joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c4ef7
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
and dword [eax], 0
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
mov dword [ebp - 8], eax
jne 0x4c5069
push esi
mov esi, dword [ebp - 0x10]
test esi, esi
mov dword [ebp - 0xc], esi
je 0x4c504e
push ebx
push edi
jmp 0x4c4f3f
mov esi, dword [ebp - 0xc]
cmp dword [esi + 4], 2
jne 0x4c4fe2
cmp dword [esi + 0x18], 0
je 0x4c4fe2
mov eax, dword [esi + 0x10]
test eax, eax
jbe 0x4c4fe2
push 0x10
pop edi
cmp eax, edi
jb 0x4c4fe2
push 0x20
call dword [0x5148b8]
mov ebx, eax
xor eax, eax
cmp ebx, eax
pop ecx
je 0x4c4ff2
mov ecx, dword [esi]
mov dword [ebx], ecx
mov ecx, dword [esi + 4]
mov dword [ebx + 4], ecx
mov ecx, dword [esi + 8]
mov dword [ebx + 8], ecx
mov ecx, dword [esi + 0xc]
push edi
mov dword [ebx + 0xc], ecx
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x1c], eax
call dword [0x5148b8]
test eax, eax
pop ecx
mov dword [ebx + 0x18], eax
je 0x4c4ffb
mov esi, dword [esi + 0x18]
mov edi, eax
mov eax, dword [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0x14]
test eax, eax
je 0x4c4fc9
push eax
call dword [0x5148c4]
test eax, eax
pop ecx
mov dword [ebx + 0x14], eax
je 0x4c500b
cmp dword [ebp - 4], 0
jne 0x4c4fd2
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4c4fdc
mov dword [eax + 0x1c], ebx
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x14], ebx
mov esi, dword [esi + 0x1c]
test esi, esi
mov dword [ebp - 0xc], esi
jne 0x4c4f3c
jmp 0x4c5024
mov dword [ebp - 8], 8
jmp 0x4c5024
push ebx
mov dword [ebp - 8], 8
call dword [0x5148bc]
jmp 0x4c5023
push dword [ebx + 0x18]
mov dword [ebp - 8], 8
call dword [0x5148bc]
push ebx
call dword [0x5148bc]
pop ecx
pop ecx
xor esi, esi
cmp dword [ebp - 0x10], esi
pop edi
pop ebx
je 0x4c5036
push dword [ebp - 0x10]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [ebp - 8], esi
je 0x4c5049
push dword [ebp - 4]
call fcn.004c4ebb
pop ecx
mov dword [ebp - 4], esi
jmp 0x4c505d
cmp dword [ebp - 4], esi
jne 0x4c505d
mov eax, 0x2af9
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
pop esi
leave
ret
Function at 0x4c53bb
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x48
push 1
mov ebx, eax
mov edi, ecx
call dword [0x5148c8]
mov esi, eax
xor eax, eax
cmp esi, eax
pop ecx
pop ecx
mov dword [ebp - 4], 0xc
mov dword [edi + 0x3ac], esi
je 0x4c546d
mov dword [edi + 0x3a4], eax
mov dword [edi + 0x3a8], eax
mov dword [edi + 0x3a0], eax
mov dword [edi + 0x39c], ebx
or dword [esi + 4], 0xffffffff
push ebx
push dword [ebp + 8]
mov dword [esi], eax
lea eax, [esi + 0x10]
call fcn.004c5277
test eax, eax
pop ecx
pop ecx
je 0x4c546d
lea ebx, [edi + 0x398]
push dword [ebx]
call fcn.004bb756
push dword [ebp + 8]
call dword [0x5148c4]
test eax, eax
pop ecx
pop ecx
mov dword [ebx], eax
je 0x4c546d
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x4c546d
lea eax, [esi + 0x10]
push eax
push 0x4c52eb
call fcn.004cca9f
test eax, eax
pop ecx
pop ecx
mov dword [esi], eax
jne 0x4c5487
call fcn.00497f6e
mov eax, dword [eax]
mov dword [ebp - 4], eax
add edi, 0x398
push edi
call fcn.004c5369
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor eax, eax
jmp 0x4c548a
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4c8fe1
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x31c
push ebx
mov ebx, dword [ebp + 0x78]
push esi
mov esi, dword [ebp + 0x74]
xor edx, edx
push edi
xor edi, edi
cmp esi, 0xffffffff
mov dword [ebp + 0x64], edx
mov dword [ebp + 0x68], edx
jne 0x4c9015
cmp ebx, esi
jne 0x4c9015
mov eax, dword [ebp + 0x7c]
call fcn.004c8fc2
jmp 0x4c91b2
cmp dword [ebp + 0x7c], edx
jle 0x4c902a
mov edi, dword [ebp + 0x7c]
call fcn.004ca5a7
mov dword [ebp + 0x68], edx
mov dword [ebp + 0x64], eax
xor edx, edx
xor eax, eax
or ecx, 0xffffffff
inc eax
cmp esi, ecx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0x1ac], edx
je 0x4c905a
mov dword [ebp - 0x1a8], esi
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa8], eax
mov ecx, esi
cmp ebx, 0xffffffff
mov dword [ebp - 0x2b0], edx
je 0x4c90b1
mov dword [ebp - 0x2b0], eax
xor eax, eax
cmp dword [ebp - 0xa8], edx
mov dword [ebp - 0x2ac], ebx
jbe 0x4c908d
cmp dword [ebp + eax*4 - 0xa4], ebx
je 0x4c908d
inc eax
cmp eax, dword [ebp - 0xa8]
jb 0x4c907b
cmp eax, dword [ebp - 0xa8]
jne 0x4c90ab
cmp dword [ebp - 0xa8], 0x40
jae 0x4c90ab
mov dword [ebp + eax*4 - 0xa4], ebx
inc dword [ebp - 0xa8]
cmp ebx, ecx
jbe 0x4c90b1
mov ecx, ebx
cmp dword [ebp + 0x7c], edx
jge 0x4c90ba
xor ebx, ebx
jmp 0x4c90bd
lea ebx, [ebp + 0x5c]
lea esi, [ecx + 1]
xor eax, eax
cmp dword [ebp + 0x7c], eax
jle 0x4c90dc
mov eax, edi
cdq
mov ecx, 0x3e8
idiv ecx
imul edx, edx, 0x3e8
mov dword [ebp + 0x60], edx
jmp 0x4c90e1
jne 0x4c90e4
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x5c], eax
push ebx
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x1ac]
push eax
push esi
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x4c913d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x4c9117
cmp eax, 0x2714
jne 0x4c9141
cmp dword [ebp + 0x7c], 0
jle 0x4c90c0
push dword [ebp + 0x68]
push dword [ebp + 0x64]
call fcn.004ca5a7
push edx
push eax
call fcn.004ca5bd
mov edi, dword [ebp + 0x7c]
sub edi, eax
add esp, 0x10
test edi, edi
jg 0x4c90c0
jmp 0x4c9141
test eax, eax
jge 0x4c9146
or eax, 0xffffffff
jmp 0x4c91b2
jne 0x4c914c
xor eax, eax
jmp 0x4c91b2
xor esi, esi
cmp dword [ebp + 0x74], 0xffffffff
je 0x4c917e
lea eax, [ebp - 0x1ac]
push eax
push dword [ebp + 0x74]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4c9168
inc esi
lea eax, [ebp - 0xa8]
push eax
push dword [ebp + 0x74]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4c917e
or esi, 4
cmp dword [ebp + 0x78], 0xffffffff
je 0x4c91b0
lea eax, [ebp - 0x2b0]
push eax
push dword [ebp + 0x78]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4c919a
or esi, 2
lea eax, [ebp - 0xa8]
push eax
push dword [ebp + 0x78]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4c91b0
or esi, 4
mov eax, esi
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret
Function at 0x4cb104
Capabilities:
Parse pe header

Disassembly:
movsx eax, byte [esp + 4]
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x4cb111
jmp dword [eax*4 + 0x4cb16c]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
mov al, byte [esp + 4]
ret

Function at 0x4cce4f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi]
push ebx
xor ebx, ebx
cmp dword [eax + 4], 2
push edi
sete bl
test ebx, ebx
je 0x4cce73
push dword [eax + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [esi + 0xc]
jmp 0x4ccea4
cmp dword [esi + 8], 0
jne 0x4cce94
push 0x4fb7d4
push dword [eax + 8]
call fcn.0049a325
test eax, eax
pop ecx
pop ecx
mov dword [esi + 8], eax
jne 0x4cce94
or eax, 0xffffffff
jmp 0x4cceca
push dword [esi + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.0049978a
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4cceb2
cmp edi, dword [ebp + 0xc]
jbe 0x4ccec8
test ebx, ebx
jne 0x4ccec2
push dword [esi + 8]
call fcn.00499817
and dword [esi + 8], ebx
pop ecx
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop ebx
pop ebp
ret
Function at 0x4cfae0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x5c], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0xc3d2e1f0
mov edx, dword [ebp + 8]
mov dword [edx + 0x60], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x64], 0
pop ebp
ret
Function at 0x4d17a0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 8
jge 0x4d17d9
jmp 0x4d18b4
mov dword [ebp - 8], 0x288
mov dword [ebp - 0x18], 0
jmp 0x4d17f2
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x4d185a
mov ecx, dword [ebp - 8]
push ecx
call fcn.0049130d
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x4d1858
mov eax, dword [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.004923b0
add esp, 0xc
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.iphlpapi.dll_GetAdaptersInfo
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x6f
jne 0x4d1856
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.0049242a
add esp, 4
mov dword [ebp - 4], 0
jmp 0x4d1858
jmp 0x4d185a
jmp 0x4d17e9
cmp dword [ebp - 0x10], 0
jne 0x4d18b4
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4d18b4
push 6
push 0x4f2e08
mov ecx, dword [ebp - 0x14]
add ecx, 0x10c
push ecx
call fcn.0049814c
add esp, 0xc
test eax, eax
je 0x4d18aa
push 8
mov edx, dword [ebp - 0x14]
add edx, 0x194
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00492ac0
add esp, 0xc
mov dword [ebp - 0xc], 1
jmp 0x4d18b4
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
jmp 0x4d1866
cmp dword [ebp - 4], 0
je 0x4d18cc
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.0049242a
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4d18e0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x513454]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0xb0], 0
push 0x9a
push 0
lea eax, [ebp - 0xaf]
push eax
call fcn.004923b0
add esp, 0xc
mov dword [ebp - 8], 0
push 0x9b
lea ecx, [ebp - 0xb0]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x4d195c
lea edx, [ebp - 0xb0]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4d195c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebp - 0xb4], eax
mov ecx, dword [ebp - 0xb4]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0049b84b
mov esp, ebp
pop ebp
ret
Function at 0x4d26e0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e197c
mov eax, dword fs:[0]
push eax
mov eax, 0x6d40
call fcn.004a68e0
mov eax, dword [0x513454]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1f0], 0xffffffff
lea eax, [ebp - 0x1ec]
call fcn.00423603
lea eax, [ebp - 0x3764]
call fcn.0042c239
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1a8]
call fcn.0041d665
mov byte [ebp - 4], 1
mov word [ebp - 0x1a4], 0
push 0x18e
push 0
lea eax, [ebp - 0x1a2]
push eax
call fcn.004923b0
add esp, 0xc
lea ecx, [ebp - 0x1a4]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
je 0x4d278c
jmp 0x4d286a
mov edx, 0x4f2e10
lea ecx, [ebp - 0x1ec]
call fcn.00423646
lea edx, [ebp - 0x1ec]
push edx
lea eax, [ebp - 0x3764]
push eax
mov edi, dword [ebp + 8]
call fcn.0042c384
movzx ecx, al
test ecx, ecx
je 0x4d286a
lea eax, [ebp - 0x3764]
call fcn.00440d80
cmp eax, 0xc8
jne 0x4d286a
lea eax, [ebp - 0x3764]
call fcn.0042c61c
push eax
lea ecx, [ebp - 0x3764]
call fcn.0042c623
push eax
lea eax, [ebp - 0x1a8]
call fcn.0042702b
push 0x4f2e1c
lea edx, [ebp - 0x1a8]
push edx
call fcn.00427008
lea eax, [ebp - 0x1a8]
call fcn.004020de
push eax
lea esi, [ebp - 0x3868]
call fcn.004020e1
mov dword [ebp - 0x6d48], eax
mov eax, dword [ebp - 0x6d48]
mov dword [ebp - 0x6d4c], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x6d4c]
call fcn.004020de
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401b5c
mov byte [ebp - 4], 1
lea eax, [ebp - 0x3868]
call fcn.004020cd
mov eax, dword [ebp + 0xc]
call fcn.004270e9
mov dword [ebp - 0x1f0], 0
cmp dword [ebp - 0x1ac], 0
jne 0x4d2879
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, dword [ebp - 0x1f0]
mov dword [ebp - 0x386c], edx
mov byte [ebp - 4], 0
lea eax, [ebp - 0x1a8]
call fcn.0040221c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3764]
call fcn.00427f77
mov eax, dword [ebp - 0x386c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b84b
mov esp, ebp
pop ebp
ret
Function at 0x4d4780
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x513454]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0x80004005
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x28], 0xffffffff
mov byte [ebp - 0xc], 0
xor eax, eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
cmp dword [ebp + 8], 0
je 0x4d47e1
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
test edx, edx
jne 0x4d47eb
jmp 0x4d490e
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x4d481a
jmp 0x4d490e
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
ja 0x4d4839
jmp 0x4d490e
push 0
lea edx, [ebp - 0x1c]
push edx
push 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4d4862
jmp 0x4d490e
lea edx, [ebp - 0xc]
push edx
call fcn.004d46a0
add esp, 4
test eax, eax
jne 0x4d487c
jmp 0x4d490e
mov eax, dword [ebp - 0x14]
sub eax, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 1
push ecx
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4d48a1
jmp 0x4d490e
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x2c]
mov dword [edx], eax
push 0
push 0
push 4
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4d48de
jmp 0x4d490e
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.004d46d0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x4d490e
cmp dword [ebp - 0x24], 0
je 0x4d490e
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.DLL_LocalFree]
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x28], 0xffffffff
je 0x4d4925
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b84b
mov esp, ebp
pop ebp
ret
Function at 0x4d5260
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x513454]
xor eax, ebp
mov dword [ebp - 8], eax
mov word [ebp - 0x218], 0
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.004923b0
add esp, 0xc
mov byte [ebp - 1], 0
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
test eax, eax
ja 0x4d52b6
jmp 0x4d5363
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov dword [ebp - 0x21c], 0
jmp 0x4d52de
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jae 0x4d5363
mov word [ebp - 0x430], 0
push 0x208
push 0
lea ecx, [ebp - 0x42e]
push ecx
call fcn.004923b0
add esp, 0xc
push 0xffffffffffffffff
lea edx, [ebp - 0x218]
push edx
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.00495af1
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx*4 + 0x519608]
push edx
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.004cdc48
add esp, 0x10
lea ecx, [ebp - 0x430]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d535e
mov byte [ebp - 1], 1
jmp 0x4d5363
jmp 0x4d52cf
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0049b84b
mov esp, ebp
pop ebp
ret

Function at 0x4d5380
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0xd], 0
push 0x288
call fcn.00493ee2
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4d53a7
xor al, al
jmp 0x4d5491
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x288
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.iphlpapi.dll_GetAdaptersInfo
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x6f
jne 0x4d540a
mov edx, dword [ebp - 0x14]
push edx
call fcn.00492a2f
add esp, 4
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.00493ee2
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4d53fa
xor al, al
jmp 0x4d5491
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call sub.iphlpapi.dll_GetAdaptersInfo
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x4d546e
cmp dword [ebp - 0x14], 0
je 0x4d546e
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x190], 3
ja 0x4d5432
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
jmp 0x4d5416
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x194]
cmp edx, 0x52
jne 0x4d5464
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x195]
cmp ecx, 0x54
jne 0x4d5464
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + 0x196]
test eax, eax
jne 0x4d5464
mov byte [ebp - 0xd], 1
jmp 0x4d546e
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
jmp 0x4d5416
cmp dword [ebp - 8], 0
je 0x4d548e
mov eax, dword [ebp - 8]
push eax
call fcn.00492a2f
add esp, 4
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret
Function at 0x4d54a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov byte [ebp - 9], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4d54e0
mov byte [ebp - 9], 0
jmp 0x4d555d
push 0x80
call fcn.00493ee2
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 0x50
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4d5529
mov byte [ebp - 9], 0
jmp 0x4d5541
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.0044f93d
add esp, 8
test eax, eax
je 0x4d5541
mov byte [ebp - 9], 1
cmp dword [ebp - 0x18], 0
je 0x4d5553
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00492a2f
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x4d5620
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x513454]
xor eax, ebp
mov dword [ebp - 8], eax
mov word [ebp - 0x218], 0
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.004923b0
add esp, 0xc
mov byte [ebp - 1], 0
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
test eax, eax
ja 0x4d5676
jmp 0x4d5723
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov dword [ebp - 0x21c], 0
jmp 0x4d569e
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 5
jae 0x4d5723
mov word [ebp - 0x430], 0
push 0x208
push 0
lea ecx, [ebp - 0x42e]
push ecx
call fcn.004923b0
add esp, 0xc
push 0xffffffffffffffff
lea edx, [ebp - 0x218]
push edx
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.00495af1
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx*4 + 0x5195e0]
push edx
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.004cdc48
add esp, 0x10
lea ecx, [ebp - 0x430]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4d571e
mov byte [ebp - 1], 1
jmp 0x4d5723
jmp 0x4d568f
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0049b84b
mov esp, ebp
pop ebp
ret
Function at 0x4d5740
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x513454]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x23d], 0
mov dword [ebp - 0x23c], 0xffffffff
mov dword [ebp - 0x238], 0
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.004923b0
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
jne 0x4d57aa
jmp 0x4d57f9
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call sub.KERNEL32.DLL_Process32FirstW
test eax, eax
je 0x4d57f9
lea eax, [ebp - 0x214]
push eax
push str.vmusrvc.exe
call fcn.00493a74
add esp, 8
test eax, eax
jne 0x4d57e2
mov byte [ebp - 0x23d], 1
jmp 0x4d57f9
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x4d57c1
cmp dword [ebp - 0x23c], 0
je 0x4d5819
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0x23c], 0
mov al, byte [ebp - 0x23d]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b84b
mov esp, ebp
pop ebp
ret