joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d97b3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.004e37a0
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 0xa
mov ecx, dword [ebp - 4]
sbb eax, eax
xor ecx, ebp
inc eax
pop esi
call fcn.004682d0
mov esp, ebp
pop ebp
ret

Function at 0x4d980a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.004e37a0
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
pop esi
jb 0x4d9860
cmp dword [ebp - 0x118], 2
jb 0x4d9860
xor eax, eax
inc eax
jmp 0x4d986a
cmp dword [ebp - 0x11c], 0xa
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004682d0
mov esp, ebp
pop ebp
ret

Function at 0x4d9aa5
Capabilities:
Create directory

Disassembly:
push 0x49c
mov eax, 0x546733
call fcn.00506b61
mov ebx, ecx
mov edi, dword [ebp + 8]
test edi, edi
jne 0x4d9ac4
xor eax, eax
jmp 0x4d9c48
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.004e37a0
lea eax, [ebp - 0x110]
push edi
push eax
call fcn.004f41c0
push edi
xor esi, esi
call fcn.004f3930
mov edi, eax
mov dword [ebp - 0x214], 7
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x218], ecx
mov word [ebp - 0x228], ax
push 0x100
push ecx
lea eax, [ebp - 0x210]
mov dword [ebp - 4], ecx
push eax
call fcn.004e37a0
add esp, 0x24
cmp byte [ebp + edi - 0x111], 0x5c
je 0x4d9b33
mov byte [ebp + edi - 0x110], 0x5c
cmp byte [ebp - 0x110], 0
je 0x4d9c36
mov al, byte [ebp + esi - 0x110]
cmp al, 0x3a
jne 0x4d9b53
add esi, 2
jmp 0x4d9c28
cmp al, 0x5c
jne 0x4d9c27
push esi
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004e3220
add esp, 0xc
cmp esi, 0x100
jae 0x4d9c64
lea eax, [ebp - 0x210]
mov byte [ebp + esi - 0x210], 0
push eax
lea ecx, [ebp - 0x240]
call fcn.00405820
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x258]
mov ecx, ebx
push eax
call fcn.004da1b6
push eax
lea ecx, [ebp - 0x228]
call fcn.00404010
push 0
push 1
lea ecx, [ebp - 0x258]
call fcn.00402590
push 0
push 1
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0
call fcn.0046d37e
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x4a8]
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x4d9c27
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
push 0
cmovae eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4d9c50
inc esi
cmp byte [ebp + esi - 0x110], 0
jne 0x4d9b40
push 0
push 1
lea ecx, [ebp - 0x228]
call fcn.00402590
xor eax, eax
inc eax
call fcn.00506b0b
ret 4
push 0
push 1
lea ecx, [ebp - 0x228]
call fcn.00402590
jmp 0x4d9abd
call fcn.00468812
int3
Function at 0x4da188
Capabilities:
Create thread

Disassembly:
mov edx, dword [ecx + 0x300]
or eax, 0xffffffff
cmp edx, eax
je 0x4da19a
cmp edx, 1
jne 0x4da1b5
xor eax, eax
push eax
push eax
push ecx
push 0x4d9f26
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
ret

Function at 0x4da948
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54698e
mov eax, dword fs:[0]
push eax
mov eax, 0x132c
call fcn.004682f0
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x5e
pop ecx
mov esi, str.FeejAy1jctPr8dTBbFGZLbqzHDsZGTcxjWGbdxzuQMBZd3ct972k3qZCAmAecQC7FNQwGNhgjZvJ6ZPKV6UDBtMGQZf2G3PR3ukFlre4X5nhDDliNRaAda7h51yY9jlG5PjyaznDeLqnFkriTHOGxkm4X77yTb6a9bCkYNlH05S4c5sDY65L6vGjPxFngBC2nPPnB7npAMDKAdwlMj6LEVZh5q1JgE0XUqxXHLCEgRpbxTmP1r319aAvtBi2BxisqYrjwrTS4SWqjHNaJY5Y0e7OphfrANWlyMHiG72O8eXlPAkRCC3xb85PU3KFP3BDWnP6Wt2bdqs6FLoLfwr7G4ZscDTGgPmHll2eiSOjvjJxdCE4KzSUr0oU
lea edi, [ebp - 0x18c]
rep movsd dword es:[edi], dword [esi]
push 0x7a
xor ebx, ebx
pop ecx
movsb byte es:[edi], byte [esi]
mov esi, str.6kvbKtJmF2PHzaPI6JMvEiXyc9Jgbmen1Ynulq7yoRBTE9N7xiGUlofrDFfI7nSe1iTMedKLxwr6w0dYLK1kbnr4KMLfQT5TPkeRqh06hr0ifVyNNhlPkZd2KgkVZzewLW4JaLpKDGttuOhgyVXueqspgDzVLEa57h1r3386yZ9coebBEPSZyg5n9jEd8W23S5SlCyLVnqaX6Fr8LjHq9Do5BETV1WNA6KXTxIanCupkXFtErZVTuWFffXfhvKlig0h5KzHiYNXvdTUGDUZSjbIhKWvJ7ZKFYaoAHr6q3tFtIpctjapgqO5FUdc6DnfZWG2W3vZWuAnmgh81S1UdIW8E8ZvsOKA3d4wboRnJqLi8gb7DTDPhWP2QhCEJDCd5UWfDb7yVN6P2WRv1sWGZ2HjjcGYmgIqewweU8LVAzZ4DPGRkGfMiZkQQF9zl8AxKkrgxoI0HUtcFYYQ0SWWBCYHrvhqmoIFz2htoxIh
mov dword [ebp - 0x1338], ebx
lea edi, [ebp - 0x374]
mov dword [ebp - 0x1334], ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x1330], ebx
lea eax, [ebp - 0x18c]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x132c]
call fcn.00405820
lea eax, [ebp - 0x132c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x1338]
call fcn.00407e30
push ebx
push 1
lea ecx, [ebp - 0x132c]
mov byte [ebp - 4], bl
call fcn.0046d37e
lea eax, [ebp - 0x374]
push eax
lea ecx, [ebp - 0x132c]
call fcn.00405820
lea eax, [ebp - 0x132c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x1338]
call fcn.00407e30
push ebx
push 1
lea ecx, [ebp - 0x132c]
call fcn.0046d37e
push 0x7d0
lea eax, [ebp - 0x1314]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x1314]
push 0x62d530
push eax
call fcn.004f39c6
pop ecx
pop ecx
lea eax, [ebp - 0x1314]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
lea ecx, [ebp - 0x1338]
sbb esi, esi
neg esi
call fcn.0046d3d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004682d0
mov esp, ebp
pop ebp
ret
Function at 0x4dafc0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x4dcde0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x4dce75
lea ecx, [eax + 0x80]
add eax, 0x100
dec edi
mov dword [ebp - 0x14], ecx
shr edi, 3
inc edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], edi
mov edx, ebx
mov ecx, esi
push 8
sub edx, esi
pop edi
mov al, byte [edx + ecx]
mov byte [ecx], al
inc ecx
sub edi, 1
jne 0x4dce25
push 8
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.004e3220
push esi
push esi
push dword [ebp - 0x14]
call fcn.004dc0c9
mov edx, dword [ebp - 0x18]
add esp, 0x18
xor ecx, ecx
mov al, byte [edx + ecx]
xor byte [esi + ecx], al
inc ecx
cmp ecx, 8
jl 0x4dce4e
push 8
lea eax, [ebp - 0xc]
push eax
push edx
call fcn.004e3220
add esp, 0xc
add ebx, 8
add esi, 8
sub dword [ebp - 0x10], 1
jne 0x4dce1c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004682d0
mov esp, ebp
pop ebp
ret

Function at 0x4dfd0e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [eax + 0x210]
mov esi, dword [edi]
mov dword [ebp - 8], edi
cmp esi, dword [eax + 0x214]
je 0x4dfddb
lea edi, [esi + 0x28]
lea ecx, [ebx + 0xa8]
mov dword [ebp + 8], edi
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5dc214
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
sub edi, 0xffffff80
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5dc214
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5dc214
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x5dc214
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebx + 0xa8]
push edi
push eax
call fcn.004f4130
mov edi, dword [ebp + 8]
pop ecx
pop ecx
test eax, eax
jne 0x4dfdb7
lea eax, [ebx + 0x28]
push edi
push eax
call fcn.004f4130
pop ecx
pop ecx
test eax, eax
je 0x4dfdf8
mov eax, 0x1b0
lea ecx, [ebx + 0xa8]
add edi, eax
add esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp + 8], edi
cmp esi, dword [eax + 0x214]
jne 0x4dfd41
mov edi, dword [ebp - 8]
lea eax, [ebx + 0xa8]
push eax
call fcn.004f3930
pop ecx
test eax, eax
je 0x4dfdf8
push ebx
mov ecx, edi
call fcn.004e0717
mov al, 1
jmp 0x4dfdfa
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4e065a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, 0x114
push edi
push ebx
xor edi, edi
mov eax, dword [esi + 0x210]
mov dword [esi + 0x214], eax
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.004e37a0
add esp, 0xc
mov dword [ebp - 0x118], ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x4e06bb
mov ecx, esi
call fcn.004e00d4
jmp 0x4e06d0
mov ebx, edi
test edi, edi
jne 0x4e06d0
mov ecx, esi
call fcn.004dffaf
inc ebx
mov edi, eax
cmp ebx, 0xa
jl 0x4e06bd
mov eax, dword [esi + 0x214]
mov ecx, 0x1b0
sub eax, dword [esi + 0x210]
cdq
idiv ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004682d0
mov esp, ebp
pop ebp
ret

Function at 0x4e0982
Capabilities:
Check if file exists
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x418]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x418], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4e09ca
xor eax, eax
jmp 0x4e0ab4
push 0x208
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.004e37a0
add esp, 0xc
mov dword [ebp - 0x41c], 0x104
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], 1
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
push 0x63d8a0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e0a96
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004e37a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push ebx
push 0x26
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
push str.Internet_Exploreriexplore.exe
push eax
call fcn.004f39c6
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e09c3
lea ecx, [ebp - 0x20c]
push ecx
push esi
call fcn.004f3a37
pop ecx
pop ecx
jmp 0x4e0ab1
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.004f3a37
pop ecx
pop ecx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004682d0
mov esp, ebp
pop ebp
ret 4
Function at 0x4e0b42
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 0x20c]
push 0x208
push edi
push eax
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x21c], edi
call fcn.004e37a0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
add esp, 0xc
mov ebx, 0x20019
push eax
push ebx
push edi
push 0x63d98c
push connect
call esi
test eax, eax
je 0x4e0bb2
xor eax, eax
jmp 0x4e0c80
lea eax, [ebp - 0x210]
push eax
push ebx
push edi
push str.shell
push dword [ebp - 0x218]
call esi
test eax, eax
jne 0x4e0bab
lea eax, [ebp - 0x214]
push eax
push ebx
push edi
push str.opencommand
push dword [ebp - 0x210]
call esi
test eax, eax
jne 0x4e0bab
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x104
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x220], 1
push eax
lea eax, [ebp - 0x220]
push eax
push edi
push 0x63d8a0
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x214]
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.004ee398
mov edi, 0x588d1c
push edi
push eax
call fcn.004e2b55
add esp, 0xc
test eax, eax
je 0x4e0bab
lea esi, [eax + 2]
push edi
push esi
call fcn.004e2b55
pop ecx
pop ecx
test eax, eax
je 0x4e0bab
xor ecx, ecx
push esi
mov word [eax], cx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004682d0
mov esp, ebp
pop ebp
ret
Function at 0x4e0fda
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fa4
call fcn.004682f0
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x804]
push edi
mov edi, 0x800
xor ebx, ebx
push edi
push ebx
push eax
call fcn.004e37a0
push edi
lea eax, [ebp - 0x1004]
push ebx
push eax
call fcn.004e37a0
add esp, 0x18
lea eax, [ebp - 0x1fa4]
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Program_FilesInternet_Exploreriexplore.exe
push 0x62b940
call fcn.004f3a59
pop ecx
lea eax, [ebp + eax*2 - 0x1fa4]
push eax
call fcn.004f3a37
lea eax, [ebp - 0x1fa4]
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.004f3a37
lea eax, [ebp - 0x804]
push esi
push eax
call fcn.004f3a37
lea eax, [ebp - 0x1fa4]
push esi
push eax
call fcn.004f39c6
add esp, 0x20
push 1
push ebx
push ebx
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x4e10aa
push ebx
push ebx
lea ecx, [ebp - 0x804]
push ecx
lea ecx, [ebp - 0x1004]
push ecx
call fcn.004c1063
add esp, 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.004682d0
mov esp, ebp
pop ebp
ret 4

Function at 0x4e143b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
lea esi, [edi + 4]
cmp dword [esi + 0x14], 8
jb 0x4e144f
mov eax, dword [esi]
jmp 0x4e1451
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e14b5
push 0x62e80c
call fcn.004f3a59
pop ecx
push eax
push 0x62e80c
lea ecx, [edi + 0x34]
call fcn.00402650
cmp dword [esi + 0x14], 8
jb 0x4e147f
mov eax, dword [esi]
jmp 0x4e1481
mov eax, esi
push dword [ebp + 8]
mov ecx, edi
push eax
call fcn.004e13a8
test eax, eax
jne 0x4e14b5
cmp dword [esi + 0x14], 8
jb 0x4e149a
mov eax, dword [esi]
jmp 0x4e149c
mov eax, esi
push 0
push 0
push dword [ebp + 8]
push eax
call fcn.004c1063
add esp, 0x10
test eax, eax
je 0x4e14b5
xor eax, eax
inc eax
jmp 0x4e151d
lea eax, [edi + 0x1c]
cmp dword [eax + 0x14], 8
jb 0x4e14c0
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e151b
push 0x62e818
call fcn.004f3a59
pop ecx
push eax
push 0x62e818
lea ecx, [edi + 0x34]
call fcn.00402650
cmp dword [esi + 0x14], 8
jb 0x4e14ee
mov eax, dword [esi]
jmp 0x4e14f0
mov eax, esi
push dword [ebp + 8]
mov ecx, edi
push eax
call fcn.004e13a8
test eax, eax
jne 0x4e151b
cmp dword [esi + 0x14], 8
jb 0x4e1507
mov esi, dword [esi]
push 0
push 0
push dword [ebp + 8]
push esi
call fcn.004c1063
add esp, 0x10
test eax, eax
jne 0x4e14b0
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x4e1523
Capabilities:
Get disk information

Disassembly:
push 0x4e0
mov eax, 0x546fb4
call fcn.00506b61
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x4e0]
mov ebx, dword [ebp + 0xc]
xor edi, edi
push edi
xor eax, eax
mov dword [ebp - 0x4ec], edi
push 0x63d8a0
mov dword [ebp - 0x4cc], 7
mov dword [ebp - 0x4d0], edi
mov word [ebp - 0x4e0], ax
call fcn.00402650
mov dword [ebp - 4], edi
test ebx, ebx
je 0x4e1659
lea eax, [ebp - 0x4c8]
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4e1659
mov dword [ebp - 0x4e4], edi
cmp word [ebp - 0x4c8], di
je 0x4e1659
and dword [ebp - 0x4e8], 0
lea edi, [ebp - 0x4c8]
push 0x62e830
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4e162d
push 0x62e838
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4e162d
mov ax, word [edi]
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0x4e8]
push 0x64
mov ax, word [ebp + eax - 0x4c6]
mov word [ebp - 0x16], ax
xor eax, eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4e16d7
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea eax, [ebp - 0xe0]
push edi
push eax
push ebx
call fcn.004f5c5c
add esp, 0xc
test eax, eax
je 0x4e167f
mov eax, dword [ebp - 0x4e4]
lea edi, [ebp - 0x4c8]
add eax, 4
mov dword [ebp - 0x4e4], eax
add eax, eax
add edi, eax
mov dword [ebp - 0x4e8], eax
xor eax, eax
cmp word [edi], ax
jne 0x4e15af
xor edi, edi
lea eax, [ebp - 0x4e0]
mov ecx, esi
push eax
call fcn.00404660
push edi
push 1
lea ecx, [ebp - 0x4e0]
call fcn.00402590
mov eax, esi
call fcn.00506b0b
ret 8
cmp word [ebp - 0x18], 0
jne 0x4e168a
xor eax, eax
jmp 0x4e1694
lea eax, [ebp - 0x18]
push eax
call fcn.004f3a59
pop ecx
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x4e0]
call fcn.00404290
lea edi, [ebx + edi*2]
xor ebx, ebx
cmp word [edi], bx
jne 0x4e16b2
mov eax, ebx
jmp 0x4e16b9
push edi
call fcn.004f3a59
pop ecx
push eax
push edi
lea ecx, [ebp - 0x4e0]
call fcn.00404290
lea eax, [ebp - 0x4e0]
mov ecx, esi
push eax
call fcn.00404660
push ebx
jmp 0x4e1668
push 0x63d8a0
mov ecx, esi
call fcn.004024f0
xor eax, eax
push eax
jmp 0x4e1668

Function at 0x4f9ad4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004f9953

Function at 0x4fb5b9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004fb279
Function at 0x508790
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004e37a0
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jg 0x508802
cmp dword [ebp - 0x118], 2
jg 0x508802
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004682d0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004682d0
mov esp, ebp
pop ebp
ret

Function at 0x508990
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x5089bc
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x5089ad
pop edi
xor eax, eax
pop esi
pop ebp
ret
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x5089f0
cmp dword [esi + 8], 0
jne 0x5089e0
push 0x54bef0
push dword [eax + 8]
call fcn.004eaa2d
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x5089e0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.004eac10
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x508a12
mov eax, dword [esi + 8]
test eax, eax
je 0x508a0c
push eax
call fcn.004ea7de
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x508ce0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x508d30
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x508d2a
shr eax, 8
cmp al, 2
jne 0x508d2a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004682d0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.004682d0
mov esp, ebp
pop ebp
ret

Function at 0x5093d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push edi
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ecx + eax*4 + 0x130]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x50944e
push esi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x50941e
pop esi
pop edi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
pop ebp
ret
push esi
push dword [ebp + 8]
call fcn.00516b80
push eax
mov eax, dword [ebp + 8]
push str.Send_failure:__s
push dword [eax]
call fcn.005090b0
mov eax, dword [ebp + 8]
add esp, 0x14
mov eax, dword [eax]
mov dword [eax + 0x856c], esi
mov eax, edi
mov dword [ebx], 0x37
pop esi
pop edi
pop ebx
pop ebp
ret