joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465ee8
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 8]
jne 0x465f05
cmp dword [ebp + 0xc], 0
ja 0x465f0d
jmp 0x465f07
jg 0x465f0d
xor eax, eax
xor edx, edx
jmp 0x465f12
call fcn.004a4894
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
xor eax, eax
lea edx, [ebp - 0x118]
jmp 0x465f32
cmp ebx, dword [edx]
je 0x465f3a
inc eax
add edx, 4
cmp eax, dword [ebp - 0x11c]
jb 0x465f2a
mov edx, dword [ebp - 0x11c]
cmp eax, edx
jne 0x465f56
cmp edx, 0x40
jae 0x465f56
mov dword [ebp + eax*4 - 0x118], ebx
inc dword [ebp - 0x11c]
cmp dword [ebp + 0x10], 0
jne 0x465f64
cmp dword [ebp + 0xc], 0
jb 0x465fa3
jmp 0x465f66
jl 0x465fa3
push 0
push 0x3e8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call fcn.004af277
mov dword [ebp - 8], eax
push 0
push 0x3e8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call fcn.004af338
mov edx, eax
lea eax, [ebp - 8]
shl edx, 3
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
mov dword [ebp - 4], edx
jmp 0x465fa5
xor eax, eax
push eax
push 0
push 0
lea edx, [ebp - 0x11c]
push edx
lea ecx, [ebx + 1]
push ecx
call sub.WS2_32.DLL_select
mov esi, eax
test esi, esi
jl 0x465fc4
xor edi, edi
jmp 0x465fcb
call sub.WS2_32.DLL_WSAGetLastError
mov edi, eax
push edi
call fcn.00465a3c
pop ecx
cmp esi, 0xffffffff
jne 0x46605e
cmp dword [ebp + 0x10], 0
jne 0x465fe9
cmp dword [ebp + 0xc], 0
jbe 0x46605e
jmp 0x465feb
jle 0x46605e
cmp edi, 0x2714
jne 0x46605e
call fcn.00425334
test ax, ax
jne 0x46605e
call fcn.004a4894
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0xc]
jne 0x466016
cmp eax, dword [ebp - 0x10]
jbe 0x46605e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push edx
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0x10], 0
jne 0x466058
cmp dword [ebp + 0xc], 0
jbe 0x46605e
jmp 0x465f18
jg 0x465f18
test esi, esi
jge 0x466067
or eax, 0xffffffff
jmp 0x466085
test esi, esi
jle 0x466083
lea edx, [ebp - 0x11c]
push edx
push ebx
call sub.WS2_32.DLL___WSAFDIsSet
test eax, eax
je 0x466083
mov eax, 1
jmp 0x466085
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46608c
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 8]
jne 0x4660a9
cmp dword [ebp + 0xc], 0
ja 0x4660b1
jmp 0x4660ab
jg 0x4660b1
xor eax, eax
xor edx, edx
jmp 0x4660b6
call fcn.004a4894
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
xor eax, eax
lea edx, [ebp - 0x118]
jmp 0x4660d6
cmp ebx, dword [edx]
je 0x4660de
inc eax
add edx, 4
cmp eax, dword [ebp - 0x11c]
jb 0x4660ce
mov edx, dword [ebp - 0x11c]
cmp eax, edx
jne 0x4660fa
cmp edx, 0x40
jae 0x4660fa
mov dword [ebp + eax*4 - 0x118], ebx
inc dword [ebp - 0x11c]
cmp dword [ebp + 0x10], 0
jne 0x466108
cmp dword [ebp + 0xc], 0
jb 0x466147
jmp 0x46610a
jl 0x466147
push 0
push 0x3e8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call fcn.004af277
mov dword [ebp - 8], eax
push 0
push 0x3e8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
call fcn.004af338
mov edx, eax
lea eax, [ebp - 8]
shl edx, 3
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
mov dword [ebp - 4], edx
jmp 0x466149
xor eax, eax
push eax
lea edx, [ebp - 0x11c]
push 0
push edx
lea ecx, [ebx + 1]
push 0
push ecx
call sub.WS2_32.DLL_select
mov esi, eax
test esi, esi
jl 0x466168
xor edi, edi
jmp 0x46616f
call sub.WS2_32.DLL_WSAGetLastError
mov edi, eax
push edi
call fcn.00465a3c
pop ecx
cmp esi, 0xffffffff
jne 0x466202
cmp dword [ebp + 0x10], 0
jne 0x46618d
cmp dword [ebp + 0xc], 0
jbe 0x466202
jmp 0x46618f
jle 0x466202
cmp edi, 0x2714
jne 0x466202
call fcn.00425334
test ax, ax
jne 0x466202
call fcn.004a4894
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0xc]
jne 0x4661ba
cmp eax, dword [ebp - 0x10]
jbe 0x466202
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push edx
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
sub eax, dword [ebp - 0x10]
sbb edx, dword [ebp - 0xc]
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0x10], 0
jne 0x4661fc
cmp dword [ebp + 0xc], 0
jbe 0x466202
jmp 0x4660bc
jg 0x4660bc
test esi, esi
jge 0x46620b
or eax, 0xffffffff
jmp 0x466229
test esi, esi
jle 0x466227
lea edx, [ebp - 0x11c]
push edx
push ebx
call sub.WS2_32.DLL___WSAFDIsSet
test eax, eax
je 0x466227
mov eax, 1
jmp 0x466229
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466b54
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.0041aa48
cmp dword [ebp + 0x18], 0
jne 0x466b73
cmp dword [ebp + 0x14], 0
jae 0x466b79
jmp 0x466b75
jge 0x466b79
xor eax, eax
jmp 0x466b84
push 0
push edi
call fcn.00466ee0
add esp, 8
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push edi
call sub.WS2_32.DLL_connect
mov ebx, eax
test ebx, ebx
jne 0x466b9f
xor esi, esi
jmp 0x466ba6
call sub.WS2_32.DLL_WSAGetLastError
mov esi, eax
push esi
call fcn.00465a3c
pop ecx
test ebx, ebx
je 0x466bf1
cmp dword [ebp + 0x18], 0
jne 0x466bbf
cmp dword [ebp + 0x14], 0
jb 0x466bf1
jmp 0x466bc1
jl 0x466bf1
cmp esi, 0x2733
jne 0x466bf1
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
call fcn.00466230
add esp, 0xc
mov ebx, eax
test ebx, ebx
jle 0x466be2
xor ebx, ebx
jmp 0x466bf1
test ebx, ebx
jne 0x466bf1
push 2
call fcn.004659bc
pop ecx
or ebx, 0xffffffff
cmp dword [ebp - 4], 0
jle 0x466c30
call fcn.00465990
mov esi, eax
test esi, esi
je 0x466c06
xor eax, eax
jmp 0x466c0b
call fcn.00465984
mov dword [ebp - 8], eax
push 1
push edi
call fcn.00466ee0
add esp, 8
test esi, esi
je 0x466c26
push esi
call fcn.00465a3c
pop ecx
jmp 0x466c30
mov edx, dword [ebp - 8]
push edx
call fcn.004659bc
pop ecx
call fcn.0041aab8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x466c40
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov edi, dword [ebp + 8]
call fcn.0041aa48
cmp dword [ebp + 0x1c], 0
jne 0x466c5e
cmp dword [ebp + 0x18], 0
jb 0x466c80
jmp 0x466c60
jl 0x466c80
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
call fcn.0046608c
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x466c80
push 2
call fcn.004659bc
pop ecx
or ebx, 0xffffffff
test ebx, ebx
jl 0x466cbd
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push edi
call sub.WS2_32.DLL_send
mov ebx, eax
call sub.WS2_32.DLL_WSAGetLastError
mov esi, eax
push esi
call fcn.00465a3c
pop ecx
cmp ebx, 0xffffffff
jne 0x466cbd
cmp esi, 0x2714
jne 0x466cbd
call fcn.00425334
test ax, ax
je 0x466c84
call fcn.0041aab8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x466ccc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov edi, dword [ebp + 8]
call fcn.0041aa48
cmp dword [ebp + 0x24], 0
jne 0x466cea
cmp dword [ebp + 0x20], 0
jb 0x466d0c
jmp 0x466cec
jl 0x466d0c
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push edi
call fcn.0046608c
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x466d0c
push 2
call fcn.004659bc
pop ecx
or ebx, 0xffffffff
test ebx, ebx
jl 0x466d51
mov eax, dword [ebp + 0x1c]
push eax
mov edx, dword [ebp + 0x18]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
push edi
call sub.WS2_32.DLL_sendto
mov ebx, eax
call sub.WS2_32.DLL_WSAGetLastError
mov esi, eax
push esi
call fcn.00465a3c
pop ecx
cmp ebx, 0xffffffff
jne 0x466d51
cmp esi, 0x2714
jne 0x466d51
call fcn.00425334
test ax, ax
je 0x466d10
call fcn.0041aab8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x466d60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov edi, dword [ebp + 8]
call fcn.0041aa48
cmp dword [ebp + 0x1c], 0
jne 0x466d7e
cmp dword [ebp + 0x18], 0
jb 0x466da0
jmp 0x466d80
jl 0x466da0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
call fcn.00465ee8
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x466da0
push 2
call fcn.004659bc
pop ecx
or ebx, 0xffffffff
test ebx, ebx
jl 0x466ddd
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push edi
call sub.WS2_32.DLL_recv
mov ebx, eax
call sub.WS2_32.DLL_WSAGetLastError
mov esi, eax
push esi
call fcn.00465a3c
pop ecx
cmp ebx, 0xffffffff
jne 0x466ddd
cmp esi, 0x2714
jne 0x466ddd
call fcn.00425334
test ax, ax
je 0x466da4
call fcn.0041aab8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x466dec
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor ebx, ebx
mov edi, dword [ebp + 0x18]
call fcn.0041aa48
cmp dword [ebp + 0x24], 0
jne 0x466e10
cmp dword [ebp + 0x20], 0
jb 0x466e35
jmp 0x466e12
jl 0x466e35
push dword [ebp + 0x24]
push dword [ebp + 0x20]
mov edx, dword [ebp + 8]
push edx
call fcn.00465ee8
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x466e35
push 2
call fcn.004659bc
pop ecx
or ebx, 0xffffffff
test ebx, ebx
jl 0x466ed0
mov dword [ebp - 4], 0x100
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
push eax
push edx
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.DLL_recvfrom
mov ebx, eax
call sub.WS2_32.DLL_WSAGetLastError
mov esi, eax
push esi
call fcn.00465a3c
pop ecx
cmp ebx, 0xffffffff
jne 0x466e8b
cmp esi, 0x2714
jne 0x466e8b
call fcn.00425334
test ax, ax
je 0x466e44
test edi, edi
je 0x466ed0
cmp dword [ebp + 0x1c], 0
je 0x466ed0
cmp ebx, 0xffffffff
jne 0x466ea7
xor eax, eax
mov dword [edi], eax
mov edx, dword [ebp + 0x1c]
xor ecx, ecx
mov dword [edx], ecx
jmp 0x466ed0
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x104]
push eax
push edx
mov ecx, dword [ebp - 4]
inc ecx
push ecx
call fcn.0043b120
pop ecx
push eax
call fcn.004ab480
add esp, 0xc
mov dword [edi], eax
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp - 4]
mov dword [eax], edx
call fcn.0041aab8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46716c
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
cmp dword [ebp + 0xc], 2
jne 0x4671bd
mov eax, dword [ebp + 0x10]
push eax
call sub.WS2_32.DLL_inet_addr
mov dword [ebp - 8], eax
push 0
call sub.WS2_32.DLL_htonl
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
push 8
push edx
push 0xc
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.DLL_setsockopt
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4671ad
xor eax, eax
jmp 0x4671b2
call sub.WS2_32.DLL_WSAGetLastError
push eax
call fcn.00465a3c
pop ecx
mov eax, ebx
jmp 0x4671c8
push 4
call fcn.004659bc
pop ecx
or eax, 0xffffffff
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4676b0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor edi, edi
xor esi, esi
test ebx, ebx
je 0x4676c7
cmp byte [ebx], 0
jne 0x4676ce
xor eax, eax
jmp 0x467760
cmp dword [ebp + 0xc], 2
jne 0x46775c
push ebx
call sub.WS2_32.DLL_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x467710
mov eax, str.255.255.255.255
mov edx, ebx
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x46770a
test cl, cl
je 0x467710
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x46770a
add eax, 2
add edx, 2
test cl, cl
jne 0x4676ee
je 0x467710
xor esi, esi
jmp 0x467715
mov esi, 1
test esi, esi
jne 0x467744
call fcn.0041aa48
push ebx
call sub.WS2_32.DLL_gethostbyname
test eax, eax
je 0x46773f
mov edx, dword [eax + 0xc]
cmp dword [edx], 0
je 0x46773f
mov eax, dword [eax + 0xc]
mov esi, 1
mov ecx, dword [eax]
mov eax, dword [ecx]
mov dword [ebp - 4], eax
call fcn.0041aab8
test esi, esi
je 0x46775c
mov eax, dword [ebp - 4]
push eax
call sub.WS2_32.DLL_inet_ntoa
mov ebx, eax
push ebx
call fcn.004a8574
pop ecx
mov edi, eax
test esi, esi
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x467768
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 2
jne 0x467820
xor esi, esi
xor ebx, ebx
call fcn.0041aa48
push edi
call sub.WS2_32.DLL_inet_addr
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4677c0
mov eax, str.255.255.255.255
mov edx, edi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4677cf
test cl, cl
je 0x4677be
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4677cf
add eax, 2
add edx, 2
test cl, cl
jne 0x4677a2
jne 0x4677cf
push 2
push 4
lea eax, [ebp - 8]
push eax
call sub.WS2_32.DLL_gethostbyaddr
mov esi, eax
test esi, esi
jne 0x4677db
push edi
call sub.WS2_32.DLL_gethostbyname
mov esi, eax
call fcn.0041aab8
test esi, esi
je 0x4677f0
jmp 0x4677e7
inc ebx
mov eax, dword [esi + 0xc]
cmp dword [eax + ebx*4], 0
jne 0x4677e6
test ebx, ebx
jle 0x467820
push ebx
call fcn.0043d994
pop ecx
mov dword [ebp - 4], eax
mov edx, dword [esi + 0xc]
mov eax, dword [edx + ebx*4 - 4]
mov edx, dword [eax]
push edx
call sub.WS2_32.DLL_inet_ntoa
mov edi, eax
push edi
push ebx
mov eax, dword [ebp - 4]
push eax
call fcn.0042a71c
add esp, 0xc
dec ebx
jne 0x4677fe
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4a6678
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x4a66b3
push esi
call fcn.0045a214
pop ecx
mov edi, eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4a669f
test al, 0x50
je 0x4a66a3
xor ebx, ebx
jmp 0x4a66a8
mov ebx, 1
test edi, edi
je 0x4a66b3
push edi
call fcn.0043b208
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a6710
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
push eax
call fcn.00449574
pop ecx
mov ebx, eax
push 0
push 0
push ebx
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov esi, eax
test esi, esi
je 0x4a6764
mov eax, esi
add eax, eax
push eax
call fcn.0043b120
pop ecx
mov dword [ebp - 4], eax
push esi
mov edx, dword [ebp - 4]
push edx
push ebx
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov ecx, dword [ebp - 4]
push ecx
call fcn.00449668
pop ecx
mov edi, eax
mov eax, dword [ebp - 4]
push eax
call fcn.0043b208
pop ecx
push ebx
call fcn.0043b208
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4a9540
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffcb4
push 0x100
call fcn.0043b120
pop ecx
mov ebx, eax
mov dword [esp], 0x114
push esp
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
je 0x4a97bf
push str.ntdll.dll
call sub.KERNEL32.DLL_GetModuleHandleW
mov edi, 0x54aec7
mov esi, 0x54aec7
test eax, eax
je 0x4a9597
push str.wine_get_version
push eax
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x4a9597
mov edi, str.__Wine_
mov eax, dword [esp + 0x10]
sub eax, 1
jb 0x4a971b
je 0x4a95b5
dec eax
je 0x4a95ef
dec eax
je 0x4a9722
jmp 0x4a9727
cmp dword [esp + 4], 4
jne 0x4a95cd
cmp dword [esp + 8], 0xa
jae 0x4a95cd
mov esi, 0x54af25
jmp 0x4a9727
cmp dword [esp + 4], 4
jne 0x4a95e5
cmp dword [esp + 8], 0xa
jne 0x4a95e5
mov esi, 0x54af29
jmp 0x4a9727
mov esi, 0x54af2d
jmp 0x4a9727
cmp dword [esp + 4], 6
jne 0x4a9696
mov dword [esp + 0x114], 0x11c
lea eax, [esp + 0x114]
push eax
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
je 0x4a968c
mov eax, dword [esp + 8]
cmp eax, 2
jne 0x4a963d
cmp byte [esp + 0x22e], 1
jne 0x4a9633
mov esi, 0x54af31
jmp 0x4a9727
mov esi, str._Server_2012
jmp 0x4a9727
cmp eax, 1
jne 0x4a9660
cmp byte [esp + 0x22e], 1
jne 0x4a9656
mov esi, 0x54af41
jmp 0x4a9727
mov esi, str._Server_2008_R2
jmp 0x4a9727
test eax, eax
jne 0x4a9682
cmp byte [esp + 0x22e], 1
jne 0x4a9678
mov esi, str._Vista
jmp 0x4a9727
mov esi, str._Server_2008
jmp 0x4a9727
mov esi, 0x54aec7
jmp 0x4a9727
mov esi, 0x54aec7
jmp 0x4a9727
cmp dword [esp + 4], 5
jne 0x4a96f1
cmp dword [esp + 8], 2
jb 0x4a96f1
mov dword [esp + 0x230], 0x11c
lea eax, [esp + 0x230]
push eax
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
je 0x4a96ea
cmp byte [esp + 0x34a], 1
jne 0x4a96d1
mov esi, str._XP_x64
jmp 0x4a9727
push 0x59
call sub.USER32.DLL_GetSystemMetrics
test eax, eax
je 0x4a96e3
mov esi, str._Server_2003_R2
jmp 0x4a9727
mov esi, str._Server_2003
jmp 0x4a9727
mov esi, 0x54aec7
jmp 0x4a9727
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x4a9708
cmp dword [esp + 8], 1
jne 0x4a9708
mov esi, 0x54af8d
jmp 0x4a9727
cmp eax, 5
jne 0x4a9714
mov esi, str._2000
jmp 0x4a9727
mov esi, 0x54af97
jmp 0x4a9727
mov esi, str._32s
jmp 0x4a9727
mov esi, 0x54afa0
mov ax, word [esp + 0xc]
and ax, 0xffff
movzx edx, ax
push edx
mov ecx, dword [esp + 0xc]
push ecx
mov eax, dword [esp + 0xc]
push eax
push edi
push esi
push str.Windows_s_s__lu._lu._04u
push 0x100
push ebx
call fcn.004a8478
add esp, 0x20
lea edx, [esp + 0x14]
test edx, edx
je 0x4a97d2
lea ecx, [esp + 0x14]
push ecx
call fcn.00449668
pop ecx
mov edi, eax
xor esi, esi
mov eax, edi
jmp 0x4a9770
inc esi
inc eax
cmp byte [eax], 0
je 0x4a978c
movsx edx, byte [eax]
cmp edx, 0x20
je 0x4a976e
cmp edx, 9
je 0x4a976e
cmp edx, 0xa
je 0x4a976e
cmp edx, 0xd
je 0x4a976e
cmp byte [edi + esi], 0
je 0x4a97b6
push 0xff
push 0x54afbd
push ebx
call fcn.004a90e4
add esp, 0xc
add esi, edi
push 0xff
push esi
push ebx
call fcn.004a90e4
add esp, 0xc
push edi
call fcn.0043b208
pop ecx
jmp 0x4a97d2
push str.Windows
push 0x100
push ebx
call fcn.004a8478
add esp, 0xc
mov eax, ebx
add esp, 0x34c
pop edi
pop esi
pop ebx
ret
Function at 0x4a97e0
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffdd0
mov dword [esp], 0x114
push esp
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
je 0x4a988a
mov edx, dword [esp + 4]
cmp edx, 6
setae al
and eax, 1
cmp edx, 5
setae cl
mov dword [0x54aeb0], eax
mov dword [0x54aeb4], eax
mov eax, dword [esp + 0x10]
and ecx, 1
cmp eax, 2
mov dword [0x54aeb8], ecx
sete dl
and edx, 1
cmp eax, 1
sete cl
and ecx, 1
mov dword [0x54aebc], edx
mov dword [0x54aec0], ecx
cmp dword [0x54aeb4], 0
jne 0x4a988a
cmp dword [esp + 4], 5
jne 0x4a988a
cmp dword [esp + 8], 2
jb 0x4a988a
mov dword [esp + 0x114], 0x11c
lea eax, [esp + 0x114]
push eax
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
je 0x4a988a
cmp byte [esp + 0x22e], 1
setne dl
and edx, 1
mov dword [0x54aeb4], edx
mov dword [0x54aeac], 1
add esp, 0x230
ret

Function at 0x4ab11c
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4ac4bc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4ac4d8
call fcn.004ad954
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4ac4f4
test bl, 1
je 0x4ac4f4
call fcn.004b1a8c
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4ac6d8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004ad4f0
test byte [ebp + 0xd], 0xc0
jne 0x4ac6fc
mov eax, dword [0x54bc78]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4ac709
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4ac736
je 0x4ac748
sub ecx, 0x100
je 0x4ac756
sub ecx, 0x100
je 0x4ac75d
sub ecx, 0x100
je 0x4ac74f
jmp 0x4ac764
sub ecx, 0x600
je 0x4ac75d
sub ecx, 0x100
je 0x4ac748
jmp 0x4ac764
mov edi, 1
jmp 0x4ac769
mov edi, 2
jmp 0x4ac769
mov edi, 4
jmp 0x4ac769
mov edi, 5
jmp 0x4ac769
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4ac790
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x54b6f0]
test al, 0x80
je 0x4ac789
mov ebx, 0x80
jmp 0x4ac7a2
mov ebx, 1
jmp 0x4ac7a2
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4ac7a2
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4ac7b4
je 0x4ac7bd
dec eax
je 0x4ac7c6
jmp 0x4ac7cf
mov dword [ebp - 4], closesocket
jmp 0x4ac7de
mov dword [ebp - 4], 0x40000000
jmp 0x4ac7de
mov dword [ebp - 4], 0xc0000000
jmp 0x4ac7de
push 1
call fcn.004ad8e8
pop ecx
mov ebx, eax
jmp 0x4ac8ce
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4ac7fa
sub eax, 0x10
je 0x4ac801
sub eax, 0x10
je 0x4ac80a
sub eax, 0x10
je 0x4ac813
jmp 0x4ac813
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4ac81a
mov dword [ebp - 8], 1
jmp 0x4ac81a
mov dword [ebp - 8], 2
jmp 0x4ac81a
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4ac887
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4ac87c
test byte [ebp + 0xd], 1
je 0x4ac877
mov ebx, 0x50
jmp 0x4ac87c
mov ebx, 2
push ebx
call fcn.004ad8e8
pop ecx
mov ebx, eax
jmp 0x4ac8ce
mov edi, esi
push edi
call fcn.004ac63c
pop ecx
test eax, eax
je 0x4ac89b
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4ac8a7
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004ad610
add esp, 8
mov ebx, eax
inc eax
jne 0x4ac8ce
push 4
call fcn.004ad8e8
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.004ad524
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret