joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c3a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 0x10
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x47c3ba
cmp edx, 0xffffffff
je 0x47c571
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [ebx + 0x78], 0
jle 0x47c570
xor ecx, ecx
xor eax, eax
mov dword [ebp - 8], ecx
push edi
mov edi, dword [ebx + 0x74]
add edi, ecx
cmp dword [edi + 0x38], 0
je 0x47c55b
mov eax, dword [edi + 0x20]
cmp eax, 0xffffffff
je 0x47c558
cmp dword [edi + 0x54], 0
jne 0x47c558
test esi, esi
je 0x47c455
push esi
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x47c555
mov edx, dword [esi]
xor eax, eax
test edx, edx
je 0x47c45d
mov ecx, dword [ebp + 0xc]
mov esi, dword [edi + 0x20]
add ecx, 4
cmp dword [ecx], esi
je 0x47c42e
inc eax
add ecx, 4
cmp eax, edx
jb 0x47c420
jmp 0x47c45d
mov esi, dword [ebp + 0xc]
lea ecx, [edx - 1]
cmp eax, ecx
jae 0x47c451
lea edx, [esi + 4]
lea edx, [edx + eax*4]
nop
mov ecx, dword [edx + 4]
lea edx, [edx + 4]
mov dword [edx - 4], ecx
inc eax
mov ecx, dword [esi]
dec ecx
cmp eax, ecx
jb 0x47c440
dec dword [esi]
jmp 0x47c45d
cmp eax, edx
jne 0x47c558
mov eax, dword [edi + 0x38]
xor ecx, ecx
test eax, eax
je 0x47c46e
mov eax, dword [eax + 0x10]
inc ecx
test eax, eax
jne 0x47c466
lea eax, [ecx*8]
push eax
call dword [0x501144]
mov esi, eax
add esp, 4
test esi, esi
je 0x47c504
mov ecx, dword [edi + 0x38]
xor edx, edx
test ecx, ecx
je 0x47c4a6
mov eax, dword [ecx]
mov dword [esi + edx*8], eax
mov eax, dword [ecx + 4]
mov dword [esi + edx*8 + 4], eax
inc edx
mov ecx, dword [ecx + 0x10]
test ecx, ecx
jne 0x47c492
mov ecx, dword [ebx + 0x91b8]
mov eax, dword [edi + 0x20]
test ecx, ecx
je 0x47c4c6
push dword [ebx + 0x91bc]
push edx
push esi
push eax
mov eax, dword [ecx + 0x10]
call eax
add esp, 0x10
jmp 0x47c4d1
push edx
push esi
push eax
call fcn.0047ee80
add esp, 0xc
push esi
mov edi, eax
call dword [0x50114c]
add esp, 4
test edi, edi
jns 0x47c501
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xb
je 0x47c552
cmp eax, 0x2733
je 0x47c552
push dword [ebp + 0x14]
push dword [ebp - 4]
push ebx
call fcn.0047b190
jmp 0x47c54f
push edi
jmp 0x47c546
mov eax, dword [edi + 0x38]
mov esi, dword [ebx + 0x91b8]
mov edx, dword [edi + 0x20]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
test esi, esi
je 0x47c536
push dword [ebx + 0x91bc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push 1
push eax
mov dword [ebp - 0xc], ecx
mov eax, dword [esi + 0x10]
push edx
call eax
add esp, 0x10
jmp 0x47c541
push 0
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x47c4e1
push eax
push dword [ebp - 4]
push ebx
call fcn.0047aaf0
add esp, 0xc
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
add dword [ebp - 8], 0x58
inc eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], eax
cmp eax, dword [ebx + 0x78]
jl 0x47c3d7
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47cc90
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x501040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
test dword [esi + 0x14], 0x100
lea ebx, [esi + 0x14]
je 0x47ccc9
push str.CARES_HOSTS
call fcn.004ae5b7
add esp, 4
test eax, eax
jne 0x47cd9b
mov byte [ebp - 0x108], 0
call fcn.0047d330
cmp eax, 3
jne 0x47cd50
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47cd6b
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.DatabasePath
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x104
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47cd6b
cmp eax, 2
jne 0x47ce73
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x108]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x47cd72
mov eax, dword [str.hosts]
mov dword [ecx], eax
mov ax, word [0x4e6c70]
mov word [ecx + 4], ax
mov al, byte [0x4e6c72]
mov byte [ecx + 6], al
lea eax, [ebp - 0x108]
push edi
push 0x4e6c74
push eax
call fcn.004aba15
mov edi, eax
add esp, 8
test edi, edi
jne 0x47cdd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
mov ecx, 1
cmp ecx, eax
sbb eax, eax
and eax, 0xa
add eax, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472b2a
mov esp, ebp
pop ebp
ret
push dword [esi + 0x30]
movzx eax, word [esi + 8]
push ebx
push eax
push dword [esi + 4]
push edi
call fcn.0047f970
push edi
mov dword [ebp - 0x210], eax
call fcn.004a71d2
mov eax, dword [ebp - 0x210]
add esp, 0x18
cmp eax, 4
jne 0x47cdc8
mov edi, dword [esi + 4]
mov edx, str.localhost
mov ecx, edi
nop
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x47ce30
test al, al
je 0x47ce2c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x47ce30
add ecx, 2
add edx, 2
test al, al
jne 0x47ce10
xor eax, eax
jmp 0x47ce35
sbb eax, eax
or eax, 1
test eax, eax
jne 0x47ce5c
push dword [esi + 0x30]
movzx eax, word [esi + 8]
push ebx
push eax
push edi
call fcn.0047fe80
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472b2a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x210]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472b2a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 4
pop esi
xor ecx, ebp
pop ebx
call fcn.00472b2a
mov esp, ebp
pop ebp
ret
Function at 0x47dc30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 2
jne 0x47dc40
lea ecx, [eax + 2]
jmp 0x47dc48
cmp eax, 0x17
jne 0x47dca3
lea ecx, [eax - 7]
push esi
sub eax, 2
je 0x47dc71
sub eax, 0x15
je 0x47dc63
push 0x273f
call dword [sym.imp.KERNEL32.dll_SetLastError]
or esi, 0xffffffff
jmp 0x47dc87
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0047e1a0
jmp 0x47dc7d
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0047de20
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
jne 0x47dc97
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x47dc97
xor eax, eax
pop esi
pop ebp
ret
sar esi, 0x1f
and esi, 0xfffffffe
lea eax, [esi + 1]
pop esi
pop ebp
ret
push 0x273f
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop ebp
ret

Function at 0x47e9b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
cmp dword [ebp + 0x10], edi
jle 0x47ea24
push ebx
movzx ebx, cl
push esi
movzx ecx, dl
inc bl
mov dh, bl
movzx ebx, dh
mov dl, byte [ebx + eax]
add cl, dl
movzx esi, cl
mov byte [ebp + 0xb], cl
mov dword [ebp - 4], esi
movzx ecx, byte [esi + eax]
mov byte [ebx + eax], cl
mov byte [esi + eax], dl
movzx ecx, byte [ebx + eax]
mov esi, dword [ebp + 0xc]
add cl, dl
movzx ecx, cl
movzx ecx, byte [ecx + eax]
xor byte [edi + esi], cl
inc edi
mov ecx, dword [ebp - 4]
cmp edi, dword [ebp + 0x10]
jl 0x47e9d3
mov cl, byte [ebp + 0xb]
pop esi
pop ebx
mov byte [eax + 0x100], dh
mov byte [eax + 0x101], cl
pop edi
mov esp, ebp
pop ebp
ret
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x47ee80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jg 0x47eea3
push 0x2726
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
push esi
test edi, edi
jle 0x47ef4b
mov esi, dword [ebp + 0xc]
add esi, 4
mov edx, esi
mov eax, bind
sub eax, ebx
cmp dword [edx], eax
ja 0x47ef36
add ebx, dword [edx]
inc ecx
add edx, 8
mov dword [ebp + 0x10], ebx
cmp ecx, edi
jl 0x47eeb6
test ebx, ebx
je 0x47ef4b
push ebx
call dword [0x501144]
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x47eef5
push 0xc
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, eax
push dword [esi]
push dword [esi - 4]
push ebx
call fcn.0049d280
add ebx, dword [esi]
lea esi, [esi + 8]
add esp, 0xc
sub edi, 1
jne 0x47eef7
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp - 4]
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
push edi
mov esi, eax
call dword [0x50114c]
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x2726
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47f480
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
movzx ecx, word [ebx]
mov eax, ecx
sub eax, 2
je 0x47f4a4
sub eax, 0x15
je 0x47f49b
xor eax, eax
pop ebx
pop ebp
ret
mov dword [ebp + 0xc], 0x1c
jmp 0x47f4ab
mov dword [ebp + 0xc], 0x10
push esi
push edi
mov edi, dword [ebp + 8]
push 0x11
push 2
push ecx
push edi
call fcn.0047ac50
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x47f4e0
call fcn.004a7890
pop edi
pop esi
pop ebx
mov eax, dword [eax]
sub eax, 0x273f
neg eax
sbb eax, eax
pop ebp
ret
push dword [ebp + 0xc]
push ebx
push esi
push edi
call fcn.0047abb0
add esp, 0x10
cmp eax, 0xffffffff
jne 0x47f511
call fcn.004a7890
cmp dword [eax], 0x2714
je 0x47f4e0
push esi
push edi
call fcn.0047ab80
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
push esi
push edi
test eax, eax
je 0x47f535
call fcn.0047ab80
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.0047ab80
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x48aa40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x501040]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
push str.Unspecified_error.
call fcn.00481d70
add esp, 4
push 0x44
push 0
lea eax, [ebp - 0x268]
push eax
call fcn.0049cfc0
add esp, 0xc
mov dword [ebp - 0x268], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x224]
push ecx
call fcn.0049cfc0
add esp, 0xc
mov dx, word [0x4e7538]
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call fcn.0049cfc0
add esp, 0xc
push 0x4e822c
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004af441
add esp, 0xc
push 0
mov ecx, dword [ebp - 0x210]
add ecx, 0x9c
call fcn.00484560
push eax
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.004af441
add esp, 0xc
push 0x4e8230
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.004af441
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x20c]
push edx
call fcn.004af441
add esp, 0xc
push 0x4e822c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.004af441
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x268]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x210]
add ecx, 0x9c
call fcn.00485370
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x220], 0
je 0x48aba4
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x220], 0
cmp dword [ebp - 0x214], 0
jne 0x48abc1
push 0x4e8238
call fcn.00481d70
add esp, 4
mov eax, 1
jmp 0x48ac15
cmp dword [ebp + 0xc], 0
je 0x48abdc
push 0xffffffffffffffff
mov edx, dword [ebp - 0x210]
mov eax, dword [edx + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0x10], 0
je 0x48abef
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x224]
mov dword [ecx], edx
jmp 0x48ac06
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x224], 0
push 0x4e6f8c
call fcn.00481d70
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472b2a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4977f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6ba3
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x501040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
call fcn.00499040
push 1
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x49784e
mov eax, 1
jmp 0x49789c
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x228]
call fcn.00483b60
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x224], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x224]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.004913d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00483d70
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472b2a
mov esp, ebp
pop ebp
ret
Function at 0x4981e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6d58
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x501040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00483c00
mov byte [ebp - 4], 1
push 0
lea ecx, [ebp + 0xc]
call fcn.00485370
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4982f9
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 0
lea ecx, [ebp + 0xc]
call fcn.00485370
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4982f9
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0x4e7558
mov edx, dword [ebp - 0x24]
push edx
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x10]
shr ecx, 0x10
and ecx, 0xffff
mov word [ebp - 0x1c], cx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x10]
and eax, 0xffff
mov word [ebp - 0x18], ax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x14]
shr edx, 0x10
and edx, 0xffff
mov word [ebp - 0x14], dx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x14]
and ecx, 0xffff
mov word [ebp - 0x10], cx
movzx edx, word [ebp - 0x10]
push edx
movzx eax, word [ebp - 0x14]
push eax
movzx ecx, word [ebp - 0x18]
push ecx
movzx edx, word [ebp - 0x1c]
push edx
push str._u._u._u._u
lea eax, [ebp - 0x28]
push eax
call fcn.00491bb0
add esp, 0x18
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp + 8]
call fcn.00490e10
mov eax, dword [ebp - 0x30]
or eax, 1
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00483d70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00483d70
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x498350
Capabilities:
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6d8b
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x501040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00483c00
mov byte [ebp - 4], 1
push 0
push 0x3a
lea ecx, [ebp + 8]
call fcn.00499080
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x4983a6
mov eax, dword [ebp - 0x18]
add eax, 2
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x5c
lea ecx, [ebp + 8]
call fcn.00499080
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x4983d1
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.004913d0
jmp 0x498406
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp + 8]
call fcn.004922e0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004913d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00483d70
push 0
lea ecx, [ebp - 0x14]
call fcn.00485370
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x498454
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x498454
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00483d70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00483d70
mov eax, dword [ebp - 0x2c]
jmp 0x4984d0
lea ecx, [ebp - 0x14]
call fcn.00485370
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
and edx, 0x10
jne 0x498495
mov dword [ebp - 0x34], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00483d70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00483d70
mov eax, dword [ebp - 0x34]
jmp 0x4984d0
cmp dword [ebp - 0x10], 0xffffffff
jne 0x49849d
jmp 0x4984ab
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x4983ac
mov dword [ebp - 0x38], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00483d70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00483d70
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x499200
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 0x10], 0
je 0x499218
mov dword [ebp - 8], 1
jmp 0x49921f
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
xor ecx, ecx
jne 0x499225
cmp dword [ebp - 0x14], 0
jne 0x499239
push 0x80004005
call fcn.004844b0
xor edx, edx
jne 0x499209
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x499380
cmp dword [ebp + 8], 0
je 0x499380
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jbe 0x49936f
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jbe 0x499355
cmp dword [ebp - 4], 2
jbe 0x4992a6
cmp dword [ebp - 4], 7
je 0x4992eb
jmp 0x499355
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x4992cb
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + eax*2 - 2]
test edx, edx
je 0x4992e6
mov eax, 2
imul ecx, eax, 0
xor edx, edx
mov eax, dword [ebp + 8]
mov word [eax + ecx], dx
mov eax, 0xd
jmp 0x499383
jmp 0x49936d
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x49933b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
cmp eax, 1
jb 0x49933b
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shr edx, 1
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
jne 0x49933b
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 1
cmp eax, 1
jbe 0x499353
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shr edx, 1
mov eax, dword [ebp + 8]
movzx ecx, word [eax + edx*2 - 4]
test ecx, ecx
je 0x499353
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 8]
mov word [edx + eax], cx
mov eax, 0xd
jmp 0x499383
jmp 0x49936d
mov eax, 2
imul ecx, eax, 0
xor edx, edx
mov eax, dword [ebp + 8]
mov word [eax + ecx], dx
mov eax, 0xd
jmp 0x499383
jmp 0x499380
mov ecx, 2
imul edx, ecx, 0
xor eax, eax
mov ecx, dword [ebp + 8]
mov word [ecx + edx], ax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49a030
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6eb8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x501040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00483c00
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00483a30
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 8], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x49a2f0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
xor edx, edx
div dword [ecx + 8]
mov eax, dword [ebp + 8]
sub eax, edx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
push 6
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 8]
add ecx, 0x18
call fcn.0049bb00
mov edx, dword [ebp - 4]
mov dword [eax], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x4b0609
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4eb37c
push 0x4eb374
push str.FlsAlloc
push 0x1f
call fcn.004b0434
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b063d
push dword [ebp + 8]
mov ecx, esi
call dword [0x4c842c]
call esi
jmp 0x4b0643
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4b0687
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4eb38c
push 0x4eb384
push str.FlsGetValue
push 0x21
call fcn.004b0434
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b06be
push dword [ebp + 8]
mov ecx, esi
call dword [0x4c842c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4b06c6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4eb394
push 0x4eb38c
push str.FlsSetValue
push 0x22
call fcn.004b0434
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b0700
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4c842c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]