joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c3b5d
Capabilities:
Write file on windows

Disassembly:
push ebp
sub esp, 0x50
push 0x48
mov eax, 0x5d22cd
call fcn.005234b0
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp byte [esi], bl
je 0x4c3d34
lea eax, [esi + 8]
push eax
lea ecx, [ebp + 0x48]
call fcn.00411742
mov byte [ebp - 4], 1
cmp dword [esi + 4], ebx
push ebx
push 0x6a0e4c
jne 0x4c3bb1
add esi, 0x18
mov ecx, esi
call fcn.004acfec
lea eax, [ebp + 0x5c]
push eax
mov ecx, esi
call fcn.004230f9
jmp 0x4c3d24
lea ecx, [ebp + 0x24]
call fcn.004ac9bc
mov byte [ebp - 4], 2
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004adc57
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x24]
call fcn.004ac66a
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4c3d18
push 2
push ebx
push eax
call fcn.0052044a
push dword [esi + 4]
call fcn.00525924
add esp, 0x10
cmp eax, 0xf4240
jle 0x4c3cb3
push dword [esi + 4]
call fcn.0051ed30
pop ecx
push ebx
push str.TeamViewer4_Logfile.log
lea ecx, [ebp]
mov dword [esi + 4], ebx
call fcn.004ac9bc
mov byte [ebp - 4], 5
lea eax, [ebp]
push eax
lea edi, [esi + 0x3c]
lea eax, [ebp - 0x54]
push edi
push eax
call fcn.004adc57
add esp, 0xc
mov byte [ebp - 4], 7
lea ecx, [ebp]
call fcn.004ac66a
push ebx
push str.TeamViewer4_Logfile_OLD.log
lea ecx, [ebp]
call fcn.004ac9bc
mov byte [ebp - 4], 8
lea eax, [ebp]
push eax
lea eax, [ebp + 0x24]
push edi
push eax
call fcn.004adc57
add esp, 0xc
mov byte [ebp - 4], 0xa
lea ecx, [ebp]
call fcn.004ac66a
push dword [ebp + 0x24]
call dword [0x71f624]
push dword [ebp + 0x24]
push dword [ebp - 0x54]
call dword [0x71f6ac]
test eax, eax
setne al
mov byte [ebp + 0x50], al
push dword [ebp + 0x50]
mov ecx, esi
call fcn.004c39f0
mov byte [ebp - 4], 7
lea ecx, [ebp + 0x24]
call fcn.004ac66a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x54]
call fcn.004ac66a
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4c3d18
push eax
push dword [ebp - 0x2c]
lea eax, [ebp - 0x30]
push 1
sub esp, 0x24
mov ecx, esp
mov dword [ebp + 0x50], esp
push eax
call fcn.004ac698
mov byte [ebp - 4], 0xb
lea eax, [ebp + 0x2c]
push eax
mov byte [ebp - 4], 4
call fcn.004ae117
add esp, 0x28
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x18], 0x10
jb 0x4c3cf4
mov eax, dword [eax + 4]
jmp 0x4c3cf7
add eax, 4
push eax
call fcn.0052007a
add esp, 0x10
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp + 0x2c]
call fcn.004108b7
push dword [esi + 4]
call fcn.0051ec62
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.004ac66a
mov byte [ebp - 4], bl
cmp byte [ebp + 0x4c], bl
je 0x4c3d34
mov ecx, dword [ebp + 0x48]
call fcn.0040df8b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x5c]
call fcn.004ac66a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x54
leave
ret 0x24
Function at 0x4c6622
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x70b744]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xd], bl
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x4c6664
lea eax, [ebp - 0x14]
push eax
call fcn.004c6191
cmp eax, 1
pop ecx
je 0x4c673b
mov byte [ebp - 0xd], 1
jmp 0x4c6667
mov dword [ebp - 0x14], esi
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x14]
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call edi
test eax, eax
je 0x4c6698
xor eax, eax
jmp 0x4c673b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4c6691
mov eax, dword [ebp - 0x1c]
call fcn.005259d0
mov esi, esp
cmp esi, ebx
je 0x4c6691
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push esi
push 2
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x4c6691
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4c6691
cmp dword [esi], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
jbe 0x4c6717
lea edi, [esi + 4]
push dword [ebp - 0x24]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4c6710
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add edi, 8
cmp eax, dword [esi]
jb 0x4c66f2
jmp 0x4c6717
mov dword [ebp - 0x20], 1
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x14], ebx
je 0x4c6733
cmp byte [ebp - 0xd], bl
je 0x4c6733
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x20], ebx
setne al
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051d721
leave
ret
Function at 0x4c6eb0
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x70b744]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x88
mov eax, 0x5d2b71
call fcn.005234b0
mov esi, dword [ebp + 0x80c]
xor edi, edi
inc edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x10]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 0x14]
push esi
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.004ca847
add esp, 0x10
cmp dword [ebp - 0x10], ebx
je 0x4c701e
push 0x44
lea eax, [ebp - 0x94]
push ebx
push eax
call fcn.00522720
push 0x10
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.00522720
mov eax, dword [ebp + 0x814]
add esp, 0x18
cmp dword [ebp + 0x828], 8
mov dword [ebp - 0x8c], str.Winsta0Default
mov dword [ebp - 0x94], 0x44
mov dword [ebp - 0x68], 0x20
jae 0x4c6f54
lea eax, [ebp + 0x814]
push eax
lea eax, [ebp]
push eax
call fcn.00523ace
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x94]
push eax
push ebx
push ebx
push 0x400
lea eax, [ebp]
push eax
push ebx
push edi
push esi
call fcn.004ca6bc
add esp, 0x30
test al, al
je 0x4c6f90
cmp dword [ebp - 0x10], ebx
jne 0x4c701e
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x94]
push eax
push ebx
push ebx
push 0x408
push ebx
push ebx
push ebx
lea eax, [ebp]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x4c701e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push str.Could_not_create_a_process__Errorcode:
lea ecx, [ebp - 0x50]
mov esi, eax
call fcn.004ac9bc
mov byte [ebp - 4], 2
push esi
lea ecx, [ebp - 0x50]
call fcn.004ad0b5
sub esp, 0x24
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ebx
push 0x69dd8c
call fcn.004ac9bc
mov byte [ebp - 4], 3
sub esp, 0x24
lea eax, [ebp - 0x50]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.004ac698
mov byte [ebp - 4], 4
mov byte [ebp - 4], 2
mov ecx, 0x721f18
call fcn.00449cf1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x50]
call fcn.004ac66a
mov byte [ebp - 4], bl
push ebx
push edi
lea ecx, [ebp + 0x810]
call fcn.00410779
or dword [ebp - 4], 0xffffffff
push ebx
push edi
lea ecx, [ebp + 0x82c]
call fcn.00410779
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.0051d721
add ebp, 0x804
leave
ret
Function at 0x4cc3c9
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 8
mov eax, 0x5db531
call fcn.005234b0
mov esi, ecx
push esi
lea ecx, [ebp - 0x14]
call fcn.00411742
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
add dword [esi + 0x2c], eax
mov edi, dword [esi + 0x2c]
add dword [esi + 0x6c], eax
cmp edi, 0x400
jl 0x4cc41c
mov eax, edi
cdq
and edx, 0x3ff
add eax, edx
mov ecx, eax
sar ecx, 0xa
add dword [esi + 0x24], ecx
mov eax, ecx
cdq
add dword [esi + 0x30], eax
adc dword [esi + 0x34], edx
shl ecx, 0xa
sub edi, ecx
mov dword [esi + 0x2c], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi + 0x68]
cmp eax, 0xbb8
jbe 0x4cc455
test eax, eax
fild dword [esi + 0x6c]
mov dword [ebp + 8], eax
fild dword [ebp + 8]
jge 0x4cc441
fadd qword [0x6b2e90]
fdivp st(1)
fmul qword [0x6b2ff0]
fstp qword [esi + 0x60]
call edi
and dword [esi + 0x6c], 0
mov dword [esi + 0x68], eax
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x10], 0
je 0x4cc467
mov ecx, dword [ebp - 0x14]
call fcn.0040df8b
call fcn.00523588
ret 4
Function at 0x4cd322
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push ebx
push 0x1f5
call fcn.004cd1e7
mov ebx, eax
test ebx, ebx
pop ecx
je 0x4cd37f
push esi
push edi
lea eax, [ebp - 8]
push eax
push 1
push dword [ebp + 8]
call fcn.004cd0fd
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4cd377
push dword [edi]
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4cd374
mov dword [ebp - 4], 1
push edi
call esi
push ebx
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4cd3cd
Capabilities:
Link many functions at runtime

Disassembly:
push 0x330
push 0x6cf658
call fcn.00525e84
xor ebx, ebx
mov dword [ebp - 0x33c], ebx
mov dword [ebp - 0x338], 0x114
lea eax, [ebp - 0x338]
push eax
call dword [0x71f68c]
test eax, eax
jne 0x4cd406
xor eax, eax
jmp 0x4cd50c
cmp dword [ebp - 0x328], 2
jne 0x4cd427
cmp dword [ebp - 0x334], 4
jne 0x4cd427
cmp dword [ebp - 0x330], ebx
jne 0x4cd427
push str.security.dll
jmp 0x4cd42c
push str.secur32.dll
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x224]
push eax
call dword [0x71f6a8]
mov edi, eax
mov dword [ebp - 0x340], edi
cmp edi, ebx
je 0x4cd3ff
mov dword [ebp - 4], ebx
push str.AcceptSecurityContext
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [0x72eb14], eax
cmp eax, ebx
je 0x4cd4fe
push str.AcquireCredentialsHandleW
push edi
call esi
mov dword [0x72eb18], eax
cmp eax, ebx
je 0x4cd4fe
push str.CompleteAuthToken
push edi
call esi
mov dword [0x72eb1c], eax
push str.DeleteSecurityContext
push edi
call esi
mov dword [0x72eb20], eax
cmp eax, ebx
je 0x4cd4fe
push str.FreeContextBuffer
push edi
call esi
mov dword [0x72eb24], eax
cmp eax, ebx
je 0x4cd4fe
push str.FreeCredentialsHandle
push edi
call esi
mov dword [0x72eb28], eax
cmp eax, ebx
je 0x4cd4fe
push str.InitializeSecurityContextW
push edi
call esi
mov dword [0x72eb2c], eax
cmp eax, ebx
je 0x4cd4fe
push str.QuerySecurityPackageInfoW
push edi
call esi
mov dword [0x72eb30], eax
cmp eax, ebx
je 0x4cd4fe
push str.QuerySecurityContextToken
push edi
call esi
mov dword [0x72eb34], eax
cmp eax, ebx
je 0x4cd4fe
mov dword [ebp - 0x33c], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.004cd518
mov eax, edi
call fcn.00525ecc
ret
Function at 0x4d6ae1
Capabilities:
Create thread

Disassembly:
push 0x24
mov eax, 0x5d59ae
call fcn.005234b0
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
xor edi, edi
cmp byte [ebp + 0x10], bl
mov dword [esi + 8], eax
mov dword [esi + 0x30], ecx
jne 0x4d6b73
lea edx, [ebp + 0x10]
push edx
push 0x10000
push ecx
push eax
push 0x40000
push ebx
mov dword [ebp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x4d6b4e
push ebx
sub esp, 0x24
mov ecx, esp
mov dword [ebp + 8], esp
push ebx
push str.Thread.Create.Failed
call fcn.004ac9bc
mov dword [ebp - 4], ebx
or edi, 0xffffffff
mov dword [ebp - 4], edi
mov ecx, 0x721f30
call fcn.00430cd8
jmp 0x4d6b73
push 0x7387cc
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push ebx
push str.CreateThread__not_running_yet
lea ecx, [ebp - 0x30]
call fcn.004ac9bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004ac66a
mov eax, edi
call fcn.00523588
ret 0xc

Function at 0x4d6b7d
Capabilities:
Create thread
Resume thread

Disassembly:
push 0x2c
mov eax, 0x5d59d9
call fcn.005234b0
mov esi, ecx
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
jne 0x4d6c07
lea eax, [ebp - 0x10]
push eax
push 0x10000
push dword [esi + 0x30]
mov dword [ebp - 0x10], edi
push dword [esi + 8]
push 0x40000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 4], eax
jne 0x4d6be0
push edi
sub esp, 0x24
mov ecx, esp
mov dword [ebp - 0x14], esp
push edi
push str.Thread.Create.Failed
call fcn.004ac9bc
mov dword [ebp - 4], edi
or dword [ebp - 4], 0xffffffff
mov ecx, 0x721f30
call fcn.00430cd8
jmp 0x4d6c13
push 0x7387cc
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push edi
push str.CreateThread__not_running_yet
lea ecx, [ebp - 0x38]
call fcn.004ac9bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004ac66a
jmp 0x4d6c16
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x4d6c16
or edi, 0xffffffff
mov eax, edi
call fcn.00523588
ret
Function at 0x4da371
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x74
mov eax, 0x5d64a9
call fcn.005234b0
mov esi, ecx
lea eax, [esi + 0xcc]
push eax
lea ecx, [ebp - 0x20]
call fcn.00411742
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x98], ebx
jbe 0x4da4ae
lea eax, [ebp - 0x18]
lea edi, [esi + 0x90]
push eax
mov ecx, edi
call fcn.004d927f
mov ecx, edi
jmp 0x4da494
lea ecx, [ebp - 0x18]
call fcn.004cb07f
mov edi, dword [eax + 4]
cmp edi, ebx
je 0x4da486
cmp byte [edi + 4], bl
je 0x4da486
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0x4b0
cmp dword [edi + 0x14], eax
jae 0x4da486
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x2c0]
push ebx
push 1
mov dword [ebp - 0x34], eax
mov dword [esi + 0x2c4], eax
mov eax, dword [esi + 0x2c8]
push ebx
mov dword [ebp - 0x38], eax
mov eax, dword [edi]
push ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
push 0x10
lea eax, [ebp - 0x38]
push eax
push 0x64
mov ecx, esi
call fcn.004d088b
push ebx
push str.GWT.RequestResendPackets_PID
lea ecx, [ebp - 0x5c]
call fcn.004ac9bc
mov byte [ebp - 4], 1
push ebx
push ebx
push dword [edi]
lea ecx, [ebp - 0x80]
call fcn.004ac6f7
mov byte [ebp - 4], 2
sub esp, 0x24
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
lea eax, [ebp - 0x5c]
push eax
push ecx
call fcn.004adc57
add esp, 0xc
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
mov ecx, 0x721f18
call fcn.0041122b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x80]
call fcn.004ac66a
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5c]
call fcn.004ac66a
lea ecx, [ebp - 0x18]
call fcn.004cb0e7
lea ecx, [esi + 0x90]
lea eax, [ebp - 0x28]
push eax
call fcn.004d92a4
push eax
lea ecx, [ebp - 0x18]
call fcn.004cdc46
test al, al
je 0x4da3b7
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x1c], bl
je 0x4da4bf
mov ecx, dword [ebp - 0x20]
call fcn.0040df8b
call fcn.00523588
ret
Function at 0x4dd0be
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
movzx eax, word [edi + 6]
mov esi, ecx
mov ecx, dword [edi]
mov edx, dword [esi + 0x6c]
mov edx, dword [edx + 0x24]
lea ebx, [esi + 0x78]
push ebx
movzx eax, ax
lea ebx, [ebp + 8]
push ebx
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4dd0f9
mov ax, word [ebp + 8]
mov word [edi + 4], ax
xor eax, eax
jmp 0x4dd144
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4dd141
mov eax, 0x80
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x4dd125
push 0x1f4
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4dd10b
test eax, eax
jne 0x4dd141
push 1
lea eax, [ebp + 8]
push eax
lea eax, [esi + 0x78]
push eax
mov eax, dword [esi + 0x6c]
push dword [eax + 0x24]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x4dd0ed
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4dd14b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx edx, word [eax + 4]
mov eax, dword [eax]
push esi
mov esi, dword [ecx + 0x6c]
mov esi, dword [esi + 0x24]
add ecx, 0x8c
push ecx
lea ecx, [ebp + 8]
push ecx
movzx ecx, dx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
pop esi
je 0x4dd17e
xor eax, eax
jmp 0x4dd18d
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x3e5
neg eax
sbb eax, eax
pop ebp
ret 4
Function at 0x4e4a52
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5d8438
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x70b744]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
mov eax, dword [0x70b744]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor esi, esi
push esi
sub esp, 0x24
mov ecx, esp
mov dword [esp + 0x30], esp
push esi
push str.Generating_new_RSA_private_public_key_pair
call fcn.004ac9bc
mov dword [esp + 0xa8], esi
or dword [esp + 0xa8], 0xffffffff
mov ecx, 0x721f18
call fcn.004112c4
push 0x20
push esi
lea ecx, [esp + 0x14]
call fcn.004e4897
mov dword [esp + 0x80], 1
mov esi, 0x400
push esi
lea eax, [esp + 0x10]
push eax
mov ecx, 0x7435cc
call fcn.0047d200
push 0x7435b0
push 0x74359c
mov ecx, 0x743678
call fcn.004e455b
push esi
lea eax, [esp + 0x10]
push eax
mov ecx, 0x7436ec
call fcn.0047d200
push 0x7436d0
push 0x7436bc
mov ecx, 0x743798
call fcn.004e455b
mov byte [0x7422d8], 1
or dword [esp + 0x80], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.004e469b
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0051d721
mov esp, ebp
pop ebp
ret

Function at 0x4e4c8c
Capabilities:
Reference public rsa key

Disassembly:
push esi
push edi
mov edi, 0x94
push edi
mov esi, ecx
push 0x706538
push esi
call fcn.004e4931
push edi
push 0x7065d0
add esi, 0x38
push esi
call fcn.004e4931
add esp, 0x18
pop edi
pop esi
ret

Function at 0x4e6474
Capabilities:
Reference public rsa key

Disassembly:
push 0x64
mov eax, 0x5d8a77
call fcn.00523519
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], ebx
mov eax, dword [esi]
mov ecx, eax
and ecx, 0xf
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], eax
je 0x4e64aa
sub eax, ecx
add eax, 0x10
mov dword [esi], eax
push dword [esi]
call fcn.004fed14
pop ecx
push eax
mov ecx, edi
call fcn.00401899
mov dword [ebp - 4], ebx
push dword [esi]
mov eax, dword [edi]
xor ebx, ebx
push 0
inc ebx
push eax
mov dword [ebp - 0x2c], ebx
call fcn.00522720
push dword [ebp - 0x28]
mov eax, dword [edi]
push dword [ebp - 0x24]
push eax
call fcn.005229e0
mov eax, dword [ebp + 0x14]
add esp, 0x18
test eax, eax
je 0x4e6515
push 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push 0x706538
push eax
call fcn.005229e0
add esp, 0xc
push 0x706548
push 0x10
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x70]
call fcn.004e622c
mov dword [ebp - 4], ebx
jmp 0x4e6530
push 0x706548
push 0x10
push 0x706538
lea ecx, [ebp - 0x70]
call fcn.004e622c
mov dword [ebp - 4], 2
push dword [esi]
mov eax, dword [edi]
push eax
push eax
mov eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x70]
call dword [eax + 0x1c]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.004e5ce0
mov eax, edi
call fcn.0052359c
ret
Function at 0x4e6553
Capabilities:
Reference public rsa key

Disassembly:
push 0x6c
mov eax, 0x5d8ac5
call fcn.00523519
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], ebx
push dword [esi]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], eax
call fcn.004fed14
pop ecx
push eax
mov ecx, edi
call fcn.00401899
mov dword [ebp - 4], ebx
push dword [esi]
mov eax, dword [edi]
push dword [ebp - 0x24]
inc ebx
push eax
mov dword [ebp - 0x28], ebx
call fcn.005229e0
mov eax, dword [ebp + 0x14]
add esp, 0xc
test eax, eax
je 0x4e65d2
push 0xc
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
push 0x706538
push eax
call fcn.005229e0
add esp, 0xc
push 0x706548
push 0x10
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x78]
call fcn.004e6300
mov dword [ebp - 4], ebx
jmp 0x4e65ed
push 0x706548
push 0x10
push 0x706538
lea ecx, [ebp - 0x78]
call fcn.004e6300
mov dword [ebp - 4], 2
push dword [esi]
mov eax, dword [edi]
push eax
push eax
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x78]
call dword [eax + 0x1c]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x78]
call fcn.004e5a15
mov eax, edi
call fcn.0052359c
ret

Function at 0x4ea5e5
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
push ebx
push esi
push edi
mov esi, ecx
jne 0x4ea5ff
push eax
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov edi, dword [sym.imp.WSOCK32.dll_setsockopt]
push 4
mov dword [esi + 0x2cc], eax
lea eax, [ebp + 8]
push eax
push 0x1002
mov ebx, 0xffff
push ebx
push dword [esi + 0x2cc]
mov dword [ebp + 8], 0x20000
call edi
push 4
lea eax, [ebp + 8]
push eax
push 0x1001
push ebx
push dword [esi + 0x2cc]
call edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4ea67e
Capabilities:
Resolve dns
Send data
Send data on socket
Set socket configuration

Disassembly:
push 0x1c
mov eax, 0x5d9c1b
call fcn.00523519
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov ebx, ecx
xor edi, edi
cmp dword [ebx + 0x2cc], 0xffffffff
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], esi
jne 0x4ea6a9
push edi
call fcn.004ea5e5
cmp dword [ebx + 0x2cc], edi
ja 0x4ea6b9
or eax, 0xffffffff
jmp 0x4ea830
cmp esi, edi
je 0x4ea75b
push 0x10
lea eax, [ebp - 0x20]
push edi
push eax
call fcn.00522720
add esp, 0xc
push esi
mov word [ebp - 0x20], 2
call dword [sym.imp.WSOCK32.dll_inet_addr]
push dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x1c], esi
call dword [sym.imp.WSOCK32.dll_htons]
cmp esi, 0xffffffff
mov word [ebp - 0x1e], ax
jne 0x4ea76a
push dword [ebp - 0x28]
call dword [sym.imp.WSOCK32.dll_gethostbyname]
cmp eax, edi
jne 0x4ea74f
sub esp, 0x24
mov ecx, esp
mov dword [ebp - 0x24], esp
push edi
push str.sendudp.ResolveHost
call fcn.004ac9bc
mov dword [ebp - 4], edi
or dword [ebp - 4], esi
mov ecx, ebx
call fcn.004ea560
push ebx
push edi
sub esp, 0x24
mov ecx, esp
mov dword [ebp - 0x24], esp
push edi
push str._NC.SendUDP.Resolve.Failed
call fcn.004ac9bc
mov dword [ebp - 4], 1
or dword [ebp - 4], esi
mov ecx, 0x721f18
call fcn.004bc4ff
jmp 0x4ea6b1
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
jmp 0x4ea76a
lea esi, [ebx + 0x2d0]
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
push 0x10
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x24]
push dword [ebx + 0x2cc]
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, dword [ebp + 0xc]
je 0x4ea7fc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x2751
je 0x4ea7ce
call esi
cmp eax, 0x271d
je 0x4ea7ce
push edi
sub esp, 0x24
mov ecx, esp
mov dword [ebp - 0x24], esp
push edi
push 0x67c864
call fcn.004ac9bc
mov dword [ebp - 4], 3
or dword [ebp - 4], 0xffffffff
mov ecx, 0x721f18
call fcn.0041122b
jmp 0x4ea6b1
push edi
sub esp, 0x24
mov ecx, esp
mov dword [ebp - 0x24], esp
push edi
push 0x67c864
call fcn.004ac9bc
mov dword [ebp - 4], 2
or dword [ebp - 4], 0xffffffff
mov ecx, 0x721f30
call fcn.004cbdaf
jmp 0x4ea6b1
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebx + 0x2f0], eax
call esi
mov esi, dword [ebp + 0xc]
add esi, 0x2e
push esi
mov ecx, 0x721f90
mov dword [ebx + 0x24c], eax
call fcn.004cc3c9
add ebx, 0x358
add dword [ebx], esi
adc dword [ebx + 4], edi
xor eax, eax
call fcn.0052359c
ret 0x10