joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d3ea
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea esi, [ebp - 0x10c]
lea edi, [ebp - 0x210]
xor eax, eax
mov dword [esi], eax
xor eax, eax
jmp 0x47d417
mov edx, dword [esi + eax*4 + 4]
cmp edx, dword [ebx + 4]
je 0x47d41b
inc eax
cmp eax, dword [esi]
jb 0x47d40d
cmp eax, dword [esi]
jne 0x47d42d
cmp dword [esi], 0x40
jae 0x47d42d
mov ecx, dword [ebx + 4]
mov dword [esi + eax*4 + 4], ecx
inc dword [esi]
xor eax, eax
mov dword [edi], eax
xor eax, eax
jmp 0x47d43f
mov edx, dword [edi + eax*4 + 4]
cmp edx, dword [ebx + 4]
je 0x47d443
inc eax
cmp eax, dword [edi]
jb 0x47d435
cmp eax, dword [edi]
jne 0x47d455
cmp dword [edi], 0x40
jae 0x47d455
mov ecx, dword [ebx + 4]
mov dword [edi + eax*4 + 4], ecx
inc dword [edi]
cmp dword [ebx + 0x24], 0xffffffff
jne 0x47d476
push 0
push edi
push esi
push 0
mov eax, dword [ebx + 4]
inc eax
push eax
call sub.WSOCK32.DLL_select
test eax, eax
jge 0x47d4b5
mov eax, 2
jmp 0x47d4df
mov eax, dword [ebx + 0x24]
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x24]
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
push edx
push edi
push esi
push 0
mov ecx, dword [ebx + 4]
inc ecx
push ecx
call sub.WSOCK32.DLL_select
test eax, eax
jge 0x47d4b5
mov eax, 2
jmp 0x47d4df
push edi
push dword [ebx + 4]
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
je 0x47d4c9
mov eax, 2
jmp 0x47d4df
push esi
push dword [ebx + 4]
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
je 0x47d4dd
mov eax, 1
jmp 0x47d4df
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x47d4e6
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
call sub.WSOCK32.DLL_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x47d527
push esi
push str.255.255.255.255
call fcn.004d49dc
add esp, 8
test eax, eax
jne 0x47d536
push 2
push 4
lea eax, [ebp - 4]
push eax
call sub.WSOCK32.DLL_gethostbyaddr
mov ebx, eax
jmp 0x47d536
push 2
push 4
lea eax, [ebp - 4]
push eax
call sub.WSOCK32.DLL_gethostbyaddr
mov ebx, eax
test ebx, ebx
jne 0x47d542
push esi
call sub.WSOCK32.DLL_gethostbyname
mov ebx, eax
test ebx, ebx
jne 0x47d560
test edi, edi
je 0x47d560
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [edi + 0xc], eax
mov dword [edi + 8], str.Generic_error_in_GetHostByName__
push 0
call sub.WSOCK32.DLL_WSASetLastError
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x47d5aa
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 8
push 0xffff
push dword [ebx + 4]
call sub.WSOCK32.DLL_setsockopt
push ebx
call fcn.0047d568
pop ecx
push 0x10
lea edx, [ebx + 0x10]
push edx
push dword [ebx + 4]
call sub.WSOCK32.DLL_connect
test eax, eax
je 0x47d6ac
call sub.WSOCK32.DLL_WSAGetLastError
cmp eax, 0x2733
je 0x47d619
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [ebx + 0xc], eax
push dword [ebx + 0xc]
call fcn.004c2d52
pop ecx
mov dword [ebx + 8], eax
push 0
call sub.WSOCK32.DLL_WSASetLastError
jmp 0x47d6ac
push ebx
call fcn.0047d3ea
pop ecx
cmp eax, 2
jne 0x47d635
mov dword [ebx + 0xc], 2
mov dword [ebx + 8], str.Connection_failed
jmp 0x47d646
dec eax
je 0x47d646
mov dword [ebx + 0xc], 0xffffffff
mov dword [ebx + 8], str.Timeout
mov dword [ebp - 0xc], 4
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebx + 4]
call sub.WSOCK32.DLL_getsockopt
inc eax
je 0x47d69e
mov edx, dword [ebp - 8]
mov dword [ebx + 0x30], edx
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 8]
push eax
push 0x1002
push 0xffff
push dword [ebx + 4]
call sub.WSOCK32.DLL_getsockopt
inc eax
je 0x47d695
mov edx, dword [ebp - 8]
mov dword [ebx + 0x34], edx
jmp 0x47d6ac
mov dword [ebx + 0x34], 0x578
jmp 0x47d6ac
mov dword [ebx + 0x30], 0x578
mov dword [ebx + 0x34], 0x578
push ebx
call fcn.0047d58a
pop ecx
cmp dword [ebx + 0xc], 0
sete al
and eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47e026
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
push 1
call fcn.00463d22
pop ecx
mov ebx, eax
push 0x400
push 2
call sym.SISCOM.EXE__hb_param
add esp, 8
mov esi, eax
test ebx, ebx
je 0x47e067
cmp dword [ebx], 0xf0123a42
jne 0x47e067
test esi, esi
je 0x47e067
push 2
call sym.SISCOM.EXE__hb_parinfo
pop ecx
test ah, 0x20
jne 0x47e094
push 2
call sym.SISCOM.EXE__hb_paramError
pop ecx
push eax
push 1
call sym.SISCOM.EXE__hb_paramError
pop ecx
push eax
push 2
push dword [ebp + 8]
push 0
push 0xbc4
push 1
call fcn.00461828
add esp, 0x1c
jmp 0x47e235
push esi
call fcn.00480c5f
pop ecx
mov esi, eax
push esi
call fcn.0047fcae
pop ecx
mov dword [ebp - 4], eax
push esi
call fcn.0047fcca
pop ecx
mov esi, eax
push 0xffffffffffffffff
push 3
call sym.SISCOM.EXE__hb_param
add esp, 8
test eax, eax
je 0x47e0d4
push 0xffffffffffffffff
push 3
call sym.SISCOM.EXE__hb_param
add esp, 8
test dword [eax], 0xfffbffff
jne 0x47e0d9
mov dword [ebp - 8], esi
jmp 0x47e0ec
push 3
call sym.SISCOM.EXE__hb_parni
pop ecx
mov dword [ebp - 8], eax
cmp esi, dword [ebp - 8]
jge 0x47e0ec
mov dword [ebp - 8], esi
xor edi, edi
xor eax, eax
mov dword [ebp - 0xc], eax
xor edx, edx
mov dword [ebx + 0xc], edx
mov dword [ebx + 8], 0x672faf
cmp dword [ebp + 0xc], 1
jne 0x47e11b
mov ecx, dword [ebp - 8]
sub ecx, edi
cmp ecx, dword [ebx + 0x34]
jge 0x47e116
mov esi, dword [ebp - 8]
sub esi, edi
jmp 0x47e11e
mov esi, dword [ebx + 0x34]
jmp 0x47e11e
mov esi, dword [ebp - 8]
push ebx
call fcn.0047d29c
pop ecx
test eax, eax
je 0x47e14e
push 0
push esi
mov eax, dword [ebp - 4]
add eax, edi
push eax
push dword [ebx + 4]
call sub.WSOCK32.DLL_recv
mov esi, eax
test esi, esi
jle 0x47e142
add edi, esi
cmp dword [ebp + 0xc], 0
je 0x47e1d3
jmp 0x47e1c6
mov edx, dword [ebx + 0x24]
add dword [ebp - 0xc], edx
cmp dword [ebx + 0x2c], 0
je 0x47e1a8
push dword [ebx + 0x2c]
call fcn.00462e99
pop ecx
push 0x6895cc
call fcn.0047ff57
pop ecx
test eax, eax
je 0x47e180
cmp dword [ebx + 0x28], 0xffffffff
je 0x47e1a1
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebx + 0x28]
jl 0x47e1a1
mov dword [ebx + 0xc], 0xffffffff
mov dword [ebx + 8], str.Timeout
push edi
push 0x6895cc
call fcn.00480502
add esp, 8
jmp 0x47e235
mov esi, 1
jmp 0x47e1c6
mov dword [ebx + 0xc], 0xffffffff
mov dword [ebx + 8], str.Timeout
push edi
push 0x6895cc
call fcn.00480502
add esp, 8
jmp 0x47e235
cmp edi, dword [ebp - 8]
jge 0x47e1d3
test esi, esi
jg 0x47e0ff
mov dword [ebx + 0x20], edi
test esi, esi
jne 0x47e1f8
mov dword [ebx + 0xc], 0xfffffffe
mov dword [ebx + 8], str.Connection_closed
push esi
push 0x6895cc
call fcn.00480502
add esp, 8
jmp 0x47e235
test esi, esi
jge 0x47e227
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [ebx + 0xc], eax
push dword [ebx + 0xc]
call fcn.004c2d52
pop ecx
mov dword [ebx + 8], eax
push 0
call sub.WSOCK32.DLL_WSASetLastError
push esi
push 0x6895cc
call fcn.00480502
add esp, 8
jmp 0x47e235
push edi
push 0x6895cc
call fcn.00480502
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47eb1e
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
push 1
push 0x47d6c2
call fcn.00463d94
add esp, 8
mov ebx, eax
push 0x400
push 2
call sym.SISCOM.EXE__hb_param
add esp, 8
mov esi, eax
test ebx, ebx
je 0x47eb59
cmp dword [ebx], 0xf0123a42
jne 0x47eb59
test esi, esi
jne 0x47eb8f
push 3
call sym.SISCOM.EXE__hb_paramError
pop ecx
push eax
push 2
call sym.SISCOM.EXE__hb_paramError
pop ecx
push eax
push 1
call sym.SISCOM.EXE__hb_paramError
pop ecx
push eax
push 3
push dword [ebp + 8]
push 0
push 0xbc4
push 1
call fcn.00461828
add esp, 0x20
jmp 0x47ec93
push esi
call fcn.0047fcae
pop ecx
mov dword [ebp - 4], eax
push esi
call fcn.0047fcca
pop ecx
mov dword [ebp - 8], eax
push 0x1a
push 3
call sym.SISCOM.EXE__hb_param
add esp, 8
test eax, eax
je 0x47ebc5
push 3
call sym.SISCOM.EXE__hb_parni
pop ecx
mov esi, eax
cmp esi, dword [ebp - 8]
jge 0x47ebc5
mov dword [ebp - 8], esi
xor edi, edi
xor eax, eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], 0x672faf
xor esi, esi
cmp edi, dword [ebp - 8]
jge 0x47ec6d
cmp dword [ebp + 0xc], 1
jne 0x47ebfd
mov eax, dword [ebp - 8]
sub eax, edi
cmp eax, dword [ebx + 0x30]
jge 0x47ebf5
mov edx, dword [ebp - 8]
sub edx, edi
jmp 0x47ebf8
mov edx, dword [ebx + 0x30]
mov dword [ebp - 0xc], edx
jmp 0x47ec03
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
xor esi, esi
push ebx
call fcn.0047d343
pop ecx
test eax, eax
je 0x47ec25
push 0
push dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, edi
push eax
push dword [ebx + 4]
call sub.WSOCK32.DLL_send
mov esi, eax
test esi, esi
jle 0x47ec2d
add edi, esi
jmp 0x47ec5e
test esi, esi
jne 0x47ec41
mov dword [ebx + 0xc], 0xffffffff
mov dword [ebx + 8], str.Timeout
jmp 0x47ec6d
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [ebx + 0xc], eax
push dword [ebx + 0xc]
call fcn.004c2d52
pop ecx
mov dword [ebx + 8], eax
push 0
call sub.WSOCK32.DLL_WSASetLastError
jmp 0x47ec6d
cmp dword [ebp + 0xc], 0
je 0x47ec6d
cmp edi, dword [ebp - 8]
jl 0x47ebde
mov dword [ebx + 0x20], edi
test esi, esi
jle 0x47ec84
push edi
push 0x6895cc
call fcn.00480502
add esp, 8
jmp 0x47ec93
push 0xffffffffffffffff
push 0x6895cc
call fcn.00480502
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c1c36
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], edx
test eax, eax
jne 0x4c1c4b
xor eax, eax
jmp 0x4c1c81
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.00437224
add esp, 8
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4c1c67
test al, 0x50
je 0x4c1c6b
xor ebx, ebx
jmp 0x4c1c70
mov ebx, 1
cmp dword [ebp - 4], 0
je 0x4c1c7f
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret
Function at 0x4c9238
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 0x30]
jmp 0x4c93f6
cmp byte [ebx], 0x5c
jne 0x4c928c
inc ebx
cmp byte [ebx], 0
jne 0x4c925f
or eax, 0xffffffff
jmp 0x4c9402
cmp byte [ebx], 0x51
jne 0x4c93f5
inc ebx
cmp byte [ebx], 0
je 0x4c9273
cmp byte [ebx], 0x5c
jne 0x4c9268
cmp byte [ebx], 0
jne 0x4c9280
or eax, 0xffffffff
jmp 0x4c9402
inc ebx
cmp byte [ebx], 0x45
je 0x4c93f5
jmp 0x4c9268
cmp byte [ebx], 0x5b
jne 0x4c9338
xor esi, esi
inc ebx
xor eax, eax
mov al, byte [ebx]
cmp eax, 0x5c
jne 0x4c92c6
cmp byte [ebx + 1], 0x45
jne 0x4c92aa
inc ebx
jmp 0x4c9297
push 3
push 0x67c431
lea edx, [ebx + 1]
push edx
call fcn.004d4b24
add esp, 0xc
test eax, eax
jne 0x4c92d6
add ebx, 3
jmp 0x4c9297
test esi, esi
jne 0x4c92d6
cmp eax, 0x5e
jne 0x4c92d6
mov esi, 1
jmp 0x4c9297
cmp byte [ebx + 1], 0x5d
jne 0x4c932d
mov eax, dword [ebp + 0xc]
test byte [eax + 0x43], 2
jne 0x4c932d
inc ebx
jmp 0x4c932d
cmp byte [ebx], 0
jne 0x4c92f5
or eax, 0xffffffff
jmp 0x4c9402
cmp byte [ebx], 0x5c
jne 0x4c932d
inc ebx
cmp byte [ebx], 0
jne 0x4c9308
or eax, 0xffffffff
jmp 0x4c9402
cmp byte [ebx], 0x51
jne 0x4c932d
inc ebx
cmp byte [ebx], 0
je 0x4c9318
cmp byte [ebx], 0x5c
jne 0x4c930d
cmp byte [ebx], 0
jne 0x4c9325
or eax, 0xffffffff
jmp 0x4c9402
inc ebx
cmp byte [ebx], 0x45
je 0x4c932d
jmp 0x4c930d
inc ebx
cmp byte [ebx], 0x5d
jne 0x4c92e8
jmp 0x4c93f5
cmp dword [ebp + 0x18], 0
je 0x4c935f
cmp byte [ebx], 0x23
jne 0x4c935f
inc ebx
cmp byte [ebx], 0
je 0x4c934e
cmp byte [ebx], 0xa
jne 0x4c9343
cmp byte [ebx], 0
jne 0x4c93f5
or eax, 0xffffffff
jmp 0x4c9402
cmp byte [ebx], 0x28
jne 0x4c93f5
cmp byte [ebx + 1], 0x3f
je 0x4c9384
cmp byte [ebx + 1], 0x2a
je 0x4c9384
inc edi
cmp dword [ebp + 0x10], 0
jne 0x4c93f5
cmp edi, dword [ebp + 0x14]
jne 0x4c93f5
mov eax, edi
jmp 0x4c9402
add ebx, 2
cmp byte [ebx], 0x50
jne 0x4c938d
inc ebx
cmp byte [ebx], 0x3c
jne 0x4c939e
cmp byte [ebx + 1], 0x21
je 0x4c939e
cmp byte [ebx + 1], 0x3d
jne 0x4c93a3
cmp byte [ebx], 0x27
jne 0x4c93f5
inc edi
cmp dword [ebp + 0x10], 0
jne 0x4c93b3
cmp edi, dword [ebp + 0x14]
jne 0x4c93b3
mov eax, edi
jmp 0x4c9402
xor eax, eax
mov al, byte [ebx]
inc ebx
cmp eax, 0x3c
jne 0x4c93c2
mov eax, 0x3e
mov edx, ebx
jmp 0x4c93c7
inc ebx
xor ecx, ecx
mov cl, byte [ebx]
cmp eax, ecx
jne 0x4c93c6
cmp dword [ebp + 0x10], 0
je 0x4c93f5
mov eax, ebx
sub eax, edx
cmp eax, dword [ebp + 0x14]
jne 0x4c93f5
push dword [ebp + 0x14]
push edx
push dword [ebp + 0x10]
call fcn.004d4b24
add esp, 0xc
test eax, eax
jne 0x4c93f5
mov eax, edi
jmp 0x4c9402
inc ebx
cmp byte [ebx], 0
jne 0x4c924c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d4488
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4d5cbc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x4d5cdb
mov eax, dword [0x68445c]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4d5ce8
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4d5d15
je 0x4d5d27
sub ecx, 0x100
je 0x4d5d35
sub ecx, 0x100
je 0x4d5d3c
sub ecx, 0x100
je 0x4d5d2e
jmp 0x4d5d43
sub ecx, 0x600
je 0x4d5d3c
sub ecx, 0x100
je 0x4d5d27
jmp 0x4d5d43
mov edi, 1
jmp 0x4d5d48
mov edi, 2
jmp 0x4d5d48
mov edi, 4
jmp 0x4d5d48
mov edi, 5
jmp 0x4d5d48
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4d5d6f
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x683ed4]
test al, 0x80
je 0x4d5d68
mov ebx, 0x80
jmp 0x4d5d81
mov ebx, 1
jmp 0x4d5d81
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4d5d81
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4d5d93
je 0x4d5d9c
dec eax
je 0x4d5da5
jmp 0x4d5dae
mov dword [ebp - 4], getpeername
jmp 0x4d5dbd
mov dword [ebp - 4], 0x40000000
jmp 0x4d5dbd
mov dword [ebp - 4], 0xc0000000
jmp 0x4d5dbd
push 1
call fcn.004d6e40
pop ecx
mov ebx, eax
jmp 0x4d5ead
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4d5dd9
sub eax, 0x10
je 0x4d5de0
sub eax, 0x10
je 0x4d5de9
sub eax, 0x10
je 0x4d5df2
jmp 0x4d5df2
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4d5df9
mov dword [ebp - 8], 1
jmp 0x4d5df9
mov dword [ebp - 8], 2
jmp 0x4d5df9
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4d5e66
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4d5e5b
test byte [ebp + 0xd], 1
je 0x4d5e56
mov ebx, 0x50
jmp 0x4d5e5b
mov ebx, 2
push ebx
call fcn.004d6e40
pop ecx
mov ebx, eax
jmp 0x4d5ead
mov edi, esi
push edi
call fcn.004d5c2c
pop ecx
test eax, eax
je 0x4d5e7a
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4d5e86
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004d6b84
add esp, 8
mov ebx, eax
inc eax
jne 0x4d5ead
push 4
call fcn.004d6e40
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d6314
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [ebp + 8]
lea edx, [ebp - 3]
add al, 0x40
mov byte [ebp - 3], al
mov byte [ebp - 2], 0x3a
mov byte [ebp - 1], 0
push edx
call sub.KERNEL32.DLL_SetCurrentDirectoryA
dec eax
je 0x4d633c
call fcn.004d6ea4
pop ecx
pop ebp
ret
xor eax, eax
pop ecx
pop ebp
ret

Function at 0x4d6344
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push 0x104
call fcn.004d3a40
pop ecx
mov esi, eax
test eax, eax
jne 0x4d6367
mov dword [0x685410], 8
or eax, 0xffffffff
jmp 0x4d63ab
push esi
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
je 0x4d6358
cmp eax, 0x104
jg 0x4d6358
movsx ebx, byte [esi]
cmp byte [esi + 1], 0x3a
jne 0x4d63a2
mov edi, ebx
push edi
call fcn.004d83f0
pop ecx
mov ebx, eax
cmp ebx, 0x41
jl 0x4d63a0
cmp ebx, 0x5a
jg 0x4d63a0
add ebx, 0xffffffc0
jmp 0x4d63a2
xor ebx, ebx
push esi
call fcn.004d3a50
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x4d6970
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.004d3a40
pop ecx
mov ebx, eax
test eax, eax
jne 0x4d6994
xor eax, eax
jmp 0x4d6a3d
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
mov esi, eax
test esi, esi
je 0x4d69b5
cmp esi, 0x104
jb 0x4d69c0
push ebx
call fcn.004d3a50
pop ecx
xor eax, eax
jmp 0x4d6a3d
cmp byte [ebx + 1], 0x3a
jne 0x4d69f0
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jae 0x4d69f0
push ebx
call fcn.004d3a50
pop ecx
xor eax, eax
jmp 0x4d6a3d
inc esi
test edi, edi
je 0x4d6a33
cmp esi, dword [ebp + 0x10]
jbe 0x4d6a05
push ebx
call fcn.004d3a50
pop ecx
xor eax, eax
jmp 0x4d6a3d
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.004d3a50
pop ecx
mov eax, edi
jmp 0x4d6a3d
push esi
push ebx
call fcn.004d3a60
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4d6a44
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x4d6a89
lea eax, [ebp - 0x10c]
push eax
push 0x103
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test eax, eax
je 0x4d6a78
cmp eax, dword [ebp + 0x10]
jle 0x4d6b12
mov dword [0x685410], 8
xor eax, eax
jmp 0x4d6b7d
cmp dword [0x690ce4], 1
jne 0x4d6ace
mov eax, ebx
lea ecx, [ebp - 0x10c]
mov edx, eax
add dl, 0x40
add ecx, 3
mov byte [ebp - 0x10c], dl
mov dl, al
mov byte [ebp - 0x10b], 0x3a
mov byte [ebp - 0x10a], 0x5c
mov byte [ebp - 0x109], 0
mov ah, 0x47
mov esi, ecx
int 0x21
jae 0x4d6b12
xor eax, eax
jmp 0x4d6b7d
call sub.KERNEL32.DLL_GetLogicalDrives
lea ecx, [ebx - 1]
mov edx, 1
shl edx, cl
test edx, eax
je 0x4d6b0e
add bl, 0x40
lea eax, [ebp - 8]
mov byte [ebp - 4], bl
lea edx, [ebp - 0x10c]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x2e
mov byte [ebp - 1], 0
push eax
push edx
lea ecx, [ebp - 4]
push 0x103
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
jmp 0x4d6b12
xor eax, eax
jmp 0x4d6b7d
lea edx, [ebp - 0x10c]
push edx
call fcn.004d4a58
pop ecx
cmp eax, dword [ebp + 0x10]
jl 0x4d6b32
mov dword [0x685410], 0x22
xor eax, eax
jmp 0x4d6b7d
test edi, edi
jne 0x4d6b54
mov edx, dword [ebp + 0x10]
push edx
call fcn.004d3a40
pop ecx
mov edi, eax
test eax, eax
jne 0x4d6b54
mov dword [0x685410], 8
xor eax, eax
jmp 0x4d6b7d
push edi
mov esi, edi
xor eax, eax
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4db4dc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x4db53e
call fcn.004db48c
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004d4a58
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004d4a58
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4db59c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x685418], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4db676
cmp dword [0x685414], 0
jne 0x4db676
cmp dword [0x68567c], 0
je 0x4db630
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004db36c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4db616
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004db36c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4db616
lea ebx, [ebp - 0x84]
jmp 0x4db617
inc ebx
call fcn.004db558
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4db6b1
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x68541c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004d4a58
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x68541f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4db6b1
cmp dword [0x685414], 0
je 0x4db690
cmp dword [0x685414], 0xffffffff
je 0x4db6b1
push esi
call dword [0x685414]
pop ecx
mov eax, dword [0x685418]
test eax, eax
je 0x4db6b1
cmp dword [0x685418], 0xffffffff
je 0x4db6b1
cmp byte [eax], 0
je 0x4db6b1
push esi
push eax
call fcn.004db4dc
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dc8a0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x690d04], 0
jne 0x4dc921
cmp dword [0x690d24], 0
jne 0x4dc8d0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x690d24], eax
test eax, eax
jne 0x4dc8d0
push str.GetEnvironmentStrings_failed
call fcn.004db6c8
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x690d24]
jmp 0x4dc8e4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004d4a58
pop ecx
mov edi, eax
test eax, eax
jne 0x4dc8dc
lea edi, [ebp + 1]
push edi
call fcn.004d3a40
pop ecx
mov ebx, eax
mov dword [0x690d08], ebx
test ebx, ebx
jne 0x4dc90e
xor eax, eax
jmp 0x4dc9e4
push edi
mov edx, dword [0x690d24]
push edx
push ebx
call fcn.004d4838
add esp, 0xc
jmp 0x4dc941
xor esi, esi
mov ebx, dword [0x690d04]
jmp 0x4dc93b
push eax
call fcn.004d4a58
pop ecx
test eax, eax
jne 0x4dc937
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4dc92b
lea ebx, [esi + 4]
push 4
mov dword [0x690d0c], ebx
inc ebx
push ebx
call fcn.004d35fc
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4dc964
xor eax, eax
jmp 0x4dc9e4
cmp dword [0x690d04], 0
jne 0x4dc995
xor esi, esi
mov ebx, dword [0x690d08]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4dc986
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004d4a58
pop ecx
mov edi, eax
test eax, eax
jne 0x4dc97c
jmp 0x4dc9c6
xor esi, esi
mov ebx, dword [0x690d04]
mov eax, dword [esp]
mov edi, eax
jmp 0x4dc9c0
push eax
call fcn.004d4a58
pop ecx
test eax, eax
je 0x4dc9b5
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4dc9b9
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4dc9a4
mov eax, dword [0x690d04]
test eax, eax
je 0x4dc9d6
push eax
call fcn.004d3a50
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x690d04], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret