joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac8b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4ac8e9
dec al
je 0x4ac925
dec al
je 0x4ac969
dec al
je 0x4ac9d4
jmp 0x4aca5e
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4aca5e
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4ac8f9
jmp 0x4aca5e
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4aca5e
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4ac935
jmp 0x4aca5e
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4aca5e
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4ac997
xor ebp, ebp
jmp 0x4ac9a8
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4ac9b1
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4ac979
jmp 0x4aca5e
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4aca5e
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4aca2c
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004aa370
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4ac9e8
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b0864
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x114], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b0952
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xff
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
push 0x4b0968
mov eax, dword [0x4c8ac8]
mov eax, dword [eax]
push dword [eax + 0x58c]
push 0x4b097c
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404938
push dword [ebp - 0x10c]
push 0x4b0990
push 0x4b099c
lea eax, [ebp - 0x110]
call fcn.004b8cc4
push dword [ebp - 0x110]
push 0x4b0990
lea eax, [ebp - 0x114]
call fcn.004b07f4
push dword [ebp - 0x114]
lea eax, [ebp - 0x108]
mov edx, 9
call fcn.00404a48
mov edx, dword [ebp - 0x108]
mov eax, dword [ebx + 0x340]
call fcn.00442b54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0959
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.004046ec
ret
Function at 0x4b2778
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4b2780
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b2911
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [0x4c8b80]
mov eax, dword [eax]
call fcn.00463114
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409894
lea eax, [ebp - 0x14]
mov edx, 0x4b2928
call fcn.00404990
mov eax, dword [ebp - 0x14]
call fcn.004096d4
test al, al
je 0x4b2810
lea edx, [ebp - 0x20]
mov eax, dword [0x4c8b80]
mov eax, dword [eax]
call fcn.00463114
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409894
lea eax, [ebp - 0x1c]
mov edx, 0x4b2928
call fcn.00404990
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x168]
call fcn.00425a98
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00402b0c
mov eax, dword [ebp - 0x24]
call fcn.00404b88
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
mov eax, esi
call fcn.004027ac
mov edi, eax
push edi
push esi
push 0
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00402b0c
mov eax, dword [ebp - 0x28]
call fcn.00404b88
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4b2934
push edi
call sub.version.dll_VerQueryValueA
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.004092b8
push dword [ebp - 0x30]
push 0x4b2940
mov eax, dword [ebx + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.004092b8
push dword [ebp - 0x34]
push 0x4b2940
mov eax, dword [ebx + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x38]
call fcn.004092b8
push dword [ebp - 0x38]
push 0x4b2940
mov eax, dword [ebx + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3c]
call fcn.004092b8
push dword [ebp - 0x3c]
lea eax, [ebp - 0x2c]
mov edx, 7
call fcn.00404a48
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, 0xff
call fcn.00404964
mov edx, esi
mov eax, edi
call fcn.004027cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2918
lea eax, [ebp - 0x3c]
mov edx, 0xb
call fcn.004046ec
ret

Function at 0x4b3910
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 0x202
call sub.wsock32.dll_WSAStartup
add esp, 0x190
ret

Function at 0x4b3930
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ecx, edx
mov ebx, eax
mov eax, ecx
mov esi, 0x3e8
cdq
idiv esi
mov dword [esp], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [esp + 4], edx
lea eax, [esp + 8]
call fcn.004939e0
lea edx, [esp + 8]
mov eax, dword [ebx]
call fcn.004939d0
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
setg al
add esp, 0x10c
pop esi
pop ebx
ret
Function at 0x4b398c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404b78
xor eax, eax
push ebp
push 0x4b3a59
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404760
mov eax, dword [ebp - 0xc]
call fcn.00404988
mov ebx, eax
mov esi, 1
test ebx, ebx
jle 0x4b3a3b
cmp ebx, 0x1000
jle 0x4b39fd
push 0
push 0x1000
lea eax, [ebp - 0xc]
call fcn.00404be0
lea eax, [eax + esi - 1]
push eax
mov eax, dword [edi]
push eax
call sub.wsock32.dll_send
jmp 0x4b3a15
push 0
push ebx
lea eax, [ebp - 0xc]
call fcn.00404be0
lea eax, [eax + esi - 1]
push eax
mov eax, dword [edi]
push eax
call sub.wsock32.dll_send
sub ebx, 0x1000
add esi, 0x1000
test eax, eax
je 0x4b3a28
inc eax
jne 0x4b3a2c
xor eax, eax
jmp 0x4b3a2e
mov al, 1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4b3a3b
test ebx, ebx
jg 0x4b39d7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3a60
lea eax, [ebp - 0xc]
call fcn.004046c8
lea eax, [ebp - 4]
call fcn.004046c8
ret

Function at 0x4b3aa8
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b78
xor eax, eax
push ebp
push 0x4b3be8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x4b3bc0
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.00409ae4
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4b3bad
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4b3bad
mov ebx, dword [edx]
test ebx, ebx
je 0x4b3bad
lea eax, [ebp - 0x29c]
push eax
xor eax, eax
mov al, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
xor eax, eax
mov al, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
xor eax, eax
mov al, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
xor eax, eax
mov al, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x4b3c00
call fcn.0040a128
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.0040471c
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3bc7
call sub.wsock32.dll_WSACleanup
ret
Function at 0x4b7338
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 0x202
call sub.wsock32.dll_WSAStartup
add esp, 0x190
ret

Function at 0x4b74f4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b78
xor eax, eax
push ebp
push 0x4b7634
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x4b760c
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.00409ae4
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4b75f9
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4b75f9
mov ebx, dword [edx]
test ebx, ebx
je 0x4b75f9
lea eax, [ebp - 0x29c]
push eax
xor eax, eax
mov al, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
xor eax, eax
mov al, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
xor eax, eax
mov al, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
xor eax, eax
mov al, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x4b764c
call fcn.0040a128
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.0040471c
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7613
call sub.wsock32.dll_WSACleanup
ret

Function at 0x4b7658
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404b78
xor eax, eax
push ebp
push 0x4b7725
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00404760
mov eax, dword [ebp - 0xc]
call fcn.00404988
mov ebx, eax
mov esi, 1
test ebx, ebx
jle 0x4b7707
cmp ebx, 0x1000
jle 0x4b76c9
push 0
push 0x1000
lea eax, [ebp - 0xc]
call fcn.00404be0
lea eax, [eax + esi - 1]
push eax
mov eax, dword [edi]
push eax
call sub.wsock32.dll_send
jmp 0x4b76e1
push 0
push ebx
lea eax, [ebp - 0xc]
call fcn.00404be0
lea eax, [eax + esi - 1]
push eax
mov eax, dword [edi]
push eax
call sub.wsock32.dll_send
sub ebx, 0x1000
add esi, 0x1000
test eax, eax
je 0x4b76f4
inc eax
jne 0x4b76f8
xor eax, eax
jmp 0x4b76fa
mov al, 1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x4b7707
test ebx, ebx
jg 0x4b76a3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b772c
lea eax, [ebp - 0xc]
call fcn.004046c8
lea eax, [ebp - 4]
call fcn.004046c8
ret
Function at 0x4b7738
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ecx, edx
mov ebx, eax
mov eax, ecx
mov esi, 0x3e8
cdq
idiv esi
mov dword [esp], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [esp + 4], edx
lea eax, [esp + 8]
call fcn.004939e0
lea edx, [esp + 8]
mov eax, dword [ebx]
call fcn.004939d0
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
setg al
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4b77d0
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b78b8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x194]
push eax
mov dl, 1
mov al, 1
call fcn.00407578
push eax
call sub.wsock32.dll_WSAStartup
mov esi, eax
test esi, esi
je 0x4b7817
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
jmp 0x4b78aa
push 0x11
push 2
push 2
call sub.wsock32.dll_socket
mov edi, eax
mov dword [ebx + 0x3d0], edi
inc edi
jne 0x4b7836
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
jmp 0x4b78aa
mov word [ebp - 0x1a4], 2
xor eax, eax
mov dword [ebp - 0x1a0], eax
mov ax, word [ebp - 4]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x1a2], ax
mov eax, ebx
call fcn.00449344
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x4b78a7
push 0x10
lea eax, [ebp - 0x1a4]
push eax
mov eax, dword [ebx + 0x3d0]
push eax
call sub.wsock32.dll_bind
inc eax
jne 0x4b788a
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
jmp 0x4b78aa
push 1
push 0x409
mov eax, ebx
call fcn.00449344
push eax
mov eax, dword [ebx + 0x3d0]
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x4b78aa
or esi, 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b78bf
ret

Function at 0x4b78c8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404b78
xor eax, eax
push ebp
push 0x4b794e
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x14], 2
push esi
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 4]
call fcn.00404b88
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebx + 0x3d0]
push eax
call sub.wsock32.dll_sendto
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4b7938
call sub.wsock32.dll_WSAGetLastError
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7955
lea eax, [ebp - 4]
call fcn.004046c8
ret
Function at 0x4b7960
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov dword [ebp - 4], 0x10
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.00403114
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0xc]
push eax
push edi
push esi
mov eax, dword [ebx + 0x3d0]
push eax
call sub.wsock32.dll_recvfrom
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4b79ad
call sub.wsock32.dll_WSAGetLastError
mov ebx, eax
jmp 0x4b79bf
push dword [ebp - 0x10]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.004048c0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4b7a04
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b78
mov eax, dword [ebp - 8]
call fcn.00404b78
xor eax, eax
push ebp
push 0x4b7a9c
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00404b88
push eax
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
jbe 0x4b7a7f
push 4
mov eax, dword [ebp - 4]
call fcn.00404b88
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov edi, eax
test edi, edi
jbe 0x4b7a79
lea eax, [ebp - 0x24]
push eax
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4b7a73
mov esi, dword [ebp - 0x20]
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov ebx, esi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7aa3
lea eax, [ebp - 8]
mov edx, 2
call fcn.004046ec
ret

Function at 0x4b7e94
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b7f1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x104
call fcn.00409c4c
mov ebx, eax
lea eax, [ebp - 4]
push eax
push esi
mov eax, dword [0x4c8b80]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4b7eec
mov eax, edi
mov edx, ebx
call fcn.004048c0
lea eax, [ebp - 8]
push eax
call sub.shell32.dll_SHGetMalloc
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
mov eax, ebx
call fcn.00409c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7f26
lea eax, [ebp - 8]
call fcn.00406130
ret
Function at 0x4b8024
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
mov ebx, eax
mov eax, esp
mov edx, 0x94
call fcn.004075b4
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
mov eax, ebx
mov edx, 0x4b8118
call fcn.0040471c
cmp dword [esp + 0x10], 2
jne 0x4b80b5
mov eax, dword [esp + 4]
sub eax, 3
je 0x4b806d
dec eax
je 0x4b807e
dec eax
je 0x4b808c
jmp 0x4b8107
mov eax, ebx
mov edx, 0x4b8130
call fcn.0040471c
jmp 0x4b8107
mov eax, ebx
mov edx, 0x4b8148
call fcn.0040471c
jmp 0x4b8107
mov eax, dword [esp + 8]
sub eax, 1
jb 0x4b8099
je 0x4b80a7
jmp 0x4b8107
mov eax, ebx
mov edx, 0x4b8160
call fcn.0040471c
jmp 0x4b8107
mov eax, ebx
mov edx, 0x4b8178
call fcn.0040471c
jmp 0x4b8107
cmp dword [esp + 4], 4
jne 0x4b80d1
cmp dword [esp + 8], 0
jne 0x4b80d1
mov eax, ebx
mov edx, 0x4b818c
call fcn.0040471c
jmp 0x4b8107
cmp dword [esp + 4], 4
jne 0x4b80ed
cmp dword [esp + 8], 0xa
jne 0x4b80ed
mov eax, ebx
mov edx, 0x4b81a0
call fcn.0040471c
jmp 0x4b8107
cmp dword [esp + 4], 4
jne 0x4b8107
cmp dword [esp + 8], 0x5a
jne 0x4b8107
mov eax, ebx
mov edx, 0x4b81b4
call fcn.0040471c
add esp, 0x94
pop ebx
ret
Function at 0x4b8b88
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [0x4cb198]
cmp byte [eax + 0x583], 2
je 0x4b8c90
xor eax, eax
push ebp
push 0x4b8bdc
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4b8ca0
mov eax, dword [0x4cb198]
call fcn.004b91dc
mov ebx, 0xa
push 0x32
call sub.kernel32.dll_Sleep_1
dec ebx
jne 0x4b8bc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b8be6
xor eax, eax
push ebp
push 0x4b8c08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4cb198]
call fcn.004c1c38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b8c12
lea eax, [ebp - 8]
push eax
push 0xf00ff
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4b8c90
lea eax, [ebp - 0x18]
push eax
push 0x4b8cb0
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x4b8c90
mov eax, dword [ebp - 4]
and eax, 1
dec eax
jne 0x4b8c85
push 0
call sub.ntdll.dll_NtShutdownSystem
jmp 0x4b8c90
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ExitWindowsEx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b8cc4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe0c
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b8dcd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x4b8de4
call fcn.0040471c
xor edx, edx
push ebp
push 0x4b8db0
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1d4]
push eax
push 2
call sub.wsock32.dll_WSAStartup
push 0x40
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x4b8d2e
call fcn.0040412c
jmp 0x4b8db7
mov eax, dword [eax + 0xc]
mov ebx, dword [eax]
lea eax, [ebp - 4]
push eax
xor eax, eax
mov al, byte [ebx]
mov dword [ebp - 0x1f4], eax
mov byte [ebp - 0x1f0], 0
xor eax, eax
mov al, byte [ebx + 1]
mov dword [ebp - 0x1ec], eax
mov byte [ebp - 0x1e8], 0
xor eax, eax
mov al, byte [ebx + 2]
mov dword [ebp - 0x1e4], eax
mov byte [ebp - 0x1e0], 0
xor eax, eax
mov al, byte [ebx + 3]
mov dword [ebp - 0x1dc], eax
mov byte [ebp - 0x1d8], 0
lea edx, [ebp - 0x1f4]
mov ecx, 3
mov eax, 0x4b8df4
call fcn.0040a128
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040471c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8db7
call sub.wsock32.dll_WSACleanup
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8dd4
lea eax, [ebp - 4]
call fcn.004046c8
ret