joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452ad0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0x84
jg 0x452b01
je 0x452b5b
sub eax, 7
je 0x452b22
dec eax
je 0x452b4c
sub eax, 0x17
je 0x452c00
jmp 0x452c3e
add eax, 0xffffff00
sub eax, 9
jb 0x452bec
add eax, 0xffffff09
sub eax, 0xb
jb 0x452bb4
jmp 0x452c3e
mov eax, ebx
call fcn.0043a3bc
mov edi, eax
test edi, edi
je 0x452c9e
mov edx, ebx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd4]
test al, al
je 0x452ca7
jmp 0x452c9e
test byte [ebx + 0x44], 0x20
jne 0x452ca7
jmp 0x452c9e
mov edx, esi
mov eax, ebx
call fcn.00450048
cmp dword [esi + 0xc], 0xffffffff
jne 0x452ca7
push 0
lea edx, [ebp - 0x120]
mov eax, dword [esi + 8]
call fcn.004823ac
lea edx, [ebp - 0x120]
lea ecx, [ebp - 0x118]
mov eax, ebx
call fcn.0044eb7c
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, ebx
call fcn.004529a8
test eax, eax
je 0x452ca7
mov dword [esi + 0xc], 1
jmp 0x452ca7
mov edx, esi
mov eax, ebx
call fcn.00452a3c
test al, al
je 0x452c9e
cmp dword [esi + 0xc], 0
jne 0x452ca7
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push eax
mov eax, dword [esi]
push eax
mov eax, ebx
call fcn.00455138
push eax
call sub.USER32.DLL_DefWindowProcA
jmp 0x452ca7
mov eax, ebx
call fcn.0044f6e4
test al, al
jne 0x452ca7
jmp 0x452c9e
mov eax, ebx
call fcn.00455138
mov edi, eax
call sub.USER32.DLL_GetCapture
cmp edi, eax
jne 0x452c9e
cmp dword [0x4e0acc], 0
je 0x452c9e
mov eax, dword [0x4e0acc]
cmp ebx, dword [eax + 0x24]
jne 0x452c9e
push 0
xor ecx, ecx
mov edx, 0x1f
mov eax, dword [0x4e0acc]
call fcn.0044ff7c
jmp 0x452c9e
mov eax, dword [0x4ee97c]
cmp byte [eax + 0x20], 0
je 0x452c9e
mov eax, dword [0x4ee97c]
cmp dword [eax + 0x1c], 0
je 0x452c9e
mov eax, dword [esi]
mov edx, dword [0x4ee97c]
cmp eax, dword [edx + 0x1c]
jne 0x452c9e
lea eax, [ebp - 0x110]
push eax
call sub.USER32.DLL_GetKeyboardState
mov eax, dword [esi]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x110]
call fcn.0043a300
mov byte [ebp - 0xc], al
mov ax, word [esi + 4]
mov word [ebp - 0xa], ax
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, ebx
mov bx, 0xffb7
call fcn.0048bb78
jmp 0x452ca7
mov edx, esi
mov eax, ebx
call fcn.00450048
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453168
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1e8], 0
je 0x453184
cmp dword [esi + 4], 0
je 0x4531b1
test byte [ebx + 0x45], 1
jne 0x4531a3
mov eax, ebx
call fcn.00452018
test eax, eax
jne 0x4531a3
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x4532c1
mov edx, esi
mov eax, ebx
call fcn.00452de0
jmp 0x4532c1
push 0
call sub.USER32.DLL_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.DLL_ReleaseDC
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4532ba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00455138
push eax
call sub.USER32.DLL_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0044ff7c
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00453168
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.DLL_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00455138
push eax
call sub.USER32.DLL_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4532c1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.DLL_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461b2c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x461c04
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4eea00], 0
jne 0x461be8
lea eax, [ebp - 4]
mov edx, 0x461c1c
call fcn.0048c4e4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0048c890
mov esi, eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x461be8
mov eax, ebx
call fcn.0048b234
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x461be1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.VERSION.DLL_GetFileVersionInfoA
test eax, eax
je 0x461bcb
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x461c2c
mov eax, dword [ebp - 0xc]
push eax
call sub.VERSION.DLL_VerQueryValueA
test eax, eax
je 0x461bcb
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4eea00], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461be8
mov eax, dword [ebp - 0xc]
call fcn.0048b24c
ret
mov ebx, dword [0x4eea00]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461c0b
lea eax, [ebp - 4]
call fcn.0048c44c
ret

Function at 0x473db0
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x4eea24], 0
jne 0x473dd3
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, 0x473d34
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x4eea24], eax
ret

Function at 0x474c90
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.00455434
test al, al
je 0x474ceb
cmp bl, 7
jne 0x474cc7
push 2
lea eax, [esp + 4]
push eax
push 0x100c
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
movzx edi, byte [esp]
sub edi, 0x30
jmp 0x474ccc
mov edi, ebx
and edi, 0x7f
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xbc]
test eax, eax
je 0x474ceb
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xbc]
mov edx, edi
call fcn.00482ed8
mov byte [esi + 0x208], bl
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x486bf4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x486c2d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0048c534
jmp 0x486c36
mov eax, ebx
mov edx, esi
call fcn.0048c4a0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x486c40
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x486c61
mov al, byte [esp]
jmp 0x486c63
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x48b478
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x48b4a7
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0048c534
jmp 0x48b4c5
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.0048b400
mov edi, eax
test ebx, ebx
je 0x48b4c5
cmp dword [esi], 0
je 0x48b4c5
dec ebx
jmp 0x48b4ae
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x48b814
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4e1088]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x48b8ac
push reloc.WS2_32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x48b88c
xor eax, eax
push ebp
push 0x48b885
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x48b8c8
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b88c
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x4e1088]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4e1088], ax
mov esp, ebp
pop ebp
ret
Function at 0x48dfb4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x48e170
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x48e015
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x48e18c
push closesocket
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x48e087
xor eax, eax
push ebp
push 0x48e080
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.0048de0c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x48e069
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x48e1ac
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e087
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x48e168
cmp byte [ebp - 0xd], 0
jne 0x48e0c9
cmp byte [ebp - 0x12], 0
je 0x48e168
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x48e0e2
dec ebx
cmp byte [ebx], 0x2e
je 0x48e0f1
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x48e0e1
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x48e168
inc ebx
cmp byte [ebp - 0x12], 0
je 0x48e11e
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x48e168
cmp byte [ebp - 0xd], 0
je 0x48e168
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x48e168
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48e58c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
push ebp
push 0x48e674
push dword fs:[eax]
mov dword fs:[eax], esp
sub dword [0x4ef098], 1
jae 0x48e666
xor eax, eax
mov dword [0x4eeca4], eax
xor eax, eax
mov dword [0x4eecac], eax
xor eax, eax
mov dword [0x4eecb0], eax
mov byte [0x4eecb6], 2
mov byte [0x4eecb7], 2
mov byte [0x4eecb8], 3
mov word [0x4ef060], 0
mov word [0x4ef070], 1
mov word [0x4ef080], 0xa
mov dword [0x4ef088], 0x80020004
mov dword [0x4ef054], 0x48d120
mov dword [0x4ef058], 0x48d118
mov dword [0x4ef05c], 0x48d120
call fcn.0048b7e4
test al, al
je 0x48e625
call fcn.0048b814
call fcn.0048b8d8
mov eax, 0x4eecbc
mov edx, 0x48e680
call fcn.00488f62
mov eax, 0x4eee88
mov edx, 0x48e680
call fcn.00488f62
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x4eec9c], eax
call fcn.00489ef0
mov dword [0x4eec98], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x4eec90], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e67b
ret

Function at 0x492e40
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe18
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x140
push 0
lea eax, [ebp - 0x154]
push eax
call fcn.0049c07c
add esp, 0xc
lea edx, [ebp - 0x1e8]
mov dword [ebp - 0x1e8], 0x94
push edx
call sub.KERNEL32.DLL_GetVersionExA
lea ecx, [ebp - 0x154]
lea eax, [ebp - 0x1e8]
push ecx
push eax
push ebx
call fcn.00492cec
add esp, 0xc
lea edx, [ebp - 8]
mov dword [ebp - 0x154], 0x10
push edx
call sub.KERNEL32.DLL_QueryPerformanceCounter
lea ecx, [ebp - 0x10]
push ecx
call sub.KERNEL32.DLL_QueryPerformanceFrequency
lea eax, [ebp - 0x154]
lea edx, [ebp - 8]
push eax
push edx
push ebx
call fcn.00492d84
add esp, 0xc
lea ecx, [ebp - 0x154]
push ecx
lea eax, [ebp - 0x10]
push eax
push ebx
call fcn.00492de4
add esp, 0xc
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push edx
lea ecx, [ebp - 0x128]
push ecx
call sub.KERNEL32.DLL_GetComputerNameA
test esi, esi
je 0x492f31
push esi
call fcn.0049c15c
pop ecx
mov edi, eax
test eax, eax
jle 0x492f31
add edi, dword [ebp - 0x14]
inc edi
cmp edi, 0x104
jae 0x492f31
push 0x4e15c0
lea edx, [ebp - 0x128]
push edx
call fcn.0049c120
add esp, 8
push esi
lea ecx, [ebp - 0x128]
push ecx
call fcn.0049c120
add esp, 8
push 1
lea eax, [ebp - 0x154]
push 0
push eax
lea edx, [ebp - 0x128]
push 0
push edx
push 0
push ebx
call fcn.00492968
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492f58
Capabilities:
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd54
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x140
push 0
lea eax, [ebp - 0x2ac]
push eax
call fcn.0049c07c
mov dword [ebp - 0x2ac], 0x10
add esp, 0xc
lea edx, [ebp - 8]
mov dword [ebp - 8], 0x104
push edx
lea ecx, [ebp - 0x280]
push ecx
call sub.ADVAPI32.DLL_GetUserNameA
test edi, edi
je 0x492fe9
push edi
call fcn.0049c15c
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
jle 0x492fe9
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 8]
inc edx
cmp edx, 0x104
jae 0x492fe9
push 0x4e15c2
lea ecx, [ebp - 0x280]
push ecx
call fcn.0049c120
add esp, 8
push edi
lea eax, [ebp - 0x280]
push eax
call fcn.0049c120
add esp, 8
lea edx, [ebp - 4]
push edx
push 0x11
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push 0x408
push 0x160
lea ecx, [ebp - 0x16c]
push ecx
push 0
mov eax, dword [ebp - 4]
push eax
mov edx, dword [ebx + 4]
push edx
call fcn.004a8af0
add esp, 0x18
test esi, esi
je 0x493033
mov ecx, dword [esi]
cmp ecx, dword [ebp - 0x168]
jle 0x49302b
mov eax, dword [esi]
jmp 0x493031
mov eax, dword [ebp - 0x168]
mov dword [esi], eax
push 1
lea ecx, [ebp - 0x2ac]
mov edx, dword [ebp - 0x168]
lea eax, [ebp - 0x5c]
push edx
push ecx
push eax
lea edx, [ebp - 0x280]
push edx
push 0
push ebx
call fcn.00492968
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x493060
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
xor eax, eax
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4930b5
mov dl, byte [edx]
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], dl
lea eax, [ebp - 0x10]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], 0
push 0x64
push ecx
push eax
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 8]
push ecx
lea eax, [ebp - 0x110]
push 0xff
push eax
lea edx, [ebp - 4]
push edx
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
setne al
and eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x493114
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov byte [ebp - 5], 0
push edi
mov eax, dword [esi]
push eax
call fcn.00413ca8
add esp, 8
test al, al
jne 0x493142
mov al, byte [ebp - 5]
jmp 0x49322c
push edi
call fcn.0049c15c
movsx edx, byte [edi + eax - 1]
cmp edx, 0x5c
pop ecx
setne bl
and ebx, 1
xor edx, edx
mov dl, bl
add eax, edx
add eax, 4
push eax
call fcn.0049b898
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push esi
mov esi, eax
xor eax, eax
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
test bl, bl
je 0x4931a5
push 0x4e15c4
mov eax, dword [ebp - 4]
push eax
call fcn.0049c120
add esp, 8
push 0x4e15c6
mov edx, dword [ebp - 4]
push edx
call fcn.0049c120
add esp, 8
lea ecx, [ebp - 0x148]
push ecx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov edi, eax
mov eax, dword [ebp - 4]
push eax
call fcn.0049b6d4
pop ecx
cmp edi, 0xffffffff
setne bl
and ebx, 1
jmp 0x493219
lea eax, [ebp - 0x11c]
push eax
push esi
call fcn.004930d0
add esp, 8
test al, al
jne 0x493204
mov edx, dword [ebp - 0x148]
push edx
push esi
call fcn.004930bc
add esp, 8
mov byte [ebp - 5], al
lea ecx, [ebp - 0x148]
push ecx
push edi
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
setne bl
and ebx, 1
test bl, bl
je 0x493223
cmp byte [ebp - 5], 0
je 0x4931dd
push edi
call sub.KERNEL32.DLL_FindClose
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49403c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop ebp
ret

Function at 0x494058
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [esi]
push edx
call fcn.00413ca8
add esp, 8
test al, al
je 0x4941fe
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0049c15c
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 5
push eax
call fcn.0049b898
mov edi, eax
mov eax, dword [ebp + 0xc]
pop ecx
push esi
push edi
mov esi, edi
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x4e15ea
push edi
call fcn.0049c120
add esp, 8
lea eax, [ebp - 0x148]
push eax
push edi
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 4], eax
push edi
call fcn.0049b6d4
pop ecx
mov bl, 1
cmp dword [ebp - 4], 0xffffffff
setne al
and eax, 1
test al, al
je 0x4941d8
lea edx, [ebp - 0x11c]
push edx
push esi
call fcn.004930d0
add esp, 8
test al, al
jne 0x4941b8
lea ecx, [ebp - 0x11c]
push ecx
call fcn.0049c15c
pop ecx
mov edi, eax
test eax, eax
jle 0x4941b8
mov eax, dword [ebp - 8]
add eax, edi
add eax, 2
push eax
call fcn.0049b898
mov edi, eax
mov eax, dword [ebp + 0xc]
pop ecx
push esi
push edi
mov esi, edi
mov edi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0x4e15ef
push edi
call fcn.0049c120
add esp, 8
lea eax, [ebp - 0x11c]
push eax
push edi
call fcn.0049c120
add esp, 8
mov edx, dword [ebp - 0x148]
push edx
push esi
call fcn.004930bc
add esp, 8
test al, al
je 0x4941a5
push edi
push esi
call fcn.00494058
add esp, 8
and bl, al
jmp 0x4941b1
push edi
push esi
call fcn.00494208
add esp, 8
and bl, al
push edi
call fcn.0049b6d4
pop ecx
lea ecx, [ebp - 0x148]
push ecx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x4940fd
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.DLL_FindClose
push 0x30
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebp + 0xc]
push eax
call sub.KERNEL32.DLL_RemoveDirectoryA
dec eax
sete dl
and edx, 1
and bl, dl
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x494208
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push 0x20
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push ebx
call sub.KERNEL32.DLL_DeleteFileA
dec eax
sete al
and eax, 1
pop ebx
pop ebp
ret
Function at 0x496390
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov bl, 1
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push esi
call fcn.00496510
pop ecx
cmp di, ax
jne 0x4963b6
cmp dword [esi], 0
jne 0x4964ce
push esi
call fcn.00496798
pop ecx
cmp dword [esi], 0
je 0x4963cc
push esi
push esi
call fcn.00496370
add esp, 8
mov eax, dword [esi + 0x1c]
push eax
call fcn.00412804
pop ecx
push 0x11
push 2
push 2
call sub.WS2_32.DLL_socket
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
setne bl
and ebx, 1
test bl, bl
je 0x49641c
cmp byte [ebp + 0xc], 0
je 0x49641c
mov dword [ebp - 8], 1
push 4
lea eax, [ebp - 8]
push eax
push 0x20
push 0xffff
mov edx, dword [ebp - 4]
push edx
call sub.WS2_32.DLL_setsockopt
inc eax
setne bl
and ebx, 1
test bl, bl
je 0x496465
test di, di
jbe 0x496465
mov ebx, 0x10
lea eax, [ebp - 0x20]
push ebx
push 0
push eax
call fcn.0049c07c
add esp, 0xc
mov word [ebp - 0x20], 2
xor edx, edx
mov dword [ebp - 0x1c], edx
push edi
call sub.WS2_32.DLL_htons
mov word [ebp - 0x1e], ax
push ebx
lea ecx, [ebp - 0x20]
push ecx
mov eax, dword [ebp - 4]
push eax
call sub.WS2_32.DLL_bind
inc eax
setne dl
and edx, 1
mov ebx, edx
test bl, bl
jne 0x496478
lea ecx, [ebp - 4]
push ecx
push esi
call fcn.00496370
add esp, 8
jmp 0x4964ce
push esi
call fcn.0049678c
pop ecx
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov word [esi + 0x16], di
mov edx, dword [esi]
push edx
push 8
push esi
call fcn.004968cc
lea ecx, [ebp - 0x10]
add esp, 0xc
mov dword [ebp - 0x10], 0x4967a4
mov dword [ebp - 0xc], esi
push dword [ecx + 4]
push dword [ecx]
push 1
mov edi, dword [esi + 0x1c]
push edi
call fcn.0041271c
pop ecx
push eax
push 0
push edi
call fcn.00412770
add esp, 0x18
push 1
mov eax, dword [esi + 0x1c]
push eax
call fcn.0041284c
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x496530
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor esi, esi
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cmp dword [ebx], 0
je 0x4965cc
test edi, edi
je 0x4965cc
cmp dword [ebp + 0x10], 0
jl 0x4965cc
cmp dword [ebp + 0x14], 0
je 0x4965cc
cmp dword [ebp + 0x18], 0
jle 0x4965cc
mov esi, 0x10
lea eax, [ebp - 0x10]
push esi
push 0
push eax
call fcn.0049c07c
add esp, 0xc
mov word [ebp - 0x10], 2
push edi
call sub.WS2_32.DLL_inet_addr
mov dword [ebp - 0xc], eax
mov dx, word [ebp + 0x10]
push edx
call sub.WS2_32.DLL_htons
mov word [ebp - 0xe], ax
mov ecx, dword [ebx + 0x20]
push ecx
call fcn.00416dfc
pop ecx
push esi
lea eax, [ebp - 0x10]
push eax
push 0
mov edx, dword [ebp + 0x18]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [ebx]
push eax
call sub.WS2_32.DLL_sendto
mov esi, eax
mov edx, dword [ebx + 0x20]
push edx
call fcn.00416e0c
pop ecx
mov ecx, dword [ebx]
push ecx
push 2
push ebx
call fcn.004968cc
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret