joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465840
Capabilities:
Get common file path

Disassembly:
sub esp, 0x22c
mov eax, dword [0x519674]
test eax, eax
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x465310
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x465600
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.004652c0
jne 0x465992
push 0x104
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x465988
xor eax, eax
nop
mov cl, byte [esp + eax + 0x124]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x4658a0
push edi
lea edi, [esp + 0x1c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4658b6
mov edx, dword [str.ws2_32]
mov eax, dword [0x4ee19c]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
lea ecx, [esp + 0x28]
mov dword [edi], edx
push ecx
mov dword [edi + 4], eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4658fd
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x46594f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
nop
mov cl, byte [esp + eax + 0x134]
mov byte [esp + eax + 0x28], cl
inc eax
test cl, cl
jne 0x465900
lea edi, [esp + 0x28]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x465915
mov edx, dword [str.wship6]
mov eax, dword [0x4ee194]
lea ecx, [esp + 0x28]
mov dword [edi], edx
push ecx
mov dword [edi + 4], eax
call ebp
mov esi, eax
test esi, esi
je 0x465984
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x46594f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x465984
xor edi, edi
mov edx, dword [esp + edi*8 + 0x10]
push edx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x465946
inc edi
cmp edi, 3
jl 0x465951
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov dword [0x50b0f4], eax
mov dword [0x50b0fc], ecx
mov dword [fcn.004652c0], edx
pop esi
pop ebp
pop ebx
pop edi
mov dword [0x519674], 1
movzx eax, word [esp + 0x230]
mov eax, dword [eax*8 + 0x50b0f4]
add esp, 0x22c
ret 4
Function at 0x46c130
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push str.Connected_for_receive
push 0x4edca0
push ecx
call fcn.004622f0
add esp, 0xc
mov eax, esi
mov dword [esi], 1
call fcn.0046b2c0
test eax, eax
jne 0x46c160
mov eax, esi
jmp fcn.0046b6f0
ret
Function at 0x46c520
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x84
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x98]
mov ebx, dword [edi + 0x3d0]
mov ebp, dword [edi]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
mov edx, dword [ebx + 0x144]
mov eax, dword [ebx + 0x14c]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [ebx + 0x14]
push 0
add edx, 4
push edx
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recvfrom]
mov dword [ebx + 0x13c], eax
mov eax, dword [ebx + 0x138]
test eax, eax
jne 0x46c5a5
mov ecx, dword [esp + 0x10]
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x14]
lea edi, [ebx + 0xb8]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x98]
mov dword [ebx + 0x138], eax
mov esi, dword [ebx + 0x13c]
cmp esi, 4
jge 0x46c5d2
push str.Received_too_short_packet
push ebp
call fcn.004623b0
add esp, 8
mov dword [ebx + 0xc], 7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x84
ret
mov ecx, dword [ebx + 0x14c]
xor edx, edx
mov dh, byte [ecx]
movzx ecx, byte [ecx + 1]
movzx eax, dx
or eax, ecx
mov dword [ebx + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x46c5f4
jmp dword [eax*4 + 0x46c714]
cmp esi, 4
jle case.0x46c5f4.4
mov eax, dword [ebx + 0x14c]
xor edx, edx
mov dh, byte [eax + 2]
mov dl, byte [eax + 3]
xor eax, eax
mov ax, word [ebx + 0x30]
inc eax
and eax, 0xffff
cmp eax, edx
jne case.0x46c5f4.4
mov ecx, dword [ebx + 0x14c]
add esi, 0xfffffffc
push esi
add ecx, 4
push ecx
push 1
push edi
call fcn.004627b0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x46c65e
mov eax, 5
mov ecx, ebx
call fcn.0046c4a0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret
mov eax, dword [ebx + 0x13c]
mov ecx, dword [ebp + 0x38]
sub eax, 4
cdq
add ecx, eax
mov eax, dword [ebp + 0x3c]
adc eax, edx
mov edx, eax
mov dword [ebp + 0x3c], eax
push edx
mov eax, ecx
push eax
push ebp
mov dword [ebp + 0x38], ecx
call fcn.00479ed0
jmp 0x46c6e4
mov eax, dword [ebx + 0x14c]
mov edx, dword [ebx + 0x14c]
xor ecx, ecx
mov ch, byte [eax + 2]
add edx, 4
push edx
push 0x4edca0
push ebp
mov cl, byte [eax + 3]
mov dword [ebx + 8], ecx
call fcn.004622f0
jmp 0x46c6e4
mov eax, dword [ebx + 0x14c]
add esi, 0xfffffffe
push esi
add eax, 2
push eax
push ebx
call fcn.0046b480
add esp, 0xc
test eax, eax
je case.0x46c5f4.4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret
push str.Internal_error:_Unexpected_packet
push 0x4edb14
push ebp
call fcn.004623b0
add esp, 0xc
push edi
call fcn.00479f90
add esp, 4
test eax, eax
je 0x46c5c5
mov eax, 5
mov ecx, ebx
call fcn.0046c4a0
pop edi
pop esi
pop ebp
mov eax, 0x2a
pop ebx
add esp, 0x84
ret
Function at 0x46e4a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov edx, dword [edi + 0x130]
mov al, byte [esp + 8]
push esi
mov esi, dword [edi]
push 0
push 3
lea ecx, [esp + 0xc]
push ecx
push edx
mov byte [esp + 0x14], 0xff
mov byte [esp + 0x15], al
mov byte [esp + 0x16], bl
call dword [sym.imp.WSOCK32.dll_send]
test eax, eax
jge 0x46e4e4
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.004623b0
add esp, 0xc
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
push str.SENT
mov eax, ebx
call fcn.0046e390
add esp, 4
pop esi
pop ecx
ret
Function at 0x46f170
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov eax, dword [eax]
push ebx
mov ebx, dword [eax + 0x8674]
mov dword [esp + 4], eax
cmp dword [esp + 0x10], 0x1f
jne 0x46f2d8
push ebp
push esi
push edi
lea edi, [ebx + 0x1cb0]
lea ebp, [ebx + 0x1eb0]
cmp edi, ebp
mov dword [ebp], edi
jae 0x46f1a9
mov byte [edi], 0xff
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x46f1b6
mov byte [eax], 0xfa
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x46f1c3
mov byte [eax], 0x1f
inc dword [ebp]
mov esi, dword [sym.imp.WSOCK32.dll_htons]
xor ecx, ecx
mov cx, word [ebx + 0x1ca8]
push ecx
call esi
xor edx, edx
mov dx, word [ebx + 0x1caa]
mov dword [esp + 0x1c], eax
push edx
call esi
mov ecx, dword [ebp]
cmp ecx, ebp
jae 0x46f1f5
mov dl, byte [esp + 0x1c]
mov byte [ecx], dl
inc dword [ebp]
mov ecx, dword [ebp]
cmp ecx, ebp
jae 0x46f205
mov dl, byte [esp + 0x1d]
mov byte [ecx], dl
inc dword [ebp]
mov ecx, dword [ebp]
cmp ecx, ebp
jae 0x46f211
mov byte [ecx], al
inc dword [ebp]
mov ecx, dword [ebp]
cmp ecx, ebp
jae 0x46f21d
mov byte [ecx], ah
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x46f22a
mov byte [eax], 0xff
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x46f237
mov byte [eax], 0xf0
inc dword [ebp]
mov eax, dword [ebp]
mov esi, dword [esp + 0x10]
mov ecx, eax
sub ecx, edi
sub ecx, 2
push ecx
lea edx, [ebx + 0x1cb2]
push edx
push 0x3e
mov dword [ebx + 0x1eb4], eax
mov dword [ebp], edi
call fcn.0046e6f0
mov ebp, dword [sym.imp.WSOCK32.dll_send]
add esp, 0xc
push 0
push 3
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 0x130]
push eax
call ebp
test eax, eax
mov esi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
jge 0x46f297
call esi
mov ecx, dword [esp + 0x10]
push eax
push str.Sending_data_failed___d_
push ecx
call fcn.004623b0
add esp, 0xc
lea edx, [ebx + 0x1cb3]
push 4
push edx
call fcn.0046ef40
mov eax, dword [edi + 0x130]
add esp, 8
push 0
push 2
add ebx, 0x1cb7
push ebx
push eax
call ebp
test eax, eax
jge 0x46f2d5
call esi
mov ecx, dword [esp + 0x10]
push eax
push str.Sending_data_failed___d_
push ecx
call fcn.004623b0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x46fe70
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [edi + 0x134]
push ebp
mov ebp, dword [edi]
push esi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
or esi, 0xffffffff
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
test eax, eax
jne 0x46feb9
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WSOCK32.dll_accept]
mov esi, eax
push ebx
push edi
call fcn.004631d0
add esp, 8
cmp esi, 0xffffffff
jne 0x46fee2
push str.Error_accept__ing_server_connect
push ebp
call fcn.004623b0
add esp, 8
pop esi
pop ebp
mov eax, 0x1e
pop ebx
add esp, 0x14
ret
push str.Connection_accepted_from_server_n
push ebp
call fcn.004622f0
push 1
push esi
mov dword [edi + 0x134], esi
call fcn.0047cf80
mov dword [edi + 0x13c], 1
mov eax, dword [ebp + 0x164]
add esp, 0x10
test eax, eax
je 0x46ff45
mov ecx, dword [ebp + 0x168]
push 1
push esi
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x46ff45
push esi
push edi
call fcn.004631d0
add esp, 8
pop esi
pop ebp
mov dword [edi + 0x134], 0xffffffff
mov eax, 0x2a
pop ebx
add esp, 0x14
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
Function at 0x47b210
Capabilities:
Parse pe header

Disassembly:
mov al, byte [esp + 4]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x47b21f
jmp dword [ecx*4 + 0x47b274]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret

Function at 0x47b3f0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
mov eax, dword [esp + 0x108]
push eax
call fcn.00487b0c
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x47b43a
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov al, byte [esp]
test al, al
je 0x47b43a
lea edx, [esp]
push edx
call dword [0x50b0e0]
add esp, 4
add esp, 0x104
ret
xor eax, eax
add esp, 0x104
ret

Function at 0x47d2c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1a0]
test esi, esi
jne 0x47d2d9
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.00466ae0
push edx
push eax
call fcn.00466b00
sub esi, eax
mov eax, dword [edi + 0x194]
add esp, 0x10
test eax, eax
je 0x47d327
mov eax, dword [ebx + 0x124]
mov ecx, dword [ebx + 0x120]
push eax
push ecx
call fcn.00466ae0
push edx
push eax
call fcn.00466b00
mov ecx, dword [edi + 0x194]
sub ecx, eax
add esp, 0x10
cmp esi, ecx
mov eax, ecx
jge 0x47d329
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x47e5f0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 8
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x47e625
mov edx, dword [esp]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x8003
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push esi
mov esi, dword [esp + 0x14]
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47e630
sub eax, edx
push eax
call fcn.00466b80
add esp, 4
push 0
push eax
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
push edx
call fcn.0047e590
add esp, 8
pop esi
add esp, 8
ret
Function at 0x48221e
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4f3e80
call fcn.00488310
mov edi, 0x94
mov eax, edi
call fcn.00483900
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x51b994], ecx
mov eax, dword [esi + 4]
mov dword [0x51b9a0], eax
mov edx, dword [esi + 8]
mov dword [0x51b9a4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x51b998], esi
cmp ecx, 2
je 0x48227e
or esi, 0x8000
mov dword [0x51b998], esi
shl eax, 8
add eax, edx
mov dword [0x51b99c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x4822b9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4822b9
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4822d1
cmp eax, 0x20b
je 0x4822be
mov dword [ebp - 0x1c], esi
jmp 0x4822e5
cmp dword [ecx + 0x84], 0xe
jbe 0x4822b9
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4822df
cmp dword [ecx + 0x74], 0xe
jbe 0x4822b9
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00489ec8
pop ecx
test eax, eax
jne 0x4822f9
push 0x1c
call fcn.004821fa
pop ecx
call fcn.00489dbf
test eax, eax
jne 0x48230a
push 0x10
call fcn.004821fa
pop ecx
call fcn.00489b17
mov dword [ebp - 4], esi
call fcn.00489919
test eax, eax
jge 0x482323
push 0x1b
call fcn.004821d5
pop ecx
call fcn.0048987a
mov dword [0x51d684], eax
call fcn.00489710
mov dword [0x51b8a4], eax
call fcn.0048967a
test eax, eax
jge 0x482348
push 8
call fcn.004821d5
pop ecx
call fcn.00489447
test eax, eax
jge 0x482359
push 9
call fcn.004821d5
pop ecx
push 1
call fcn.00488f1e
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x48236f
push eax
call fcn.004821d5
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call fcn.00489401
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x482390
movzx eax, word [ebp - 0x40]
jmp 0x482393
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00402060
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x4823b1
push edi
call fcn.0048904b
call fcn.0048906d
jmp 0x4823e3
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0048834b
ret
Function at 0x484419
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x484436
call fcn.00486a71
mov dword [eax], 0x16
xor eax, eax
jmp 0x4844a0
push esi
push 0x8c
push 1
call fcn.0048630a
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x48448b
push esi
call fcn.00489bc5
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x484469
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x484384
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x48449f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.00482838
test ebx, ebx
pop ecx
je 0x48449d
push ebx
call fcn.00486a83
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x488628
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00483900
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4886c3
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x51b994]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4886c3
cmp eax, 1
je 0x4886e4
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4886c3
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x488690
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4886bf
xor eax, eax
inc eax
jmp 0x488703
cmp edi, eax
jae 0x4886c7
xor eax, eax
jmp 0x488703
cmp eax, esi
jae 0x4886ce
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x51b994]
jmp 0x4886e7
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x488f88
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4f45c0
call fcn.00488310
push 8
call fcn.0048ae13
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x51b9d4], esi
jne 0x488fbc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x51b9d0], esi
mov al, byte [ebp + 0x10]
mov byte [0x51b9cc], al
cmp dword [ebp + 0xc], edi
jne 0x489006
cmp dword [0x51c668], edi
je 0x488ff6
mov eax, dword [0x51c664]
sub eax, 4
mov dword [0x51c664], eax
cmp eax, dword [0x51c668]
jb 0x488ff6
mov eax, dword [eax]
cmp eax, edi
je 0x488fd7
call eax
jmp 0x488fd7
push 0x50a104
mov eax, 0x50a0fc
call fcn.00488f06
pop ecx
push 0x50a110
mov eax, 0x50a108
call fcn.00488f06
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x489037
cmp dword [ebp + 0x10], edi
jne 0x489045
mov dword [0x51b9d4], esi
push dword [ebp + 8]
call fcn.00488ec4
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x489044
push 8
call fcn.0048ad5e
pop ecx
ret
call fcn.0048834b
ret

Function at 0x4890ed
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x50ba00]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x50bfc0]
je 0x489122
inc eax
cmp eax, 0x13
jb 0x489113
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x50bfc0]
jne 0x489248
mov eax, dword [0x51b8a8]
cmp eax, 1
je 0x489220
cmp eax, edx
jne 0x489152
cmp dword [0x50b9fc], 1
je 0x489220
cmp ecx, 0xfc
je 0x489248
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x489188
lea eax, [ebp - 0x80]
push 0x4f49cc
push eax
call fcn.0048eb00
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00487fc0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4891bc
mov eax, edi
push eax
call fcn.00487fc0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x4f49c8
push edi
call fcn.004863d0
add esp, 0x10
push edi
call fcn.00487fc0
push dword [esi + 0x50bfc4]
mov ebx, eax
call fcn.00487fc0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00483900
mov ebx, esp
push 0x4f49ac
push ebx
call fcn.0048eb00
push edi
push ebx
call fcn.0048eb10
push 0x4f49a8
push ebx
call fcn.0048eb10
push dword [esi + 0x50bfc4]
push ebx
call fcn.0048eb10
push 0x12010
push 0x4f4980
push ebx
call fcn.00492a21
add esp, 0x2c
jmp 0x489248
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x50bfc4]
push dword [esi]
call fcn.00487fc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00482423
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x489710
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x51bbec]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp eax, ebx
jne 0x489759
call ebp
mov esi, eax
cmp esi, ebx
je 0x48973f
mov dword [0x51bbec], 1
jmp 0x48975e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x489754
push 2
pop eax
mov dword [0x51bbec], eax
jmp 0x489759
mov eax, dword [0x51bbec]
cmp eax, 1
jne 0x4897b6
cmp esi, ebx
jne 0x489771
call ebp
mov esi, eax
cmp esi, ebx
jne 0x489771
xor eax, eax
jmp 0x48985d
cmp word [esi], bx
mov eax, esi
je 0x489786
inc eax
inc eax
cmp word [eax], bx
jne 0x489778
inc eax
inc eax
cmp word [eax], bx
jne 0x489778
sub eax, esi
inc eax
inc eax
mov ebp, eax
push ebp
call fcn.00483778
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x4897a9
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
jmp 0x48985d
push ebp
push esi
push edi
call fcn.00487c60
add esp, 0xc
jmp 0x48979b
cmp eax, 2
je 0x4897bf
cmp eax, ebx
jne 0x48976a
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebp, eax
cmp ebp, ebx
je 0x48976a
cmp byte [ebp], bl
mov esi, ebp
je 0x4897f5
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x48976a
push esi
add edi, eax
call fcn.00487fc0
lea esi, [esi + eax + 1]
cmp byte [esi], bl
pop ecx
jne 0x4897d2
inc edi
lea eax, [edi + edi]
push eax
mov dword [esp + 0x18], edi
call fcn.00483778
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x48986e
cmp byte [ebp], bl
mov edi, ebp
mov esi, eax
je 0x48984f
mov ecx, dword [esp + 0x14]
mov eax, esi
sub eax, dword [esp + 0x10]
sar eax, 1
sub ecx, eax
push ecx
push esi
push 0xffffffffffffffff
push edi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x489864
push edi
call fcn.00487fc0
push esi
lea edi, [edi + eax + 1]
call fcn.00482726
cmp byte [edi], bl
pop ecx
pop ecx
lea esi, [esi + eax*2 + 2]
jne 0x489815
push ebp
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push dword [esp + 0x10]
call fcn.00482838
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x48976a
Function at 0x48987a
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x51bbf0]
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jne 0x4898ba
call esi
test eax, eax
je 0x48989f
mov dword [0x51bbf0], 1
jmp 0x4898bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4898b6
mov dword [0x51bbf0], 2
jmp 0x4898c8
xor eax, eax
jmp 0x489916
cmp eax, 1
jne 0x4898c3
call esi
jmp 0x489916
cmp eax, 2
jne 0x4898b6
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebp
push ebp
push 0xffffffffffffffff
mov ebx, eax
push ebx
push 1
push ebp
call edi
mov esi, eax
cmp esi, ebp
je 0x48990e
lea eax, [esi + esi]
push eax
call fcn.00483778
mov ebp, eax
test ebp, ebp
pop ecx
je 0x48990e
push esi
push ebp
push 0xffffffffffffffff
push ebx
push 1
push 0
call edi
test eax, eax
jne 0x489912
push ebp
call fcn.00482838
pop ecx
xor eax, eax
jmp 0x489914
mov eax, ebp
pop edi
pop ebx
pop esi
pop ebp
ret