joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aa880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4aaad2
sub esp, 0x74
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.004ab260
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x70], eax
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], edx
mov eax, dword [esp + 0x70]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], ecx
test eax, eax
jne 0x4aa943
jmp 0x4aa95d
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
add esp, 0x74
ret
mov dword [esp + 0x1c], 0x64
jmp 0x4aa967
jmp 0x4aa969
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
lea edx, [0x5116e0]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call fcn.004711a0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
test ecx, ecx
ja 0x4aa9c4
jmp 0x4aaaca
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
call fcn.004ae440
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], edx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], edx
test eax, eax
jne 0x4aaa2c
jmp 0x4aaa46
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
add esp, 0x74
ret
mov eax, dword [esp + 0x34]
mov dword [esp + 0x28], eax
cmp dword [esp + 0x1c], eax
jbe 0x4aaa56
jmp 0x4aaabe
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
cmp edx, ecx
jae 0x4aaa68
jmp 0x4aaac5
jmp 0x4aaa6a
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call fcn.004ab050
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ecx
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
add esp, 0x74
ret
jmp 0x4aaac0
jmp 0x4aa967
call fcn.00475880
xor eax, eax
call fcn.00475830
nop
call fcn.004743b0
jmp fcn.004aa880
Function at 0x4ab050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ab1e3
sub esp, 0x64
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x6c]
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x70]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x30], 0
mov dword [esp + 0x38], eax
jmp 0x4ab0a5
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x38], eax
jg 0x4ab0b1
jmp 0x4ab11e
mov eax, dword [esp + 0x30]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x54]
lea eax, [ebx + eax*2]
movzx eax, word [eax]
mov word [esp + 0x26], ax
test ax, ax
je 0x4ab0d3
jmp 0x4ab0ec
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x70]
cmp edx, ecx
jae 0x4ab0e4
jmp 0x4ab1dd
jmp 0x4ab0e6
mov dword [esp + 0x6c], ecx
jmp 0x4ab120
cmp ax, 0x7f
jbe 0x4ab0f4
jmp 0x4ab0fc
jmp 0x4ab0f6
inc dword [esp + 0x28]
jmp 0x4ab116
cmp ax, 0x7ff
jbe 0x4ab104
jmp 0x4ab10d
jmp 0x4ab106
add dword [esp + 0x28], 2
jmp 0x4ab116
jmp 0x4ab10f
add dword [esp + 0x28], 3
jmp 0x4ab116
jmp 0x4ab118
inc dword [esp + 0x30]
jmp 0x4ab0a5
jmp 0x4ab120
mov eax, dword [esp + 0x28]
lea ecx, [0x511660]
mov dword [esp], ecx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
call fcn.004711a0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], eax
mov edx, dword [esp + 0x68]
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], ebp
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
call fcn.004ad180
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x60], eax
mov ecx, dword [esp + 0x34]
test ecx, ecx
jl 0x4ab1d8
jmp 0x4ab1ac
mov ecx, eax
neg eax
cmp dword [esp + 0x34], eax
ja 0x4ab1c8
jmp 0x4ab1b8
mov eax, dword [esp + 0x34]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], eax
add esp, 0x64
ret
test ecx, ecx
jne 0x4ab1ce
jmp 0x4ab1d3
call fcn.00467f50
call fcn.00467f90
call fcn.00467f50
call fcn.00475870
nop
call fcn.004743b0
jmp fcn.004ab050
Function at 0x4b3b40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4b3d4d
sub esp, 0x50
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], eax
jmp 0x4b3b87
cmp eax, 0x19
je 0x4b3b91
jmp 0x4b3c31
jmp 0x4b3b93
cmp eax, 0x19
je 0x4b3b9d
jmp 0x4b3c2a
mov dword [esp], ecx
lea eax, [0x52bbb0]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x19
call fcn.00403b40
movzx eax, byte [esp + 0xc]
test al, al
jne 0x4b3bc2
jmp 0x4b3c28
jmp 0x4b3bc4
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x34], ecx
mov edx, dword [esp + 0x70]
lea edi, [esp]
lea esi, [esp + 0x54]
call fcn.00475eee
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov byte [esp + 0x20], 0
call fcn.004b6580
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], edx
add esp, 0x50
ret
jmp 0x4b3c2c
jmp 0x4b3c2c
jmp 0x4b3cdc
cmp eax, 0x23
je 0x4b3c3b
jmp 0x4b3cd8
jmp 0x4b3c3d
cmp eax, 0x23
je 0x4b3c47
jmp 0x4b3cd4
mov dword [esp], ecx
lea eax, [0x52e716]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x23
call fcn.00403b40
movzx eax, byte [esp + 0xc]
test al, al
jne 0x4b3c6c
jmp 0x4b3cd2
jmp 0x4b3c6e
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x34], ecx
mov edx, dword [esp + 0x70]
lea edi, [esp]
lea esi, [esp + 0x54]
call fcn.00475eee
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov byte [esp + 0x20], 1
call fcn.004b6580
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], edx
add esp, 0x50
ret
jmp 0x4b3cd6
jmp 0x4b3cd6
jmp 0x4b3cdc
jmp 0x4b3cda
jmp 0x4b3cdc
jmp 0x4b3cde
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0x6c]
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0x70]
lea edi, [esp]
lea esi, [esp + 0x54]
call fcn.00475eee
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x38]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebx
call fcn.004b3d60
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], edx
add esp, 0x50
ret
call fcn.004743b0
jmp fcn.004b3b40
Function at 0x4c57d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c59a8
sub esp, 0x24
mov byte [esp + 0x38], 0
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x20], edx
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x1c], ebx
cmp edx, ebx
jl 0x4c5802
jmp 0x4c580b
mov byte [esp + 0x38], 0
add esp, 0x24
ret
mov dword [esp + 0x14], 0
jmp 0x4c5815
mov edx, dword [esp + 0x34]
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x14], edx
jl 0x4c5828
jmp 0x4c5919
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
cmp ecx, eax
ja 0x4c583d
jmp 0x4c59a2
add eax, edx
movzx eax, byte [eax]
mov byte [esp + 0x12], al
mov byte [esp], al
call fcn.004c4470
movzx eax, byte [esp + 4]
mov byte [esp + 0xd], al
test al, al
jne 0x4c585d
jmp 0x4c589d
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
cmp eax, ecx
jb 0x4c5872
jmp 0x4c599d
add eax, edx
movzx eax, byte [eax]
mov byte [esp + 0x11], al
mov byte [esp], al
call fcn.004c4470
movzx eax, byte [esp + 4]
mov byte [esp + 0xd], al
test al, al
jne 0x4c5892
jmp 0x4c5894
jmp 0x4c590e
mov byte [esp + 0x38], 0
add esp, 0x24
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
cmp eax, ecx
jb 0x4c58b2
jmp 0x4c5998
add eax, edx
movzx eax, byte [eax]
mov byte [esp + 0x10], al
mov byte [esp], al
call fcn.004c5240
movzx eax, byte [esp + 4]
mov byte [esp + 0xc], al
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
cmp ecx, eax
ja 0x4c58e1
jmp 0x4c5993
add eax, edx
movzx eax, byte [eax]
mov byte [esp + 0xf], al
mov byte [esp], al
call fcn.004c5240
movzx eax, byte [esp + 4]
mov byte [esp + 0xb], al
cmp byte [esp + 0xc], al
jne 0x4c5903
jmp 0x4c590c
mov byte [esp + 0x38], 0
add esp, 0x24
ret
jmp 0x4c590e
jmp 0x4c5910
inc dword [esp + 0x14]
jmp 0x4c5815
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x1c], edx
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x20], ebx
cmp edx, ebx
setg dl
mov byte [esp + 0xd], dl
jg 0x4c5936
jmp 0x4c596f
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
cmp eax, ecx
jb 0x4c594c
jmp 0x4c598e
add eax, edx
movzx eax, byte [eax]
mov byte [esp + 0xe], al
mov byte [esp], al
call fcn.004c4470
movzx eax, byte [esp + 4]
mov byte [esp + 0x13], al
xor eax, 1
mov byte [esp + 0xd], al
jmp 0x4c5971
jmp 0x4c5971
movzx eax, byte [esp + 0xd]
test al, al
jne 0x4c597c
jmp 0x4c5985
mov byte [esp + 0x38], 0
add esp, 0x24
ret
mov byte [esp + 0x38], 1
add esp, 0x24
ret
call fcn.00475830
call fcn.00475830
call fcn.00475830
call fcn.00475830
call fcn.00475830
nop
call fcn.004743b0
jmp fcn.004c57d0
Function at 0x4c8c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4c8d16
sub esp, 0x60
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x34], 0
movzx eax, byte [esp + 0x70]
test al, al
jne 0x4c8c4a
jmp 0x4c8c54
mov dword [esp + 0x34], 1
jmp 0x4c8c56
jmp 0x4c8c56
mov eax, dword [esp + 0x68]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x54], eax
mov eax, dword [0x5cf540]
mov dword [esp], eax
call fcn.004aa740
mov eax, dword [esp + 4]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x5c]
mov ebx, dword [esp + 0x58]
mov ebp, dword [esp + 0x34]
mov esi, dword [esp + 0x54]
mov dword [esp], eax
mov dword [esp + 4], 5
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0
call fcn.00472c30
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], edx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x50], edx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
test eax, eax
je 0x4c8cf6
jmp 0x4c8d10
mov dword [esp], ecx
call fcn.004c86e0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], ecx
jmp 0x4c8d12
jmp 0x4c8d12
add esp, 0x60
ret
call fcn.004743b0
jmp fcn.004c8c10
Function at 0x4e6700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4e688a
sub esp, 0x40
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov byte [esp + 0x54], 0
mov edx, dword [esp + 0x48]
mov dword [esp + 0x38], edx
cmp edx, 3
jl 0x4e673b
jmp 0x4e6754
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov byte [esp + 0x54], 0
add esp, 0x40
ret
mov dword [esp + 0x28], 1
jmp 0x4e675e
mov edx, dword [esp + 0x48]
mov dword [esp + 0x38], edx
cmp dword [esp + 0x28], edx
jl 0x4e6771
jmp 0x4e686b
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
cmp ecx, eax
ja 0x4e6786
jmp 0x4e6884
add edx, eax
cmp byte [edx], 0x5d
je 0x4e6792
jmp 0x4e6860
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
call fcn.004e1870
mov eax, dword [esp + 0x10]
movzx ecx, byte [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov byte [esp + 0x1f], cl
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], eax
movzx ecx, byte [esp + 0x1f]
mov byte [esp + 0x1e], cl
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x20], eax
movzx eax, byte [esp + 0x1e]
mov byte [esp + 0x1d], al
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
movzx eax, byte [esp + 0x1d]
mov ecx, eax
xor eax, 1
mov byte [esp + 0x1f], al
test cl, cl
jne 0x4e680d
jmp 0x4e681e
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x28], eax
setne al
mov byte [esp + 0x1f], al
jmp 0x4e6820
jmp 0x4e6820
movzx eax, byte [esp + 0x1f]
test al, al
jne 0x4e682b
jmp 0x4e6845
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x28]
inc eax
mov dword [esp + 0x50], eax
mov byte [esp + 0x54], 0
add esp, 0x40
ret
mov eax, dword [esp + 0x20]
dec eax
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x28]
inc eax
mov dword [esp + 0x50], eax
mov byte [esp + 0x54], 1
add esp, 0x40
ret
jmp 0x4e6862
inc dword [esp + 0x28]
jmp 0x4e675e
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov byte [esp + 0x54], 0
add esp, 0x40
ret
call fcn.00475830
nop
call fcn.004743b0
jmp fcn.004e6700
Function at 0x4eaa80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x5efcb0]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4eabdb
sub esp, 0x1c
mov dword [esp + 0x34], 0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
test byte [edx], al
mov edx, dword [edx + 0x14]
mov ebx, dword [esp + 0x24]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call edx
mov eax, dword [esp + 0x28]
inc eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2c]
dec eax
mov dword [esp + 0x14], eax
jmp 0x4eaad5
jmp 0x4eaad7
jmp 0x4eaad9
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x14], eax
setge al
mov byte [esp + 0x13], al
jge 0x4eaaec
jmp 0x4eab20
mov eax, dword [esp + 0x20]
test byte [eax], al
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x24]
mov eax, dword [eax + 0x10]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call eax
movzx eax, byte [esp + 0xc]
mov byte [esp + 0x12], al
xor eax, 1
mov byte [esp + 0x13], al
jmp 0x4eab22
jmp 0x4eab22
movzx eax, byte [esp + 0x13]
test al, al
jne 0x4eab2d
jmp 0x4eab35
inc dword [esp + 0x18]
jmp 0x4eab33
jmp 0x4eaad9
jmp 0x4eab37
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x14], eax
setge al
mov byte [esp + 0x13], al
jge 0x4eab4a
jmp 0x4eab7b
mov eax, dword [esp + 0x20]
test byte [eax], al
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x24]
mov eax, dword [eax + 0x10]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
call eax
movzx eax, byte [esp + 0xc]
mov byte [esp + 0x12], al
mov byte [esp + 0x13], al
jmp 0x4eab7d
jmp 0x4eab7d
movzx eax, byte [esp + 0x13]
test al, al
jne 0x4eab88
jmp 0x4eab90
dec dword [esp + 0x14]
jmp 0x4eab8e
jmp 0x4eab37
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x14], eax
jl 0x4eab9c
jmp 0x4eabaa
jmp 0x4eab9e
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
add esp, 0x1c
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
test byte [edx], al
mov edx, dword [edx + 0x14]
mov ebx, dword [esp + 0x24]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
call edx
inc dword [esp + 0x18]
dec dword [esp + 0x14]
jmp 0x4eabd6
jmp 0x4eaad5
call fcn.004743b0
jmp fcn.004eaa80
Function at 0x10009900
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x11c], ecx
mov eax, dword [ebp - 0x11c]
cmp dword [eax + 0x88], 0xffffffff
jne 0x10009925
xor al, al
jmp 0x10009a79
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x118], 0
jmp 0x10009956
mov edx, dword [ebp - 0x118]
add edx, 1
mov dword [ebp - 0x118], edx
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x108]
jae 0x100099d1
mov ecx, dword [ebp - 0x118]
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp + ecx*4 - 0x104]
cmp eax, dword [edx + 0x88]
jne 0x100099cc
mov ecx, dword [ebp - 0x108]
sub ecx, 1
cmp dword [ebp - 0x118], ecx
jae 0x100099bb
mov edx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp + eax*4 - 0x100]
mov dword [ebp + edx*4 - 0x104], ecx
mov edx, dword [ebp - 0x118]
add edx, 1
mov dword [ebp - 0x118], edx
jmp 0x1000997f
mov eax, dword [ebp - 0x108]
sub eax, 1
mov dword [ebp - 0x108], eax
jmp 0x100099d1
jmp 0x10009947
xor ecx, ecx
jne 0x1000993b
cmp dword [ebp - 0x108], 0x40
jae 0x10009a0a
mov edx, dword [ebp - 0x108]
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax + 0x88]
mov dword [ebp + edx*4 - 0x104], ecx
mov edx, dword [ebp - 0x108]
add edx, 1
mov dword [ebp - 0x108], edx
xor eax, eax
jne 0x100099d9
push 8
push 0
lea ecx, [ebp - 0x114]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
lea edx, [ebp - 0x114]
push edx
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call sub.WS2_32.dll_select
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffff
je 0x10009a52
cmp dword [ebp - 0x10c], 0
jne 0x10009a56
xor al, al
jmp 0x10009a79
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x11c]
mov eax, dword [edx + 0x88]
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x10009a77
xor al, al
jmp 0x10009a79
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x10009b00
Capabilities:
Check for time delay via gettickcount
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x230], ecx
cmp dword [ebp + 8], 0
je 0x10009b25
cmp dword [ebp + 0xc], 0
jne 0x10009b2c
xor eax, eax
jmp 0x10009d2c
mov eax, dword [ebp - 0x230]
cmp dword [eax], 0
je 0x10009b7b
mov ecx, dword [ebp - 0x230]
add ecx, 0x108
push ecx
call sub.ntdll.dll_strlen
add esp, 4
cmp dword [ebp + 0xc], eax
jae 0x10009b58
xor eax, eax
jmp 0x10009d2c
mov edx, dword [ebp - 0x230]
add edx, 0x108
push edx
mov eax, dword [ebp + 8]
push eax
call sub.ntdll.dll_strcpy
add esp, 8
mov eax, 1
jmp 0x10009d2c
call sym.Comn.dll_GetObjectSys
mov dword [ebp - 0x21c], eax
call sym.Comn.dll_GetObjectVol
mov dword [ebp - 4], eax
mov word [ebp - 0x218], 0
push 0x206
push 0
lea ecx, [ebp - 0x216]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x104
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x34]
call eax
test eax, eax
jne 0x10009c71
lea ecx, [ebp - 0x220]
push ecx
push 1
push 0
push str.SYSTEMSetup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x10009bff
xor eax, eax
jmp 0x10009d2c
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x228], 0x104
lea edx, [ebp - 0x228]
push edx
mov eax, dword [ebp - 0x230]
add eax, 4
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 0
push str.SystemPartition
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x10009c62
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10009d2c
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10009c90
push 0x104
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x230]
add eax, 4
push eax
call dword [sym.imp.ntdll.dll_wcstombs]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
and ecx, 0x3e8
push ecx
push str.._systmp_d
mov edx, dword [ebp - 0x230]
add edx, 0x108
push edx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
mov eax, dword [ebp - 0x230]
add eax, 4
push eax
mov ecx, dword [ebp - 0x230]
add ecx, 0x10c
push ecx
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x10009ce5
xor eax, eax
jmp 0x10009d2c
mov edx, dword [ebp - 0x230]
mov dword [edx], 1
mov eax, dword [ebp - 0x230]
add eax, 0x108
push eax
call sub.ntdll.dll_strlen
add esp, 4
cmp dword [ebp + 0xc], eax
jae 0x10009d0e
xor eax, eax
jmp 0x10009d2c
mov ecx, dword [ebp - 0x230]
add ecx, 0x108
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.ntdll.dll_strcpy
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret 8