joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421138
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x7a
xor ebx, ebx
mov byte [ebp - 1], 0
mov esi, 0x1000
xor edi, edi
pop eax
test eax, eax
je 0x421189
cmp eax, 0x7a
jne 0x4211bd
push edi
call fcn.0043f20b
push esi
call fcn.0042a136
mov edi, eax
pop ecx
mov dword [edi], esi
pop ecx
mov dword [ebp - 8], esi
test ebx, ebx
jne 0x42119e
lea eax, [ebp - 8]
push eax
push edi
push ebx
call dword [0x46744c]
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
jmp 0x4211aa
test dword [edi + 0xc], 0x100000
jne 0x42119b
push dword [edi + 4]
call dword [0x467448]
mov dword [ebp - 8], esi
lea eax, [ebp - 8]
push eax
push edi
push ebx
call dword [0x467444]
test eax, eax
je 0x4211b2
xor eax, eax
jmp 0x421150
call dword [0x467274]
mov esi, dword [ebp - 8]
jmp 0x421150
cmp eax, 0x103
jne 0x4211c8
mov byte [ebp - 1], 1
push edi
call fcn.0043f20b
pop ecx
test ebx, ebx
je 0x4211da
push ebx
call dword [0x467440]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42127f
Capabilities:
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor edi, edi
push 0x7a
mov dword [ebp - 0x14], ecx
mov byte [ebp - 1], 0
xor ebx, ebx
mov esi, 0x1000
pop eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
test eax, eax
je 0x4212de
cmp eax, 0x7a
jne 0x421337
push edi
call fcn.0043f20b
push esi
call fcn.0042a136
mov edi, eax
pop ecx
mov dword [edi], esi
pop ecx
mov dword [ebp - 8], esi
test ebx, ebx
jne 0x421312
lea eax, [ebp - 8]
push eax
push edi
push ebx
call dword [0x46744c]
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
jmp 0x42131e
test dword [edi + 0xc], 0x100000
jne 0x42130f
push dword [edi + 8]
call fcn.004281af
mov ecx, eax
call fcn.004280fe
test eax, eax
je 0x42130f
push dword [edi + 8]
call fcn.004281af
mov ecx, eax
call fcn.004280bb
add dword [ebp - 0x10], eax
inc dword [ebp - 0xc]
mov dword [ebp - 8], esi
lea eax, [ebp - 8]
push eax
push edi
push ebx
call dword [0x467444]
test eax, eax
je 0x421329
xor eax, eax
jmp 0x4212a1
call dword [0x467274]
mov esi, dword [ebp - 8]
jmp 0x4212a1
cmp eax, 0x103
jne 0x421342
mov byte [ebp - 1], 1
push edi
call fcn.0043f20b
pop ecx
test ebx, ebx
je 0x421354
push ebx
call dword [0x467440]
cmp byte [ebp - 1], 0
pop edi
pop esi
pop ebx
je 0x421378
cmp dword [ebp - 0xc], 0
je 0x421378
push dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.004211eb
mov al, 1
jmp 0x42137a
xor al, al
leave
ret 4

Function at 0x421460
Capabilities:
Check if file exists

Disassembly:
push 0
mov eax, 0x45bdb1
call fcn.0043e355
mov esi, ecx
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [0x4672f8]
test eax, eax
je 0x4214a2
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.0040bc74
xor esi, esi
inc esi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040b6b3
mov eax, esi
call fcn.0043e42d
ret 4
xor esi, esi
jmp 0x42148d
Function at 0x4214a6
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x45c439
call fcn.0043e3be
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x47b5e4
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], ebx
call fcn.0041b726
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
xor edi, edi
lea eax, [ebp - 0x216]
push ebx
inc edi
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x220], edi
call fcn.0043ed90
add esp, 0xc
push ebx
push 0x28
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [0x4672f0]
test eax, eax
je 0x421550
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.0040bb2f
push 0x47e390
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.0040bb55
add esp, 0xc
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0040bc74
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.0040b6b3
mov eax, esi
call fcn.0043e441
ret

Function at 0x421558
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x45c439
call fcn.0043e3be
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x47b5e4
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], ebx
call fcn.0041b726
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
xor edi, edi
lea eax, [ebp - 0x216]
push ebx
inc edi
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x220], edi
call fcn.0043ed90
add esp, 0xc
push ebx
push 0x28
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [0x4672f0]
test eax, eax
je 0x421602
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.0040bb2f
push 0x47e394
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.0040bb55
add esp, 0xc
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0040bc74
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.0040b6b3
mov eax, esi
call fcn.0043e441
ret
Function at 0x421e14
Capabilities:
Hide graphical window

Disassembly:
push 0x28
mov eax, 0x45c6d0
call fcn.0043e355
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 8]
mov esi, eax
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [eax + 4]
add esi, 0x1f
mov dword [ebp - 0x28], esi
and dword [ebp - 4], 0
push 0xd7d7d7
push 1
push 0
call dword [0x467070]
push 0xf1f1f1
mov dword [ebp - 0x14], eax
call dword [0x467088]
push dword [ebp - 0x14]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov edi, dword [0x467060]
mov dword [ebp - 0x10], eax
call edi
push dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
push dword [ebx]
call edi
push esi
push dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebx]
call dword [0x467074]
push 0xb4b4b4
push 1
push 0
mov byte [ebp - 4], 2
call dword [0x467070]
push eax
push dword [ebx]
mov dword [ebp + 0xc], eax
call edi
push 0
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebx]
call dword [0x46707c]
push dword [ebp - 0x30]
mov esi, dword [0x467078]
push dword [ebp - 0x2c]
push dword [ebx]
call esi
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebx]
call esi
push 0
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebx]
call dword [0x46707c]
push dword [ebp - 0x28]
push dword [ebp - 0x34]
push dword [ebx]
call esi
mov eax, dword [ebp + 0x10]
push dword [eax]
push dword [ebx]
call edi
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
inc eax
inc ecx
push 0
mov dword [ebp + 0x10], ecx
push eax
push ecx
push dword [ebx]
call dword [0x46707c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
dec ecx
inc eax
push eax
push ecx
push dword [ebx]
mov dword [ebp - 0x1c], ecx
call esi
mov eax, dword [ebp + 0x14]
push dword [eax]
push dword [ebx]
call edi
mov eax, dword [ebp - 0x30]
push 0
add eax, 2
push eax
push dword [ebp + 0x10]
mov dword [ebp + 0x14], eax
push dword [ebx]
call dword [0x46707c]
push dword [ebp + 0x14]
push dword [ebp - 0x1c]
push dword [ebx]
call esi
mov eax, dword [ebp - 0x28]
push dword [ebp - 0x20]
mov esi, dword [ebp + 8]
inc eax
mov dword [esi + 4], eax
push dword [ebx]
call edi
push dword [ebp - 0x24]
push dword [ebx]
call edi
mov edi, dword [ebp - 0x18]
cmp byte [edi + 0x5e4], 0
jne 0x421f82
mov esi, dword [0x46735c]
push 0
push dword [edi + 0x294]
call esi
push 5
push dword [edi + 0x48]
call esi
jmp 0x421fb3
push 5
push dword [edi + 0x294]
call dword [0x46735c]
push 0
push dword [edi + 0x48]
call dword [0x46735c]
mov ecx, dword [ebp - 0x18]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
add ecx, 0x84
movsd dword es:[edi], dword [esi]
call fcn.00427972
mov esi, dword [0x4670b0]
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x421fc5
push dword [ebp + 0xc]
call esi
cmp dword [ebp - 0x10], edi
je 0x421fcf
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0x14], edi
je 0x421fd9
push dword [ebp - 0x14]
call esi
call fcn.0043e42d
ret 0x10
Function at 0x423e25
Capabilities:
Hide graphical window

Disassembly:
push 8
mov eax, 0x45c8a5
call fcn.0043e355
mov esi, ecx
mov edi, dword [0x46735c]
xor ebx, ebx
push ebx
push dword [esi + 0x294]
mov byte [esi + 0x5e4], 0
call edi
lea ecx, [esi + 0x84]
call fcn.00426437
test al, al
jne 0x423fad
mov ebx, 0x47b5e4
push ebx
lea ecx, [ebp - 0x14]
call fcn.0041b726
and dword [ebp - 4], 0
push 0
push 0x8c
call fcn.0040b66f
pop ecx
pop ecx
test eax, eax
je 0x423e90
push 0x8c
push eax
lea ecx, [ebp - 0x14]
call fcn.0040bae5
push ebx
lea ecx, [ebp - 0x10]
call fcn.0041b726
push 1
lea ecx, [esi + 0x84]
mov byte [ebp - 4], 1
call fcn.00426587
test eax, eax
jne 0x423ec4
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push 0x46a6a8
push eax
call fcn.00418c32
add esp, 0xc
jmp 0x423ed9
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push str._s__d_
push eax
call fcn.00418c32
add esp, 0x10
push dword [ebp - 0x10]
mov ebx, dword [0x4673f8]
push dword [esi + 0x1e8]
call ebx
push 1
push 0
push dword [esi + 0x1e8]
call dword [0x467374]
push 0
push 0x8b
call fcn.0040b66f
pop ecx
pop ecx
test eax, eax
je 0x423f1a
push 0x8b
push eax
lea ecx, [ebp - 0x14]
call fcn.0040bae5
push 0
lea ecx, [esi + 0x84]
call fcn.00426587
test eax, eax
jne 0x423f41
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push 0x46a6a8
push eax
call fcn.00418c32
add esp, 0xc
jmp 0x423f56
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push str._s__d_
push eax
call fcn.00418c32
add esp, 0x10
push dword [ebp - 0x10]
push dword [esi + 0x13c]
call ebx
push 1
push 0
push dword [esi + 0x13c]
call dword [0x467374]
push 5
push dword [esi + 0x1e8]
call edi
push 5
push dword [esi + 0x13c]
call edi
push 5
push dword [esi + 0x2b8]
call edi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040b6b3
mov ecx, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040b6b3
xor ebx, ebx
jmp 0x423fc0
push 5
push dword [esi + 0x408]
call edi
push ebx
push dword [esi + 0x2b8]
call edi
push 1
push dword [esi + 0x2b8]
call dword [0x4673ec]
push ebx
push dword [esi + 0x548]
call edi
mov ecx, esi
call fcn.00421c87
push 0x105
push ebx
push ebx
push dword [esi + 4]
call dword [0x4673f0]
xor eax, eax
call fcn.0043e42d
ret 0x10
Function at 0x425511
Capabilities:
Check if file exists

Disassembly:
push 0x150
mov eax, 0x45ca04
call fcn.0043e3be
mov esi, ecx
push 1
mov dword [ebp - 0x15c], esi
call fcn.0041dd54
xor ebx, ebx
mov dword [esi + 0xd0], 0xf
mov dword [esi + 0xcc], ebx
mov dword [ebp - 4], ebx
mov byte [esi + 0xbc], bl
push 0x103
lea eax, [ebp - 0x113]
push ebx
push eax
mov byte [ebp - 4], 1
mov byte [ebp - 0x114], bl
call fcn.0043ed90
add esp, 0xc
push 0x104
lea eax, [ebp - 0x114]
push eax
push ebx
call dword [0x467210]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x14c]
call fcn.00403010
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 2
mov byte [ebp - 0x150], 0x5c
call fcn.0041b7b2
push eax
push ebx
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x14c]
call fcn.00419c3b
mov edi, str.question.txt
push edi
mov byte [ebp - 4], 3
call fcn.0043f600
pop ecx
push eax
push edi
lea ecx, [ebp - 0x130]
call fcn.004030b0
cmp dword [ebp - 0x11c], 0x10
mov eax, dword [ebp - 0x130]
jae 0x4255f5
lea eax, [ebp - 0x130]
push eax
call dword [0x4672fc]
test eax, eax
mov eax, dword [ebp - 0x130]
je 0x42562a
cmp dword [ebp - 0x11c], 0x10
jae 0x425615
lea eax, [ebp - 0x130]
push 0x40
push 3
push eax
mov ecx, esi
call fcn.0041ca2f
mov byte [esi + 0xb8], 1
jmp 0x42564b
cmp dword [ebp - 0x11c], 0x10
jae 0x425639
lea eax, [ebp - 0x130]
push 0x40
push 2
push eax
mov ecx, esi
call fcn.0041ca2f
mov byte [esi + 0xb8], bl
push 0x3f
push 0x469a14
lea ecx, [ebp - 0x154]
call fcn.0041c3fe
push eax
lea eax, [ebp - 0x158]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
mov byte [ebp - 4], 4
call fcn.0041268f
lea ecx, [ebp - 0x158]
call fcn.00406650
lea ecx, [ebp - 0x154]
call fcn.00406650
push ebx
push 1
lea ecx, [ebp - 0x130]
call fcn.00403740
push ebx
push 1
lea ecx, [ebp - 0x14c]
call fcn.00403740
mov eax, esi
call fcn.0043e441
ret

Function at 0x4256f0
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x45ca34
call fcn.0043e355
mov esi, ecx
lea ecx, [esi + 0x10]
call fcn.004138c6
mov ecx, esi
call fcn.00424119
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.00424197
push dword [eax]
call dword [0x4672f8]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov edi, eax
call fcn.0040b6b3
test edi, edi
je 0x425759
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.00424197
and dword [ebp - 4], 0
mov ecx, eax
call fcn.00410a6b
push eax
call dword [0x467248]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040b6b3
call fcn.0043e42d
ret
Function at 0x42579f
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x20]
call fcn.0040cd05
lea ecx, [esi + 0x84]
call fcn.0042741e
mov edi, dword [0x46735c]
push 0
push dword [esi + 0x1e8]
call edi
push 0
push dword [esi + 0x13c]
call edi
push 0
lea ecx, [esi + 0x1e4]
call fcn.00418450
push 1
lea ecx, [esi + 0x138]
call fcn.00418450
push 1
lea ecx, [esi + 0x84]
call fcn.00426de1
lea ecx, [esi + 0x84]
call fcn.00427ceb
xor ebx, ebx
push ebx
push dword [esi + 0x48]
call edi
push 5
push dword [esi + 0x294]
call edi
push 5
push dword [esi + 0x548]
call edi
push ebx
push dword [esi + 0x408]
call edi
call fcn.004256af
mov ecx, eax
call fcn.004256f0
mov ecx, esi
call fcn.00421c20
push ebx
push dword [esi + 0x2b8]
call dword [0x4673ec]
pop edi
pop esi
pop ebx
ret

Function at 0x42584c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x47c094]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 4], 1
mov esi, ecx
jne 0x42588c
inc dword [esi + 0x5e8]
mov eax, dword [esi + 0x5e8]
imul eax, eax, 0x64
push 0
push eax
push 0x402
push dword [esi + 0x294]
call dword [0x467334]
mov ecx, dword [edi]
mov eax, 0xa3
cmp ecx, eax
ja 0x425904
je 0x4258fa
sub ecx, 7
je 0x4258f0
sub ecx, 0x81
je 0x4258e6
dec ecx
dec ecx
je 0x4258dc
sub ecx, 0xc
je 0x4258d2
dec ecx
je 0x4258c8
sub ecx, 5
jne 0x425950
push edi
mov ecx, esi
call fcn.00424e41
jmp 0x425950
push edi
mov ecx, esi
call fcn.004218e3
jmp 0x425950
push edi
mov ecx, esi
call fcn.00424c17
jmp 0x425950
push edi
mov ecx, esi
call fcn.00424658
jmp 0x425950
push edi
mov ecx, esi
call fcn.00424d34
jmp 0x425950
push edi
mov ecx, esi
call fcn.00424b41
jmp 0x425950
push edi
mov ecx, esi
call fcn.00424a5d
jmp 0x425950
mov eax, ecx
sub eax, 0xa5
je 0x425948
push 3
pop ecx
sub eax, ecx
je 0x42593e
sub eax, ecx
je 0x425934
sub eax, ecx
je 0x42592a
sub eax, ecx
jne 0x425950
push edi
mov ecx, esi
call fcn.0042499c
jmp 0x425950
push edi
mov ecx, esi
call fcn.004248db
jmp 0x425950
push edi
mov ecx, esi
call fcn.004247da
jmp 0x425950
push edi
mov ecx, esi
call fcn.00424719
jmp 0x425950
push edi
mov ecx, esi
call fcn.00424574
cmp dword [edi + 4], 0
jne 0x42598a
mov edi, dword [0x46735c]
push 0
push dword [esi + 0x4b0]
call edi
push 0
push dword [esi + 0x2b8]
call edi
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.004219f5
push 1
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
call dword [0x467374]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0043e346
leave
ret 0x10
Function at 0x425c87
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x47c094]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.0041f7ff
call fcn.0041eddc
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x4219b4
push ebx
push ebx
call fcn.0043f750
add esp, 0x18
push dword [esi + 4]
lea ecx, [esi + 0x20]
call fcn.004263da
mov eax, dword [esi + 4]
mov dword [esi + 0x5ec], ebx
mov dword [esi + 0x5e8], ebx
mov dword [0x47dfa8], eax
call fcn.0041f49e
mov ecx, esi
call fcn.004253fe
push 1
mov eax, 0x182
push eax
mov ecx, 0x259
push ecx
push ebx
push ebx
push dword [esi + 4]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
call dword [0x467360]
push ebx
lea ecx, [esi + 4]
call fcn.00421759
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
call dword [0x467368]
push ebx
push dword [esi + 4]
lea ecx, [esi + 0x44]
call fcn.00422981
mov eax, dword [ebp - 0x10]
push 1
lea ecx, [eax + 0x137]
push ecx
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + 0x181]
push edx
add eax, 0x42
push eax
add ecx, 0xd5
push ecx
push dword [esi + 0x48]
call dword [0x467360]
push ebx
push dword [esi + 0x48]
call dword [0x46735c]
mov eax, dword [0x47eb60]
push ebx
push 0xc
mov dword [ebp - 0x18], eax
call dword [0x4673c4]
push eax
push 0xb
call dword [0x4673c4]
push eax
push 1
push 0x80
push dword [ebp - 0x18]
call dword [0x467400]
push eax
push 1
push 0x80
push dword [esi + 4]
call dword [0x467334]
mov eax, dword [0x47eb60]
push ebx
push 0x32
mov dword [ebp - 0x18], eax
call dword [0x4673c4]
push eax
push 0x31
call dword [0x4673c4]
push eax
push 1
push 0x80
push dword [ebp - 0x18]
call dword [0x467400]
push eax
push ebx
push 0x80
push dword [esi + 4]
call dword [0x467334]
mov ecx, esi
call fcn.0042392a
mov ecx, esi
call fcn.00423c26
mov ecx, esi
call fcn.00423dca
mov ecx, esi
call fcn.00423ff9
push ebx
push dword [esi + 0x2b8]
call dword [0x4673ec]
mov ecx, esi
call fcn.004224f2
mov ecx, esi
call fcn.00425bbe
mov ecx, esi
call fcn.00421c20
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0043e346
leave
ret 0x10

Function at 0x425e86
Capabilities:
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
xor ebx, ebx
mov byte [ebp - 1], bl
call fcn.0045960e
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x425ea3
xor al, al
jmp 0x425f10
push edi
push dword [ebp + 8]
call dword [0x467460]
mov edi, eax
cmp edi, 0xffffffff
jne 0x425eb8
xor al, al
jmp 0x425f0f
mov dword [ebp + 8], 1
push esi
push 0x3e8
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push ebx
push edi
push dword [ebp - 8]
call fcn.00459608
mov esi, eax
call dword [0x467274]
cmp esi, ebx
je 0x425eef
cmp dword [ebp - 0x20], ebx
je 0x425efa
cmp eax, 0x4cf
je 0x425f00
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jle 0x425ec0
jmp 0x425f03
mov byte [ebp - 1], 1
jmp 0x425f03
mov byte [ebp - 1], bl
push dword [ebp - 8]
call fcn.00459602
mov al, byte [ebp - 1]
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x425f35
Capabilities:
Initialize winsock library
Reference google public dns server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x47c094]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x194]
push eax
push 0x202
mov edi, ecx
call dword [0x46745c]
push str.8.8.8.8
mov ecx, edi
call fcn.00425e86
test al, al
je 0x425f8f
mov byte [esi + 0xc], 1
xor esi, esi
call dword [0x467458]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043e346
leave
ret 4
xor esi, esi
inc esi
jmp 0x425f77

Function at 0x426085
Capabilities:
Check if file exists

Disassembly:
push 0x3c
mov eax, 0x45cd6c
call fcn.0043e3be
mov edi, ecx
lea eax, [ebp - 0x44]
push eax
call fcn.0041e19f
pop ecx
push dword [ebp - 0x44]
and dword [ebp - 4], 0
call dword [0x4672f8]
test eax, eax
je 0x4260ed
mov eax, dword [0x47e06c]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x48], esp
mov esi, esp
push eax
call fcn.0040b7fa
pop ecx
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.00425fb9
test al, al
je 0x4261fa
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0040b6b3
xor eax, eax
inc eax
call fcn.0043e441
ret 4
push str.360Tray.exe
lea ecx, [ebp - 0x40]
call fcn.0040be56
push str.egui.exe
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.0040be56
push str.MpfSrv.exe
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call fcn.0040be56
push str.mcmscsvc.exe
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.0040be56
push str.McNASvc.exe
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.0040be56
push str.rsmain.exe
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.0040be56
push str.RsMgrSvr.exe
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.0040be56
push str.avp.exe
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 7
call fcn.0040be56
push str.ekrn.exe
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 8
call fcn.0040be56
push str.MPmain.exe
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.0040be56
push str.ccSvcHst.exe
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xa
call fcn.0040be56
push 0x46a784
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xb
call fcn.0040be56
lea eax, [ebp - 0x40]
push 0xc
push eax
mov byte [ebp - 4], 0xc
call fcn.0041ef94
pop ecx
pop ecx
push 0x41bfc0
push 0xc
test eax, eax
push 4
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0
push eax
je 0x4261f5
call fcn.0043e5f7
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0040b6b3
mov eax, esi
jmp 0x4260e5
call fcn.0043e5f7
xor esi, esi
jmp 0x4261e3
Function at 0x426898
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx]
mov dword [ebp - 4], ecx
cmp esi, dword [ecx + 4]
je 0x426a08
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [0x467380]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4268ca
push dword [eax + 4]
call edi
cmp ebx, eax
je 0x4269b8
mov ecx, dword [ebp - 4]
push esi
call fcn.004265ab
test al, al
je 0x4268ff
mov eax, dword [esi + 0xc]
push dword [eax + 4]
call edi
cmp ebx, eax
je 0x42690f
mov eax, dword [esi + 0x10]
push dword [eax + 4]
call edi
cmp ebx, eax
je 0x426967
mov eax, dword [esi + 8]
push dword [eax + 4]
call edi
cmp ebx, eax
je 0x4269af
mov eax, dword [ebp - 4]
add esi, 0x28
cmp esi, dword [eax + 4]
jne 0x4268b6
jmp 0x426a06
mov eax, dword [ebp - 4]
cmp dword [eax + 0x24], 1
jne 0x426a06
mov eax, dword [esi + 0xc]
mov edi, dword [0x46735c]
xor ebx, ebx
push ebx
push dword [eax + 4]
call edi
mov eax, dword [esi + 8]
push ebx
push dword [eax + 4]
call edi
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x426943
push ebx
push dword [eax + 4]
call edi
mov ecx, dword [ebp - 4]
push 1
push dword [esi]
call fcn.004264e4
push 1
push dword [esi]
call fcn.00429373
mov ecx, eax
call fcn.004297c8
push dword [esi]
push ebx
jmp 0x4269f5
mov ebx, dword [ebp - 4]
xor edi, edi
cmp dword [ebx + 0x24], edi
jne 0x426a06
mov eax, dword [esi + 0x10]
push edi
push dword [eax + 4]
call dword [0x46735c]
push edi
push dword [esi]
mov ecx, ebx
call fcn.004264e4
push edi
push dword [esi]
call fcn.00429373
mov ecx, eax
call fcn.004297c8
push dword [esi]
call fcn.00429373
mov ecx, eax
call fcn.004291a3
push dword [esi]
push 3
jmp 0x4269f5
mov eax, dword [esi + 0x18]
dec eax
je 0x4269be
dec eax
jne 0x426a06
push dword [esi]
push 1
jmp 0x4269f5
mov eax, dword [esi + 8]
mov edi, dword [0x46735c]
push 0
mov dword [esi + 0x24], 1
push dword [eax + 4]
call edi
mov eax, dword [esi + 0xc]
push 0
push dword [eax + 4]
call edi
mov eax, dword [esi + 0x1c]
push 5
push dword [eax + 4]
call edi
mov ecx, dword [esi + 0x1c]
call fcn.0041a7db
push dword [esi]
push 2
push 0x401
push dword [0x47dfa8]
call dword [0x467334]
pop edi
pop ebx
pop esi
leave
ret 4