joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477cf0
Capabilities:
Check for time delay via gettickcount
Create http request
Read data from internet
Receive data

Disassembly:
sub esp, 0xc
push 0
push 0
push 0
push 1
push str.GAME_CLIENT
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esp + 8], eax
test eax, eax
jne 0x477d33
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetOpen_Error__d_n
push 0x100
push 0x50e7c0
call fcn.00405970
add esp, 0x10
or eax, 0xffffffff
add esp, 0xc
ret
mov ecx, dword [esp + 0x10]
push edi
push 1
push Ordinal_1
push 0
push 0
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
jne 0x477d77
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetOpenUrl_Error__d_n
push 0x100
push 0x50e7c0
call fcn.00405970
add esp, 0x10
or eax, 0xffffffff
pop edi
add esp, 0xc
ret
push ebx
push ebp
push esi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], eax
xor ebp, ebp
lea esp, [esp]
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x10]
push edx
push eax
push esi
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [esp + 0x10]
add ebx, ecx
test ecx, ecx
jne 0x477db9
cmp eax, 1
je 0x477ddd
add esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x14]
cmp eax, 0x2710
ja 0x477df7
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
cmp ebp, 0x64
jl 0x477d90
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ecx
call esi
push edi
call esi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop edi
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.InternetReadFile_Error__d_n
push 0x100
push 0x50e7c0
call fcn.00405970
add esp, 0x10
pop esi
pop ebp
pop ebx
or eax, 0xffffffff
pop edi
add esp, 0xc
ret

Function at 0x47a4e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4dcb13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esi + 0x10], esi
mov dword [esi + 0x14], esi
mov eax, dword [esi + 0x10]
xor ecx, ecx
push edi
mov dword [esp + 0xc], esi
mov byte [eax], cl
lea eax, [esi + 0x18]
mov dword [eax + 0x10], eax
mov dword [eax + 0x14], eax
mov eax, dword [eax + 0x10]
mov dword [esp + 0x18], ecx
mov byte [eax], cl
mov edi, dword [esp + 0x20]
mov eax, edi
mov byte [esp + 0x18], 1
mov dword [esi + 0x38], ecx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x30], ecx
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, cl
jne 0x47a538
sub eax, ebx
add eax, edi
push eax
push edi
mov ecx, esi
call fcn.00478110
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x47b4d0
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 0xc]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 8]
ret 8
Function at 0x47b500
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx + 0xc]
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
ret 8

Function at 0x47b5a0
Capabilities:
Get file size

Disassembly:
mov eax, dword [ecx + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
ret

Function at 0x47b5c0
Capabilities:
Read file via mapping

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 4], 0xffffffff
je 0x47b5cf
xor eax, eax
pop esi
ret 4
test byte [esp + 8], 2
push ebx
push edi
je 0x47b5e4
mov edi, 4
mov ebx, 0xf001f
jmp 0x47b5ec
mov edi, 2
lea ebx, [edi + 2]
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
push 0
call edx
push eax
mov eax, dword [esi + 0xc]
push 0
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x47b624
push 0
push 0
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
pop edi
pop ebx
mov dword [esi + 8], eax
pop esi
ret 4
pop edi
pop ebx
xor eax, eax
pop esi
ret 4

Function at 0x47ee70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4dce08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov edi, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
mov ebp, dword [esi]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0xc]
push 0
mov dword [esp + 0x24], eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 8], edi
mov dword [eax + 0xc], ebx
sub esp, 0x10
mov eax, esp
mov dword [eax], ebp
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [eax + 8], edx
mov dword [esp + 0x50], 0
mov dword [eax + 0xc], ecx
call fcn.0047eb40
add esp, 0x24
cmp dword [esi + 0x20], 0
mov dword [esp + 0x2c], 0xffffffff
je 0x47ef4f
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 0xc]
add edx, 4
push edx
push eax
mov ecx, esi
call fcn.0047e110
mov eax, dword [esi + 0x20]
test eax, eax
je 0x47ef4f
mov esi, dword [esi + 0x24]
add esi, esi
add esi, esi
cmp esi, 0x80
jbe 0x47ef45
push eax
call fcn.00485fb1
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
push esi
push eax
call fcn.004803c0
add esp, 8
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret

Function at 0x48aa5a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x507f24]
jne 0x48aa64
repz ret
jmp fcn.004a042b
Function at 0x4a5d9f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0048b3c6
and dword [ebp - 4], 0
cmp dword [0x50f99c], 0
mov ebx, eax
jne 0x4a5e50
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4a5f01
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4e70ac
push edi
call esi
test eax, eax
je 0x4a5f01
push eax
call fcn.0048b354
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x50f99c], eax
call esi
push eax
call fcn.0048b354
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x50f9a0], eax
call esi
push eax
call fcn.0048b354
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x50f9a4], eax
call esi
push eax
call fcn.0048b354
pop ecx
mov dword [0x50f9ac], eax
test eax, eax
je 0x4a5e50
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0048b354
pop ecx
mov dword [0x50f9a8], eax
mov eax, dword [0x50f9a8]
cmp eax, ebx
je 0x4a5ea8
cmp dword [0x50f9ac], ebx
je 0x4a5ea8
push eax
call fcn.0048b3cf
push dword [0x50f9ac]
mov esi, eax
call fcn.0048b3cf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4a5ea8
test edi, edi
je 0x4a5ea8
call esi
test eax, eax
je 0x4a5e9f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4a5e9f
test byte [ebp - 0xc], 1
jne 0x4a5ea8
or dword [ebp + 0x10], 0x200000
jmp 0x4a5ee1
mov eax, dword [0x50f9a0]
cmp eax, ebx
je 0x4a5ee1
push eax
call fcn.0048b3cf
pop ecx
test eax, eax
je 0x4a5ee1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4a5ee1
mov eax, dword [0x50f9a4]
cmp eax, ebx
je 0x4a5ee1
push eax
call fcn.0048b3cf
pop ecx
test eax, eax
je 0x4a5ee1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x50f99c]
call fcn.0048b3cf
pop ecx
test eax, eax
je 0x4a5f01
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4a5f03
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b42c7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8270
push 0x489ac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x2014
call fcn.00486a70
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x2020], 0
mov dword [ebp - 0x201c], 0
mov byte [ebp - 0x2018], 0
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x2017]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x1018], 0
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1017]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x4b436b
cmp dword [ebp + 0xc], 0
je 0x4b436b
cmp dword [ebp + 0x10], 0
je 0x4b436b
cmp dword [ebp + 0x10], 0x1000
ja 0x4b436b
cmp dword [ebp + 0x14], 0
je 0x4b436b
cmp dword [ebp + 0x18], 0
jne 0x4b4387
mov dword [ebp - 0x2024], 0x1b020
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2024]
jmp 0x4b4469
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
lea edx, [ebp - 0x2018]
push edx
call fcn.0048a3ab
add esp, 0x10
mov dword [ebp - 0x201c], eax
cmp dword [ebp - 0x201c], 0
jne 0x4b43cb
mov dword [ebp - 0x2028], 0x1b021
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2028]
jmp 0x4b4469
lea eax, [ebp - 0x1018]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 0x201c]
push edx
lea eax, [ebp - 0x2018]
push eax
call fcn.004b3c7d
mov dword [ebp - 0x2020], eax
cmp dword [ebp - 0x2020], 0
je 0x4b4411
mov dword [ebp - 0x202c], 0x1b022
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x202c]
jmp 0x4b4469
mov ecx, dword [ebp - 0x201c]
push ecx
lea edx, [ebp - 0x1018]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00485c00
add esp, 0xc
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x201c]
mov dword [ecx], edx
mov dword [ebp - 0x2020], 0
mov dword [ebp - 4], 0xffffffff
jmp 0x4b4463
mov eax, dword [ebp - 0x2020]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4bb098
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
cmp dword [ebp + 8], 0
jne 0x4bb0bb
push 0
push 0xe2014001
call fcn.004be3c0
add esp, 8
xor eax, eax
jmp 0x4bb193
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
cmp dword [eax], 0x4550
je 0x4bb0ee
push 0
push 0xe2014002
call fcn.004be3c0
add esp, 8
xor eax, eax
jmp 0x4bb193
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 0x78]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
je 0x4bb191
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
add edx, dword [ecx + 0x24]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
jmp 0x4bb146
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x18]
jae 0x4bb191
mov edx, dword [ebp + 0xc]
and edx, 0xffff
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
xor esi, esi
mov si, word [ecx + eax*2]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x10]
add ecx, esi
cmp edx, ecx
jne 0x4bb18f
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cx, word [eax + edx*2]
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x1c]
jmp 0x4bb193
jmp 0x4bb13d
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4bc63b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed3e8
push 0x489ac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffcbc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x134], 0
mov byte [ebp - 0x340], 0
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x33f]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x130], 0
mov byte [ebp - 0x11c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0x314]
push eax
push 0x104
lea ecx, [ebp - 0x340]
push ecx
call fcn.0041a130
push 0x5c
lea edx, [ebp - 0x340]
push edx
call fcn.00488580
add esp, 8
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jne 0x4bc6ee
mov dword [ebp - 0x134], 2
jmp 0x4bc871
mov eax, dword [ebp - 0x130]
mov byte [eax], 0
lea ecx, [ebp - 0x340]
push ecx
call fcn.004be885
add esp, 4
push 0x30c
lea edx, [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
jne 0x4bc738
push 0
push 0xe2015001
call fcn.004be3c0
add esp, 8
mov dword [ebp - 0x134], 0x101
jmp 0x4bc871
mov eax, dword [ebp + 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x50f9d8], eax
cmp dword [0x50f9d8], 0
jne 0x4bc782
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x354], eax
mov ecx, dword [ebp - 0x354]
push ecx
push 0xe2015002
call fcn.004be3c0
add esp, 8
mov dword [ebp - 0x134], 0x101
jmp 0x4bc871
mov dword [ebp - 4], 0
cmp dword [0x50f9d8], 0
je 0x4bc84e
cmp dword [0x50f9e8], 0
jne 0x4bc7e3
push 0xa
mov edx, dword [0x50f9d8]
push edx
call fcn.004bb098
add esp, 8
mov dword [0x50f9e8], eax
cmp dword [0x50f9e8], 0
jne 0x4bc7e3
push 0
push 0xe2015004
call fcn.004be3c0
add esp, 8
mov dword [ebp - 0x134], 0x101
mov dword [ebp - 4], 0xffffffff
jmp 0x4bc871
lea eax, [ebp + 8]
mov dword [ebp - 0x350], eax
lea ecx, [ebp + 0x10c]
mov dword [ebp - 0x34c], ecx
lea edx, [ebp + 0x210]
mov dword [ebp - 0x348], edx
lea eax, [ebp - 0x340]
mov dword [ebp - 0x344], eax
lea ecx, [ebp - 0x134]
push ecx
lea edx, [ebp - 0x350]
push edx
push 0x11
call dword [0x50f9e8]
and eax, 0xff
cmp eax, 1
je 0x4bc84e
mov eax, dword [ebp - 0x134]
push eax
push 0xe2015003
call fcn.004be3c0
add esp, 8
mov dword [ebp - 0x134], 1
mov dword [ebp - 4], 0xffffffff
jmp 0x4bc871
mov byte [ebp - 0x12c], 0x5b
mov byte [ebp - 0x12b], 0x41
mov byte [ebp - 0x12a], 0x48
mov byte [ebp - 0x129], 0x4e
mov byte [ebp - 0x128], 0x48
mov byte [ebp - 0x127], 0x53
mov byte [ebp - 0x126], 0x4d
mov byte [ebp - 0x125], 0x4f
mov byte [ebp - 0x124], 0x4e
mov byte [ebp - 0x123], 0x5d
mov byte [ebp - 0x122], 0x20
mov byte [ebp - 0x121], 0x28
mov byte [ebp - 0x120], 0x25
mov byte [ebp - 0x11f], 0x64
mov byte [ebp - 0x11e], 0x29
mov byte [ebp - 0x11d], 0
mov ecx, dword [ebp - 0x134]
push ecx
lea edx, [ebp - 0x12c]
push edx
push 0x104
lea eax, [ebp - 0x11c]
push eax
call fcn.004be590
add esp, 0x10
lea ecx, [ebp - 0x11c]
push ecx
call fcn.004be95f
add esp, 4
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x310
Function at 0x4bce5e
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed438
push 0x489ac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x4bcecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0x4bcf79
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x2c]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
jmp 0x4bcf11
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
cmp eax, 1
je 0x4bcf36
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0x4bcf79
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0x509228
mov ecx, dword [ebp - 0x20]
push ecx
call sub.VERSION.dll_VerQueryValueA
cmp eax, 1
je 0x4bcf5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0x4bcf79
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0xc]
mov dword [edx], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
call fcn.004bcf87
jmp 0x4bcfa1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4be3c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x138], 0x5b
mov byte [ebp - 0x137], 0x43
mov byte [ebp - 0x136], 0x36
mov byte [ebp - 0x135], 0x39
mov byte [ebp - 0x134], 0x44
mov byte [ebp - 0x133], 0x39
mov byte [ebp - 0x132], 0x36
mov byte [ebp - 0x131], 0x38
mov byte [ebp - 0x130], 0x31
mov byte [ebp - 0x12f], 0x5f
mov byte [ebp - 0x12e], 0x39
mov byte [ebp - 0x12d], 0x34
mov byte [ebp - 0x12c], 0x44
mov byte [ebp - 0x12b], 0x46
mov byte [ebp - 0x12a], 0x5f
mov byte [ebp - 0x129], 0x34
mov byte [ebp - 0x128], 0x32
mov byte [ebp - 0x127], 0x39
mov byte [ebp - 0x126], 0x39
mov byte [ebp - 0x125], 0x5f
mov byte [ebp - 0x124], 0x42
mov byte [ebp - 0x123], 0x37
mov byte [ebp - 0x122], 0x45
mov byte [ebp - 0x121], 0x44
mov byte [ebp - 0x120], 0x5f
mov byte [ebp - 0x11f], 0x42
mov byte [ebp - 0x11e], 0x30
mov byte [ebp - 0x11d], 0x38
mov byte [ebp - 0x11c], 0x37
mov byte [ebp - 0x11b], 0x35
mov byte [ebp - 0x11a], 0x33
mov byte [ebp - 0x119], 0x34
mov byte [ebp - 0x118], 0x30
mov byte [ebp - 0x117], 0x37
mov byte [ebp - 0x116], 0x38
mov byte [ebp - 0x115], 0x36
mov byte [ebp - 0x114], 0x30
mov byte [ebp - 0x113], 0x5d
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x30
mov byte [ebp - 0x110], 0x78
mov byte [ebp - 0x10f], 0x25
mov byte [ebp - 0x10e], 0x78
mov byte [ebp - 0x10d], 0x20
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0x20
mov byte [ebp - 0x10a], 0x30
mov byte [ebp - 0x109], 0x78
mov byte [ebp - 0x108], 0x25
mov byte [ebp - 0x107], 0x64
mov byte [ebp - 0x106], 0x20
mov byte [ebp - 0x105], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x138]
push edx
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.004be590
add esp, 0x14
lea ecx, [ebp - 0x104]
push ecx
call fcn.004be95f
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4be6f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed490
push 0x489ac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4be740
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x4be769
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4be77d
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ed4a0
push 0x489ac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 4], 0
push 0
push 0x80
push 3
push 0
push 1
push Ordinal_1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x4be7e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0x4be831
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x4be808
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0x4be831
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], 0xffffffff
cmp dword [ebp - 0x24], 0x1f4000
jbe 0x4be831
mov eax, dword [ebp + 8]
push eax
call fcn.004be6f0
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x4be85a
cmp dword [ebp - 0x20], 0xffffffff
je 0x4be871
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bef7f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push edi
mov dword [ebp - 4], 0
mov byte [ebp - 0x108], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x20c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x314], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x210], 0
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x4bf007
mov dword [ebp - 4], 0x30000304
jmp 0x4bf178
push 1
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x108]
push edx
push str.l_Kc_Ia_h8__..
call fcn.004cc2c9
cmp eax, 1
je 0x4bf032
mov dword [ebp - 4], 0x30000305
jmp 0x4bf176
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 0x509258
push 0x104
lea edx, [ebp - 0x314]
push edx
call fcn.004c5960
add esp, 0x14
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x510690], eax
cmp dword [0x510690], 0
jne 0x4bf080
mov dword [ebp - 4], 0x30000301
jmp 0x4bf174
push 1
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x108]
push edx
push str.l_K_Lblu1_..
call fcn.004cc2c9
cmp eax, 1
je 0x4bf0ab
mov dword [ebp - 4], 0x30000305
jmp 0x4bf172
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [0x510690]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x510680], eax
cmp dword [0x510680], 0
jne 0x4bf0d9
mov dword [ebp - 4], 0x30000302
jmp 0x4bf170
push 1
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x108]
push eax
push str.l_K__DL_lK_o_1:.
call fcn.004cc2c9
cmp eax, 1
je 0x4bf101
mov dword [ebp - 4], 0x30000305
jmp 0x4bf16e
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [0x510690]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x510688], eax
cmp dword [0x510688], 0
jne 0x4bf12c
mov dword [ebp - 4], 0x30000302
jmp 0x4bf16c
push 0
push 0x4bf17f
mov eax, dword [0x510680]
push eax
call fcn.004cb5b6
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4bf149
jmp 0x4bf16a
cmp dword [ebp - 4], 0
je 0x4bf165
cmp dword [0x510690], 0
je 0x4bf165
mov ecx, dword [0x510690]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 4]
jmp 0x4bf17a
jmp 0x4bf149
jmp 0x4bf149
jmp 0x4bf149
jmp 0x4bf149
jmp 0x4bf149
jmp 0x4bf149
jmp 0x4bf149
jmp 0x4bf149
pop edi
mov esp, ebp
pop ebp
ret