joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474b50
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x5274d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x12c], 0
cmp dword [0x52a05c], 0
jne 0x474d95
call sub.MSVCR120.dll__getpid
push eax
push str.TerminalServerFlexlmMutex
push 0x51cde8
lea ecx, [ebp - 0x110]
push ecx
call sub.MSVCR120.dll_sprintf
add esp, 0x10
lea edx, [ebp - 0x110]
push edx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x474c14
xor eax, eax
jmp 0x474da1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x474c30
push 0xffffffffffffffff
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x52a05c], 0
jne 0x474d7b
call fcn.00474a60
mov dword [ebp - 0x124], eax
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x130], ecx
mov edx, dword [ebp - 0x130]
sub edx, 4
mov dword [ebp - 0x130], edx
cmp dword [ebp - 0x130], 3
ja case.default.0x474c76
mov eax, dword [ebp - 0x130]
jmp dword [eax*4 + 0x474db0]
push 0x51cdf0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x52a070], eax
cmp dword [0x52a070], 0
je 0x474d34
push str.WTSEnumerateSessionsA
mov ecx, dword [0x52a070]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x52a064], eax
cmp dword [0x52a064], 0
je 0x474d34
push 0x51ce18
mov edx, dword [0x52a070]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x52a068], eax
cmp dword [0x52a068], 0
je 0x474d34
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x128]
push ecx
push 1
push 0
push 0
call dword [0x52a064]
cmp dword [ebp - 0x128], 0
je 0x474d0e
mov edx, dword [ebp - 0x128]
cmp dword [edx + 8], 0
jne 0x474d1d
mov eax, dword [ebp - 0x128]
push eax
call dword [0x52a068]
jmp 0x474d34
mov ecx, dword [ebp - 0x128]
push ecx
call dword [0x52a068]
mov dword [0x52a060], 1
mov edx, dword [0x52a070]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x52a070], 0
jmp case.default.0x474c76
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je case.default.0x474c76
mov dword [0x52a060], 1
mov dword [0x52a05c], 1
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [0x52a060], 0
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00431a84
mov esp, ebp
pop ebp
ret
Function at 0x4751e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x5274d0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x52a078], 0
jne 0x475283
push 0
push 0x94
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.00401ca0
add esp, 0x10
mov dword [ebp - 0xa0], 0x94
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x475279
cmp dword [ebp - 0x90], 1
jne 0x475248
mov dword [0x52a074], 2
jmp 0x475279
cmp dword [ebp - 0x90], 2
je 0x47525a
cmp dword [ebp - 0x9c], 6
jb 0x475266
mov dword [0x52a074], 1
jmp 0x475279
cmp dword [ebp - 0x90], 0
jne 0x475279
mov dword [0x52a074], 3
mov dword [0x52a078], 1
mov eax, dword [0x52a074]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00431a84
mov esp, ebp
pop ebp
ret

Function at 0x475f20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x475f61
cmp dword [ebp + 0xc], 0
je 0x475f61
cmp dword [ebp + 0x10], 0
je 0x475f61
cmp dword [ebp + 0x14], 0
jne 0x475f66
jmp 0x476039
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004752a0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x476039
cmp dword [ebp - 0x14], 0
je 0x476039
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x476039
mov edx, dword [ebp - 0x14]
add edx, 1
push edx
call sub.MSVCR120.dll_malloc
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x476039
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x476039
mov edx, dword [ebp + 0x10]
cmp dword [edx], 1
je 0x47600f
mov eax, dword [ebp + 0x10]
cmp dword [eax], 2
jne 0x476024
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.004757b0
add esp, 8
mov dword [ebp - 8], eax
jmp 0x476039
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
cmp dword [ebp - 4], 0
je 0x476052
mov eax, dword [ebp - 4]
push eax
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
je 0x47606b
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x476080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0
je 0x4760c1
cmp dword [ebp + 0xc], 0
je 0x4760c1
cmp dword [ebp + 0x10], 0
je 0x4760c1
cmp dword [ebp + 0x14], 0
jne 0x4760c6
jmp 0x476199
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004755a0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x476199
cmp dword [ebp - 0x14], 0
je 0x476199
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x476199
mov edx, dword [ebp - 0x14]
add edx, 1
push edx
call sub.MSVCR120.dll_malloc
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x476199
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x476199
mov edx, dword [ebp + 0x10]
cmp dword [edx], 1
je 0x47616f
mov eax, dword [ebp + 0x10]
cmp dword [eax], 2
jne 0x476184
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.00475650
add esp, 8
mov dword [ebp - 4], eax
jmp 0x476199
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
cmp dword [ebp - 8], 0
je 0x4761b2
mov eax, dword [ebp - 8]
push eax
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
je 0x4761cb
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x476240
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x47627a
cmp dword [ebp + 0xc], 0
je 0x47627a
cmp dword [ebp + 0x14], 0
je 0x47627a
cmp dword [ebp + 0x18], 0
jne 0x47627f
jmp 0x476301
cmp dword [ebp + 0x10], 1
je 0x47628b
cmp dword [ebp + 0x10], 2
jne 0x4762e2
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004752a0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4762a6
jmp 0x476301
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.004752a0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4762c1
jmp 0x476301
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
jmp 0x476301
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x47631a
mov edx, dword [ebp - 4]
push edx
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 8], 0
je 0x476333
mov eax, dword [ebp - 8]
push eax
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x476340
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x47637a
cmp dword [ebp + 0xc], 0
je 0x47637a
cmp dword [ebp + 0x14], 0
je 0x47637a
cmp dword [ebp + 0x18], 0
jne 0x47637f
jmp 0x476409
cmp dword [ebp + 0x10], 1
je 0x47638b
cmp dword [ebp + 0x10], 2
jne 0x4763ea
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004755a0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4763a6
jmp 0x476409
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.004755a0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4763c1
jmp 0x476409
mov ecx, dword [ebp - 0x10]
shl ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
jmp 0x476409
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 8], 0
je 0x476422
mov eax, dword [ebp - 8]
push eax
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x47643b
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4764a0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x4764da
cmp dword [ebp + 8], 0
jne 0x4764da
jmp 0x47657e
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp dword [ebp - 8], 0
je 0x47657e
mov edx, dword [ebp - 8]
push edx
call sub.MSVCR120.dll_malloc
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x47657e
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x47657e
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004757b0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x47657e
cmp dword [ebp + 0xc], 0
je 0x476578
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jle 0x47654e
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp - 8], edx
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401ca0
add esp, 0x10
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401990
add esp, 0x10
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0xc], 0
je 0x476597
mov eax, dword [ebp - 0xc]
push eax
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x4765b0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4765c0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x4765fa
cmp dword [ebp + 8], 0
jne 0x4765fa
jmp 0x4766a0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [ebp - 8], 0
je 0x4766a0
mov edx, dword [ebp - 8]
shl edx, 1
push edx
call sub.MSVCR120.dll_malloc
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4766a0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4766a0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00475650
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4766a0
cmp dword [ebp + 0xc], 0
je 0x47669a
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0xc]
jle 0x476670
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp - 8], edx
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401ca0
add esp, 0x10
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401990
add esp, 0x10
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 4], 0
je 0x4766b9
mov eax, dword [ebp - 4]
push eax
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
je 0x4766d2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4767f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004752a0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4768ee
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4768ee
cmp dword [ebp + 0x10], 0
je 0x4768ee
mov eax, dword [ebp - 0xc]
push eax
call sub.MSVCR120.dll_malloc
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4768ee
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4768ee
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004757b0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4768d3
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jle 0x4768b2
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp - 0xc], ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401150
add esp, 0x10
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
mov byte [edx], 0
jmp 0x4768ee
mov dword [ebp - 0xc], 0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401ca0
add esp, 0x10
cmp dword [ebp - 8], 0
je 0x476907
mov edx, dword [ebp - 8]
push edx
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x476920
mov eax, dword [ebp - 4]
push eax
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0x10], 0
je 0x476939
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x476940
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004755a0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x476a40
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x476a40
cmp dword [ebp + 0x10], 0
je 0x476a40
mov eax, dword [ebp - 8]
shl eax, 1
push eax
call sub.MSVCR120.dll_malloc
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x476a40
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x476a40
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00475650
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x476a25
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jle 0x476a04
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp - 8], ecx
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401150
add esp, 0x10
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
mov byte [edx], 0
jmp 0x476a40
mov dword [ebp - 8], 0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00401ca0
add esp, 0x10
cmp dword [ebp - 0x10], 0
je 0x476a59
mov edx, dword [ebp - 0x10]
push edx
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 0x10], 0
cmp dword [ebp - 4], 0
je 0x476a72
mov eax, dword [ebp - 4]
push eax
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
je 0x476a8b
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0043c5b0
add esp, 4
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x488150
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x5274d0]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 0x410], 0
push 0x400
push 0
lea eax, [ebp - 0x40f]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x420], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x418], 0
cmp dword [ebp + 8], 0
je 0x4881c7
push 0
push 0x400
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x410]
push edx
call fcn.00401150
add esp, 0x10
jmp 0x4881ec
cmp dword [ebp + 8], 0
jne 0x4881ec
push 0x400
lea eax, [ebp - 0x410]
push eax
call fcn.004766e0
add esp, 8
test eax, eax
je 0x4881ec
xor eax, eax
jmp 0x488394
push 1
call fcn.00489770
add esp, 4
test eax, eax
jne 0x488201
xor eax, eax
jmp 0x488394
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x410]
push edx
call fcn.004752a0
add esp, 8
mov dword [ebp - 0x414], eax
push 0
push 0x20
push 0
lea eax, [ebp - 0x440]
push eax
call fcn.00401ca0
add esp, 0x10
mov dword [ebp - 0x440], 2
mov dword [ebp - 0x438], 1
mov dword [ebp - 0x43c], 2
cmp dword [ebp - 0x414], 0
je 0x488264
mov ecx, dword [ebp - 0x414]
mov dword [ebp - 0x444], ecx
jmp 0x488270
lea edx, [ebp - 0x410]
mov dword [ebp - 0x444], edx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x440]
push ecx
push 0
mov edx, dword [ebp - 0x444]
push edx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x48829a
cmp dword [ebp - 0x420], 0
jne 0x4882b9
cmp dword [ebp - 0x414], 0
je 0x4882b2
mov eax, dword [ebp - 0x414]
push eax
call fcn.0043c5b0
add esp, 4
xor eax, eax
jmp 0x488394
mov ecx, dword [ebp - 0x420]
mov dword [ebp - 0x41c], ecx
jmp 0x4882d6
mov edx, dword [ebp - 0x41c]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x488369
push 0
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.00401ca0
add esp, 0x10
push 2
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x41c]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x41c]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x488325
jmp 0x4882c7
push 0
push str.127.0.0.1
mov eax, dword [ebp + 0xc]
push eax
call fcn.004013c0
add esp, 0xc
test eax, eax
je 0x488353
push 0
push str.0.0.0.0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004013c0
add esp, 0xc
test eax, eax
jne 0x488358
jmp 0x4882c7
mov dword [ebp - 0x418], 1
jmp 0x488369
mov edx, dword [ebp - 0x420]
push edx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [ebp - 0x414], 0
je 0x48838e
mov eax, dword [ebp - 0x414]
push eax
call fcn.0043c5b0
add esp, 4
mov eax, dword [ebp - 0x418]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00431a84
mov esp, ebp
pop ebp
ret
Function at 0x49b840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
and ecx, 0xff
mov byte [ebp - 8], cl
mov edx, dword [ebp + 0x10]
sar edx, 8
and edx, 0xff
mov byte [ebp - 7], dl
mov eax, dword [ebp + 0x10]
sar eax, 0x10
and eax, 0xff
mov byte [ebp - 6], al
mov ecx, dword [ebp + 0x10]
sar ecx, 0x18
and ecx, 0xff
mov byte [ebp - 5], cl
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
test edx, edx
je 0x49b8d1
mov ecx, dword [ebp - 4]
movsx edx, byte [ebp + ecx - 8]
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp + 8]
mov byte [edx], cl
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jle 0x49b8c6
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
jmp 0x49b88b
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4aa770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x10], 0
je 0x4aa784
mov eax, dword [ebp + 0x10]
mov dword [0x52c8cc], eax
jmp 0x4aa78e
mov dword [0x52c8cc], 0xffffffff
mov ecx, dword [ebp + 0x14]
mov dword [0x52c8c4], ecx
cmp dword [0x52b71c], 0
je 0x4aa7af
mov edx, dword [0x52c8c0]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x4aa820
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x52c8c0], eax
cmp dword [0x52c8c0], 0
jne 0x4aa7cf
xor eax, eax
jmp 0x4aa825
push 4
push 1
call sub.MSVCR120.dll_calloc
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4aa7e8
xor eax, eax
jmp 0x4aa825
mov eax, dword [ebp - 4]
mov ecx, dword [0x52c8c0]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
push edx
push 0
push 0x4aa6e0
call sub.MSVCR120.dll__beginthread
add esp, 0xc
mov dword [0x52b71c], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x52b71c], 0
jne 0x4aa820
xor eax, eax
jmp 0x4aa825
mov eax, dword [0x52b71c]
mov esp, ebp
pop ebp
ret