joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ce30
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov esi, ecx
mov eax, dword [ecx + 0x18]
mov dword [esp + 0xc], eax
mov ebx, dword [eax + 0x1ac]
mov dword [esp + 4], pe_nt_image_headers32
lea eax, [esp + 4]
lea edi, [esp + 0x10]
push eax
push edi
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x44ce86
push str.Error_accept__ing_server_connect
push esi
call fcn.00442490
add esp, 8
mov eax, 0x1e
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], pe_nt_image_headers32
push str.ftp.c
push 0x1bc
lea eax, [esp + 0xc]
push eax
push edi
push ebx
call fcn.00404d90
add esp, 0x14
mov dword [esp + 8], eax
cmp eax, 0xffffffff
je 0x44ce6b
test byte [esi + 0x6eb], 0x20
mov ebx, esi
je 0x44cedd
mov ecx, dword [ebx + 0xd20]
test ecx, ecx
je 0x44cecb
cmp dword [ecx + 4], 0
jle 0x44cedd
push str.Connection_accepted_from_server
push ebx
mov esi, eax
call fcn.00442520
mov eax, esi
add esp, 8
mov esi, dword [esp + 0xc]
and byte [esi + 0x2a1], 0xef
push 1
push eax
call fcn.00463d30
add esp, 8
lea eax, [esp + 8]
push eax
push 1
push esi
push ebx
call fcn.004377b0
add esp, 0x10
test eax, eax
je 0x44cf27
push str.ftp.c
push 0x1cc
push dword [esp + 0x10]
mov esi, eax
call fcn.00404e00
mov eax, esi
add esp, 0xc
jmp 0x44ce7e
xor eax, eax
cmp dword [ebx + 0x19c], 0
je 0x44ce7e
push 1
push ebx
call fcn.00410960
add esp, 8
push 1
push dword [esp + 0xc]
push dword [ebx + 0x1a0]
call dword [ebx + 0x19c]
add esp, 0xc
mov edi, eax
push 0
push ebx
call fcn.00410960
xor eax, eax
add esp, 8
test edi, edi
je 0x44ce7e
test byte [ebx + 0x6eb], 0x20
je 0x44cfbc
mov eax, dword [ebx + 0xd20]
test eax, eax
je 0x44cf86
cmp dword [eax + 4], 0
jle 0x44cfbc
mov eax, dword [0xb5ad14]
cmp dword [eax + 4], 0
jle 0x44cfbc
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x44cfa8
movzx eax, byte [eax + 0x3b6]
mov eax, dword [eax*4 + 0xa21838]
jmp 0x44cfad
mov eax, 0xa218c4
push eax
push str.__s__closing_DATA_connection
push ebx
call fcn.00442890
add esp, 0xc
push 1
push ebx
call fcn.00438ac0
add esp, 8
push 1
push dword [ebx + 0x18]
push ebx
call fcn.00438a50
add esp, 0xc
mov eax, 0x2a
jmp 0x44ce7e

Function at 0x44e2e0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, 1
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop word cs:[eax + eax]
push str.getenv.c
push 0x30
push edi
push ebx
call fcn.00404a20
add esp, 0x10
test eax, eax
je 0x44e342
mov esi, eax
push edi
push eax
push dword [esp + 0x1c]
call ebp
test eax, eax
je 0x44e338
cmp eax, edi
je 0x44e338
cmp eax, 0x8001
jae 0x44e338
mov ebx, esi
cmp eax, edi
mov edi, eax
jae 0x44e300
jmp 0x44e354
push str.getenv.c
push 0x3d
push esi
jmp 0x44e34a
push str.getenv.c
push 0x32
push ebx
call fcn.00404af0
add esp, 0xc
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x45ce40
Capabilities:
Parse credit card information

Disassembly:
test edx, edx
je 0x45cfda
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x1c]
nop word [eax + eax]
movzx eax, byte [edi]
mov ecx, eax
add cl, 0xd0
cmp cl, 0xa
jb 0x45cf50
mov ecx, eax
and cl, 0xdf
add cl, 0xbf
cmp cl, 0x19
jbe 0x45cf50
cmp eax, 0x5e
jg 0x45cf40
lea ecx, [eax - 0x2d]
cmp ecx, 2
jb 0x45cf50
cmp eax, 0x25
jne 0x45cf6a
movzx eax, byte [edi + 1]
mov ecx, eax
add cl, 0xd0
cmp cl, 0xa
jb 0x45cec5
movzx eax, al
lea ecx, [eax - 0x61]
cmp ecx, 6
jb 0x45cec5
add eax, 0xffffffbf
cmp eax, 5
ja 0x45cfc9
movzx eax, byte [edi + 2]
mov ecx, eax
add cl, 0xd0
cmp cl, 0xa
jb 0x45ceea
movzx eax, al
lea ecx, [eax - 0x61]
cmp ecx, 6
jb 0x45ceea
add eax, 0xffffffbf
cmp eax, 5
ja 0x45cfc9
lea ebx, [edi + 2]
mov byte [esp + 6], 0
mov word [esp + 4], 0x25
movsx eax, byte [edi + 1]
push eax
call fcn.0041a200
add esp, 4
mov byte [esp + 5], al
movsx eax, byte [edi + 2]
push eax
call fcn.0041a200
add esp, 4
mov byte [esp + 6], al
push 3
lea eax, [esp + 8]
push eax
push ebp
call fcn.00445810
add esp, 0xc
add esi, 0xfffffffe
mov edi, ebx
dec esi
jne 0x45cf5f
jmp 0x45cfd2
cmp eax, 0x7e
je 0x45cf50
cmp eax, 0x5f
jne 0x45cf6a
nop word [eax + eax]
push 1
push edi
push ebp
call fcn.00445810
add esp, 0xc
dec esi
je 0x45cfd2
inc edi
test eax, eax
je 0x45ce60
jmp 0x45cfd2
mov byte [esp + 2], 0
mov word [esp], 0x25
movzx eax, byte [edi]
cmp dword [esp + 0x20], 0
je 0x45cf9c
cmp eax, 0x3d
jne 0x45cfa1
push 1
push edi
push ebp
call fcn.00445810
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov byte [ecx], 1
dec esi
jne 0x45cf5f
jmp 0x45cfd2
cmp eax, 0x2f
je 0x45cf50
shr eax, 4
movzx eax, byte [eax + 0xa252ef]
mov byte [esp + 1], al
movzx eax, byte [edi]
and eax, 0xf
movzx eax, byte [eax + 0xa252ef]
mov byte [esp + 2], al
push 3
lea eax, [esp + 4]
push eax
jmp 0x45cf53
push 3
push 0xa252eb
jmp 0x45cf53
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
ret

Function at 0x463d30
Capabilities:
Set socket configuration

Disassembly:
push eax
mov eax, dword [esp + 8]
xor ecx, ecx
cmp dword [esp + 0xc], 0
setne cl
mov dword [esp], ecx
mov ecx, esp
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop ecx
ret
Function at 0x4798a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c0
mov ebp, edx
mov ebx, ecx
mov edi, dword [esp + 0x1d8]
mov eax, dword [ecx + 8]
mov dword [esp], eax
lea esi, [esp + 0x5c]
push 0x100
push 0xa2ab1c
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [esp + 4], ebp
push ebp
push ebx
call fcn.0042a450
add esp, 8
mov dword [esp + 8], eax
call fcn.005b46e0
mov ebp, eax
and eax, 0xff800000
cmp eax, 0xa000000
jne 0x479988
mov eax, ebp
and eax, 0x7fffff
cmp eax, 0x414
jg 0x47992b
cmp eax, 0x86
je 0x47993d
cmp eax, 0xcf
jne 0x479988
mov eax, dword [esp]
or byte [eax + 0x2d8], 8
mov esi, str.QUIC_connection_has_been_shut_down
jmp 0x479ad7
cmp eax, 0x45c
je 0x479a8d
cmp eax, 0x415
jne 0x479988
mov eax, dword [esp]
push dword [eax + 0x10c]
call fcn.00505b70
add esp, 4
mov edi, 0x3c
test eax, eax
je 0x479ad2
mov ecx, dword [esp + 8]
mov dword [ecx + 0x48], eax
push eax
call fcn.00630690
add esp, 4
lea esi, [esp + 0x5c]
push eax
push str.SSL_certificate_problem:__s
push 0x100
push esi
call fcn.00409eb0
add esp, 0x10
jmp 0x479ad7
mov byte [esp + 0x5c], 0
push 0x100
push esi
push ebp
call fcn.005b4f00
add esp, 0xc
cmp byte [esp + 0x5c], 0
je 0x4799b1
mov eax, edi
xor eax, 0x23
or eax, ebp
je 0x4799db
jmp 0x479ad7
test ebp, ebp
mov eax, 0xa2acbd
mov ecx, 0xa2acaf
cmove ecx, eax
lea eax, [esp + 0x5c]
push ecx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
mov eax, edi
xor eax, 0x23
or eax, ebp
jne 0x479ad7
mov ebp, dword [esp + 0x1d4]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
movups xmmword [esp + 0x2c], xmm0
movups xmmword [esp + 0x1c], xmm0
movups xmmword [esp + 0xc], xmm0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea edi, [esp + 0x15c]
push edi
push 0
push 0
push dword [esp + 0x10]
push dword [ebx + 4]
call fcn.004379f0
add esp, 0x14
test esi, esi
sete al
cmp ebp, 5
setne cl
or cl, al
jne 0x479a52
lea ebx, [esp + 0xc]
push 0x50
push ebx
push esi
call fcn.0041a5e0
add esp, 0xc
cmp byte [esp + 0xc], 0
mov eax, str.SSL_ERROR_SYSCALL
cmovne eax, ebx
mov ecx, dword [esp]
jmp 0x479a66
mov eax, str.SSL_ERROR_unknown
cmp ebp, 0xa
mov ecx, dword [esp]
ja 0x479a66
mov eax, dword [ebp*4 + 0xa2b5b4]
push edi
push dword [esp + 0x1bc]
push dword [ecx + 0xf4]
push eax
push str.QUIC_connect:__s_in_connection_to__s:_d___s_
push dword [esp + 0x18]
call fcn.00442490
add esp, 0x18
mov edi, 0x23
jmp 0x479ae9
mov byte [esp + 0x5c], 0
lea esi, [esp + 0x5c]
push 0x100
push esi
push ebp
call fcn.005b4f00
add esp, 0xc
mov edi, 0x62
cmp byte [esp + 0x5c], 0
jne 0x479ad7
mov word [esp + 0x68], 0x72
mov dword [esp + 0x64], 0x6f727265
mov dword [esp + 0x60], 0x206e776f
mov dword [esp + 0x5c], 0x6e6b6e55
jmp 0x479ad7
mov esi, str.SSL_certificate_verification_failed
push esi
push 0xa2acac
push dword [esp + 0xc]
call fcn.00442490
add esp, 0xc
mov eax, edi
add esp, 0x1c0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4836b0
Capabilities:
Get hostname

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov byte [esi], 0
push edi
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
je 0x4836d1
pop esi
pop edi
ret
push 0x2e
push esi
mov esi, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
mov ecx, eax
mov eax, esi
test ecx, ecx
je 0x4836ce
mov byte [ecx], 0
pop esi
pop edi
ret

Function at 0x486a80
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x1c]
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x14]
lea eax, [ecx + eax*2]
add eax, 0xc
push str.hmac.c
push 0x43
push eax
call fcn.00404730
add esp, 0xc
mov esi, eax
test eax, eax
je 0x486b96
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov dword [esi], edi
add eax, 0xc
mov dword [esi + 4], eax
mov ecx, dword [edi + 0xc]
add ecx, eax
mov dword [esi + 8], ecx
cmp dword [edi + 0x10], ebx
jae 0x486af5
push eax
call dword [edi]
add esp, 4
push ebx
push ebp
push dword [esi + 4]
call dword [edi + 4]
add esp, 0xc
mov ebp, dword [esi + 8]
add ebp, dword [edi + 0xc]
push dword [esi + 4]
push ebp
call dword [edi + 8]
add esp, 8
mov ebx, dword [edi + 0x14]
mov eax, dword [esi + 4]
push eax
call dword [edi]
add esp, 4
push dword [esi + 8]
call dword [edi]
add esp, 4
test ebx, ebx
mov ecx, edi
je 0x486b5a
xor edi, edi
mov dword [esp + 4], ebx
nop
movzx eax, byte [ebp + edi]
xor al, 0x36
mov byte [esp + 3], al
push 1
lea eax, [esp + 7]
push eax
push dword [esi + 4]
mov ebx, esi
mov esi, ebp
mov ebp, ecx
call dword [ecx + 4]
add esp, 0xc
movzx eax, byte [esi + edi]
xor al, 0x5c
mov byte [esp + 3], al
push 1
lea eax, [esp + 7]
push eax
push dword [ebx + 8]
call dword [ebp + 4]
mov ecx, ebp
mov ebp, esi
mov esi, ebx
mov ebx, dword [esp + 0x10]
add esp, 0xc
inc edi
cmp ebx, edi
jne 0x486b10
cmp ebx, dword [ecx + 0x10]
jae 0x486b96
mov edi, ecx
nop word cs:[eax + eax]
push 1
push str.6_s__s_s_s_s_HTTP_1._d_r_n
push dword [esi + 4]
call dword [edi + 4]
add esp, 0xc
push 1
push 0xa2cc00
push dword [esi + 8]
call dword [edi + 4]
add esp, 0xc
inc ebx
cmp ebx, dword [edi + 0x10]
jb 0x486b70
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4872e0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push esi
sub esp, 0xc
mov dword [esp], 0
mov dword [esp + 4], 0
sub esp, 0x14
movaps xmm0, xmmword [0xa2cc30]
movups xmmword [esp + 4], xmm0
lea eax, [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, 2
test eax, eax
je 0x4873ae
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x8002
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4873b5
mov esi, dword [esp + 0x18]
push dword [esp + 0x1c]
call fcn.00424d90
add esp, 4
push 0
push eax
push esi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov dword [esp + 8], 0
lea esi, [esp + 8]
push 0
push esi
push 0
push 2
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp + 8], 0x10
jne 0x48738d
push 0
push esi
push dword [esp + 0x1c]
push 2
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 4]
test eax, eax
je 0x48739c
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp]
test eax, eax
je 0x4873ac
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor esi, esi
mov eax, esi
add esp, 0xc
pop esi
ret
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
add esp, 0xc
pop esi
ret
Function at 0x498c20
Capabilities:
Parse credit card information

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 8]
mov ecx, eax
and ecx, 3
jmp dword [ecx*4 + 0xa35e80]
Function at 0x4b2d90
Capabilities:
Get hostname

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp], 0
test byte [ecx + 0x44], 1
jne 0x4b2dd5
mov dword [esi], 0x100
cmp dword [esi + 0x38], 0
jne 0x4b2ddb
mov dword [esi + 0x38], 0x4d0
cmp dword [esi + 4], 0
jne 0x4b2de1
mov dword [esi + 4], 0x7d0
cmp dword [esi + 8], 0
jne 0x4b2de7
mov dword [esi + 8], 3
jmp 0x4b2de7
cmp dword [esi + 0x38], 0
je 0x4b2db2
cmp dword [esi + 4], 0
je 0x4b2dbf
cmp dword [esi + 8], 0
je 0x4b2dcc
push dword [esi + 0x84]
call fcn.004bd7e0
add esp, 4
test eax, eax
je 0x4b2e45
xor ebx, ebx
cmp dword [esi + 0x28], 0
je 0x4b2eb4
cmp dword [esi + 0x30], 0
je 0x4b2f19
xor eax, eax
cmp dword [esi + 0x34], 0
je 0x4b2f2c
test byte [esi + 0x46], 0x80
jne 0x4b2f52
mov word [esi + 0xd0], 0xa
mov dword [esi + 0xd4], 0x1388
test ebx, ebx
jne 0x4b2f56
jmp 0x4b2f66
mov eax, 0x1a
test byte [esi + 1], 2
jne 0x4b2f66
mov dword [esp + 4], 2
push 0x7f000001
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov ecx, esp
push 0
push 0
push 0
push eax
push ecx
call fcn.004b99d0
add esp, 0x14
test eax, eax
jne 0x4b2f66
push 0
push dword [esp + 4]
push esi
call fcn.004ba020
add esp, 0xc
mov edi, eax
push dword [esp]
call fcn.004bd030
add esp, 4
test edi, edi
je 0x4b2df9
mov eax, edi
jmp 0x4b2f66
mov eax, dword [0xb5ad4c]
push 0x40
call dword [eax]
add esp, 4
test eax, eax
je 0x4b2f6e
mov edi, 0x40
mov ebp, 0x40
nop word cs:[eax + eax]
mov ebx, eax
push edi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x4b2f75
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x271e
jne 0x4b2f79
add ebp, ebp
add edi, edi
push ebp
push ebx
mov eax, dword [0xb5ad50]
call dword [eax]
add esp, 8
test eax, eax
jne 0x4b2ee0
jmp 0x4b2fce
mov dword [esi + 0x2c], 0
xor eax, eax
cmp dword [esi + 0x34], 0
jne 0x4b2e1b
push 0xa3eee4
call fcn.004c5ce0
add esp, 4
mov dword [esi + 0x34], eax
xor ecx, ecx
test eax, eax
mov eax, 0xf
cmovne eax, ecx
test byte [esi + 0x46], 0x80
je 0x4b2e25
test ebx, ebx
je 0x4b2f66
mov ecx, dword [0xb5ad44]
push ebx
mov esi, eax
call dword [ecx]
mov eax, esi
add esp, 4
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0xf
jmp 0x4b2f66
test eax, eax
je 0x4b2f7c
mov byte [ebx], 0
push 0x2e
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
test eax, eax
je 0x4b2e05
mov edi, eax
push 4
mov eax, dword [0xb5ad4c]
call dword [eax]
add esp, 4
mov ecx, eax
mov dword [esi + 0x24], eax
mov eax, 0xf
test ecx, ecx
je 0x4b2f56
inc edi
push edi
call fcn.004c5ce0
add esp, 4
mov ecx, dword [esi + 0x24]
mov dword [ecx], eax
mov eax, dword [esi + 0x24]
cmp dword [eax], 0
je 0x4b2fce
mov dword [esi + 0x28], 1
jmp 0x4b2e05
mov eax, 0xf
jmp 0x4b2f56
Function at 0x4b4330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
mov edi, dword [ebx + 0x28]
push dword [edi + 0x84]
call fcn.004bd7e0
add esp, 4
mov esi, eax
mov dword [esp + 4], edi
imul esi, dword [edi + 8]
push dword [ebx + 0x2c]
call fcn.004bd840
add esp, 4
push dword [ebx + 0x30]
call fcn.004bcf00
add esp, 4
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x38], 0
test ebp, ebp
je 0x4b439b
mov dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x48]
cmp dword [esp + 8], 0
je 0x4b43a9
inc eax
mov dword [ebx + 0x48], eax
cmp eax, esi
jae 0x4b43b7
cmp dword [ebx + 0x5c], 0
je 0x4b4477
mov esi, dword [ebx + 0x54]
test esi, esi
jne 0x4b43ca
mov dword [ebx + 0x54], 0xc
mov esi, 0xc
mov edi, dword [esp]
push edi
push esi
push 0
push ebx
call fcn.004ca760
add esp, 0x10
push edi
push dword [ebx + 0x58]
push esi
push dword [ebx + 0x44]
call dword [ebx + 0x40]
add esp, 0x10
push dword [ebx + 0x2c]
call fcn.004bd840
add esp, 4
push dword [ebx + 0x30]
call fcn.004bcf00
add esp, 4
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x38], 0
mov eax, dword [ebx + 0x28]
movzx ecx, word [ebx]
push ecx
push dword [eax + 0x90]
call fcn.004bcb30
add esp, 8
push dword [ebx + 0x34]
call fcn.004bcf00
add esp, 4
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
push dword [ebx + 0x3c]
call fcn.004c1310
add esp, 4
mov eax, dword [0xb5ad44]
push ebx
call dword [eax]
add esp, 4
push dword [esp + 4]
call fcn.004c6cc0
add esp, 4
mov eax, 0xc
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004b4490
Function at 0x4b6790
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14c
mov ebp, dword [esp + 0x168]
mov esi, dword [esp + 0x164]
mov ecx, dword [esp + 0x160]
mov dword [esp + 8], 0
test ecx, ecx
sete al
test esi, esi
sete dl
or dl, al
test ebp, ebp
sete al
or al, dl
mov eax, 2
jne 0x4b687f
mov dword [ebp], 0
mov eax, 4
test byte [ecx], 0x40
jne 0x4b687f
push 0x2e
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
mov ecx, eax
mov eax, 4
test ecx, ecx
jne 0x4b687f
push str.HOSTALIASES
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
xor ebx, ebx
test eax, eax
je 0x4b6857
mov edi, eax
mov dword [esp], 4
call fcn.004c40e0
test eax, eax
je 0x4b6860
push eax
push edi
mov ebx, eax
call fcn.004c5bf0
add esp, 8
test eax, eax
jne 0x4b6852
lea eax, [esp + 8]
push eax
push 0
push 0x30
push 1
push 0xa3efc8
push ebx
call fcn.004c4e00
add esp, 0x18
test eax, eax
je 0x4b688a
mov dword [esp], eax
jmp 0x4b6867
mov dword [esp], 4
jmp 0x4b6867
mov dword [esp], 0xf
push ebx
call fcn.004c4140
add esp, 4
push dword [esp + 8]
call fcn.004bd030
add esp, 4
mov eax, dword [esp]
add esp, 0x14c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], ebx
push dword [esp + 8]
call fcn.004bcda0
add esp, 4
test eax, eax
je 0x4b6a11
mov edi, eax
jmp 0x4b68b9
push edi
call fcn.004bce10
add esp, 4
mov edi, eax
test eax, eax
je 0x4b6a11
push edi
call fcn.004bce30
add esp, 4
mov ebx, eax
xorps xmm0, xmm0
movups xmmword [esp + 0x3c], xmm0
movups xmmword [esp + 0x2c], xmm0
movups xmmword [esp + 0x1c], xmm0
movups xmmword [esp + 0xc], xmm0
movups xmmword [esp + 0x13c], xmm0
movups xmmword [esp + 0x12c], xmm0
movups xmmword [esp + 0x11c], xmm0
movups xmmword [esp + 0x10c], xmm0
movups xmmword [esp + 0xfc], xmm0
movups xmmword [esp + 0xec], xmm0
movups xmmword [esp + 0xdc], xmm0
movups xmmword [esp + 0xcc], xmm0
movups xmmword [esp + 0xbc], xmm0
movups xmmword [esp + 0xac], xmm0
movups xmmword [esp + 0x9c], xmm0
movups xmmword [esp + 0x8c], xmm0
movups xmmword [esp + 0x7c], xmm0
movups xmmword [esp + 0x6c], xmm0
movups xmmword [esp + 0x5c], xmm0
movups xmmword [esp + 0x4c], xmm0
push eax
call fcn.004c4640
add esp, 4
push ebx
call fcn.004c4c20
add esp, 4
push 0x40
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.004c4760
add esp, 0xc
test eax, eax
jne 0x4b68a6
push esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4b68a6
push 1
push ebx
call fcn.004c4b80
add esp, 8
push ebx
call fcn.004c4640
add esp, 4
push ebx
call fcn.004c4c20
add esp, 4
push 0x100
lea eax, [esp + 0x50]
push eax
push ebx
call fcn.004c4760
add esp, 0xc
test eax, eax
jne 0x4b68a6
lea eax, [esp + 0x4c]
push eax
call fcn.004c5cd0
add esp, 4
test eax, eax
je 0x4b68a6
lea eax, [esp + 0x4c]
push eax
call fcn.004c5fb0
add esp, 4
test eax, eax
je 0x4b68a6
lea eax, [esp + 0x4c]
push eax
call fcn.004c5ce0
add esp, 4
mov dword [ebp], eax
xor ecx, ecx
test eax, eax
mov eax, 0xf
cmovne eax, ecx
mov dword [esp], eax
mov ebx, dword [esp + 4]
jmp 0x4b6867
Function at 0x4b7fa0
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x18]
push str.LOCALDOMAIN
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x4b805f
push eax
call fcn.004c5ce0
add esp, 4
mov esi, eax
mov eax, 0xf
test esi, esi
je 0x4b8092
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4b7ffc
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x4b7ffc
push ecx
push eax
call fcn.004c6060
add esp, 8
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
lea ebx, [edi + 0x10]
push ebx
push 0xa3f0cb
push esi
call fcn.004c6130
add esp, 0xc
mov dword [edi + 0xc], eax
test eax, eax
je 0x4b8082
cmp dword [ebx], 2
jb 0x4b8054
mov dword [esp], ebx
mov ebp, 1
mov ebx, dword [0xb5ad44]
nop dword [eax + eax]
mov eax, dword [edi + 0xc]
push dword [eax + ebp*4]
call dword [ebx]
add esp, 4
mov eax, dword [edi + 0xc]
mov dword [eax + ebp*4], 0
inc ebp
cmp ebp, dword [edi + 0x10]
jb 0x4b8030
mov eax, dword [esp]
mov dword [eax], 1
mov eax, dword [0xb5ad44]
push esi
call dword [eax]
add esp, 4
push str.RES_OPTIONS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x4b807e
push eax
push edi
call fcn.004b7cc0
add esp, 8
test eax, eax
jne 0x4b8092
xor eax, eax
jmp 0x4b8092
mov eax, dword [0xb5ad44]
push esi
call dword [eax]
add esp, 4
mov eax, 0xf
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4bb560
Capabilities:
Check if file exists

Disassembly:
push esi
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, 0x17
je 0x4bb58a
cmp eax, 2
jne 0x4bb5b8
push 4
call fcn.004bb230
add esp, 4
mov esi, eax
cmp eax, 0xffffffff
jne 0x4bb5ae
jmp 0x4bb59f
push 0x10
push edx
push ecx
push 0x17
call fcn.004bad40
add esp, 0x10
mov esi, eax
cmp eax, 0xffffffff
jne 0x4bb5ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 2
je 0x4bb5b6
sar esi, 0x1f
or esi, 1
mov eax, esi
pop esi
ret
push 0x273f
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xffffffff
pop esi
ret

Function at 0x4c5bf0
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov dword [esp], 0
test ecx, ecx
sete al
test ebx, ebx
sete dl
or dl, al
mov eax, 2
jne 0x4c5c67
push 0xa4044d
push ecx
call fcn.00786c50
add esp, 8
test eax, eax
je 0x4c5c4e
mov esi, eax
push 2
push 0
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
mov ebp, 0xe
test eax, eax
je 0x4c5c6f
push esi
call fcn.00786c28
add esp, 4
mov eax, ebp
jmp 0x4c5c67
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xfffffffe
cmp eax, 2
mov ecx, 4
mov eax, 0xe
cmove eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ftell
add esp, 4
test eax, eax
js 0x4c5c41
mov edi, eax
push 0
push 0
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
test eax, eax
jne 0x4c5c41
test edi, edi
je 0x4c5cbd
mov dword [esp], edi
mov eax, esp
push eax
push ebx
call fcn.004c4490
add esp, 8
test eax, eax
je 0x4c5cc1
push esi
push edi
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
mov dword [esp], eax
cmp eax, edi
jne 0x4c5c41
add dword [ebx + 4], edi
xor ebp, ebp
jmp 0x4c5c41
mov ebp, 0xf
jmp 0x4c5c41

Function at 0x4c6920
Capabilities:
Create thread

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
test ebx, ebx
sete al
test edi, edi
sete cl
or cl, al
mov eax, 2
jne 0x4c697a
push 0x14
call fcn.004b3420
add esp, 4
test eax, eax
je 0x4c697e
mov esi, eax
mov eax, dword [esp + 0x18]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov eax, esi
add eax, 4
push eax
push 0
push esi
push 0x4c69a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x4c6987
mov dword [edi], esi
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov eax, 0xf
pop esi
pop edi
pop ebx
ret
mov eax, dword [0xb5ad44]
push esi
call dword [eax]
add esp, 4
mov eax, 3
pop esi
pop edi
pop ebx
ret