joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499a04
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00499358
xor eax, eax
push ebp
push 0x499b76
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x499b60
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x499a4f
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x499a59
call fcn.004bb254
jmp 0x499b7d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004a0be4
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 8]
mov ebx, eax
test ebx, ebx
jle 0x499b55
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.WSOCK32.DLL_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x499b07
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x499af4
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004babd8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.004999bc
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x499b88]
cmp dl, byte [eax + 0x28]
je 0x499b5c
call fcn.004ad710
jmp 0x499b5c
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004a0c04
jmp 0x499b5c
cmp ecx, ebx
jge 0x499b23
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004a0c04
jmp 0x499a59
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004a0be4
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.004a0c18
cmp edx, dword [esp + 4]
jne 0x499b44
cmp eax, dword [esp]
pop edx
pop eax
jne 0x499a59
push ebp
call fcn.004999bc
pop ecx
jmp 0x499b5c
push ebp
call fcn.004999bc
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499b7d
mov eax, dword [ebp - 4]
call fcn.00499364
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49a220
Capabilities:
Get socket status

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ecx, edx
mov ebx, eax
mov eax, ecx
mov esi, 0x3e8
cdq
idiv esi
mov dword [esp], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [esp + 4], eax
lea eax, [esp + 8]
call fcn.004970b8
lea edx, [esp + 8]
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
call fcn.004970a8
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.WSOCK32.DLL_select
test eax, eax
setg al
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4a69bc
Capabilities:
Suspend thread

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0xe], 1
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_SuspendThread
test eax, eax
setge dl
mov eax, ebx
call fcn.004a6840
pop ebx
ret
Function at 0x4a69dc
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004a6840
dec esi
jne 0x4a69fe
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x4a7b28
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4e409c
cmp dword [edi], 0
jne 0x4a7ba4
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x4e4098]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4ded00
mov ecx, 2
call fcn.004b9d5c
mov edx, 0x4a7b00
lea eax, [esi + 5]
call fcn.004a7b20
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004a7b20
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4a7b79
mov dword [0x4e4098], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4a9074
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.004a8cd8
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.004bbbbc
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
je 0x4a90d2
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4e3118]
mov dl, 1
mov eax, dword [0x4a8bd0]
call fcn.004ad864
call fcn.004bb1a8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4a90dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004bbbbc
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4a9134
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4e3114]
mov dl, 1
mov eax, dword [0x4a8bd0]
call fcn.004ad864
call fcn.004bb1a8
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004a8d08
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4acf60
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x4acf99
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004bb7fc
jmp 0x4acfa2
mov eax, ebx
mov edx, esi
call fcn.004bb760
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4acfac
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x4acfcd
mov al, byte [esp]
jmp 0x4acfcf
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4ad654
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x4ad4cc
mov eax, dword [0x4e3338]
cmp byte [eax], 0
je 0x4ad6c1
mov eax, dword [0x4e333c]
call fcn.004ba118
call fcn.004b9cc8
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.004ab488
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4ad708
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x4ad6f7
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4e31f0]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4e339c]
call fcn.004bce58
push eax
call sub.USER32.DLL_LoadStringA
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.USER32.DLL_MessageBoxA
add esp, 0x444
ret

Function at 0x4ae328
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4ae38c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004bb974
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.004aafdc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae393
lea eax, [ebp - 0xc]
call fcn.004bb70c
ret
Function at 0x4ba84c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4df240]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4ba8e4
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4ba8c4
xor eax, eax
push ebp
push 0x4ba8bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4ba900
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba8c4
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x4df240]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4df240], ax
mov esp, ebp
pop ebp
ret

Function at 0x4bb50c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4e43c4], 0
je 0x4bb56d
cmp word [0x4e4598], 0xd7b2
jne 0x4bb535
cmp dword [0x4e45a0], 0
jbe 0x4bb535
mov eax, 0x4e4594
call dword [0x4e45b0]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4bb594
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x4df250], 0
jne 0x4bb589
push 0
push 0x4df2a8
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret

Function at 0x4bb6c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004b9af8
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4e43c5], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4bb688
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4bd04c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4bd27c
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x4bd0cf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4bd27c
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x4bd0cf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4bd298
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4bd158
xor eax, eax
push ebp
push 0x4bd151
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004bce94
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4bd136
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4bd2b8
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4bd136
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd158
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4bd272
cmp byte [ebp - 0xd], 0
jne 0x4bd19f
cmp byte [ebp - 0x12], 0
je 0x4bd272
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4bd1b8
dec ebx
cmp byte [ebx], 0x2e
je 0x4bd1c7
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4bd1b7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4bd272
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4bd204
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4bd272
cmp byte [ebp - 0xd], 0
je 0x4bd272
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4bd272
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bd9f0
Capabilities:
Accept command line arguments

Disassembly:
sub dword [0x4e4938], 1
jae 0x4bda76
mov byte [0x4df23c], 2
mov dword [0x4e4388], 0x4cc5f8
mov dword [0x4e438c], 0x4cc610
mov byte [0x4e43c6], 2
mov dword [0x4e4374], 0x4bc67c
call fcn.004ba81c
test al, al
je 0x4bda33
call fcn.004ba84c
call fcn.004ba910
mov word [0x4e43cc], 0xd7b0
mov word [0x4e4598], 0xd7b0
mov word [0x4e4764], 0xd7b0
call fcn.004bc55c
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x4e43b8], eax
call fcn.004b8794
mov dword [0x4e43b4], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x4e43ac], eax
ret

Function at 0x4bfbe8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4bfc04
call fcn.004c11cc
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4bfc20
test bl, 1
je 0x4bfc20
call fcn.004c61d4
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4bfe04
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004c0d68
test byte [ebp + 0xd], 0xc0
jne 0x4bfe28
mov eax, dword [0x4e014c]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4bfe35
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4bfe62
je 0x4bfe74
sub ecx, 0x100
je 0x4bfe82
sub ecx, 0x100
je 0x4bfe89
sub ecx, 0x100
je 0x4bfe7b
jmp 0x4bfe90
sub ecx, 0x600
je 0x4bfe89
sub ecx, 0x100
je 0x4bfe74
jmp 0x4bfe90
mov edi, 1
jmp 0x4bfe95
mov edi, 2
jmp 0x4bfe95
mov edi, 4
jmp 0x4bfe95
mov edi, 5
jmp 0x4bfe95
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4bfebc
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4dfbc4]
test al, 0x80
je 0x4bfeb5
mov ebx, 0x80
jmp 0x4bfece
mov ebx, 1
jmp 0x4bfece
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4bfece
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4bfee0
je 0x4bfee9
dec eax
je 0x4bfef2
jmp 0x4bfefb
mov dword [ebp - 4], closesocket
jmp 0x4bff0a
mov dword [ebp - 4], 0x40000000
jmp 0x4bff0a
mov dword [ebp - 4], 0xc0000000
jmp 0x4bff0a
push 1
call fcn.004c1160
pop ecx
mov ebx, eax
jmp 0x4bfffa
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4bff26
sub eax, 0x10
je 0x4bff2d
sub eax, 0x10
je 0x4bff36
sub eax, 0x10
je 0x4bff3f
jmp 0x4bff3f
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4bff46
mov dword [ebp - 8], 1
jmp 0x4bff46
mov dword [ebp - 8], 2
jmp 0x4bff46
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4bffb3
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4bffa8
test byte [ebp + 0xd], 1
je 0x4bffa3
mov ebx, 0x50
jmp 0x4bffa8
mov ebx, 2
push ebx
call fcn.004c1160
pop ecx
mov ebx, eax
jmp 0x4bfffa
mov edi, esi
push edi
call fcn.004bfd68
pop ecx
test eax, eax
je 0x4bffc7
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4bffd3
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004c0e88
add esp, 8
mov ebx, eax
inc eax
jne 0x4bfffa
push 4
call fcn.004c1160
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.004c0d9c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c616c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x4c61ce
call fcn.004c611c
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004bea54
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004bea54
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4c624c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4e124c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4c6326
cmp dword [0x4e1248], 0
jne 0x4c6326
cmp dword [0x4e144c], 0
je 0x4c62e0
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004c601c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4c62c6
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004c601c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4c62c6
lea ebx, [ebp - 0x84]
jmp 0x4c62c7
inc ebx
call fcn.004c6208
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4c6361
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4e1250
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004bea54
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4e1253
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4c6361
cmp dword [0x4e1248], 0
je 0x4c6340
cmp dword [0x4e1248], 0xffffffff
je 0x4c6361
push esi
call dword [0x4e1248]
pop ecx
mov eax, dword [0x4e124c]
test eax, eax
je 0x4c6361
cmp dword [0x4e124c], 0xffffffff
je 0x4c6361
cmp byte [eax], 0
je 0x4c6361
push esi
push eax
call fcn.004c616c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c6b6c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4e52dc], 0
jne 0x4c6bed
cmp dword [0x4e52fc], 0
jne 0x4c6b9c
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4e52fc], eax
test eax, eax
jne 0x4c6b9c
push str.GetEnvironmentStrings_failed
call fcn.004c6378
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4e52fc]
jmp 0x4c6bb0
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004bea54
pop ecx
mov edi, eax
test eax, eax
jne 0x4c6ba8
lea edi, [ebp + 1]
push edi
call fcn.004be2bc
pop ecx
mov ebx, eax
mov dword [0x4e52e0], ebx
test ebx, ebx
jne 0x4c6bda
xor eax, eax
jmp 0x4c6cb0
push edi
mov edx, dword [0x4e52fc]
push edx
push ebx
call fcn.004be888
add esp, 0xc
jmp 0x4c6c0d
xor esi, esi
mov ebx, dword [0x4e52dc]
jmp 0x4c6c07
push eax
call fcn.004bea54
pop ecx
test eax, eax
jne 0x4c6c03
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4c6bf7
lea ebx, [esi + 4]
push 4
mov dword [0x4e52e4], ebx
inc ebx
push ebx
call fcn.004bda78
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4c6c30
xor eax, eax
jmp 0x4c6cb0
cmp dword [0x4e52dc], 0
jne 0x4c6c61
xor esi, esi
mov ebx, dword [0x4e52e0]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4c6c52
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004bea54
pop ecx
mov edi, eax
test eax, eax
jne 0x4c6c48
jmp 0x4c6c92
xor esi, esi
mov ebx, dword [0x4e52dc]
mov eax, dword [esp]
mov edi, eax
jmp 0x4c6c8c
push eax
call fcn.004bea54
pop ecx
test eax, eax
je 0x4c6c81
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4c6c85
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4c6c70
mov eax, dword [0x4e52dc]
test eax, eax
je 0x4c6ca2
push eax
call fcn.004be2cc
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4e52dc], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xabfc7e
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
jmp 0xabfcbb
js 0xabfcd1
lea esp, [esp + 2]
mov dword [esp + 0x18], ebx
jmp 0xabfcd9
lea esp, [esp + 2]
mov dword [esp + 0x18], ebx
call fcn.00abfcf5
jmp 0xabfeb0
mov byte [esp + 1], cl
jmp 0xabfd75
mov dword [esp + 0x1c], ebp
pushal
lea esp, [esp + 0xa]
jmp 0xabfd25
pushfd
jmp 0xabebb3
mov word [esp + 5], si
mov dword [esp + 0x1c], ebp
pushal
lea esp, [esp + 0xa]
mov byte [esp + 1], cl
lea esp, [esp + 2]
mov dword [esp + 0x2c], esi
pushfd
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
jmp 0xabfd46
lea esp, [esp]
push dword [esp + 1]
jns 0xabfd63
mov word [esp + 5], si
jmp 0xabfd3b

Function at 0xabfcde
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
jmp 0xabfcbb
js 0xabfcd1
lea esp, [esp + 2]
mov dword [esp + 0x18], ebx
jmp 0xabfcd9
lea esp, [esp + 2]
mov dword [esp + 0x18], ebx
call fcn.00abfcf5
jmp 0xabfeb0
mov byte [esp + 1], cl
jmp 0xabfd75
mov dword [esp + 0x1c], ebp
pushal
lea esp, [esp + 0xa]
jmp 0xabfd25
pushfd
jmp 0xabebb3
mov word [esp + 5], si
mov dword [esp + 0x1c], ebp
pushal
lea esp, [esp + 0xa]
mov byte [esp + 1], cl
lea esp, [esp + 2]
mov dword [esp + 0x2c], esi
pushfd
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
jmp 0xabfd46
lea esp, [esp]
push dword [esp + 1]
jns 0xabfd63
mov word [esp + 5], si
jmp 0xabfd3b

Function at 0xabfdce
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], bh
xchg dword [esp + 4], esi
mov cx, bx
mov bx, word [esp]
jmp 0xabfe03
btc edx, esi
mov ecx, dword [esp]
lea esi, [esi + 1]
xchg cx, bx
call fcn.00abfdec

Function at 0xabfdec
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
and cx, cx
jmp 0xabfe14
mov ecx, dword [esp]
lea esp, [esp + 2]
xchg dword [esp + 8], esi
rdtsc
setb al
xchg cl, bl
jmp 0xabfe58
not eax
call fcn.00abfe36

Function at 0xabffd6
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edx
mov ebx, dword [esp]
xchg dword [esp], ecx
btr dx, ax
mov dx, di
jmp 0xac0018
xchg edx, eax
setae dh

Function at 0xac8fb5
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0xaad3cb
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0xaad3e5
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0xaad3d4
pop esi
jmp 0xaad3f0
ret 4
lea esp, [esp + 4]
pushal
lea esp, [esp + 0x20]
jmp 0xaad3be

Function at 0xd85ef9
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 2], dl
lea esp, [esp + 3]
push word [esp + 1]
cmc
jmp 0xd85f1a
not ax
btr dx, si
rdtsc
sets dh
mov ax, 0x4840
shr esi, cl
jmp 0xd85ec8
mov word [esp + 0x15], di
lea esp, [esp + 0x27]
jmp 0xd85ede
inc dx
pop si
add dx, 0xd7ef
xchg byte [esp], dh
sub esp, 0x1b
jmp 0xd8605f
add esp, 1
rdtsc
mov dh, byte [esp + 4]
cmc
pop ax
bt edx, eax
jmp 0xd85f04
pop word [esp + 4]
mov word [esp + 5], dx
lea esp, [esp + 0x1a]
sub esp, 0x17