joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4999a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa14
mov eax, dword [0x8307c0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x834334], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xa0c], eax
mov dword [ebp - 0xa14], ecx
jne 0x499a08
push str.not_initialized
push edi
push dword [0x7d1314]
push dword [0x7d0370]
push 0x80b
push eax
call fcn.00494c70
add esp, 0x18
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e7e02
mov esp, ebp
pop ebp
ret
push ebx
push 0x83435c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test esi, esi
js 0x499a2a
push esi
push edi
call fcn.004996e0
add esp, 8
test eax, eax
jne 0x499b53
mov ecx, dword [ebp - 0xa0c]
mov ecx, dword [ecx + 0x384]
test ecx, ecx
je 0x499a40
mov ecx, dword [ecx]
test ecx, ecx
jne 0x499a58
push str.LIBMYSQL_PLUGIN_DIR
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
mov ecx, str.C:_Program_Files_MySQL_MySQL_Server_6.1_lib_plugin
test eax, eax
cmovne ecx, eax
push 0
push str..dll
push edi
push 0x4fddf0
push ecx
lea eax, [ebp - 0x208]
push 0x200
push eax
call fcn.0049f3b0
add esp, 0x1c
lea eax, [ebp - 0x208]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [ebp - 0xa10], eax
test eax, eax
jne 0x499ad1
push eax
push 0x800
lea eax, [ebp - 0xa08]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x499ac7
lea esi, [ebp - 0xa08]
jmp 0x499b58
mov esi, 0x4fbd0e
jmp 0x499b58
push dword [0x7d0bb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x499af7
push dword [ebp - 0xa10]
mov esi, str.not_a_plugin
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x499b58
test esi, esi
js 0x499b06
cmp esi, dword [ebx]
je 0x499b06
mov esi, str.type_mismatch
jmp 0x499b58
mov ecx, dword [ebx + 8]
mov eax, edi
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x499b30
test dl, dl
je 0x499b2c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x499b30
add eax, 2
add ecx, 2
test dl, dl
jne 0x499b10
xor eax, eax
jmp 0x499b35
sbb eax, eax
or eax, 1
test eax, eax
je 0x499b40
mov esi, str.name_mismatch
jmp 0x499b58
test esi, esi
jns 0x499b97
push dword [ebx]
push edi
call fcn.004996e0
add esp, 8
test eax, eax
je 0x499b97
mov esi, str.it_is_already_loaded
push 0x83435c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
push edi
push dword [0x7d1314]
push dword [0x7d0370]
push 0x80b
push dword [ebp - 0xa0c]
call fcn.00494c70
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e7e02
mov esp, ebp
pop ebp
ret
push dword [ebp - 0xa14]
push dword [ebp + 0x14]
push dword [ebp - 0xa10]
push ebx
push dword [ebp - 0xa0c]
call fcn.00499570
add esp, 0x14
mov esi, eax
push 0x83435c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, esi
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.004e7e02
mov esp, ebp
pop ebp
ret
Function at 0x499db0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, 1
cmovne esi, eax
push edi
test bl, 0x20
je 0x499dd9
push 1
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
add esp, 8
jmp 0x499de3
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov edi, eax
test edi, edi
jne 0x499e35
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call fcn.004a3610
add esp, 4
mov eax, ebx
and eax, 8
mov dword [ebp + 8], eax
mov eax, dword [fcn.004ace90]
cmovne eax, dword [fcn.004ace90]
mov dword [fcn.004ace90], eax
test bl, 0x18
je 0x499e27
push esi
push 0x440
push 5
call fcn.0049a080
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x499e35
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x49b9e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x8307c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x836384]
test eax, eax
jne 0x49ba6e
mov ax, word [0x4feb58]
mov word [ebp - 0x10], ax
mov al, byte [0x4feb5a]
mov byte [ebp - 0xe], al
xor eax, eax
push 7
mov dword [ebp - 0xd], eax
mov word [ebp - 9], ax
mov byte [ebp - 7], al
lea eax, [ebp - 0xe]
push eax
push 0x1004
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, str.cp932
lea eax, [ebp - 0x10]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x49ba55
test dl, dl
je 0x49ba51
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x49ba55
add eax, 2
add ecx, 2
test dl, dl
jne 0x49ba35
xor ecx, ecx
jmp 0x49ba5a
sbb ecx, ecx
or ecx, 1
test ecx, ecx
mov eax, 0x7db5b0
mov edx, 0x7d1138
cmovne eax, edx
mov dword [0x836384], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e7e02
mov esp, ebp
pop ebp
ret
Function at 0x49cd70
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x8307c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x1c
push ebx
xor edi, edi
call fcn.0049b130
mov esi, eax
add esp, 8
test esi, esi
jne 0x49cdad
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e7e02
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
lea eax, [ebp - 0x404]
movups xmmword [esi], xmm0
push 0x200
movq qword [esi + 0x10], xmm0
push eax
mov dword [esi + 0x18], edi
call fcn.0049d010
add esp, 8
test eax, eax
je 0x49ce0e
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.0049a950
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
call fcn.0049b410
add esp, 0x14
test eax, eax
jne 0x49ce00
lea edi, [eax + 1]
jmp 0x49ce0e
push 7
push esi
push eax
call fcn.004b1d00
add esp, 0xc
xor edi, edi
push 0x200
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x49ce63
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.0049a950
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
call fcn.0049b410
add esp, 0x14
test eax, eax
jne 0x49ce53
mov eax, 1
jmp 0x49ce61
push 7
push esi
push eax
call fcn.004b1d00
add esp, 0xc
xor eax, eax
add edi, eax
lea eax, [ebp - 0x204]
push 0x4fee48
push eax
call fcn.0049a950
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
call fcn.0049b410
add esp, 0x14
test eax, eax
jne 0x49ce90
mov eax, 1
jmp 0x49ce9e
push 7
push esi
push eax
call fcn.004b1d00
add esp, 0xc
xor eax, eax
add edi, eax
lea eax, [ebp - 0x404]
push 0x200
push eax
call fcn.0049cfc0
add esp, 8
test eax, eax
je 0x49cef7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.0049a950
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
call fcn.0049b410
add esp, 0x14
test eax, eax
jne 0x49cee7
mov eax, 1
jmp 0x49cef5
push 7
push esi
push eax
call fcn.004b1d00
add esp, 0xc
xor eax, eax
add edi, eax
push str.MYSQL_HOME
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x49cf16
push esi
push eax
push ebx
call fcn.0049cbe0
add esp, 0xc
add edi, eax
lea eax, [ebp - 0x204]
push 0x4fbd0e
push eax
call fcn.0049a950
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
call fcn.0049b410
add esp, 0x14
test eax, eax
jne 0x49cf43
mov eax, 1
jmp 0x49cf51
push 7
push esi
push eax
call fcn.004b1d00
add esp, 0xc
xor eax, eax
add eax, edi
xor ecx, ecx
test eax, eax
pop edi
cmovg esi, ecx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.004e7e02
mov esp, ebp
pop ebp
ret
Function at 0x49d010
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push str.GetSystemWindowsDirectoryA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49d038
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop ebp
ret
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, eax
cmp esi, 8
jbe 0x49d06c
lea ecx, [edi - 8]
add ecx, esi
push str.System32
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x49d06c
sub esi, 8
mov byte [esi + edi], al
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x49dcd0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
push str.MYSQL_TEST_LOGIN_FILE
call esi
add esp, 4
test eax, eax
je 0x49dcf7
push str.MYSQL_TEST_LOGIN_FILE
call esi
push eax
push 0x4fee70
jmp 0x49dd12
push str.APPDATA
call esi
add esp, 4
test eax, eax
je 0x49dd2b
push str.APPDATA
call esi
push eax
push str._sMySQL.mylogin.cnf
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0049e710
add esp, 0x14
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
pop esi
pop ebp
ret
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret
Function at 0x49fc80
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x8307c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [eax]
cmp edi, 0xffffffff
jne 0x49fcb4
or eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e7e02
mov esp, ebp
pop ebp
ret
test esi, esi
js 0x49fce5
mov eax, 0x10624dd3
mov ecx, esi
imul esi
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x318], eax
imul eax, eax, 0x3e8
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [ebp - 0x314], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x30c], edi
mov dword [ebp - 0x310], 1
test ebx, ebx
je 0x49fd2b
lea eax, [ebx - 1]
cmp eax, 1
ja 0x49fd3b
mov dword [ebp - 0x104], edi
mov dword [ebp - 0x108], 1
jmp 0x49fd3b
mov dword [ebp - 0x208], edi
mov dword [ebp - 0x20c], 1
xor ecx, ecx
lea eax, [ebp - 0x318]
test esi, esi
cmovs eax, ecx
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jne 0x49fd8c
push 0x274c
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop ebx
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e7e02
mov esp, ebp
pop ebp
ret
jg 0x49fda1
pop ebx
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e7e02
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x49fdb5
lea eax, [ebx - 1]
cmp eax, 1
ja 0x49fdca
lea eax, [ebp - 0x108]
jmp 0x49fdbb
lea eax, [ebp - 0x20c]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
mov esi, eax
neg esi
sbb esi, esi
neg esi
lea eax, [ebp - 0x310]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
mov ecx, dword [ebp - 4]
neg eax
pop ebx
sbb eax, eax
xor ecx, ebp
neg eax
or eax, esi
pop edi
pop esi
call fcn.004e7e02
mov esp, ebp
pop ebp
ret

Function at 0x49ffe0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4a005e
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
nop dword [eax]
call ebx
cmp eax, 0x2734
je 0x4a0020
cmp eax, 0x2733
jne 0x4a005b
push dword [esi + 0x144]
push 0
push esi
call fcn.0049fc80
add esp, 0xc
cmp eax, 0xffffffff
je 0x4a003e
test eax, eax
je 0x4a0064
xor eax, eax
jmp 0x4a0041
or eax, 0xffffffff
test eax, eax
jne 0x4a005d
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
je 0x4a0010
mov eax, edi
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a01c0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
cmp edi, 0xffffffff
jle 0x4a01f7
lea eax, [ebp + 0x14]
mov dword [ebp + 0x14], 1
push eax
push 0x8004667e
push dword [esi]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x4a01f7
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4a0274
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2734
je 0x4a022d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4a0274
push edi
push 2
push esi
call fcn.0049fc80
add esp, 0xc
cmp eax, 1
jne 0x4a0274
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp + 0x14]
push eax
push 0x1007
push 0xffff
push dword [esi]
call dword [sym.imp.WS2_32.dll_getsockopt]
mov ebx, eax
test ebx, ebx
jne 0x4a0274
push dword [ebp + 0x14]
call dword [sym.imp.WS2_32.dll_WSASetLastError]
cmp dword [ebp + 0x14], ebx
setne bl
cmp edi, 0xffffffff
jle 0x4a029e
test ebx, ebx
jne 0x4a02a0
lea eax, [ebp + 0x14]
mov dword [ebp + 0x14], ebx
push eax
push 0x8004667e
push dword [esi]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x4a029e
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
test ebx, ebx
pop ebx
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a1410
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x8307c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x150], ebx
push edi
test eax, eax
je 0x4a15df
push 2
push 0xb
push eax
push ecx
call fcn.004a09b0
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x154], esi
cmp esi, 1
jne 0x4a15df
test ebx, ebx
je 0x4a15df
mov edi, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4a1471
sub edi, ecx
lea esi, [edi + 4]
push esi
mov dword [ebp - 0x148], esi
call fcn.004e80a4
push esi
mov ebx, eax
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
lea ecx, [esi - 4]
push ecx
push dword [ebp - 0x150]
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 3
push 0x4ff1b4
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
add esp, 0x28
lea eax, [ebp - 0x144]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x14c], eax
cmp eax, 0xffffffff
jne 0x4a14f0
push ebx
call fcn.004e8cdc
add esp, 4
mov eax, 0xfffffffa
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e7e02
mov esp, ebp
pop ebp
ret
test byte [ebp - 0x144], 0x10
jne 0x4a15f2
lea esi, [ebp - 0x118]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4a1506
mov eax, dword [ebp - 0x148]
sub esi, ecx
lea ecx, [edi + 3]
add ecx, esi
cmp ecx, eax
jle 0x4a1540
push ebx
call fcn.004e8cdc
lea eax, [edi + 3]
add eax, esi
push eax
mov dword [ebp - 0x148], eax
call fcn.004e80a4
mov ebx, eax
add esp, 8
mov eax, dword [ebp - 0x148]
push eax
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x148]
sub eax, esi
sub eax, 3
push eax
push dword [ebp - 0x150]
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
push 2
push 0x4ff1b8
push ebx
call esi
mov eax, dword [ebp - 0x148]
sub eax, edi
sub eax, 3
push eax
lea eax, [ebp - 0x118]
push eax
push ebx
call esi
push 2
push 0xb
push ebx
push dword [ebp - 0x158]
call fcn.004a09b0
mov esi, eax
add esp, 0x40
mov dword [ebp - 0x154], esi
cmp esi, 1
jne 0x4a15ca
mov eax, dword [ebp - 0x14c]
lea ecx, [ebp - 0x144]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
mov eax, dword [ebp - 0x14c]
jne 0x4a14f0
push ebx
call fcn.004e8cdc
add esp, 4
push dword [ebp - 0x14c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e7e02
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x154]
jmp 0x4a15ae
Function at 0x4a3050
Capabilities:
Query environment variable

Disassembly:
cmp byte [0x8367d1], 0
je 0x4a305c
xor al, al
ret
push esi
mov esi, dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
push str.UMASK
mov byte [0x8367d1], 1
mov dword [0x7db258], 0x1a0
mov dword [0x7db25c], 0x1e8
call esi
add esp, 4
test eax, eax
je 0x4a309f
push eax
call fcn.004a3000
add esp, 4
or eax, 0x1a0
mov dword [0x7db258], eax
push str.UMASK_DIR
call esi
add esp, 4
test eax, eax
je 0x4a30c0
push eax
call fcn.004a3000
add esp, 4
or eax, 0x1e8
mov dword [0x7db25c], eax
push 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov dword [0x8367d8], eax
mov dword [0x8367dc], 0
mov dword [0x8367d4], 0x8367d8
call fcn.004a34f0
test al, al
jne 0x4a30f6
call fcn.004a35e0
test al, al
je 0x4a30fa
mov al, 1
pop esi
ret
push str.HOME
call esi
add esp, 4
mov dword [0x8369fc], eax
test eax, eax
je 0x4a3120
push eax
push 0x8367f8
call fcn.0049a8d0
add esp, 8
mov dword [0x8369fc], eax
push fcn.0049b450
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler]
add esp, 4
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__tzset]
call fcn.004a33d0
call fcn.004a3270
call fcn.004a31e0
xor al, al
pop esi
ret

Function at 0x4a3150
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call esi
test eax, eax
je 0x4a31ce
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinsock2Parameters
push reloc.WS2_32.dll_bind
call esi
test eax, eax
je 0x4a31ce
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinsockParameters
push reloc.WS2_32.dll_bind
call esi
test eax, eax
je 0x4a31ce
push str.HAVE_TCPIP
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x4a31c7
cmp byte [0x8367d0], 0
je 0x4a31ce
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a3270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [0x8307c0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xa14]
push eax
push 0x20019
push 0
push str.SOFTWAREMySQL
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a33b8
push esi
lea eax, [ebp - 0xa0c]
mov dword [ebp - 0xa10], 0xff
push eax
lea eax, [ebp - 0x504]
mov dword [ebp - 0xa0c], 0x3ff
push eax
lea eax, [ebp - 0xa18]
xor esi, esi
push eax
push esi
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp - 0xa14]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x4a33ab
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
push edi
mov edi, dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
nop word [eax + eax]
inc esi
cmp eax, 0xea
je 0x4a3358
test eax, eax
jne 0x4a33a9
cmp dword [ebp - 0xa18], 1
jne 0x4a3358
push eax
lea eax, [ebp - 0x504]
push eax
push 0x4ff6cc
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0xa08]
push eax
call fcn.0049f370
lea eax, [ebp - 0xa08]
push eax
call ebx
push eax
call edi
add esp, 0x1c
lea eax, [ebp - 0xa0c]
mov dword [ebp - 0xa10], 0xff
push eax
lea eax, [ebp - 0x504]
mov dword [ebp - 0xa0c], 0x3ff
push eax
lea eax, [ebp - 0xa18]
push eax
push 0
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp - 0xa14]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x4a3310
pop edi
pop ebx
push dword [ebp - 0xa14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e7e02
mov esp, ebp
pop ebp
ret

Function at 0x4a34f0
Capabilities:
Allocate thread local storage

Disassembly:
cmp byte [0x8367e1], 0
je 0x4a34fc
xor al, al
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov byte [0x8367e1], 1
call esi
xor ecx, ecx
mov dword [0x8367e4], eax
cmp eax, 0xffffffff
sete cl
test ecx, ecx
jne 0x4a3530
call esi
xor ecx, ecx
mov dword [0x8367e8], eax
cmp eax, 0xffffffff
sete cl
test ecx, ecx
je 0x4a3544
push ecx
push str.Cant_initialize_threads:_error__d
push 0
call fcn.0049a1a0
add esp, 0xc
mov al, 1
pop esi
ret
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x87f500
mov byte [0x8367e0], 1
mov dword [0x87f518], 0
call esi
push 0x87f4e0
mov dword [0x87f4f8], 0
call esi
push 0x87f480
mov dword [0x87f498], 0
call esi
push 0x87f4c0
mov dword [0x87f4d8], 0
call esi
push 0x87f460
mov dword [0x87f478], 0
call esi
push 0x87f420
mov dword [0x87f438], 0
call esi
push 0x87f440
mov dword [0x87f458], 0
call esi
push 0x87f4a0
mov dword [0x87f4b8], 0
call esi
xor al, al
pop esi
ret
Function at 0x4a7a20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4a7a2c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.004a7a40

Function at 0x4a87a0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ea5e4
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x8307c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
call fcn.004cf4f0
lea edi, [esi + 0x30]
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.004cf610
lea eax, [esi + 0x18]
xor ebx, ebx
cmp dword [esi + 0x24], 1
lea edx, [esi + 8]
push eax
lea eax, [esi + 0x20]
push eax
push edi
push edx
push 0
lea eax, [ebp - 0x28]
cmove eax, ebx
push eax
push ebx
push ebx
xor eax, eax
cmp dword [esi + 0x24], 1
push 0x100
push dword [esi + 0x50]
cmovne eax, edx
push eax
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.Secur32.dll_InitializeSecurityContextW]
push eax
mov ecx, esi
call fcn.004cf760
mov esi, dword [ebp + 8]
test al, al
je 0x4a883d
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [ebp - 4], 1
jmp 0x4a884f
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 0x14]
mov dword [esi], ecx
mov dword [esi + 4], edx
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.004cf610
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4b0c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x8307c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [edi + 0x68]
push esi
push edi
mov dword [ebp - 0x30], ebx
mov eax, dword [eax + 0x18]
call eax
push eax
push esi
push dword [edi + 0x30]
lea eax, [ebp - 0x24]
push edi
push eax
mov eax, dword [ebx]
call eax
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edi, dword [ebp - 0x2c]
push eax
mov eax, dword [ebx + 4]
mov esi, dword [esi]
mov edi, dword [edi]
call eax
mov ebx, eax
add esp, 0x24
test ebx, ebx
jle 0x4b0d3b
mov edx, esi
mov ecx, ebx
sar ecx, 8
and edx, 0x3f
add edx, edi
mov eax, esi
imul edx, ecx
add edi, 3
shl eax, 8
add edx, eax
movzx eax, bl
xor esi, edx
mov ecx, esi
and ecx, 0x3f
add ecx, edi
add edi, 3
imul ecx, eax
mov eax, esi
shl eax, 8
add ecx, eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x30]
xor esi, ecx
mov eax, dword [eax + 4]
call eax
mov ebx, eax
add esp, 4
test ebx, ebx
jg 0x4b0cf2
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [eax], esi
mov eax, dword [ebp - 0x2c]
mov dword [eax], edi
pop edi
pop esi
pop ebx
call fcn.004e7e02
mov esp, ebp
pop ebp
ret