joyce8/EMBER2024-capa huggingface dataset:
Function at 0x540c40
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x38
mov dword [ebp - 8], 0
mov dword [0x5f12dc], 0x2ca5
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x10]
add ecx, 0x3c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [0x5f12dc], 0x261f
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x540cf3
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [0x5f12dc], 0x6eb
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0x104
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], ecx
jl 0x540c8a
jmp 0x540cf3
mov dword [0x5f12e0], 0x681
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x14], 0x64
sete dl
mov byte [ebp - 0x29], dl
mov al, byte [ebp - 0x29]
test al, 1
jne 0x540d54
jmp 0x540dc0
mov eax, dword [ebp - 0x20]
mov dword [0x5f12e0], 0x6af
mov ecx, dword [ebp - 0x14]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x28], eax
jne 0x540dc0
mov dword [0x5f12dc], 0x1f57
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x540dc0
mov eax, dword [0x5f12e0]
add eax, 0xffffec0d
mov dword [0x5f12dc], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x540cca
jmp 0x540dc0
mov dword [0x5f12dc], 0x17cf
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff7
shl eax, 1
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp word [eax], 0x64
jne 0x540dc0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x10], 0x6c
sete dl
mov byte [ebp - 0x31], dl
mov al, byte [ebp - 0x31]
test al, 1
jne 0x540d97
jmp 0x540dc0
mov eax, 0x5b7
mov ecx, 1
mov dword [0x5f12dc], 0x23a3
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x28]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
je 0x540dcf
mov eax, 0x1567
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
jmp 0x540dcf
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov dword [0x5f12dc], ecx
add esp, 0x38
pop esi
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x8793c0
xchg ebx, eax
xchg dword [eax], eax
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xeb
jp 0x40109d
mov byte [eax - 0x47], dh
jg 0x401033
in al, 0xd4
jmp 0x4010af
test eax, 0xcf33638c
adc ch, bl
js 0x400fd0
sbb ch, ah
daa
stosd dword es:[edi], eax
mov dword [0x540fb128], eax
xchg edi, eax
inc ecx
and dword [esi + esi*8 - 0x78], ebp
rcr byte [eax - 0x2e], 0xa4
sti
push ss
scasd eax, dword es:[edi]
jne 0x40108b
jl 0x40102c
salc
pushal
jbe 0x401085
daa
xchg esp, eax
lcall 0xa4e8, 0x1020bb2d
push eax
in eax, dx
xor bl, ah
sti
bnd jg 0x401002
popal
lea ebp, [edx - 0x70bb56c6]
push ds
pop ss
cmp dword [eax + ebx*8 + 0x46], eax
and byte [eax - 0x702274c0], al
pop eax
test al, 0xc5
fisttp qword [edi + 0x3dc5a858]
lahf
mov ah, 0xc2
sub ecx, dword [0x6e1df55c]
cmp eax, 0x2bc2b49f
or eax, 0x6e1df55c
pop esp
cmc
sbb eax, 0x97530b6e
or edx, dword [ebx - 0x69]
in al, 0x34
sub dword [ebx], esp
jge 0x401055
ja 0x4010fe
fld xword [esi - 7]
or al, 0xb7
dec edx
mov ch, 0xfc
outsd dx, dword [esi]
jns 0x4010cd
fcom qword [eax - 0x69d98623]
retf 0x41f8
and ecx, eax
hlt
int1
push 0xffffffffffffffb7
dec edx
mul dword [esi - 0x69]
invalid
push edx
inc edi
aas
int1
lds esi, [eax - 0x386d9885]
out 0xf1, eax
xchg edx, eax
cmp al, 0x61
sahf
jmp 0xb6298785
Function at 0xdae370
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00dae4c0
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xdae396
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdae382
add dl, dl
jne 0xdae3a1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdae3f4
xor eax, eax
add dl, dl
jne 0xdae3ae
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdae495
add dl, dl
jne 0xdae3bd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdae3c8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdae3d3
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdae3de
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xdae3ea
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xdae38d
mov eax, 1
add dl, dl
jne 0xdae402
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdae40d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdae3f9
sub eax, ebx
mov ebx, 1
jne 0xdae440
mov ecx, 1
add dl, dl
jne 0xdae426
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdae431
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdae41d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdae38d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xdae457
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdae462
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdae44e
cmp eax, 0x7d00
jae 0xdae485
cmp eax, 0x500
jb 0xdae480
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdae38d
cmp eax, 0x7f
ja 0xdae488
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdae38d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xdae4b6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xdae38d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42af20
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x3f0
push esi
mov esi, ecx
call fcn.004e2760
test eax, eax
je 0x42b137
mov eax, dword [esi + 0x1914]
push ebx
xor ebx, ebx
push ebp
xor ebp, ebp
cmp eax, ebx
push edi
mov dword [esi + 0x1918], 2
mov dword [esi + 0x1a34], ebx
mov dword [esi + 0x1c58], ebx
mov dword [esi + 0x1c5c], ebx
mov dword [esi + 0x1a28], ebx
mov dword [esi + 0x1a2c], ebx
mov dword [esi + 0x1a30], ebx
jne 0x42af92
push esi
push ebx
push ebx
mov edx, 4
mov ecx, str.Channels_List
call fcn.00548f10
mov dword [esi + 0x1914], eax
mov ebp, 1
mov ecx, dword [esi + 0x1914]
call fcn.00542c90
mov edi, eax
cmp edi, ebx
je 0x42b134
mov eax, dword [edi + 0x874]
push ebx
push ebx
push 0x184
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [edi + 0x6cc]
call fcn.004c8280
lea ecx, [edi + 0x6b8]
mov dword [esp + 0x10], ecx
call fcn.004c8280
cmp ebp, ebx
je 0x42afe5
mov ecx, dword [edi]
mov edx, 4
call fcn.004973e0
mov ecx, dword [edi]
push ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x42afff
mov edx, dword [edi]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x42b00c
mov ecx, edi
mov dword [edi + 0x710], ebx
call fcn.00527d80
xor edx, edx
mov ecx, 0xdd0
call fcn.0041d620
push eax
mov eax, dword [edi]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edx, dword [0x5a5504]
mov ecx, dword [esi]
call fcn.00502b10
mov ecx, dword [0x5a550c]
push ecx
xor edx, edx
mov ecx, 0xdd1
call fcn.0041d620
mov ecx, dword [esi]
mov edx, eax
call fcn.00502c40
mov edx, dword [0x5a5504]
mov ecx, dword [esi]
call fcn.00502b10
cmp dword [esi + 0x1920], ebx
je 0x42b134
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esi + 0x1924]
push edx
push 0x5a3900
lea eax, [esp + 0x20]
push 0x583954
push eax
call edi
add esp, 0x10
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x191c], eax
je 0x42b134
push ebx
call fcn.00570bc6
add esp, 4
mov ecx, eax
call fcn.0052d0c0
push eax
lea edx, [esi + 0x1124]
push edx
lea eax, [esp + 0x20]
push 0x584610
push eax
call edi
mov edi, dword [esp + 0x20]
mov ecx, dword [edi]
add esp, 0x10
push ebx
lea edx, [esp + 0x1c]
call fcn.004c7e10
mov dword [edi], eax
lea edi, [esp + 0x18]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x42b0f0
mov cx, word [0x583b70]
mov dl, byte [0x583b72]
mov word [edi], cx
lea eax, [esp + 0x18]
mov byte [edi + 2], dl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x42b112
push ebx
sub eax, edx
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [esi + 0x191c]
lea edx, [esp + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x3f0
ret
Function at 0x4795f0
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ebx, edx
mov edi, esi
mov dword [esp + 0x14], ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x479604
mov eax, 0x59b9f8
sub edi, ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x479615
sub eax, edx
test ebx, ebx
mov ebp, eax
mov dword [esp + 0x10], 0
je 0x4796a7
test edi, edi
jle 0x4796a7
mov ecx, esi
call fcn.00479120
mov ecx, esi
call fcn.00479160
movzx ecx, byte [edi + esi - 1]
dec edi
sub ecx, 0x78
test ecx, ecx
jle 0x47964d
sub edi, ecx
movzx eax, byte [edi + esi - 1]
dec edi
sub eax, 0x6e
dec edi
mov dword [esp + 0x10], eax
movzx eax, byte [edi + esi]
sub eax, 0x64
add eax, ecx
cmp eax, ebp
mov byte [edi + esi], 0
jle 0x47966e
sub eax, ebp
mov edi, esi
lea edx, [edi + 1]
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x479673
sub edi, edx
test eax, eax
jl 0x479744
cmp eax, ebp
jg 0x479744
xor ecx, ecx
test edi, edi
jle 0x4796a7
mov dl, byte [eax + 0x59b9f8]
sub byte [ecx + esi], dl
inc eax
cmp eax, ebp
jl 0x4796a2
xor eax, eax
inc ecx
cmp ecx, edi
jl 0x479692
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4796b0
sub eax, edx
lea ecx, [eax - 1]
test ecx, ecx
jle 0x4796db
dec ecx
shr ecx, 1
lea eax, [esi + 1]
inc ecx
mov dl, byte [eax - 1]
mov bl, byte [eax]
mov byte [eax - 1], bl
mov byte [eax], dl
add eax, 2
dec ecx
jne 0x4796c7
mov ebx, dword [esp + 0x14]
mov ecx, esi
call fcn.00479160
xor eax, eax
xor ecx, ecx
test edi, edi
jle 0x479705
lea ebx, [ebx]
mov dl, byte [eax + 0x59b9f8]
sub byte [ecx + esi], dl
inc eax
cmp eax, ebp
jl 0x479700
xor eax, eax
inc ecx
cmp ecx, edi
jl 0x4796f0
test ebx, ebx
je 0x479779
xor ecx, ecx
xor ebx, ebx
test edi, edi
jle 0x479730
movzx eax, byte [ebx + esi]
add ecx, eax
cmp ecx, 0x1e
jl 0x47972b
mov eax, 0x88888889
mul ecx
shr edx, 4
imul edx, edx, 0xffffffe2
add ecx, edx
inc ebx
cmp ebx, edi
jl 0x479711
cmp ecx, dword [esp + 0x10]
je 0x479779
cmp dword [esp + 0x14], 1
jne 0x479768
push 0
call fcn.00573096
cmp ebx, 1
jne 0x479750
push 0
call fcn.00573096
mov eax, dword [str.None]
mov dword [esi], eax
mov cl, byte [0x586a94]
pop edi
mov byte [esi + 4], cl
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ecx, dword [str.None]
mov dword [esi], ecx
mov dl, byte [0x586a94]
mov byte [esi + 4], dl
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x486660
Capabilities:
Connect socket

Disassembly:
mov eax, dword [0x5a7cb8]
sub esp, 0x10
cmp ecx, eax
jne 0x486673
shr edx, 0x10
test edx, edx
je 0x48668c
mov ecx, 0x9c7
xor edx, edx
call fcn.0041d620
mov ecx, eax
call fcn.004865a0
add esp, 0x10
ret 4
mov dx, word [0x59bcfc]
mov cx, word [0x59bcf8]
push 0
push 0
push 2
push 0
mov dword [0x5a7cb8], 0
call fcn.005049f0
cmp eax, 0xffffffff
mov dword [0x59ba28], eax
jne 0x4866d4
mov ecx, 0x9c8
xor edx, edx
call fcn.0041d620
mov ecx, eax
call fcn.004865a0
add esp, 0x10
ret 4
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
push 0x4f
mov dword [esp + 0x10], eax
mov word [esp + 4], 2
call dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 2], ax
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
jne 0x48670d
mov ecx, dword [0x5a7ccc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [0x5b4314]
mov edx, dword [0x59ba28]
push 0x10
push 0x8023
push ecx
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
mov ecx, dword [0x59ba28]
push 0x10
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
je 0x486764
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x486764
mov ecx, 0x9c9
xor edx, edx
call fcn.0041d620
mov ecx, eax
call fcn.004865a0
add esp, 0x10
ret 4

Function at 0x486770
Capabilities:
Send data
Send data on socket

Disassembly:
shr ecx, 0x10
sub esp, 0x104
test ecx, ecx
je 0x486787
mov ecx, 0x9c9
jmp 0x4868b1
mov al, byte [0x5a7be8]
push esi
xor edx, edx
test al, al
push 0x5a7c50
je 0x4867da
push 0x5a7be8
mov ecx, 0x9ca
call fcn.0041d620
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0x10]
push eax
call esi
mov ecx, dword [0x5a5508]
add esp, 0x10
push ecx
mov ecx, dword [0x5b432c]
lea edx, [esp + 8]
call fcn.00502c40
push 0x5a7be8
push 0x584748
jmp 0x486815
mov ecx, 0x9cb
call fcn.0041d620
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0xc]
push eax
call esi
mov ecx, dword [0x5a5508]
add esp, 0xc
push ecx
mov ecx, dword [0x5b432c]
lea edx, [esp + 8]
call fcn.00502c40
push 0x5a7c50
push str.__s_n
lea edx, [esp + 0xc]
push edx
call esi
mov edx, dword [0x5a5504]
mov ecx, dword [0x5b432c]
add esp, 0xc
call fcn.00502b10
mov edx, 0x64
mov ecx, 0x5a7be8
call fcn.0041ef30
mov edx, 0x64
mov ecx, 0x5a7c50
call fcn.0041ef30
mov edx, 0x3e7
mov ecx, 0x5a80c0
call fcn.0041ef30
mov eax, dword [0x5b4314]
mov ecx, dword [0x59ba28]
push 0x21
push 0x8024
push eax
push ecx
mov dword [0x5a84a8], 0
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
lea eax, [esp + 4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x486888
sub eax, edx
push 0
mov esi, eax
mov eax, dword [0x59ba28]
push esi
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, esi
pop esi
je 0x4868bf
mov ecx, 0x9cc
xor edx, edx
call fcn.0041d620
mov ecx, eax
call fcn.004865a0
add esp, 0x104
ret
Function at 0x4c76e0
Capabilities:
Delete registry key

Disassembly:
push ecx
mov edx, 0x5a07e0
mov ecx, str.date
call fcn.004c7340
test eax, eax
je 0x4c781c
mov edx, 2
mov ecx, 0x5a07e0
call fcn.004795f0
mov edx, 0x5a07e0
mov ecx, str.DateUsed
call fcn.004c72d0
lea eax, [esp]
push eax
push 0x589038
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4c774a
mov ecx, dword [esp]
push str.date
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x5a07e0
mov ecx, str.name
call fcn.004c7340
test eax, eax
je 0x4c77c4
mov edx, 0x5a0bc8
mov ecx, str.code
call fcn.004c7340
test eax, eax
je 0x4c77b0
mov edx, 2
mov ecx, 0x5a0bc8
call fcn.004795f0
mov edx, 0x5a0bc8
mov ecx, 0x5a07e0
call fcn.004c7600
test eax, eax
je 0x4c77b0
mov edx, 0x5a07e0
mov ecx, str.UserName
call fcn.004c72d0
mov edx, 0x5a0bc8
mov ecx, str.License
call fcn.004c72d0
mov ecx, str.name
call fcn.004c73b0
mov ecx, str.code
call fcn.004c73b0
mov edx, 0x5a07e0
mov ecx, str.lock
call fcn.004c7340
test eax, eax
je 0x4c77f0
mov edx, 0x5a07e0
mov ecx, str.LockOptions
call fcn.004c72d0
mov ecx, str.lock
call fcn.004c73b0
mov edx, 0x5a07e0
mov ecx, str.channels
call fcn.004c7340
test eax, eax
je 0x4c781c
mov ecx, str.channels
call fcn.004c73b0
mov edx, 0x5a07e0
mov ecx, str.Channels
call fcn.004c72d0
pop ecx
ret

Function at 0x4c79b0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x5a9e18]
mov ecx, dword [0x5a9e14]
push eax
push ecx
push str._ld__ld
push 0x5a07e0
mov dword [0x5a9e0c], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, 0x5a07e0
mov ecx, str.LastRun
jmp fcn.004c72d0
Function at 0x4ca420
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x5a9e28]
mov ecx, dword [0x5a9e24]
push ebx
push eax
push ecx
push str._lu__d
push 0x5a0bc8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, 0x5a0bc8
mov ecx, str.LockOptions
call fcn.004c72d0
mov ebx, dword [0x5a9e2c]
test ebx, ebx
mov byte [0x5a0bc8], 0
je 0x4ca4f2
push ebp
mov bp, word [0x583ea0]
push esi
push edi
nop
mov eax, 0x5a0bc8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ca478
sub eax, edx
mov edx, eax
mov eax, dword [ebx]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ca488
sub eax, esi
add eax, edx
cmp eax, 0x3b5
ja 0x4ca4ef
mov al, byte [0x5a0bc8]
test al, al
je 0x4ca4bb
mov edi, 0x5a0bc8
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4ca4b0
mov word [edi], bp
mov eax, dword [ebx]
mov edx, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ca4c0
mov edi, 0x5a0bc8
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4ca4d0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x4ca470
pop edi
pop esi
pop ebp
mov edx, 0x5a0bc8
mov ecx, str.Channels
pop ebx
jmp fcn.004c72d0
Function at 0x4e6650
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.00542c90
mov esi, eax
xor ebp, ebp
cmp esi, ebp
je 0x4e6857
cmp dword [esi + 0x708], 1
jne 0x4e6857
push ebp
push 0x469c40
mov edx, 0x28a
mov ecx, edi
call fcn.004675d0
mov ebx, eax
cmp ebx, ebp
jle 0x4e6852
mov ecx, esi
call fcn.00542ed0
test eax, eax
je 0x4e6852
test bl, 0x40
je 0x4e66b6
mov dword [0x5ab734], ebp
mov dword [0x5ab738], ebp
mov dword [0x5ab73c], ebp
test bl, 0x20
je 0x4e66f6
push 0x5a98a0
push ebp
lea edx, [esi + 8]
mov ecx, str.nicklist
call fcn.004b1bc0
mov eax, dword [0x5ab734]
mov dword [esi + 0x740], eax
mov ecx, dword [0x5ab738]
mov dword [esi + 0x728], ecx
mov edx, dword [0x5ab73c]
mov dword [esi + 0x774], edx
jmp 0x4e6828
test bl, 1
je 0x4e6703
mov dword [esi + 0x740], ebp
jmp 0x4e6730
test bl, 2
je 0x4e6714
mov dword [esi + 0x740], 1
jmp 0x4e6730
test bl, 4
je 0x4e6725
mov dword [esi + 0x740], 2
jmp 0x4e6730
mov eax, dword [0x5ab734]
mov dword [esi + 0x740], eax
test bl, bl
jns 0x4e6740
mov dword [esi + 0x774], 1
jmp 0x4e6746
mov dword [esi + 0x774], ebp
test bl, 0x10
je 0x4e6786
push 0x5a98a0
push ebp
lea edx, [esi + 8]
mov ecx, str.nicklist
call fcn.004b1bc0
mov ecx, dword [esi + 0x740]
mov dword [0x5ab734], ecx
mov edx, dword [esi + 0x728]
mov dword [0x5ab738], edx
mov eax, dword [esi + 0x774]
mov dword [0x5ab73c], eax
jmp 0x4e6823
mov eax, dword [esi + 0x740]
cmp eax, ebp
jne 0x4e67ac
mov ecx, dword [str.right]
mov dx, word [0x5863a8]
mov dword [0x5aa640], ecx
mov word [0x5aa644], dx
jmp 0x4e67d3
cmp eax, 1
jne 0x4e67c9
mov eax, dword [str.left]
mov cl, byte [0x586324]
mov dword [0x5aa640], eax
mov byte [0x5aa644], cl
jmp 0x4e67d3
mov dword [0x5aa640], 0x66666f
mov eax, 0x5aa640
lea edx, [eax + 1]
jmp 0x4e67e0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4e67e0
mov ecx, dword [esi + 0x728]
sub eax, edx
mov edx, dword [esi + 0x774]
push edx
push ecx
lea edx, [eax + 0x5aa640]
push str.__d__d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x5a98a0
push 0x5aa640
lea edx, [esi + 8]
mov ecx, str.nicklist
call fcn.004b1bc0
call fcn.004b5990
mov esi, dword [0x5b430c]
cmp esi, ebp
je 0x4e6852
mov edi, 1
cmp dword [esi + 0x708], edi
jne 0x4e6848
xor edx, edx
mov ecx, esi
call fcn.004e6300
mov esi, dword [esi + 0xd9c]
cmp esi, ebp
jne 0x4e6837
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor ecx, ecx
pop ebx
jmp fcn.0041d520

Function at 0x4e8730
Capabilities:
Capture screenshot
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov edi, ecx
call fcn.004e27f0
mov esi, eax
xor ecx, ecx
test esi, esi
jne 0x4e8748
pop edi
pop esi
jmp fcn.0041d520
call fcn.00531cf0
mov eax, dword [0x5b4328]
test eax, eax
jne 0x4e8773
push esi
push 0
push 0
mov edx, 7
mov ecx, str.Notify_List
call fcn.00548f10
test eax, eax
mov dword [0x5b4328], eax
je 0x4e878b
call fcn.004e7820
test edi, edi
je 0x4e878b
mov ecx, dword [0x5b4328]
pop edi
xor edx, edx
pop esi
jmp fcn.004973e0
pop edi
pop esi
ret
Function at 0x4e8790
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x3f4
push ebp
mov ebp, ecx
call fcn.004e2760
test eax, eax
je 0x4e88cc
push ebx
mov ecx, ebp
call fcn.004e6ab0
xor ebx, ebx
push ebx
lea eax, [esp + 0xc]
push 0x583f60
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x5a98a0
push 0x3e7
lea ecx, [esp + 0x1c]
push ecx
push 0x583b74
lea edx, [esp + 0x18]
mov ecx, str.Notify
call fcn.004b1f10
mov al, byte [esp + 0x14]
test al, al
je 0x4e88ba
push esi
push edi
lea edx, [esp + 0x1c]
push str.WAVE2:
push edx
call fcn.00570b40
mov edi, eax
add esp, 8
test edi, edi
je 0x4e881b
mov byte [edi], 0
mov al, byte [edi + 6]
add edi, 6
test al, al
jne 0x4e881b
xor edi, edi
lea eax, [esp + 0x1c]
push str.WAVE:
push eax
call fcn.00570b40
mov esi, eax
add esp, 8
test esi, esi
je 0x4e8842
mov byte [esi], 0
mov al, byte [esi + 5]
add esi, 5
test al, al
jne 0x4e8842
xor esi, esi
lea ecx, [esp + 0x1c]
push str.NOTE:
push ecx
call fcn.00570b40
add esp, 8
test eax, eax
je 0x4e8867
mov byte [eax], 0
mov cl, byte [eax + 5]
add eax, 5
test cl, cl
jne 0x4e8867
xor eax, eax
push ebp
push edi
push esi
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.004e7c60
inc ebx
push ebx
lea edx, [esp + 0x14]
push 0x583f60
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x5a98a0
push 0x3e7
lea eax, [esp + 0x24]
push eax
push 0x583b74
lea edx, [esp + 0x20]
mov ecx, str.Notify
call fcn.004b1f10
mov al, byte [esp + 0x1c]
test al, al
jne 0x4e87f4
pop edi
pop esi
mov ecx, dword [ebp + 0x215c]
call fcn.0051fea0
mov dword [ebp + 0x215c], eax
pop ebx
pop ebp
add esp, 0x3f4
ret