joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d530
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x105
mov eax, dword [ebp - 8]
call fcn.0040b638
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetTempPathA
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0040b624
mov eax, dword [ebp - 0xc]
call fcn.0040b684
mov esp, ebp
pop ebp
ret

Function at 0x4a0944
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 8], eax
push 1
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 8]
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, dword [ebp - 4]
cdq
cmp edx, dword [esp + 4]
jne 0x4a0987
cmp eax, dword [esp]
pop edx
pop eax
ja 0x4a0955
jmp 0x4a098b
pop edx
pop eax
jg 0x4a0955
pop ecx
pop ecx
pop ebp
ret

Function at 0x4a50f4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41b0b0]
call fcn.00405df8
xor eax, eax
push ebp
push 0x4a5238
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x7cc4d8], 0
jne 0x4a5147
mov ecx, dword [0x7d63c0]
mov dl, 1
mov eax, dword [0x4092e0]
call fcn.0040f3ac
call fcn.00404c14
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403450
mov eax, ebx
call fcn.00405b4c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4a5248
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004071f8
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405b5c
test eax, eax
jle 0x4a51df
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4a51d8
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00405510
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004054f8
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0040a2d8
test eax, eax
jne 0x4a51d8
mov ebx, 0x15
jmp 0x4a51e4
mov ebx, 0x10
jmp 0x4a51e4
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x7cc4d8]
call fcn.004a504c
mov eax, dword [ebp - 8]
call fcn.004a504c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00407210
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a523f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040529c
lea eax, [ebp - 0x10]
mov edx, dword [0x41b0b0]
call fcn.00405ec8
ret
Function at 0x4a692c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405738
xor eax, eax
push ebp
push 0x4a6a94
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0040b1f4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040a0f8
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00405548
mov ecx, eax
mov edx, 2
mov eax, dword [ebp - 0x1c]
call fcn.004057a8
mov eax, dword [ebp - 0x1c]
mov edx, 0x4a6aa8
call fcn.00405694
jne 0x4a69aa
lea eax, [ebp - 0x1c]
mov edx, 0x4a6ab4
call fcn.00405310
mov eax, dword [ebp - 0x1c]
call fcn.00405748
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0040b0f4
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.00405310
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00405748
push eax
mov eax, dword [0x7d8668]
push eax
call sub.kernel32.dll_FindResourceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x7d8668]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4a6a24
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 4]
mov edx, 0x4a6ac4
call fcn.00405594
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x41ba30]
call fcn.0040f2f0
call fcn.00404c14
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
call fcn.00421d10
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x7d8668]
push eax
call sub.kernel32.dll_SizeofResource
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00421790
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00408c8c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6a9b
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.0040529c
lea eax, [ebp - 4]
call fcn.00405278
ret
Function at 0x4a9868
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.00402808
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a98d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00405480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a98e0
mov eax, dword [ebp - 0xc]
call fcn.00402828
ret

Function at 0x4a99a8
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 0x40
call fcn.00403450
mov eax, dword [ebp - 4]
mov dword [eax], 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a99fb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a9ae0
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a9a05
cmp dword [ebp - 0xc], 0
je 0x4a9a1c
push 0x4a9af0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4a9a6c
mov eax, dword [ebp - 4]
push eax
call dword [ebp - 0x10]
test eax, eax
je 0x4a9a6c
xor eax, eax
push ebp
push 0x4a9a58
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x4a9a4a
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FreeLibrary_1
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a9a66
cmp byte [ebp - 5], 0
jne 0x4a9ad6
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x28]
xor edx, edx
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], edx
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], edx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], edx
mov eax, dword [ebp - 4]
mov dword [eax], 1
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ab444
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x105
mov eax, dword [ebp - 8]
call fcn.0040b638
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetTempPathA
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.0040b624
mov eax, dword [ebp - 0xc]
call fcn.0040b684
mov esp, ebp
pop ebp
ret

Function at 0x4ab484
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405738
mov eax, dword [ebp - 0xc]
call fcn.00405738
xor eax, eax
push ebp
push 0x4ab521
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405748
push eax
push 1
push 3
push 1
push 0x10030
mov eax, dword [ebp - 8]
call fcn.00405748
push eax
mov eax, dword [ebp - 8]
call fcn.00405748
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4ab4f9
mov byte [ebp - 0xd], 0
jmp 0x4ab506
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab528
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040529c
ret

Function at 0x4ab530
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405738
xor eax, eax
push ebp
push 0x4ab633
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x10
mov eax, dword [ebp - 8]
call fcn.00405748
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4ab580
mov byte [ebp - 9], 0
jmp 0x4ab610
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_StartServiceA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [0x7cc520], eax
cmp byte [0x7cc524], 0
je 0x4ab607
cmp byte [ebp - 9], 0
jne 0x4ab5f4
push 0
push 0x4ab644
mov eax, dword [ebp - 0x18]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.0040a928
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x4ab658
call fcn.00405594
mov eax, dword [ebp - 0x1c]
call fcn.00405748
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0x4ab607
push 0
push 0x4ab660
push 0x4ab670
push 0
call sub.user32.dll_MessageBoxA_1
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab63a
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.0040529c
lea eax, [ebp - 8]
call fcn.00405278
ret
Function at 0x4ab724
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405738
xor eax, eax
push ebp
push 0x4ab7a6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
mov eax, dword [ebp - 8]
call fcn.00405748
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4ab769
mov byte [ebp - 9], 0
jmp 0x4ab790
lea eax, [ebp - 0x30]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ControlService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov al, byte [ebp - 0x11]
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab7ad
lea eax, [ebp - 8]
call fcn.00405278
ret

Function at 0x4ab7b4
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405738
xor eax, eax
push ebp
push 0x4ab83b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x10000
mov eax, dword [ebp - 8]
call fcn.00405748
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4ab7fc
mov byte [ebp - 9], 0
jmp 0x4ab825
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_DeleteService
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x11], al
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov al, byte [ebp - 0x11]
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab842
lea eax, [ebp - 8]
call fcn.00405278
ret
Function at 0x4ab9e4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4ab9ec
push ecx
xor eax, eax
push ebp
push 0x4abbba
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x7d8d68], 0x80102058
mov dword [0x7d8d6c], 0x8010205c
mov dword [0x7d8d70], 0x80102060
mov dword [0x7d8d74], 0x80102064
mov dword [0x7d8d78], 0x80102068
mov dword [0x7d8d7c], 0x8010206c
mov dword [0x7d8d80], 0x8010204c
mov dword [0x7d8d84], 0x80102050
mov dword [0x7d8d88], 0x80102054
mov dword [0x7d8d8c], 0x80102040
mov dword [0x7d8d90], 0x80102044
mov dword [0x7d8d94], 0x80102070
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402bf8
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
mov edx, 0x4abbd0
call fcn.0040b0f4
mov eax, dword [ebp - 8]
call fcn.0040adec
test al, al
jne 0x4ababa
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402bf8
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 8]
mov edx, 0x4abbe0
call fcn.0040b0f4
cmp dword [0x7cc518], 0
je 0x4abad1
lea eax, [ebp - 8]
mov edx, dword [0x7cc518]
call fcn.00405310
mov eax, dword [0x7d8d9c]
call fcn.004ab84c
mov ecx, 0x7d8d98
mov edx, dword [ebp - 8]
mov eax, dword [0x7d8d9c]
call fcn.004ab934
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x4abb8c
mov eax, dword [0x7d8d9c]
call fcn.004ab84c
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.0040b1bc
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
call fcn.004ab444
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0041001c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0xc]
pop ecx
call fcn.00405594
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405748
push eax
mov eax, dword [ebp - 8]
call fcn.00405748
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4abb8c
xor eax, eax
mov dword [0x7cc51c], eax
jmp 0x4abb83
mov ecx, 0x7d8d98
mov edx, dword [ebp - 0xc]
mov eax, dword [0x7d8d9c]
call fcn.004ab934
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x4abb8c
push 0x1f4
call sub.kernel32.dll_Sleep_1
inc dword [0x7cc51c]
cmp dword [0x7cc51c], 5
jl 0x4abb58
mov al, byte [ebp - 0xd]
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4abbc1
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.0040529c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040529c
ret
Function at 0x4abbe8
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4abd7e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x7d8d68], 0x80102058
mov dword [0x7d8d6c], 0x8010205c
mov dword [0x7d8d70], 0x80102060
mov dword [0x7d8d74], 0x80102064
mov dword [0x7d8d78], 0x80102068
mov dword [0x7d8d7c], 0x8010206c
mov dword [0x7d8d80], 0x8010204c
mov dword [0x7d8d84], 0x80102050
mov dword [0x7d8d88], 0x80102054
mov dword [0x7d8d8c], 0x80102040
mov dword [0x7d8d90], 0x80102044
mov dword [0x7d8d94], 0x80102070
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402bf8
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
mov edx, 0x4abd94
call fcn.0040b0f4
mov eax, dword [0x7d8d9c]
call fcn.004ab84c
mov ecx, 0x7d8d98
mov edx, dword [ebp - 8]
mov eax, dword [0x7d8d9c]
call fcn.004ab934
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x4abd50
mov eax, dword [0x7d8d9c]
call fcn.004ab84c
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.0040b1bc
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
call fcn.004ab444
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041001c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
pop ecx
call fcn.00405594
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405748
push eax
mov eax, dword [ebp - 8]
call fcn.00405748
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4abd50
xor eax, eax
mov dword [0x7cc51c], eax
jmp 0x4abd47
mov ecx, 0x7d8d98
mov edx, dword [ebp - 0xc]
mov eax, dword [0x7d8d9c]
call fcn.004ab934
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x4abd50
push 0x1f4
call sub.kernel32.dll_Sleep_1
inc dword [0x7cc51c]
cmp dword [0x7cc51c], 5
jl 0x4abd1c
mov al, byte [ebp - 0xd]
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4abd85
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.0040529c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040529c
ret
Function at 0x4abd9c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4abda4
push ecx
xor eax, eax
push ebp
push 0x4abf2a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x7d8d68], 2
mov dword [0x7d8d6c], 3
mov dword [0x7d8d70], 4
mov dword [0x7d8d74], 5
mov dword [0x7d8d78], 6
mov dword [0x7d8d7c], 7
mov dword [0x7d8d80], 8
mov dword [0x7d8d84], 9
mov dword [0x7d8d88], 0xa
mov dword [0x7d8d8c], 0xb
mov dword [0x7d8d90], 0xc
mov dword [0x7d8d94], 0xd
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402bf8
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
mov edx, 0x4abf40
call fcn.0040b0f4
push 0
push 0x4000000
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, 0x4abf50
call fcn.00405594
mov eax, dword [ebp - 0x14]
call fcn.00405748
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x7d8d98], eax
cmp dword [0x7d8d98], 0xffffffff
jne 0x4abf04
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.0040b1bc
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
call fcn.004ab444
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041001c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
pop ecx
call fcn.00405594
push 0
mov eax, dword [ebp - 0xc]
call fcn.00405748
push eax
mov eax, dword [ebp - 8]
call fcn.00405748
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4abf04
push 0
push 0x4000000
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4abf50
call fcn.00405594
mov eax, dword [ebp - 0x24]
call fcn.00405748
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [0x7d8d98], eax
cmp dword [0x7d8d98], 0xffffffff
setne byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4abf31
lea eax, [ebp - 0x24]
mov edx, 8
call fcn.0040529c
ret
Function at 0x4ad930
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe60
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405738
xor eax, eax
push ebp
push 0x4ada38
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1a0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor eax, eax
push ebp
push 0x4ada07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405748
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4ad9e7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4ad9cf
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx]
mov byte [eax], dl
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 1]
mov byte [eax + 1], dl
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 2]
mov byte [eax + 2], dl
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 3]
mov byte [eax + 3], dl
jmp 0x4ad9fd
mov ecx, 0x4ada50
mov dl, 1
mov eax, dword [0x4092e0]
call fcn.0040f2f0
call fcn.00404c14
jmp 0x4ad9fd
mov ecx, 0x4ada78
mov dl, 1
mov eax, dword [0x4092e0]
call fcn.0040f2f0
call fcn.00404c14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ada1d
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ada3f
lea eax, [ebp - 4]
call fcn.00405278
ret

Function at 0x4ada90
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405738
xor eax, eax
push ebp
push 0x4adb1e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
call sub.icmp.dll_IcmpCreateFile
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4adb08
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004ad930
mov eax, dword [ebp - 8]
push eax
push 0x80
lea eax, [ebp - 0x98]
push eax
push 0
push 0
push 0
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
push eax
call sub.icmp.dll_IcmpSendEcho
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
setne byte [ebp - 9]
mov eax, dword [ebp - 0x10]
push eax
call sub.icmp.dll_IcmpCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adb25
lea eax, [ebp - 4]
call fcn.00405278
ret