joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447320
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], ecx
rdtsc
sub eax, dword [0x51c3f0]
sbb edx, dword [0x51c3f4]
shrd eax, edx, 8
mov dword [0x51c0c0], eax
mov eax, dword [0x51ceec]
test eax, eax
je 0x44746f
mov eax, dword [0x51c0c8]
push ebx
push edi
xor edi, edi
test eax, eax
mov ebx, 0x51c3f8
jle 0x44739d
mov esi, dword [ebx]
mov eax, dword [ebp - 4]
mov cl, byte [eax]
mov dl, cl
cmp cl, byte [esi]
jne 0x447387
test dl, dl
je 0x447383
mov cl, byte [eax + 1]
mov dl, cl
cmp cl, byte [esi + 1]
jne 0x447387
add eax, 2
add esi, 2
test dl, dl
jne 0x447363
xor eax, eax
jmp 0x44738c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4473b6
mov eax, dword [0x51c0c8]
inc edi
add ebx, 0x1c
cmp edi, eax
jl 0x44735e
mov ecx, dword [ebp - 4]
lea edx, [eax*8]
sub edx, eax
inc eax
mov dword [0x51c0c8], eax
mov dword [edx*4 + 0x51c3f8], ecx
mov eax, dword [0x51c3ec]
mov dword [0x51cee8], edi
test eax, eax
lea esi, [eax - 1]
je 0x4473d1
cmp dword [eax*4 + 0x51c0c8], edi
je 0x447430
mov dword [eax*4 + 0x51c0cc], edi
inc eax
mov dword [0x51c3ec], eax
rdtsc
sub eax, dword [0x51c3f0]
sbb edx, dword [0x51c3f4]
shrd eax, edx, 8
mov dword [0x51c0c4], eax
mov ecx, dword [0x51cee8]
lea eax, [ecx*8]
sub eax, ecx
mov ecx, dword [0x51c0c4]
shl eax, 2
mov dword [eax + 0x51c400], ecx
mov dword [eax + 0x51c3fc], ecx
mov ecx, dword [eax + 0x51c410]
inc ecx
mov dword [eax + 0x51c410], ecx
mov dword [eax + 0x51c40c], 0
pop edi
pop ebx
test esi, esi
jl 0x44746f
mov ecx, dword [esi*4 + 0x51c0cc]
rdtsc
sub eax, dword [0x51c3f0]
sbb edx, dword [0x51c3f4]
shrd eax, edx, 8
sub eax, dword [0x51c0c0]
mov dword [0x51c0c0], eax
mov eax, dword [0x51c0c0]
lea edx, [ecx*8]
sub edx, ecx
mov dword [edx*4 + 0x51c40c], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x447480
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
rdtsc
sub eax, dword [0x51c3f0]
sbb edx, dword [0x51c3f4]
shrd eax, edx, 8
mov dword [0x51c0c0], eax
mov eax, dword [0x51ceec]
test eax, eax
je 0x4475ed
mov eax, dword [0x51c0c8]
push ebx
push esi
xor ebx, ebx
push edi
mov edi, 0x51c3f8
test eax, eax
jle 0x4474fd
mov esi, dword [edi]
mov eax, dword [ebp - 4]
mov cl, byte [eax]
mov dl, cl
cmp cl, byte [esi]
jne 0x4474e7
test dl, dl
je 0x4474e3
mov cl, byte [eax + 1]
mov dl, cl
cmp cl, byte [esi + 1]
jne 0x4474e7
add eax, 2
add esi, 2
test dl, dl
jne 0x4474c3
xor eax, eax
jmp 0x4474ec
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x447516
mov eax, dword [0x51c0c8]
inc ebx
add edi, 0x1c
cmp ebx, eax
jl 0x4474be
mov ecx, dword [ebp - 4]
lea edx, [eax*8]
sub edx, eax
inc eax
mov dword [0x51c0c8], eax
mov dword [edx*4 + 0x51c3f8], ecx
mov eax, dword [0x51cee8]
lea edx, [eax*8]
sub edx, eax
lea ecx, [edx*4 + 0x51c3f8]
rdtsc
sub eax, dword [0x51c3f0]
sbb edx, dword [0x51c3f4]
shrd eax, edx, 8
sub eax, dword [0x51c0c0]
mov dword [0x51c0c0], eax
mov eax, dword [ecx + 0x14]
mov ebx, dword [0x51c0c0]
add ebx, eax
mov dword [0x51c0c0], ebx
rdtsc
sub eax, dword [0x51c3f0]
sbb edx, dword [0x51c3f4]
shrd eax, edx, 8
mov dword [0x51c0c4], eax
mov eax, dword [0x51c0c4]
mov edi, dword [ecx + 8]
mov esi, dword [0x51c0c0]
mov edx, dword [ecx + 0x10]
mov ebx, dword [ecx + 4]
sub eax, edi
sub eax, esi
mov esi, dword [ecx + 0xc]
add edx, eax
mov dword [ecx + 0x10], edx
mov edx, dword [0x51c0c4]
mov edi, dword [0x51c0c0]
sub edx, ebx
sub edx, edi
pop edi
add esi, edx
mov dword [ecx + 0xc], esi
mov ecx, dword [0x51c3ec]
dec ecx
pop esi
mov dword [0x51c3ec], ecx
pop ebx
je 0x4475e3
mov ecx, dword [ecx*4 + 0x51c0c8]
mov dword [0x51cee8], ecx
lea edx, [ecx*8]
sub edx, ecx
lea ecx, [edx*4 + 0x51c3fc]
mov edx, dword [edx*4 + 0x51c3fc]
add edx, eax
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret
mov dword [0x51cee8], 0
mov esp, ebp
pop ebp
ret
Function at 0x44d8a0
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
mov eax, dword [0x51da28]
push esi
push 6
mov esi, ecx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x51da28]
push 1
push 0
push 0
push esi
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop esi
ret
Function at 0x460390
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
test esi, esi
jne 0x4603a2
mov esi, str.Toolbox
jmp 0x4603a8
mov dword [0x51da2c], esi
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
push 0x2710
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x460414
push 0
push esi
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x460419
push esi
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov edi, eax
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x46040d
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, 1
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
pop edi
pop esi
pop ebx
ret
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, 1
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x463a10
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x463a38
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add edi, 4
push edi
push eax
call fcn.00464160
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
mov ecx, dword [edi + 0x3ec]
mov esi, dword [esp + 0x14]
test esi, esi
mov byte [ecx], 0
je 0x463a6b
cmp byte [esi], 0x5c
je 0x463a5e
mov ecx, dword [edi + 0x3ec]
mov edx, 0x4964e8
call fcn.00463540
mov ecx, dword [edi + 0x3ec]
mov edx, esi
call fcn.00463540
mov ebx, dword [esp + 0x18]
test ebx, ebx
jne 0x463b1c
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
push 0xf003f
lea eax, [edi + 4]
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x463a9c
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xor esi, esi
xor edi, edi
mov edx, 0x1000
push 0
push 0
sub edx, esi
push 0
lea eax, [esp + 0x28]
push 0
lea ecx, [esi + 0x51dcc8]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x1c]
push eax
push ecx
push edi
push edx
call ebx
test eax, eax
jne 0x463ae2
mov eax, dword [esp + 0x1c]
inc edi
lea esi, [esi + eax + 1]
cmp esi, 0xfff
jb 0x463aa6
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esi + 0x51dcc8], 0
inc esi
xor edx, edx
mov ecx, esi
call fcn.004642e0
mov edi, eax
test edi, edi
je 0x463b13
push esi
push 0x51dcc8
push edi
call fcn.0047ef90
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
cmp byte [ebx], 0x5c
jne 0x463b22
inc ebx
lea esi, [edi + 4]
mov edx, 0x4964e8
mov ecx, esi
call fcn.00463540
mov edx, ebx
mov ecx, esi
call fcn.00463540
mov dl, 0x5c
mov ecx, esi
call fcn.00463740
mov ebx, eax
lea edx, [esp + 0xc]
push edx
push 0xf003f
mov byte [ebx], 0
mov eax, dword [edi]
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x463b7c
mov edx, dword [esp + 0x1c]
mov ecx, 0x51dcc8
call fcn.004634d0
pop edi
pop esi
mov eax, 0x51dcc8
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push 0x51dcc8
push 0
inc ebx
push 0
push ebx
push edx
mov dword [esp + 0x2c], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x463bb1
mov edx, dword [esp + 0x1c]
mov ecx, 0x51dcc8
call fcn.004634d0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 0x51dcc8
pop ebx
pop ecx
ret 0xc
Function at 0x463c10
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx], 0
jne 0x463c36
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
add ebx, 4
push ebx
push eax
call fcn.00464280
pop edi
pop esi
pop ebx
ret 0xc
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x463c52
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x463c4e
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
xor esi, esi
jmp 0x463c56
mov esi, dword [esp + 0x10]
mov ecx, dword [ebx + 0x3ec]
test esi, esi
mov byte [ecx], 0
je 0x463c85
cmp byte [esi], 0x5c
je 0x463c78
mov ecx, dword [ebx + 0x3ec]
mov edx, 0x4964e8
call fcn.00463540
mov ecx, dword [ebx + 0x3ec]
mov edx, esi
call fcn.00463540
cmp byte [edi], 0x5c
jne 0x463c8b
inc edi
lea esi, [ebx + 4]
push ebp
mov edx, 0x4964e8
mov ecx, esi
call fcn.00463540
mov edx, edi
mov ecx, esi
call fcn.00463540
mov dl, 0x5c
mov ecx, esi
call fcn.00463740
xor edi, edi
lea edx, [esp + 0x14]
push edi
push edx
mov ebp, eax
push edi
push 0xf003f
push edi
mov byte [ebp], 0
mov eax, dword [ebx]
push edi
push edi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x463d02
mov esi, dword [esp + 0x1c]
mov ecx, esi
call fcn.004634b0
mov ecx, dword [esp + 0x14]
inc eax
push eax
push esi
push 1
inc ebp
push edi
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
mov edi, eax
neg edi
sbb edi, edi
push edx
inc edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x463ff0
Capabilities:
Get common file path

Disassembly:
mov al, byte [0x51f320]
sub esp, 0x12c
test al, al
jne 0x4640ff
mov ecx, dword [0x51f314]
lea eax, [esp]
push 0x12c
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp]
mov ecx, 0x51f320
call fcn.004634d0
mov dl, 0x2e
mov ecx, 0x51f320
call fcn.00463740
mov ecx, eax
mov edx, str..INI
call fcn.004634d0
mov dl, 0x5c
mov ecx, 0x51f320
call fcn.00463740
test eax, eax
je 0x46409a
lea edx, [eax + 1]
mov ecx, 0x52044c
call fcn.004634d0
xor dl, dl
mov ecx, 0x52044c
call fcn.00463310
test al, al
je 0x464085
mov edx, 0x52044c
xor ecx, ecx
call fcn.00472fd0
mov edx, eax
mov ecx, 0x51f320
call fcn.004634d0
mov dl, 0x2e
mov ecx, 0x52044c
call fcn.00463740
mov ecx, eax
xor edx, edx
call fcn.004634d0
xor dl, dl
mov ecx, 0x51f320
call fcn.00463310
test al, al
jne 0x4640ff
lea edx, [esp]
push 0x12c
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edx, str.SIERRA.INI
lea ecx, [esp]
call fcn.00463540
lea eax, [esp]
mov edx, str.InstallPath
push eax
push 0
mov ecx, 0x52044c
call fcn.00464160
test eax, eax
je 0x4640ff
cmp byte [eax], 0
je 0x4640ff
push 0x52044c
push eax
push str._s_s.INI
push 0x51f320
call fcn.0047e3b7
add esp, 0x10
add esp, 0x12c
ret
Function at 0x464160
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x14]
mov ebx, edx
test esi, esi
je 0x464173
test edi, edi
jne 0x464199
mov al, byte [0x51f320]
test al, al
jne 0x464181
call fcn.00463ff0
test esi, esi
jne 0x46418a
mov esi, 0x52044c
test edi, edi
jne 0x464199
mov edi, 0x51f320
mov eax, edi
test eax, eax
je 0x4641d0
test esi, esi
je 0x4641b5
push edi
push 0x1000
push 0x51f44c
push str.tirsnf
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test edi, edi
je 0x4641d0
test esi, esi
je 0x4641d0
mov edx, str.tirsnf
mov ecx, 0x51f44c
call fcn.004635e0
test eax, eax
jne 0x4641de
mov edx, dword [esp + 0x10]
mov ecx, 0x51f44c
call fcn.004634d0
test ebx, ebx
jne 0x46422c
mov al, byte [0x51f44c]
mov esi, 0x51f44c
test al, al
mov edi, 1
je 0x464206
mov ecx, esi
call fcn.004634b0
inc eax
add esi, eax
add edi, eax
cmp byte [esi], 0
jne 0x4641f5
xor edx, edx
mov ecx, edi
call fcn.004642e0
mov esi, eax
test esi, esi
je 0x464224
push edi
push 0x51f44c
push esi
call fcn.0047ef90
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
ret 8
pop edi
pop esi
mov eax, 0x51f44c
pop ebx
ret 8
Function at 0x471c70
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x70]
test eax, eax
jne 0x471c8d
mov eax, dword [esi + 0x6c]
test eax, eax
jne 0x471c8d
call fcn.00471ad0
mov dword [esi + 0x6c], 1
mov ecx, esi
call fcn.00469e30
mov eax, dword [esi + 0x70]
test eax, eax
je 0x471d01
test byte [esi + 0x30], 4
je 0x471cac
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
push ebx
push edi
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x3c]
push 8
call fcn.00467bf0
mov ecx, dword [esi + 0x3c]
mov edi, eax
mov eax, dword [esi + 0x84]
push eax
call fcn.00467b30
test esi, esi
mov ebx, eax
je 0x471cdd
lea eax, [esi + 4]
jmp 0x471cdf
xor eax, eax
mov ecx, dword [esi + 0x3c]
push eax
mov edx, dword [ecx]
call dword [edx + 0x18]
mov ecx, dword [esi + 0x3c]
push ebx
call fcn.00467b30
test edi, edi
pop edi
pop ebx
jne 0x471d01
mov ecx, dword [esi + 0x3c]
push 8
call fcn.00467c70
pop esi
ret
Function at 0x4731d0
Capabilities:
Set current directory

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push esi
mov esi, ecx
push edi
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x47322e
push ebp
mov dl, 0x5c
mov ecx, esi
call fcn.00463740
mov dl, 0x2e
mov ecx, esi
mov ebp, eax
call fcn.00463740
cmp eax, ebp
pop ebp
jbe 0x47322e
mov edx, esi
lea ecx, [esp + 0xc]
call fcn.004634d0
mov edx, 0x498fb4
lea ecx, [esp + 0xc]
call fcn.00463540
lea eax, [esp + 0xc]
push eax
call ebx
pop edi
pop esi
pop ebx
add esp, 0x104
ret
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x104
ret
Function at 0x47b710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
push ecx
push edx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [0x499956], eax
cmp word [ebx + 0x24], 0x10
jne 0x47b72c
shr eax, 1
mov dword [0x499952], eax
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test dword [ebx + 0x10], 1
je 0x47b74f
movzx eax, word [ebx + 0x1c]
shr eax, 4
and eax, 0xf
mov word [ebx + 0x1e], ax
jmp 0x47b75f
xor eax, eax
mov al, byte [esi]
mov word [ebx + 0x1c], ax
inc esi
and eax, 0xf
mov word [ebx + 0x1e], ax
mov dword [ebx + 0x18], 0
movzx ecx, word [ebx + 0x20]
test eax, 4
je 0x47b774
add dword [ebx + 0x18], ecx
test eax, 2
je 0x47b782
mov edx, ecx
shr edx, 1
add dword [ebx + 0x18], edx
test eax, 1
je 0x47b791
mov edx, ecx
shr edx, 2
add dword [ebx + 0x18], edx
mov edx, ecx
shr edx, 3
add dword [ebx + 0x18], edx
test eax, 8
je 0x47b7a3
neg dword [ebx + 0x18]
mov eax, dword [ebx + 0x14]
add eax, dword [ebx + 0x18]
cmp eax, 0x7fff
jl 0x47b7b5
mov eax, 0x7fff
cmp eax, 0xffff8000
jg 0x47b7c1
mov eax, 0xffff8000
mov dword [ebx + 0x14], eax
cmp word [ebx + 0x24], 0x10
jne 0x47b7cf
stosw word es:[edi], ax
jmp 0x47b7d5
xor ah, 0x80
mov al, ah
stosb byte es:[edi], al
movzx ecx, word [ebx + 0x1e]
movzx eax, word [ecx*2 + 0x499880]
add word [ebx + 0x22], ax
cmp word [ebx + 0x22], 0x8000
jb 0x47b7f5
mov word [ebx + 0x22], 0
jmp 0x47b802
cmp word [ebx + 0x22], 0x58
jbe 0x47b802
mov word [ebx + 0x22], 0x58
movzx ecx, word [ebx + 0x22]
movzx eax, word [ecx*2 + 0x4998a0]
add dword [ebx + 0x10], 1
mov word [ebx + 0x20], ax
dec dword [0x499952]
jne 0x47b736
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov eax, dword [0x499956]
pop edx
pop ecx
pop ebx
pop edi
pop esi
leave
ret
Function at 0x47d980
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x13c
or ecx, 0xffffffff
xor eax, eax
push esi
mov esi, dword [esp + 0x150]
push edi
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x47d9a6
pop edi
pop esi
add esp, 0x13c
ret
push esi
call fcn.0047d8a0
mov edi, eax
add esp, 4
test edi, edi
je 0x47d9c3
push 0x5c
push esi
call fcn.0047eab0
add esp, 8
inc eax
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x47d9df
pop edi
xor eax, eax
pop esi
add esp, 0x13c
ret
mov eax, dword [esp + 0x14c]
xor esi, esi
test eax, eax
mov dword [esp + 8], 0
jle 0x47da84
mov ecx, dword [esp + 0x148]
mov edi, dword [esp + 0x150]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x10], ecx
inc esi
lea edx, [esp + 0x20]
push esi
push edi
push str._s_i
push edx
mov dword [esp + 0x28], 0x100
mov dword [esp + 0x2c], 1
call fcn.0047e3b7
add esp, 0x10
lea eax, [esp + 0x18]
lea ecx, [esp + 0x48]
lea edx, [esp + 0x1c]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0x2c]
push 0
push eax
push ecx
call ebx
test eax, eax
jne 0x47da7a
lea edx, [esp + 0x48]
push edx
call fcn.0048a1fd
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
add esp, 4
inc edx
mov dword [ecx], eax
add ecx, 4
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
cmp esi, dword [esp + 0x150]
jl 0x47da11
pop ebx
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x13c
ret
Function at 0x483673
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x499f10
cmp edx, dword [eax]
je 0x483695
add eax, 8
inc ecx
cmp eax, 0x499fa0
jl 0x483686
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x499f10]
jne 0x4837c3
mov eax, dword [0x52becc]
cmp eax, 1
je 0x48379d
test eax, eax
jne 0x4836c6
cmp dword [0x499b7c], 1
je 0x48379d
cmp edx, 0xfc
je 0x4837c3
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4836fd
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00487730
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00484cf0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x483740
lea eax, [ebp - 0x1a4]
push eax
call fcn.00484cf0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x492244
push edi
call fcn.00480470
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00487730
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00487740
lea eax, [ebp - 0xa0]
push 0x492224
push eax
call fcn.00487740
push dword [esi + 0x499f14]
lea eax, [ebp - 0xa0]
push eax
call fcn.00487740
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004886f5
add esp, 0x2c
pop edi
jmp 0x4837c3
lea eax, [ebp + 8]
lea esi, [esi + 0x499f14]
push 0
push eax
push dword [esi]
call fcn.00484cf0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x48a3f0
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x52c200]
sub esp, 0x190
test eax, eax
jne 0x48a423
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x48a41c
xor al, al
add esp, 0x190
ret
mov byte [0x52c1fc], 1
mov eax, dword [0x52c200]
inc eax
mov dword [0x52c200], eax
mov al, 1
add esp, 0x190
ret

Function at 0x48bb00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x14]
mov ebx, dword [esi + 0x24]
mov edx, dword [esi + 0x28]
add ebx, edi
lea eax, [edi - 2]
mov dword [esi + 0x24], ebx
mov ebx, dword [esp + 0x10]
add edx, edi
push eax
lea ecx, [ebx + 2]
mov dword [esi + 0x28], edx
push ecx
call fcn.0048e2b0
mov edx, dword [esp + 0x20]
add esp, 8
mov word [ebx], ax
mov eax, dword [esi + 0x54]
push 0x10
push edx
push 0
push edi
push ebx
push eax
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, edi
je 0x48bb66
cmp eax, 0xffffffff
jne 0x48bb66
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x2742
jne 0x48bb66
pop edi
pop esi
mov eax, 0xb
pop ebx
ret 0xc
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
inc ecx
add eax, edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
pop edi
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x48c0c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push esi
mov esi, ecx
push edi
mov ebp, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
inc ebp
mov dword [esi + 0x8c], ebp
mov edx, dword [0x52c204]
mov ecx, edx
sub ecx, edi
cmp ecx, 0x7fffffff
jb 0x48c0f2
pop edi
pop esi
xor eax, eax
pop ebp
ret 8
mov eax, dword [esi + 0x78]
cmp ecx, eax
jae 0x48c101
pop edi
pop esi
xor eax, eax
pop ebp
ret 8
push ebx
lea ebx, [eax*4]
cmp ecx, ebx
jbe 0x48c11a
lea eax, [eax + eax*2]
sub edx, eax
mov dword [esi + 0x88], edx
jmp 0x48c122
add eax, edi
mov dword [esi + 0x88], eax
mov eax, dword [esi + 0x7c]
mov ebp, dword [esp + 0x18]
cmp ebp, eax
jle 0x48c12f
mov ebp, eax
mov ecx, dword [esp + 0x14]
add ebp, 0xfffffffd
push ebp
lea eax, [ecx + 3]
mov ecx, esi
push eax
mov dword [esp + 0x20], eax
call fcn.0048c300
mov edi, eax
sub ebp, edi
mov dword [esp + 0x14], ebp
fild dword [esp + 0x14]
fmul qword [esi + 0x58]
call fcn.0044eaa0
mov ecx, ebp
sub ecx, eax
mov eax, dword [esi + 0x3c]
test eax, eax
mov dword [esp + 0x14], ecx
je 0x48c1b6
lea eax, [ecx - 2]
cmp edi, eax
jge 0x48c1b6
jmp 0x48c176
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
sub ecx, edi
push ecx
mov ecx, dword [esi + 0x3c]
lea ebx, [edx + edi]
push ebx
call fcn.0048e3e0
test al, al
je 0x48c1b6
xor eax, eax
mov edx, dword [esi + 0x1c]
mov al, byte [ebx]
xor ecx, ecx
lea edi, [edi + eax + 2]
mov eax, dword [esi + 0x18]
inc eax
mov dword [esi + 0x18], eax
mov cl, byte [ebx]
add ecx, 2
add edx, ecx
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x14]
lea eax, [edx - 2]
cmp edi, eax
jl 0x48c172
mov eax, dword [esi + 0x40]
test eax, eax
je 0x48c202
lea eax, [ebp - 2]
cmp edi, eax
jge 0x48c202
mov eax, dword [esp + 0x18]
mov ecx, ebp
sub ecx, edi
lea ebx, [eax + edi]
push ecx
mov ecx, dword [esi + 0x40]
push ebx
call fcn.0048ef80
test al, al
je 0x48c202
mov eax, dword [esi + 0x28]
xor edx, edx
mov dl, byte [ebx]
inc eax
mov dword [esi + 0x28], eax
xor eax, eax
mov al, byte [ebx]
lea edi, [edi + edx + 2]
mov edx, dword [esi + 0x2c]
add eax, 2
add edx, eax
lea eax, [ebp - 2]
cmp edi, eax
mov dword [esi + 0x2c], edx
jl 0x48c1c4
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x48c24e
lea eax, [ebp - 2]
cmp edi, eax
jge 0x48c24e
mov ecx, dword [esp + 0x18]
mov edx, ebp
sub edx, edi
lea ebx, [ecx + edi]
mov ecx, dword [esi + 0x3c]
push edx
push ebx
call fcn.0048e3e0
test al, al
je 0x48c24e
xor eax, eax
mov edx, dword [esi + 0x1c]
mov al, byte [ebx]
xor ecx, ecx
lea edi, [edi + eax + 2]
mov eax, dword [esi + 0x18]
inc eax
mov dword [esi + 0x18], eax
mov cl, byte [ebx]
add ecx, 2
lea eax, [ebp - 2]
add edx, ecx
cmp edi, eax
mov dword [esi + 0x1c], edx
jl 0x48c210
test edi, edi
pop ebx
jne 0x48c25b
pop edi
pop esi
xor eax, eax
pop ebp
ret 8
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
lea edx, [edi + 3]
inc ecx
add eax, edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
lea eax, [edi + 3]
pop edi
pop esi
pop ebp
ret 8