joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a93fb
Capabilities:
Check for time delay via gettickcount
Get socket status

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x31c
push ebx
mov ebx, dword [ebp + 0x78]
push esi
mov esi, dword [ebp + 0x74]
xor edx, edx
push edi
xor edi, edi
cmp esi, 0xffffffff
mov dword [ebp + 0x64], edx
mov dword [ebp + 0x68], edx
jne 0x4a942f
cmp ebx, esi
jne 0x4a942f
mov eax, dword [ebp + 0x7c]
call fcn.004a93dc
jmp 0x4a95cc
cmp dword [ebp + 0x7c], edx
jle 0x4a9444
mov edi, dword [ebp + 0x7c]
call fcn.004aa9c1
mov dword [ebp + 0x68], edx
mov dword [ebp + 0x64], eax
xor edx, edx
xor eax, eax
or ecx, 0xffffffff
inc eax
cmp esi, ecx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0x1ac], edx
je 0x4a9474
mov dword [ebp - 0x1a8], esi
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa8], eax
mov ecx, esi
cmp ebx, 0xffffffff
mov dword [ebp - 0x2b0], edx
je 0x4a94cb
mov dword [ebp - 0x2b0], eax
xor eax, eax
cmp dword [ebp - 0xa8], edx
mov dword [ebp - 0x2ac], ebx
jbe 0x4a94a7
cmp dword [ebp + eax*4 - 0xa4], ebx
je 0x4a94a7
inc eax
cmp eax, dword [ebp - 0xa8]
jb 0x4a9495
cmp eax, dword [ebp - 0xa8]
jne 0x4a94c5
cmp dword [ebp - 0xa8], 0x40
jae 0x4a94c5
mov dword [ebp + eax*4 - 0xa4], ebx
inc dword [ebp - 0xa8]
cmp ebx, ecx
jbe 0x4a94cb
mov ecx, ebx
cmp dword [ebp + 0x7c], edx
jge 0x4a94d4
xor ebx, ebx
jmp 0x4a94d7
lea ebx, [ebp + 0x5c]
lea esi, [ecx + 1]
xor eax, eax
cmp dword [ebp + 0x7c], eax
jle 0x4a94f6
mov eax, edi
cdq
mov ecx, 0x3e8
idiv ecx
imul edx, edx, 0x3e8
mov dword [ebp + 0x60], edx
jmp 0x4a94fb
jne 0x4a94fe
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x5c], eax
push ebx
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x1ac]
push eax
push esi
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x4a9557
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x4a9531
cmp eax, 0x2714
jne 0x4a955b
cmp dword [ebp + 0x7c], 0
jle 0x4a94da
push dword [ebp + 0x68]
push dword [ebp + 0x64]
call fcn.004aa9c1
push edx
push eax
call fcn.004aa9d7
mov edi, dword [ebp + 0x7c]
sub edi, eax
add esp, 0x10
test edi, edi
jg 0x4a94da
jmp 0x4a955b
test eax, eax
jge 0x4a9560
or eax, 0xffffffff
jmp 0x4a95cc
jne 0x4a9566
xor eax, eax
jmp 0x4a95cc
xor esi, esi
cmp dword [ebp + 0x74], 0xffffffff
je 0x4a9598
lea eax, [ebp - 0x1ac]
push eax
push dword [ebp + 0x74]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4a9582
inc esi
lea eax, [ebp - 0xa8]
push eax
push dword [ebp + 0x74]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4a9598
or esi, 4
cmp dword [ebp + 0x78], 0xffffffff
je 0x4a95ca
lea eax, [ebp - 0x2b0]
push eax
push dword [ebp + 0x78]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4a95b4
or esi, 2
lea eax, [ebp - 0xa8]
push eax
push dword [ebp + 0x78]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4a95ca
or esi, 4
mov eax, esi
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret
Function at 0x4ab519
Capabilities:
Parse pe header

Disassembly:
movsx eax, byte [esp + 4]
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x4ab526
jmp dword [eax*4 + 0x4ab581]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
mov al, byte [esp + 4]
ret

Function at 0x4ad269
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi]
push ebx
xor ebx, ebx
cmp dword [eax + 4], 2
push edi
sete bl
test ebx, ebx
je 0x4ad28d
push dword [eax + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [esi + 0xc]
jmp 0x4ad2be
cmp dword [esi + 8], 0
jne 0x4ad2ae
push 0x4d41a4
push dword [eax + 8]
call fcn.0048047a
test eax, eax
pop ecx
pop ecx
mov dword [esi + 8], eax
jne 0x4ad2ae
or eax, 0xffffffff
jmp 0x4ad2e4
push dword [esi + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.00480c83
mov edi, eax
add esp, 0x10
test edi, edi
je 0x4ad2cc
cmp edi, dword [ebp + 0xc]
jbe 0x4ad2e2
test ebx, ebx
jne 0x4ad2dc
push dword [esi + 8]
call fcn.004804ff
and dword [esi + 8], ebx
pop ecx
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop ebx
pop ebp
ret
Function at 0x4aff20
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x4fb304]
xor eax, ebp
mov dword [ebp - 8], eax
mov word [ebp - 0x218], 0
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.00480cb0
add esp, 0xc
mov byte [ebp - 1], 0
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
ja 0x4aff76
jmp 0x4b0023
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov dword [ebp - 0x21c], 0
jmp 0x4aff9e
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jae 0x4b0023
mov word [ebp - 0x430], 0
push 0x208
push 0
lea ecx, [ebp - 0x42e]
push ecx
call fcn.00480cb0
add esp, 0xc
push 0xffffffffffffffff
lea edx, [ebp - 0x218]
push edx
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.0048471f
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx*4 + 0x50006c]
push edx
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.004ae29c
add esp, 0x10
lea ecx, [ebp - 0x430]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b001e
mov byte [ebp - 1], 1
jmp 0x4b0023
jmp 0x4aff8f
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00485d3d
mov esp, ebp
pop ebp
ret

Function at 0x4b0040
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0xd], 0
add byte [eax - 0x78], ch
add al, byte [eax]
add al, ch
xor al, 0xfd
inc dword [ebx + 0x458904c4]
in al, dx
cmp dword [ebp - 0x14], 0
jne 0x4b0067
xor al, al
jmp 0x4b0151
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x288
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.iphlpapi.dll_GetAdaptersInfo
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x6f
jne 0x4b00ca
mov edx, dword [ebp - 0x14]
push edx
call fcn.00480959
add esp, 4
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.00483546
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4b00ba
xor al, al
jmp 0x4b0151
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call sub.iphlpapi.dll_GetAdaptersInfo
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x4b012e
cmp dword [ebp - 0x14], 0
je 0x4b012e
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x190], 3
ja 0x4b00f2
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
jmp 0x4b00d6
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x194]
cmp edx, 0x52
jne 0x4b0124
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x195]
cmp ecx, 0x54
jne 0x4b0124
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + 0x196]
test eax, eax
jne 0x4b0124
mov byte [ebp - 0xd], 1
jmp 0x4b012e
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
jmp 0x4b00d6
cmp dword [ebp - 8], 0
je 0x4b014e
mov eax, dword [ebp - 8]
push eax
call fcn.00480959
add esp, 4
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret
Function at 0x4b0160
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov byte [ebp - 9], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b01a0
mov byte [ebp - 9], 0
jmp 0x4b021d
push 0x80
call fcn.00483546
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 0x50
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4b01e9
mov byte [ebp - 9], 0
jmp 0x4b0201
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.0046c910
add esp, 8
test eax, eax
je 0x4b0201
mov byte [ebp - 9], 1
cmp dword [ebp - 0x18], 0
je 0x4b0213
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00480959
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x4b0300
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x4fb304]
xor eax, ebp
mov dword [ebp - 8], eax
mov word [ebp - 0x218], 0
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.00480cb0
add esp, 0xc
mov byte [ebp - 1], 0
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
ja 0x4b0356
jmp 0x4b0403
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov dword [ebp - 0x21c], 0
jmp 0x4b037e
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 5
jae 0x4b0403
mov word [ebp - 0x430], 0
push 0x208
push 0
lea ecx, [ebp - 0x42e]
push ecx
call fcn.00480cb0
add esp, 0xc
push 0xffffffffffffffff
lea edx, [ebp - 0x218]
push edx
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.0048471f
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx*4 + 0x500044]
push edx
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.004ae29c
add esp, 0x10
lea ecx, [ebp - 0x430]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4b03fe
mov byte [ebp - 1], 1
jmp 0x4b0403
jmp 0x4b036f
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00485d3d
mov esp, ebp
pop ebp
ret
Function at 0x4b0420
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x4fb304]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x23d], 0
mov dword [ebp - 0x23c], 0xffffffff
mov dword [ebp - 0x238], 0
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.00480cb0
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
jne 0x4b048a
jmp 0x4b04d9
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4b04d9
lea eax, [ebp - 0x214]
push eax
push str.vmusrvc.exe
call fcn.004827f5
add esp, 8
test eax, eax
jne 0x4b04c2
mov byte [ebp - 0x23d], 1
jmp 0x4b04d9
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4b04a1
cmp dword [ebp - 0x23c], 0
je 0x4b04f9
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x23c], 0
mov al, byte [ebp - 0x23d]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485d3d
mov esp, ebp
pop ebp
ret

Function at 0x4b0e90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4b0eb3
xor eax, eax
jmp 0x4b0f7e
push 1
mov edx, dword [ebp - 8]
push edx
call fcn.004826a7
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4b0ed1
xor eax, eax
jmp 0x4b0f7e
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x4b0efd
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00480959
add esp, 4
xor eax, eax
jmp 0x4b0f7e
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x14]
push eax
push 0x4d53d4
mov ecx, dword [ebp - 0x18]
push ecx
call sub.VERSION.dll_VerQueryValueW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b0f70
cmp dword [ebp - 0x14], 0
je 0x4b0f70
push 0x10
call fcn.00417421
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4b0f5c
mov edx, dword [ebp - 0x14]
movzx eax, word [edx + 2]
push eax
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.004b0e30
mov dword [ebp - 0x24], eax
jmp 0x4b0f63
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
jmp 0x4b0f7e
mov edx, dword [ebp - 0x18]
push edx
call fcn.00480959
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4b0f90
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4fb304]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x25c]
mov dx, word [ecx + 4]
mov word [ebp + eax*2 - 0x18], dx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x25c]
mov ax, word [edx + 8]
mov word [ebp + ecx*2 - 0x18], ax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, dword [ebp - 4]
mov word [ebp + edx*2 - 0x18], ax
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x25c]
mov ax, word [edx + 8]
mov word [ebp + ecx*2 - 0x18], ax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x25c]
mov cx, word [eax + 4]
mov word [ebp + edx*2 - 0x18], cx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov word [ebp + eax*2 - 0x18], 0x4e4
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, dword [ebp - 4]
mov word [ebp + edx*2 - 0x18], ax
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov word [ebp + ecx*2 - 0x18], 0x4e4
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 8
jae 0x4b1120
mov eax, dword [ebp - 4]
mov cx, word [ebp + eax*2 - 0x18]
mov word [ebp - 0x2c], cx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov cx, word [ebp + eax*2 - 0x18]
mov word [ebp - 0x1c], cx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
push eax
movzx ecx, word [ebp - 0x1c]
push ecx
movzx edx, word [ebp - 0x2c]
push edx
push 0x4d55e0
push 0x104
push 0x104
lea eax, [ebp - 0x238]
push eax
call fcn.004845bb
add esp, 0x1c
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x25c]
mov edx, dword [ecx]
push edx
call sub.VERSION.dll_VerQueryValueW
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4b111b
cmp dword [ebp - 0x20], 0
je 0x4b111b
mov eax, dword [ebp - 0x20]
push eax
mov esi, dword [ebp + 0xc]
call fcn.00409695
mov al, 1
jmp 0x4b1122
jmp 0x4b1078
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00485d3d
mov esp, ebp
pop ebp
ret 8
Function at 0x4b1260
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4eb730
push 0x488510
mov eax, dword fs:[0]
push eax
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, dword [0x4fb304]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
cmp dword [ebp + 8], 0
je 0x4b12ba
cmp dword [ebp + 0xc], 0
je 0x4b12ba
cmp dword [ebp + 0x10], 1
jae 0x4b12bf
jmp 0x4b139d
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jb 0x4b12e1
mov ecx, dword [ebp + 0x10]
sub ecx, 1
cmp dword [ebp - 0x1c], ecx
jbe 0x4b12e6
jmp 0x4b139d
mov dword [ebp - 4], 0
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047da0e
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4b1321
mov dword [ebp - 4], 0xfffffffe
jmp 0x4b139d
mov ecx, dword [ebp - 0x1c]
shl ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x20]
push edx
call fcn.00480cb0
add esp, 0xc
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4b137d
mov eax, dword [ebp + 0x10]
sub eax, 1
cmp dword [ebp - 0x1c], eax
ja 0x4b137d
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp + 0x10]
sub eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0048471f
add esp, 0x10
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xfffffffe
jmp 0x4b139d
cmp dword [ebp - 0x20], 0
je 0x4b13bc
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00480c9e
add esp, 4
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b1430
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x4fb304]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, dword [ebp + 8]
call fcn.00406fcc
movzx eax, al
test eax, eax
je 0x4b145a
xor eax, eax
jmp 0x4b16c2
mov word [ebp - 0x218], 0
push 0x208
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.00480cb0
add esp, 0xc
push 0x4d5620
xor ecx, ecx
mov esi, dword [ebp + 8]
call fcn.00408e81
cmp eax, 0xffffffff
je 0x4b14cb
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0x4d5644
call fcn.004b1260
add esp, 0xc
test eax, eax
jne 0x4b14b1
xor eax, eax
jmp 0x4b16c2
lea eax, [ebp - 0x218]
push eax
push 0x4d5668
mov ecx, dword [ebp + 8]
push ecx
call fcn.0044a0e1
jmp 0x4b16b1
push 0x4d568c
xor ecx, ecx
mov esi, dword [ebp + 8]
call fcn.00408e81
cmp eax, 0xffffffff
je 0x4b151d
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0x4d56a0
call fcn.004b1260
add esp, 0xc
test eax, eax
jne 0x4b1503
xor eax, eax
jmp 0x4b16c2
lea eax, [ebp - 0x218]
push eax
push 0x4d56b4
mov ecx, dword [ebp + 8]
push ecx
call fcn.0044a0e1
jmp 0x4b16b1
push 0x4d56c8
xor ecx, ecx
mov esi, dword [ebp + 8]
call fcn.00408e81
cmp eax, 0xffffffff
je 0x4b156f
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0x4d56d8
call fcn.004b1260
add esp, 0xc
test eax, eax
jne 0x4b1555
xor eax, eax
jmp 0x4b16c2
lea eax, [ebp - 0x218]
push eax
push 0x4d56e8
mov ecx, dword [ebp + 8]
push ecx
call fcn.0044a0e1
jmp 0x4b16b1
push 0x4d56f8
xor ecx, ecx
mov esi, dword [ebp + 8]
call fcn.00408e81
cmp eax, 0xffffffff
je 0x4b15ba
push 0x104
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
ja 0x4b15a0
xor eax, eax
jmp 0x4b16c2
lea eax, [ebp - 0x218]
push eax
push 0x4d570c
mov ecx, dword [ebp + 8]
push ecx
call fcn.0044a0e1
jmp 0x4b16b1
push 0x4d5720
xor ecx, ecx
mov esi, dword [ebp + 8]
call fcn.00408e81
cmp eax, 0xffffffff
je 0x4b1605
push 0x104
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
ja 0x4b15eb
xor eax, eax
jmp 0x4b16c2
lea eax, [ebp - 0x218]
push eax
push 0x4d5734
mov ecx, dword [ebp + 8]
push ecx
call fcn.0044a0e1
jmp 0x4b16b1
push 0x4d5748
xor ecx, ecx
mov esi, dword [ebp + 8]
call fcn.00408e81
cmp eax, 0xffffffff
je 0x4b1667
push 0x20a
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.00480cb0
add esp, 0xc
push 0x105
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 0x218]
push edx
push 0x4d575c
mov eax, dword [ebp + 8]
push eax
call fcn.0044a0e1
jmp 0x4b16b1
push 0x4d5770
xor ecx, ecx
mov esi, dword [ebp + 8]
call fcn.00408e81
cmp eax, 0xffffffff
je 0x4b16b1
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0x4d578c
call fcn.004b1260
add esp, 0xc
test eax, eax
jne 0x4b169c
xor eax, eax
jmp 0x4b16c2
lea edx, [ebp - 0x218]
push edx
push str._Systemroot_
mov eax, dword [ebp + 8]
push eax
call fcn.0044a0e1
mov ecx, dword [ebp + 8]
push ecx
call fcn.004b13e0
add esp, 4
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485d3d
mov esp, ebp
pop ebp
ret
Function at 0x4b64c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x4b6720
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4fb304]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0x80004005
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x28], 0xffffffff
mov byte [ebp - 0xc], 0
xor eax, eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
cmp dword [ebp + 8], 0
je 0x4b6781
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
test edx, edx
jne 0x4b678b
jmp 0x4b68ae
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x4b67ba
jmp 0x4b68ae
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
ja 0x4b67d9
jmp 0x4b68ae
push 0
lea edx, [ebp - 0x1c]
push edx
push 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4b6802
jmp 0x4b68ae
lea edx, [ebp - 0xc]
push edx
call fcn.004b6640
add esp, 4
test eax, eax
jne 0x4b681c
jmp 0x4b68ae
mov eax, dword [ebp - 0x14]
sub eax, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 1
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4b6841
jmp 0x4b68ae
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x2c]
mov dword [edx], eax
push 0
push 0
push 4
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4b687e
jmp 0x4b68ae
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.004b6670
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x4b68ae
cmp dword [ebp - 0x24], 0
je 0x4b68ae
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x28], 0xffffffff
je 0x4b68c5
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00485d3d
mov esp, ebp
pop ebp
ret
Function at 0x4b71a0
Capabilities:
Check for sandbox and av modules

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.SbieDll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], 0
setne al
mov esp, ebp
pop ebp
ret