joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c8f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x41ca7b
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x41ca7b
push edi
push 0x6c
push 1
call fcn.00580d1f
mov edi, eax
add esp, 8
mov dword [esi + 0x4e8], edi
test edi, edi
je 0x41ca74
mov dword [edi], esi
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x120]
push str.user32.dll
mov dword [edi + 4], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x18], 0x20
mov dword [edi + 0x14], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [edi + 0x58], eax
test eax, eax
je 0x41c98b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AddClipboardFormatListener
push eax
call esi
push str.RemoveClipboardFormatListener
push dword [edi + 0x58]
mov dword [edi + 0x60], eax
call esi
push str.GetUpdatedClipboardFormats
push dword [edi + 0x58]
mov dword [edi + 0x64], eax
call esi
mov esi, dword [ebp + 8]
mov dword [edi + 0x68], eax
cmp dword [edi + 0x58], 0
je 0x41c9a3
cmp dword [edi + 0x60], 0
je 0x41c9a3
cmp dword [edi + 0x64], 0
je 0x41c9a3
cmp dword [edi + 0x68], 0
jne 0x41c9aa
mov dword [edi + 0x54], 1
push 0xc
push dword [edi + 0x18]
call fcn.00580d1f
add esp, 8
mov dword [edi + 0x1c], eax
test eax, eax
je 0x41ca6a
push str.response_data_event
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x41ca6a
push str.request_filecontents_event
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x40], eax
test eax, eax
je 0x41ca6a
push 0
push 0
push edi
push 0x41c420
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x2c], eax
test eax, eax
je 0x41ca6a
mov dword [ebx + 0x10], 0x41ca90
mov dword [ebx + 8], 0x41cbd0
mov dword [ebx + 0x1c], 0x41d3b0
mov dword [ebx + 0x24], 0x41d570
mov dword [ebx + 0x2c], fcn.0041ef60
mov dword [ebx + 0x34], fcn.0041ef60
mov dword [ebx + 0x3c], 0x41d020
mov dword [ebx + 0x44], 0x41d2f0
mov dword [ebx + 0x4c], 0x41cc20
mov dword [ebx + 0x54], 0x41cfa0
mov eax, dword [esi + 0x4e8]
pop edi
mov dword [ebx + 4], eax
mov eax, 1
pop esi
pop ebx
pop ebp
ret
push ebx
push esi
call fcn.0041d860
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x41eaf0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x63e758]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push edi
push eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], 0
call sym.wfreerdp.exe_region16_init
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x4f8]
call fcn.00430b70
mov ebx, eax
add esp, 0xc
xor edi, edi
test ebx, ebx
jle 0x41ebfd
lea ecx, [ecx]
mov ecx, dword [ebp - 0x18]
push dword [ecx + edi*4]
push dword [esi + 0x4f8]
call fcn.00430b00
mov esi, eax
add esp, 8
test esi, esi
je 0x41ebf1
movzx eax, word [esi + 0x10]
mov word [ebp - 0x20], ax
movzx eax, word [esi + 0x14]
mov word [ebp - 0x1e], ax
movzx eax, word [esi + 0x18]
add ax, word [esi + 0x10]
mov word [ebp - 0x1c], ax
movzx eax, word [esi + 0x1c]
add ax, word [esi + 0x14]
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x30]
push eax
call sym.wfreerdp.exe_region16_clear
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x34]
lea eax, [ebp - 0x30]
push eax
call sym.wfreerdp.exe_region16_intersect_rect
lea eax, [ebp - 0x30]
push eax
call sym.wfreerdp.exe_region16_is_empty
add esp, 0x14
test eax, eax
jne 0x41ebf1
lea eax, [ebp - 0x30]
push eax
call sym.wfreerdp.exe_region16_extents
add esp, 4
movzx ecx, word [eax]
sub ecx, dword [esi + 0x10]
mov dword [ebp - 0x14], ecx
movzx ecx, word [eax + 2]
sub ecx, dword [esi + 0x14]
mov dword [ebp - 0x10], ecx
movzx ecx, word [eax + 4]
sub ecx, dword [esi + 0x10]
mov dword [ebp - 0xc], ecx
movzx eax, word [eax + 6]
sub eax, dword [esi + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push 0
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov esi, dword [ebp - 0x24]
inc edi
cmp edi, ebx
jl 0x41eb40
lea eax, [ebp - 0x30]
push eax
call sym.wfreerdp.exe_region16_uninit
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.005802ce
mov esp, ebp
pop ebp
ret
Function at 0x41f920
Capabilities:
Prompt user for credentials

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
mov eax, dword [0x63e758]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
push 0x202
mov dword [ebp - 0x668], eax
lea eax, [ebp - 0x664]
push 0
push eax
mov dword [ebp - 0x66c], 0
call fcn.00580b90
push 0x101
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00580b90
add esp, 0x18
lea eax, [ebp - 0x66c]
push 0xa
push eax
push 0x101
lea eax, [ebp - 0x108]
push eax
push 0x202
lea eax, [ebp - 0x664]
push eax
push 0
push 0
push esi
push section..data
call dword [sym.imp.credui.dll_CredUIPromptForCredentialsA]
mov esi, eax
test esi, esi
je 0x41fa10
push 4
push str.com.freerdp.client.windows
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042f7e0
add esp, 8
test eax, eax
je 0x41f9fd
push esi
push str.CredUIPromptForCredentials_unexpected_status:_0x_08lX
push str.wf_authenticate_raw
push str.C:BuildFreeRDP_stable_1.1BuildFreeRDPclientWindowswf_client.c
push 0x1b9
push 4
push 0
push str.com.freerdp.client.windows
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042fce0
add esp, 0x20
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ce
mov esp, ebp
pop ebp
ret
push 0x202
lea eax, [ebp - 0x460]
push 0
push eax
call fcn.00580b90
push 0x152
lea eax, [ebp - 0x25c]
push 0
push eax
call fcn.00580b90
add esp, 0x18
lea eax, [ebp - 0x25c]
push 0x152
push eax
push 0x202
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.credui.dll_CredUIParseUserNameA]
mov esi, eax
lea eax, [ebp - 0x460]
push eax
call fcn.00580c20
add esp, 4
mov dword [ebx], eax
test eax, eax
jne 0x41faaf
push 4
push str.com.freerdp.client.windows
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042f7e0
add esp, 8
test eax, eax
je 0x41f9fd
push esi
push str.strdup_failed
push str.wf_authenticate_raw
push str.C:BuildFreeRDP_stable_1.1BuildFreeRDPclientWindowswf_client.c
push 0x1c6
jmp 0x41f9e3
lea ecx, [ebp - 0x25c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41fab8
sub ecx, edx
je 0x41facc
lea eax, [ebp - 0x25c]
push eax
jmp 0x41fad1
push 0x5b1a6c
call fcn.00580c20
add esp, 4
mov dword [edi], eax
test eax, eax
jne 0x41fb23
push dword [ebx]
call fcn.00580204
add esp, 4
push 4
push str.com.freerdp.client.windows
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042f7e0
add esp, 8
test eax, eax
je 0x41f9fd
push esi
push str.strdup_failed
push str.wf_authenticate_raw
push str.C:BuildFreeRDP_stable_1.1BuildFreeRDPclientWindowswf_client.c
push 0x1d2
jmp 0x41f9e3
lea eax, [ebp - 0x108]
push eax
call fcn.00580c20
mov ecx, dword [ebp - 0x668]
add esp, 4
mov dword [ecx], eax
test eax, eax
jne 0x41fb62
push dword [ebx]
call fcn.00580204
push dword [edi]
call fcn.00580204
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ce
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005802ce
mov esp, ebp
pop ebp
ret
Function at 0x422540
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x422550
xor eax, eax
pop esi
pop ebp
ret
mov eax, dword [esi + 4]
mov ecx, eax
shr ecx, 5
and ecx, 1
test al, 0x10
mov eax, dword [ebp + 0xc]
je 0x422566
test eax, eax
jne 0x42256e
test ecx, ecx
je 0x4225a8
test eax, eax
jne 0x4225a8
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x40], 0
push esi
je 0x422598
call fcn.00422110
add esp, 4
mov eax, 1
pop esi
pop ebp
ret
call fcn.004217e0
add esp, 4
mov eax, 1
pop esi
pop ebp
ret
push 0
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
pop ebp
ret
Function at 0x4225c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
xorps xmm0, xmm0
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0x44]
mov dword [ebp - 8], 0
push esi
movdqu xmmword [ebp - 0x44], xmm0
push eax
xor ebx, ebx
movq qword [ebp - 0x24], xmm0
movdqu xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x44], 0x28
mov dword [ebp - 0x40], 1
call sym.wfreerdp.exe_RdpClientEntry
lea eax, [ebp - 0x44]
push eax
call sym.wfreerdp.exe_freerdp_client_context_new
mov esi, eax
add esp, 8
mov dword [ebp - 0xc], esi
test esi, esi
jne 0x422621
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x422753
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x422751
mov ebx, dword [ebp - 8]
push 4
push ebx
call fcn.00580d1f
mov edi, eax
add esp, 8
test edi, edi
je 0x42275b
mov dword [ebp - 0x10], 0
test ebx, ebx
jle 0x4226dc
mov esi, dword [ebp - 4]
mov ecx, edi
sub ecx, esi
mov dword [ebp - 0x18], ecx
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [esi]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
push 1
push ebx
call fcn.00580d1f
mov ecx, dword [ebp - 0x18]
add esp, 8
mov dword [ecx + esi], eax
test eax, eax
je 0x422758
push 0
push 0
push ebx
push eax
push 0xffffffffffffffff
push dword [esi]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, ebx
jne 0x422758
mov eax, dword [ebp - 0x10]
add esi, 4
mov ebx, dword [ebp - 8]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, ebx
jl 0x422675
mov esi, dword [ebp - 0xc]
mov eax, dword [esi + 0x140]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x42275b
push 0
push edi
push ebx
push eax
call sym.wfreerdp.exe_freerdp_client_settings_parse_command_line
add esp, 0x10
test eax, eax
je 0x42270c
push edi
push dword [ebp - 8]
push eax
push dword [ebp - 0x18]
call sym.wfreerdp.exe_freerdp_client_settings_command_line_status_print
add esp, 0x10
jmp 0x42275b
push esi
call sym.wfreerdp.exe_freerdp_client_start
add esp, 4
test eax, eax
jne 0x42275b
push esi
call sym.wfreerdp.exe_freerdp_client_get_thread
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x422746
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x422746
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
push esi
call sym.wfreerdp.exe_freerdp_client_stop
add esp, 4
jmp 0x42275b
mov ebx, eax
mov edi, dword [ebp - 0x1c]
jmp 0x42275e
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
push esi
call sym.wfreerdp.exe_freerdp_client_context_free
add esp, 4
test edi, edi
je 0x42278c
xor esi, esi
cmp dword [ebp - 8], esi
jle 0x422783
push dword [edi + esi*4]
call fcn.00580204
inc esi
add esp, 4
cmp esi, dword [ebp - 8]
jl 0x422772
push edi
call fcn.00580204
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x429d40
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
test al, 0x10
je 0x429d53
mov dword [ebp + 0x14], eax
pop ebp
jmp fcn.00429d70
test al, 0x20
je 0x429d60
mov dword [ebp + 0x14], eax
pop ebp
jmp fcn.00429f80
xor eax, eax
pop ebp
ret
Function at 0x42a650
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push 0x5b5e84
push ebx
call fcn.00582816
mov edi, eax
add esp, 8
test edi, edi
jne 0x42a6bf
push 4
push str.com.freerdp.client.common
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042f7e0
add esp, 8
test eax, eax
je 0x42a6b7
push ebx
push str.Failed_to_open_RDP_file__s
push 0x5b5ea4
push str.C:BuildFreeRDP_stable_1.1BuildFreeRDPclientcommon_file.c
push 0x219
push 4
push edi
push str.com.freerdp.client.common
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042fce0
add esp, 0x20
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push 2
push 0
push 0
push edi
call fcn.00582a9c
push edi
call fcn.00582bd3
push 0
push 0
push 0
push edi
mov dword [ebp - 4], eax
mov esi, edx
call fcn.00582a9c
add esp, 0x24
test esi, esi
jg 0x42a751
jl 0x42a6f4
mov esi, dword [ebp - 4]
cmp esi, 1
jae 0x42a754
push 4
push str.com.freerdp.client.common
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042f7e0
add esp, 8
test eax, eax
je 0x42a73f
push ebx
push str.RDP_file__s_is_empty
push 0x5b5ea4
push str.C:BuildFreeRDP_stable_1.1BuildFreeRDPclientcommon_file.c
push 0x223
push 4
push 0
push str.com.freerdp.client.common
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042fce0
add esp, 0x20
push edi
call fcn.005826db
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
lea eax, [esi + 2]
push eax
call fcn.0058023c
add esp, 4
mov ebx, eax
push edi
test ebx, ebx
je 0x42a740
push 1
push esi
push ebx
call fcn.005829f0
add esp, 0x10
mov dword [ebp - 4], eax
test eax, eax
jne 0x42a78e
push edi
call fcn.005816a7
mov ecx, dword [ebp - 4]
add esp, 4
test eax, eax
cmove ecx, esi
mov dword [ebp - 4], ecx
push edi
call fcn.005826db
add esp, 4
cmp dword [ebp - 4], 1
jae 0x42a7fc
push 4
push str.com.freerdp.client.common
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042f7e0
add esp, 8
test eax, eax
je 0x42a7ea
push dword [ebp + 0xc]
push str.Could_not_read_from_RDP_file__s
push 0x5b5ea4
push str.C:BuildFreeRDP_stable_1.1BuildFreeRDPclientcommon_file.c
push 0x23c
push 4
push 0
push str.com.freerdp.client.common
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042fce0
add esp, 0x20
push ebx
call fcn.00580204
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push ebx
push dword [ebp + 8]
mov word [esi + ebx], 0
call sym.wfreerdp.exe_freerdp_client_parse_rdp_file_buffer
push ebx
mov esi, eax
call fcn.00580204
add esp, 0x10
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c9b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [eax + 0x15c]
xor edi, edi
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
test esi, esi
jle 0x42c9f7
mov edx, dword [eax + 0x164]
add edx, 4
nop
mov ecx, dword [edx]
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42c9e5
sub ecx, ebx
inc edi
add edi, ecx
add edx, 0x20
dec esi
jne 0x42c9e0
lea esi, [edi + 1]
push 1
push esi
call fcn.00580d1f
mov ebx, eax
push esi
push ebx
push dword [ebp + 8]
call sym.wfreerdp.exe_freerdp_client_write_rdp_file_buffer
add esp, 0x14
cmp eax, edi
je 0x42ca71
push 4
push str.com.freerdp.client.common
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042f7e0
add esp, 8
test eax, eax
je 0x42ca5f
push str.freerdp_client_write_rdp_file:_error_writing_to_output_buffer
push 0x5b5f3c
push str.C:BuildFreeRDP_stable_1.1BuildFreeRDPclientcommon_file.c
push 0x288
push 4
push 0
push str.com.freerdp.client.common
call fcn.0042f4e0
add esp, 4
push eax
call fcn.0042fce0
add esp, 0x1c
push ebx
call fcn.00580204
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x5b5f5c
push dword [ebp + 0xc]
call fcn.00582816
mov esi, eax
add esp, 8
test esi, esi
je 0x42cb1e
cmp dword [ebp + 0x10], 0
je 0x42cb36
cmp edi, 0x7fffffff
jbe 0x42cabd
push ebx
call fcn.00580204
push dword [ebp - 4]
call fcn.00580204
push esi
call fcn.005826db
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
push edi
push ebx
push 0
push 0xfde9
call fcn.00430810
add esp, 0x18
test edi, edi
js 0x42ca9d
push esi
push 2
push 1
push 0x639398
call fcn.0058317c
add esp, 0x10
cmp eax, 2
jne 0x42ca9d
push esi
push edi
push eax
push dword [ebp - 4]
call fcn.0058317c
add esp, 0x10
cmp eax, edi
jne 0x42ca9d
push dword [ebp - 4]
call fcn.00580204
add esp, 4
push esi
call fcn.00581780
push esi
call fcn.005826db
add esp, 8
mov dword [ebp - 8], eax
push ebx
call fcn.00580204
add esp, 4
xor eax, eax
cmp dword [ebp - 8], eax
sete al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
push 1
push ebx
call fcn.0058317c
add esp, 0x10
cmp eax, edi
je 0x42cb0c
push ebx
call fcn.00580204
push esi
call fcn.005826db
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f840
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x30
push 1
call fcn.00580d1f
mov esi, eax
add esp, 8
test esi, esi
jne 0x42f859
pop esi
pop ebp
ret
push ebx
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00580c20
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x42f937
push edi
push esi
call fcn.0042fc20
add esp, 8
test eax, eax
je 0x42f937
mov edi, dword [ebp + 0xc]
push 4
push 0x10
mov dword [esi + 0x20], edi
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0x10
mov dword [esi + 4], 0xfffffffe
call fcn.00580d1f
add esp, 8
mov dword [esi + 0x24], eax
test eax, eax
je 0x42f937
mov dword [esi + 0x1c], 0
test edi, edi
je 0x42f8d3
mov dword [esi + 8], 0xffff
mov dword [esi + 0x10], 1
jmp 0x42f979
push 0
push 0
push str.WLOG_LEVEL
mov dword [esi + 8], 2
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test ebx, ebx
je 0x42f979
push ebx
call fcn.0058023c
mov edi, eax
add esp, 4
test edi, edi
je 0x42f937
push ebx
push edi
push str.WLOG_LEVEL
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebx - 1]
cmp eax, ecx
je 0x42f956
push str.WLOG_LEVEL
push str._s_environment_variable_changed_in_my_back___n
call fcn.005815a5
add eax, 0x40
push eax
call fcn.0058328f
push edi
call fcn.00580204
add esp, 0x10
push dword [esi + 0x24]
call fcn.00580204
push dword [esi]
call fcn.00580204
push esi
call fcn.00580204
add esp, 0xc
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
ret
push edi
call fcn.0042fb40
push edi
mov ebx, eax
call fcn.00580204
add esp, 8
test ebx, ebx
js 0x42f979
push ebx
push esi
call fcn.0042fef0
add esp, 8
test eax, eax
je 0x42f937
push esi
call fcn.0042f550
add esp, 4
test eax, eax
js 0x42f994
push eax
push esi
call fcn.0042fef0
add esp, 8
test eax, eax
je 0x42f937
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret

Function at 0x42fac0
Capabilities:
Query environment variable

Disassembly:
push ebx
push edi
push dword [0x6453e0]
xor ebx, ebx
call fcn.00580204
add esp, 4
mov dword [0x6453e0], ebx
mov dword [0x6453dc], ebx
push ebx
push ebx
push str.WLOG_FILTER
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
cmp edi, 1
jae 0x42faf8
pop edi
lea eax, [ebx + 1]
pop ebx
ret
push esi
push edi
call fcn.0058023c
mov esi, eax
add esp, 4
test esi, esi
jne 0x42fb0c
pop esi
pop edi
pop ebx
ret
push edi
push esi
push str.WLOG_FILTER
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [edi - 1]
cmp eax, ecx
jne 0x42fb2b
push esi
call fcn.0042f2c0
add esp, 4
mov ebx, eax
push esi
call fcn.00580204
add esp, 4
mov eax, ebx
pop esi
pop edi
pop ebx
ret
Function at 0x432e10
Capabilities:
Query environment variable

Disassembly:
push esi
push 8
push 1
call fcn.00580d1f
mov esi, eax
add esp, 8
test esi, esi
jne 0x432e25
pop esi
ret
push ebx
push edi
push 0
push 0
push str.WLOG_PREFIX
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test ebx, ebx
je 0x432e7d
push ebx
call fcn.0058023c
mov edi, eax
add esp, 4
test edi, edi
je 0x432e91
push ebx
push edi
push str.WLOG_PREFIX
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebx - 1]
cmp eax, ecx
je 0x432e74
push edi
call fcn.00580204
push esi
call fcn.00580204
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
ret
mov dword [esi + 4], edi
pop edi
pop ebx
mov eax, esi
pop esi
ret
push str.__hr:_mi:_se:_ml____pid:_tid____lv___mn___
call fcn.00580c20
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x432e77
push esi
call fcn.00580204
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
ret

Function at 0x432f60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x68
push 1
call fcn.00580d1f
mov esi, eax
add esp, 8
test esi, esi
jne 0x432f7e
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push 0
push 0
push str.WLOG_FILEAPPENDER_OUTPUT_FILE_PATH
mov dword [esi], 1
mov dword [esi + 0x38], 0x4330a0
mov dword [esi + 0x3c], 0x432ef0
mov dword [esi + 0x40], 0x433330
mov dword [esi + 0x44], 0x433270
mov dword [esi + 0x48], 0x4332d0
mov dword [esi + 0x50], 0x432f30
mov dword [esi + 0x54], 0x433180
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test ebx, ebx
je 0x433010
push ebx
call fcn.0058023c
mov edi, eax
add esp, 4
test edi, edi
je 0x433078
push ebx
push edi
push str.WLOG_FILEAPPENDER_OUTPUT_FILE_PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebx - 1]
push edi
cmp eax, ecx
jne 0x433070
call fcn.00580c20
xor ebx, ebx
mov dword [esi + 0x5c], eax
test eax, eax
push edi
setne bl
call fcn.00580204
add esp, 8
test ebx, ebx
je 0x433078
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
push 0
push str.WLOG_FILEAPPENDER_OUTPUT_FILE_NAME
call ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x43308a
push eax
mov dword [ebp - 8], 0
call fcn.0058023c
mov edi, eax
add esp, 4
test edi, edi
je 0x43306d
push dword [ebp - 4]
push edi
push str.WLOG_FILEAPPENDER_OUTPUT_FILE_NAME
call ebx
mov ecx, dword [ebp - 4]
dec ecx
cmp eax, ecx
jne 0x43305e
push edi
push esi
call fcn.00433250
add esp, 8
mov dword [ebp - 8], eax
push edi
call fcn.00580204
add esp, 4
cmp dword [ebp - 8], 0
jne 0x43308a
push dword [esi + 0x5c]
call fcn.00580204
add esp, 4
push esi
call fcn.00580204
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x433e10
Capabilities:
Create udp socket
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x74
push 1
call fcn.00580d1f
mov esi, eax
add esp, 8
test esi, esi
jne 0x433e29
pop esi
pop ebp
ret
push edi
push 0x11
push 2
push 2
mov dword [esi], 6
mov dword [esi + 0x38], fcn.00433f00
mov dword [esi + 0x3c], 0x433db0
mov dword [esi + 0x40], 0x434110
mov dword [esi + 0x44], 0x4340f0
mov dword [esi + 0x48], 0x4340f0
mov dword [esi + 0x50], 0x433dd0
mov dword [esi + 0x54], 0x434050
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x70], eax
cmp eax, 0xffffffff
je 0x433eec
push 0
push 0
push str.WLOG_UDP_TARGET
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
test edi, edi
je 0x433ec4
push edi
call fcn.0058023c
add esp, 4
mov dword [esi + 0x58], eax
test eax, eax
je 0x433ed8
push edi
push eax
push str.WLOG_UDP_TARGET
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [edi - 1]
cmp eax, ecx
jne 0x433ed8
push esi
push dword [ebp + 8]
call fcn.00433f00
add esp, 8
test eax, eax
je 0x433ed8
pop edi
mov eax, esi
pop esi
pop ebp
ret
push str.127.0.0.1:20000
call fcn.00580c20
add esp, 4
mov dword [esi + 0x58], eax
test eax, eax
jne 0x433ebe
push dword [esi + 0x58]
call fcn.00580204
add esp, 4
push dword [esi + 0x70]
call dword [sym.imp.WS2_32.dll_closesocket]
push esi
call fcn.00580204
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
ret