joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8000
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x414
mov eax, dword [0x5094b0]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push esi
push edi
push 0x3ff
lea eax, [esp + 0x1d]
mov esi, ecx
push 0
push eax
mov dword [esp + 0x18], esi
mov byte [esp + 0x24], 0
call fcn.004e82d0
movzx eax, word [esi]
mov ecx, 0x5a4d
add esp, 0xc
mov dword [esp + 0x10], 0
cmp ax, cx
je 0x4c808b
movzx edx, ax
push edx
push str.dos_magic___x
lea eax, [esp + 0x20]
push eax
call fcn.004e63fa
lea ecx, [esp + 0x24]
add esp, 0xc
push ecx
call fcn.004c83d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.004e6204
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
je 0x4c80d3
push 0x5a4d
lea edx, [esp + 0x1c]
push str.nt_sign___x
push edx
call fcn.004e63fa
lea eax, [esp + 0x24]
add esp, 0xc
push eax
call fcn.004c83d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.004e6204
mov esp, ebp
pop ebp
ret
movzx ebx, word [eax + 6]
lea edi, [eax + 0x108]
xor esi, esi
mov dword [esp + 0x14], edi
test ebx, ebx
jle 0x4c8143
mov ecx, str..text
mov eax, edi
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4c8110
test dl, dl
je 0x4c810c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4c8110
add eax, 2
add ecx, 2
test dl, dl
jne 0x4c80f0
xor eax, eax
jmp 0x4c8115
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4c812d
inc esi
add edi, 0x28
cmp esi, ebx
jl 0x4c80e7
push 0
push str.update_PointerToRawData___d
jmp 0x4c805a
mov edx, dword [esp + 0x14]
lea ecx, [esi + esi*4]
mov edi, dword [edx + ecx*8 + 0x14]
mov esi, dword [edx + ecx*8 + 0x10]
lea eax, [edx + ecx*8]
test edi, edi
jne 0x4c814f
push 0
push str.update_PointerToRawData___d
jmp 0x4c805a
test esi, esi
jne 0x4c8158
mov esi, 0x3e8
push esi
push edi
lea edx, [esp + 0x20]
push str.code_begin__x___x
push edx
call fcn.004e63fa
lea eax, [esp + 0x28]
push eax
call fcn.004c83d0
add esp, 0x14
xor eax, eax
test esi, esi
jbe 0x4c81c2
mov ecx, dword [esp + 0xc]
add ecx, edi
mov dl, 0xcc
cmp byte [ecx + eax], dl
jne 0x4c81b3
cmp byte [ecx + eax + 1], dl
jne 0x4c81b3
cmp byte [ecx + eax + 2], dl
jne 0x4c81b3
cmp byte [ecx + eax + 3], dl
jne 0x4c81b3
cmp byte [ecx + eax + 4], dl
jne 0x4c81b3
cmp byte [ecx + eax + 5], dl
jne 0x4c81b3
cmp byte [ecx + eax + 6], dl
jne 0x4c81b3
cmp byte [ecx + eax + 7], dl
je 0x4c81be
inc eax
cmp eax, esi
jb 0x4c8184
mov edi, dword [esp + 0x10]
jmp 0x4c81c4
add edi, eax
jmp 0x4c81c4
mov edi, eax
push edi
lea edx, [esp + 0x1c]
push str.code_flag__x
push edx
call fcn.004e63fa
lea eax, [esp + 0x24]
add esp, 0xc
push eax
call fcn.004c83d0
add esp, 4
test edi, edi
je 0x4c81f6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0xc]
mov dword [ecx + edi + 2], eax
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004e6204
mov esp, ebp
pop ebp
ret
Function at 0x4c8210
Capabilities:
Acquire debug privileges
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a4
mov eax, dword [0x5094b0]
xor eax, esp
mov dword [esp + 0x1a0], eax
push esi
push 0xff
lea eax, [esp + 0xa5]
push 0
push eax
mov byte [esp + 0xac], 0
call fcn.004e82d0
add esp, 0xc
push 0x94
lea ecx, [esp + 0xc]
push 0
push ecx
call fcn.004e82d0
add esp, 0xc
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0xc], 5
jbe 0x4c8296
mov esi, str.SeDebugPrivilege
call fcn.004c8810
mov esi, str.SeRestorePrivilege
call fcn.004c8810
mov esi, str.SeBackupPrivilege
call fcn.004c8810
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0xa8]
push str.os_version__d._d
push edx
call fcn.004e63fa
lea eax, [esp + 0xb0]
push eax
call fcn.004c83d0
mov ecx, dword [esp + 0x1b8]
mov eax, dword [esp + 0x20]
add esp, 0x14
pop esi
xor ecx, esp
call fcn.004e6204
mov esp, ebp
pop ebp
ret

Function at 0x4c8340
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
mov eax, dword [0x5094b0]
xor eax, esp
mov dword [esp + 0x100], eax
push 0xff
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.004e82d0
add esp, 0xc
push 0
push 0x1a
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c8384
sub eax, edx
cmp byte [esp + eax - 1], 0x5c
push esi
jne 0x4c83a1
lea edx, [esp + 4]
push edx
push 0x500648
jmp 0x4c83ab
lea eax, [esp + 4]
push eax
push str._s_s
push edi
call fcn.004e63fa
mov ecx, dword [esp + 0x110]
add esp, 0x10
xor ecx, esp
mov eax, 1
call fcn.004e6204
add esp, 0x104
ret
Function at 0x4c83d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x420
mov eax, dword [0x5094b0]
xor eax, esp
mov dword [esp + 0x41c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x42c]
push esi
push edi
xor ebx, ebx
xor eax, eax
push 0x1ff
lea ecx, [esp + 0x22d]
push ebx
push ecx
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], ax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov word [esp + 0x2e], ax
mov byte [esp + 0x234], bl
call fcn.004e82d0
push 0xff
lea edx, [esp + 0x139]
push ebx
push edx
mov byte [esp + 0x140], bl
call fcn.004e82d0
push 0xff
lea eax, [esp + 0x45]
push ebx
push eax
mov byte [esp + 0x4c], bl
call fcn.004e82d0
push ebx
push str.db.txt
call fcn.004e6876
add esp, 0x2c
test eax, eax
jne 0x4c8539
lea edi, [esp + 0x28]
mov esi, str.log2.txt
call fcn.004c8340
push ebx
push 0x80
push 4
push ebx
push 1
push 0x40000000
mov ecx, edi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4c8539
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x100
lea eax, [esp + 0x12c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movzx edx, word [esp + 0x20]
movzx eax, word [esp + 0x1e]
push ebp
lea ecx, [esp + 0x12c]
push ecx
movzx ecx, word [esp + 0x24]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x26]
push ecx
movzx ecx, word [esp + 0x28]
push edx
push eax
push ecx
lea edx, [esp + 0x248]
push str._04d__02d__02d__02d:_02d:_02d_t_s_t_s_r_n
push edx
call fcn.004e63fa
lea eax, [esp + 0x250]
add esp, 0x28
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4c8513
push ebx
lea ecx, [esp + 0x28]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x234]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e6204
add esp, 0x420
ret
Function at 0x4c8950
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x414
mov eax, dword [0x5094b0]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push esi
push edi
push 0x3ff
lea eax, [esp + 0x1d]
mov esi, ecx
push 0
push eax
mov dword [esp + 0x18], esi
mov byte [esp + 0x24], 0
call fcn.004e82d0
movzx eax, word [esi]
mov ecx, 0x5a4d
add esp, 0xc
mov dword [esp + 0x10], 0
cmp ax, cx
je 0x4c89db
movzx edx, ax
push edx
push str.dos_magic___x
lea eax, [esp + 0x20]
push eax
call fcn.004e63fa
lea ecx, [esp + 0x24]
add esp, 0xc
push ecx
call fcn.004c83d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.004e6204
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
je 0x4c8a23
push 0x5a4d
lea edx, [esp + 0x1c]
push str.nt_sign___x
push edx
call fcn.004e63fa
lea eax, [esp + 0x24]
add esp, 0xc
push eax
call fcn.004c83d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.004e6204
mov esp, ebp
pop ebp
ret
movzx ebx, word [eax + 6]
lea edi, [eax + 0xf8]
xor esi, esi
mov dword [esp + 0x14], edi
test ebx, ebx
jle 0x4c8a93
mov ecx, str..text
mov eax, edi
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4c8a60
test dl, dl
je 0x4c8a5c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4c8a60
add eax, 2
add ecx, 2
test dl, dl
jne 0x4c8a40
xor eax, eax
jmp 0x4c8a65
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4c8a7d
inc esi
add edi, 0x28
cmp esi, ebx
jl 0x4c8a37
push 0
push str.update_PointerToRawData___d
jmp 0x4c89aa
mov edx, dword [esp + 0x14]
lea ecx, [esi + esi*4]
mov edi, dword [edx + ecx*8 + 0x14]
mov esi, dword [edx + ecx*8 + 0x10]
lea eax, [edx + ecx*8]
test edi, edi
jne 0x4c8a9f
push 0
push str.update_PointerToRawData___d
jmp 0x4c89aa
test esi, esi
jne 0x4c8aa8
mov esi, 0x3e8
push esi
push edi
lea edx, [esp + 0x20]
push str.code_begin__x___x
push edx
call fcn.004e63fa
lea eax, [esp + 0x28]
push eax
call fcn.004c83d0
add esp, 0x14
xor eax, eax
test esi, esi
jbe 0x4c8b12
mov ecx, dword [esp + 0xc]
add ecx, edi
mov dl, 0xcc
cmp byte [ecx + eax], dl
jne 0x4c8b03
cmp byte [ecx + eax + 1], dl
jne 0x4c8b03
cmp byte [ecx + eax + 2], dl
jne 0x4c8b03
cmp byte [ecx + eax + 3], dl
jne 0x4c8b03
cmp byte [ecx + eax + 4], dl
jne 0x4c8b03
cmp byte [ecx + eax + 5], dl
jne 0x4c8b03
cmp byte [ecx + eax + 6], dl
jne 0x4c8b03
cmp byte [ecx + eax + 7], dl
je 0x4c8b0e
inc eax
cmp eax, esi
jb 0x4c8ad4
mov edi, dword [esp + 0x10]
jmp 0x4c8b14
add edi, eax
jmp 0x4c8b14
mov edi, eax
push edi
lea edx, [esp + 0x1c]
push str.code_flag__x
push edx
call fcn.004e63fa
lea eax, [esp + 0x24]
add esp, 0xc
push eax
call fcn.004c83d0
add esp, 4
test edi, edi
je 0x4c8b46
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0xc]
mov dword [ecx + edi + 2], eax
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004e6204
mov esp, ebp
pop ebp
ret
Function at 0x4c8c70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30c
mov eax, dword [0x5094b0]
xor eax, esp
mov dword [esp + 0x308], eax
push esi
push 0xff
lea eax, [esp + 0xd]
push 0
push eax
mov esi, ecx
mov byte [esp + 0x14], 0
call fcn.004e82d0
add esp, 0xc
push 0x1ff
lea ecx, [esp + 0x10d]
push 0
push ecx
mov byte [esp + 0x114], 0
call fcn.004e82d0
add esp, 0xc
push str.set_start
call fcn.004c83d0
add esp, 4
push 0x200
lea edx, [esp + 0x10c]
push 0
push edx
call fcn.004e82d0
add esp, 0xc
xor eax, eax
cmp dword [0x50d2f8], 6
jne 0x4c8d20
jmp 0x4c8d00
mov cl, byte [eax + str.SoftwareClassesCLSIDECD4FC4D_521C_11D0_B792_00A0C90312E1InProcServer32]
mov byte [esp + eax + 0x108], cl
inc eax
test cl, cl
jne 0x4c8d00
jmp 0x4c8d32
mov cl, byte [eax + str.SoftwareClassesCLSIDB12AE898_D056_4378_A844_6D393FE37956InProcServer32]
mov byte [esp + eax + 0x108], cl
inc eax
test cl, cl
jne 0x4c8d20
push 0
lea eax, [esp + 8]
push eax
push 0
push 0x102
push 0
push 0
push 0
lea ecx, [esp + 0x124]
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4c8d9e
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2b4
lea edx, [esp + 0x14]
push str.RegCreateKeyEx_error__d__d__d
push edx
call fcn.004e63fa
lea eax, [esp + 0x1c]
add esp, 0x14
push eax
call fcn.004c83d0
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [esp + 0x308]
xor ecx, esp
call fcn.004e6204
mov esp, ebp
pop ebp
ret
push str.Open_OK
call fcn.004c83d0
mov eax, esi
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c8db0
mov ecx, dword [esp + 4]
sub eax, edx
inc eax
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push 0
push 0
push ecx
call esi
test eax, eax
je 0x4c8e1f
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2c0
lea edx, [esp + 0x14]
push str.RegSetValueEx_error__d__d__d
push edx
call fcn.004e63fa
lea eax, [esp + 0x1c]
add esp, 0x14
push eax
call fcn.004c83d0
mov ecx, dword [esp + 8]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x308]
xor ecx, esp
call fcn.004e6204
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 4]
push 0xa
push 0x500970
push 1
push 0
push str.ThreadingModel
push edx
call esi
test eax, eax
je 0x4c8e86
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2c9
lea eax, [esp + 0x14]
push str.RegSetValueEx_error__d__d__d
push eax
call fcn.004e63fa
lea ecx, [esp + 0x1c]
add esp, 0x14
push ecx
call fcn.004c83d0
mov edx, dword [esp + 8]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x308]
xor ecx, esp
call fcn.004e6204
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.set_end
call fcn.004c83d0
mov ecx, dword [esp + 0x310]
add esp, 4
pop esi
xor ecx, esp
mov eax, 1
call fcn.004e6204
mov esp, ebp
pop ebp
ret
Function at 0x4c90e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4c90f9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4c9134
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4c9130
lea ebx, [ebx]
cmp esi, eax
jae 0x4c9134
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4c9120
cmp esi, eax
jb 0x4c913a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4c9210
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.004cdd20

Function at 0x4cc194
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x4cc1dc
call fcn.004d5ec9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4cc1dc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4cc21f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x4cc208
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4cc208
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4cc21c
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4d4920
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x4d4967
call fcn.004d5ec9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4d4967
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x4d4983
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004d449a
mov esi, eax
test edi, edi
je 0x4d4981
test ebx, ebx
je 0x4d4981
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4d5082
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x4f94b0
call fcn.004e8730
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4d50a7
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4d50ed
lea ecx, [ebp - 0x10]
call fcn.004c95a0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004ce279
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004c9190
mov eax, esi
call fcn.004e8808
ret 8
Function at 0x4e6204
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5094b0]
jne 0x4e620e
repz ret
jmp fcn.004eadaf

Function at 0x4e67ed
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4e681e
call fcn.004e9009
mov dword [eax], esi
call fcn.004e8ff6
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004ec0d2
add esp, 0x14
push 0x16
pop eax
jmp 0x4e6873
test dword [ebp + 0xc], 0xfffffff9
jne 0x4e67fa
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4e684b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004e901c
pop ecx
call fcn.004e8ff6
mov eax, dword [eax]
jmp 0x4e6873
test al, 0x10
jne 0x4e6871
test al, 1
je 0x4e6871
test byte [ebp + 0xc], 2
je 0x4e6871
call fcn.004e9009
mov dword [eax], 5
call fcn.004e8ff6
mov dword [eax], 0xd
jmp 0x4e6842
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4f47ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004eb92f
and dword [ebp - 4], 0
cmp dword [0x50d248], 0
mov ebx, eax
jne 0x4f485d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4f490e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4ff644
push edi
call esi
test eax, eax
je 0x4f490e
push eax
call fcn.004eb8bd
mov dword [esp], 0x4ff634
push edi
mov dword [0x50d248], eax
call esi
push eax
call fcn.004eb8bd
mov dword [esp], 0x4ff620
push edi
mov dword [0x50d24c], eax
call esi
push eax
call fcn.004eb8bd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x50d250], eax
call esi
push eax
call fcn.004eb8bd
pop ecx
mov dword [0x50d258], eax
test eax, eax
je 0x4f485d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004eb8bd
pop ecx
mov dword [0x50d254], eax
mov eax, dword [0x50d254]
cmp eax, ebx
je 0x4f48b5
cmp dword [0x50d258], ebx
je 0x4f48b5
push eax
call fcn.004eb938
push dword [0x50d258]
mov esi, eax
call fcn.004eb938
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4f48b5
test edi, edi
je 0x4f48b5
call esi
test eax, eax
je 0x4f48ac
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4f48ac
test byte [ebp - 0xc], 1
jne 0x4f48b5
or dword [ebp + 0x10], 0x200000
jmp 0x4f48ee
mov eax, dword [0x50d24c]
cmp eax, ebx
je 0x4f48ee
push eax
call fcn.004eb938
pop ecx
test eax, eax
je 0x4f48ee
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4f48ee
mov eax, dword [0x50d250]
cmp eax, ebx
je 0x4f48ee
push eax
call fcn.004eb938
pop ecx
test eax, eax
je 0x4f48ee
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x50d248]
call fcn.004eb938
pop ecx
test eax, eax
je 0x4f490e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4f4910
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408e3f
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0x170
mov eax, 0x6cbda2
call fcn.00573bfd
mov esi, ecx
mov dword [ebp - 0x17c], esi
xor ebx, ebx
mov dword [ebp - 0x17c], esi
push 0xf
pop edi
mov dword [ebp - 0x120], ebx
mov byte [ebp - 0x130], bl
mov dword [ebp - 0x11c], edi
cmp byte [ebp + 8], bl
je 0x408f4a
lea eax, [ebp - 0x118]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
push 0x26
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x130]
test eax, eax
js 0x409001
lea eax, [ebp - 0x118]
push eax
call fcn.0040249b
push str.JiSu
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], edi
mov byte [ebp - 0x148], bl
call fcn.0040249b
push 0x782544
lea edx, [ebp - 0x130]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x178]
call fcn.00409f67
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 2
push ecx
mov edx, eax
lea ecx, [ebp - 0x160]
call fcn.0040261f
pop ecx
pop ecx
push str.Application
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004022f2
push eax
mov ecx, esi
call fcn.00402334
lea ecx, [ebp - 0x160]
call fcn.00402475
lea ecx, [ebp - 0x178]
call fcn.00402475
lea ecx, [ebp - 0x148]
call fcn.00402475
lea ecx, [ebp - 0x130]
call fcn.00402475
jmp 0x40900e
lea eax, [ebp - 0x118]
mov dword [ebp - 4], 4
push eax
push ebx
push ebx
push 0x1c
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0x130]
test eax, eax
js 0x409001
lea eax, [ebp - 0x118]
push eax
call fcn.0040249b
push str.JiSu
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], edi
mov byte [ebp - 0x148], bl
call fcn.0040249b
push 0x782544
lea edx, [ebp - 0x130]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x160]
call fcn.00409f67
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 6
push ecx
mov edx, eax
lea ecx, [ebp - 0x178]
call fcn.0040261f
pop ecx
pop ecx
push str.Application
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.004022f2
push eax
mov ecx, esi
call fcn.00402334
lea ecx, [ebp - 0x178]
call fcn.00402475
lea ecx, [ebp - 0x160]
jmp 0x408f2a
call fcn.00402475
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
mov byte [esi], bl
mov eax, esi
call fcn.00573ba7
ret
Function at 0x40bfe4
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x7b2e5c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
push 0x41
pop ecx
mov dword [ebp - 0x104], edx
lea esi, [ebp - 0x108]
mov dword [ebp - 0x108], 1
lea edi, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
push 0x41
pop ecx
lea esi, [ebp - 0x108]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp + 0x10]
lea edi, [ebp - 0x310]
rep movsd dword es:[edi], dword [esi]
push 4
mov dword [ebp - 0x314], edx
mov dword [ebp - 0x320], eax
pop edi
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [edx + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jns 0x40c087
call fcn.00694029
cmp dword [eax], edi
jne 0x40c085
mov edx, dword [ebp - 0x314]
jmp 0x40c048
test esi, esi
jne 0x40c08d
push 0xd
jmp 0x40c104
test esi, esi
jle 0x40c102
mov esi, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x314]
call esi
test eax, eax
jne 0x40c0bd
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x314]
call esi
test eax, eax
je 0x40c102
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x31c], edi
push eax
lea eax, [ebp - 0x318]
xor esi, esi
push eax
push 0x1007
push 0xffff
push dword [ebp - 0x314]
mov dword [ebp - 0x318], esi
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
js 0x40c0fb
cmp dword [ebp - 0x318], esi
je 0x40c0fe
push 2
pop esi
mov eax, esi
jmp 0x40c105
push 2
pop eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005730d5
leave
ret