joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481ba5
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x4a46ed
call fcn.00489db4
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x40]
mov dword [ebp - 4], 0xf
call fcn.00401605
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 0xe
call fcn.00401605
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0xd
call fcn.00401605
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 0xc
call fcn.00401605
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 0xb
call fcn.00401605
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 0xa
call fcn.00401605
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 9
call fcn.00401605
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 8
call fcn.00401605
lea ecx, [esi + 0x20]
mov byte [ebp - 4], 7
call fcn.00401605
lea ecx, [esi + 0x1c]
mov byte [ebp - 4], 6
call fcn.00401605
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 5
call fcn.00401605
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 4
call fcn.00401605
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 3
call fcn.00401605
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 2
call fcn.00401605
lea ecx, [esi + 8]
mov byte [ebp - 4], 1
call fcn.00401605
and byte [ebp - 4], 0
lea ecx, [esi + 4]
call fcn.00401605
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00401605
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x482579
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push dword [ebp + 8]
call fcn.00482568
mov edi, eax
pop ecx
test edi, edi
je 0x4825b2
and byte [ebp - 1], 0
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 1]
push eax
push edi
mov ecx, esi
call fcn.004825c3
mov esi, dword [esi + 4]
push edi
push esi
push dword [ebp + 8]
call fcn.004824fc
add esp, 0xc
pop esi
pop edi
leave
ret
Function at 0x48655d
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
mov edx, 0xff
mov esi, dword [ecx]
movzx edi, byte [esp + 0x10]
mov eax, esi
and eax, edx
xor eax, edi
shr esi, 8
mov eax, dword [eax*4 + 0x4a9270]
xor eax, esi
mov esi, dword [ecx + 8]
mov dword [ecx], eax
and eax, edx
add eax, dword [ecx + 4]
mov edi, esi
and edi, edx
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 4], eax
shr eax, 0x18
xor eax, edi
pop edi
shr esi, 8
mov eax, dword [eax*4 + 0x4a9270]
xor eax, esi
pop esi
mov dword [ecx + 8], eax
ret

Function at 0x4e0f88
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [esp + 0x3c], eax
push 0x2e2e9258
lea esp, [esp + 0x40]
call fcn.00455ac4
cmp bh, 0x4e
movsx ax, cl
mov eax, dword [ebp - 0x40]
pushal
mov byte [ebp - 4], 4
bt bp, 2
test eax, eax
call fcn.004dc120
call fcn.004de4c7
movsx eax, al
push eax
lea eax, [ebp - 0x40]
setb ch
call fcn.004dbf43
jmp 0x4d81e8
not ch
push esi
movzx cx, al
lea ecx, [ebp - 0xc0]
call fcn.004dac29
mov byte [esp], 0xb5
push dword [esp]
lea esp, [esp + 8]
jns 0x4dc26b
mov byte [ebp - 4], 7
pushal
lea esp, [esp + 0x20]
jne 0x4ddf38
pushal
pop edi
not di
mov dword [esp + 0x18], 5
lea esp, [esp + 0x18]
not di
call fcn.004d8382
pushfd
lea esp, [esp + 0x24]
call fcn.00455e73
jmp 0x4df3a4
cmp dword [ebp - 0x28], edi
jmp 0x4e07ca

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1deb6bf8
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4a951e50
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x431072
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x68233a26
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x431060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3720657f
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x361e4355
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x441473e7
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4528b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x44
call fcn.005e6090
push ebx
push ebp
push esi
push edi
xor edi, edi
mov esi, ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], 0x5f7544
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
call fcn.0050d750
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x1c], edi
call fcn.0050c670
mov ecx, dword [esi + 0x78]
call fcn.004fb140
mov ebp, eax
cmp ebp, edi
je 0x452a2c
mov ecx, ebp
call fcn.00453020
mov ebx, eax
cmp ebx, 0x5d
je 0x452998
cmp ebx, 0x5e
je 0x452998
cmp ebx, 0x60
je 0x452933
cmp ebx, 0x61
jne 0x452a1b
mov esi, dword [esp + 0x5c]
mov eax, dword [esi + 0xa0]
mov ecx, dword [esi + 0x9c]
push eax
push ecx
mov ecx, ebp
call fcn.004eebe0
mov ecx, dword [esi]
push eax
lea edx, [esp + 0x28]
push edx
call fcn.004ad080
push 1
push 0x20
mov ecx, 0x63b5b0
call fcn.004e1dd0
cmp eax, edi
je 0x452a0f
mov dword [eax], 0x5fd690
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x18], edi
mov dword [eax + 0xc], ebx
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x10], ecx
mov edx, dword [esp + 0x28]
mov dword [eax + 0x14], edx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 0x18], ecx
jmp 0x452a11
mov edx, dword [esp + 0x5c]
mov eax, dword [edx + 0x10]
mov esi, dword [eax + 4]
cmp esi, edi
je 0x4529b9
mov ecx, ebp
call fcn.00489580
cmp eax, dword [esi + 0xc]
je 0x4529d1
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x4529a6
lea ecx, [esp + 0x10]
call fcn.004e6350
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 8
push 1
push 0x20
mov ecx, 0x63b5b0
call fcn.004e1dd0
cmp eax, edi
je 0x452a0f
mov dword [eax], 0x5fd690
lea ecx, [esi + 0x20]
cmp ecx, edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x18], edi
mov dword [eax + 0xc], ebx
je 0x452a11
mov edx, dword [ecx]
mov dword [eax + 0x10], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x14], edx
mov ecx, dword [ecx + 8]
mov dword [eax + 0x18], ecx
jmp 0x452a11
xor eax, eax
lea ecx, [esp + 0x10]
push eax
call fcn.004e6190
mov ecx, ebp
call fcn.004ecf40
mov ebp, eax
cmp ebp, edi
jne 0x452912
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x58]
push edx
lea edx, [esp + 0x14]
call fcn.004527f0
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.004e6350
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 8
Function at 0x4beba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x394
call fcn.005e6090
push ebx
push esi
mov ebx, ecx
mov eax, dword [ebx + 0x34]
push edi
xor edi, edi
push eax
lea ecx, [esp + 0x25c]
xor esi, esi
mov dword [esp + 0x18], edi
call fcn.004be460
mov ecx, dword [ebx + 0x34]
push ecx
lea ecx, [esp + 0x74]
call fcn.004be460
lea ecx, [esp + 0x4c]
call fcn.004e7170
lea ecx, [esp + 0x5c]
call fcn.004e7170
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4bebfa
mov edx, dword [eax]
cmp edx, dword [ebx + 0x34]
je 0x4bec0f
mov edx, dword [ebp + 0x10]
lea eax, [esp + 0x20]
mov ecx, eax
push ecx
mov ecx, dword [ebx + 0x34]
mov dword [ebp + 0x14], eax
call fcn.004189a0
mov ecx, ebx
call fcn.004619c0
mov ecx, eax
call fcn.004e66c0
test eax, eax
mov dword [esp + 0x10], eax
je 0x4bec9a
jmp 0x4bec30
mov eax, dword [esp + 0x10]
jmp 0x4bec30
mov edx, dword [ebp + 0x14]
add edx, 0x3c
push edx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x264]
push edx
mov ecx, eax
call fcn.004b7190
test eax, eax
jne 0x4bec89
test esi, esi
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
je 0x4bec6c
cmp eax, edi
jg 0x4bec6c
jne 0x4bec89
cmp edx, dword [esp + 0x14]
jbe 0x4bec89
mov ecx, 0x52
lea esi, [esp + 0x258]
lea edi, [esp + 0x70]
rep movsd dword es:[edi], dword [esi]
mov esi, 1
mov edi, eax
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x10]
call fcn.004ecf40
test eax, eax
mov dword [esp + 0x10], eax
jne 0x4bec27
lea ecx, [esp + 0x1b8]
call fcn.0052abd0
mov eax, dword [esp + 0x128]
xor esi, esi
cmp eax, esi
je 0x4becd5
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x124]
neg eax
adc ecx, esi
neg ecx
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], ecx
cmp dword [esp + 0x140], esi
mov dword [esp + 0x128], esi
je 0x4bed07
mov edx, dword [esp + 0x138]
mov eax, dword [esp + 0x13c]
neg edx
adc eax, esi
neg eax
mov dword [esp + 0x138], edx
mov dword [esp + 0x13c], eax
cmp dword [ebp + 0x18], esi
mov dword [esp + 0x140], esi
je 0x4bed26
lea ecx, [esp + 0x78]
push ecx
lea ecx, [esp + 0x1bc]
call fcn.0052aa40
jmp 0x4bed49
lea edx, [ebx + 0xb8]
push edx
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x158]
push ecx
lea ecx, [esp + 0x1c4]
call fcn.0052b1a0
mov edx, dword [esp + 0x1c0]
or edx, dword [esp + 0x1c4]
jne 0x4bed8c
mov eax, dword [esp + 0x1d8]
or eax, dword [esp + 0x1dc]
jne 0x4bed8c
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push 1
push esi
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
mov ecx, ebx
call fcn.004be8e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 8]
lea edx, [esp + 0x1b8]
push edx
call fcn.0052aa40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4dc7f0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [ecx + 0xc0]
jmp fcn.005056d0
Function at 0x4ddae0
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
mov eax, 0x190
call fcn.005e6090
push esi
lea eax, [esp + 4]
push eax
push 0x101
mov esi, ecx
call sub.WSOCK32.dll_WSAStartup
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
xor ecx, ecx
mov dword [esi + 0x20], eax
mov cx, word [0x625278]
push ecx
call sub.WSOCK32.dll_htons
push 0
call sub.WSOCK32.dll_htonl
mov dword [0x625278], 0
pop esi
add esp, 0x190
ret 4

Function at 0x4ddc00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebp, ebp
test esi, esi
push edi
jbe 0x4ddc4e
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
cmp ebp, 0x927c0
ja 0x4ddc57
push 0
push esi
push edi
push ebx
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
jne 0x4ddc46
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4ddc57
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebp, 0x64
jmp 0x4ddc4a
sub esi, eax
add edi, eax
test esi, esi
ja 0x4ddc16
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0xc
Function at 0x4deda0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov ecx, 0x2001
mov dword [esp + 0x14], 0x2000
mov dword [esp + 0x10], ebp
call fcn.004dc4c0
mov ebx, eax
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x4dedd8
cmp eax, 0x2000
jae 0x4dedd8
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x34]
lea esp, [esp]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x30]
push 0
push ecx
push ebx
push edx
call sub.WSOCK32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
jne 0x4dee2e
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x4dee18
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebp, 0x64
cmp ebp, 0x927c0
jbe 0x4dede0
mov ecx, ebx
call fcn.004dc6a0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret 0x10
push 1
mov byte [esi + ebx], 0
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx]
push esi
push ebx
call dword [eax + 0x30]
mov edx, dword [esp + 0x10]
mov ebp, dword [esp + 0x3c]
mov eax, dword [ebp + 8]
add edx, esi
cmp eax, 0xffffffff
mov dword [esp + 0x10], edx
je 0x4dee64
cmp eax, esi
jbe 0x4dee86
sub eax, esi
mov dword [ebp + 8], eax
xor ebp, ebp
jmp 0x4dede0
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4dee7f
push 1
mov ecx, eax
mov edx, dword [ecx]
push 0xf
push 0x6252ac
call dword [edx + 0x54]
test eax, eax
je 0x4dee86
xor ebp, ebp
jmp 0x4dede0
mov ecx, ebx
call fcn.004dc6a0
mov eax, dword [ebp + 4]
test eax, eax
je 0x4deeec
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4deea4
mov ecx, eax
mov eax, dword [ecx]
call dword [eax + 0x50]
jmp 0x4deea6
xor eax, eax
mov ecx, dword [esp + 0x10]
push 0
push ecx
push eax
lea ecx, [esp + 0x24]
call fcn.0051cb60
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx]
push 1
call dword [edx + 0x14]
lea ecx, [esp + 0x18]
call fcn.0051ca00
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.0051c9f0
mov edi, dword [edi + 0xc]
mov edx, dword [edi]
push 1
push esi
push eax
mov ecx, edi
call dword [edx + 0x30]
lea ecx, [esp + 0x18]
call fcn.0051cb20
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0x10

Function at 0x4def00
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push edi
mov ecx, 0x400
call fcn.004dc4c0
mov edi, dword [esp + 0xc]
push 0
push 0x400
mov esi, eax
push esi
push edi
call sub.WSOCK32.dll_recv
test eax, eax
je 0x4def3b
cmp eax, 0xffffffff
je 0x4def3b
push 0
push 0x400
push esi
push edi
call sub.WSOCK32.dll_recv
test eax, eax
jne 0x4def24
mov ecx, esi
call fcn.004dc6a0
pop edi
pop esi
ret 4
Function at 0x4e00b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x723df4]
sub esp, 8
push ebx
push ebp
push esi
xor ebx, ebx
cmp eax, ebx
push edi
mov edi, ecx
je 0x4e00cd
mov esi, dword [eax + 4]
mov dword [esp + 0x10], esi
jmp 0x4e00d3
mov dword [esp + 0x10], ebx
mov esi, ebx
mov ax, word [0x62cac8]
lea ebp, [edi + 0x64]
push ebp
mov ecx, esi
mov word [ebp], ax
call fcn.0051bd90
cmp word [esi + 0x28], 1
jbe 0x4e010e
mov eax, dword [edi + 0x5c]
mov ecx, dword [eax + 0x2c]
mov edx, dword [eax + 0x28]
push 0
push 0x186a0
push ecx
push edx
call fcn.005e64b0
movzx ebx, word [esi + 0x28]
dec ebx
imul ebx, eax
mov ecx, dword [edi + 0x70]
mov eax, dword [esi + 0x40]
movsx edx, word [ecx + 0x26]
add eax, ebx
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x20]
sub eax, edx
movsx edx, word [ecx + 0x24]
sub eax, edx
cmp dword [esp + 0x14], eax
jle 0x4e014f
movsx edx, word [ecx + 0x26]
mov eax, dword [ecx + 0x20]
mov esi, dword [esp + 0x10]
sub eax, edx
movsx edx, word [ecx + 0x24]
sub eax, edx
imul eax, eax, 0x2710
cdq
idiv dword [esp + 0x14]
jmp 0x4e0155
mov ax, word [0x62cac8]
movsx edx, word [ecx + 0x2a]
mov word [esp + 0x14], ax
mov eax, dword [ecx + 0x1c]
sub eax, edx
movsx edx, word [ecx + 0x28]
sub eax, edx
cmp dword [esi + 0x3c], eax
jle 0x4e0189
movsx edx, word [ecx + 0x2a]
mov eax, dword [ecx + 0x1c]
movsx ecx, word [ecx + 0x28]
sub eax, edx
sub eax, ecx
imul eax, eax, 0x2710
cdq
idiv dword [esi + 0x3c]
jmp 0x4e018f
mov ax, word [0x62cac8]
movzx edx, word [esp + 0x14]
movzx ecx, ax
sub edx, ecx
jns 0x4e01a6
mov dx, word [esp + 0x14]
mov word [ebp], dx
jmp 0x4e01aa
mov word [ebp], ax
mov eax, dword [esi + 0x40]
push eax
mov ecx, ebp
call fcn.005192b0
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x3c]
push edx
mov ecx, ebp
mov esi, eax
call fcn.005192b0
push ebx
mov ecx, ebp
mov dword [esp + 0x18], eax
call fcn.005192b0
mov ebp, eax
mov eax, dword [edi + 0x70]
movsx ecx, word [eax + 0x26]
mov edx, dword [eax + 0x20]
sub edx, ecx
movsx ecx, word [eax + 0x24]
sub edx, ecx
lea ecx, [esi + ebp]
cmp ecx, edx
jle 0x4e01fe
movsx edx, word [eax + 0x26]
mov esi, dword [eax + 0x20]
movsx eax, word [eax + 0x24]
sub esi, edx
sub esi, eax
sub esi, ebp
mov eax, dword [edi + 0x70]
mov eax, dword [eax + 0x20]
mov ecx, dword [edi + 0x78]
sub eax, esi
sub eax, ebp
cdq
sub eax, edx
mov edx, dword [esp + 0x14]
mov ebx, eax
mov eax, dword [edi + 0x70]
mov eax, dword [eax + 0x1c]
sub eax, edx
cdq
sub eax, edx
mov edx, dword [esp + 0x14]
sar eax, 1
sar ebx, 1
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x1c], edx
mov dword [ecx + 0x20], esi
call fcn.00516ff0
mov eax, dword [edi + 0x70]
mov eax, dword [eax + 0x1c]
mov ecx, dword [edi + 0x74]
add ebx, esi
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], ebp
call fcn.00516ff0
movzx ecx, word [0x62cac8]
movzx edx, word [edi + 0x64]
sub edx, ecx
lea eax, [edi + 0x64]
je 0x4e0274
mov ecx, dword [esp + 0x10]
push eax
call fcn.0051bd90
mov eax, dword [esp + 0x10]
push eax
mov ecx, edi
call fcn.004dfd20
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4e1660
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
mov eax, 0x450
call fcn.005e6090
push ebx
push ebp
push esi
xor ebp, ebp
push ebp
push ebp
push ebp
push ebp
xor ebx, ebx
push 0x602dc8
mov dword [esp + 0x34], 0x602dc4
mov dword [esp + 0x38], ebp
mov dword [esp + 0x28], ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
cmp esi, ebp
mov dword [esp + 0x1c], esi
je 0x4e17e5
push edi
push ebp
push ebp
push 3
push ebp
push ebp
push ebp
push str.experts.tallysolutions.com
push esi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
cmp edi, ebp
mov dword [esp + 0x1c], edi
je 0x4e17dd
mov dword [esp + 0x10], ebp
call fcn.005e6031
push eax
lea eax, [esp + 0x30]
push 0x5f820c
push eax
call fcn.005e6246
lea eax, [esp + 0x38]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e16e3
lea ecx, [esp + 0x60]
sub eax, edx
push str.TallyShop.php
push ecx
mov ebx, eax
call fcn.005e6246
add esp, 8
push ebp
push 0x84200000
lea edx, [esp + 0x2c]
push edx
push ebp
push ebp
lea eax, [esp + 0x74]
push eax
push 0x602d94
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov ebp, eax
test ebp, ebp
je 0x4e17d2
push 0
push 0
push 0
push 0
push ebp
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x4e17cb
lea ecx, [esp + 0x14]
push ecx
push 0x3ff
lea edx, [esp + 0x68]
push edx
push ebp
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4e17cb
mov eax, dword [esp + 0x14]
push ebx
lea edx, [esp + 0x30]
lea ecx, [esp + 0x14]
lea esi, [esp + 0x64]
mov byte [esp + eax + 0x64], 0
call fcn.004e2330
mov eax, dword [esp + 0x14]
cmp eax, 0x80
jbe 0x4e17f1
xor edi, edi
test eax, 0xffffff80
jbe 0x4e17ad
jmp 0x4e1790
mov edx, dword [esp + 0x10]
mov ecx, esi
call fcn.0053682a
mov ecx, dword [esp + 0x14]
add esi, 0x80
inc edi
shr ecx, 7
cmp edi, ecx
jb 0x4e1790
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
call fcn.004dc6a0
mov esi, dword [esp + 0x20]
mov byte [esp + ebx + 0x60], 0
mov dword [esp + 0x18], 1
push ebp
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ebx, dword [esp + 0x18]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x450
ret
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x60]
call fcn.0053682a
jmp 0x4e17b1
Function at 0x4e28a0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
mov ecx, dword [eax + 0xb0]
test ecx, ecx
je 0x4e28cb
mov dword [eax + 0xb0], 0
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
push 0x7f
push 0x80
mov ecx, eax
call dword [edx + 0x28]
mov ecx, dword [esi + 0x14]
call fcn.0050af80
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x4e2911
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + 0x10]
call fcn.004ed940
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
call dword [edx + 8]
cmp eax, 1
jne 0x4e2906
push str.Migration_needs_exclusive_access_to_the_company...
push 3
push 0x64
call fcn.004edf50
add esp, 0xc
mov ecx, dword [esi + 0x14]
call fcn.0050aff0
inc dword [esi + 0x2c]
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x24], 0
pop esi
jmp fcn.005370a0

Function at 0x4e9f70
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x88
call fcn.005e6090
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e9fc1
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
push eax
mov eax, dword [esp + 0x10]
push str.Version
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4e9fcb
xor ax, ax
add esp, 0x88
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 8]
push edx
call fcn.005e64a5
add esp, 4
add esp, 0x88
ret

Function at 0x4ed780
Capabilities:
Get disk size

Disassembly:
sub esp, 0x18
mov al, byte [ecx]
push ebx
xor ebx, ebx
cmp al, bl
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov dword [esp + 0x10], ebx
je 0x4ed7db
mov dl, 0x3a
cmp byte [ecx + 1], dl
jne 0x4ed7db
mov ecx, dword [0x71d748]
movsx eax, al
mov al, byte [eax + ecx]
lea ecx, [esp + 0x10]
push ecx
mov byte [esp + 0x19], dl
lea edx, [esp + 8]
push edx
mov byte [esp + 0x1c], al
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
mov byte [esp + 0x26], 0x5c
mov byte [esp + 0x27], bl
push edx
jmp 0x4ed7f0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
cmp eax, ebx
pop ebx
jne 0x4ed805
or eax, 0xffffffff
or edx, 0xffffffff
add esp, 0x18
ret
mov eax, dword [esp]
imul eax, dword [esp + 4]
imul eax, dword [esp + 8]
xor edx, edx
add esp, 0x18
ret