joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f6ac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
sub esp, 0x20
mov edx, dword [0x69761c]
mov dword [ebp - 0xc], eax
cmp edx, dword [ebp - 0xc]
mov byte [ebp - 0xd], 0
jb 0x41f745
mov ecx, dword [edi + 4]
mov esi, dword [ebp - 0xc]
add esi, ecx
mov ecx, dword [edi + 0xc]
cmp ecx, esi
jae 0x41f73e
mov eax, dword [0x6975c8]
lea esi, [esi + eax - 1]
neg eax
and esi, eax
cmp dword [0x697608], esi
jae 0x41f750
cmp byte [ebp - 0xd], 0
je 0x41f745
cmp byte [0x697620], 0
jne 0x41f7d0
mov dword [esp], 0
call fcn.0041f608
cmp byte [0x6971d2], 0
mov byte [ebp - 0xd], 1
je 0x41f6c8
mov dword [ebx], 0x4fbc41
add ebx, 4
call fcn.0043a1a4
mov edx, dword [0x69761c]
cmp edx, dword [ebp - 0xc]
jb 0x41f6bf
mov eax, dword [edi + 0xc]
mov esi, dword [edi + 4]
sub eax, esi
cmp eax, dword [ebp - 0xc]
jb 0x41f6bf
add esp, 0x20
pop esi
pop edi
pop ebp
ret
call fcn.0041f5e4
jmp 0x41f70b
mov dword [0x698fa0], ebx
mov edx, esi
mov eax, ecx
sub edx, ecx
call fcn.00419c94
xor edx, edx
test eax, eax
mov dword [0x698fa0], edx
jns 0x41f7b4
mov dword [esp], str.Trying_to_make_room_through_a_GC...
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 0x23
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 0xa
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
jmp 0x41f6ec
mov dword [edi + 0xc], esi
mov eax, dword [ebp - 0xc]
cmp dword [0x69761c], eax
jae 0x41f73e
mov dword [0x69761c], eax
jmp 0x41f73e
call fcn.0041f62c
lea esi, [esi]
Function at 0x41f7d8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x14
mov edx, dword [0x69761c]
cmp edx, 7
jbe 0x41f810
mov ecx, dword [0x6975fc]
mov esi, dword [0x697608]
mov eax, ecx
sub eax, esi
cmp eax, 7
ja 0x41f8c0
lea esi, [esi]
lea edi, [edi]
mov byte [ebp - 5], 0
cmp edx, 8
jb 0x41f8f2
mov ecx, dword [0x6975fc]
lea esi, [ecx - 8]
cmp ecx, esi
jb 0x41f84d
mov edx, dword [0x697608]
cmp edx, esi
jbe 0x41f962
mov eax, dword [0x6975c8]
neg eax
and esi, eax
cmp dword [0x6975e8], esi
jbe 0x41f900
cmp byte [ebp - 5], 0
je 0x41f8f2
cmp byte [0x697620], 0
jne 0x41f96d
mov dword [esp], 0
call fcn.0041f608
cmp byte [0x6971d2], 0
mov byte [ebp - 5], 1
je 0x41f81d
mov dword [ebx], 0x4fbc41
add ebx, 4
call fcn.0043a1a4
mov edx, dword [0x69761c]
cmp edx, 8
jb 0x41f810
mov ecx, dword [0x6975fc]
mov esi, dword [0x697608]
mov eax, ecx
sub eax, esi
cmp eax, 8
jb 0x41f810
lea esi, [esi]
lea edi, [edi]
mov eax, ecx
sub edx, 8
lea ecx, [ecx - 8]
mov dword [eax - 8], 0x4fa001
sub eax, 5
mov dword [ecx + 4], 0x4fa001
mov dword [0x6975fc], ecx
mov dword [0x69761c], edx
mov byte [0x698fc1], 0
add esp, 0x14
pop esi
pop ebp
ret
call fcn.0041f5e4
jmp 0x41f870
mov dword [0x698fa0], ebx
sub edx, esi
mov eax, esi
call fcn.00419c94
xor edx, edx
test eax, eax
mov dword [0x698fa0], edx
jns 0x41f972
mov dword [esp], str.Trying_to_make_room_through_a_GC...
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 0x23
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 0xa
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
jmp 0x41f84d
mov edx, dword [0x69761c]
jmp 0x41f8c0
call fcn.0041f62c
mov eax, 0x6975fc
mov dword [eax + 0xc], esi
mov edx, dword [0x69761c]
cmp edx, 8
jae 0x41f994
mov eax, 8
mov edx, 8
mov dword [0x69761c], eax
mov ecx, dword [0x6975fc]
jmp 0x41f8c0
Function at 0x426abc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5044a8]
mov dword [esp], eax
call fcn.00497604
mov byte [ebp - 1], al
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [0x698fa0], ebx
mov dword [esp], 0xa
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
mov dword [esp], str.___Lisp_stack_overflow._RESET
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 0x20
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 0xa
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
xor eax, eax
cmp byte [ebp - 1], 0
mov dword [0x698fa0], eax
je 0x426b5b
mov dword [esp], 1
call fcn.0043bc00
mov eax, 1
mov dword [0x6971b4], eax
call fcn.004268d4
nop
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5044a8]
mov dword [esp], eax
call fcn.00497604
mov byte [ebp - 1], al
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [0x698fa0], ebx
mov dword [esp], 0xa
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
mov dword [esp], str.___Program_stack_overflow._RESET
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov ecx, 1
mov dword [esp + 4], ecx
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 0x23
mov dword [esp + 8], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 0xa
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
xor edx, edx
cmp byte [ebp - 1], 0
mov dword [0x698fa0], edx
je 0x426c0c
mov dword [esp], 1
call fcn.0043bc00
mov eax, 1
mov dword [0x6971b4], eax
call fcn.004268d4
nop
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x698fa0]
mov edx, dword [ebp + 8]
test eax, eax
je 0x426c35
mov ebx, eax
call 0x426b6c
test edx, edx
je 0x426c30
mov ebx, dword [edx + 0xa4]
call 0x426b6c
push ebp
mov ebp, esp
sub esp, 8
mov edx, esp
mov eax, dword [0x699040]
add eax, 0x1000
cmp edx, eax
jb 0x426c9f
mov eax, dword [0x697624]
shr eax, 2
cmp dword [0x697628], eax
ja 0x426c86
mov eax, 1
mov dword [0x697658], eax
call fcn.0041d420
mov byte [0x697620], 0
leave
jmp fcn.0041f574
xor eax, eax
mov dword [0x697658], eax
call fcn.0041d420
mov byte [0x697620], 1
leave
jmp fcn.0041f574
call 0x426b6c
push ebp
mov ebp, esp
sub esp, 8
mov edx, esp
mov eax, dword [0x699040]
add eax, 0x1000
cmp edx, eax
jb 0x426cd3
xor eax, eax
mov dword [0x697658], eax
call fcn.0041d420
mov byte [0x697620], 1
leave
jmp fcn.0041f574
call 0x426b6c
Function at 0x426b6c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5044a8]
mov dword [esp], eax
call fcn.00497604
mov byte [ebp - 1], al
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [0x698fa0], ebx
mov dword [esp], 0xa
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
mov dword [esp], str.___Lisp_stack_overflow._RESET
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 0x20
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 0xa
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
xor eax, eax
cmp byte [ebp - 1], 0
mov dword [0x698fa0], eax
je 0x426b5b
mov dword [esp], 1
call fcn.0043bc00
mov eax, 1
mov dword [0x6971b4], eax
call fcn.004268d4
nop
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5044a8]
mov dword [esp], eax
call fcn.00497604
mov byte [ebp - 1], al
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [0x698fa0], ebx
mov dword [esp], 0xa
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
mov dword [esp], str.___Program_stack_overflow._RESET
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov ecx, 1
mov dword [esp + 4], ecx
add eax, 0x40
mov dword [esp + 0xc], eax
mov eax, 0x23
mov dword [esp + 8], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 0xa
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp + 4], eax
call fcn.004f07b8
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fflush
xor edx, edx
cmp byte [ebp - 1], 0
mov dword [0x698fa0], edx
je 0x426c0c
mov dword [esp], 1
call fcn.0043bc00
mov eax, 1
mov dword [0x6971b4], eax
call fcn.004268d4
nop
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x698fa0]
mov edx, dword [ebp + 8]
test eax, eax
je 0x426c35
mov ebx, eax
call 0x426b6c
test edx, edx
je 0x426c30
mov ebx, dword [edx + 0xa4]
call 0x426b6c
push ebp
mov ebp, esp
sub esp, 8
mov edx, esp
mov eax, dword [0x699040]
add eax, 0x1000
cmp edx, eax
jb 0x426c9f
mov eax, dword [0x697624]
shr eax, 2
cmp dword [0x697628], eax
ja 0x426c86
mov eax, 1
mov dword [0x697658], eax
call fcn.0041d420
mov byte [0x697620], 0
leave
jmp fcn.0041f574
xor eax, eax
mov dword [0x697658], eax
call fcn.0041d420
mov byte [0x697620], 1
leave
jmp fcn.0041f574
call 0x426b6c
push ebp
mov ebp, esp
sub esp, 8
mov edx, esp
mov eax, dword [0x699040]
add eax, 0x1000
cmp edx, eax
jb 0x426cd3
xor eax, eax
mov dword [0x697658], eax
call fcn.0041d420
mov byte [0x697620], 1
leave
jmp fcn.0041f574
call 0x426b6c
Function at 0x44426c
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov edx, ebx
mov ebp, esp
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [0x699000]
mov dword [ebx], eax
mov eax, dword [0x698ffc]
add ebx, 4
mov dword [ebx], eax
mov eax, dword [0x698ff8]
add ebx, 4
mov dword [ebx], eax
mov eax, dword [0x698ff4]
add ebx, 4
mov dword [ebx], eax
mov eax, dword [0x698ff0]
add ebx, 4
mov dword [ebx], eax
add ebx, 4
mov eax, ebx
sub eax, edx
sub eax, 0x7fffffc
mov dword [ebx], eax
mov eax, dword [ebp - 0x10]
add ebx, 4
mov dword [0x698ff4], esi
mov dword [0x698ff8], edi
mov dword [0x698ffc], eax
mov eax, dword [ebp - 0x14]
mov dword [0x698ff0], ecx
mov dword [0x699000], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004439d0
add esp, 0x10
pop esi
pop edi
pop ebp
jmp fcn.0043b82c
Function at 0x4479a8
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
cmp edi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jae 0x447a72
nop
movzx esi, byte [edi]
inc edi
cmp dword [ebp - 0x10], 0x12
ja 0x447a80
inc dword [ebp - 0x10]
test ecx, ecx
je 0x4479f6
mov eax, esi
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_c:_usr_work_edrive_w32texsrc_clisp249_clisp_2.49_src_encoding.d]
mov dword [ecx], eax
add ecx, 4
inc dword [ebp - 0x14]
mov edx, esi
and edx, 3
shl edx, 4
cmp edi, dword [ebp + 8]
je 0x447adf
movzx esi, byte [edi]
inc edi
test ecx, ecx
je 0x447a25
mov eax, esi
shr eax, 4
or eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_c:_usr_work_edrive_w32texsrc_clisp249_clisp_2.49_src_encoding.d]
mov dword [ecx], eax
add ecx, 4
inc dword [ebp - 0x14]
and esi, 0xf
lea edx, [esi*4]
cmp edi, dword [ebp + 8]
je 0x447b0a
movzx esi, byte [edi]
inc edi
test ecx, ecx
je 0x447a65
mov eax, esi
shr eax, 6
and esi, 0x3f
or eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_c:_usr_work_edrive_w32texsrc_clisp249_clisp_2.49_src_encoding.d]
mov dword [ecx], eax
add ecx, 4
movzx eax, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_c:_usr_work_edrive_w32texsrc_clisp249_clisp_2.49_src_encoding.d]
mov dword [ecx], eax
add ecx, 4
add dword [ebp - 0x14], 2
cmp edi, dword [ebp + 8]
jb 0x4479d0
mov eax, dword [ebp - 0x14]
add esp, 0xc
pop esi
pop edi
pop ebp
ret
cmp dword [ebp - 0xc], 1
mov dword [ebp - 0x10], 1
je 0x447ad0
jb 0x447ab8
cmp dword [ebp - 0xc], 2
jne 0x4479e1
test ecx, ecx
je 0x447aaf
mov dword [ecx], 0xd
add ecx, 4
mov dword [ecx], 0xa
add ecx, 4
add dword [ebp - 0x14], 2
jmp 0x4479e1
test ecx, ecx
je 0x447ac5
mov dword [ecx], 0xa
add ecx, 4
inc dword [ebp - 0x14]
jmp 0x4479e1
test ecx, ecx
je 0x447ac5
mov dword [ecx], 0xd
add ecx, 4
jmp 0x447ac5
test ecx, ecx
je 0x447afc
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_c:_usr_work_edrive_w32texsrc_clisp249_clisp_2.49_src_encoding.d]
mov dword [ecx], eax
add ecx, 4
mov dword [ecx], 0x3d
mov dword [ecx + 4], 0x3d
add dword [ebp - 0x14], 3
mov eax, dword [ebp - 0x14]
add esp, 0xc
pop esi
pop edi
pop ebp
ret
test ecx, ecx
je 0x447b1e
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_c:_usr_work_edrive_w32texsrc_clisp249_clisp_2.49_src_encoding.d]
mov dword [ecx + 4], 0x3d
mov dword [ecx], eax
add dword [ebp - 0x14], 2
mov eax, dword [ebp - 0x14]
add esp, 0xc
pop esi
pop edi
pop ebp
ret
Function at 0x4593dc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x20
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [ecx]
mov edi, edx
add eax, edx
lea ecx, [eax + 6]
mov dword [ebp - 0x18], ecx
movzx eax, byte [eax + 6]
test al, al
js 0x459535
mov dword [ebp - 0xc], 0
cmp edx, 1
jbe 0x459430
test al, al
jne 0x459430
cmp byte [ecx - 1], 0
jmp 0x45942d
dec dword [ebp - 0x18]
dec edi
cmp edi, 1
jbe 0x459430
mov eax, dword [ebp - 0x18]
cmp byte [eax], 0
jne 0x459430
cmp byte [eax - 1], 0
jns 0x459418
nop
cmp edi, 3
jbe 0x459510
cmp edi, 4
je 0x459501
mov eax, dword [ebp - 0xc]
lea esi, [edi + 3]
shr esi, 2
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00420028
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 7], edx
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx]
lea esi, [edx + esi*4 + 7]
add eax, 7
mov dword [ebp - 0x14], esi
mov esi, edi
shr esi, 2
mov dword [ebp - 0x18], eax
lea esi, [esi]
mov ecx, dword [ebp - 0x18]
movzx edx, byte [ecx]
inc ecx
mov dword [ebp - 0x18], ecx
movzx eax, byte [ecx]
inc ecx
mov dword [ebp - 0x18], ecx
shl eax, 8
or edx, eax
movzx eax, byte [ecx]
inc ecx
mov dword [ebp - 0x18], ecx
shl eax, 0x10
or edx, eax
movzx eax, byte [ecx]
inc ecx
sub dword [ebp - 0x14], 4
mov dword [ebp - 0x18], ecx
shl eax, 0x18
or edx, eax
mov eax, dword [ebp - 0x14]
dec esi
mov dword [eax], edx
jne 0x459480
mov esi, edi
and esi, 3
je 0x4594f7
movzx edx, byte [ecx]
xor edi, edi
inc ecx
mov dword [ebp - 0x18], ecx
jmp 0x4594e2
mov ecx, dword [ebp - 0x18]
add edi, 8
movzx eax, byte [ecx]
mov ecx, edi
inc dword [ebp - 0x18]
shl eax, cl
or edx, eax
dec esi
jne 0x4594d0
lea ecx, [edi + 8]
mov eax, dword [ebp - 0x14]
shl dword [ebp - 0xc], cl
xor dword [ebp - 0xc], edx
mov edx, dword [ebp - 0xc]
mov dword [eax - 4], edx
mov eax, dword [ebp - 0x10]
add esp, 0x20
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp - 0x18]
cmp byte [edx], 0
jne 0x459442
lea esi, [esi]
xor edx, edx
test edi, edi
jmp 0x459526
mov ecx, dword [ebp - 0x18]
shl edx, 8
movzx eax, byte [ecx]
dec ecx
mov dword [ebp - 0x18], ecx
or edx, eax
dec edi
jne 0x459516
add esp, 0x20
shl edx, 7
lea eax, [edx + 7]
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0xc], 0xffffffff
cmp edx, 1
jbe 0x459545
inc al
je 0x45958a
cmp edi, 3
jbe 0x45955f
cmp edi, 4
jne 0x459442
mov ecx, dword [ebp - 0x18]
cmp byte [ecx], 0xff
jne 0x459442
mov edx, 0xffffffff
test edi, edi
jmp 0x459578
mov ecx, dword [ebp - 0x18]
shl edx, 8
movzx eax, byte [ecx]
dec ecx
mov dword [ebp - 0x18], ecx
or edx, eax
dec edi
jne 0x459568
add esp, 0x20
shl edx, 7
lea eax, [edx - 0x7ffffff1]
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x18]
cmp byte [eax - 1], 0
jns 0x459545
dec dword [ebp - 0x18]
dec edi
cmp edi, 1
jbe 0x459545
mov edx, dword [ebp - 0x18]
cmp byte [edx], 0xff
jne 0x459545
cmp byte [edx - 1], 0
js 0x459593
jmp 0x459545
Function at 0x4720e4
Capabilities:
Create thread

Disassembly:
push ebp
mov eax, 0x4720c8
mov ebp, esp
mov edx, dword [ebp + 8]
mov dword [ebp + 8], 0
pop ebp
jmp fcn.00471f38

Function at 0x4722bc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [0x507f90], 0xffffffff
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
jne 0x4722da
cmp dword [0x507f8c], 0xffffffff
je 0x4722ef
mov dword [esp], str.c:_usr_work_edrive_w32texsrc_clisp249_clisp_2.49_src_win32aux.d
mov esi, 0x10d
mov dword [esp + 4], esi
call fcn.00420a64
call sub.KERNEL32.dll_GetCurrentProcess
mov edi, eax
call sub.KERNEL32.dll_GetCurrentThread
mov esi, eax
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [esp], eax
xor edx, edx
mov ecx, 2
mov dword [esp + 0x18], ecx
xor ecx, ecx
mov dword [esp + 0x14], edx
mov edx, 0x507f90
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
call sub.KERNEL32.dll_DuplicateHandle
sub esp, 0x1c
test eax, eax
je 0x47239a
mov dword [esp], 0
lea eax, [ebp - 0xc]
xor edi, edi
mov dword [esp + 0x14], eax
xor esi, esi
mov ecx, 0x472168
mov dword [esp + 0x10], edi
mov edx, 0x2710
mov dword [esp + 0xc], esi
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
test eax, eax
je 0x47239a
mov dword [0x507f8c], eax
mov eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x472118
call sub.KERNEL32.dll_SetConsoleCtrlHandler
sub esp, 8
test eax, eax
je 0x47239a
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call fcn.00439640
nop
push ebp
mov ebp, esp
push esi
sub esp, 0x14
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 8], eax
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadConsoleInputA
mov dword [esi + 0xc], eax
sub esp, 0x10
test eax, eax
je 0x4723e0
mov esi, dword [ebp - 4]
xor eax, eax
leave
ret 4
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 0x10], eax
mov esi, dword [ebp - 4]
xor eax, eax
leave
ret 4
Function at 0x472c9c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x697c40], 0
jne 0x472d00
mov byte [0x697c40], 0
call sub.OLE32.dll_CoUninitialize
mov eax, dword [0x697c90]
test eax, eax
jne 0x472cc2
leave
ret
mov dword [esp], eax
xor edx, edx
mov dword [esp + 4], edx
call sub.KERNEL32.dll_TerminateThread
mov eax, dword [0x697ca0]
xor ecx, ecx
sub esp, 8
mov dword [0x697c90], ecx
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [0x697cb0]
sub esp, 4
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
leave
ret
call sub.WS2_32.DLL_WSACleanup
test eax, eax
je 0x472cab
xor edx, edx
mov eax, str._n___Failed_to_shutdown_winsock_library_n
call fcn.00472c54
jmp 0x472cab

Function at 0x472d18
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
mov dword [esp], 0xfffffff6
call sub.KERNEL32.dll_GetStdHandle
mov dword [0x507f88], eax
sub esp, 4
mov dword [esp], 0xfffffff5
call sub.KERNEL32.dll_GetStdHandle
mov dword [0x507f84], eax
sub esp, 4
mov dword [esp], 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
mov dword [0x507f80], eax
sub esp, 4
xor edx, edx
mov dword [esp + 8], edx
xor ecx, ecx
mov eax, 1
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
mov dword [0x697c50], eax
sub esp, 0x10
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
mov dword [0x697c60], eax
sub esp, 0x10
xor eax, eax
mov dword [esp + 0xc], eax
mov ecx, 1
xor eax, eax
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
mov dword [0x697c70], eax
sub esp, 0x10
lea eax, [ebp - 0x198]
mov dword [esp + 4], eax
mov dword [esp], 0x101
call sub.WS2_32.DLL_WSAStartup
sub esp, 8
test eax, eax
jne 0x472e00
mov byte [0x697c40], 1
leave
ret
mov byte [0x697c40], 0
xor edx, edx
mov eax, str._n___Failed_to_initialize_winsock_library_n
call fcn.00472c54
leave
ret

Function at 0x47346c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [esp], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov word [ebp - 0x26], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], 0x100
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x58]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, 1
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
leave
ret
Function at 0x473c4c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov eax, 2
mov ebp, esp
push edi
xor edx, edx
xor edi, edi
push esi
mov ecx, 3
sub esp, 0xd0
mov dword [ebp - 0xb0], eax
mov eax, 3
mov esi, 0x8000000
mov dword [esp + 8], eax
mov eax, 0x80000000
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0xac], eax
sub esp, 0x1c
mov eax, 2
cmp dword [ebp - 0xac], 0xffffffff
je 0x473ce7
lea eax, [ebp - 0x48]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileInformationByHandle
sub esp, 8
test eax, eax
jne 0x473cf0
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0xb0]
sub esp, 4
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
xor eax, eax
test byte [ebp - 0x48], 1
mov dword [ebp - 0xb0], eax
je 0x473cd0
mov ecx, dword [ebp - 0xac]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], ecx
call sub.KERNEL32.dll_GetFileSize
sub esp, 8
cmp eax, 0x2000
ja 0x473cd0
xor eax, eax
mov edi, dword [ebp - 0xac]
lea esi, [ebp - 0x98]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x9c]
mov dword [esp + 0xc], eax
mov eax, 0x4c
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
test eax, eax
je 0x473cd0
cmp dword [ebp - 0x9c], 0x4c
jne 0x473cd0
lea eax, [ebp - 0x80]
lea edx, [ebp - 0x5c]
mov dword [ebp - 0xb4], eax
cmp edx, dword [ebp - 0xb4]
jbe 0x473d8e
mov ecx, dword [ebp - 0xb4]
mov eax, dword [ecx]
add ecx, 4
mov dword [ebp - 0xb4], ecx
test eax, eax
je 0x473d71
cmp dword [ebp - 0x98], 0x4c
jne 0x473cd0
cld
mov edi, 0x566d60
lea eax, [ebp - 0x98]
mov dword [ebp - 0xa0], edi
add eax, 4
mov esi, 0x10
mov dword [ebp - 0xa4], esi
mov edi, 0x566d60
mov esi, eax
mov ecx, 0x10
repe cmpsb byte [esi], byte es:[edi]
seta byte [ebp - 0xa5]
setb al
cmp byte [ebp - 0xa5], al
jne 0x473cd0
mov eax, dword [ebp - 0x84]
and eax, 0xfffffffe
cmp eax, 0xc
jne 0x473cd0
cmp edx, dword [ebp - 0xb4]
ja 0x473cd0
cmp dword [ebp - 0x5c], 1
jne 0x473cd0
mov ecx, 1
mov dword [ebp - 0xb0], ecx
jmp 0x473cd0