joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4203fc
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
push esi
push edi
push 0xf01ff
lea ecx, [ebx + 4]
call fcn.0042b153
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x420570
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x24]
push eax
push edi
call esi
test eax, eax
jne 0x420468
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
lea eax, [ebp - 8]
push str.ERROR__d_QueryServiceStatus__
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 8]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
cmp dword [ebp - 0x20], 1
je 0x4204f6
lea eax, [ebp - 0x24]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x4204c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
lea eax, [ebp - 8]
push str.ERROR__d_ControlService__
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 8]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
cmp dword [ebp - 0x20], 3
jne 0x4204cb
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x24]
push eax
push edi
call esi
test eax, eax
jne 0x4204b2
cmp dword [ebp - 0x20], 1
je 0x4204f6
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [ebp - 8]
push str.The_Ammyy_service_could_not_be_stopped
push eax
call fcn.0042783a
pop ecx
lea eax, [ebp - 8]
pop ecx
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
cmp dword [ebp + 0xc], 0
je 0x420562
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x420559
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp esi, 0x430
lea eax, [ebp - 8]
jne 0x42053c
push str.The_Ammyy_service_is_already_marked_for_removing
push eax
call fcn.0042783a
pop ecx
lea eax, [ebp - 8]
pop ecx
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
push esi
push str.The_Ammyy_service_could_not_be_removed__error_d
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 8]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0
mov ecx, ebx
call fcn.0042034a
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
leave
ret 8
lea eax, [ebp - 8]
push str.The_Ammyy_service_could_not_be_found
push eax
call fcn.0042783a
pop ecx
lea eax, [ebp - 8]
pop ecx
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
Function at 0x42058e
Capabilities:
Start service

Disassembly:
mov eax, 0x47f9d0
call fcn.0047bf90
sub esp, 0x10
push esi
push 0xf01ff
add ecx, 4
call fcn.0042b153
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x4205d7
lea eax, [ebp - 0x14]
push str.The_Ammyy_service_could_not_be_found
push eax
call fcn.0042783a
pop ecx
lea eax, [ebp - 0x14]
pop ecx
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x420628
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [ebp + 8]
push edi
push eax
call fcn.0040bd18
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push edi
push str.ERROR__d___S__while_starting_the_AMMYY_service
push eax
call fcn.0042783a
add esp, 0x18
lea eax, [ebp - 0x1c]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
pop edi
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42094d
Capabilities:
Delete service
Query service status
Start service

Disassembly:
mov eax, 0x47fa58
call fcn.0047bf90
sub esp, 0x8c
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ebx
jge 0x42098d
lea eax, [ebp - 0x54]
push str.JustLunch___Invalid_Session
push eax
call fcn.0042783a
pop ecx
lea eax, [ebp - 0x54]
pop ecx
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x4209c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x30]
push str.OpenSCManager___error__d
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0x30]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
push 1
push eax
mov ecx, ebx
mov dword [ebp - 4], esi
call fcn.004203fc
jmp 0x4209e1
push 2
mov ecx, ebx
pop edi
mov dword [ebp - 0x14], esi
push dword [ebp - 0x18]
mov dword [ebp - 4], edi
call fcn.004201ce
lea ecx, [ebx + 4]
call fcn.0042b153
push 0xf01ff
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
mov dword [ebp - 0x14], esi
jne 0x420a3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x5c]
push str.OpenService___error__d
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0x5c]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
push dword [ebp + 8]
lea eax, [ebp - 0x98]
push 0x4a34b8
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
lea eax, [ebp - 0x98]
add esp, 0xc
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x420a97
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x38]
push str.StartService___error__d
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0x38]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x420acc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x40]
push str.QueryServiceStatus___error__d
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0x40]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
cmp dword [ebp - 0x74], 1
je 0x420adc
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x420a97
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x420b0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x4c]
push str.DeleteService___error__d
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0x4c]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push dword [ebp - 0x18]
call esi
push 0
mov ecx, ebx
call fcn.0042034a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x42312a
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x47fef4
call fcn.0047bf90
push ecx
lea eax, [ebp - 0x10]
push eax
call fcn.0042a16f
and dword [ebp - 4], 0
push 1
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.0042b153
push eax
push 0x4a1678
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042a9b6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x423328
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0xffffffff
je 0x423353
lea eax, [ebp - 8]
push str.CreateInternal__1
push eax
call fcn.0042783a
pop ecx
lea eax, [ebp - 8]
pop ecx
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x42338c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 8]
push str.Error__d_socket__
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 8]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
pop esi
leave
ret

Function at 0x4234a4
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
xor edx, edx
mov ecx, 0x3e8
push edi
div ecx
xor edi, edi
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x10], eax
mov eax, dword [esi]
imul edx, edx, 0x3e8
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x114]
push edi
push eax
push edi
mov dword [ebp - 0xc], edx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, edi
jne 0x4234fe
or eax, 0xffffffff
pop edi
pop esi
leave
ret 4
jle 0x423547
lea eax, [ebp - 0x114]
push eax
push dword [esi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x423547
push edi
push edi
push dword [esi]
call dword [sym.imp.WS2_32.dll_accept]
cmp eax, 0xffffffff
jne 0x4234f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 8]
push str.accept___error_d
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 8]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 8]
push str.select___error_d
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 8]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException

Function at 0x42356d
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0xc], eax
mov word [ebp - 0x10], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x10]
push 0x10
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
pop esi
je 0x4235a8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
leave
ret 8
Function at 0x4235ff
Capabilities:
Connect socket
Get socket status

Disassembly:
mov eax, 0x47ffa8
call fcn.0047bf90
sub esp, 0x22c
push ebx
push esi
push edi
lea ecx, [ebp - 0x10]
call fcn.0042331d
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00423328
push ebx
push dword [ebp - 0x10]
call fcn.004242ea
mov eax, dword [ebp + 8]
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
push dword [ebp + 0xc]
mov word [ebp - 0x30], 2
call dword [sym.imp.WS2_32.dll_htons]
mov edi, dword [ebp - 0x10]
mov word [ebp - 0x2e], ax
lea eax, [ebp - 0x30]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
xor esi, esi
inc esi
test eax, eax
je 0x423720
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x423735
mov eax, dword [ebp + 0x10]
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x134], esi
mov dword [ebp - 0x20], eax
imul edx, edx, 0x3e8
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], edx
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x238]
push eax
push ebx
push ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, ebx
jl 0x42375c
cmp eax, esi
jg 0x42375c
cmp eax, ebx
je 0x423752
cmp eax, esi
jne 0x4236e9
lea eax, [ebp - 0x134]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x423752
lea eax, [ebp - 0x238]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x423720
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x18]
push str.select___error_d
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0x18]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
push esi
push dword [ebp - 0x10]
call fcn.004242ea
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
call fcn.004233fd
mov ebx, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00423323
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
lea ecx, [ebp - 0x10]
call fcn.0042338f
jmp 0x423735
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x18]
push str.select___error_d
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0x18]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException

Function at 0x423782
Capabilities:
Set socket configuration

Disassembly:
push dword [esp + 4]
call fcn.00423791
pop ecx
jmp fcn.004237db

Function at 0x423791
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor eax, eax
lea ecx, [ebp - 4]
inc eax
push 4
push ecx
push eax
push 6
mov dword [ebp - 4], eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x4237d9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [ebp - 0xc]
push str.ERROR__d_disabling_Nagles_algorithm
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
leave
ret
Function at 0x4239c3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
cmp dword [0x4aecd4], 0
mov dword [ebp - 0x18], str.getaddrinfo
mov dword [ebp - 0x14], 0x423b5c
mov dword [ebp - 0x10], str.getnameinfo
mov dword [ebp - 0xc], 0x42408d
mov dword [ebp - 8], str.freeaddrinfo
mov dword [ebp - 4], fcn.00423b20
jne 0x423b11
push ebx
push esi
push edi
lea eax, [ebp - 0x22c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x423b04
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x124]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x124]
push str.ws2_32
push eax
call sub.MSVCRT.dll_strcat
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x10
lea eax, [ebp - 0x124]
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x423a7b
push str.getaddrinfo
push esi
call edi
test eax, eax
jne 0x423a77
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
jne 0x423aca
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x124]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x124]
push str.wship6
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x124]
push eax
call ebx
mov esi, eax
test esi, esi
je 0x423b04
push str.getaddrinfo
push esi
call edi
test eax, eax
jne 0x423ac6
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x423b04
xor ebx, ebx
push dword [ebp + ebx*8 - 0x18]
push esi
call edi
test eax, eax
mov dword [ebp + ebx*8 - 0x14], eax
je 0x423ae3
inc ebx
cmp ebx, 3
jl 0x423acc
jmp 0x423aec
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x423b04
xor eax, eax
mov ecx, dword [ebp + eax - 0x14]
mov dword [eax + 0x4a37f8], ecx
add eax, 8
cmp eax, 0x18
jl 0x423af2
pop edi
pop esi
mov dword [0x4aecd4], 1
pop ebx
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x4a37f8]
leave
ret 4

Function at 0x423fa6
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
push dword [ebp + 8]
and dword [edi], 0
and byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x424020
cmp word [ebx + 8], 2
jne 0x423ffc
cmp word [ebx + 0xa], 4
jne 0x423ffc
mov esi, dword [ebx + 0xc]
jmp 0x423ff6
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00423e3f
test eax, eax
mov dword [edi], eax
je 0x42401b
lea edi, [eax + 0x1c]
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x423fda
mov esi, dword [ebp + 0x18]
push 0x400
push dword [ebx]
push esi
call dword [sym.imp.MSVCRT.dll_strncpy]
and byte [esi + 0x400], 0
add esp, 0xc
xor eax, eax
jmp 0x424046
push 8
pop eax
jmp 0x424046
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x424046
dec ecx
je 0x424041
dec ecx
je 0x42403a
dec ecx
jmp 0x424046
mov eax, 0x2afb
jmp 0x424046
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x4242ea
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
cmp byte [ebp + 0xc], al
sete al
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push 0x8004667e
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x424339
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 8]
push str.Error_d_in_SetBlockingMode__u_
push eax
call fcn.0042783a
add esp, 0x10
lea eax, [ebp - 8]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
leave
ret

Function at 0x42433b
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
push 4
cmp byte [ebp + 0xc], al
setne al
mov word [ebp + 0xc], ax
mov ax, word [ebp + 0x10]
mov word [ebp + 0xe], ax
lea eax, [ebp + 0xc]
push eax
push 0x80
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x424397
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 8]
push str.setsockopt_SO_LINGER___u
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 8]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
leave
ret

Function at 0x424399
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push 4
push eax
push 0x1001
push 0xffff
mov dword [ebp - 4], 0x10000
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x4243e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc]
push str.Error_d_setsockopt__
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0xc]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
leave
ret

Function at 0x4243eb
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [ebp + 0x10]
push esi
mov esi, ecx
xor edx, edx
mov ecx, 0x3e8
mov dword [ebp - 0x114], 1
div ecx
mov dword [ebp - 8], eax
mov eax, dword [esi]
imul edx, edx, 0x3e8
mov dword [ebp - 0x110], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x114]
push 0
push eax
push 0
mov dword [ebp - 4], edx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jl 0x424473
cmp eax, 1
jg 0x424473
lea eax, [ebp - 0x114]
push eax
push dword [esi]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x42446f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x42446a
or eax, 0xffffffff
pop esi
leave
ret 0xc
xor eax, eax
jmp 0x42446a
push dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10]
push str.ERROR__d_in_TCP::TryRead__1__d_socket_X
push eax
call fcn.00424a82
add esp, 0x14
lea eax, [ebp - 0x10]
push 0x493180
push eax
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [esp + 4]
push esi
mov esi, ecx
add eax, 4
push eax
lea ecx, [esi + 4]
call fcn.0042a6c1
mov dword [esi], 0x48a5d8
mov eax, esi
pop esi
ret 4
Function at 0x424987
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ecx + 8]
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x114], 1
imul edx, edx, 0x3e8
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x114]
push 0
push eax
lea eax, [esi + 1]
push eax
mov dword [ebp - 4], edx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jl 0x4249f5
cmp eax, 2
jg 0x4249f5
lea eax, [ebp - 0x114]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
neg eax
sbb eax, eax
pop esi
neg eax
leave
ret 4
push eax
lea eax, [ebp - 0x10]
push str.ERROR_in_TransportTCP1::IsReadyForRead__1__d
push eax
call fcn.00424a82
add esp, 0xc
lea eax, [ebp - 0x10]
push 0x493180
push eax
call sub.MSVCRT.dll__CxxThrowException
Function at 0x425057
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4800fc
call fcn.0047bf90
sub esp, 0x50
push ebx
push esi
push str.Elevate__
push 0x4aea90
call fcn.004287f7
xor ebx, ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0040ba66
add esp, 0x10
push str._elevated
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.0042c02c
push 0x4ae414
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
call fcn.0042c1e4
add esp, 0xc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.0042bf6c
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x5c], 0x3c
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], str.runas
call fcn.0042b153
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x4c], eax
call fcn.0042b153
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x3c], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x425147
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x4c7
jne 0x425125
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0042bf6c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0042bf6c
xor al, al
jmp 0x425160
call esi
push eax
lea eax, [ebp - 0x20]
push str.Error__d_in_Elevate__
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0x20]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0042bf6c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0042bf6c
mov al, 1
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42524c
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push eax
call esi
push 0
mov edi, eax
push dword [esp + 0x14]
call esi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, eax
push 1
push ebx
push edi
call esi
test eax, eax
jne 0x42528f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x4252ea
push eax
push str.SetForegroundWindow__1_Error__d
jmp 0x4252dd
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x4252ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetForegroundWindow__2_Error__d
jmp 0x4252dd
push 0
push ebx
push edi
call esi
test eax, eax
jne 0x4252c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetForegroundWindow__3_Error__d
jmp 0x4252dd
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetActiveWindow]
test eax, eax
jne 0x4252ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetForegroundWindow__4_Error__d
push 0x4aea90
call fcn.004287df
add esp, 0xc
xor eax, eax
jmp 0x4252f1
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret
Function at 0x4272fb
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx + 0x1db4]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jle 0x427323
mov edx, dword [esp + 8]
push edi
movzx edi, byte [edx]
xor edi, eax
movzx eax, byte [edi + ecx + 0x1cb4]
mov byte [edx], al
inc edx
dec esi
jne 0x42730f
pop edi
mov dword [ecx + 0x1db4], eax
pop esi
ret 8

Function at 0x427350
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push edi
mov edi, ecx
test edx, edx
mov ecx, dword [edi + 0x1db4]
jle 0x42737d
push ebx
push esi
mov esi, dword [esp + 0x10]
movzx eax, byte [esi]
mov bl, byte [edi + eax + 0x1cb4]
xor bl, cl
mov ecx, eax
mov byte [esi], bl
inc esi
dec edx
jne 0x427367
pop esi
pop ebx
mov dword [edi + 0x1db4], ecx
pop edi
ret 8

Function at 0x4273e9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, edx
push esi
shr eax, 2
test eax, eax
jle 0x427412
mov esi, eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ecx]
add ecx, 4
xor dword [eax], edi
add eax, 4
dec esi
jne 0x427402
pop edi
jmp 0x427415
mov eax, dword [ebp + 8]
and edx, 3
jle 0x427425
mov esi, edx
mov dl, byte [ecx]
xor byte [eax], dl
inc eax
inc ecx
dec esi
jne 0x42741c
pop esi
pop ebp
ret