joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d53f0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ecx
push ebp
push esi
push edi
push 0
mov esi, ecx
push 6
call fcn.004d57c0
mov eax, dword [esi + 0x104]
mov ecx, dword [eax + 0x1c]
push ecx
call sub.IMM32.dll_ImmGetContext
push 0
mov ebp, eax
push 0
push 8
push ebp
call sub.IMM32.dll_ImmGetCompositionStringW
push 0
push 0
push 0x800
push ebp
mov edi, eax
call sub.IMM32.dll_ImmGetCompositionStringW
test eax, eax
je 0x4d5445
test edi, edi
je 0x4d5445
push ebp
mov ecx, esi
call fcn.004d5600
push ebp
mov ecx, esi
call fcn.004d5550
mov al, byte [esi + 0xd4]
test al, al
je 0x4d5535
cmp edi, 2
jne 0x4d5535
lea edx, [esp + 0xc]
push edi
push edx
push 8
push ebp
call sub.IMM32.dll_ImmGetCompositionStringW
mov eax, dword [esp + 0xc]
cmp ax, 0x20
jae 0x4d548a
cmp ax, 0xa
je 0x4d548a
cmp ax, 0xd
je 0x4d548a
cmp ax, 9
jne 0x4d5535
cmp ax, 0xff60
ja 0x4d549a
cmp ax, 0xff00
jae 0x4d5535
mov ecx, dword [esi + 0x88]
mov edx, dword [esi + 0x24]
cmp ecx, edx
jge 0x4d54d5
push ecx
lea ecx, [esi + 0x1c]
call fcn.004c78d0
test eax, eax
je 0x4d54b8
mov eax, dword [eax]
jmp 0x4d54ba
xor eax, eax
mov ecx, dword [esi + 0x8c]
mov edx, dword [esp + 0xc]
push 1
add ecx, eax
push 0
push ecx
push edx
mov ecx, esi
call fcn.004d3040
jmp 0x4d54df
push 0
push eax
mov ecx, esi
call fcn.004d2f30
mov ecx, dword [esi + 0x8c]
push 0
push 4
inc ecx
push 0x15
push ebp
mov dword [esi + 0x8c], ecx
call sub.IMM32.dll_ImmNotifyIME
mov edi, dword [esi + 0x88]
mov eax, dword [esi + 0x24]
inc edi
cmp edi, eax
jge 0x4d5520
push ebx
lea ebx, [esi + 0x1c]
push edi
mov ecx, ebx
call fcn.004c78d0
mov edx, dword [eax]
inc edx
inc edi
mov dword [eax], edx
mov eax, dword [esi + 0x24]
cmp edi, eax
jl 0x4d550a
pop ebx
mov eax, dword [esi + 0x88]
mov ecx, esi
push eax
call fcn.004d30d0
mov ecx, esi
call fcn.004d4470
mov ecx, dword [esi + 0x104]
push ebp
mov edx, dword [ecx + 0x1c]
push edx
call sub.IMM32.dll_ImmReleaseContext
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x4d5600
Capabilities:
Log keystrokes via input method manager

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push esi
test eax, eax
mov esi, ecx
mov dword [esp + 4], eax
jne 0x4d5625
mov eax, dword [esi + 0x104]
mov ecx, dword [eax + 0x1c]
push ecx
call sub.IMM32.dll_ImmGetContext
mov dword [esp + 4], eax
push ebx
mov ebx, dword [esp + 8]
push ebp
push edi
push 0
push 0
push 0x800
push ebx
call sub.IMM32.dll_ImmGetCompositionStringW
push 0
push 0
push 0x800
push ebx
mov edi, eax
call sub.IMM32.dll_ImmGetCompositionStringA
mov ebx, eax
test ebx, ebx
jle 0x4d5677
push ebx
call fcn.0058ecf8
mov edx, dword [esp + 0x14]
add esp, 4
mov ebp, eax
push ebx
push ebp
push 0x800
push edx
call sub.IMM32.dll_ImmGetCompositionStringA
push ebp
call fcn.0058ed21
add esp, 4
test edi, edi
jle 0x4d5793
push 0xffffffffffffffff
mov ecx, esi
call fcn.004d5e10
test eax, eax
jne 0x4d5793
push edi
mov dword [esi + 0xe4], edi
call fcn.0058ecf8
add esp, 4
mov ebp, eax
mov eax, dword [esp + 0x10]
push edi
push ebp
push 0x800
push eax
call sub.IMM32.dll_ImmGetCompositionStringW
mov eax, edi
mov dword [esp + 0x14], 0
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x4d574a
mov ebx, ebp
mov dword [esp + 0x18], eax
mov al, byte [esi + 0x121]
test al, al
jne 0x4d5712
mov eax, dword [esi + 0x88]
mov ecx, dword [esi + 0x24]
cmp eax, ecx
jge 0x4d5712
push eax
lea ecx, [esi + 0x1c]
call fcn.004c78d0
mov eax, dword [eax]
mov edx, dword [esi + 0x8c]
mov cx, word [ebx]
mov edi, dword [esi + 0x10]
add eax, edx
push 1
push 0
push eax
push ecx
mov ecx, esi
call fcn.004d3040
cmp edi, eax
je 0x4d573c
jmp 0x4d5726
mov dx, word [ebx]
mov edi, dword [esi + 0x10]
push 0
push edx
mov ecx, esi
call fcn.004d2f30
cmp edi, eax
je 0x4d573c
mov ecx, dword [esi + 0x8c]
mov eax, dword [esp + 0x14]
inc ecx
inc eax
mov dword [esi + 0x8c], ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
add ebx, 2
dec eax
mov dword [esp + 0x18], eax
jne 0x4d56cf
push ebp
call fcn.0058ed21
mov edi, dword [esi + 0x88]
mov eax, dword [esi + 0x24]
add esp, 4
inc edi
cmp edi, eax
jge 0x4d577e
lea ebx, [esi + 0x1c]
push edi
mov ecx, ebx
call fcn.004c78d0
mov ecx, dword [esp + 0x14]
mov edx, dword [eax]
add edx, ecx
inc edi
mov dword [eax], edx
mov eax, dword [esi + 0x24]
cmp edi, eax
jl 0x4d5764
mov edx, dword [esi + 0x88]
mov ecx, esi
push edx
call fcn.004d30d0
mov ecx, esi
call fcn.004d4470
mov eax, dword [esp + 0x20]
pop edi
pop ebp
pop ebx
test eax, eax
jne 0x4d57b2
mov ecx, dword [esi + 0x104]
mov eax, dword [esp + 4]
push eax
mov edx, dword [ecx + 0x1c]
push edx
call sub.IMM32.dll_ImmReleaseContext
pop esi
add esp, 0xc
ret 4
Function at 0x4d5ab0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push 0xffffffffffffffff
call fcn.004d5e10
test eax, eax
jne 0x4d5b86
mov ecx, esi
call fcn.004d43e0
mov ecx, esi
call fcn.004d2ed0
mov ecx, dword [esp + 0x10]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ecx
mov ecx, esi
call fcn.004d4050
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [esi + 0xec]
cmp eax, 0x32
jbe 0x4d5b7f
mov edx, dword [esi + 0xf0]
push edi
push edx
mov ecx, esi
call fcn.004d30d0
mov ecx, esi
call fcn.004d2ed0
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x24]
lea edi, [eax - 1]
mov al, byte [esi + 0x120]
test al, al
jne 0x4d5b45
push edi
lea ecx, [esi + 0x1c]
mov dword [esi + 0x88], edi
call fcn.004c78d0
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
sub ecx, edx
mov dword [esi + 0x8c], ecx
mov edx, dword [esi]
mov ecx, esi
call dword [edx]
mov al, byte [esi + 0x120]
test al, al
jne 0x4d5b5c
mov ecx, esi
call fcn.004d4470
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov dword [esi + 0xf0], edi
call ebx
mov dword [esi + 0xec], eax
mov byte [esi + 0xf4], 0
pop edi
pop esi
pop ebx
pop ecx
ret 4
mov byte [esi + 0xf4], 1
pop esi
pop ebx
pop ecx
ret 4
Function at 0x4d7a70
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
test eax, eax
jg 0x4d7a81
mov eax, 6
pop esi
ret
mov eax, dword [esi + 0x24]
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
push 6
push eax
mov dword [esi + 0x28], 0xfffffffe
call edi
mov ecx, dword [esi + 0x24]
push 4
push ecx
call edi
mov edx, dword [esi + 0x24]
push 0xf
push edx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov eax, dword [esi + 0x24]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetCommMask]
mov eax, dword [esi + 0x28]
mov edi, 0x1e
test eax, eax
je 0x4d7af7
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
dec edi
test edi, edi
jle 0x4d7ada
push 0x64
call ebx
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x4d7aca
mov eax, dword [esi + 0x28]
test eax, eax
je 0x4d7af7
mov ecx, dword [esi + 0x2c]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0xfffffffffffffffe
push ecx
call edi
mov edx, dword [esi + 0x30]
push 0xfffffffffffffffe
push edx
call edi
mov eax, dword [esi + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esi + 0x28], 0xffffffff
call edi
mov ecx, dword [esi + 0x805c]
push ecx
call edi
mov edx, dword [esi + 0x8070]
push edx
call edi
mov eax, dword [esi + 0x2c]
push eax
call edi
mov ecx, dword [esi + 0x30]
push ecx
call edi
pop edi
pop ebx
xor eax, eax
pop esi
ret

Function at 0x4d7be0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xc
test eax, eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
je 0x4d7c53
mov edx, dword [esp + 0x20]
lea edi, [esi + 0x8060]
lea ecx, [esp + 0x24]
push edi
push ecx
push eax
mov eax, dword [esi + 0x24]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4d7c53
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x3e5
jne 0x4d7c85
mov edx, dword [esi + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
lea ecx, [esp + 0x24]
push 1
push ecx
push edi
push edx
call ebx
test eax, eax
jne 0x4d7c53
call ebp
cmp eax, 0x3e4
jne 0x4d7c62
mov ecx, dword [esi + 0x24]
lea eax, [esp + 0x24]
push 1
push eax
push edi
push ecx
call ebx
test eax, eax
je 0x4d7c38
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 8
mov ecx, dword [esi + 0x24]
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 8
mov ecx, dword [esi + 0x24]
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
Function at 0x4dade0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5c9988
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
mov ebp, ecx
push esi
xor ebx, ebx
mov dword [esp + 0x10], ebp
mov esi, dword [ebp + 0xa0]
cmp esi, ebx
mov dword [esp + 0xc], esi
je 0x4daf79
mov eax, dword [ebp + 0x78]
push eax
call dword [sym.imp.USER32.dll_LockWindowUpdate]
mov eax, dword [esi + 8]
cmp eax, 1
lea ecx, [eax + 1]
mov dword [esp + 0x18], ecx
jne 0x4dae34
mov dword [ebp + 0xa8], ebx
cmp ecx, ebx
jle 0x4daf69
push edi
add ebp, 0x5c
push 0
push 0
push 0
push 0
push 0x63f7e8
push ebx
push 1
mov ecx, ebp
call fcn.0058c250
test ebx, ebx
mov esi, eax
je 0x4dae91
mov ecx, dword [esp + 0x10]
lea edi, [ebx + ebx*2]
mov edx, dword [ecx + 4]
lea edi, [edi + edi*8]
shl edi, 1
sub edi, ebx
mov ecx, ebp
shl edi, 2
mov eax, dword [edx + edi - 0xd0]
push eax
push 1
push esi
call fcn.0058c315
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 4]
mov eax, dword [edx + edi - 0x44]
push eax
jmp 0x4daece
lea ecx, [esp + 0x18]
push 0xa2f3
push ecx
call fcn.004ec350
add esp, 8
mov eax, dword [eax]
mov ecx, ebp
push eax
push 1
push esi
mov dword [esp + 0x5c], 0
call fcn.0058c315
lea ecx, [esp + 0x18]
mov dword [esp + 0x50], 0xffffffff
call fcn.005936db
push 0x63f7e8
push 2
push esi
mov ecx, ebp
call fcn.0058c315
lea eax, [ebx - 1]
mov ecx, ebp
push eax
push 0
push 0
push 0
push 0
push 4
push 0
push esi
call fcn.0058c29c
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x20]
xor edx, edx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], esi
lea eax, [ebx - 1]
mov dword [esp + 0x20], 2
mov esi, dword [ecx + 0xa8]
mov dword [esp + 0x28], edx
cmp esi, eax
jne 0x4daf28
cmp dword [ecx + 0xac], edx
jne 0x4daf34
cmp dword [ecx + 0xac], edx
jne 0x4daf3e
cmp ebx, edx
jne 0x4daf3e
mov dword [esp + 0x3c], 1
jmp 0x4daf42
mov dword [esp + 0x3c], edx
mov ecx, dword [ecx + 0x78]
lea eax, [esp + 0x20]
push eax
push edx
push 0x1006
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x1c]
inc ebx
cmp ebx, eax
jl 0x4dae40
mov ebp, dword [esp + 0x14]
pop edi
push 0
call dword [sym.imp.USER32.dll_LockWindowUpdate]
lea ecx, [ebp + 0x5c]
call fcn.00592e45
mov ecx, dword [esp + 0x44]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret

Function at 0x4dc430
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
or eax, 0xffffffff
test ecx, ecx
jle 0x4dc46a
push esi
mov esi, ecx
xor ecx, ecx
mov edi, eax
mov cl, byte [edx]
and edi, 0xff
xor ecx, edi
shr eax, 8
mov ecx, dword [ecx*4 + 0x5e6750]
xor eax, ecx
inc edx
dec esi
jne 0x4dc44b
pop esi
not eax
pop edi
ret
Function at 0x4dc470
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor ecx, ecx
mov eax, 0xffff
test esi, esi
jbe 0x4dc4ab
push ebx
push edi
mov edi, dword [esp + 0x10]
xor edx, edx
mov ebx, eax
mov dl, byte [ecx + edi]
and ebx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, ah
mov ax, word [edx*4 + 0x5e6b50]
xor ax, bx
inc ecx
cmp ecx, esi
jb 0x4dc486
pop edi
pop ebx
not eax
pop esi
ret

Function at 0x4dec30
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5c9ef0
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [esp + 0x40]
push edi
push eax
mov ecx, esi
call fcn.0059b3d8
mov edi, eax
mov eax, dword [esi]
xor ebx, ebx
cmp eax, ebx
je 0x4ded0e
mov byte [esp + 0xc], bl
mov byte [esp + 0x13], bl
lea ecx, [esp + 0x20]
push 0x13
push ecx
push edi
mov dword [esp + 0x48], ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 0x20]
lea ecx, [esp + 0xc]
push edx
call fcn.0040b700
test eax, eax
jne 0x4decdf
lea eax, [esp + 0x4c]
push 0xc998
push eax
call fcn.004ec350
add esp, 8
mov eax, dword [eax]
push ebx
push 0x30
push eax
mov byte [esp + 0x48], 1
call fcn.0059bd71
lea ecx, [esp + 0x4c]
mov byte [esp + 0x3c], bl
call fcn.005936db
mov ecx, esi
call fcn.0059b41e
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0xc
mov esi, dword [esp + 0x4c]
lea ecx, [esp + 0xc]
push 7
push ecx
push esi
call fcn.00573cb0
mov dl, byte [esp + 0x1f]
add esp, 0xc
mov byte [esi + 7], dl
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0xc
mov ecx, dword [esp + 0x4c]
call fcn.0040b820
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
mov ecx, dword [esp + 0x2c]
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0xc
Function at 0x4ded40
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5c9f21
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0xd8
push ebx
push ebp
push esi
mov esi, dword [esp + 0xf4]
push edi
push eax
mov ecx, esi
call fcn.0059b3d8
mov ebp, eax
mov eax, dword [esi]
xor ebx, ebx
cmp eax, ebx
je 0x4dee53
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0x64
mov edi, dword [esp + 0x100]
lea ecx, [esp + 0x14]
mov dword [esp + 0xf0], ebx
mov eax, dword [edi + 4]
push eax
call fcn.0040b8a0
lea ecx, [esp + 0x20]
push 0xc7
push ecx
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 0x20]
lea ecx, [esp + 0x14]
push edx
call fcn.0040baa0
cmp eax, dword [esp + 0x104]
jge 0x4dee11
lea eax, [esp + 0x10]
push 0xc999
push eax
call fcn.004ec350
add esp, 8
mov eax, dword [eax]
push ebx
push 0x30
push eax
mov byte [esp + 0xfc], 1
call fcn.0059bd71
lea ecx, [esp + 0x10]
mov byte [esp + 0xf0], bl
call fcn.005936db
mov ecx, esi
call fcn.0059b41e
jmp 0x4dee1d
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.0040b980
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xf0], 0xffffffff
cmp eax, ebx
je 0x4deecc
mov edx, dword [eax - 4]
lea esi, [eax - 4]
push fcn.00425060
push edx
push 0x12
push eax
call fcn.00573a14
push esi
call fcn.0058ed21
add esp, 4
jmp 0x4deecc
mov eax, dword [0x639698]
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0x100]
xor esi, esi
mov dword [esp + 0xf0], 2
mov eax, dword [edi]
cmp eax, ebx
jle 0x4deeac
xor ecx, ecx
cmp esi, eax
setge cl
dec ecx
and ecx, esi
mov eax, ecx
lea edx, [eax + eax*8]
mov eax, dword [edi + 8]
lea ecx, [eax + edx*2]
call fcn.0040b820
push eax
lea ecx, [esp + 0x14]
call fcn.00593ab7
push 0x20
lea ecx, [esp + 0x14]
call fcn.00593ade
mov eax, dword [edi]
inc esi
cmp esi, eax
jl 0x4dee76
mov ecx, dword [esp + 0x10]
push ecx
push ebp
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea ecx, [esp + 0x10]
mov dword [esp + 0xf0], 0xffffffff
call fcn.005936db
mov ecx, dword [esp + 0xe8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xe4
ret 0x10
Function at 0x4dfb00
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5ca04b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
push esi
push str..cwt
lea eax, [esp + 8]
push 0x664810
push eax
call fcn.00593970
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push edx
mov dword [esp + 0x158], 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
setne al
test eax, eax
je 0x4dfb84
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test dword [esp + 0xc], 0x1356
jne 0x4dfb77
lea eax, [esp + 0x38]
push eax
call fcn.004df4e0
add esp, 4
lea ecx, [esp + 0xc]
push ecx
push esi
call edi
test eax, eax
jne 0x4dfb60
pop edi
push 0x623638
call fcn.004def80
add esp, 4
test eax, eax
pop esi
jne 0x4dfbce
push eax
push 0x30
push str.Cannot_load_ENG.cwt__MixW_will_now_exit.
call fcn.0059bd71
lea ecx, [esp]
mov dword [esp + 0x14c], 0xffffffff
call fcn.005936db
xor eax, eax
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
add esp, 0x150
ret
lea ecx, [esp]
mov dword [esp + 0x14c], 0xffffffff
call fcn.005936db
mov ecx, dword [esp + 0x144]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x150
ret
Function at 0x4e2e80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ca2a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push esi
lea ecx, [esp + 0x2c]
call fcn.00595172
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], 0
call fcn.00593cce
mov eax, dword [0x639698]
mov dword [esp + 0x28], eax
mov esi, 0x5f2934
push 0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], 2
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0xffffffff
call fcn.00593864
mov ecx, dword [esp + 0x50]
push 0
push 0
push ecx
lea ecx, [esp + 0x38]
mov byte [esp + 0x54], 3
call fcn.005951e7
test eax, eax
je 0x4e30c1
mov eax, dword [0x639698]
push ebx
mov dword [esp + 0x54], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea edx, [esp + 0x54]
mov bl, 6
push edx
lea ecx, [esp + 0x34]
mov byte [esp + 0x50], bl
call fcn.005953ca
test eax, eax
je 0x4e305c
push 0x3b
lea ecx, [esp + 0x58]
call fcn.00593ba2
test eax, eax
jl 0x4e2f6c
push eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x5c]
call fcn.0058a9cd
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x50], 7
call fcn.00593814
lea ecx, [esp + 0x10]
mov byte [esp + 0x4c], bl
call fcn.005936db
lea ecx, [esp + 0x54]
call fcn.00593bfd
push 0x3a
lea ecx, [esp + 0x58]
call fcn.00593ba2
mov esi, eax
cmp esi, 2
jl 0x4e3041
lea ecx, [esp + 0x14]
push esi
push ecx
lea ecx, [esp + 0x5c]
call fcn.0058a9cd
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x50], 8
call fcn.00593814
lea ecx, [esp + 0x14]
mov byte [esp + 0x4c], bl
call fcn.005936db
lea ecx, [esp + 0xc]
call fcn.0058af50
lea ecx, [esp + 0xc]
call fcn.0058ae9c
lea ecx, [esp + 0xc]
call fcn.00593bfd
inc esi
lea edx, [esp + 0x18]
push esi
push edx
lea ecx, [esp + 0x5c]
call fcn.0058a898
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x50], 9
call fcn.00593814
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c], bl
call fcn.005936db
lea ecx, [esp + 8]
call fcn.0058af50
lea ecx, [esp + 8]
call fcn.0058ae9c
lea ecx, [esp + 8]
call fcn.00593bfd
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4e3041
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx - 8]
test edx, edx
je 0x4e3041
push eax
push ecx
mov ecx, 0x6645f8
call fcn.0058e414
mov ecx, eax
call fcn.00593864
lea eax, [esp + 0x54]
lea ecx, [esp + 0x30]
push eax
call fcn.005953ca
test eax, eax
jne 0x4e2f32
mov esi, 0x5f2934
lea ecx, [esp + 8]
mov byte [esp + 0x4c], 5
call fcn.005936db
lea ecx, [esp + 0xc]
mov byte [esp + 0x4c], 4
call fcn.005936db
lea ecx, [esp + 0x54]
mov byte [esp + 0x4c], 3
call fcn.005936db
mov dword [esp + 0x1c], esi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x4c], 0xa
call fcn.005936db
lea ecx, [esp + 0x30]
mov dword [esp + 0x4c], 0xffffffff
call fcn.005951a4
pop ebx
mov eax, 1
pop esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
add esp, 0x48
ret 4
mov dword [esp + 0x18], esi
lea ecx, [esp + 0x28]
mov byte [esp + 0x48], 0xb
call fcn.005936db
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xffffffff
call fcn.005951a4
mov ecx, dword [esp + 0x40]
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x48
ret 4
Function at 0x4e5aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5ca763
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
push edi
mov edi, ecx
mov ebp, dword [edi + 8]
sub esp, 0x18
mov esi, esp
lea eax, [esp + 0x38]
mov dword [esp + 0x24], esp
push eax
mov ecx, esi
mov dword [esp + 0x34], 0
mov dword [esp + 0x28], esi
call fcn.00593450
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 1
push ecx
lea ecx, [esi + 4]
call fcn.00593450
mov edx, dword [esp + 0x40]
mov byte [esp + 0x30], 2
mov dword [esi + 8], edx
mov al, byte [esp + 0x44]
mov byte [esi + 0xc], al
mov ecx, dword [esp + 0x48]
lea edx, [esp + 0x4c]
mov dword [esi + 0x10], ecx
push edx
lea ecx, [esi + 0x14]
call fcn.00593450
push ebp
mov ecx, edi
mov byte [esp + 0x34], 0
call fcn.004e6700
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x18], 5
test ecx, ecx
je 0x4e5b3c
mov eax, dword [ecx]
push 1
call dword [eax + 4]
lea ecx, [esp + 0x34]
mov byte [esp + 0x18], 4
call fcn.005936db
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], 3
call fcn.005936db
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.005936db
mov ecx, dword [esp + 0x10]
pop edi
mov eax, ebp
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x10
ret 0x18
Function at 0x4e99f0
Capabilities:
Create thread
Terminate thread

Disassembly:
mov eax, dword fs:[0]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
push 0x5cad8b
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0xa8
mov edx, dword [esp + 0xc0]
mov dword [0x664664], ecx
push esi
push edi
lea ecx, [esp + 8]
xor edi, edi
push ecx
push edi
push 0x664660
mov dword [0x664660], eax
mov eax, dword [esp + 0xd8]
push 0x4e9b30
push edi
push edi
mov dword [0x664668], edx
mov dword [0x66466c], eax
mov dword [0x664670], edi
mov dword [0x66467c], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, edi
je 0x4e9b0f
push edi
lea ecx, [esp + 0x10]
call fcn.00541d50
mov edx, dword [str.Sending_QSL_s__to_eQSL.cc]
lea ecx, [esp + 0xa4]
push edx
mov dword [esp + 0xbc], edi
mov dword [esp + 0xac], 0x4e9c40
mov dword [esp + 0xb0], edi
call fcn.00593864
lea ecx, [esp + 0xc]
call fcn.0058f2cb
cmp dword [0x664670], edi
jne 0x4e9ab8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
cmp dword [0x664674], edi
jne 0x4e9afb
cmp dword [0x664670], edi
je 0x4e9afb
mov esi, dword [0x664678]
lea ecx, [esp + 0xc]
mov dword [esp + 0xb8], 0xffffffff
call fcn.00541e10
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
add esp, 0xb4
ret
lea ecx, [esp + 0xc]
mov dword [esp + 0xb8], 0xffffffff
call fcn.00541e10
mov ecx, dword [esp + 0xb0]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0xb4
ret