 0x10
mov dword [ebp - 0x1c], eax
cmp eax, 4
jle 0x479e29
sub dword [ebp - 0x1c], 4
push edi
call fcn.004bf2a6
push esi
call fcn.004bf2a6
pop ecx
pop ecx
jmp 0x479e46
mov byte [esi + ecx], dl
inc ecx
jmp 0x479dda
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.004c6571
ret

Function at 0x47ab20
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ecx
push esi
push 0x2b7
push str..Security.c
call fcn.0047aa95
mov edx, 0x4de3b8
mov ecx, eax
call fcn.0041c35a
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x47ab70
push esi
push 1
lea eax, [esp + 0x14]
push 4
push eax
call fcn.004bf5f0
push esi
call fcn.0041c787
add esp, 0x14
push 2
push ecx
call fcn.0047aa95
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
inc eax
pop esi
pop ecx
ret
Function at 0x47ab73
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
push edi
push 0x2d0
push str..Security.c
call fcn.0047aa95
mov edx, 0x4de27c
mov ecx, eax
call fcn.0041c35a
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x47abb1
call fcn.0047aa95
mov edi, eax
call fcn.0041a56b
xor eax, eax
jmp 0x47abd5
push esi
push 1
lea eax, [ebp - 4]
push 4
push eax
call fcn.004c0915
add esp, 0x10
cmp eax, 1
jae 0x47abcb
and dword [ebp - 4], 0
push esi
call fcn.0041c787
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
leave
ret
Function at 0x47cd7e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
mov ebx, ecx
mov esi, edx
push 0
push eax
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], esi
mov byte [ebp - 0x110], 0
call fcn.004c05d0
and word [ebp - 0x12c], 0
xor eax, eax
lea edi, [ebp - 0x12a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
test ebx, ebx
stosw word es:[edi], ax
jne 0x47cde6
test esi, esi
jne 0x47cde6
xor eax, eax
inc eax
jmp 0x47ceee
push str.S7.tim
lea edi, [ebp - 0x110]
call fcn.004457b7
test ebx, ebx
pop ecx
jne 0x47ce0d
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x11c], eax
xor edx, edx
mov ecx, eax
jmp 0x47ce23
test esi, esi
jne 0x47ce32
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x118], eax
mov esi, ebx
mov edx, eax
xor ecx, ecx
lea edi, [ebp - 0x12c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0047cefd
and dword [ebp - 0x114], 0
mov edi, 0x190
lea esi, [edi - 0x64]
push 0x664
push str..ServerPAULA.c
mov edx, 0x4de3b8
lea ecx, [ebp - 0x110]
call fcn.0041c35a
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x47ceaf
call fcn.004c0a8c
cdq
mov ecx, edi
idiv ecx
add edx, esi
js 0x47ce94
call fcn.004c0a8c
cdq
mov ecx, edi
idiv ecx
add edx, esi
cmp edx, 0x7fffffff
jge 0x47ce94
call fcn.004c0a8c
cdq
mov ecx, edi
idiv ecx
add edx, esi
push edx
jmp 0x47ce96
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 3
jl 0x47ce41
xor eax, eax
jmp 0x47ceee
xor esi, esi
push ebx
inc esi
push esi
push 0x10
push dword [ebp - 0x11c]
call fcn.004bf5f0
add esp, 0x10
cmp eax, esi
jne 0x47cede
push ebx
push esi
push 0x10
push dword [ebp - 0x118]
call fcn.004bf5f0
add esp, 0x10
cmp eax, esi
je 0x47cee0
xor esi, esi
push ebx
call fcn.0041c787
xor eax, eax
test esi, esi
pop ecx
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bfeb5
leave
ret
Function at 0x47cefd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x10f]
mov esi, ecx
mov ebx, edx
push 0
push eax
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x118], ebx
mov byte [ebp - 0x110], 0
call fcn.004c05d0
and word [ebp - 0x12c], 0
xor eax, eax
lea edi, [ebp - 0x12a]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosw word es:[edi], ax
push str.S7.tim
lea edi, [ebp - 0x110]
call fcn.004457b7
test esi, esi
pop ecx
jne 0x47cf76
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x11c], eax
test ebx, ebx
jne 0x47cf86
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x118], eax
and dword [ebp - 0x114], 0
mov esi, 0x15e
lea ebx, [esi - 0x64]
push 0x6a1
push str..ServerPAULA.c
mov edx, 0x4de27c
lea ecx, [ebp - 0x110]
call fcn.0041c35a
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x47d02a
lea edi, [ebp - 0x110]
call fcn.0041a56b
test eax, eax
je 0x47d00e
call fcn.004c0a8c
cdq
mov ecx, esi
idiv ecx
add edx, ebx
js 0x47cff7
call fcn.004c0a8c
cdq
mov ecx, esi
idiv ecx
add edx, ebx
cmp edx, 0x7fffffff
jge 0x47cff7
call fcn.004c0a8c
cdq
mov ecx, esi
idiv ecx
add edx, ebx
push edx
jmp 0x47cff9
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 3
jl 0x47cf95
lea edi, [ebp - 0x110]
call fcn.0041a56b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bfeb5
leave
ret
mov esi, dword [ebp - 0x11c]
xor ebx, ebx
push edi
inc ebx
push ebx
push 0x10
push esi
mov dword [ebp - 0x114], ebx
call fcn.004c0915
add esp, 0x10
cmp eax, ebx
jne 0x47d060
push edi
push ebx
push 0x10
push dword [ebp - 0x118]
call fcn.004c0915
add esp, 0x10
cmp eax, ebx
je 0x47d067
and dword [ebp - 0x114], 0
push edi
call fcn.0041c787
pop ecx
push ebx
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004ae973
add esp, 0x14
test eax, eax
je 0x47d019
mov esi, dword [ebp - 0x118]
push ebx
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004ae973
add esp, 0x14
test eax, eax
je 0x47d019
xor eax, eax
cmp dword [ebp - 0x114], eax
setne al
jmp 0x47d01b
Function at 0x47d0b4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
xor ebx, ebx
lea eax, [ebp - 0x10f]
mov edi, ecx
push ebx
push eax
mov dword [ebp - 0x118], edi
mov byte [ebp - 0x110], 0
call fcn.004c05d0
add esp, 0xc
cmp edi, ebx
jne 0x47d0fb
xor eax, eax
jmp 0x47d1f0
mov esi, 0x188
push esi
push ebx
push edi
call fcn.004c05d0
add esp, 0xc
push str.eod.tim
lea edi, [ebp - 0x110]
call fcn.004457b7
mov dword [ebp - 0x114], ebx
pop ecx
mov ebx, 0xfa
push 0x6ee
push str..ServerPAULA.c
mov edx, 0x4de27c
lea ecx, [ebp - 0x110]
call fcn.0041c35a
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x47d1b3
lea edi, [ebp - 0x110]
call fcn.0041a56b
test eax, eax
je 0x47d1a3
call fcn.004c0a8c
mov edi, 0x226
cdq
mov ecx, edi
idiv ecx
add edx, ebx
js 0x47d18c
call fcn.004c0a8c
cdq
mov ecx, edi
idiv ecx
add edx, ebx
cmp edx, 0x7fffffff
jge 0x47d18c
call fcn.004c0a8c
cdq
idiv edi
add edx, ebx
push edx
jmp 0x47d18e
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 3
jl 0x47d127
lea edi, [ebp - 0x110]
call fcn.0041a56b
jmp 0x47d0f4
push edi
push 1
push esi
push dword [ebp - 0x118]
call fcn.004c0915
add esp, 0x10
cmp eax, 1
push edi
je 0x47d1e7
call fcn.0041c787
pop ecx
push esi
push 0
push dword [ebp - 0x118]
call fcn.004c05d0
add esp, 0xc
jmp 0x47d0f4
call fcn.0041c787
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bfeb5
leave
ret

Function at 0x47d1ff
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x51f5d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x10f]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x118], esi
mov byte [ebp - 0x110], 0
call fcn.004c05d0
add esp, 0xc
test esi, esi
jne 0x47d245
xor eax, eax
jmp 0x47d308
push str.eod.tim
lea edi, [ebp - 0x110]
call fcn.004457b7
and dword [ebp - 0x114], 0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
pop ecx
mov edi, 0x226
mov esi, 0x12c
push 0x721
push str..ServerPAULA.c
mov edx, 0x4de3b8
lea ecx, [ebp - 0x110]
call fcn.0041c35a
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x11c], eax
jne 0x47d2dc
call fcn.004c0a8c
cdq
mov ecx, edi
idiv ecx
add edx, esi
js 0x47d2c4
call fcn.004c0a8c
cdq
mov ecx, edi
idiv ecx
add edx, esi
cmp edx, 0x7fffffff
jge 0x47d2c4
call fcn.004c0a8c
cdq
mov ecx, edi
idiv ecx
add edx, esi
push edx
jmp 0x47d2c6
push 0xa
call ebx
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 3
jl 0x47d26d
jmp 0x47d23e
push eax
xor esi, esi
inc esi
push esi
push 0x188
push dword [ebp - 0x118]
call fcn.004bf5f0
add esp, 0x10
cmp eax, esi
je 0x47d2fa
xor esi, esi
push dword [ebp - 0x11c]
call fcn.0041c787
pop ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bfeb5
leave
ret