joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f355
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 0x10

Function at 0x48f431
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
call fcn.0047f4e3
mov edi, eax
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0047fa00
test eax, eax
jne 0x48f620
inc dword [ebx + 0x1d4]
lea eax, [ebx + 0x4c]
push esi
xor esi, esi
mov dword [ebp - 4], eax
push esi
push esi
push 0x1004
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x48f550
mov ebx, esi
mov ecx, dword [ebp - 4]
push ebx
call fcn.0046ffd5
mov ecx, dword [ebp - 4]
mov esi, eax
push ebx
call fcn.0046feae
push esi
mov ecx, edi
mov dword [ebp - 8], eax
call fcn.0047f40b
mov ecx, eax
call fcn.004682df
push dword [ebp - 8]
mov esi, eax
mov ecx, esi
call fcn.00469396
mov ecx, esi
call fcn.00467e12
cmp eax, 3
jne 0x48f4c6
push 0
mov ecx, esi
call fcn.004693a6
cmp dword [ebp - 8], 0
je 0x48f516
mov ecx, esi
call fcn.00467e12
test eax, eax
jne 0x48f530
mov ecx, edi
call fcn.0047f40b
push str.StatusPending
push str.ResendDlg
push dword [eax + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004604a9
mov ecx, dword [ebp - 4]
add esp, 0x10
xor esi, esi
push esi
push esi
push esi
push esi
push dword [eax]
push 1
push 2
push ebx
call fcn.00473674
lea ecx, [ebp - 0xc]
call fcn.0045e73f
jmp 0x48f532
mov ecx, dword [ebp - 4]
xor esi, esi
push esi
push esi
push esi
push esi
push 0x49f854
push 1
push 2
push ebx
call fcn.00473674
jmp 0x48f532
xor esi, esi
mov eax, dword [ebp - 4]
inc ebx
push esi
push esi
push 0x1004
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, eax
jl 0x48f47f
mov ebx, dword [ebp - 0x10]
push str.DeliveryingReports
push str.ResendDlg
lea eax, [ebp - 0x10]
mov dword [ebx + 0x1dc], esi
push eax
mov ecx, edi
call fcn.0047f521
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [eax]
push dword [ebx + 0x44]
call edi
lea ecx, [ebp - 0x10]
call fcn.0045e73f
push esi
push dword [ebx + 0xbc]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
call esi
push 0
push dword [ebx + 0xc0]
call esi
push 0
push dword [ebx + 0xc8]
call esi
push 0
push dword [ebx + 0x124]
call esi
push 0
push dword [ebx + 0x128]
call esi
push 5
push dword [ebx + 0x130]
call esi
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push 0x4a464c
push str.ProgressDlg
push eax
mov ecx, esi
call fcn.0047f521
push dword [eax]
push dword [ebx + 0x120]
call edi
lea ecx, [ebp - 0x10]
call fcn.0045e73f
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0xfa
push 1
push dword [ebx + 4]
call edi
cmp dword [ebx + 0x1d4], 1
jne 0x48f616
push 0
push 0xbb8
push 2
push dword [ebx + 4]
call edi
mov ecx, esi
call fcn.00480121
pop esi
jmp 0x48f640
push 0
push dword [ebx + 0x120]
call dword [sym.imp.USER32.dll_EnableWindow]
push 2
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, edi
call fcn.0047bcca
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x48f64a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.0047f4e3
lea ecx, [ebp - 4]
push ecx
mov ecx, eax
call fcn.0047f563
push 5
push 0
push 0
push dword [eax]
push str.open
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
call fcn.0045e73f
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x48f6b5
Capabilities:
Hide graphical window

Disassembly:
push 0x5c
mov eax, 0x49d665
call fcn.00497232
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
call fcn.0047f4e3
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, 0x201
cmp si, ax
je 0x48f6ed
add eax, 2
cmp si, ax
je 0x48f6ed
mov eax, 0x405
cmp si, ax
jne 0x48f703
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 0x204
cmp si, ax
jne 0x48f844
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0xd6
push dword [0x4cc500]
call dword [sym.imp.USER32.dll_LoadMenuW]
mov edi, eax
mov dword [ebp - 0x14], edi
push 2
lea eax, [ebp - 0x24]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x14]
call fcn.00475739
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push str.PopupShow
push str.ResendDlg
push eax
mov byte [ebp - 4], 2
call fcn.0047f521
mov ecx, dword [ebp - 0x18]
lea eax, [ebp + 0x10]
push str.PopupExit
push str.ResendDlg
push eax
mov byte [ebp - 4], 3
call fcn.0047f521
push 0x30
pop ebx
push ebx
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 4
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x68], ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x64], 0x40
push 0
call fcn.0046023d
mov ebx, dword [sym.imp.USER32.dll_SetMenuItemInfoW]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0x8013
push esi
call ebx
push 0
lea ecx, [ebp + 0x10]
call fcn.0046023d
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0x8012
push esi
call ebx
mov eax, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebx + 4]
call fcn.00476d15
pop ecx
pop ecx
xor ecx, ecx
push ecx
push ebx
push ecx
push dword [ebp - 0x1c]
push eax
push ecx
push esi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
lea ecx, [ebp + 0x10]
call fcn.0045e73f
lea ecx, [ebp - 0x10]
call fcn.0045e73f
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.0045f6ac
test esi, esi
je 0x48f838
lea ecx, [ebp - 0x20]
call fcn.004751c5
test edi, edi
je 0x48f844
lea ecx, [ebp - 0x14]
call fcn.004751c5
xor eax, eax
call fcn.00497200
ret 0x10
Function at 0x490289
Capabilities:
Write file on windows

Disassembly:
push 0x3c
mov eax, 0x49d839
call fcn.00497265
and dword [ebp - 4], 0
lea ebx, [ecx + 0x3c]
and dword [ebx], 0
lea ecx, [ebp + 0x14]
push 0x4bf00c
push 0
call fcn.0046023d
push eax
push ebx
call dword [sym.imp.MSVCR120.dll__wfopen_s]
add esp, 0xc
cmp dword [ebx], 0
je 0x490384
push 0xe
lea eax, [ebp - 0x20]
push 0
push eax
call sub.MSVCR120.dll_memset
push 0x28
lea eax, [ebp - 0x48]
push 0
push eax
call sub.MSVCR120.dll_memset
mov esi, dword [ebp + 0x10]
mov eax, 0x4d42
mov edx, dword [ebp + 8]
xor edi, edi
mov word [ebp - 0x20], ax
inc edi
xor eax, eax
test esi, esi
push 3
pop ecx
cmovne ecx, edi
mov dword [ebp - 0x1a], eax
imul ecx, edx
mov eax, ecx
and eax, reloc.WS2_32.dll_closesocket
jns 0x49030c
dec eax
or eax, 0xfffffffc
inc eax
add eax, ecx
mov dword [ebp - 0x16], 0x36
mov ecx, dword [ebp + 0xc]
imul eax, ecx
push 0x18
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x48], 0x28
mov dword [ebp - 0x44], edx
add eax, 0x36
mov word [ebp - 0x3c], di
mov dword [ebp - 0x1e], eax
test esi, esi
mov esi, dword [sym.imp.MSVCR120.dll_fwrite]
pop eax
push 8
pop ecx
push dword [ebx]
cmovne eax, ecx
xor ecx, ecx
mov word [ebp - 0x3a], ax
mov eax, 0xec4
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
push 0xe
push eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
call esi
add esp, 0x28
cmp eax, edi
jne 0x490384
push dword [ebx]
lea eax, [ebp - 0x48]
push edi
push 0x28
push eax
call esi
add esp, 0x10
cmp eax, edi
je 0x490386
xor edi, edi
lea ecx, [ebp + 0x14]
call fcn.0045e73f
mov eax, edi
call fcn.00497214
ret 0x10

Function at 0x490398
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
push esi
mov esi, ecx
mov dword [ebp - 4], esi
je 0x49040f
mov eax, dword [ebp + 0xc]
push ebx
push edi
push 3
pop ecx
cdq
idiv ecx
mov edi, eax
push edi
call fcn.00497198
and dword [ebp + 0xc], 0
mov ebx, eax
pop ecx
test edi, edi
jle 0x4903f5
mov esi, dword [ebp + 8]
inc esi
movzx ecx, byte [esi + 1]
movzx eax, byte [esi - 1]
add eax, ecx
movzx ecx, byte [esi]
add eax, ecx
push 3
pop ecx
cdq
idiv ecx
mov ecx, dword [ebp + 0xc]
push 3
mov byte [ecx + ebx], al
inc ecx
pop eax
add esi, eax
mov dword [ebp + 0xc], ecx
cmp ecx, edi
jl 0x4903ca
mov esi, dword [ebp - 4]
push dword [esi + 0x3c]
push 1
push edi
push ebx
call dword [sym.imp.MSVCR120.dll_fwrite]
push ebx
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
add esp, 0x14
pop edi
pop ebx
jmp 0x490423
push dword [esi + 0x3c]
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
xor eax, eax
inc eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x490a87
Capabilities:
Enumerate gui resources

Disassembly:
push 0x2c
mov eax, 0x49d8ff
call fcn.00497265
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
push eax
push 0x490998
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], edi
call dword [sym.imp.USER32.dll_EnumWindows]
test esi, esi
jne 0x490b2c
mov eax, dword [0x4cb014]
xorps xmm0, xmm0
mov dword [ebp - 0x2c], eax
movdqu xmmword [ebp - 0x28], xmm0
mov eax, dword [edi + 4]
xor ecx, ecx
mov esi, dword [edi]
sub eax, esi
push 0x1c
cdq
pop ebx
idiv ebx
mov dword [ebp - 4], ecx
test eax, eax
je 0x490b24
mov edx, ecx
test dword [edx + esi + 0x18], 0x40000
je 0x490afe
test dword [edx + esi + 0x14], 0xc00000
je 0x490afe
test dword [edx + esi + 0x14], 0x80000
jne 0x490b37
inc ecx
add edx, ebx
cmp ecx, eax
jb 0x490ae0
test eax, eax
je 0x490b24
push esi
lea ecx, [ebp - 0x2c]
call fcn.0046697a
mov ecx, edi
call fcn.0046a992
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.0049165c
lea ecx, [ebp - 0x2c]
call fcn.0045e73f
xor eax, eax
inc eax
call fcn.00497214
ret 0xc
imul eax, ecx, 0x1c
add eax, esi
push eax
jmp 0x490b0a

Function at 0x491f6d
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4cb0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4cb014]
push esi
mov esi, ecx
mov dword [esi], eax
mov eax, dword [0x4cb014]
mov dword [esi + 8], eax
lea eax, [ebp - 0x194]
mov ecx, dword [0x4cb014]
push eax
push 0x202
mov dword [esi + 0xc], ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [ebp - 4]
mov eax, esi
and dword [esi + 0x14], 0
xor ecx, ebp
and dword [esi + 0x10], 0
mov dword [esi + 4], 0x19
pop esi
call fcn.004971ea
mov esp, ebp
pop ebp
ret
Function at 0x492357
Capabilities:
Read file on windows

Disassembly:
push 0x30
mov eax, 0x49dafb
call fcn.00497265
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
push dword [ebp + 8]
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
call fcn.00460382
mov esi, eax
pop ecx
test esi, esi
js 0x492415
push esi
call fcn.00497198
and dword [ebp - 0x2c], 0
mov edi, eax
mov dword [esp], 0x4beffc
lea eax, [ebp - 0x2c]
push dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR120.dll__wfopen_s]
add esp, 0xc
cmp dword [ebp - 0x2c], 0
je 0x49240b
push dword [ebp - 0x2c]
push ebx
push esi
push edi
call dword [sym.imp.MSVCR120.dll_fread]
add esp, 0x10
cmp eax, ebx
jne 0x49240b
push dword [ebp - 0x2c]
call dword [sym.imp.MSVCR120.dll_fclose]
mov dword [esp], 0x4a2750
lea eax, [ebp - 0x28]
push 0x4c
push esi
push edi
push eax
call fcn.00462d9a
mov ecx, dword [ebp - 0x30]
add esp, 0x14
push eax
call fcn.0047b374
push 0
push ebx
lea ecx, [ebp - 0x28]
call fcn.0046282b
push edi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
pop ecx
xor ebx, ebx
jmp 0x492415
push edi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
pop ecx
push 2
pop ebx
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0
call fcn.0045f6ac
lea ecx, [ebp + 8]
call fcn.0045e73f
mov eax, ebx
call fcn.00497214
ret 8
Function at 0x49265e
Capabilities:
Resolve dns

Disassembly:
push 0x10
mov eax, 0x49db96
call fcn.00497232
mov edi, ecx
push dword [ebp + 8]
xor esi, esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], esi
call fcn.0045f630
mov eax, dword [0x4cb014]
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], eax
push esi
push 0x40
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0045fcee
inc eax
lea ecx, [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
call fcn.00460ab0
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.0045f6df
lea ecx, [ebp + 8]
call fcn.0045e73f
mov eax, dword [0x4cb014]
mov dword [ebp + 8], eax
push dword [ebp - 0x14]
lea eax, [ebp + 8]
mov byte [ebp - 4], 3
push str.Quering_MX_record_of_domain__s
push eax
call fcn.0045fd48
add esp, 0xc
lea eax, [ebp + 8]
push 1
push 2
push ecx
mov ecx, esp
push eax
call fcn.0045e6a5
mov ecx, dword [edi + 0x14]
call fcn.004620ac
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push 0xf
pop eax
push eax
push dword [ebp - 0x14]
call sub.DNSAPI.dll_DnsQuery_W
mov ecx, dword [ebp - 0x10]
mov ebx, ecx
test eax, eax
jne 0x492765
test ecx, ecx
je 0x49275b
push 0xf
pop edi
cmp word [ecx + 8], di
jne 0x492752
push dword [ecx + 0x18]
lea ecx, [ebp - 0x1c]
call fcn.0045f630
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x10]
add eax, 0x1c
mov byte [ebp - 4], 4
push eax
call fcn.00492100
mov ecx, eax
call fcn.0045f6df
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.0045e73f
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov dword [ebp - 0x10], ecx
test ecx, ecx
jne 0x492714
push 1
push ebx
call sub.DNSAPI.dll_DnsFree
jmp 0x492792
push eax
lea eax, [ebp + 8]
push str.DNS_query_failed_with_code__d
push eax
call fcn.0045fd48
add esp, 0xc
lea eax, [ebp + 8]
push 1
push 2
push ecx
mov ecx, esp
push eax
call fcn.0045e6a5
mov ecx, dword [edi + 0x14]
call fcn.004620ac
xor esi, esi
inc esi
lea ecx, [ebp + 8]
call fcn.0045e73f
lea ecx, [ebp - 0x14]
call fcn.0045e73f
lea ecx, [ebp - 0x18]
call fcn.0045e73f
mov eax, esi
call fcn.00497200
ret 8

Function at 0x4928fb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ecx + 0x10], eax
xor eax, eax
push eax
push eax
push ecx
push 0x493e70
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
neg eax
sbb eax, eax
inc eax
pop ebp
ret 8
Function at 0x493be4
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push 0x14
mov eax, 0x49ddb8
call fcn.00497232
mov eax, ecx
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov ecx, dword [eax + 0x14]
call fcn.00461fed
or edi, 0xffffffff
test al, al
je 0x493c19
mov esi, edi
jmp 0x493d4f
cmp dword [ebp + 0xc], 0
mov ebx, dword [ebp + 0x10]
je 0x493d10
push dword [ebp + 0xc]
call dword [sym.imp.MSVCR120.dll_wcslen]
pop ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
mov esi, eax
call fcn.0046b68b
push 0
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp esi, edi
jne 0x493cc4
mov eax, dword [0x4cb014]
mov dword [ebp + 0xc], eax
push edi
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 1
push str.Send_error:__d
push eax
call fcn.0045fd48
add esp, 0xc
lea eax, [ebp + 0xc]
push 1
push 0
push ecx
mov ecx, esp
push eax
call fcn.0045e6a5
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x14]
call fcn.004620ac
mov eax, dword [0x4cb014]
mov dword [ebp + 0x10], eax
push 1
push 0
push ecx
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 2
mov ecx, esp
push eax
call fcn.0045e6a5
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x14]
call fcn.004620ac
lea ecx, [ebp + 0x10]
call fcn.0045e73f
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0
call fcn.0045e73f
test ebx, ebx
je 0x493d4f
jmp 0x493d10
push ebx
lea ecx, [ebp + 0xc]
call fcn.0045f5db
push 1
push 0
push ecx
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 3
mov ecx, esp
push eax
call fcn.0045e6a5
mov esi, dword [ebp - 0x10]
mov ecx, dword [esi + 0x14]
call fcn.004620ac
push ebx
mov ecx, esi
call fcn.00492507
mov esi, eax
lea ecx, [ebp + 0xc]
cmp esi, edi
jne 0x493d64
mov byte [ebp - 4], 0
call fcn.0045e73f
push dword [ebp + 0x14]
push 0
push ebx
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0
push dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, edi
jne 0x493cce
push 1
push 0
push ecx
mov ecx, esp
push str.Receive_error
call fcn.0045f630
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x14]
call fcn.004620ac
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], edi
call fcn.0045f6ac
mov eax, esi
call fcn.00497200
ret 0x10
cmp esi, 0xfffffffe
cmove esi, edi
call fcn.0045e73f
jmp 0x493d4f
Function at 0x49498a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4cb0b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4cc46c], 0
mov dword [ebp - 0x230], str.getaddrinfo
mov dword [ebp - 0x22c], 0x49452b
mov dword [ebp - 0x228], str.getnameinfo
mov dword [ebp - 0x224], 0x4947a5
mov dword [ebp - 0x220], str.freeaddrinfo
mov dword [ebp - 0x21c], fcn.004944ea
jne 0x494b15
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x494b0b
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
mov ebx, 0x10c
push eax
lea eax, [ebp - 0x110]
push ebx
push eax
call dword [sym.imp.MSVCR120.dll_strcpy_s]
push str.ws2_32
lea eax, [ebp - 0x110]
push ebx
push eax
call dword [sym.imp.MSVCR120.dll_strcat_s]
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
xor edi, edi
test esi, esi
je 0x494a67
push str.getaddrinfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x494a63
push esi
call ebx
mov esi, edi
test esi, esi
jne 0x494ac3
lea eax, [ebp - 0x218]
mov esi, 0x10c
push eax
lea eax, [ebp - 0x110]
push esi
push eax
call dword [sym.imp.MSVCR120.dll_strcpy_s]
push str.wship6
lea eax, [ebp - 0x110]
push esi
push eax
call dword [sym.imp.MSVCR120.dll_strcat_s]
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x494b08
push str.getaddrinfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x494abf
push esi
call ebx
mov esi, edi
test esi, esi
je 0x494b08
mov ebx, edi
push dword [ebp + ebx*8 - 0x230]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + ebx*8 - 0x22c], eax
test eax, eax
je 0x494ae6
inc ebx
cmp ebx, 3
jl 0x494ac5
jmp 0x494aef
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, edi
test esi, esi
je 0x494b08
mov eax, dword [ebp + edi - 0x22c]
mov dword [edi + 0x4cb094], eax
add edi, 8
cmp edi, 0x18
jl 0x494af3
pop edi
pop esi
pop ebx
mov dword [0x4cc46c], 1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
movzx eax, ax
xor ecx, ebp
mov eax, dword [eax*8 + 0x4cb094]
call fcn.004971ea
mov esp, ebp
pop ebp
ret 4
Function at 0x494d10
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
and dword [eax], 0
push edi
push dword [ebp + 8]
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x494d8f
cmp word [esi + 8], 2
jne 0x494d70
push 4
pop eax
cmp word [esi + 0xa], ax
jne 0x494d70
mov edi, dword [esi + 0xc]
jmp 0x494d6a
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00494c65
mov ecx, eax
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
test ecx, ecx
je 0x494d8a
lea eax, [ecx + 0x1c]
add edi, 4
mov dword [ebp + 0x1c], eax
mov eax, dword [edi]
test eax, eax
jne 0x494d46
push 0x400
push dword [esi]
push 0x401
push ebx
call dword [sym.imp.MSVCR120.dll_strncpy_s]
add esp, 0x10
xor eax, eax
jmp 0x494da7
push 8
pop eax
jmp 0x494da7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x2af9
sub eax, ecx
je 0x494da5
dec eax
je 0x494db5
dec eax
je 0x494dae
dec eax
mov eax, ecx
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
mov eax, 0x2afb
jmp 0x494da7
mov eax, 0x2afa
jmp 0x494da7
Function at 0x403500
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x6c
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
lea ebx, [ebp - 0x64]
mov dword [esp], ebx
lea esi, [ebp - 0x54]
mov dword [esp + 4], edx
mov dword [ebp - 0x6c], eax
call fcn.0040a9e0
mov dword [esp + 4], 0x3c
mov dword [esp], esi
call fcn.00411480
cmp byte [edi + 4], 0
mov eax, str.runas
mov ecx, dword [ebp + 8]
mov edx, str.open
mov dword [ebp - 0x54], 0x3c
cmove eax, edx
mov dword [ebp - 0x48], eax
mov eax, dword [ecx + 4]
cmp byte [ebp - 0x6c], 1
mov dword [ebp - 0x50], 0x41
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], str.exefile
mov eax, dword [eax + 4]
mov dword [esp], esi
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x3c], eax
sbb eax, eax
not eax
and eax, 5
mov dword [ebp - 0x38], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
sub esp, 4
xor esi, esi
test eax, eax
je 0x4035b0
mov eax, dword [ebp - 0x1c]
mov esi, 1
mov dword [edi + 8], eax
mov ecx, ebx
call fcn.00405e80
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x4038c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x220
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x210]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
sub esp, 0x10
test eax, eax
je 0x403912
mov dword [esp], esi
mov ecx, ebx
call fcn.00407ca0
mov eax, ebx
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov ecx, ebx
mov dword [esp], 0x4574b0
call fcn.00407ca0
mov eax, ebx
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret