joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d2790
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4d28d0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4d28e8
mov edx, dword [0x4f7524]
call fcn.00404f58
lea eax, [ebp - 4]
mov ecx, 0x4d28fc
mov edx, dword [0x4f7524]
call fcn.00404f58
push 0x4d290c
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4d289a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x4d2817
push 0x4d291c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f73c8], eax
push 0x4d292c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f73cc], eax
cmp dword [0x4f73c8], 0
jne 0x4d2890
mov eax, dword [ebp - 4]
call fcn.004050d0
push eax
call sub.kernel32.dll_DeleteFileA
push 0
mov eax, dword [ebp - 4]
call fcn.004050d0
mov ebx, eax
push ebx
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4d28fc
mov edx, dword [ebp - 8]
pop eax
call fcn.00404f58
mov eax, dword [ebp - 0x10]
call fcn.004050d0
push eax
call sub.kernel32.dll_CopyFileA
push ebx
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4d2890
push 0x4d291c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f73c8], eax
push 0x4d292c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f73cc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d28ad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d28d7
lea eax, [ebp - 0x10]
call fcn.00404c40
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404c64
ret

Function at 0x4d2a98
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, edx
mov ebx, eax
mov edx, esi
mov eax, ebx
call fcn.004d2a14
test eax, eax
jne 0x4d2b43
mov ebp, esi
mov eax, ebx
call fcn.004d29a4
mov ebx, eax
call fcn.004d293c
push ebx
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
mov eax, esi
call fcn.0040a254
mov edi, eax
inc edi
push 4
push 0x1000
push edi
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
push esp
push edi
push ebp
push esi
push ebx
call sub.kernel32.dll_WriteProcessMemory
push esp
push 0
push esi
push 0x4d2b4c
push 0x4d2b5c
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_CreateRemoteThread
mov edi, eax
test edi, edi
je 0x4d2b2f
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
push edi
call sub.kernel32.dll_CloseHandle
push 0x8000
push 0
push esi
push ebx
call sub.kernel32.dll_VirtualFreeEx
push ebx
call sub.kernel32.dll_CloseHandle
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d2b6c
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, edx
mov esi, eax
mov eax, esi
call fcn.004d29a4
mov ebx, eax
call fcn.004d293c
push ebx
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov ebx, eax
mov edx, edi
mov eax, esi
call fcn.004d2a14
mov esi, eax
test esi, esi
je 0x4d2bd4
push esp
push 0
push esi
push 0x4d2be0
push 0x4d2bec
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_CreateRemoteThread
mov esi, eax
push 0xffffffffffffffff
push esi
call sub.kernel32.dll_WaitForSingleObject
push esi
call sub.kernel32.dll_CloseHandle
push ebx
call sub.kernel32.dll_CloseHandle
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4d7fa8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2c
push 0
push 0
dec ecx
jne 0x4d7fb0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4d81ba
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004744bc
mov dword [ebp - 8], eax
mov dword [ebp - 0x130], 0x128
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 8]
call fcn.004744dc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d8195
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4d8174
mov eax, dword [0x4f757c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x4d80f8
inc esi
xor ebx, ebx
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404eb0
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.0040a108
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004091e8
mov eax, dword [ebp - 0x134]
push eax
lea ecx, [ebp - 0x144]
mov edx, ebx
mov eax, dword [0x4f757c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004091e8
mov edx, dword [ebp - 0x140]
pop eax
call fcn.00405068
je 0x4d8163
lea eax, [ebp - 0x14c]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404eb0
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.004091e8
mov eax, dword [ebp - 0x148]
push eax
lea ecx, [ebp - 0x154]
mov edx, ebx
mov eax, dword [0x4f757c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 0x150]
call fcn.004091e8
mov edx, dword [ebp - 0x150]
pop eax
call fcn.00405068
je 0x4d8163
inc ebx
dec esi
jne 0x4d801d
call fcn.004d7d44
test al, al
je 0x4d8163
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404eb0
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 0x15c]
call fcn.0040a108
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x158]
call fcn.00409270
mov eax, dword [ebp - 0x158]
mov edx, 0x4d81d0
call fcn.00405068
je 0x4d8163
push 0
mov eax, dword [ebp - 0x128]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 8]
call fcn.004744fc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d8005
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d819c
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
Function at 0x4d81e4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050c0
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4d835b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.004744bc
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.004744dc
mov ebx, eax
jmp 0x4d8327
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404eb0
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a108
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.004091e8
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.004091e8
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.00405068
je 0x4d82fe
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404eb0
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.004091e8
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.004091e8
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00405068
jne 0x4d831c
call fcn.004d7d44
test al, al
je 0x4d831c
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.004744fc
mov ebx, eax
test ebx, ebx
jne 0x4d825f
push esi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8362
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00404c64
lea eax, [ebp - 4]
call fcn.00404c40
ret
Function at 0x4d9d90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050c0
mov eax, dword [ebp - 8]
call fcn.004050c0
xor eax, eax
push ebp
push 0x4d9e73
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41b2f8]
call fcn.00403d10
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4d9e42
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4d9e31
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004050d0
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x4f73bc]
mov eax, dword [eax + 0x384]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0049a460
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.00420240
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9e38
mov eax, dword [ebp - 0x10]
call fcn.00403d40
ret
Function at 0x4e16c4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4e17c1
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
lea eax, [ebp - 4]
mov edx, 0x4e17d8
call fcn.00404cd8
xor ebx, ebx
mov ecx, ebx
mov eax, 1
shl eax, cl
test eax, esi
je 0x4e179c
lea eax, [ebp - 4]
call fcn.00405130
mov byte [eax], 0x41
lea eax, [ebp - 4]
call fcn.00405130
add byte [eax], bl
push 0x4e17e4
push dword [ebp - 4]
push 0x4e17f4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404fd4
mov eax, dword [ebp - 0xc]
call fcn.004050d0
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404e38
mov eax, dword [ebp - 8]
push eax
call fcn.004e1f48
test al, al
je 0x4e179c
mov eax, dword [0x4ef1c4]
cmp byte [eax], 0
jne 0x4e1767
mov eax, dword [0x4eef64]
cmp byte [eax], 0
je 0x4e179c
mov cl, 1
mov dl, 1
mov eax, dword [0x4e1170]
call fcn.00423dc8
mov edi, eax
push 0x4e17e4
push dword [ebp - 4]
push 0x4e17f4
lea eax, [edi + 0x40]
mov edx, 3
call fcn.00404fd4
mov byte [edi + 0xf], 1
mov eax, edi
call fcn.004242f4
inc ebx
cmp ebx, 0x1a
jne 0x4e16f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e17c8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c64
ret

Function at 0x4e1a88
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050c0
xor eax, eax
push ebp
push 0x4e1b58
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4e1af0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 3
push 0
push 3
push 0
mov eax, dword [ebp - 4]
call fcn.004050d0
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4e1ae6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e1b42
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e1b0e
push 0
lea eax, [ebp - 0xc]
push eax
push 0xc
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x2d1080
push ebx
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x4e1b3c
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
call fcn.004099a8
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1b5f
lea eax, [ebp - 4]
call fcn.00404c40
ret
Function at 0x4e1ce0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050c0
xor eax, eax
push ebp
push 0x4e1d82
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0
push 0
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004050d0
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4e1d6c
push 0
lea eax, [ebp - 0x14]
push eax
push 8
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x7405c
push ebx
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x4e1d66
push 0
push 0x400
push 0
push 0x400
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00405d60
call fcn.00405d60
mov esi, eax
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1d89
lea eax, [ebp - 4]
call fcn.00404c40
ret
Function at 0x4e1d94
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050c0
xor eax, eax
push ebp
push 0x4e1f35
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.004050d0
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4e1f1f
mov eax, 0xc
call fcn.00402f4c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4e1f0f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, 0xc
call fcn.00403660
push 0
lea eax, [ebp - 0xc]
push eax
push 0xc
mov eax, dword [ebp - 0x10]
push eax
push 0xc
mov eax, dword [ebp - 0x10]
push eax
push 0x2d1400
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x4e1ef9
mov eax, dword [ebp - 0x10]
call fcn.00402f68
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00402f4c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00403660
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0xc
mov eax, dword [ebp - 0x10]
push eax
push 0x2d1400
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x4e1ef9
mov ebx, dword [ebp - 0x10]
cmp dword [ebx + 0xc], 0
jle 0x4e1ea0
mov eax, esi
mov edx, dword [ebx + 0xc]
add edx, dword [ebp - 0x10]
call fcn.00404e38
jmp 0x4e1eaf
mov eax, esi
mov edx, dword [0x4ef544]
mov edx, dword [edx]
call fcn.00404c94
mov esi, dword [ebx + 0x10]
test esi, esi
jle 0x4e1ec4
mov eax, edi
mov edx, esi
add edx, dword [ebp - 0x10]
call fcn.00404e38
jmp 0x4e1ed3
mov eax, edi
mov edx, dword [0x4ef544]
mov edx, dword [edx]
call fcn.00404c94
mov esi, dword [ebx + 0x14]
test esi, esi
jle 0x4e1ee9
mov eax, dword [ebp + 8]
mov edx, esi
add edx, dword [ebp - 0x10]
call fcn.00404e38
jmp 0x4e1ef9
mov eax, dword [ebp + 8]
mov edx, dword [0x4ef544]
mov edx, dword [edx]
call fcn.00404c94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1f16
mov eax, dword [ebp - 0x10]
call fcn.00402f68
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e1f3c
lea eax, [ebp - 4]
call fcn.00404c40
ret
Function at 0x4e1f48
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, dword [ebp + 8]
call fcn.004050c0
xor eax, eax
push ebp
push 0x4e207b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp + 8]
call fcn.004050d0
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4e2065
mov eax, 0xc
call fcn.00402f4c
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4e2055
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, 0xc
call fcn.00403660
push 0
lea eax, [ebp - 0xc]
push eax
push 0xc
mov eax, dword [ebp - 0x10]
push eax
push 0xc
mov eax, dword [ebp - 0x10]
push eax
push 0x2d1400
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x4e203f
mov eax, dword [ebp - 0x10]
call fcn.00402f68
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00402f4c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00403660
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0xc
mov eax, dword [ebp - 0x10]
push eax
push 0x2d1400
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
je 0x4e203f
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x1c], 7
jne 0x4e203f
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e205c
mov eax, dword [ebp - 0x10]
call fcn.00402f68
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2082
lea eax, [ebp + 8]
call fcn.00404c40
ret

Function at 0x4e25c8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e26aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edx
shl eax, 9
mov edx, eax
xor ecx, ecx
mov eax, ebx
call fcn.00409d9c
push 0
lea eax, [ebp - 0xc]
push eax
push 0x200
lea eax, [ebp - 0x20c]
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x4e2687
xor eax, eax
push ebp
push 0x4e2673
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x200
lea ebx, [ebp - 0x20c]
lea eax, [ebp - 4]
push eax
movzx eax, byte [ebx]
mov dword [ebp - 0x214], eax
mov byte [ebp - 0x210], 0
lea edx, [ebp - 0x214]
xor ecx, ecx
mov eax, 0x4e26c0
call fcn.0040ad20
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404f0c
mov eax, dword [ebp - 8]
inc ebx
dec esi
jne 0x4e2631
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e2694
mov eax, dword [ebp - 8]
mov edx, 0x4e26d0
call fcn.00404c94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e26b1
lea eax, [ebp - 4]
call fcn.00404c40
ret
Function at 0x4e35f4
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x4e360b
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 1], 0
xor eax, eax
push ebp
push 0x4e3647
push dword fs:[eax]
mov dword fs:[eax], esp
push edx
push ecx
push ebx
mov eax, 0x564d5868
mov ecx, 0xa
mov edx, 0x5658
in eax, dx
cmp ebx, 0x564d5868
sete byte [ebp - 1]
pop ebx
pop ecx
pop edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e366a
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4e3870
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe2c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1d4], eax
xor eax, eax
push ebp
push 0x4e390a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0x40
lea eax, [ebp - 0x40]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x40]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4e38f1
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4e38e5
push dword [edi]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x1d4]
call fcn.0040a494
mov edx, dword [ebp - 0x1d4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x4e38c2
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3911
lea eax, [ebp - 0x1d4]
call fcn.00404c40
ret

Function at 0x4e3a7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050c0
mov eax, dword [ebp - 8]
call fcn.004050c0
xor eax, eax
push ebp
push 0x4e3b7b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4277c8]
call fcn.004278c8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4e3b59
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00427968
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.00427af0
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004050d0
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov edx, dword [ebp - 0x18]
dec edx
lea eax, [ebp - 0xc]
call fcn.00405360
cmp dword [ebp - 0x18], 1
jbe 0x4e3b39
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.00404c94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3b60
mov eax, dword [ebp - 0x10]
call fcn.00403d40
ret
Function at 0x4e40d0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004050c0
xor eax, eax
push ebp
push 0x4e421a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x4e41f2
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.0040a314
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4e41db
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4e41d5
mov ebx, dword [edx]
test ebx, ebx
je 0x4e41cf
lea eax, [ebp - 0x29c]
push eax
movzx eax, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
movzx eax, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
movzx eax, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
movzx eax, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x4e4234
call fcn.0040ad20
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.00404c94
mov byte [ebp - 5], 1
jmp 0x4e41df
mov byte [ebp - 5], 0
jmp 0x4e41df
mov byte [ebp - 5], 0
jmp 0x4e41df
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e41f9
call sub.wsock32.dll_WSACleanup
ret

Function at 0x4e49e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x15]
push eax
call sub.kernel32.dll_GetComputerNameA
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x15]
call fcn.0040a494
mov esp, ebp
pop ebp
ret 4