joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af6f8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4af8a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
jne 0x4af886
mov dl, 1
mov eax, dword [0x42c058]
call fcn.00438184
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
xor edx, edx
call fcn.00406a7c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4af875
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00491e20
test al, al
je 0x4af868
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x4af8b4
lea eax, [ebp - 0x394]
call fcn.00413ee4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4af868
xor eax, eax
push ebp
push 0x4af861
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x4af924
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4af84a
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406c74
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x40]
jne 0x4af84a
mov eax, dword [ebp - 4]
add eax, 0x3c
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406c74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af868
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4af76b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.004380c0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af8ac
lea eax, [ebp - 0x3a0]
call fcn.00406a6c
ret

Function at 0x4b0404
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4df284]
cmp byte [eax + 0xad], 0
jne 0x4b0476
cmp dword [0x4df29c], 0
jne 0x4b0436
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x4d905c]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x4df29c], eax
cmp dword [0x4df298], 0
jne 0x4b0451
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x4df298], eax
cmp dword [0x4df2a0], 0
jne 0x4b0476
push esp
push 0
push 0
mov eax, dword [0x4d9058]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4df2a0], eax
pop edx
ret
Function at 0x4b079c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4b07b3
add esp, 0xfffffff0
call fcn.00405324
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0044070c
mov eax, dword [0x4d9938]
cmp byte [eax], 0
jne 0x4b07e0
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4d9bd8]
cmp word [eax + 2], 0
jne 0x4b07fa
mov eax, dword [0x4d9bd8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004b2894
mov eax, dword [0x4d9cc8]
cmp word [eax + 2], 0
jne 0x4b0814
mov eax, dword [0x4d9cc8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004b2aa4
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x44b038]
call fcn.0045130c
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4b3054
mov dl, 1
mov eax, dword [0x429a90]
call fcn.00404dc0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x429a90]
call fcn.00404dc0
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x44f4d0]
call fcn.0045a77c
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4b09f4
mov eax, dword [0x4d9aac]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0045ac10
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4b333c
mov dl, 1
mov eax, dword [0x429a90]
call fcn.00404dc0
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4d9aac]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00413d1c
test eax, eax
je 0x4b0925
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00413b00
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00413d00
test eax, eax
je 0x4b093d
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00406c74
push ebx
push 0x4b2264
call fcn.004a64ac
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x4d9938]
cmp byte [eax], 0
jne 0x4b098e
mov eax, ebx
call fcn.004b0b68
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004b3568
mov eax, ebx
call fcn.004b419c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4b09eb
call fcn.0040537c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b0e3c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4b0ede
cmp dword [ebx + 0x94], 0
jne 0x4b0ed8
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4b0d88
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4b0ed8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4b0e9e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4b0ed8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00434864
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4b0ead
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4b10fc
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4df284]
cmp dword [eax + 0x170], 0
je 0x4b1261
test bl, bl
jne 0x4b11af
cmp dword [esi + 0x9c], 0
jne 0x4b11a4
mov eax, esi
call fcn.004b3fec
push eax
push 0x4b1008
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4b1175
mov eax, dword [0x4df284]
cmp byte [eax + 0xd3], 0
je 0x4b1175
mov eax, dword [esi + 0xd8]
call fcn.00408374
mov edi, eax
cmp edi, 0
jl 0x4b1175
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b115e
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b11a4
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00434864
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b1184
inc dword [esi + 0x9c]
jmp 0x4b1261
cmp dword [esi + 0x9c], 0
jle 0x4b1261
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4b1261
cmp dword [esi + 0x44], 0
je 0x4b120c
mov eax, dword [0x4df284]
cmp byte [eax + 0xd3], 0
je 0x4b120c
mov eax, dword [esi + 0xd8]
call fcn.00408374
mov edi, eax
cmp edi, 0
jl 0x4b120c
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b11f5
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b123b
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00434864
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b121b
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4a4384]
call fcn.00408534
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4b1eb0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4b1f1b
cmp byte [ebx + 0xd3], 0
jne 0x4b1f1b
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406bb8
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4b1f08
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4b1f28
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406a7c
jmp 0x4b1f28
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406a7c
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4b3750
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4b37be
mov eax, esi
call fcn.0048bd7c
test al, al
je 0x4b37be
mov eax, dword [ebx + 0x84]
call fcn.0048b9d0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4b37be
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4b37b2
push 0
mov eax, dword [ebx + 0x84]
call fcn.0048b9d0
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004829a4
jmp 0x4b37be
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004b3588
pop esi
pop ebx
ret

Function at 0x4b6158
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4b61c9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4d90cc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4b61b3
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004b6140
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4b59ec]
call fcn.004b6908
mov dword [0x4d9130], eax
mov eax, dword [ebp - 4]
call fcn.004b60ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b61d0
lea eax, [ebp - 8]
call fcn.004099a0
ret

Function at 0x4b61f8
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffd4c
mov esi, 0x4008
test cl, cl
je 0x4b620b
or esi, 2
test dl, dl
je 0x4b6214
or esi, 0
jmp 0x4b6217
or esi, 1
push esi
push 0x2b4
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [esp + 4]
add esp, 0x2b4
pop esi
ret
Function at 0x4b8c9c
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00406a7c
test esi, 1
je 0x4b8cc1
mov eax, ebx
mov edx, 0x4b8f5c
call fcn.00406e88
test esi, 2
je 0x4b8cd5
mov eax, ebx
mov edx, 0x4b8f84
call fcn.00406e88
test esi, 4
je 0x4b8ce9
mov eax, ebx
mov edx, 0x4b8fa0
call fcn.00406e88
test esi, 8
je 0x4b8cfd
mov eax, ebx
mov edx, 0x4b8fc4
call fcn.00406e88
test esi, 0x10
je 0x4b8d11
mov eax, ebx
mov edx, 0x4b8fec
call fcn.00406e88
test esi, 0x20
je 0x4b8d25
mov eax, ebx
mov edx, 0x4b9018
call fcn.00406e88
test esi, 0x40
je 0x4b8d39
mov eax, ebx
mov edx, 0x4b9040
call fcn.00406e88
test esi, 0x80
je 0x4b8d4d
mov eax, ebx
mov edx, 0x4b9058
call fcn.00406e88
test esi, 0x100
je 0x4b8d61
mov eax, ebx
mov edx, 0x4b9074
call fcn.00406e88
test esi, 0x200
je 0x4b8d75
mov eax, ebx
mov edx, 0x4b90a0
call fcn.00406e88
test esi, 0x400
je 0x4b8d89
mov eax, ebx
mov edx, 0x4b90cc
call fcn.00406e88
test esi, 0x800
je 0x4b8d9d
mov eax, ebx
mov edx, 0x4b90f8
call fcn.00406e88
mov edi, esi
and edi, 0x4000
test edi, edi
je 0x4b8db5
mov eax, ebx
mov edx, 0x4b9120
call fcn.00406e88
test esi, 0x1000
je 0x4b8dc9
mov eax, ebx
mov edx, 0x4b9148
call fcn.00406e88
test esi, 0x2000
je 0x4b8ddd
mov eax, ebx
mov edx, 0x4b915c
call fcn.00406e88
test edi, edi
je 0x4b8ded
mov eax, ebx
mov edx, 0x4b9120
call fcn.00406e88
test esi, 0x8000
je 0x4b8e01
mov eax, ebx
mov edx, 0x4b9174
call fcn.00406e88
test esi, 0x10000
je 0x4b8e15
mov eax, ebx
mov edx, 0x4b9198
call fcn.00406e88
test esi, 0x20000
je 0x4b8e29
mov eax, ebx
mov edx, 0x4b91cc
call fcn.00406e88
test esi, 0x40000
je 0x4b8e3d
mov eax, ebx
mov edx, 0x4b91f8
call fcn.00406e88
test esi, 0x80000
je 0x4b8e51
mov eax, ebx
mov edx, 0x4b9224
call fcn.00406e88
test esi, 0x100000
je 0x4b8e65
mov eax, ebx
mov edx, 0x4b9250
call fcn.00406e88
test esi, 0x200000
je 0x4b8e79
mov eax, ebx
mov edx, 0x4b9274
call fcn.00406e88
test esi, 0x400000
je 0x4b8e8d
mov eax, ebx
mov edx, 0x4b9298
call fcn.00406e88
test esi, 0x800000
je 0x4b8ea1
mov eax, ebx
mov edx, 0x4b92b8
call fcn.00406e88
test esi, 0x1000000
je 0x4b8eb5
mov eax, ebx
mov edx, 0x4b92d0
call fcn.00406e88
test esi, 0x2000000
je 0x4b8ec9
mov eax, ebx
mov edx, 0x4b92f4
call fcn.00406e88
test esi, 0x4000000
je 0x4b8edd
mov eax, ebx
mov edx, 0x4b9320
call fcn.00406e88
test esi, 0x10000000
je 0x4b8ef1
mov eax, ebx
mov edx, 0x4b934c
call fcn.00406e88
test esi, 0x20000000
je 0x4b8f05
mov eax, ebx
mov edx, 0x4b9364
call fcn.00406e88
test esi, 0x40000000
je 0x4b8f19
mov eax, ebx
mov edx, 0x4b9394
call fcn.00406e88
test esi, 0x80000000
je 0x4b8f2d
mov eax, ebx
mov edx, 0x4b93c4
call fcn.00406e88
mov eax, dword [ebx]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x4b8f3e
sub eax, 4
mov eax, dword [eax]
mov edx, eax
dec edx
mov eax, ebx
call fcn.00406df0
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4bae4c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4baea8
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebx + 4]
mov cx, 0x50
mov edx, 0x4baec0
call fcn.004bd4b8
mov eax, dword [ebp - 4]
call fcn.00406b08
push eax
push 0x4baecc
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4baeaf
lea eax, [ebp - 4]
call fcn.00406a6c
ret

Function at 0x4bd720
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp + 8], ecx
mov dword [esp], edx
mov edi, eax
mov cl, 8
mov eax, edi
mov ebx, dword [esp]
mov esi, dword [esp + 8]
movzx edx, word [eax]
xor dx, word [ebx]
mov word [esi], dx
add esi, 2
add ebx, 2
add eax, 2
dec cl
jne 0x4bd73a
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x4bf780
Capabilities:
Initialize winsock library

Disassembly:
push ebx
push esi
add esp, 0xfffffe5c
mov esi, edx
mov dword [esp], eax
mov eax, esi
xor edx, edx
call fcn.00406a7c
lea eax, [esp + 4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4bf7dd
mov eax, dword [esp]
call fcn.004bc218
mov dword [esp + 0x198], eax
push 2
push 4
lea eax, [esp + 0x1a0]
push eax
call sub.wsock32.dll_gethostbyaddr
mov ebx, eax
test ebx, ebx
je 0x4bf7d8
mov eax, esi
mov edx, dword [ebx]
call fcn.00406c08
call sub.wsock32.dll_WSACleanup
add esp, 0x1a4
pop esi
pop ebx
ret

Function at 0x4bf7e8
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff654
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406a64
xor eax, eax
push ebp
push 0x4bf8ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
xor edx, edx
call fcn.00406a7c
mov eax, dword [0x4d9b84]
cmp dword [eax], 0
je 0x4bf8d1
lea eax, [ebp - 0x198]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4bf8d1
xor edx, edx
push ebp
push 0x4bf8ca
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.00406cb8
mov word [ebp - 0x1a8], 2
mov eax, dword [ebp - 8]
call fcn.00406534
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x1a4], eax
push 0
push 0
push 0
push 0x401
lea eax, [ebp - 0x9ac]
push eax
push 0x10
lea eax, [ebp - 0x1a8]
push eax
mov eax, dword [0x4d9b84]
mov eax, dword [eax]
call eax
test eax, eax
jne 0x4bf8b7
mov eax, ebx
lea edx, [ebp - 0x9ac]
mov ecx, 0x402
call fcn.00406c74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf8d1
call sub.wsock32.dll_WSACleanup
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf8f6
lea eax, [ebp - 8]
call fcn.00406090
lea eax, [ebp - 4]
call fcn.00406a6c
ret
Function at 0x4bfcac
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1a0], ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x198], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bfe0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00406a7c
lea edx, [ebp - 0x198]
mov eax, ebx
call fcn.00412634
cmp dword [ebp - 0x198], 0
je 0x4bfdd3
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x4bfdcc
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x19c]
mov edx, ebx
call fcn.00406cf0
mov eax, dword [ebp - 0x19c]
lea ecx, [ebp - 4]
xor edx, edx
call fcn.004b74a0
mov eax, dword [ebp - 4]
call fcn.00406534
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x4bfd59
call fcn.004059bc
jmp 0x4bfdd3
mov edi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4bfd8f
push dword [esi]
mov eax, dword [edi + ebx*4]
mov eax, dword [eax]
call fcn.004bc248
lea edx, [ebp - 0x1a0]
call fcn.004bc620
push dword [ebp - 0x1a0]
push 0x4bfe24
mov eax, esi
mov edx, 3
call fcn.0040702c
inc ebx
cmp dword [edi + ebx*4], 0
jne 0x4bfd60
mov eax, dword [esi]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
test eax, eax
je 0x4bfdac
sub eax, 4
mov eax, dword [eax]
mov edx, esi
mov ecx, 1
xchg edx, eax
call fcn.00407284
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bfdd3
call sub.wsock32.dll_WSACleanup
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bfe11
lea eax, [ebp - 0x1a0]
call fcn.00406a6c
lea eax, [ebp - 0x19c]
call fcn.004066e0
lea eax, [ebp - 0x198]
call fcn.00406a6c
lea eax, [ebp - 4]
call fcn.00406090
ret
Function at 0x4c9bd8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c9c9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
call sub.kernel32.dll_GetEnvironmentStringsW
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406ad0
jmp 0x4c9c65
test di, di
je 0x4c9c2e
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.00406bf8
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00406e88
jmp 0x4c9c64
cmp dword [ebp - 4], 0
je 0x4c9c76
mov edx, dword [ebp - 4]
mov eax, 0x4c9cbc
call fcn.004074cc
dec eax
je 0x4c9c5a
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00412634
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406ad0
inc ebx
movzx edi, word [esi + ebx*2]
test di, di
jne 0x4c9c12
cmp word [esi + ebx*2 - 2], 0
jne 0x4c9c12
push esi
call sub.kernel32.dll_FreeEnvironmentStringsW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9ca6
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00406a74
lea eax, [ebp - 4]
call fcn.00406a6c
ret

Function at 0x4c9cc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x4c9d51
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x104
mov eax, esi
call fcn.00413e30
mov ebx, eax
push esi
push ebx
call sub.kernel32.dll_GetWindowsDirectoryW
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406c38
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, 0x4c9d6c
call fcn.00406f48
push esi
push ebx
call sub.kernel32.dll_GetSystemDirectoryW
push dword [edi]
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00406c38
push dword [ebp - 8]
push 0x4c9d6c
mov eax, edi
mov edx, 3
call fcn.0040702c
mov eax, ebx
call fcn.00413e70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9d58
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406a74
ret

Function at 0x4c9d70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4c9e11
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor edx, edx
call fcn.00406a7c
mov eax, 0x104
call fcn.00413e30
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
call sub.shell32.dll_SHGetSpecialFolderLocation
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x4c9dcd
mov eax, esi
mov edx, ebx
call fcn.00406c38
mov eax, ebx
call fcn.00413e70
lea eax, [ebp - 4]
call fcn.004099a0
push eax
call sub.shell32.dll_SHGetMalloc
test eax, 0x80000000
sete al
test al, al
je 0x4c9dfb
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9e18
lea eax, [ebp - 4]
call fcn.004099a0
ret