joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418060
Capabilities:
Get hostname

Disassembly:
sub esp, 0x84
mov eax, dword [0x4bc4a0]
xor eax, esp
mov dword [esp + 0x80], eax
push esi
mov esi, dword [esp + 0x8c]
push 0x80
lea eax, [esp + 8]
push 0
push eax
call fcn.00466720
add esp, 0xc
push 0x80
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x4180ea
lea edx, [esp + 4]
push edx
call fcn.004177e0
add esp, 4
test eax, eax
je 0x4180ea
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, esi
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x4180c5
mov eax, 1
pop esi
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.00466555
add esp, 0x84
ret
mov ecx, dword [esp + 0x84]
pop esi
xor ecx, esp
xor eax, eax
call fcn.00466555
add esp, 0x84
ret
Function at 0x41e630
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x91c
mov eax, dword [0x4bc4a0]
xor eax, esp
mov dword [esp + 0x918], eax
push ebx
xor eax, eax
push esi
xor ebx, ebx
push 0x7ff
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov word [esp + 0x1d], ax
mov byte [esp + 0x1f], al
lea eax, [esp + 0x125]
push ebx
push eax
mov byte [esp + 0x17], bl
mov byte [esp + 0x18], bl
mov byte [esp + 0x12c], bl
call fcn.00466720
push 0x103
lea ecx, [esp + 0x2d]
push ebx
push ecx
mov byte [esp + 0x34], bl
call fcn.00466720
mov edx, dword [0x4bdcf8]
add esp, 0x18
add edx, 0x28c
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4bdcf8]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add eax, 0x16e
push eax
push 0x10
lea ecx, [esp + 0x14]
push ecx
push 0x49c432
push str.AppNum
push 0x49e238
call esi
test eax, eax
je 0x41e7d1
push ebp
lea edx, [esp + 0x10]
push edi
push edx
call fcn.00467557
mov ebp, eax
add esp, 4
xor edi, edi
cmp ebp, ebx
jle 0x41e7cf
push 0xa
lea eax, [esp + 0x18]
push eax
push edi
call fcn.004688e8
mov ecx, dword [0x4bdcf8]
add esp, 0xc
add ecx, 0x16e
push ecx
push 0x800
lea edx, [esp + 0x130]
push edx
push 0x49c432
push 0x49e11c
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x41e7bf
mov ecx, dword [0x4bdcf8]
add ecx, 0x16e
push ecx
push 0x104
lea edx, [esp + 0x2c]
push edx
push 0x49c432
push str.file
lea eax, [esp + 0x28]
push eax
call esi
test eax, eax
je 0x41e7bf
mov ecx, dword [esp + 0x930]
add ecx, 0x210
lea eax, [esp + 0x128]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x41e7a0
cmp dl, bl
je 0x41e79c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x41e7a0
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x41e780
xor eax, eax
jmp 0x41e7a5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x41e7bf
lea ecx, [esp + 0x24]
push str..tq.dat
push ecx
call fcn.004668e0
add esp, 8
test eax, eax
je 0x41e7ca
inc edi
cmp edi, ebp
jl 0x41e6f7
jmp 0x41e7cf
mov byte [esp + 0x13], 1
pop edi
pop ebp
mov edx, dword [0x4bdcf8]
add edx, 0x28c
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x920]
mov al, byte [esp + 0xb]
pop esi
pop ebx
xor ecx, esp
call fcn.00466555
add esp, 0x91c
ret
Function at 0x421ba0
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 4], 0
push esi
jne 0x421be0
mov esi, dword [esp + 0x10]
push 0x7d
push str...p2psrc_src_seed.cpp
push esi
push str.__del:_0x_x__file:__s:_u
call fcn.004166d0
add esp, 0x10
test esi, esi
je 0x421bd8
mov ecx, esi
call fcn.00424dd0
push esi
call fcn.0042ec92
add esp, 4
pop esi
xor eax, eax
pop ebx
pop ecx
ret 8
push 0x10
call fcn.0042ec63
add esp, 4
test eax, eax
je 0x421c0d
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov esi, eax
jmp 0x421c0f
xor esi, esi
push edi
push 0x81
push str...p2psrc_src_seed.cpp
push esi
push str.__new:_0x_x__file:__s:_u
call fcn.004166d0
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x1c]
push ecx
push 4
push esi
push 0x4216f0
push 0
push 0
mov dword [esi], ebx
mov dword [esi + 4], eax
call fcn.00466665
push 0x86
push str...p2psrc_src_seed.cpp
lea edx, [esp + 0x3c]
push edx
mov edi, eax
push edi
push str.__thrd:_0x_x:0x_x__file:__s:_u
call fcn.00416770
add esp, 0x3c
mov dword [esi + 0xc], edi
mov ecx, dword [ebx + 0xc]
push edi
call fcn.00419ef0
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [esp + 0x18], 0
je 0x421ca1
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
neg eax
pop edi
sbb eax, eax
and eax, dword [esp + 0x10]
pop esi
pop ebx
pop ecx
ret 8
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 8

Function at 0x421f10
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 4], 0
push esi
jne 0x421f53
mov esi, dword [esp + 0x10]
push 0xd6
push str...p2psrc_src_seed.cpp
push esi
push str.__del:_0x_x__file:__s:_u
call fcn.004166d0
add esp, 0x10
test esi, esi
je 0x421f4b
mov ecx, esi
call fcn.00424dd0
push esi
call fcn.0042ec92
add esp, 4
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
push 0x10
call fcn.0042ec63
add esp, 4
test eax, eax
je 0x421f80
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov esi, eax
jmp 0x421f82
xor esi, esi
push edi
push 0xda
push str...p2psrc_src_seed.cpp
push esi
push str.__new:_0x_x__file:__s:_u
call fcn.004166d0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x1c]
push edx
push 4
push esi
push 0x421cb0
push 0
push 0
mov dword [esi], ebx
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
call fcn.00466665
push 0xe0
mov edi, eax
push str...p2psrc_src_seed.cpp
lea eax, [esp + 0x3c]
push eax
push edi
push str.__thrd:_0x_x:0x_x__file:__s:_u
call fcn.00416770
add esp, 0x3c
mov dword [esi + 0xc], edi
mov ecx, dword [ebx + 0xc]
push edi
call fcn.00419ef0
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [esp + 0x1c], 0
je 0x42201b
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x14]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
neg eax
pop edi
sbb eax, eax
and eax, dword [esp + 0x10]
pop esi
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
Function at 0x424630
Capabilities:
Create thread

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea ebp, [ebx + 0x28]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebx + 0x68]
sub esi, dword [ebx + 0x64]
lea edi, [ebx + 0x58]
push ebp
sar esi, 2
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, 0x32
jle 0x42468a
mov esi, dword [esp + 0x1c]
push 0x86
push str...p2psrc_src_serv.cpp
push esi
push str.__sock_cls:_0x_x__file:__s:_u
call fcn.00416770
add esp, 0x10
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
push 0x14
call fcn.0042ec63
xor esi, esi
add esp, 4
cmp eax, esi
je 0x4246aa
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov esi, eax
push 0x8c
push str...p2psrc_src_serv.cpp
push esi
push str.__new:_0x_x__file:__s:_u
mov dword [esp + 0x24], esi
call fcn.004166d0
mov dword [esi + 0xc], ebx
mov ebx, dword [esp + 0x2c]
add esp, 0x10
push ebp
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
and eax, 0xfffffffc
cmp eax, 0xc8
jle 0x42472b
lea ecx, [esp + 0x10]
push ecx
push 0
push esi
push 0x423aa0
push 0
push 0
call fcn.00466665
push 0x93
push str...p2psrc_src_serv.cpp
lea edx, [esp + 0x30]
push edx
push eax
push str.__thrd:_0x_x:0x_x__file:__s:_u
mov dword [esi + 8], eax
call fcn.00416770
add esp, 0x2c
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.00421680
jmp 0x424765
push 0x98
push str...p2psrc_src_serv.cpp
push esi
push str.__del:_0x_x__file:__s:_u
call fcn.004166d0
push esi
call fcn.0042ec92
push 0x99
push str...p2psrc_src_serv.cpp
push ebx
push str.__sock_cls:_0x_x__file:__s:_u
call fcn.00416770
add esp, 0x24
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret 4
Function at 0x4247d0
Capabilities:
Create tcp socket
Create thread

Disassembly:
sub esp, 0x18
mov eax, dword [0x4bc4a0]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push 6
push 1
push 2
mov esi, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x424807
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00466555
add esp, 0x18
ret
mov ecx, dword [0x4bdcf8]
push ebx
push ebp
push edi
add ecx, 0x56
mov eax, 2
push ecx
mov word [esp + 0x18], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ebx, dword [sym.imp.WS2_32.dll_htons]
mov ebp, dword [sym.imp.WS2_32.dll_bind]
mov dword [esp + 0x18], eax
xor edi, edi
jmp 0x424840
mov edx, dword [0x4bdcf8]
movzx eax, word [edx + 4]
push eax
call ebx
mov edx, dword [esi + 8]
push 0x10
lea ecx, [esp + 0x18]
push ecx
push edx
mov word [esp + 0x22], ax
call ebp
cmp eax, 0xffffffff
jne 0x4248b0
mov eax, dword [0x4bdcf8]
inc dword [eax + 4]
inc edi
cmp edi, 0x64
jl 0x424840
push 0x52
mov eax, dword [esi + 8]
push str...p2psrc_src_serv.cpp
push eax
push str.__sock_cls:_0x_x__file:__s:_u
call fcn.00416770
mov ecx, dword [esi + 8]
add esp, 0x10
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 8], 0
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00466555
add esp, 0x18
ret
mov edx, dword [esi + 8]
push accept
push edx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x4248c8
push 0x59
jmp 0x424874
lea edx, [esp + 0x10]
push edx
xor ebx, ebx
push ebx
push esi
push 0x424780
push ebx
push ebx
call fcn.00466665
push 0x5f
push str...p2psrc_src_serv.cpp
lea ecx, [esp + 0x30]
push ecx
push eax
push str.__thrd:_0x_x:0x_x__file:__s:_u
mov dword [esi + 4], eax
call fcn.00416770
add esp, 0x2c
cmp dword [esi + 4], ebx
je 0x42489b
push 0x124
call fcn.0042ec63
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x424926
lea edx, [edi + 0xc]
push edx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x424928
xor edi, edi
push 0x62
push str...p2psrc_src_serv.cpp
push edi
push str.__new:_0x_x__file:__s:_u
mov dword [esi + 0xc], edi
call fcn.004166d0
add esp, 0x10
cmp dword [esi + 0xc], ebx
je 0x42489b
mov ecx, dword [esp + 0x24]
pop edi
pop ebp
pop ebx
pop esi
xor ecx, esp
mov eax, 1
call fcn.00466555
add esp, 0x18
ret
Function at 0x4255a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
cmp dword [esp + 0x10], 0
mov dword [esp + 4], ecx
je 0x4256b3
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4256b3
mov eax, dword [esp + 0x20]
push ebx
mov ebx, dword [eax + 0x68]
sub ebx, dword [eax + 0x64]
mov dword [esp + 4], 0
sar ebx, 2
cmp dword [ecx], 0
jne 0x4256a8
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
sub edi, dword [esp + 0x10]
test edi, edi
jle 0x4256a5
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx]
cmp ecx, 0x40000001
mov ebp, eax
mov eax, 0x2800
jge 0x425614
mov eax, ecx
cdq
add ebx, ebx
idiv ebx
cmp eax, edi
jle 0x42561a
mov eax, edi
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x2c]
add edx, eax
push edx
push ecx
call fcn.00417a80
add esp, 0x14
mov edi, eax
call esi
mov esi, eax
sub esi, ebp
test edi, edi
jle 0x4256a5
mov eax, dword [esp + 0x30]
mov ebx, dword [eax + 0x68]
sub ebx, dword [eax + 0x64]
add dword [esp + 0x10], edi
sar ebx, 2
cmp dword [esp + 0x34], 0
je 0x42566e
push str.limit_send_err
call fcn.004168b0
add esp, 4
mov ecx, dword [esp + 0x14]
mov eax, edi
imul eax, eax, 0x3e8
cdq
idiv dword [ecx]
sub eax, esi
test eax, eax
jle 0x425698
cmp eax, 0x3e8
jle 0x42568f
mov eax, 0x3e8
push eax
call fcn.004299c0
add esp, 4
mov edx, dword [esp + 0x2c]
cmp dword [edx], 0
je 0x4255e0
pop edi
pop esi
pop ebp
mov eax, dword [esp + 4]
pop ebx
add esp, 8
ret 0x1c
xor eax, eax
add esp, 8
ret 0x1c
Function at 0x429e60
Capabilities:
Create thread

Disassembly:
push ecx
push 0x4bde48
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x13
push str...p2psrc_src_timer.cpp
push eax
push str.__event:_0x_x__file:__s:_u
mov dword [0x4bde60], eax
call fcn.00416770
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x429ac0
push 0
push 0
call fcn.00466665
push 0x14
push str...p2psrc_src_timer.cpp
lea ecx, [esp + 0x30]
push ecx
push eax
push str.__thrd:_0x_x:0x_x__file:__s:_u
mov dword [0x4bde64], eax
call fcn.00416770
mov eax, 1
add esp, 0x40
ret
Function at 0x42b250
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
cmp dword [esp + 0x10], 0xffffffff
push ebx
je 0x42b440
xor ebx, ebx
cmp dword [esp + 0x20], ebx
je 0x42b440
cmp dword [esp + 0x18], ebx
jbe 0x42b440
push esi
push 0x4bde48
mov byte [esp + 0xf], bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x4bde74]
cmp esi, dword [0x4bde78]
jbe 0x42b298
call fcn.0046814b
push ebp
mov ebp, dword [0x4bde68]
push edi
mov edi, dword [0x4bde78]
cmp dword [0x4bde74], edi
jbe 0x42b2b3
call fcn.0046814b
cmp ebp, ebx
je 0x42b2bf
cmp ebp, dword [0x4bde68]
je 0x42b2c4
call fcn.0046814b
cmp esi, edi
je 0x42b310
cmp ebp, ebx
jne 0x42b301
call fcn.0046814b
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x42b2dd
call fcn.0046814b
mov eax, dword [esi]
mov ecx, dword [esp + 0x20]
cmp dword [eax], ecx
je 0x42b30b
cmp ebp, ebx
jne 0x42b306
call fcn.0046814b
xor eax, eax
cmp esi, dword [eax + 0x10]
jb 0x42b2fc
call fcn.0046814b
add esi, 4
jmp 0x42b2a0
mov eax, dword [ebp]
jmp 0x42b2d3
mov eax, dword [ebp]
jmp 0x42b2f2
mov byte [esp + 0x13], 1
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x4bde48
call edi
cmp byte [esp + 0x13], bl
jne 0x42b36e
push 0x24
call fcn.0042ec63
add esp, 4
cmp eax, ebx
je 0x42b34f
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov byte [eax + 0x14], bl
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x20], ebx
mov esi, eax
jmp 0x42b351
xor esi, esi
push 0x70
push str...p2psrc_src_timer.cpp
push esi
push str.__new:_0x_x__file:__s:_u
mov dword [esp + 0x28], esi
call fcn.004166d0
add esp, 0x10
cmp esi, ebx
jne 0x42b378
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
push ebx
mov dword [esi], edx
mov edx, dword [esp + 0x30]
push ebx
mov dword [esi + 4], eax
push ebx
mov dword [esi + 0x18], ecx
push ebx
mov dword [esi + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x79
push str...p2psrc_src_timer.cpp
push eax
push str.__event:_0x_x__file:__s:_u
mov dword [esi + 0x20], eax
call fcn.00416770
lea eax, [esp + 0x24]
push eax
push ebx
push esi
push 0x429a20
push ebx
push ebx
call fcn.00466665
push 0x7a
push str...p2psrc_src_timer.cpp
lea ecx, [esp + 0x44]
push ecx
push eax
push str.__thrd:_0x_x:0x_x__file:__s:_u
mov dword [esi + 0xc], eax
call fcn.00416770
lea edx, [esp + 0x50]
push edx
push ebx
push esi
push 0x4299e0
push ebx
push ebx
call fcn.00466665
add esp, 0x54
push 0x7b
push str...p2psrc_src_timer.cpp
lea ecx, [esp + 0x1c]
push ecx
push eax
push str.__thrd:_0x_x:0x_x__file:__s:_u
mov dword [esi + 0x10], eax
call fcn.00416770
add esp, 0x14
push 0x4bde48
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edx, [esp + 0x18]
push edx
mov ecx, 0x4bde68
call fcn.0042aca0
push 0x4bde48
call edi
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
add esp, 0xc
ret
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x42d150
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x358
mov eax, dword [0x4bc4a0]
xor eax, esp
mov dword [esp + 0x354], eax
push edi
push 0x103
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call fcn.00466720
push 0x103
lea ecx, [esp + 0x265]
push 0
push ecx
mov byte [esp + 0x26c], 0
call fcn.00466720
push 0x143
lea edx, [esp + 0x12d]
push 0
push edx
mov byte [esp + 0x134], 0
call fcn.00466720
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x24
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
push reloc.WS2_32.dll_bind
call edi
test eax, eax
je 0x42d1f0
xor eax, eax
pop edi
mov ecx, dword [esp + 0x354]
xor ecx, esp
call fcn.00466555
add esp, 0x358
ret
push 0x104
lea ecx, [esp + 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0xc]
push 0x5c
push edx
call fcn.00468750
add esp, 8
test eax, eax
je 0x42d1d8
inc eax
lea edx, [esp + 0x254]
sub edx, eax
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x42d220
lea eax, [esp + 0x254]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42d234
sub eax, edx
je 0x42d1d8
lea eax, [esp + 0x254]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x118]
push str._s::Enabled:_s
push edx
call fcn.0046759c
lea eax, [esp + 0x120]
add esp, 0x10
lea edx, [eax + 1]
jmp 0x42d270
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42d270
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
mov edx, dword [esp + 8]
push eax
lea eax, [esp + 0x118]
push eax
push 1
push 0
lea ecx, [esp + 0x20]
push ecx
push edx
call esi
test eax, eax
je 0x42d2a1
xor esi, esi
jmp 0x42d2ee
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfileAuthorizedApplicationsList
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x42d2e9
lea eax, [esp + 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42d2c7
sub eax, edx
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x118]
push ecx
push 1
push 0
lea edx, [esp + 0x20]
push edx
push eax
call esi
mov esi, 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x35c]
mov eax, esi
pop esi
pop edi
xor ecx, esp
call fcn.00466555
add esp, 0x358
ret
Function at 0x42d320
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x378
mov eax, dword [0x4bc4a0]
xor eax, esp
mov dword [esp + 0x374], eax
push 0x103
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call fcn.00466720
push 0x103
lea ecx, [esp + 0x119]
push 0
push ecx
mov byte [esp + 0x120], 0
call fcn.00466720
push 0x167
lea edx, [esp + 0x229]
push 0
push edx
mov byte [esp + 0x230], 0
call fcn.00466720
add esp, 0x24
push 0x104
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 4]
push 0x5c
push ecx
call fcn.00468750
add esp, 8
test eax, eax
je 0x42d43f
inc eax
lea edx, [esp + 0x108]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x42d3b8
lea eax, [esp + 0x108]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42d3d0
sub eax, edx
je 0x42d43f
push esi
lea edx, [esp + 0x10c]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x218]
push str.netsh_firewall_add_allowedprogram___s____s__ENABLE
push ecx
call fcn.0046759c
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x10
push 0
lea edx, [esp + 0x214]
push edx
call esi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x110]
push ecx
lea edx, [esp + 0x218]
push str.netsh_advfirewall_firewall_add_rule_name__s__dirin_program__s__actionallow
push edx
call fcn.0046759c
add esp, 0x10
push 0
lea eax, [esp + 0x214]
push eax
call esi
pop esi
mov ecx, dword [esp + 0x374]
xor ecx, esp
call fcn.00466555
add esp, 0x378
ret

Function at 0x4329ad
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4329d1
cmp dword [edi + 0x54], 0
jne 0x4329d1
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00438a65
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0043296e
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x43f514
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x43f55b
call fcn.00438a65
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x43f55b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x43f577
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0043f08e
mov esi, eax
test edi, edi
je 0x43f575
test ebx, ebx
je 0x43f575
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4