joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a4b10
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a917e
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x24], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x42c], ecx
push str.CBp::HandShake
push 1
lea ecx, [ebp - 0x1c]
call fcn.004aad40
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0x64
cmp dword [ebp + 8], 0x22
jne 0x4a4b70
mov dword [str.DRHBD], 0x71af38
jmp 0x4a4b7a
mov dword [str.DRHBD], 0x71af3c
mov dword [ebp - 0x14], 0x203
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 6
je 0x4a4bad
cmp dword [ebp - 0x430], 0x22
je 0x4a4bad
jmp 0x4a4d12
mov ecx, 1
test ecx, ecx
je 0x4a4d12
push 0x71af40
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4a4bf7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4a4bf7
push str.cant_openmtx_r_n
call fcn.0066610b
add esp, 4
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4a4c13
push str.openmtx_success_r_n
call fcn.0066610b
add esp, 4
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4a4d12
push 0x41
push 0
push 0
mov eax, dword [str.DRHBD]
push eax
call fcn.00666cf0
add esp, 4
push eax
mov ecx, dword [str.DRHBD]
push ecx
mov ecx, dword [ebp - 0x42c]
add ecx, 4
call fcn.004a22c0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4a4c61
mov dword [ebp - 0x14], 0x201
xor edx, edx
jne 0x4a4c4d
mov ecx, dword [ebp - 0x42c]
call fcn.004a4790
jmp 0x4a4bad
push 0x400
push 0
lea eax, [ebp - 0x424]
push eax
call fcn.006665c0
add esp, 0xc
push 0x41
push 0
push 0
mov ecx, dword [0x7c4078]
push ecx
call fcn.00666cf0
add esp, 4
push eax
lea edx, [ebp - 0x424]
push edx
mov ecx, dword [ebp - 0x42c]
add ecx, 4
call fcn.004a2530
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4a4ccf
cmp dword [ebp - 0x14], 0x5b4
je 0x4a4ccf
mov dword [ebp - 0x14], 0x202
xor eax, eax
jne 0x4a4cbb
mov ecx, dword [ebp - 0x42c]
call fcn.004a4790
jmp 0x4a4bad
cmp dword [ebp - 0x14], 0
jne 0x4a4d0d
mov ecx, dword [0x7c4078]
push ecx
lea edx, [ebp - 0x424]
push edx
call fcn.0066a2f0
add esp, 8
test eax, eax
je 0x4a4d08
mov eax, dword [0x7c4074]
push eax
lea ecx, [ebp - 0x424]
push ecx
call fcn.0066a2f0
add esp, 8
test eax, eax
jne 0x4a4d0d
jmp 0x4a4bad
jmp 0x4a4bad
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x428], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0049b930
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 4
Function at 0x4b1c70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], ecx
mov eax, dword [ebp - 0x41c]
mov dword [eax + 0x58], 0
mov byte [ebp - 0x400], 0
push 0x1f3
push 0
lea ecx, [ebp - 0x3ff]
push ecx
call fcn.006665c0
add esp, 0xc
mov byte [ebp - 0x200], 0
push 0x1f3
push 0
lea edx, [ebp - 0x1ff]
push edx
call fcn.006665c0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0x721aa8
lea ecx, [ebp - 0x400]
push ecx
call fcn.0066926d
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0x721aac
lea eax, [ebp - 0x200]
push eax
call fcn.0066926d
add esp, 0xc
call fcn.004ab110
mov dword [ebp - 0x404], eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x204], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x204]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0x2710
jb 0x4b1d50
mov edx, dword [ebp - 0x41c]
mov dword [edx + 0x58], 0x237
jmp 0x4b1e78
push 0
push 1
push 0xc
mov ecx, dword [ebp - 0x41c]
call fcn.004b1f90
mov ecx, dword [ebp - 0x41c]
mov dword [ecx + 0x58], eax
mov edx, dword [ebp - 0x41c]
cmp dword [edx + 0x58], 0
je 0x4b1d99
push str.GetConfInfo_failed__r_n
call fcn.0066610b
add esp, 4
call fcn.006684b5
add eax, 0x20
push eax
call fcn.00668459
add esp, 4
jmp 0x4b1e78
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x40c], eax
push 0
lea eax, [ebp - 0x400]
push eax
call fcn.0066a29a
add esp, 8
test eax, eax
jne 0x4b1e08
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x414], eax
mov ecx, dword [ebp - 0x414]
sub ecx, dword [ebp - 0x40c]
mov dword [ebp - 0x418], ecx
mov edx, dword [ebp - 0x418]
push edx
push str.access_suc_use_time_d_r_n
call fcn.0066610b
add esp, 8
call fcn.006684b5
add eax, 0x20
push eax
call fcn.00668459
add esp, 4
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
jmp 0x4b1e78
push 0
lea ecx, [ebp - 0x200]
push ecx
call fcn.0066a29a
add esp, 8
test eax, eax
jne 0x4b1e28
mov edx, dword [ebp + 0xc]
mov dword [edx], 1
jmp 0x4b1e78
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x410]
sub eax, dword [ebp - 0x40c]
mov dword [ebp - 0x408], eax
mov ecx, dword [ebp - 0x408]
push ecx
push str.two_Time_access_failed_time_d_r_n
call fcn.0066610b
add esp, 8
call fcn.006684b5
add eax, 0x20
push eax
call fcn.00668459
add esp, 4
mov edx, 1
test edx, edx
jne 0x4b1d20
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x58]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 8
Function at 0x4b6e10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a9f85
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x7e2670]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
push str.CBpaCmd::SP30Download
push 1
lea ecx, [ebp - 0x1c]
call fcn.004aad40
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x38]
mov dword [eax + 0x58], 0
cmp dword [ebp + 0xc], 0
jne 0x4b6e88
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x58], 0x205
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x58]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0049b930
mov eax, dword [ebp - 0x2c]
jmp 0x4b6f99
call fcn.004bade0
mov dword [ebp - 0x20], eax
push 0x722d78
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00669fd1
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4b6ed8
mov edx, dword [ebp - 0x38]
mov dword [edx + 0x58], 0x204
xor ecx, ecx
jne 0x4b6eb4
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x58]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0049b930
mov eax, dword [ebp - 0x30]
jmp 0x4b6f99
push 2
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00669e99
add esp, 0xc
mov edx, dword [ebp - 0x14]
push edx
call fcn.00669daa
add esp, 4
mov dword [ebp - 0x10], eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call fcn.00669e99
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00669543
add esp, 4
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 1
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.00669b18
add esp, 0x10
mov dword [ebp - 0x28], eax
push 1
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x24]
push eax
movzx ecx, byte [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.004c0bc0
mov edx, dword [ebp - 0x38]
mov dword [edx + 0x58], eax
cmp dword [ebp - 0x24], 0
je 0x4b6f65
mov eax, dword [ebp - 0x24]
push eax
call fcn.00669233
add esp, 4
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x14], 0
je 0x4b6f7e
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00669ba2
add esp, 4
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x58]
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0049b930
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b6fb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a9fa8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x7e2670]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
push str.CBpaCmd::SP20C51_DlMonitor
push 1
lea ecx, [ebp - 0x20]
call fcn.004aad40
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x38]
mov dword [eax + 0x58], 0
cmp dword [ebp + 8], 0
jne 0x4b7028
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x58], 0x205
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x58]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0049b930
mov eax, dword [ebp - 0x2c]
jmp 0x4b7151
call fcn.004bad50
mov dword [ebp - 0x10], eax
push 0x722dcc
mov ecx, dword [ebp + 8]
push ecx
call fcn.00669fd1
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4b7078
mov edx, dword [ebp - 0x38]
mov dword [edx + 0x58], 0x204
xor ecx, ecx
jne 0x4b7054
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x58]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0049b930
mov eax, dword [ebp - 0x30]
jmp 0x4b7151
push 2
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00669e99
add esp, 0xc
mov edx, dword [ebp - 0x18]
push edx
call fcn.00669daa
add esp, 4
mov dword [ebp - 0x14], eax
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call fcn.00669e99
add esp, 0xc
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x5c]
mov ecx, dword [eax*4 + 0x7c4208]
push ecx
push str._s.size_d_r_n
call fcn.004a4410
add esp, 0xc
mov edx, dword [ebp - 0x14]
push edx
call fcn.00669543
add esp, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 1
mov edx, dword [ebp - 0x24]
push edx
call fcn.00669b18
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.004bf8b0
mov edx, dword [ebp - 0x38]
mov dword [edx + 0x58], eax
cmp dword [ebp - 0x24], 0
je 0x4b711d
mov eax, dword [ebp - 0x24]
push eax
call fcn.00669233
add esp, 4
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x18], 0
je 0x4b7136
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00669ba2
add esp, 4
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x58]
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0049b930
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c1700
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jne 0x4c1725
mov dword [ebp - 0xc], 0x501
mov eax, dword [ebp - 0xc]
jmp 0x4c184e
push 0x72e450
mov eax, dword [ebp + 8]
push eax
call fcn.00669fd1
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4c174e
mov dword [ebp - 0xc], 0x204
mov eax, dword [ebp - 0xc]
jmp 0x4c184e
push 2
push 0
mov ecx, dword [ebp - 8]
push ecx
call fcn.00669e99
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call fcn.00669daa
add esp, 4
mov dword [ebp - 4], eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.00669e99
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
push 0x72e454
call fcn.0066610b
add esp, 8
call fcn.006684b5
add eax, 0x20
push eax
call fcn.00668459
add esp, 4
mov edx, dword [ebp - 4]
push edx
call fcn.00669543
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4c17c3
mov dword [ebp - 0xc], 0x221
mov eax, dword [ebp - 0xc]
jmp 0x4c184e
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp - 0x10]
push edx
call fcn.00669b18
add esp, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 4]
je 0x4c17f0
mov dword [ebp - 0xc], 0x502
mov eax, dword [ebp - 0xc]
jmp 0x4c184e
cmp dword [ebp - 8], 0
je 0x4c1809
mov ecx, dword [ebp - 8]
push ecx
call fcn.00669ba2
add esp, 4
mov dword [ebp - 8], 0
push 0x1e
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004c1900
mov byte [ebp - 0x11], al
movzx ecx, byte [ebp - 0x11]
test ecx, ecx
jne 0x4c1832
mov dword [ebp - 0xc], 0x503
mov eax, dword [ebp - 0xc]
jmp 0x4c184e
cmp dword [ebp - 0x10], 0
je 0x4c184b
mov edx, dword [ebp - 0x10]
push edx
call fcn.00669233
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x4c1d50
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push str.outkey.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 8], 0
je 0x4c1e12
mov dword [ebp - 4], 0
push str.getLasetError
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x7f8420], eax
push str.outDipsKey
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x7f8424], eax
push str.OutCCK
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x7f8428], eax
push str.varifyPin
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x7f842c], eax
push str.openReader
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x7f8434], eax
push str.closeReader
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x7f8430], eax
call dword [0x7f8434]
jmp 0x4c1e37
push str.cant_open_dll_outkey.dll__thats_key_file_need_r_n
call fcn.0066610b
add esp, 4
call fcn.006684b5
add eax, 0x20
push eax
call fcn.00668459
add esp, 4
xor eax, eax
jne 0x4c1e12
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x4eda80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x10]
call fcn.00401490
mov dword [ebp - 0x2c], 0
cmp dword [ebp + 0xc], 0
jne 0x4edabc
mov dword [ebp - 0x30], 1
lea ecx, [ebp - 0x10]
call fcn.004014d0
mov eax, dword [ebp - 0x30]
jmp 0x4edbe4
push 0
lea eax, [ebp - 4]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x7ddbac]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4edb47
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
push str.COM_Write_Error_WriteSerialPort1_dwError:_d_r_n
call fcn.0066610b
add esp, 8
call fcn.006684b5
add eax, 0x20
push eax
call fcn.00668459
add esp, 4
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [0x7ddbac]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x18], 0x16
jne 0x4edb30
mov dword [0x7e46d4], 0x16
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x10]
call fcn.004014d0
mov eax, dword [ebp - 0x34]
jmp 0x4edbe4
cmp dword [ebp + 0xc], 1
jbe 0x4edbd2
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
sub edx, 1
push edx
mov eax, dword [ebp + 8]
add eax, 1
push eax
mov ecx, dword [0x7ddbac]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4edbd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
push str.COM_Write_Error_WriteSerialPort2_dwError_:_d_r_n
call fcn.0066610b
add esp, 8
call fcn.006684b5
add eax, 0x20
push eax
call fcn.00668459
add esp, 4
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [0x7ddbac]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov dword [ebp - 8], eax
mov dword [ebp - 0x38], 0
lea ecx, [ebp - 0x10]
call fcn.004014d0
mov eax, dword [ebp - 0x38]
jmp 0x4edbe4
mov dword [ebp - 0x3c], 1
lea ecx, [ebp - 0x10]
call fcn.004014d0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret
Function at 0x4edc00
Capabilities:
Check for time delay via gettickcount
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ac90d
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 0x24], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x38]
call fcn.00401490
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x3c], eax
mov eax, 1
test eax, eax
je 0x4edd78
cmp dword [0xed39d8], 1
jne 0x4edc7b
mov dword [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004014d0
mov eax, dword [ebp - 0x40]
jmp 0x4edd87
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [0x7ddbac]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push 0
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
push eax
mov ecx, dword [0x7ddbac]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4edd0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [0x7ddbac]
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x20]
push eax
push 0x73e514
lea ecx, [ebp - 0x38]
push ecx
call fcn.004017f0
add esp, 0x10
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x44], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004014d0
mov eax, dword [ebp - 0x44]
jmp 0x4edd87
cmp dword [ebp - 0x34], 0
jne 0x4edd48
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x3c]
cmp eax, dword [ebp + 0x10]
jb 0x4edd3e
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004014d0
mov eax, dword [ebp - 0x48]
jmp 0x4edd87
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4edd73
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jb 0x4edd73
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004014d0
mov eax, dword [ebp - 0x4c]
jmp 0x4edd87
jmp 0x4edc47
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004014d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret
Function at 0x4eff10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
push 0x741e84
mov eax, dword [ebp + 8]
push eax
call fcn.00669fd1
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4eff4a
push 0x741e88
call fcn.0066610b
add esp, 4
mov eax, 0x204
jmp 0x4f0001
push 2
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00669e99
add esp, 0xc
mov edx, dword [ebp - 0xc]
push edx
call fcn.00669daa
add esp, 4
mov dword [ebp - 8], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.00669e99
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 0x64
jge 0x4effa8
push str.cmd_file_len_error_n
call fcn.0066610b
add esp, 4
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00669ba2
add esp, 4
mov eax, 0x18
jmp 0x4f0001
mov edx, dword [ebp - 8]
push edx
call fcn.00576bfc
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
call fcn.006665c0
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 1
mov edx, dword [ebp - 0x10]
push edx
call fcn.00669b18
add esp, 0x10
mov eax, dword [ebp - 0xc]
push eax
call fcn.00669ba2
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x18]
call fcn.004efbe0
mov esp, ebp
pop ebp
ret 4
Function at 0x4f0050
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x7e2670]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x118], 0
cmp dword [ebp + 8], 0
je 0x4f0085
cmp dword [ebp + 0xc], 0
je 0x4f0085
cmp dword [ebp + 0x10], 0
jne 0x4f008d
or eax, 0xffffffff
jmp 0x4f0215
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea ecx, [ebp - 0x10f]
push ecx
call fcn.006665c0
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
call fcn.00666cf0
add esp, 4
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00666cf0
add esp, 4
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x110]
push edx
call fcn.00666ba0
add esp, 8
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x114]
movsx ecx, byte [eax - 1]
cmp ecx, 0x5c
je 0x4f010d
push 0x7437a0
lea edx, [ebp - 0x110]
push edx
call fcn.00666bb0
add esp, 8
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00666bb0
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.00666bb0
add esp, 8
cmp dword [0x7c4f54], 0xffffffff
jne 0x4f016e
lea ecx, [ebp - 0x258]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [0x7c4f54], eax
cmp dword [0x7c4f54], 0xffffffff
jne 0x4f016c
mov dword [ebp - 0x118], 0xfffffffe
jmp 0x4f01da
jmp 0x4f0194
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [0x7c4f54]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4f0194
mov dword [ebp - 0x118], 0xfffffffd
jmp 0x4f01da
mov edx, dword [ebp - 0x258]
and edx, 0x10
je 0x4f01c7
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [0x7c4f54]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4f01c5
mov dword [ebp - 0x118], 0xfffffffc
jmp 0x4f01da
jmp 0x4f0194
lea edx, [ebp - 0x22c]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00666bb0
add esp, 8
cmp dword [ebp + 0x14], 0
jne 0x4f01e9
cmp dword [ebp - 0x118], 0
je 0x4f020f
mov ecx, dword [0x7c4f54]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [0x7c4f54], 0xffffffff
cmp dword [ebp - 0x118], 0
je 0x4f020f
mov edx, dword [ebp + 0x10]
mov byte [edx], 0
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006665ac
mov esp, ebp
pop ebp
ret 0x10
Function at 0x508920
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea ecx, [ebp - 0xc]
call fcn.00401490
mov dword [ebp - 0x10], 0
cmp dword [ebp + 0xc], 0
jne 0x50894f
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0xc]
call fcn.004014d0
mov eax, dword [ebp - 0x14]
jmp 0x5089cd
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x7dcbec]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x508993
mov ecx, dword [0x7dcbec]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0xc]
call fcn.004014d0
mov eax, dword [ebp - 0x18]
jmp 0x5089cd
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 4]
je 0x5089bb
mov eax, dword [0x7dcbec]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0xc]
call fcn.004014d0
mov eax, dword [ebp - 0x1c]
jmp 0x5089cd
mov dword [ebp - 0x20], 1
lea ecx, [ebp - 0xc]
call fcn.004014d0
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret