joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48e530
Capabilities:
Log keystrokes
Log keystrokes via application hook
Log keystrokes via polling

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x48e5d0
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
test eax, eax
mov dword [0x4f8a38], eax
jne 0x48e55e
push str.Could_not_obtain_keyboard_hook_
call fcn.0048e810
add esp, 4
mov ecx, 0x80
xor eax, eax
mov edi, 0x608800
mov esi, 2
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push esi
call edi
shr eax, 0xf
and al, 1
mov byte [esi + 0x608800], al
inc esi
cmp esi, 0x100
jl 0x48e57a
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x14
call esi
and al, 1
push 0x91
mov byte [0x608a00], al
call esi
and al, 1
push 0x90
mov byte [0x608a02], al
call esi
and al, 1
pop edi
mov byte [0x608a01], al
pop esi
ret

Function at 0x48e810
Capabilities:
Check for time delay via queryperformancecounter
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov al, byte [0x4f8e20]
test al, al
jne 0x48e931
mov ecx, dword [ebp + 8]
push edi
push esi
lea eax, [ebp + 0xc]
push ebx
push eax
lea edx, [ebp - 0x208]
push ecx
push edx
mov byte [0x4f8e20], 1
call fcn.004b78f0
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push str.WIN:_Application_notified_error:__s
call fcn.0048fa80
mov al, byte [0x4d4bbc]
add esp, 8
cmp al, 5
jne 0x48e86b
xor cl, cl
call fcn.004963c0
call fcn.0049ed10
mov ecx, dword [0x4f8e1c]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push ecx
call esi
mov al, byte [0x4f88fc]
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
test al, al
je 0x48e8ae
lea edx, [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
div dword [0x4f8124]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x48e8b0
call ebx
mov edi, dword [0x4f8c80]
xor cl, cl
sub eax, edi
mov edi, eax
call fcn.004963c0
mov eax, dword [0x4f8e1c]
push 0
push eax
call esi
mov edx, dword [0x4f8e10]
lea ecx, [ebp - 0x208]
push ecx
push 0x491160
push 0
push 0x7b
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov al, byte [0x4f88fc]
test al, al
je 0x48e90f
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
div dword [0x4f8124]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x48e911
call ebx
mov edx, dword [0x4f8c80]
mov ecx, dword [0x4f8e30]
sub eax, edi
sub eax, edx
add ecx, eax
mov dword [0x4f8e30], ecx
call fcn.0048ebb0
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x493740
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
test eax, eax
push edi
mov ebp, eax
jne 0x493753
mov ebp, 0x4f8ec4
mov edx, dword [0x4f8e40]
test edx, edx
je 0x493795
mov esi, 0x4f8ec8
mov eax, ebp
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x493788
test cl, cl
je 0x493784
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x493788
add eax, 2
add esi, 2
test cl, cl
jne 0x493764
xor eax, eax
jmp 0x49378d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x493871
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov dword [reloc.WSOCK32.dll_accept], 0x80000001
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4f8ec8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test edx, edx
rep movsb byte es:[edi], byte [esi]
je 0x4937cc
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x13
push 0x4ca5d0
push ebp
call fcn.004b9620
add esp, 0xc
test eax, eax
jne 0x4937ed
mov dword [reloc.WSOCK32.dll_accept], 0x80000002
add ebp, 0x13
cmp byte [ebp], 0x5c
jne 0x493818
lea edi, [ebp + 1]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4f8548
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x49383f
mov eax, dword [0x4cd190]
mov ecx, dword [str.Jazz_Jackrabbit_2]
mov edx, dword [str.Epic_MegaGames]
push ebp
push eax
push ecx
push edx
push str.Software_s_s_s_s
push 0x4f8548
call fcn.004b77e0
add esp, 0x18
lea eax, [esp + 0x14]
mov ecx, dword [reloc.WSOCK32.dll_accept]
push eax
push 0x4f8e40
push 0
push 0xf003f
push 0
push 0x4f5908
push 0
push 0x4f8548
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [0x4f8e40]
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x49388c
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [reloc.WSOCK32.dll_accept]
push 0x4f8548
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
ret
Function at 0x4938b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov al, byte [0x4d3e1c]
push ebx
push ebp
push esi
test al, al
push edi
mov dword [esp + 0x10], 0xff
jne 0x4938d2
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x1c]
test eax, eax
mov ebp, eax
jne 0x4938e1
mov ebp, 0x4f8ec4
mov edx, dword [0x4f8e40]
test edx, edx
je 0x493923
mov esi, 0x4f8ec8
mov eax, ebp
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x493916
test cl, cl
je 0x493912
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x493916
add eax, 2
add esi, 2
test cl, cl
jne 0x4938f2
xor eax, eax
jmp 0x49391b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4939ff
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov dword [reloc.WSOCK32.dll_accept], 0x80000001
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4f8ec8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test edx, edx
rep movsb byte es:[edi], byte [esi]
je 0x49395a
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x13
push 0x4ca5d0
push ebp
call fcn.004b9620
add esp, 0xc
test eax, eax
jne 0x49397b
mov dword [reloc.WSOCK32.dll_accept], 0x80000002
add ebp, 0x13
cmp byte [ebp], 0x5c
jne 0x4939a6
lea edi, [ebp + 1]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4f8548
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4939cd
mov eax, dword [0x4cd190]
mov ecx, dword [str.Jazz_Jackrabbit_2]
mov edx, dword [str.Epic_MegaGames]
push ebp
push eax
push ecx
push edx
push str.Software_s_s_s_s
push 0x4f8548
call fcn.004b77e0
add esp, 0x18
lea eax, [esp + 0x14]
mov ecx, dword [reloc.WSOCK32.dll_accept]
push eax
push 0x4f8e40
push 0
push 0xf003f
push 0
push 0x4f5908
push 0
push 0x4f8548
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [0x4f8e40]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push 0x4f8d08
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x493a2a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x1c]
pop edi
dec eax
pop esi
neg eax
sbb eax, eax
pop ebp
not eax
and eax, 0x4f8d08
pop ebx
add esp, 8
ret
Function at 0x493a50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov al, byte [0x4d3e1c]
push ebx
push ebp
push esi
test al, al
push edi
mov dword [esp + 0x10], 4
je 0x493bce
mov eax, dword [esp + 0x20]
test eax, eax
mov ebp, eax
jne 0x493a7b
mov ebp, 0x4f8ec4
mov edx, dword [0x4f8e40]
test edx, edx
je 0x493abd
mov esi, 0x4f8ec8
mov eax, ebp
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x493ab0
test cl, cl
je 0x493aac
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x493ab0
add eax, 2
add esi, 2
test cl, cl
jne 0x493a8c
xor eax, eax
jmp 0x493ab5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x493b99
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov dword [reloc.WSOCK32.dll_accept], 0x80000001
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4f8ec8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test edx, edx
rep movsb byte es:[edi], byte [esi]
je 0x493af4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x13
push 0x4ca5d0
push ebp
call fcn.004b9620
add esp, 0xc
test eax, eax
jne 0x493b15
mov dword [reloc.WSOCK32.dll_accept], 0x80000002
add ebp, 0x13
cmp byte [ebp], 0x5c
jne 0x493b40
lea edi, [ebp + 1]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4f8548
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x493b67
mov eax, dword [0x4cd190]
mov ecx, dword [str.Jazz_Jackrabbit_2]
mov edx, dword [str.Epic_MegaGames]
push ebp
push eax
push ecx
push edx
push str.Software_s_s_s_s
push 0x4f8548
call fcn.004b77e0
add esp, 0x18
lea eax, [esp + 0x18]
mov ecx, dword [reloc.WSOCK32.dll_accept]
push eax
push 0x4f8e40
push 0
push 0xf003f
push 0
push 0x4f5908
push 0
push 0x4f8548
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [0x4f8e40]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
lea eax, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x2c]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x493bce
cmp dword [esp + 0x10], 4
jne 0x493bce
mov eax, dword [esp + 0x20]
cmp eax, 3
mov eax, dword [esp + 0x14]
je 0x493bd2
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x493be0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
test eax, eax
push edi
mov ebp, eax
jne 0x493bf3
mov ebp, 0x4f8ec4
mov ebx, dword [0x4f8e40]
test ebx, ebx
je 0x493c35
mov esi, 0x4f8ec8
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x493c28
test cl, cl
je 0x493c24
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x493c28
add eax, 2
add esi, 2
test cl, cl
jne 0x493c04
xor eax, eax
jmp 0x493c2d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x493d11
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov dword [reloc.WSOCK32.dll_accept], 0x80000001
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4f8ec8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test ebx, ebx
rep movsb byte es:[edi], byte [esi]
je 0x493c6c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x13
push 0x4ca5d0
push ebp
call fcn.004b9620
add esp, 0xc
test eax, eax
jne 0x493c8d
mov dword [reloc.WSOCK32.dll_accept], 0x80000002
add ebp, 0x13
cmp byte [ebp], 0x5c
jne 0x493cb8
lea edi, [ebp + 1]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4f8548
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x493cdf
mov eax, dword [0x4cd190]
mov ecx, dword [str.Jazz_Jackrabbit_2]
mov edx, dword [str.Epic_MegaGames]
push ebp
push eax
push ecx
push edx
push str.Software_s_s_s_s
push 0x4f8548
call fcn.004b77e0
add esp, 0x18
lea eax, [esp + 0x14]
mov ecx, dword [reloc.WSOCK32.dll_accept]
push eax
push 0x4f8e40
push 0
push 0xf003f
push 0
push 0x4f5908
push 0
push 0x4f8548
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, dword [0x4f8e40]
mov edx, dword [esp + 0x1c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x20]
push 1
push eax
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x493d40
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
test eax, eax
push edi
mov ebp, eax
jne 0x493d53
mov ebp, 0x4f8ec4
mov edx, dword [0x4f8e40]
test edx, edx
je 0x493d95
mov esi, 0x4f8ec8
mov eax, ebp
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x493d88
test cl, cl
je 0x493d84
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x493d88
add eax, 2
add esi, 2
test cl, cl
jne 0x493d64
xor eax, eax
jmp 0x493d8d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x493e71
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov dword [reloc.WSOCK32.dll_accept], 0x80000001
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4f8ec8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test edx, edx
rep movsb byte es:[edi], byte [esi]
je 0x493dcc
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x13
push 0x4ca5d0
push ebp
call fcn.004b9620
add esp, 0xc
test eax, eax
jne 0x493ded
mov dword [reloc.WSOCK32.dll_accept], 0x80000002
add ebp, 0x13
cmp byte [ebp], 0x5c
jne 0x493e18
lea edi, [ebp + 1]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4f8548
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x493e3f
mov eax, dword [0x4cd190]
mov ecx, dword [str.Jazz_Jackrabbit_2]
mov edx, dword [str.Epic_MegaGames]
push ebp
push eax
push ecx
push edx
push str.Software_s_s_s_s
push 0x4f8548
call fcn.004b77e0
add esp, 0x18
lea eax, [esp + 0x14]
mov ecx, dword [reloc.WSOCK32.dll_accept]
push eax
push 0x4f8e40
push 0
push 0xf003f
push 0
push 0x4f5908
push 0
push 0x4f8548
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [0x4f8e40]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push 4
push eax
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x493f60
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov al, byte [0x4f88fc]
push ebx
push esi
push edi
test al, al
je 0x493f90
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
div dword [0x4f8124]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x493f96
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, dword [0x4f8c80]
mov cl, byte [0x4d4bbc]
sub eax, edx
xor ebx, ebx
cmp cl, 5
mov edi, eax
sete bl
test bl, bl
je 0x493fb9
xor cl, cl
call fcn.00496af0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [0x4f8e1c]
push 0
push ecx
mov ecx, dword [0x4f8e10]
and eax, 0xffff
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test bl, bl
mov esi, eax
je 0x493fe7
call fcn.00496e20
mov al, byte [0x4f88fc]
test al, al
je 0x49400e
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
div dword [0x4f8124]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
jmp 0x494014
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, dword [0x4f8c80]
mov ecx, dword [0x4f8e30]
sub eax, edi
pop edi
sub eax, edx
add ecx, eax
mov eax, esi
pop esi
mov dword [0x4f8e30], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x494040
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov al, byte [0x4f88fc]
push ebx
push esi
push edi
test al, al
je 0x494070
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
div dword [0x4f8124]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x494076
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, dword [0x4f8c80]
mov cl, byte [0x4d4bbc]
sub eax, edx
xor ebx, ebx
cmp cl, 5
mov edi, eax
sete bl
test bl, bl
je 0x494099
xor cl, cl
call fcn.00496af0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [0x4f8e1c]
push ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [0x4f8e10]
and ecx, 0xffff
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test bl, bl
mov esi, eax
je 0x4940c9
call fcn.00496e20
mov al, byte [0x4f88fc]
test al, al
je 0x4940f0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
div dword [0x4f8124]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4940f6
call dword [sym.imp.WINMM.dll_timeGetTime]
mov edx, dword [0x4f8c80]
mov ecx, dword [0x4f8e30]
sub eax, edi
pop edi
sub eax, edx
add ecx, eax
mov eax, esi
pop esi
mov dword [0x4f8e30], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x496830
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4f9b48]
sub esp, 0x38
test eax, eax
push ebp
push esi
push edi
je 0x49684d
push 0
call eax
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0x38
ret
mov al, byte [0x4f9afd]
cmp al, 1
je 0x4968bf
mov cl, byte [0x4f9b1c]
test cl, cl
jne 0x4968bf
test al, al
jne 0x496a80
mov al, byte [0x4d4bbc]
mov ecx, 0xe
mov esi, 0x4f9ae0
lea edi, [esp + 0xc]
cmp al, 4
rep movsd dword es:[edi], dword [esi]
jne 0x496888
mov byte [esp + 0x28], 2
jmp 0x496891
cmp al, 5
jne 0x496891
mov byte [esp + 0x28], 1
mov eax, dword [0x4f9b40]
test eax, eax
je 0x4968ab
lea ecx, [esp + 0xc]
push ecx
call eax
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0x38
ret
lea edx, [esp + 0xc]
push edx
call fcn.00495680
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0x38
ret
or dword [0x4f9b54], 1
call fcn.0048ea90
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.USER32.dll_SetWindowLongA]
mov ebp, eax
mov eax, dword [0x4f9ba4]
test eax, eax
mov byte [0x4f8e84], 1
je 0x496989
cmp byte [0x4d4bbc], 5
jne 0x496989
mov eax, dword [0x4f8e1c]
push 0
push eax
call esi
mov ecx, dword [0x4f8e1c]
push 0x300
push 0xffffffffffffffec
push ecx
call edi
mov eax, dword [0x4f9ba4]
mov ecx, dword [0x4f8e1c]
push 8
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x50]
test eax, eax
je 0x49697e
mov cl, byte [0x4f9b18]
test cl, cl
jne 0x49697e
xor edx, edx
mov ecx, 0x4d50a0
cmp dword [ecx], eax
je 0x49694d
add ecx, 8
inc edx
cmp ecx, str.X_Alignment_error
jb 0x49693d
cmp edx, 0x60
jne 0x496971
push eax
push str.Unknown_DirectDraw_error_code__08X
push 0x4f95d8
call fcn.004b77e0
add esp, 0xc
mov dword [0x4f9b60], 0x4f95d8
jmp 0x49697e
mov edx, dword [edx*8 + 0x4d50a4]
mov dword [0x4f9b60], edx
mov eax, dword [0x4f9ba4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov edx, dword [0x4f8e1c]
push 2
push edx
call esi
mov al, byte [0x6086d4]
mov ecx, dword [0x4f9b54]
mov byte [0x4f9b68], al
mov al, byte [0x6086d4]
and ecx, 0xfffffffe
test al, al
mov dword [0x4f9b54], ecx
je 0x4969bb
call fcn.0049a3f0
push 1
push 0
push 0
push 0xfff0
push 0xf120
push 0x112
call fcn.0048f940
mov ecx, dword [0x4f9b54]
mov al, byte [0x4d4bbc]
add esp, 0x18
or ecx, 2
cmp al, 5
mov dword [0x4f9b54], ecx
jne 0x496a08
mov ecx, dword [0x4f8e1c]
push 8
push 0xffffffffffffffec
push ecx
call edi
mov edx, dword [0x4f8e1c]
push 9
push edx
call esi
push 1
call fcn.004972a0
mov al, byte [0x4f9b68]
add esp, 4
test al, al
je 0x496a20
call fcn.00499990
mov al, byte [0x4f9b30]
test al, al
je 0x496a55
mov eax, dword [0x4f8e1c]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_SetSystemPaletteUse]
mov esi, eax
push 2
push esi
call edi
push 1
push esi
call edi
mov ecx, dword [0x4f8e1c]
push esi
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov esi, dword [0x4f9b54]
mov byte [0x4f8e84], 0
and esi, 0xfffffffd
mov dword [0x4f9b54], esi
call fcn.0048ea90
mov ecx, dword [0x4f8e30]
sub eax, ebp
add ecx, eax
mov dword [0x4f8e30], ecx
pop edi
pop esi
pop ebp
add esp, 0x38
ret
Function at 0x49a640
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
test esi, esi
je 0x49a704
mov al, byte [esi + 4]
mov bl, 1
cmp al, bl
jne 0x49a704
mov al, byte [esi + 6]
test al, al
jne 0x49a704
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x49a675
mov al, bl
pop edi
pop esi
pop ebx
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x10c]
lea eax, [esp + 0x10]
push 0
push eax
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49a69f
cmp dword [esp + 0x10], edi
jne 0x49a69f
mov al, bl
pop edi
pop esi
pop ebx
ret
mov al, byte [esi + 5]
test al, al
je 0x49a6af
mov byte [esi + 6], bl
xor al, al
pop edi
pop esi
pop ebx
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
jne 0x49a6c8
cmp dword [esp + 0x10], edi
je 0x49a6c8
push str.Unable_to_write_all_bytes
jmp 0x49a6ee
push 0
push 0x1fe
push 0x4fb7b8
push 0x400
call ebx
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x4fb7b8
add esi, 7
push esi
push str.fileWrite
push str.Fatal_Error_in__s_on_file___s___error:__s
call fcn.0048e810
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x49a710
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
test esi, esi
je 0x49a7d3
mov al, byte [esi + 4]
test al, al
jne 0x49a7d3
mov al, byte [esi + 6]
test al, al
jne 0x49a7d3
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x49a743
mov al, 1
pop edi
pop esi
pop ebx
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x10c]
lea eax, [esp + 0x10]
push 0
push eax
push edi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49a76d
cmp dword [esp + 0x10], edi
jne 0x49a76d
mov al, 1
pop edi
pop esi
pop ebx
ret
mov al, byte [esi + 5]
test al, al
je 0x49a77e
mov byte [esi + 6], 1
xor al, al
pop edi
pop esi
pop ebx
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
jne 0x49a797
cmp dword [esp + 0x10], edi
je 0x49a797
push str.Input_past_end_of_file
jmp 0x49a7bd
push 0
push 0x1fe
push 0x4fb7b8
push 0x400
call ebx
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x4fb7b8
add esi, 7
push esi
push str.fileRead
push str.Fatal_Error_in__s_on_file___s___error:__s
call fcn.0048e810
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x49a910
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x49a923
xor al, al
ret
not al
shr al, 4
and al, 1
ret
Function at 0x49b530
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
je 0x49b670
cmp byte [ebx + 0xc], 5
jae 0x49b670
mov edx, dword [ebx]
xor eax, eax
cmp edx, 0x4b434f53
sete al
test al, al
je 0x49b670
mov al, byte [ebx + 0xd]
test al, al
je 0x49b590
mov dword [0x4ffaf4], 0x17
xor ecx, ecx
mov eax, 0x4d6508
cmp byte [eax], 0x17
je 0x49b693
add eax, 8
inc ecx
cmp eax, 0x4d6520
jb 0x49b577
jmp 0x49b6a0
mov edi, dword [esp + 0x1c]
test edi, edi
jle 0x49b669
mov ebp, dword [esp + 0x18]
mov eax, dword [ebx + 8]
push 0
push edi
push ebp
push eax
call sub.WSOCK32.dll_send
mov esi, eax
cmp esi, edi
je 0x49b669
cmp esi, 0xffffffff
jne 0x49b5db
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x49b5d6
mov al, byte [esp + 0x20]
test al, al
je 0x49b6b9
jmp 0x49b5df
cmp esi, 0xffffffff
je 0x49b5ea
add ebp, esi
sub edi, esi
test edi, edi
jg 0x49b5a0
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
ret
call sub.WSOCK32.dll_WSAGetLastError
mov esi, eax
xor edx, edx
mov ecx, 0x4d6394
cmp dword [ecx], esi
je 0x49b60a
add ecx, 0xc
inc edx
cmp ecx, 0x4d6508
jb 0x49b5f8
jmp 0x49b636
lea ecx, [edx + edx*2]
xor eax, eax
shl ecx, 2
mov al, byte [ecx + 0x4d6391]
mov dword [0x4ffaf4], eax
mov eax, dword [ecx + 0x4d6398]
mov dword [0x4ffaf0], eax
mov al, byte [ecx + 0x4d6390]
test al, al
je 0x49b636
mov byte [ebx + 0xd], 1
cmp edx, 0x1f
jne 0x49b6b9
push esi
push str.Unknown_Error__u
push 0x4fba50
call fcn.004b77e0
add esp, 0xc
mov dword [0x4ffaf4], 1
mov dword [0x4ffaf0], 0x4fba50
xor al, al
pop edi
pop esi
pop ebp
pop ebx
ret
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [0x4ffaf4], 0x16
xor ecx, ecx
mov eax, 0x4d6508
cmp byte [eax], 0x16
je 0x49b693
add eax, 8
inc ecx
cmp eax, 0x4d6520
jb 0x49b681
jmp 0x49b6a0
mov ecx, dword [ecx*8 + 0x4d650c]
mov dword [0x4ffaf0], ecx
mov edx, dword [0x4ffaf0]
push edx
push str.netWrite
push str.NET:__s_failed:__s
call fcn.0048fa80
add esp, 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret