joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b4320
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x5d60bb
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x629560]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov eax, dword [esp + 0x98]
mov ebp, dword [esp + 0x90]
mov ecx, dword [eax]
push edx
push eax
lea eax, [ebp + 4]
mov dword [ebp + 0x34], ecx
mov ecx, dword [esp + 0x9c]
push eax
call fcn.004b30f0
push 8
call fcn.004d3c8b
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x4b4386
mov dword [eax], ebx
mov dword [eax + 4], ebx
jmp 0x4b4388
xor eax, eax
mov esi, dword [esp + 0x9c]
mov edi, eax
mov dword [ebp + 0x28], eax
call fcn.004b3c80
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 0xa4]
push 8
mov dword [ebp + 0x2c], ecx
mov dword [ebp + 0x30], edx
call fcn.004d3c8b
add esp, 4
cmp eax, ebx
je 0x4b43c2
mov dword [eax], ebx
mov dword [eax + 4], ebx
jmp 0x4b43c4
xor eax, eax
push 0x14
mov dword [ebp + 0x24], eax
call fcn.004d3c8b
add esp, 4
mov esi, eax
cmp esi, ebx
je 0x4b43f1
push ebx
push ebx
push ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x10], eax
jmp 0x4b43f3
xor esi, esi
lea eax, [esp + 0x98]
push eax
push ebx
push ebp
push 0x4b44a0
push ebx
mov dword [esp + 0x9c], 0xffffffff
push ebx
mov dword [ebp + 0x48], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [ebp], eax
jne 0x4b4479
mov eax, 0xf
mov dword [esp + 0x1c], vtable.CUDTException.0
mov dword [esp + 0x20], 3
mov dword [esp + 0x24], 1
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], ebx
mov byte [esp + 0x30], bl
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
mov dword [esp + 0x7c], eax
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x61a010
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x30], eax
call fcn.004fa66b
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x78
ret 0x18

Function at 0x4b7980
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x629560]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
mov eax, edx
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4b79c7
sub eax, esi
mov ecx, eax
test ecx, ecx
jle 0x4b79ef
push 0
push ecx
lea esi, [esp + 0x10]
lea eax, [ecx*8]
push esi
call fcn.004ba650
add esp, 0xc
lea esi, [esp + 8]
call fcn.004ba700
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
call fcn.004f2719
add esp, 0x64
ret
Function at 0x4b7c10
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x90
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov esi, ecx
mov edi, eax
mov eax, dword [esi + 8]
push 2
push eax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
jne 0x4b7c9e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
mov ecx, 0xf
mov dword [esp + 0x34], vtable.CUDTException.0
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
mov dword [esp + 0x78], ecx
mov dword [esp + 0x74], ebx
mov byte [esp + 0x64], bl
mov dword [esp + 0x94], ecx
mov dword [esp + 0x90], ebx
mov byte [esp + 0x80], bl
jne 0x4b7c8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x61a010
lea ecx, [esp + 0x38]
push ecx
mov dword [esp + 0x48], eax
call fcn.004fa66b
cmp edi, ebx
je 0x4b7ceb
mov ecx, dword [esi + 8]
sub ecx, 2
neg ecx
sbb ecx, ecx
and ecx, 0xc
add ecx, 0x10
push ecx
push edi
push eax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x4b7ddd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov ecx, 3
mov eax, 1
lea esi, [esp + 0x34]
call fcn.004b7370
push 0x61a010
mov edx, esi
push edx
call fcn.004fa66b
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [0x649b58]
cmp eax, ebx
mov dword [esp + 0x14], 1
mov dword [esp + 0x1c], 2
jne 0x4b7d38
push ebx
call fcn.004ae220
mov dword [0x649b58], eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push str.0123456789_:
push ebx
call eax
mov edi, eax
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
cmp edi, ebx
je 0x4b7d7f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov ecx, 3
mov eax, 1
lea esi, [esp + 0x34]
call fcn.004b7370
push 0x61a010
mov eax, esi
push eax
call fcn.004fa66b
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x18]
mov eax, dword [esi + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x4b7dc1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov ecx, 3
mov eax, 1
lea esi, [esp + 0x34]
call fcn.004b7370
push 0x61a010
mov ecx, esi
push ecx
call fcn.004fa66b
mov eax, dword [0x649b5c]
cmp eax, ebx
mov edi, dword [esp + 0x10]
jne 0x4b7dda
push 2
call fcn.004ae220
mov dword [0x649b5c], eax
push edi
call eax
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x90
jmp fcn.004b7df0
Function at 0x4b7df0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x68
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, eax
mov ecx, dword [esi + 0xc]
push 4
lea eax, [esi + 0x14]
push eax
push 0x1002
push 0xffff
push ecx
call edi
test eax, eax
jne 0x4b7e80
mov eax, dword [esi + 0xc]
push 4
lea edx, [esi + 0x10]
push edx
push 0x1001
push 0xffff
push eax
call edi
test eax, eax
jne 0x4b7e80
mov edx, dword [esi + 0xc]
push 4
lea ecx, [esp + 0xc]
push ecx
push 0x1006
push 0xffff
push edx
mov dword [esp + 0x1c], 1
call edi
test eax, eax
je 0x4b7ee7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
mov ecx, 3
mov eax, 1
lea esi, [esp + 0xc]
call fcn.004b7370
push 0x61a010
mov eax, esi
push eax
call fcn.004fa66b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
cmp eax, 0xffffffff
mov edx, 0xf
mov dword [esp + 0xc], vtable.CUDTException.0
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 3
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], ecx
mov byte [esp + 0x20], cl
mov dword [esp + 0x50], edx
mov dword [esp + 0x4c], ecx
mov byte [esp + 0x3c], cl
mov dword [esp + 0x6c], edx
mov dword [esp + 0x68], ecx
mov byte [esp + 0x58], cl
jne 0x4b7ed4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x61a010
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x20], eax
call fcn.004fa66b
pop edi
pop esi
add esp, 0x68
ret

Function at 0x4b7ef0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ecx
mov ecx, dword [eax + 8]
sub ecx, 2
neg ecx
sbb ecx, ecx
and ecx, 0xc
add ecx, 0x10
lea edx, [esp]
push edx
mov edx, dword [eax + 0xc]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0xc]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_getsockname]
pop ecx
ret 4
Function at 0x4b7f20
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
test dword [esi + 0x14], 0x80000000
push ebx
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_htonl]
push edi
je 0x4b7f61
mov eax, dword [esi + 0x2c]
cdq
and edx, 3
add eax, edx
mov ebx, eax
sar ebx, 2
xor edi, edi
test ebx, ebx
jle 0x4b7f61
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + edi*4]
push edx
call ebp
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
mov dword [edx + edi*4], eax
add edi, 1
cmp edi, ebx
jl 0x4b7f47
lea edi, [esi + 0x14]
mov ebx, 4
lea esp, [esp]
mov eax, dword [edi]
push eax
call ebp
mov dword [edi], eax
add edi, 4
sub ebx, 1
jne 0x4b7f70
mov ecx, dword [esi + 0x2c]
mov edx, dword [esp + 0x18]
add ecx, 0x10
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 8]
sub eax, 2
neg eax
push 0
sbb eax, eax
push 0
and eax, 0xc
add eax, 0x10
push eax
push edx
push 0
lea eax, [esp + 0x20]
push eax
mov eax, dword [ecx + 0xc]
push 2
lea edx, [esi + 0x24]
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSASendTo]
test eax, eax
jne 0x4b7fcc
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
jmp 0x4b7fd4
mov dword [esp + 0x14], 0xffffffff
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
lea edi, [esi + 0x14]
mov ebx, 4
mov edx, dword [edi]
push edx
call ebp
mov dword [edi], eax
add edi, 4
sub ebx, 1
jne 0x4b7fe2
test dword [esi + 0x14], 0x80000000
je 0x4b802a
mov eax, dword [esi + 0x2c]
cdq
and edx, 3
add eax, edx
mov ebx, eax
sar ebx, 2
xor edi, edi
test ebx, ebx
jle 0x4b802a
mov edi, edi
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + edi*4]
push edx
call ebp
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
mov dword [edx + edi*4], eax
add edi, 1
cmp edi, ebx
jl 0x4b8010
mov eax, dword [esp + 0x14]
pop edi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x4b8040
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x66c
mov eax, dword [0x629560]
xor eax, esp
mov dword [esp + 0x668], eax
push ebx
push ebp
push edi
mov edi, ecx
mov ebx, edx
jmp 0x4b8060
mov ecx, dword [edi + 8]
mov eax, dword [esi + 0x2c]
sub ecx, 2
push 0
add eax, 0x10
neg ecx
push 0
sbb ecx, ecx
and ecx, 0xc
lea edx, [esp + 0x18]
push edx
mov edx, dword [edi + 0xc]
push ebx
add ecx, 0x10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x20]
push ecx
push 2
lea ebp, [esi + 0x24]
push ebp
push edx
mov dword [esp + 0x38], 0
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
test eax, eax
jne 0x4b8141
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x4b8141
mov ecx, dword [esi + 0xc]
cmp dword [ecx], 0xfed8d0e6
jne 0x4b815f
cmp eax, 0x10
jb 0x4b815f
mov edx, dword [edi + 0xc]
mov eax, dword [ebx]
mov ebp, dword [ebp]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x18], edx
mov edx, dword [ebx + 8]
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x28], edx
mov edx, dword [esi + 0x28]
push ebp
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x28], ecx
call fcn.004ff920
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x30]
push ecx
push edx
lea eax, [esp + ebp + 0x48]
push eax
call fcn.004ff920
mov ecx, dword [esp + 0x24]
mov edx, dword [edi + 4]
push edx
lea eax, [esp + 0x34]
mov dword [esp + 0x4c], ecx
mov ecx, dword [edi]
push eax
call ecx
add esp, 0x20
jmp 0x4b8060
pop edi
or eax, 0xffffffff
pop ebp
mov dword [esi + 0x2c], eax
pop ebx
mov ecx, dword [esp + 0x668]
xor ecx, esp
call fcn.004f2719
add esp, 0x66c
ret
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
add eax, 0xfffffff0
mov dword [esi + 0x2c], eax
lea edi, [esi + 0x14]
mov ebx, 4
mov edx, dword [edi]
push edx
call ebp
mov dword [edi], eax
add edi, 4
sub ebx, 1
jne 0x4b8173
test dword [esi + 0x14], 0x80000000
je 0x4b81ba
mov eax, dword [esi + 0x2c]
cdq
and edx, 3
add eax, edx
mov ebx, eax
sar ebx, 2
xor edi, edi
test ebx, ebx
jle 0x4b81ba
nop
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + edi*4]
push edx
call ebp
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
mov dword [edx + edi*4], eax
add edi, 1
cmp edi, ebx
jl 0x4b81a0
mov ecx, dword [esp + 0x674]
mov eax, dword [esi + 0x2c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f2719
add esp, 0x66c
ret
Function at 0x4bb010
Capabilities:
Encode data using xor

Disassembly:
push ecx
cmp eax, 0x20
push esi
jg 0x4bb0c3
mov esi, 1
mov ecx, eax
shl esi, cl
cmp edx, esi
jae 0x4bb0c3
mov ecx, 0x20
sub ecx, eax
xor esi, esi
shl edx, cl
mov ecx, esi
shl ecx, 0x18
mov eax, ecx
sar eax, 0x1f
add ecx, ecx
and eax, edx
xor eax, ecx
mov ecx, eax
sar ecx, 0x1f
and ecx, edx
add eax, eax
xor ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, ecx
and eax, edx
xor eax, ecx
mov ecx, eax
sar ecx, 0x1f
and ecx, edx
add eax, eax
xor ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, ecx
and eax, edx
xor eax, ecx
mov ecx, eax
sar ecx, 0x1f
and ecx, edx
add eax, eax
xor ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, ecx
and eax, edx
xor eax, ecx
mov ecx, eax
sar ecx, 0x1f
and ecx, edx
add eax, eax
xor ecx, eax
mov dword [esp + 4], ecx
mov eax, dword [esp + 4]
bswap eax
mov dword [esp + 4], eax
mov ecx, dword [esp + 4]
mov dword [edi + esi*4], ecx
add esi, 1
cmp esi, 0x100
jl 0x4bb037
mov dword [edi + 0x400], 1
xor eax, eax
pop esi
pop ecx
ret
or eax, 0xffffffff
pop esi
pop ecx
ret

Function at 0x4d68c6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x4d690c
call fcn.004d8c67
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4d690c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x4d694f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x4d6938
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4d6938
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4d694c
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4e04ce
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4e0507
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0041c660
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00453b40
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]
Function at 0x4e20d3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x4e2116
call fcn.004d8c67
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4e2116
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4e2131
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.004e1c8a
test ebx, ebx
mov esi, eax
je 0x4e212f
test edi, edi
je 0x4e212f
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4e30e2
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
jne 0x4e30eb
xor eax, eax
jmp 0x4e3154
cmp dword [esp + 8], 0
jne 0x4e30f7
call fcn.004d633a
push edi
push dword [esi + 0x10]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call fcn.004f612a
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4e3132
push dword [esi + 0x10]
call fcn.004faf3d
test eax, eax
pop ecx
jne 0x4e3132
mov esi, dword [esi + 0xc]
call fcn.004fa312
push esi
push dword [eax]
push 1
call fcn.004e2f46
push dword [esi + 0x10]
call fcn.004faf6c
test eax, eax
pop ecx
je 0x4e3151
push dword [esi + 0x10]
call fcn.004fae91
push eax
call fcn.00404000
pop ecx
pop ecx
jmp 0x4e3120
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x4e315d
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
jne 0x4e3167
call fcn.004d633a
push dword [esi + 0x10]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.004f64af
add esp, 0x10
cmp eax, dword [esp + 0xc]
je 0x4e3194
mov esi, dword [esi + 0xc]
call fcn.004fa312
push esi
push dword [eax]
push 1
call fcn.004e2f46
pop esi
ret 8

Function at 0x4e629d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4e62cb
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4e62e9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004e6207
jmp 0x4e62e9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4e62e9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004e6207
test edi, edi
mov eax, edi
jne 0x4e62d3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x62f7f0]
test ecx, ecx
je 0x4e63ac
jmp 0x4e629c
ret 8

Function at 0x4f2719
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x629560]
jne 0x4f2723
repz ret
jmp fcn.004fc00f
Function at 0x50907f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004fd448
xor ebx, ebx
cmp dword [0x630314], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x509154
push 0x5ddf90
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x5090bf
xor eax, eax
jmp 0x509218
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5ddf84
push edi
call esi
cmp eax, ebx
je 0x5090b8
push eax
call fcn.004fd3e5
mov dword [esp], 0x5ddf74
push edi
mov dword [0x630314], eax
call esi
push eax
call fcn.004fd3e5
mov dword [esp], 0x5ddf60
push edi
mov dword [0x630318], eax
call esi
push eax
call fcn.004fd3e5
mov dword [0x63031c], eax
lea eax, [ebp - 8]
push eax
call fcn.004f76a6
test eax, eax
pop ecx
pop ecx
je 0x509122
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004f3feb
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x509154
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004fd3e5
cmp eax, ebx
pop ecx
mov dword [0x630324], eax
je 0x509154
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004fd3e5
pop ecx
mov dword [0x630320], eax
mov eax, dword [0x630320]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x5091cd
cmp dword [0x630324], esi
je 0x5091cd
push eax
call fcn.004fd451
pop ecx
call eax
cmp eax, ebx
je 0x50919a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x630324]
call fcn.004fd451
pop ecx
call eax
test eax, eax
je 0x50919a
test byte [ebp - 0x18], 1
jne 0x5091cd
lea eax, [ebp - 0xc]
push eax
call fcn.004f76dd
test eax, eax
pop ecx
je 0x5091b5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004f3feb
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x5091c4
or dword [ebp + 0x10], 0x200000
jmp 0x5091fe
or dword [ebp + 0x10], 0x40000
jmp 0x5091fe
mov eax, dword [0x630318]
cmp eax, esi
je 0x5091fe
push eax
call fcn.004fd451
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x5091fe
mov eax, dword [0x63031c]
cmp eax, esi
je 0x5091fe
push dword [ebp - 4]
push eax
call fcn.004fd451
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x630314]
call fcn.004fd451
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5680f2
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x629560]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00568087
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004f9810
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x568141
cmp dword [ebp - 0x1c], 5
jb 0x568159
jmp 0x568155
cmp dword [ebp - 0x10], 1
jne 0x568159
cmp dword [ebp - 0x1c], 4
ja 0x568155
jne 0x568159
cmp dword [ebp - 0x18], 0
jbe 0x568159
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x5e4630
call fcn.00567f78
test eax, eax
jge 0x56817a
mov byte [0x6321ac], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004f2719
add ebp, 0x78
leave
ret

Function at 0x5683f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esi + 0x15c]
push edi
push 0x5e4ea0
push eax
call fcn.004f5eba
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 8], edi
je 0x5684d0
mov ecx, dword [esi + 0x18f8]
mov eax, dword [ecx + 0x18]
imul eax, dword [esi + 0xc]
imul eax, dword [esi + 0x10]
lea eax, [eax + eax*2]
cdq
sub eax, edx
sar eax, 1
cdq
push 0
push edx
push eax
push edi
call fcn.005c51c9
mov edx, dword [esi + 0x18f8]
xor ecx, ecx
add esp, 0x10
cmp dword [edx + 0x2c], ecx
mov dword [esp + 4], ecx
jle 0x5684c7
mov eax, dword [esi + 0x10]
push ebx
push ebp
mov ebp, 0x60
xor ebx, ebx
xor edi, edi
test ecx, ecx
setne bl
mov edx, eax
mov ecx, ebx
sar edx, cl
test edx, edx
jle 0x5684a8
jmp 0x568470
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x18f8]
mov edx, dword [esi + 0xc]
push ecx
mov ecx, ebx
sar edx, cl
mov ecx, dword [eax + ebp - 0x30]
imul ecx, edi
add ecx, dword [eax + ebp]
push edx
push 1
push ecx
call fcn.004f64af
mov eax, dword [esi + 0x10]
mov edx, eax
mov ecx, ebx
sar edx, cl
add edi, 1
add esp, 0x10
cmp edi, edx
jl 0x568470
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x18f8]
add ecx, 1
add ebp, 4
cmp ecx, dword [edx + 0x2c]
mov dword [esp + 0xc], ecx
jl 0x568458
mov edi, dword [esp + 0x10]
pop ebp
pop ebx
push edi
call fcn.004f61b8
add esp, 4
pop edi
add esp, 8
ret
Function at 0x56ea50
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push 0x60d0d8
push eax
call fcn.004f5eba
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x56ea6b
pop ebx
ret
push esi
push edi
push 2
push 0
push 0
push ebx
call fcn.005c51c9
xor ecx, ecx
test eax, eax
setl cl
push ebx
mov esi, ecx
call fcn.005c5536
push 0
push 0
push 0
push ebx
mov edi, eax
call fcn.005c51c9
xor edx, edx
add esp, 0x24
test eax, eax
setl dl
xor eax, eax
test edi, edi
setle al
or edx, eax
or esi, edx
jne 0x56eb0c
push ebp
lea ebp, [edi + 2]
lea ecx, [ebp + 0x17]
push ecx
call fcn.004f2b9f
lea esi, [eax + 0x17]
push ebx
mov edx, esi
and edx, 0xf
sub esi, edx
push edi
push 1
push esi
mov dword [esi - 4], eax
mov dword [esi - 8], ebp
call fcn.004f612a
xor ecx, ecx
add esp, 0x14
cmp eax, edi
setne cl
cmp byte [esi + edi - 1], 0xa
mov ebp, ecx
je 0x56eaee
mov byte [esi + edi], 0xa
add edi, 1
push ebx
mov byte [esi + edi], 0
call fcn.004f61b8
add esp, 4
test ebp, ebp
pop ebp
je 0x56eb12
mov edx, dword [esi - 4]
push edx
call fcn.004f2965
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebx
ret