joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492360
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x58b7c8]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
push 1
call fcn.00492f60
add esp, 4
test eax, eax
jne 0x4923a5
mov eax, dword [ebp - 0xc]
jmp 0x492487
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004e55f0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4923d0
mov edx, dword [ebp - 8]
mov dword [ebp - 0x41c], edx
jmp 0x4923d9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp - 0x41c]
push ecx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0
je 0x492402
mov edx, dword [ebp - 8]
push edx
call sub.MSVCR90.dll_free
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 0x14], 0
jne 0x49240d
mov eax, dword [ebp - 0xc]
jmp 0x492487
push 0x400
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x14]
movsx edx, word [ecx + 8]
push edx
call fcn.00492630
add esp, 0x10
test eax, eax
jne 0x49243b
mov eax, dword [ebp - 0xc]
jmp 0x492487
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
movsx edx, word [ecx + 8]
push edx
call fcn.00492e10
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
movsx ecx, word [eax + 8]
push ecx
mov edx, dword [ebp - 0x14]
movsx eax, word [edx + 0xa]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00492f10
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00472edc
mov esp, ebp
pop ebp
ret
Function at 0x492f60
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x58b7c8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x590504], 0
je 0x492f83
mov eax, 1
jmp 0x492fc4
mov word [ebp - 0x19c], 0x101
lea eax, [ebp - 0x198]
push eax
mov cx, word [ebp - 0x19c]
push ecx
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x492fb5
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
call dword [sym.imp.WSOCK32.dll_WSACleanup]
xor eax, eax
jmp 0x492fc4
mov dword [0x590504], 1
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472edc
mov esp, ebp
pop ebp
ret

Function at 0x492fe0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x58b7c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WSOCK32.dll_getsockname]
test eax, eax
jge 0x49301e
xor eax, eax
jmp 0x493054
movsx ecx, word [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 2
jne 0x49304b
push 0x30
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00492630
add esp, 0x10
test eax, eax
jne 0x493049
xor eax, eax
jmp 0x493054
jmp 0x49304f
xor eax, eax
jmp 0x493054
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472edc
mov esp, ebp
pop ebp
ret
Function at 0x496f20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x58b7c8]
xor eax, ebp
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], str.getaddrinfo
mov dword [ebp - 0x18], 0x4971d0
mov dword [ebp - 0x14], str.getnameinfo
mov dword [ebp - 0x10], 0x497a30
mov dword [ebp - 0xc], str.freeaddrinfo
mov dword [ebp - 8], fcn.00497160
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
cmp dword [0x59051c], 0
je 0x496f8b
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x5758d8]
jmp 0x497145
push 0x104
lea ecx, [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x496fa6
jmp 0x49709b
lea edx, [ebp - 0x240]
push edx
push 0x10c
lea eax, [ebp - 0x138]
push eax
call sub.MSVCR90.dll_strcpy_s
add esp, 0xc
push str.ws2_32
push 0x10c
lea ecx, [ebp - 0x138]
push ecx
call sub.MSVCR90.dll_strcat_s
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x497019
push str.getaddrinfo
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x497019
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x20], 0
je 0x497021
jmp 0x49709b
lea edx, [ebp - 0x240]
push edx
push 0x10c
lea eax, [ebp - 0x138]
push eax
call sub.MSVCR90.dll_strcpy_s
add esp, 0xc
push str.wship6
push 0x10c
lea ecx, [ebp - 0x138]
push ecx
call sub.MSVCR90.dll_strcat_s
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x497094
push str.getaddrinfo
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x497094
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
jmp 0x49709b
cmp dword [ebp - 0x20], 0
je 0x497130
mov dword [ebp - 4], 0
jmp 0x4970b7
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [0x55db5c]
jge 0x4970fa
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*8 - 0x1c]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*8 - 0x18], eax
mov edx, dword [ebp - 4]
cmp dword [ebp + edx*8 - 0x18], 0
jne 0x4970f8
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], 0
jmp 0x4970fa
jmp 0x4970ae
cmp dword [ebp - 0x20], 0
je 0x497130
mov dword [ebp - 4], 0
jmp 0x497112
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [0x55db5c]
jge 0x497130
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*8 - 0x18]
mov dword [eax*8 + 0x5758d8], edx
jmp 0x497109
mov dword [0x59051c], 1
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x5758d8]
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.00472edc
mov esp, ebp
pop ebp
ret 4
Function at 0x4975b0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x4975dc
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
test eax, eax
je 0x4975fc
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x2e
jne 0x4975fa
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x4975d3
cmp dword [ebp - 0xc], 3
je 0x497606
xor eax, eax
jmp 0x49762a
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x49761d
xor eax, eax
jmp 0x49762a
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x497880
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0xc]
mov dword [ecx], 0
mov edx, dword [ebp + 0x18]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x497948
mov ecx, dword [ebp - 8]
movsx edx, word [ecx + 8]
cmp edx, 2
jne 0x497928
mov eax, dword [ebp - 8]
movsx ecx, word [eax + 0xa]
cmp ecx, 4
jne 0x497928
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 4], eax
jmp 0x4978e5
mov ecx, dword [ebp - 4]
add ecx, 4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x497928
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
mov ax, word [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00497630
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
jne 0x49791b
mov eax, 8
jmp 0x49798e
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
add ecx, 0x1c
mov dword [ebp - 0xc], ecx
jmp 0x4978dc
push 0x400
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
push 0x401
mov ecx, dword [ebp + 0x18]
push ecx
call sub.MSVCR90.dll_strncpy_s
add esp, 0x10
xor eax, eax
jmp 0x49798e
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
sub edx, 0x2af9
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 3
ja case.default.0x497966
mov eax, dword [ebp - 0x10]
jmp dword [eax*4 + 0x497994]
mov eax, 0x2af9
jmp 0x49798e
mov eax, 0x2afa
jmp 0x49798e
mov eax, 0x2afb
jmp 0x49798e
mov eax, 0x2af9
jmp 0x49798e
mov eax, 0x2af9
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4998b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x18]
push eax
call fcn.0049af50
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0049adc0
add esp, 8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4999b0
push 0
call fcn.00499a40
add esp, 4
push 1
call fcn.00499a40
add esp, 4
lea eax, [ebp - 8]
push eax
push 0x20006
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4999b0
mov eax, dword [ebp - 0x10]
push eax
call fcn.0048e500
add esp, 4
cmp dword [ebp + 8], 0
je 0x4999a6
cmp dword [ebp + 8], 0
je 0x4999a6
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x80], 0
je 0x499975
xor edx, edx
je 0x499975
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x80]
mov dword [ebp - 0x14], ecx
jmp 0x49997c
mov dword [ebp - 0x14], 0xffffffc1
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x80], eax
push 0
push 0xff
push 0
push 0
push 0x1de
push 0xffffffffffffffc1
mov ecx, dword [ebp + 8]
push ecx
call fcn.00488110
add esp, 0x1c
mov eax, 1
jmp 0x499a3a
mov edx, dword [ebp - 0x10]
push edx
call fcn.0048e500
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x4999d8
cmp dword [ebp + 0x14], 0
jne 0x4999e8
mov eax, dword [ebp + 0x10]
push eax
call sub.MSVCR90.dll_strlen
add esp, 4
test eax, eax
jne 0x4999e8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x499a2e
cmp dword [ebp + 0x14], 0
je 0x4999f6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
jmp 0x499a08
mov ecx, dword [ebp + 0x10]
push ecx
call sub.MSVCR90.dll_strlen
add esp, 4
add eax, 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
xor ecx, ecx
cmp dword [ebp + 0x14], 0
setne cl
lea ecx, [ecx + ecx + 1]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004e6510
add esp, 0x14
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x49af10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push 0
call fcn.00498fe0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49af37
mov eax, dword [ebp - 4]
jmp 0x49af43
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR90.dll_getenv
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x49af50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x58b7c8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x49af70
mov eax, reloc.WSOCK32.dll_accept
jmp 0x49afbc
push 0x94
push 0
lea eax, [ebp - 0xa0]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x49afb7
cmp dword [ebp + 8], 0
jne 0x49afb7
cmp dword [ebp - 0x9c], 6
jb 0x49afb7
mov eax, reloc.WSOCK32.dll_accept
jmp 0x49afbc
mov eax, reloc.WSOCK32.dll_bind
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472edc
mov esp, ebp
pop ebp
ret
Function at 0x49cf60
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x49cf8e
cmp dword [ebp + 0x10], 0
jne 0x49cf90
jmp 0x49cfe8
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004e55f0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x49cfe8
cmp dword [ebp - 0xc], 0
je 0x49cfe8
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.004e55f0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49cfe8
cmp dword [ebp - 0xc], 0
je 0x49cfe8
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.MSVCR90.dll_rename
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0
je 0x49d001
mov eax, dword [ebp - 8]
push eax
call fcn.0048e500
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x49d01a
mov ecx, dword [ebp - 4]
push ecx
call fcn.0048e500
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x49d030
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0xffffffff
cmp dword [ebp + 0xc], 0
je 0x49d05e
cmp dword [ebp + 0x10], 0
jne 0x49d060
jmp 0x49d0b8
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004e58e0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49d0b8
cmp dword [ebp - 0xc], 0
je 0x49d0b8
mov dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.004e58e0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x49d0b8
cmp dword [ebp - 0xc], 0
je 0x49d0b8
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.MSVCR90.dll__wrename
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], 0
je 0x49d0d1
mov eax, dword [ebp - 4]
push eax
call fcn.0048e500
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 0
je 0x49d0ea
mov ecx, dword [ebp - 8]
push ecx
call fcn.0048e500
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x49d2a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0xffffffff
cmp dword [ebp + 0xc], 0
jne 0x49d2c3
jmp 0x49d2f1
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004e55f0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x49d2f1
cmp dword [ebp - 4], 0
je 0x49d2f1
mov edx, dword [ebp - 8]
push edx
call sub.MSVCR90.dll_remove
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
je 0x49d30a
mov eax, dword [ebp - 8]
push eax
call fcn.0048e500
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x49d320
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp + 0xc], 0
jne 0x49d343
jmp 0x49d371
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004e58e0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x49d371
cmp dword [ebp - 4], 0
je 0x49d371
mov edx, dword [ebp - 0xc]
push edx
call sub.MSVCR90.dll__wremove
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
je 0x49d38a
mov eax, dword [ebp - 0xc]
push eax
call fcn.0048e500
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4a0470
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
je 0x4a0484
mov eax, dword [ebp + 0x10]
mov dword [0x597968], eax
jmp 0x4a048e
mov dword [0x597968], 0xffffffff
mov ecx, dword [ebp + 0x14]
mov dword [0x59795c], ecx
cmp dword [0x590964], 0
je 0x4a04af
mov edx, dword [0x597958]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x4a0520
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x597958], eax
cmp dword [0x597958], 0
jne 0x4a04cf
xor eax, eax
jmp 0x4a0525
push 4
push 1
call sub.MSVCR90.dll_calloc
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4a04e8
xor eax, eax
jmp 0x4a0525
mov eax, dword [ebp - 4]
mov ecx, dword [0x597958]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
push edx
push 0
push 0x4a03e0
call sub.MSVCR90.dll__beginthread
add esp, 0xc
mov dword [0x590964], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x590964], 0
jne 0x4a0520
xor eax, eax
jmp 0x4a0525
mov eax, dword [0x590964]
mov esp, ebp
pop ebp
ret

Function at 0x4a0560
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push eax
call sub.MSVCR90.dll_getenv
add esp, 4
mov dword [0x590558], eax
cmp dword [0x590558], 0
je 0x4a0587
mov eax, dword [0x590558]
jmp 0x4a0602
lea ecx, [ebp - 4]
push ecx
push 1
push 0
push str.SOFTWAREFLEXlm_License_Manager
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a0600
mov dword [ebp - 0xc], 0x400
lea edx, [ebp - 0xc]
push edx
push 0x590560
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4a05f2
mov dword [0x590558], 0x590560
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x590558]
jmp 0x4a0602
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4a0602
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4a0f60
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
je 0x4a0f81
mov dword [ebp - 8], 1
push 4
lea eax, [ebp - 8]
push eax
push 8
push 0xffff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4a3d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x58b7c8]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 0x40], 0xc
mov byte [ebp - 0x3f], 0x52
mov byte [ebp - 0x3e], 0xe3
mov byte [ebp - 0x3d], 0xa8
mov byte [ebp - 0x3c], 0xf6
mov byte [ebp - 0x3b], 0xd4
mov byte [ebp - 0x3a], 0xc7
mov byte [ebp - 0x39], 0x68
mov byte [ebp - 0x38], 0xf2
mov byte [ebp - 0x37], 0x36
mov byte [ebp - 0x36], 0x1c
mov byte [ebp - 0x35], 0x88
mov byte [ebp - 0x34], 0x15
mov byte [ebp - 0x33], 0x36
mov byte [ebp - 0x32], 0x97
mov byte [ebp - 0x31], 0xde
mov byte [ebp - 0x30], 0x55
mov byte [ebp - 0x2f], 0x9a
mov byte [ebp - 0x2e], 0x9e
mov byte [ebp - 0x2d], 0xdf
mov byte [ebp - 0x2c], 5
mov byte [ebp - 0x2b], 0xd5
mov byte [ebp - 0x2a], 0xf3
mov byte [ebp - 0x29], 0x52
mov byte [ebp - 0x28], 0xe1
mov byte [ebp - 0x27], 0xe1
mov byte [ebp - 0x26], 0xcb
mov byte [ebp - 0x25], 0xfb
mov byte [ebp - 0x24], 0xb4
mov byte [ebp - 0x23], 0x74
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0xca
mov byte [ebp - 0x20], 0x29
mov byte [ebp - 0x1f], 0xed
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x62
mov byte [ebp - 0x1c], 0x6a
mov byte [ebp - 0x1b], 0xba
mov byte [ebp - 0x1a], 0x33
mov byte [ebp - 0x19], 0xa1
mov byte [ebp - 0x18], 0xb0
mov byte [ebp - 0x17], 0x2b
mov byte [ebp - 0x16], 0x27
mov byte [ebp - 0x15], 0x60
mov byte [ebp - 0x14], 0x87
mov byte [ebp - 0x13], 0x81
mov byte [ebp - 0x12], 0xd1
mov byte [ebp - 0x11], 0xa4
mov byte [ebp - 0x10], 0x10
mov byte [ebp - 0xf], 0xf7
mov byte [ebp - 0xe], 0xd2
mov byte [ebp - 0xd], 0x6b
mov byte [ebp - 0xc], 0xce
mov byte [ebp - 0xb], 0xb5
mov byte [ebp - 0xa], 0x12
mov byte [ebp - 9], 0xc5
mov dword [ebp - 0x44], 0x38
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x44]
ja 0x4a3e41
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
lea eax, [ebp + edx - 0x40]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00472edc
mov esp, ebp
pop ebp
ret
Function at 0x4a3e60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x58b7c8]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xd4]
mov edx, dword [ecx + 0x10d4]
and edx, 0x40
jne 0x4a3e95
xor eax, eax
jmp 0x4a407b
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x13c]
and ecx, 0x80
jne 0x4a3f08
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x13c]
or eax, 0x80
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x13c], eax
push str.BUG_B
push 0x45
push 0x44
push str.FLEXLM__c_c_sADDATE
lea edx, [ebp - 0x2d0]
push edx
call sub.MSVCR90.dll_sprintf
add esp, 0x14
lea eax, [ebp - 0x2d0]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0049a100
add esp, 8
test eax, eax
je 0x4a3f08
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x13c]
or eax, 0x100
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x13c], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x13c]
and eax, 0x100
je 0x4a3f80
cmp dword [ebp + 8], 0
je 0x4a3f76
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x80], 0
je 0x4a3f3f
xor edx, edx
je 0x4a3f3f
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x80]
mov dword [ebp - 0x2d4], ecx
jmp 0x4a3f49
mov dword [ebp - 0x2d4], 0xffffffa8
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x2d4]
mov dword [edx + 0x80], eax
push 0
push 0xff
push 0
push 0
push 0x138
push 0xffffffffffffffa8
mov ecx, dword [ebp + 8]
push ecx
call fcn.00488110
add esp, 0x1c
mov eax, 0xffffffa8
jmp 0x4a407b
mov byte [ebp - 0x208], 0x5c
mov byte [ebp - 0x207], 0
push 0
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004a4090
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4a3fb4
mov eax, dword [ebp - 4]
jmp 0x4a407b
push 0x200
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004a4090
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4a3fec
mov eax, dword [ebp - 4]
jmp 0x4a407b
mov byte [ebp - 0x208], 0x2f
mov byte [ebp - 0x206], 0x61
mov byte [ebp - 0x205], 0x72
mov byte [ebp - 0x207], 0x76
mov byte [ebp - 0x204], 0
push 0
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004a4090
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4a4032
mov eax, dword [ebp - 4]
jmp 0x4a407b
mov byte [ebp - 0x208], 0x2f
mov byte [ebp - 0x204], 0
mov byte [ebp - 0x206], 0x6d
mov byte [ebp - 0x207], 0x74
mov byte [ebp - 0x205], 0x70
push 0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004a4090
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4a4078
mov eax, dword [ebp - 4]
jmp 0x4a407b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00472edc
mov esp, ebp
pop ebp
ret