joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479740
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp + 0x84], eax
push esi
push edi
push 1
push 0x1f4
mov esi, ecx
call fcn.004aa454
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x47977a
xor eax, eax
jmp 0x47985a
push 5
pop eax
push eax
push 0x10
mov dword [edi + 8], eax
call fcn.004aa454
test eax, eax
pop ecx
pop ecx
mov dword [edi], eax
jne 0x479799
push edi
call fcn.004aa2a8
pop ecx
jmp 0x479773
and dword [edi + 4], 0
and dword [edi + 0xc], 0
push ebx
mov ebx, dword [0x614d74]
test ebx, ebx
jne 0x4797b9
call fcn.0046aaee
mov ebx, eax
mov dword [0x614d74], ebx
push edi
call fcn.0046aba0
xor eax, eax
cmp dword [0x614d74], eax
pop ecx
jne 0x4797dd
push dword [edi]
call fcn.004aa2a8
push edi
call fcn.004aa2a8
pop ecx
pop ecx
xor eax, eax
jmp 0x479859
cmp esi, eax
je 0x479817
mov ebx, 0x103
push ebx
push eax
mov byte [ebp - 0x80], al
lea eax, [ebp - 0x7f]
push eax
call fcn.004ab5d0
push esi
mov ecx, ebx
lea eax, [ebp - 0x80]
call fcn.00476b6c
mov esi, eax
call fcn.00476e69
mov eax, esi
push eax
push 0x18
lea eax, [edi + 0x10]
pop ecx
call fcn.00476b6c
add esp, 0x14
mov eax, dword [ebp + 0x90]
mov dword [edi + 0x2c], eax
call fcn.0049c471
lea ebx, [edi + 0x34]
push str..StringList.c
push ebx
mov dword [edi + 0x30], eax
call fcn.0041ebbf
pop ecx
pop ecx
mov esi, str.A_String_List_handle_had_to_be_forced_to_unlock___
mov eax, ebx
call fcn.0041edba
mov eax, 0x7d0
mov ecx, ebx
call fcn.0041ede3
mov eax, edi
call fcn.0047b14b
mov eax, edi
pop ebx
mov ecx, dword [ebp + 0x84]
pop edi
xor ecx, ebp
pop esi
call fcn.004aaeb5
add ebp, 0x88
leave
ret
Function at 0x47b2d9
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, 0x200
lea esi, [ebx - 1]
push esi
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x203]
push 0
push eax
mov byte [ebp - 0x204], 0
call fcn.004ab5d0
mov eax, dword [ebp + 0x10]
add esp, 0xc
test eax, eax
je 0x47b40d
cmp byte [eax], 0
je 0x47b40d
lea ecx, [ebp + 0x14]
push ecx
push eax
lea edi, [ebp - 0x204]
push esi
mov eax, edi
push eax
jmp 0x47b374
lea eax, [ebp - 0x204]
cmp edi, eax
je 0x47b34f
push edi
call fcn.004aa2a8
pop ecx
add ebx, ebx
lea eax, [ebx + 0xa]
push eax
push 1
call fcn.004aa454
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x47b40d
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebx - 1]
push eax
push edi
call fcn.004ac225
add esp, 0x10
cmp eax, 0xffffffff
je 0x47b33e
mov eax, edi
call fcn.0047cae3
push edi
call fcn.004aa880
cmp dword [ebp + 0xc], 0
pop ecx
mov ebx, eax
jbe 0x47b3ad
cmp dword [ebp + 0xc], 0x7ffffffe
ja 0x47b3a5
push dword [ebp + 0xc]
jmp 0x47b3a7
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x208]
mov eax, esi
call fcn.0047babc
test eax, eax
je 0x47b3fc
push 0x2ca
mov eax, esi
call fcn.0047ea3d
test eax, eax
pop ecx
je 0x47b3fc
push 0
push ebx
push edi
push dword [esi + 0xacc]
call sub.WSOCK32.dll_send
mov ebx, eax
mov eax, esi
call fcn.0047ea7f
lea eax, [ebp - 0x204]
cmp edi, eax
je 0x47b3f8
push edi
call fcn.004aa2a8
pop ecx
mov eax, ebx
jmp 0x47b40f
lea eax, [ebp - 0x204]
cmp edi, eax
je 0x47b40d
push edi
call fcn.004aa2a8
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aaeb5
leave
ret
Function at 0x47bb34
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, edi
call fcn.0047babc
test eax, eax
je 0x47bcaa
mov eax, dword [ebp + 8]
test eax, eax
je 0x47bcaa
cmp byte [eax], 0
je 0x47bcaa
mov ebx, dword [edi + 0xa8c]
push 1
push 0x2c
call fcn.004aa454
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x47bcaa
push 0x2c
push 0
push esi
call fcn.004ab5d0
add esp, 0xc
push 2
push dword [ebp + 8]
call fcn.004aa880
pop ecx
add eax, 0xa
push eax
call fcn.004aa454
test eax, eax
pop ecx
pop ecx
mov dword [esi + 4], eax
je 0x47bca3
mov eax, edi
call fcn.0047babc
test eax, eax
je 0x47bca3
push 0x881
mov eax, edi
call fcn.0047ea3d
test eax, eax
pop ecx
je 0x47bca3
mov ecx, dword [edi + 0xa88]
xor edx, edx
mov eax, ebx
div ecx
mov eax, dword [edi + 0xa84]
test edx, edx
jne 0x47bbe5
mov ebx, dword [eax + ecx*4 - 4]
jmp 0x47bbe9
mov ebx, dword [eax + edx*4 - 4]
cmp dword [ebp + 0xc], 0
jne 0x47bbf2
inc ebx
jmp 0x47bc03
call fcn.0049c471
cmp ebx, eax
jbe 0x47bc00
sub ebx, eax
add dword [ebp + 0xc], ebx
mov ebx, dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call fcn.004aa9a0
mov eax, dword [esi + 4]
pop ecx
pop ecx
call fcn.0047cae3
push dword [ebp + 8]
push dword [esi + 4]
call fcn.004aa880
pop ecx
mov ecx, dword [esi + 4]
lea eax, [eax + ecx + 1]
push eax
call fcn.004aa9a0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
pop ecx
xor ebx, ebx
pop ecx
mov dword [esi], edi
mov dword [esi + 0x18], ebx
jmp 0x47bc4d
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [edi + 0xaa8], ebx
jne 0x47bc45
mov dword [edi + 0xaa8], 1
lea eax, [edi + 0xad0]
jmp 0x47bc69
mov eax, ecx
mov ecx, dword [eax + 0x28]
cmp ecx, ebx
jne 0x47bc67
mov ebx, dword [0x614f94]
test ebx, ebx
mov dword [eax + 0x28], esi
jne 0x47bc8a
call fcn.0046aaee
mov ebx, eax
mov dword [0x614f94], ebx
push esi
call fcn.0046aba0
and dword [edi + 0xaa8], 0
pop ecx
mov eax, edi
call fcn.0047ea7f
mov eax, esi
jmp 0x47bcac
push esi
call fcn.004aa2a8
pop ecx
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x47c139
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
test esi, esi
je 0x47c278
push edi
push 1
push 0x20
call fcn.004aa454
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x47c277
push ebx
push 0x20
push 0
push edi
call fcn.004ab5d0
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [edi + 0x14], eax
add esp, 0xc
mov eax, ebx
mov dword [edi + 4], ebx
mov dword [edi + 0x10], esi
call fcn.0047babc
test eax, eax
je 0x47c26d
push 0xb2e
mov eax, ebx
call fcn.0047ea3d
test eax, eax
pop ecx
je 0x47c26d
cmp dword [0x614f9c], 0
jne 0x47c1b9
call fcn.0046aaee
test eax, eax
mov dword [0x614f9c], eax
je 0x47c26d
push 0xb3e
push str..TelNet.c
push edi
push 0x47ce93
mov esi, str.TelNetCreateConditionID
push 0x3f70
mov ecx, esi
call fcn.0041cd43
mov ebx, eax
test ebx, ebx
jne 0x47c208
push 0xb43
push str..TelNet.c
push edi
push 0x47ce93
push eax
mov ecx, esi
call fcn.0041cd43
mov ebx, eax
test ebx, ebx
jne 0x47c208
mov eax, dword [ebp + 8]
call fcn.0047ea7f
jmp 0x47c274
push dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
call fcn.00477430
mov esi, dword [ebp + 8]
push eax
push dword [ebp + 0x10]
push edi
push esi
push str.Called_for__p_HTELNET___p_Condition__from__s___in___s__line_d.
push ebx
call fcn.0041cf47
add esp, 0x1c
mov dword [edi + 8], ebx
mov dword [edi], ebx
lea eax, [esi + 0xaac]
jmp 0x47c239
mov eax, ecx
mov ecx, dword [eax + 0x1c]
test ecx, ecx
jne 0x47c237
mov dword [eax + 0x1c], edi
lea eax, [esi + 0xac4]
inc dword [eax]
cmp dword [eax], 0xc
jle 0x47c255
call fcn.0049c471
mov ebx, dword [0x614f9c]
push edi
call fcn.0046aba0
pop ecx
mov eax, esi
call fcn.0047ea7f
mov eax, edi
jmp 0x47c276
push edi
call fcn.004aa2a8
pop ecx
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x47c8cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
push esi
mov ebx, eax
jge 0x47c8e0
and dword [ebp + 8], 0
test ebx, ebx
jge 0x47c8e6
xor ebx, ebx
cmp dword [ebp + 8], ebx
jg 0x47c933
mov eax, edi
call fcn.0047babc
test eax, eax
je 0x47c933
push 0xe15
mov eax, edi
call fcn.0047ea3d
test eax, eax
pop ecx
je 0x47c933
mov eax, dword [edi + 0xf4]
cmp dword [ebp + 8], eax
jle 0x47c915
mov dword [ebp + 8], eax
cmp ebx, eax
jle 0x47c91b
mov ebx, eax
push 1
push 0x10
call fcn.004aa454
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x47c939
mov eax, edi
call fcn.0047ea7f
xor eax, eax
pop esi
pop ebx
pop ebp
ret
push 0x10
push 0
push esi
call fcn.004ab5d0
lea eax, [edi + 0xdc]
mov dword [esi], edi
mov cx, word [eax]
imul cx, word [ebp + 8]
add esp, 0xc
inc ebx
mov word [esi + 4], cx
imul bx, word [eax]
mov ax, cx
dec bx
and word [esi + 8], 0
mov word [esi + 0xa], ax
mov word [esi + 6], bx
lea eax, [edi + 0xafc]
jmp 0x47c97b
mov eax, ecx
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x47c979
mov ebx, dword [0x614f98]
test ebx, ebx
mov dword [eax + 0xc], esi
jne 0x47c99c
call fcn.0046aaee
mov ebx, eax
mov dword [0x614f98], ebx
push esi
call fcn.0046aba0
pop ecx
mov eax, edi
call fcn.0047ea7f
mov eax, esi
jmp 0x47c935
Function at 0x47d1ad
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor esi, esi
mov word [ebp - 0x68], si
lea edi, [ebp - 0x66]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x18e
stosw word es:[edi], ax
lea eax, [ebp - 0x1f6]
push esi
push eax
mov ebx, ecx
mov word [ebp - 0x1f8], si
call fcn.004ab5d0
push 0x4f
lea eax, [ebp - 0x57]
push esi
push eax
mov byte [ebp - 0x1f9], 0
mov byte [ebp - 0x58], 0
call fcn.004ab5d0
add esp, 0x18
mov edx, ebx
call fcn.00476b3a
test eax, eax
je 0x47d21b
or eax, 0xffffffff
jmp 0x47d391
push 0x10
lea eax, [ebp - 0x68]
push esi
push eax
call fcn.004ab5d0
add esp, 0xc
lea eax, [ebp - 0x1f8]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x47d213
cmp dword [ebp + 8], esi
jle 0x47d24d
cmp dword [ebp + 8], 0x10000
jl 0x47d255
call fcn.0047b8b1
mov dword [ebp + 8], eax
push 0x50
lea eax, [ebp - 0x58]
push eax
push ebx
call fcn.00440d3c
add esp, 0xc
test eax, eax
jne 0x47d29e
push ebx
call sub.WSOCK32.dll_gethostbyname
cmp eax, esi
jne 0x47d279
call sub.WSOCK32.dll_WSACleanup
jmp 0x47d213
cmp word [eax + 0xa], 4
jle 0x47d286
mov word [eax + 0xa], 4
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x64]
push eax
call fcn.004aaed0
add esp, 0xc
jmp 0x47d2a9
lea ecx, [ebp - 0x58]
call fcn.00440c64
mov dword [ebp - 0x64], eax
push 6
push 1
push 2
call sub.WSOCK32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
je 0x47d272
push dword [ebp + 8]
call sub.WSOCK32.dll_htons
mov word [ebp - 0x66], ax
push 0x10
lea eax, [ebp - 0x68]
push eax
push edi
mov word [ebp - 0x68], 2
call sub.WSOCK32.dll_connect
test eax, eax
je 0x47d308
push edi
call sub.WSOCK32.dll_closesocket
call sub.WSOCK32.dll_WSACleanup
push str.127.0.0.1
push ebx
call fcn.004777c9
test eax, eax
pop ecx
pop ecx
jne 0x47d213
inc dword [0x61510c]
jmp 0x47d213
push 1
lea eax, [ebp - 0x1f9]
push eax
push 8
push 0xffff
push edi
mov byte [ebp - 0x1f9], 1
call sub.WSOCK32.dll_setsockopt
cmp dword [ebp + 0xc], esi
je 0x47d38f
push esi
push 0xfb
mov esi, 0xff
push esi
push edi
call fcn.0047d3d4
push 1
lea ebx, [esi - 2]
push ebx
push esi
push edi
call fcn.0047d3d4
push 0
push ebx
push esi
push edi
call fcn.0047d3d4
push 0x1f
push 0xfb
push esi
push edi
call fcn.0047d3d4
add esp, 0x40
push 0x1f
push 0xfa
push esi
push edi
call fcn.0047d3d4
push 0
push 0x50
push 0
push edi
call fcn.0047d3d4
push 0xf0
push esi
push 0x19
push edi
call fcn.0047d3d4
add esp, 0x30
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aaeb5
leave
ret
Function at 0x47e9d3
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x20]
mov eax, dword [ebp + 8]
call fcn.0047ea0e
test eax, eax
pop ecx
jne 0x47e9eb
push 2
pop eax
pop ebp
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.0047ea2e
mov eax, edx
pop ebp
ret
Function at 0x49d1a7
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
xor esi, esi
lea eax, [ebp - 0x10f]
push esi
push eax
mov byte [ebp - 0x110], 0
call fcn.004ab5d0
add esp, 0xc
push 0x13c
lea eax, [ebp - 0x24c]
push esi
push eax
mov dword [ebp - 0x250], esi
call fcn.004ab5d0
xor eax, eax
mov word [ebp - 0x278], si
lea edi, [ebp - 0x276]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x268], si
xor eax, eax
lea edi, [ebp - 0x266]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosw word es:[edi], ax
call fcn.0049c471
sub eax, dword [0x618340]
cmp eax, 0x493e0
jae 0x49d237
xor eax, eax
jmp 0x49d36c
call fcn.0049c471
mov dword [0x618340], eax
call fcn.0049c88a
test eax, eax
je 0x49d230
push 0x617b08
mov ecx, 0x104
lea eax, [ebp - 0x110]
call fcn.00476b6c
pop ecx
call fcn.00476eac
push str.PAULATempTimeDetectionFile
push 0x4e11dc
push eax
call fcn.00478138
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x258], eax
je 0x49d230
mov ebx, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp + 8]
push eax
call ebx
mov dword [ebp - 0x254], esi
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x24c]
jg 0x49d2db
lea eax, [ebp - 0x23c]
push eax
call ebx
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x268]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
lea esi, [ebp - 0x278]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0049bbbe
add esp, 0x20
cmp eax, 0xdbba0
jle 0x49d33f
lea eax, [ebp - 0x110]
call fcn.00476eac
lea eax, [ebp - 0x224]
push eax
mov eax, 0x104
lea esi, [ebp - 0x110]
call fcn.00476c3c
pop ecx
mov eax, esi
call fcn.0041a140
test eax, eax
je 0x49d33f
inc dword [ebp - 0x254]
lea eax, [ebp - 0x250]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x49d2b0
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aaeb5
leave
ret
Function at 0x49dd1c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
and word [esp + 4], 0
mov edx, dword [ebp + 8]
push ebx
mov ebx, eax
push esi
push edi
xor eax, eax
lea edi, [esp + 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.00476b3a
test eax, eax
je 0x49dd4b
xor eax, eax
jmp 0x49dda9
test ebx, ebx
mov esi, str..Time.c
jne 0x49dd6f
push 0xb92
lea eax, [esp + 0x14]
push esi
push eax
call fcn.0049ce66
add esp, 0xc
test eax, eax
je 0x49dd47
lea ebx, [esp + 0x10]
mov ecx, dword [ebp + 8]
push 0xb9a
push esi
mov edx, 0x4c9338
call fcn.0041c646
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x49dd47
push edi
push 1
push 0x10
push ebx
call fcn.004aa5f2
add esp, 0x10
mov esi, eax
dec esi
neg esi
sbb esi, esi
mov ecx, edi
inc esi
call fcn.0041ca73
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49ddb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov word [esp + 0x10], bx
lea edi, [esp + 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x49dde1
push 0x10
push ebx
push edi
call fcn.004ab5d0
add esp, 0xc
mov edx, dword [ebp + 0xc]
call fcn.00476b3a
test eax, eax
je 0x49ddf1
xor eax, eax
jmp 0x49de4c
mov ecx, dword [ebp + 0xc]
push 0xbba
push str..Time.c
mov edx, 0x4c91fc
call fcn.0041c646
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x49dded
push 0x10
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.004ab5d0
push esi
push 1
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.004ab915
add esp, 0x1c
mov ebx, eax
dec ebx
neg ebx
sbb ebx, ebx
mov ecx, esi
inc ebx
call fcn.0041ca73
test edi, edi
je 0x49de4a
lea esi, [esp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49e1e6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x20], ebx
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
cmp eax, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [0x6183c0], eax
je 0x49e220
call fcn.0049c471
mov dword [0x6183c4], eax
jmp 0x49e236
call fcn.0049c471
sub eax, dword [0x6183c4]
cmp eax, 0xde
jb 0x49e302
cmp dword [0x6183c0], ebx
jne 0x49e302
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x49e2ea
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
cmp dword [ebp - 8], ebx
jne 0x49e275
call fcn.0040a9fc
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x49e2ed
cmp dword [ebp - 4], ebx
jne 0x49e2ed
lea eax, [ebp - 0x20]
push eax
call fcn.0040a9fc
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 6
call esi
push 4
mov edi, eax
call esi
add eax, dword [ebp - 0x1c]
push 0xfffffffffffffffd
lea ecx, [eax + edi + 3]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
pop edi
cdq
idiv edi
mov dword [ebp - 0x1c], ecx
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
jle 0x49e2e1
cmp eax, dword [ebp - 0x18]
jge 0x49e2e1
cmp dword [ebp - 0xc], ecx
jle 0x49e2e1
push 0xf
call esi
add eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xc], eax
jge 0x49e2e1
mov dword [0x6183a4], 1
call fcn.0049c471
mov dword [0x6183a8], eax
jmp 0x49e2ed
mov dword [ebp - 4], 1
jmp 0x49e2ed
mov dword [ebp - 4], ebx
push 0x16
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x6183c0], ebx
je 0x49e249
pop esi
pop edi
xor eax, eax
pop ebx
leave
ret 4
Function at 0x4a4168
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
mov byte [ebp - 0x110], bl
call fcn.004ab5d0
add esp, 0xc
push str.Live.ark
lea edi, [ebp - 0x110]
call fcn.004411d9
pop ecx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x124]
mov edx, edi
call fcn.004024e1
test eax, eax
pop ecx
jne 0x4a41e4
xor eax, eax
jmp 0x4a42bf
call fcn.0049c471
push ebx
push ebx
mov dword [ebp - 0x128], eax
call fcn.0045ac28
push eax
lea eax, [ebp - 0x110]
push str._sLUA.DAT
push eax
call fcn.004ab54e
add esp, 0x14
mov dword [ebp - 0x114], ebx
push 0x2e6
push str..UpdatePAULA2.c
mov edx, 0x4c91fc
lea ecx, [ebp - 0x110]
call fcn.0041c646
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
jne 0x4a4270
lea edi, [ebp - 0x110]
call fcn.0041a629
test eax, eax
je 0x4a42bc
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0049c471
sub eax, dword [ebp - 0x128]
cmp eax, 0x157c
ja 0x4a42bc
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 0xf
jl 0x4a4211
jmp 0x4a42bc
push esi
push 1
lea eax, [ebp - 0x11c]
push 4
push eax
call fcn.004ab915
push esi
push 1
lea eax, [ebp - 0x120]
push 4
push eax
call fcn.004ab915
add esp, 0x20
mov ecx, esi
call fcn.0041ca73
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x120]
jne 0x4a42bc
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x11c]
je 0x4a41dd
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aaeb5
leave
ret

Function at 0x4a42ce
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x110], bl
call fcn.004ab5d0
add esp, 0xc
mov edx, esi
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
call fcn.00476b3a
test eax, eax
je 0x4a4321
xor eax, eax
jmp 0x4a43e5
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x11c]
mov edx, esi
call fcn.004024e1
test eax, eax
pop ecx
je 0x4a431a
call fcn.0049c471
push ebx
push ebx
mov edi, eax
call fcn.0045ac28
push eax
lea eax, [ebp - 0x110]
push str._sLUA.DAT
push eax
call fcn.004ab54e
add esp, 0x14
mov dword [ebp - 0x114], ebx
push 0x327
push str..UpdatePAULA2.c
mov edx, 0x4c9338
lea ecx, [ebp - 0x110]
call fcn.0041c646
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
jne 0x4a43b6
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0049c471
sub eax, edi
cmp eax, 0x157c
ja 0x4a431a
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 0xf
jl 0x4a4363
jmp 0x4a431a
push esi
push 1
lea eax, [ebp - 0x118]
push 4
push eax
call fcn.004aa5f2
push esi
push 1
lea eax, [ebp - 0x11c]
push 4
push eax
call fcn.004aa5f2
add esp, 0x20
mov ecx, esi
call fcn.0041ca73
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aaeb5
leave
ret