joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4884c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x4884fa
cmp dword [ebp + 0xc], 0
je 0x4884fa
cmp dword [ebp + 0x14], 0
je 0x4884fa
cmp dword [ebp + 0x18], 0
jne 0x4884ff
jmp 0x488581
cmp dword [ebp + 0x10], 1
je 0x48850b
cmp dword [ebp + 0x10], 2
jne 0x488562
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00487540
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x488526
jmp 0x488581
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.00487540
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x488541
jmp 0x488581
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
jmp 0x488581
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x48859a
mov edx, dword [ebp - 4]
push edx
call fcn.00499750
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 0
je 0x4885b3
mov eax, dword [ebp - 8]
push eax
call fcn.00499750
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4885c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x4885fa
cmp dword [ebp + 0xc], 0
je 0x4885fa
cmp dword [ebp + 0x14], 0
je 0x4885fa
cmp dword [ebp + 0x18], 0
jne 0x4885ff
jmp 0x488689
cmp dword [ebp + 0x10], 1
je 0x48860b
cmp dword [ebp + 0x10], 2
jne 0x48866a
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00487830
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x488626
jmp 0x488689
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.00487830
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x488641
jmp 0x488689
mov ecx, dword [ebp - 0x10]
shl ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
jmp 0x488689
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
je 0x4886a2
mov eax, dword [ebp - 8]
push eax
call fcn.00499750
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x4886bb
mov ecx, dword [ebp - 4]
push ecx
call fcn.00499750
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x488720
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x48875a
cmp dword [ebp + 8], 0
jne 0x48875a
jmp 0x4887fa
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp dword [ebp - 8], 0
je 0x4887fa
mov edx, dword [ebp - 8]
push edx
call fcn.00405bab
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4887fa
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4887fa
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00487a40
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4887fa
cmp dword [ebp + 0xc], 0
je 0x4887f4
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jle 0x4887ce
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004054d0
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00404070
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0xc], 0
je 0x488813
mov eax, dword [ebp - 0xc]
push eax
call fcn.00499750
add esp, 4
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x48882c
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00499750
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x488840
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x48887a
cmp dword [ebp + 8], 0
jne 0x48887a
jmp 0x48891c
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [ebp - 8], 0
je 0x48891c
mov edx, dword [ebp - 8]
shl edx, 1
push edx
call fcn.00405bab
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x48891c
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x48891c
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004878e0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x48891c
cmp dword [ebp + 0xc], 0
je 0x488916
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jle 0x4888f0
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004054d0
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00404070
add esp, 0xc
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 4], 0
je 0x488935
mov eax, dword [ebp - 4]
push eax
call fcn.00499750
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
je 0x48894e
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00499750
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x488a70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00487540
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x488b66
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x488b66
cmp dword [ebp + 0x10], 0
je 0x488b66
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405bab
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x488b66
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x488b66
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00487a40
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x488b4d
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jle 0x488b2e
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004641d0
add esp, 0xc
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
mov byte [edx], 0
jmp 0x488b66
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004054d0
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x488b7f
mov edx, dword [ebp - 8]
push edx
call fcn.00499750
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x488b98
mov eax, dword [ebp - 4]
push eax
call fcn.00499750
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x488bb1
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00499750
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x488bc0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00487830
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x488cb8
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x488cb8
cmp dword [ebp + 0x10], 0
je 0x488cb8
mov eax, dword [ebp - 8]
shl eax, 1
push eax
call fcn.00405bab
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x488cb8
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x488cb8
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.004878e0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x488c9f
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jle 0x488c80
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004641d0
add esp, 0xc
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
mov byte [edx], 0
jmp 0x488cb8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004054d0
add esp, 0xc
cmp dword [ebp - 0x10], 0
je 0x488cd1
mov edx, dword [ebp - 0x10]
push edx
call fcn.00499750
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [ebp - 4], 0
je 0x488cea
mov eax, dword [ebp - 4]
push eax
call fcn.00499750
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
je 0x488d03
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00499750
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x48c6a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x563a68]
xor eax, ebp
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], str.getaddrinfo
mov dword [ebp - 0x18], 0x48c950
mov dword [ebp - 0x14], str.getnameinfo
mov dword [ebp - 0x10], 0x48d1b0
mov dword [ebp - 0xc], str.freeaddrinfo
mov dword [ebp - 8], fcn.0048c8e0
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
cmp dword [0x58b408], 0
je 0x48c70b
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x56b4f8]
jmp 0x48c8c5
push 0x104
lea ecx, [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x48c726
jmp 0x48c81b
lea edx, [ebp - 0x240]
push edx
push 0x10c
lea eax, [ebp - 0x138]
push eax
call fcn.0040366b
add esp, 0xc
push str.ws2_32
push 0x10c
lea ecx, [ebp - 0x138]
push ecx
call fcn.004034b1
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x48c799
push str.getaddrinfo
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x48c799
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0
je 0x48c7a1
jmp 0x48c81b
lea edx, [ebp - 0x240]
push edx
push 0x10c
lea eax, [ebp - 0x138]
push eax
call fcn.0040366b
add esp, 0xc
push str.wship6
push 0x10c
lea ecx, [ebp - 0x138]
push ecx
call fcn.004034b1
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x48c814
push str.getaddrinfo
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x48c814
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
jmp 0x48c81b
cmp dword [ebp - 0x20], 0
je 0x48c8b0
mov dword [ebp - 4], 0
jmp 0x48c837
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [0x559500]
jge 0x48c87a
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*8 - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*8 - 0x18], eax
mov edx, dword [ebp - 4]
cmp dword [ebp + edx*8 - 0x18], 0
jne 0x48c878
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
jmp 0x48c87a
jmp 0x48c82e
cmp dword [ebp - 0x20], 0
je 0x48c8b0
mov dword [ebp - 4], 0
jmp 0x48c892
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [0x559500]
jge 0x48c8b0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*8 - 0x18]
mov dword [eax*8 + 0x56b4f8], edx
jmp 0x48c889
mov dword [0x58b408], 1
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x56b4f8]
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.0040526d
mov esp, ebp
pop ebp
ret 4
Function at 0x48cd30
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x48cd5c
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x48cd7c
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x2e
jne 0x48cd7a
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x48cd53
cmp dword [ebp - 0xc], 3
je 0x48cd86
xor eax, eax
jmp 0x48cdaa
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x48cd9d
xor eax, eax
jmp 0x48cdaa
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x48d000
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
mov dword [ecx], 0
mov edx, dword [ebp + 0x18]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x48d0c8
mov ecx, dword [ebp - 8]
movsx edx, word [ecx + 8]
cmp edx, 2
jne 0x48d0a8
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 0xa]
cmp ecx, 4
jne 0x48d0a8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x48d065
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x48d0a8
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
mov ax, word [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0048cdb0
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
jne 0x48d09b
mov eax, 8
jmp 0x48d10e
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
add ecx, 0x1c
mov dword [ebp - 0xc], ecx
jmp 0x48d05c
push 0x400
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
push 0x401
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00403522
add esp, 0x10
xor eax, eax
jmp 0x48d10e
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
sub edx, 0x2af9
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 3
ja case.default.0x48d0e6
mov eax, dword [ebp - 0x10]
jmp dword [eax*4 + 0x48d114]
mov eax, 0x2af9
jmp 0x48d10e
mov eax, 0x2afa
jmp 0x48d10e
mov eax, 0x2afb
jmp 0x48d10e
mov eax, 0x2af9
jmp 0x48d10e
mov eax, 0x2af9
mov esp, ebp
pop ebp
ret 0x18
Function at 0x48def0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x18]
push eax
call fcn.0048f590
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0048f400
add esp, 8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x48dff0
push 0
call fcn.0048e080
add esp, 4
push 1
call fcn.0048e080
add esp, 4
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x48dff0
mov eax, dword [ebp - 0x10]
push eax
call fcn.00499750
add esp, 4
cmp dword [ebp + 8], 0
je 0x48dfe6
cmp dword [ebp + 8], 0
je 0x48dfe6
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x80], 0
je 0x48dfb5
xor edx, edx
je 0x48dfb5
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x80]
mov dword [ebp - 0x14], ecx
jmp 0x48dfbc
mov dword [ebp - 0x14], 0xffffffc1
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x80], eax
push 0
push 0xff
push 0
push 0
push 0x1de
push 0xffffffffffffffc1
mov ecx, dword [ebp + 8]
push ecx
call fcn.00495fc0
add esp, 0x1c
mov eax, 1
jmp 0x48e07a
mov edx, dword [ebp - 0x10]
push edx
call fcn.00499750
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x48e018
cmp dword [ebp + 0x14], 0
jne 0x48e028
mov eax, dword [ebp + 0x10]
push eax
call fcn.004035e0
add esp, 4
test eax, eax
jne 0x48e028
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x48e06e
cmp dword [ebp + 0x14], 0
je 0x48e036
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
jmp 0x48e048
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004035e0
add esp, 4
add eax, 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
xor ecx, ecx
cmp dword [ebp + 0x14], 0
setne cl
lea ecx, [ecx + ecx + 1]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00488460
add esp, 0x14
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x48f590
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x563a68]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x48f5b0
mov eax, connect
jmp 0x48f5fc
push 0x94
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.004054d0
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x48f5f7
cmp dword [ebp + 8], 0
jne 0x48f5f7
cmp dword [ebp - 0x9c], 6
jb 0x48f5f7
mov eax, connect
jmp 0x48f5fc
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040526d
mov esp, ebp
pop ebp
ret
Function at 0x4bb270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x563a68]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 0x40], 0xc
mov byte [ebp - 0x3f], 0x52
mov byte [ebp - 0x3e], 0xe3
mov byte [ebp - 0x3d], 0xa8
mov byte [ebp - 0x3c], 0xf6
mov byte [ebp - 0x3b], 0xd4
mov byte [ebp - 0x3a], 0xc7
mov byte [ebp - 0x39], 0x68
mov byte [ebp - 0x38], 0xf2
mov byte [ebp - 0x37], 0x36
mov byte [ebp - 0x36], 0x1c
mov byte [ebp - 0x35], 0x88
mov byte [ebp - 0x34], 0x15
mov byte [ebp - 0x33], 0x36
mov byte [ebp - 0x32], 0x97
mov byte [ebp - 0x31], 0xde
mov byte [ebp - 0x30], 0x55
mov byte [ebp - 0x2f], 0x9a
mov byte [ebp - 0x2e], 0x9e
mov byte [ebp - 0x2d], 0xdf
mov byte [ebp - 0x2c], 5
mov byte [ebp - 0x2b], 0xd5
mov byte [ebp - 0x2a], 0xf3
mov byte [ebp - 0x29], 0x52
mov byte [ebp - 0x28], 0xe1
mov byte [ebp - 0x27], 0xe1
mov byte [ebp - 0x26], 0xcb
mov byte [ebp - 0x25], 0xfb
mov byte [ebp - 0x24], 0xb4
mov byte [ebp - 0x23], 0x74
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0xca
mov byte [ebp - 0x20], 0x29
mov byte [ebp - 0x1f], 0xed
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x62
mov byte [ebp - 0x1c], 0x6a
mov byte [ebp - 0x1b], 0xba
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0xa1
mov byte [ebp - 0x18], 0xb0
mov byte [ebp - 0x17], 0x2b
mov byte [ebp - 0x16], 0x27
mov byte [ebp - 0x15], 0x60
mov byte [ebp - 0x14], 0x87
mov byte [ebp - 0x13], 0x81
mov byte [ebp - 0x12], 0xd1
mov byte [ebp - 0x11], 0xa4
mov byte [ebp - 0x10], 0x10
mov byte [ebp - 0xf], 0xf7
mov byte [ebp - 0xe], 0xd2
mov byte [ebp - 0xd], 0x6b
mov byte [ebp - 0xc], 0xce
mov byte [ebp - 0xb], 0xb5
mov byte [ebp - 0xa], 0x12
mov byte [ebp - 9], 0xc5
mov dword [ebp - 0x44], 0x38
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x44]
ja 0x4bb391
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
lea eax, [ebp + edx - 0x40]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00404070
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040526d
mov esp, ebp
pop ebp
ret
Function at 0x4bf6c0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x563a68]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40c], 0
push 0x400
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
jne 0x4bf708
lea ecx, [ebp - 0x408]
push ecx
call fcn.004bfb30
add esp, 4
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040526d
mov esp, ebp
pop ebp
ret

Function at 0x4bfb30
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x563a68]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
push 1
call fcn.004c0730
add esp, 4
test eax, eax
jne 0x4bfb75
mov eax, dword [ebp - 0xc]
jmp 0x4bfc57
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00487540
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4bfba0
mov edx, dword [ebp - 8]
mov dword [ebp - 0x41c], edx
jmp 0x4bfba9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp - 0x41c]
push ecx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0
je 0x4bfbd2
mov edx, dword [ebp - 8]
push edx
call fcn.00403716
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 0x14], 0
jne 0x4bfbdd
mov eax, dword [ebp - 0xc]
jmp 0x4bfc57
push 0x400
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x14]
movsx edx, word [ecx + 8]
push edx
call fcn.004bfe00
add esp, 0x10
test eax, eax
jne 0x4bfc0b
mov eax, dword [ebp - 0xc]
jmp 0x4bfc57
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
movsx edx, word [ecx + 8]
push edx
call fcn.004c05e0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
movsx ecx, word [eax + 8]
push ecx
mov edx, dword [ebp - 0x14]
movsx eax, word [edx + 0xa]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004c06e0
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0040526d
mov esp, ebp
pop ebp
ret