joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e72a
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
sub al, byte [esi + 3]
shr byte [ebx], 1
mov cl, 0xce
sbb byte [ecx - 0x2ac0a317], al
add bh, dh
rol cl, 1
invalid

Function at 0x43fea0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi + 4]
cmp eax, 0x200
jne 0x43ff5c
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
jne 0x43ff9f
mov eax, dword [esi]
mov dword [esp], eax
call method.IWindow.findWindow_HWND___
mov ebx, eax
test eax, eax
je 0x43ff9f
mov ecx, eax
call method.IWindow.getTopParent__
mov ecx, eax
test eax, eax
je 0x43ff9f
mov eax, dword [eax]
mov dword [esp], 0x68
call dword [eax + 0x5c]
mov dword [ebp - 0x2c], eax
push edx
test eax, eax
je 0x43ff9f
mov eax, dword [esi + 0xc]
lea edi, [ebp - 0x20]
mov ecx, edi
mov dword [esp], eax
call method.Point.Point_long_
push ecx
mov ecx, ebx
mov dword [esp], edi
call method.IWindow.toScreen_Point_const_
mov ecx, dword [ebp - 0x2c]
push ebx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], edx
mov dword [esp], eax
call method.IWindow.fromScreen_Point_const_
mov ecx, dword [ebp - 0x2c]
push esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov dword [esp], edi
call fcn.0043eb7e
or eax, edx
push edi
je 0x43ff9f
mov ecx, dword [ebp - 0x2c]
call method.IWindow.captureCursor__
jmp 0x43ffe8
and eax, 0xfffffffb
cmp eax, 0x100
jne 0x43ff9f
cmp dword [0x568b50], 0
je 0x43ff9f
mov dword [esp], 0x12
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
push edx
test ax, ax
js 0x43ff9f
mov eax, dword [esi + 8]
cmp eax, 0x73
je 0x43ffd9
ja 0x43ff9a
cmp eax, 2
je 0x43ffd9
cmp eax, 9
je 0x43ffa3
jmp 0x43ff9f
cmp eax, 0x75
je 0x43ffb2
xor eax, eax
jmp 0x43ffea
mov dword [esp], 0x11
call edi
push ebx
test ax, ax
jns 0x43ff9f
mov ecx, dword [0x568b50]
mov dword [esp], 0x10
mov dword [ebp - 0x2c], ecx
call edi
mov ecx, dword [ebp - 0x2c]
push edx
cwde
not eax
shr eax, 0x1f
mov dword [esp], eax
call fcn.0043fdc6
push ecx
jmp 0x43ffe8
test bl, bl
jne 0x43ff9f
mov ecx, dword [0x568b50]
call fcn.0043de84
mov al, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x445bc0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x2c
call method.IWindow.getHandle__
mov dword [esp], eax
call dword [sym.imp.USER32.dll_OpenClipboard]
push edi
test eax, eax
je 0x445cb4
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x445cae
mov eax, dword [esi + 0x30]
mov ebx, dword [esi + 0x2c]
lea ecx, [ebp - 0x20]
cmp eax, ebx
mov edi, ebx
cmovbe edi, eax
cmovae ebx, eax
call fcn.004c6580
mov eax, dword [esi + 0x20]
lea edx, [esi + 0x1c]
cmp ebx, dword [eax]
jne 0x445c1c
mov dword [esp + 8], 0xffffffff
jmp 0x445c24
mov eax, ebx
sub eax, edi
mov dword [esp + 8], eax
mov dword [esp], edx
lea ecx, [ebp - 0x1c]
mov dword [esp + 4], edi
call fcn.004c6ff0
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x20]
sub esp, 0xc
mov dword [esp], eax
call fcn.004c69a8
lea ecx, [ebp - 0x1c]
push ebx
call fcn.004c641a
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [esp], 0x2000
inc eax
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push esi
push esi
test eax, eax
je 0x445ca6
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ecx
test eax, eax
je 0x445ca6
mov esi, dword [ebp - 0x20]
mov edi, eax
mov edx, dword [esi]
add esi, 4
lea ecx, [edx + 1]
rep movsb byte es:[edi], byte [esi]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push eax
mov dword [esp + 4], ebx
mov dword [esp], 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push edx
push edx
lea ecx, [ebp - 0x20]
call fcn.004c641a
call dword [sym.imp.USER32.dll_CloseClipboard]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x446ec8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, ecx
sub esp, 0x20
mov esi, dword [ebp + 8]
cmp esi, 0x41
jne 0x446f0c
mov dword [esp], 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
push ecx
test ax, ax
jns 0x446f0c
mov eax, dword [ebx]
mov dword [esp + 4], 0xffffffff
mov ecx, ebx
mov dword [esp], 0
call dword [eax + 0x108]
mov al, 1
push edx
push edx
jmp 0x446f65
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov edx, dword [eax - 0xc]
add edx, ebx
mov dword [esp], edx
call sym.winbox.exe_createMsgEvent_IBase__unsigned_int__long_
lea ecx, [ebp - 0xc]
mov dword [esp], eax
call fcn.005197e4
push eax
call sym.winbox.exe_getWindowNotifier__
mov edx, dword [ebp - 0xc]
mov ecx, eax
mov eax, dword [eax]
mov dword [esp + 8], 0
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x100
mov dword [esp], ebx
call dword [eax + 0x14]
lea ecx, [ebp - 0xc]
sub esp, 0x10
call fcn.00444d72
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x459320
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov edi, dword [eax]
cmp dword [ecx + 0xfc], edi
jne 0x459355
mov esi, dword [eax + 4]
cmp dword [ecx + 0x100], esi
jne 0x459355
mov eax, dword [ecx + 0xdc]
sub esi, dword [ecx + 0xe4]
cmp esi, eax
jge 0x459368
jmp 0x459386
mov edx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebx + 0x100], edx
mov dword [ebx + 0xfc], eax
jmp 0x4593c9
add eax, 0x1d
cmp esi, eax
jg 0x459386
mov ecx, dword [ecx + 0x110]
or esi, 0xffffffff
mov eax, dword [ecx]
call dword [eax + 0xc8]
test eax, eax
jne 0x4593d5
jmp 0x4593f5
mov dword [esp], ebx
lea ecx, [ebp - 0x28]
call fcn.00455602
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
sub eax, 0x1e
push ecx
cmp esi, eax
jl 0x4593c9
mov ecx, dword [ebx + 0x110]
mov eax, dword [ecx]
call dword [eax + 0xc8]
mov esi, dword [ebx + 0xbc]
mov ecx, ebx
mov edi, eax
call fcn.004559dc
sub esi, eax
cmp edi, esi
je 0x4593f5
mov esi, 1
jmp 0x4593d5
mov dword [ebx + 0x104], 0
jmp 0x4593f5
cmp dword [ebx + 0x104], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x4593fc
call eax
mov dword [ebx + 0x108], 0
mov dword [ebx + 0x104], eax
xor eax, eax
jmp 0x45947c
call eax
mov edx, eax
sub edx, dword [ebx + 0x104]
cmp edx, 0x12b
jbe 0x4593f5
mov dword [ebx + 0x104], eax
mov eax, dword [ebx + 0x108]
cmp eax, 7
ja 0x459432
cmp eax, 3
ja 0x45942d
cmp eax, 1
jbe 0x459435
add esi, esi
jmp 0x459435
shl esi, 2
jmp 0x459435
shl esi, 3
inc eax
mov dword [esp + 4], 0xffffffff
mov ecx, ebx
mov dword [ebx + 0x108], eax
mov dword [esp], 0xffffffff
call fcn.004584fa
push edx
push edx
test al, al
je 0x45945f
mov ecx, ebx
call method.IWindow.update__
mov dword [esp + 8], 0
mov ecx, ebx
mov dword [esp + 4], esi
mov dword [esp], 0xffffffff
call fcn.00458670
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x464fa0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
lea eax, [ebp - 0x1c]
mov esi, edx
push ebx
mov ebx, ecx
sub esp, 0x3c
mov dword [esp + 4], eax
mov eax, dword [edi]
mov dword [esp + 8], 0xa
add eax, 4
mov dword [esp], eax
call sub.msvcrt.dll_strtol
imul eax, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov al, byte [eax]
test al, al
jne 0x464fe3
mov eax, dword [ebp - 0x30]
mov cl, 1
mov dword [esi], eax
jmp 0x46504b
cmp ebx, 1
seta cl
cmp al, 0x2e
sete al
and cl, al
jne 0x464ff6
xor ecx, ecx
jmp 0x46504b
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov dword [ebp - 0x1c], edx
movsx eax, byte [eax + 1]
test al, al
je 0x465033
cmp ebx, 1
jbe 0x465033
sub eax, 0x30
cmp eax, 9
ja 0x464ff2
imul edx, dword [ebp - 0x2c], 0xa
add eax, edx
xor edx, edx
mov dword [ebp - 0x2c], eax
mov eax, ebx
mov ebx, 0xa
div ebx
mov ebx, eax
jmp 0x464ffd
mov eax, dword [edi]
imul ebx, dword [ebp - 0x2c]
cmp dword [eax], 0
je 0x465046
cmp byte [eax + 4], 0x2d
jne 0x465046
neg ebx
add ebx, dword [ebp - 0x30]
mov dword [esi], ebx
add esp, 0x3c
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a1e80
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x2c
mov eax, dword [ecx + 8]
cmp eax, 1
je 0x4a1ea0
sub eax, 2
cmp eax, 1
jbe 0x4a1ed4
jmp 0x4a1fa6
mov dword [esp], str.receiving_data...
lea esi, [ebp - 0x1c]
mov ecx, esi
call fcn.004c664a
mov ecx, ebx
push edi
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.004a1c1a
mov ecx, esi
push eax
push eax
call fcn.004c641a
mov dword [ebx + 8], 2
cmp dword [ebp + 8], 0
jne 0x4a1ee6
mov eax, dword [ebp + 0xc]
jmp 0x4a1f41
mov dword [ebx + 8], 2
cmp dword [ebx + 8], 2
lea esi, [ebx + 0x4c]
jne 0x4a1f5a
lea edx, [ebx + 0x10]
xor eax, eax
mov ecx, 9
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [ebx + 0xc]
mov dword [ebx + 0xc], 0x28
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], 0x1000
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x3c]
mov dword [esp], eax
call dword [sym.imp.WININET.DLL_InternetReadFileExA]
sub esp, 0x10
test eax, eax
jne 0x4a1f5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4a1f51
mov dword [esp], eax
mov ecx, ebx
call fcn.004a1e0e
push ebx
jmp 0x4a1fd1
mov dword [ebx + 8], 3
jmp 0x4a1fd1
mov eax, dword [ebx]
mov edx, dword [ebx + 0x24]
mov ecx, ebx
mov dword [esp], esi
mov dword [esp + 4], edx
call dword [eax + 4]
push ecx
push ecx
cmp dword [ebx + 0x24], 0
jne 0x4a1edf
mov dword [esp], 0x527275
lea esi, [ebp - 0x1c]
mov ecx, esi
call fcn.004c664a
mov ecx, ebx
push eax
mov dword [esp], esi
mov dword [esp + 4], 0
call fcn.004a1c1a
mov ecx, esi
push edx
push edx
call fcn.004c641a
jmp 0x4a1fd1
mov dword [esp + 4], str.onCompletion_in_wrong_state
mov dword [esp], 0x569500
call fcn.004c8bb5
mov edx, dword [ebx + 8]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004c8d08
mov dword [esp], eax
call fcn.004c8fa3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x4a2012
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, ecx
sub esp, 0x30
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
test eax, eax
je 0x4a20b6
mov ecx, dword [ecx + 0x48]
cmp ecx, 0xffffffff
je 0x4a2096
lea esi, [ebp - 0x10]
mov dword [ebp - 0x10], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
jne 0x4a20df
mov dword [esp], str.failed:_couldnt_write_file_to_disk
lea esi, [ebp - 0xc]
mov ecx, esi
call fcn.004c664a
mov ecx, ebx
push eax
mov dword [esp], esi
mov dword [esp + 4], 0xffffffff
call fcn.004a1c1a
mov ecx, esi
push eax
push eax
call fcn.004c641a
mov ecx, ebx
call fcn.004a1dd0
jmp 0x4a20df
mov dword [esp], edx
lea esi, [ebp - 0xc]
mov dword [esp + 4], eax
mov ecx, esi
call fcn.004c663a
push ecx
push ecx
lea ecx, [ebx + 0x44]
mov dword [esp], esi
call fcn.004c67c8
jmp 0x4a20d7
lea eax, [ecx + 0x44]
lea esi, [ebp - 0xc]
mov dword [esp], eax
mov ecx, esi
call fcn.004c65c6
mov ecx, ebx
push edx
call fcn.004a1dd0
mov eax, dword [ebx]
mov dword [esp], esi
mov ecx, ebx
call dword [eax]
push eax
mov ecx, esi
call fcn.004c641a
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 8
Function at 0x4a24b6
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ecx + 0x3c]
mov dword [ebp - 0x10], 0
test eax, eax
je 0x4a24fb
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], 4
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 8], edx
mov dword [esp + 4], 0x20000005
mov dword [esp], eax
call dword [sym.imp.WININET.DLL_HttpQueryInfoA]
sub esp, 0x14
mov eax, dword [ebp - 0x10]
leave
ret

Function at 0x4a28ee
Capabilities:
Read file on windows

Disassembly:
push ebp
mov eax, 0x1020
mov ebp, esp
push esi
push ebx
call fcn.004cba40
sub esp, eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x5274d9
mov eax, dword [eax]
add eax, 4
mov dword [esp], eax
call sub.msvcrt.dll_fopen
test eax, eax
je 0x4a2977
lea esi, [ebp - 0x1008]
mov dword [esp + 0xc], eax
mov ebx, eax
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.msvcrt.dll_fread
mov dword [esp], esi
lea ecx, [ebp - 0x100c]
add eax, esi
mov dword [esp + 4], eax
call fcn.004c6680
push eax
push eax
lea eax, [ebp - 0x100c]
call fcn.004a2861
lea ecx, [ebp - 0x100c]
call fcn.004c641a
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov al, 1
jmp 0x4a2995
mov dword [esp + 4], str.file_does_not_exist
mov dword [esp], 0x569500
call fcn.004c8bb5
mov dword [esp], eax
call fcn.004c8fa3
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4a3298
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x20]
push ebx
mov ebx, ecx
mov ecx, esi
sub esp, 0x3c
call fcn.00427bc0
mov eax, dword [ebx]
mov dword [esp], 0x8fe0001
mov ecx, esi
mov dword [esp + 4], eax
call fcn.004289ae
push ecx
push ecx
mov ecx, esi
mov dword [esp], 0x30000003
call fcn.00428876
mov byte [ebp - 0x1c], 0
push edi
mov edi, eax
lea eax, [ebp - 0x1c]
mov ecx, edi
mov dword [esp + 4], eax
mov dword [esp], 0x7da8
call fcn.004c7732
push eax
push eax
lea eax, [ebp - 0x1c]
mov edx, dword [edi]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [edi + 4]
mov dword [esp + 4], edx
sub eax, edx
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x18]
shl eax, 4
add eax, dword [ebx + 0x10]
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x4a3330
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x21]
mov ecx, edi
mov byte [ebp - 0x21], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.004c7732
mov edx, dword [ebx + 0x24]
mov ecx, esi
push eax
push eax
mov eax, dword [ebp - 0x1c]
add dword [ebx + 0x20], eax
add edx, eax
mov eax, dword [ebx + 0x18]
mov dword [ebx + 0x24], edx
shl eax, 4
add eax, dword [ebx + 0x10]
cmp dword [eax + 8], edx
mov dword [esp], 4
sete al
movzx eax, al
mov dword [esp + 4], eax
call fcn.00428984
push edx
push edx
call sym.winbox.exe_getGlobalHandler__
mov edx, dword [ebx + 0xc]
mov ecx, eax
mov eax, dword [eax]
mov dword [esp + 8], esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0x52773c
mov dword [esp], 2
call dword [eax + 0x5c]
mov ecx, esi
sub esp, 0x14
call fcn.0042861a
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a3ffc
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov eax, 0x403c
mov ebp, esp
push edi
push esi
push ebx
call fcn.004cba40
xor esi, esi
sub esp, eax
mov ebx, ecx
call fcn.004a3f56
mov edx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x1c]
sub eax, edx
sar eax, 2
imul eax, eax, 0xaaaaaaab
cmp esi, eax
jae 0x4a409f
imul ecx, esi, 0xc
mov eax, dword [edx + ecx + 4]
mov dword [ebp - 0x402c], ecx
add eax, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x4020]
mov ecx, dword [ebp - 0x402c]
push edi
lea edi, [ebp - 0x4019]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 0x18]
mov dword [esp + 8], edi
mov dword [esp + 4], 0x4000
mov eax, dword [eax + ecx + 4]
add eax, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
sub esp, 0x10
test eax, eax
je 0x4a4099
mov eax, dword [ebp - 0x4020]
test eax, eax
je 0x4a408f
mov byte [eax], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push ecx
inc esi
jmp 0x4a4017
mov dword [esp], 0x4ce8d4
lea ecx, [ebx + 0x20]
call fcn.004c8338
lea eax, [ebx + 0x18]
mov edi, dword [ebx + 0x18]
push edx
mov dword [ebp - 0x402c], eax
mov eax, dword [ebx + 0x1c]
mov esi, edi
cmp eax, esi
je 0x4a40e4
lea ecx, [esi + 4]
mov dword [ebp - 0x4030], eax
call fcn.004c641a
mov ecx, esi
add esi, 0xc
call fcn.004c641a
mov eax, dword [ebp - 0x4030]
jmp 0x4a40c0
sub eax, edi
mov dword [esp], edi
mov ecx, dword [ebp - 0x402c]
shr eax, 2
imul eax, eax, 0x2aaaaaab
and eax, 0x3fffffff
imul eax, eax, 0xc
add eax, edi
mov dword [esp + 4], eax
call fcn.004c7410
mov ecx, dword [ebp - 0x402c]
push eax
push eax
call fcn.004c732a
lea ecx, [ebx + 0x10]
call fcn.004a30b4
lea ecx, [ebx + 0xc]
call fcn.004a30c6
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a7ece
Capabilities:
Get local ipv4 addresses

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x8038
call fcn.004cba40
sub esp, eax
lea ebx, [ebp - 0x8018]
mov eax, dword [esp + eax]
mov dword [esp + 0xc], ebx
mov esi, eax
lea eax, [ebp - 0x8020]
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x10
mov dword [esp], 2
mov dword [ebp - 0x8020], 0x8000
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
sub esp, 0x14
test eax, eax
jne 0x4a7f78
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x4a7f71
mov edx, dword [eax + 0xc]
mov ecx, dword [eax + 0x14]
xor eax, eax
mov edi, dword [edx + 4]
xor edx, edx
cmp edx, ecx
je 0x4a7f4c
shr eax, 1
inc edx
or eax, 0x80000000
jmp 0x4a7f3e
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htonl]
mov ecx, esi
push edx
not eax
or eax, edi
mov dword [ebp - 0x801c], eax
lea eax, [ebp - 0x801c]
mov dword [esp], eax
call fcn.0050c9d4
push ecx
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4a7f27
mov eax, dword [esi + 4]
cmp dword [esi], eax
jne 0x4a7f9a
lea eax, [ebp - 0x801c]
mov ecx, esi
mov dword [ebp - 0x801c], 0xffffffff
mov dword [esp], eax
call fcn.0050c9d4
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a8146
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x454]
push ebx
mov ebx, ecx
sub esp, 0x4ac
mov dword [ecx + 0x54], 0xffffffff
mov ecx, esi
mov dword [esp], 6
mov dword [ebp - 0x54], 4
mov dword [ebp - 0x454], 0
call fcn.004a789e
mov eax, dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x480], 2
push ecx
mov dword [ebp - 0x48c], eax
mov dword [esp], 0x162e
call eax
mov dword [ebp - 0x47c], 0xffffffff
push edi
mov word [ebp - 0x47e], ax
lea eax, [ebp - 0x480]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x54]
mov dword [esp + 0x14], 0x10
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x3c]
mov dword [esp + 0xc], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_sendto]
sub esp, 0x18
test eax, eax
jg 0x4a81f4
mov dword [esp], str.sendto_old
call sub.msvcrt.dll_perror
mov eax, dword [ebx + 0x48]
mov edi, dword [ebx + 0x44]
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], edi
je 0x4a823c
mov eax, dword [ebp - 0x54]
mov dword [esp + 0xc], 0
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov eax, dword [edi]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
test eax, eax
jg 0x4a8237
mov eax, str.sendto
call fcn.004a77a4
add edi, 4
jmp 0x4a8200
cmp dword [ebx + 0x40], 0xffffffff
je 0x4a82d1
mov word [ebp - 0x470], 0x17
mov eax, dword [ebp - 0x48c]
lea edi, [ebp - 0x468]
mov dword [esp], 0x162e
call eax
mov ecx, 0xf
mov byte [ebp - 0x459], 1
push edx
lea edx, [ebp - 0x470]
mov word [ebp - 0x46e], ax
xor eax, eax
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x54]
mov word [ebp - 0x468], 0x2ff
mov dword [ebp - 0x458], 0
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x40]
mov dword [esp + 0x14], 0x1c
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_sendto]
sub esp, 0x18
test eax, eax
jg 0x4a82d1
mov eax, str.sendto6
call fcn.004a77a4
inc dword [ebx + 0x60]
jne 0x4a8311
mov dword [esp + 4], 0x514d78
mov dword [esp + 8], 0
mov dword [esp], ebx
call fcn.004cdfcc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x64
call sym.winbox.exe_addTimer_unsigned_int__EventListener__void__bool_
mov dword [ebx + 0x54], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a88cf
Capabilities:
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x440
mov dword [esp + 0x10], 0x568ec0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 0x14
test eax, eax
jns 0x4a89a1
mov dword [esp + 4], 0x104
mov dword [esp], 0x568ec0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push eax
push eax
mov dword [esp + 4], str.AppData
mov dword [esp], 0x568ec0
call sub.msvcrt.dll_strcat
mov dword [esp], 0x568ec0
call esi
inc eax
push edx
jne 0x4a89a1
mov dword [esp + 4], 0
mov dword [esp], 0x568ec0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebx
push ebx
test eax, eax
jne 0x4a89a1
mov dword [esp + 4], str.couldnt_make_directory
mov dword [esp], 0x569500
call fcn.004c8bb5
mov dword [esp + 4], 0x568ec0
mov dword [esp], eax
call fcn.004c8bb5
mov dword [esp], eax
call fcn.004c8fa3
mov ecx, dword [ebp + 8]
call fcn.004c6580
jmp 0x4a8a1d
lea ebx, [ebp - 0x426]
mov dword [esp + 8], 0x568ec0
mov dword [esp + 4], str._sMikrotik
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
call esi
inc eax
push edx
jne 0x4a89db
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ecx
push ecx
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x21c]
mov dword [esp + 4], str._sWinbox
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp], ebx
call esi
inc eax
push edx
jne 0x4a8a11
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
push esi
mov dword [esp], ebx
mov ecx, dword [ebp + 8]
call fcn.004c664a
push ecx
mov eax, dword [ebp + 8]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret