joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40be26
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov eax, 0x47d726
call fcn.0047bf90
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.00429f36
mov dword [esi], 0x483c14
mov dword [ebp - 4], edi
mov dword [esi + 0x10], edi
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 1
call fcn.0042302c
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0042302c
push edi
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 3
call fcn.00429f36
push edi
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 4
call fcn.00429f36
push edi
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 5
call fcn.00429f36
push edi
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 6
call fcn.00429f36
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x84], edi
mov dword [esi], 0x483c00
mov dword [esi + 0xc], 0x64
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40e77c
Capabilities:
Get common file path

Disassembly:
mov eax, 0x47dc97
call fcn.0047bf90
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call fcn.0042bc6f
xor esi, esi
push 0x104
inc esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.0042c46b
push eax
push ebx
push ebx
push 5
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jge 0x40e7db
push eax
lea eax, [ebp - 0x1c]
push str.SHGetFolderPathW___Error_X
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0x1c]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0042c541
lea eax, [ebp - 0x10]
push eax
call fcn.0040b294
pop ecx
lea eax, [ebp - 0x10]
mov ecx, dword [ebp + 8]
push eax
call fcn.0042bc7b
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0042bf6c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4134a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
mov eax, 0x47e75b
call fcn.0047bf90
sub esp, 0xf0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
jmp 0x4134c4
xor ebx, ebx
lea ecx, [esi + 0x10]
mov dword [ebp - 4], ebx
call fcn.0041ec7d
cmp byte [esi + 0x18], bl
je 0x4135d3
push str.___NEED_UPDATE___
lea ecx, [esi + 0xb8]
call fcn.0042a01c
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0040ba66
pop ecx
pop ecx
lea eax, [ebp - 0xfc]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040aea6
pop ecx
pop ecx
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0040b9ae
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0042c0ad
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.0042bf6c
lea ecx, [ebp - 0x20]
call fcn.0042b153
push ebx
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.0042c46b
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0xfc]
push ecx
push edi
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
jne 0x4135b7
lea ecx, [ebp - 0x14]
call fcn.0042b153
push eax
lea ecx, [ebp - 0x40]
call fcn.0042aa6e
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.0042b153
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea eax, [ebp - 0x38]
push str.Cant_run__s_error_d
push eax
call fcn.0042783a
add esp, 0x10
lea eax, [ebp - 0x38]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.0042bf6c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.0042bf6c
jmp 0x413764
mov eax, dword [0x4ae41c]
push 0x4a12a4
xor eax, 0xfe7ded7b
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040b452
add esp, 0xc
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 5
call fcn.0042b153
push eax
lea ecx, [esi + 0xb8]
call fcn.0042a01c
mov ecx, esi
call fcn.00412c6e
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DrawMenuBar]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.0042a9b6
jmp 0x413764
or dword [ebp - 4], 0xffffffff
cmp byte [esi + 0x18], bl
push ebx
je 0x413790
push ebx
push 0x10
mov byte [0x4ae405], 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
mov ecx, 0x4ae4d0
mov dword [ebp - 4], 0xc
call fcn.0040a629
jmp 0x413781
Function at 0x419da8
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x47f26c
call fcn.0047bf90
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x28]
call fcn.00429f36
and dword [ebp - 4], 0
mov ecx, eax
call fcn.0042a00c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x10], eax
call fcn.00429f64
push 0
lea ecx, [ebp - 0x1c]
call fcn.00429f36
push dword [ebp - 0x10]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push 0xa2
push 0x7e
push ebx
push edi
push 7
push 0x3c
push dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 1
push eax
call fcn.00419ced
push dword [ebp - 0x10]
add ebx, 0x15
add edi, 0xa
mov ecx, esi
push 0xa
push 0x71
push ebx
mov dword [ebp + 0x10], edi
push edi
mov edi, 0x10003
push edi
push 0xe
push dword [ebp + 8]
push esi
call fcn.00419ced
push dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
add ebx, 0x10
add eax, 0x17
push 0xa
push 0x5e
push ebx
push eax
push edi
push 0xf
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
lea eax, [esi + 0xc]
mov ecx, esi
push eax
call fcn.00419ced
push dword [ebp - 0x10]
add ebx, 0x10
lea eax, [esi + 0x18]
mov ecx, esi
push 0xa
push 0x5e
push ebx
push dword [ebp + 0xc]
push edi
push 0x10
push dword [ebp + 8]
push eax
call fcn.00419ced
push dword [ebp - 0x10]
add ebx, 0x10
push 0xa
push 0x5e
push ebx
push dword [ebp + 0xc]
lea eax, [esi + 0x24]
mov ecx, esi
push edi
push 0x11
push dword [ebp + 8]
push eax
call fcn.00419ced
push dword [ebp - 0x10]
add ebx, 0x14
lea eax, [esi + 0x30]
mov ecx, esi
push 0xa
push 0x71
push ebx
push dword [ebp + 0x10]
push edi
push 0x12
push dword [ebp + 8]
push eax
call fcn.00419ced
push dword [ebp - 0x10]
add ebx, 0x10
lea eax, [esi + 0x3c]
mov ecx, esi
push 0xa
push 0x71
push ebx
push dword [ebp + 0x10]
push edi
push 0x13
push dword [ebp + 8]
push eax
call fcn.00419ced
push dword [ebp - 0x10]
add ebx, 0x10
lea eax, [esi + 0x48]
mov ecx, esi
push 0xa
push 0x71
push ebx
push dword [ebp + 0x10]
push edi
push 0x14
push dword [ebp + 8]
push eax
call fcn.00419ced
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00429f64
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x41bbd2
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x20], ebx
jne 0x41bc05
push 0x4ae3c0
lea ecx, [esi + 0x38]
mov byte [esi + 0x24], bl
call fcn.0042ab80
lea eax, [esp + 8]
push eax
push ebx
push esi
push 0x41bc5d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x20], eax
pop esi
pop ebx
pop ecx
ret
Function at 0x41c45f
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push esi
xor esi, esi
push edi
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x41c47f
xor eax, eax
jmp 0x41c4d0
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
jmp 0x41c4bb
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x41c4c1
lea eax, [ebp - 0x128]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41c498
jmp 0x41c4c7
mov esi, dword [ebp - 0x120]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x41c6db
Capabilities:
Get session user name
Impersonate user

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 8], esi
mov dword [esi], edi
mov dword [esi + 4], edi
cmp byte [0x4ae404], 0
je 0x41c80d
mov ecx, 0x4ae520
call fcn.0041c4d4
cmp eax, edi
mov dword [esi + 4], eax
je 0x41c80d
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x41c73c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR__d_ImpersonateLoggedOnUser__
push str.S:Ammyy_sourcesmainImpersonateWrapper.cpp
push edi
push 0x4aea90
jmp 0x41c805
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x80
push eax
lea eax, [ebp - 0xac]
push eax
mov byte [ebp - 1], 1
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
mov ebx, str.S:Ammyy_sourcesmainImpersonateWrapper.cpp
mov esi, 0x4aea90
jne 0x41c781
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR__d_GetUserName__
push ebx
push edi
push esi
call fcn.0041c87e
add esp, 0x14
and byte [ebp - 1], 0
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test eax, eax
jne 0x41c7a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR__d_RevertToSelf__
push ebx
push edi
push esi
call fcn.0041c87e
add esp, 0x14
cmp byte [ebp - 1], 0
je 0x41c80d
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 8]
lea eax, [ebp - 0xac]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x20
push dword [edi + 4]
mov dword [ebp - 0x28], 1
call dword [sym.imp.USERENV.dll_LoadUserProfileA]
test eax, eax
jne 0x41c7eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR__d_LoadUserProfile__
jmp 0x41c801
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41c7fb
cmp eax, 0xffffffff
je 0x41c7fb
mov dword [edi], eax
jmp 0x41c80d
push eax
push str.Invalid_profile_X
push ebx
push 0
push esi
call fcn.0041c87e
add esp, 0x14
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41cb1f
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, 0x47f577
call fcn.0047bf90
mov eax, 0x1de8
call fcn.0047c050
push ebx
push esi
push edi
mov esi, ecx
push 0x200
lea ecx, [ebp - 0x24]
call fcn.00428ef2
and dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.00452b4b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
push 0x3d
mov edi, ebx
lea ecx, [ebp - 0x24]
shr edi, 7
call fcn.00429090
push ebx
lea ecx, [ebp - 0x24]
call fcn.0042909f
lea eax, [ebp - 0x3c]
push 0x10
push eax
lea ecx, [ebp - 0x24]
call fcn.00429058
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
test al, al
sete cl
inc cl
test al, al
mov byte [ebp - 0x28], cl
je 0x41cb99
push 0x37
pop ebx
jmp 0x41cb9c
mov ebx, dword [esi + 8]
push edi
lea ecx, [ebp - 0x24]
call fcn.0042909f
push 0
lea ecx, [ebp - 0x24]
call fcn.0042909f
call fcn.00421ef5
push eax
lea ecx, [ebp - 0x24]
call fcn.004290ae
push dword [ebp - 0x28]
lea ecx, [ebp - 0x24]
call fcn.00429090
mov eax, dword [0x4ae41c]
lea ecx, [ebp - 0x24]
xor eax, 0xfe7ded7b
push eax
call fcn.004290ae
push ebx
lea ecx, [ebp - 0x24]
call fcn.004290ae
mov eax, dword [esi]
lea ecx, [ebp - 0x24]
push ecx
mov ecx, esi
call dword [eax + 0x14]
mov ecx, dword [esi + 0xc]
push 1
push 0x4a203c
add ecx, 0xc
call fcn.00427428
lea ecx, [ebp - 0x1df4]
call fcn.0043ed7d
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x1df4]
add eax, 0xc
mov byte [ebp - 4], 1
push eax
call fcn.0042593a
push 0x12
lea ecx, [ebp - 0x24]
call fcn.00429f6b
inc eax
lea ecx, [ebp - 0x1df4]
push eax
call fcn.004272d8
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x24]
add eax, 0xffffffed
push eax
call fcn.00429f6b
mov ecx, dword [esi + 0xc]
add eax, 0x13
push eax
add ecx, 0xc
call fcn.004272d8
push 0
lea ecx, [ebp - 0x24]
push dword [ebp - 0x18]
call fcn.00429f6b
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
je 0x41cc9c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [ebp - 0x2c]
push str.error_d__while_sending_Initial_msg
push eax
call fcn.0041d9ad
add esp, 0xc
lea eax, [ebp - 0x2c]
push 0x491e98
push eax
call sub.MSVCRT.dll__CxxThrowException
and byte [ebp - 4], 0
lea ecx, [ebp - 0x1df4]
call fcn.0041c138
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00428f7e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41d737
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, dword [ebp + 0x14]
mov ebx, eax
and dword [ebp + 0x14], 0
lea eax, [ebp + 0x14]
push eax
push 0x4004667f
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp dword [ebp + 0x14], esi
jae 0x41d798
call edi
sub eax, ebx
cmp eax, dword [ebp + 0xc]
ja 0x41d77a
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41d74c
lea eax, [ebp - 8]
push str.Routers_Initial_reply_timeout_is_expired
push eax
call fcn.0041d9ad
pop ecx
lea eax, [ebp - 8]
pop ecx
push 0x491e98
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
je 0x41d7d1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [ebp - 8]
push str.ReadNonBlock___error_d
push eax
call fcn.0041d9ad
add esp, 0xc
lea eax, [ebp - 8]
push 0x491e98
push eax
call sub.MSVCRT.dll__CxxThrowException
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x41d926
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0
push ecx
push 0x41d99f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x41d96c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc]
push str.CreateThread___Error__d
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x41d99d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc]
push str.CloseHandle___Error__d
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
leave
ret

Function at 0x41e23d
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
test eax, eax
je 0x41e2a8
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 4
push eax
push 0xffffff7f
push 0xffff
push dword [esi + 0x24]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x41e28e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.setsockopt_SO_DONTLINGER__error_d
push 0x4aea90
call fcn.004287df
add esp, 0xc
push dword [esi + 0x24]
call dword [sym.imp.WS2_32.dll_closesocket]
and dword [esi + 0x24], 0
push 0x18e
lea ecx, [esi + 4]
call fcn.0042909f
pop esi
leave
ret
Function at 0x41e5f1
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push 0
push 0x4000
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
push esi
push dword [esp + 0xc]
push str.ReTranslator::SimpleRead1__X__read__d_bytes
push 0x4aea90
call fcn.004287f7
add esp, 0x10
test esi, esi
jle 0x41e628
mov eax, esi
pop esi
ret
jge 0x41e63b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x41e63b
xor eax, eax
pop esi
ret
or eax, 0xffffffff
pop esi
ret

Function at 0x41e640
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
lea esi, [ebx + 4]
push edi
mov edi, dword [esi + 0xc]
sub edi, dword [esi + 0x10]
test edi, edi
jle 0x41e697
mov eax, 0x4000
cmp edi, eax
jg 0x41e65e
mov eax, edi
push 0
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_send]
mov ebp, eax
push ebp
push dword [ebx]
push str.ReTranslator::SimpleSend___X__send__d_bytes
push 0x4aea90
call fcn.004287f7
add esp, 0x10
test ebp, ebp
jle 0x41e6a8
cmp ebp, edi
mov ecx, esi
jne 0x41e69e
mov eax, dword [esi]
call dword [eax + 8]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
ret
push ebp
push 0
call fcn.004291a5
jmp 0x41e697
jge 0x41e6b7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x41e697
xor al, al
jmp 0x41e699
Function at 0x41e6bb
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x24]
mov eax, dword [esi]
mov ecx, dword [edi]
xor ebx, ebx
xor edx, edx
inc ebx
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x208], ebx
cmp dword [ebp + edx*4 - 0x204], ecx
je 0x41e6f5
inc edx
cmp edx, ebx
jb 0x41e6e7
cmp edx, ebx
jne 0x41e709
mov dword [ebp - 0x200], ecx
mov dword [ebp - 0x208], 2
mov edx, dword [esi + 0x10]
sub edx, dword [esi + 0x14]
je 0x41e721
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x104], 1
mov eax, dword [esi + 0x34]
sub eax, dword [esi + 0x38]
je 0x41e759
mov edx, dword [ebp - 0x104]
xor eax, eax
test edx, edx
jbe 0x41e743
cmp dword [ebp + eax*4 - 0x100], ecx
je 0x41e743
inc eax
cmp eax, edx
jb 0x41e735
cmp eax, edx
jne 0x41e759
cmp edx, 0x40
jae 0x41e759
mov dword [ebp + eax*4 - 0x100], ecx
inc dword [ebp - 0x104]
xor ebx, ebx
lea eax, [ebp - 0x104]
push ebx
push ebx
push eax
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, ebx
jle 0x41e7dd
cmp eax, 4
jg 0x41e7dd
lea eax, [ebp - 0x208]
push eax
push dword [esi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x41e79e
lea eax, [esi + 0x28]
push eax
push dword [esi]
call fcn.0041e7fc
pop ecx
test al, al
pop ecx
je 0x41e7f7
lea eax, [ebp - 0x208]
push eax
push dword [edi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x41e7c1
lea eax, [esi + 4]
push eax
push dword [edi]
call fcn.0041e7fc
pop ecx
test al, al
pop ecx
je 0x41e7f7
mov ecx, edi
call fcn.0041e640
test al, al
je 0x41e7f7
mov ecx, esi
call fcn.0041e640
test al, al
jne 0x41e6cc
jmp 0x41e7f7
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ReTranslate__1_error_d__d
push 0x4aea90
call fcn.004287df
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41e7fc
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, 0x4000
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
add ecx, edi
push ecx
mov ecx, esi
call dword [eax + 4]
mov eax, dword [esi]
push 0
push edi
mov ecx, esi
call dword [eax + 0x18]
push eax
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x41e83b
push eax
push 0
mov ecx, esi
call fcn.00429058
mov al, 1
jmp 0x41e86d
jge 0x41e86b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x41e837
cmp eax, 0x2746
je 0x41e86b
cmp eax, 0x2745
je 0x41e86b
push eax
push str.ReTranslator::SimpleRead__1_error_d
push 0x4aea90
call fcn.004287df
add esp, 0xc
xor al, al
pop edi
pop esi
ret

Function at 0x41ebf4
Capabilities:
Identify system language via api

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edx, 0x3ff
mov ecx, 0x4a292c
and eax, edx
xor esi, esi
mov di, word [ecx]
and di, dx
cmp ax, di
je 0x41ec2a
add ecx, 0x18
inc esi
cmp ecx, 0x4a2adc
jl 0x41ec0a
mov ax, word [0x4a292c]
pop edi
pop esi
ret
lea eax, [esi + esi*2]
mov ax, word [eax*8 + 0x4a292c]
jmp 0x41ec27
Function at 0x420135
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0x14]
mov byte [eax], bl
mov eax, dword [ebp + 0xc]
push edi
push 0xf003f
push ebx
mov byte [eax], bl
mov eax, dword [ebp + 0x10]
push ebx
mov edi, ecx
mov byte [eax], bl
mov byte [esi], bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
mov dword [ebp + 0x14], eax
je 0x4201c7
push 0xf01ff
lea ecx, [edi + 4]
call fcn.0042b153
push eax
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
cmp edi, ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
je 0x4201bc
lea eax, [ebp - 0x1c]
mov byte [esi], 1
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4201b7
cmp dword [ebp - 0x18], 4
jne 0x4201ab
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
cmp dword [ebp - 0x18], 1
jne 0x4201b7
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
push edi
call ebx
jmp 0x4201c2
mov eax, dword [ebp + 8]
mov byte [eax], 1
push dword [ebp + 0x14]
call ebx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4201ce
Capabilities:
Create service
Persist via windows service

Disassembly:
mov eax, 0x47f998
call fcn.0047bf90
sub esp, 0x1c
push ebx
xor ebx, ebx
push esi
lea eax, [ebp - 0x20]
push ebx
push eax
mov esi, ecx
call fcn.0040ba66
lea eax, [ebp - 0x20]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x24]
push 0x4a32e4
push eax
call fcn.0042c2bb
push str.___service
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
call fcn.0042c250
add esp, 0x20
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.0042bf6c
mov ecx, esi
call fcn.0042b153
push eax
lea ecx, [ebp - 0x14]
call fcn.0042c02c
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 4
call fcn.0042c44d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0042bf6c
lea ecx, [esi + 4]
call fcn.0042b153
push eax
lea ecx, [ebp - 0x1c]
call fcn.0042c02c
lea ecx, [esi + 8]
mov byte [ebp - 4], 5
call fcn.0042b153
push eax
lea ecx, [ebp - 0x18]
call fcn.0042c02c
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.0042b153
push eax
push 1
push 2
push 0x10
push 0xf01ff
lea ecx, [ebp - 0x18]
call fcn.0042b153
push eax
lea ecx, [ebp - 0x1c]
call fcn.0042b153
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
cmp eax, ebx
jne 0x4202fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x4202db
lea eax, [ebp - 0x28]
push str.The_Ammyy_service_is_already_registered
push eax
call fcn.0042783a
pop ecx
lea eax, [ebp - 0x28]
pop ecx
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
push eax
lea eax, [ebp - 0x28]
push str.ERROR__d_CreateServiceW___while_registering_the_Ammyy_service
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0x28]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 1
mov ecx, esi
call fcn.0042034a
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.0042bf6c
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.0042bf6c
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0042bf6c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0042bf6c
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42034a
Capabilities:
Manipulate safe mode programs

Disassembly:
mov eax, 0x47f9bc
call fcn.0047bf90
push ecx
push ecx
add ecx, 4
lea eax, [ebp - 0x10]
push ecx
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_
push eax
call fcn.0042acf7
add esp, 0xc
and dword [ebp - 4], 0
cmp byte [ebp + 8], 0
je 0x4203cd
lea ecx, [ebp + 8]
call fcn.0042994c
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0042b153
push eax
push reloc.WS2_32.dll_bind
lea ecx, [ebp + 8]
call fcn.00428877
push 0x4a32e8
lea ecx, [ebp - 0x14]
call fcn.0042aa29
push eax
push 0
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.00428aeb
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0042a9b6
and byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00428815
jmp 0x4203e2
lea ecx, [ebp - 0x10]
call fcn.0042b153
push eax
push reloc.WS2_32.dll_bind
call fcn.00428b3d
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042a9b6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4