joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b820
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xffffffff
jne 0x42b84a
push str.Err:_socket_handler_invalid__out__n
push 0x5f2334
call fcn.0040c050
add esp, 8
xor eax, eax
jmp 0x42b94a
cmp dword [ebp + 8], 0
je 0x42b856
cmp dword [ebp + 0xc], 0
ja 0x42b86f
push str.Err:_Recv_buffer_invalid__out__n
push 0x5f23ac
call fcn.0040c050
add esp, 8
xor eax, eax
jmp 0x42b94a
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x42b91c
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
je 0x42b89e
push str.Err:_Stop_work_flag_set__need_break__n
push 0x5f2430
call fcn.0040c050
add esp, 8
jmp 0x42b91c
push 0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x42b8ed
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
jne 0x42b8d2
jmp 0x42b876
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Err:_socket_recv_err_d__break__n
push 0x5f24a8
call fcn.0040c050
add esp, 0xc
jmp 0x42b91c
cmp dword [ebp - 8], 0
jne 0x42b90e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Err:_socket_may_closed__recv_ret_0__err_d__break__n
push 0x5f2544
call fcn.0040c050
add esp, 0xc
jmp 0x42b91c
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jmp 0x42b876
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
je 0x42b945
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push str.Err:_socket_recv_data_not_completely__out__n
push str.CSafeLogging::CTcpCommunicator::RecvNetCmdData
call fcn.0040c050
add esp, 8
xor eax, eax
jmp 0x42b94a
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42b950
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 0
push 1
mov eax, dword [ebp - 0x10]
add eax, 0x58
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x42b987
push str.Tcp_connection_is_fixing__can_not_execute_send._n
push 0x5f266c
call fcn.0040c050
add esp, 8
xor eax, eax
jmp 0x42ba88
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
cmp dword [ecx], 0xffffffff
jne 0x42b9ad
push str.WAR:_socket_handler_invalid__break__n
push 0x5f26ec
call fcn.0040c050
add esp, 8
jmp 0x42ba76
cmp dword [ebp + 8], 0
je 0x42b9b9
cmp dword [ebp + 0xc], 0
ja 0x42b9d0
push str.Err:_Data_params_invalid__break__n
push 0x5f2768
call fcn.0040c050
add esp, 8
jmp 0x42ba76
mov dword [ebp - 8], 0
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0xc]
jae 0x42ba4b
push 0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x42ba1f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.WAR:_socket_send_err_d__break__n
push 0x5f27dc
call fcn.0040c050
add esp, 0xc
jmp 0x42ba4b
cmp dword [ebp - 0xc], 0
jne 0x42ba40
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.WAR:_socket_send_return_0__err_d__break__n
push 0x5f2868
call fcn.0040c050
add esp, 0xc
jmp 0x42ba4b
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
jmp 0x42b9d7
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0xc]
je 0x42ba67
push str.WAR:_socket_send_data_not_completely__break__n
push str.CSafeLogging::CTcpCommunicator::SendReportData
call fcn.0040c050
add esp, 8
jmp 0x42ba76
mov dword [ebp - 4], 1
xor eax, eax
jne 0x42b98e
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x58
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x42bd40
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
cmp dword [ebp + 8], 0xffffffff
je 0x42bd5b
cmp dword [ebp + 0xc], 0
je 0x42bd5b
cmp dword [ebp + 0x10], 0
jne 0x42bd74
push str.Err:_Socket_handle_or_params_invalid_out_
push 0x5f2be0
call fcn.0040c050
add esp, 8
xor eax, eax
jmp 0x42be53
mov dword [ebp - 0x14], 1
push 4
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x42bdbb
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Err:_setsockopt_SO_KEEPALIVE__fail_code_d__out_
push 0x5f2c80
call fcn.0040c050
add esp, 0xc
xor eax, eax
jmp 0x42be53
mov dword [ebp - 0xc], 0
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x2c], 0xc
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 8], edx
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0x98000004
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x42be4e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Err:_WSAIoctl_SIO_KEEPALIVE_VALS__fail_code_d__out_
push str.CSafeLogging::CTcpCommunicator::SetSocketTcpAlive
call fcn.0040c050
add esp, 0xc
xor eax, eax
jmp 0x42be53
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42c5e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58666d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x615000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00405ec0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00405ec0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x4c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x50], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x54], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0x58
call fcn.0042df60
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x90
call fcn.0042e310
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0xc8
call fcn.0042b580
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x58
call fcn.0042e2a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42d8f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x19c], ecx
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x42d93c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DllMain_WSAStartup__d_n
push str.CSafeLogging::InitCommunicationComponent
call fcn.0040c050
add esp, 0xc
xor eax, eax
jmp 0x42d96b
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ecx + 8]
push edx
mov ecx, dword [ebp - 0x19c]
add ecx, 0x30
call fcn.00406030
push eax
mov ecx, dword [ebp - 0x19c]
add ecx, 0xc8
call fcn.0042b6b0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret

Function at 0x42d980
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x42da4e
cmp dword [ebp + 8], 0
je 0x42da4e
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x54], 0xffffffff
je 0x42da4e
mov dword [ebp - 4], 0
push 2
push 0
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.00459160
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00406030
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 4]
push ecx
push 3
push 0x5f4ba8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x5f4bac
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, 1
jmp 0x42da50
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42da60
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x114], 0
cmp dword [ebp + 8], 0
je 0x42da8f
cmp dword [ebp + 0xc], 0
jne 0x42da96
xor eax, eax
jmp 0x42dc77
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.00562540
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x124], cx
xor edx, edx
mov dword [ebp - 0x122], edx
mov dword [ebp - 0x11e], edx
mov dword [ebp - 0x11a], edx
mov word [ebp - 0x116], dx
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x11e]
push ecx
movzx edx, word [ebp - 0x122]
push edx
movzx eax, word [ebp - 0x124]
push eax
push str.HSCT_LOG___d__02d__02d.txt
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call fcn.0055b87e
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x42db25
xor eax, eax
jmp 0x42dc77
mov ecx, dword [ebp - 0x23c]
add ecx, 0x14
call fcn.0040e460
movzx edx, al
test edx, edx
je 0x42dbdd
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x12c], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
and eax, 0xffff
movzx ecx, ax
and ecx, 0xff
movzx edx, cl
mov dword [ebp - 0x12c], edx
cmp dword [ebp - 0x12c], 6
jb 0x42dbca
mov byte [ebp - 0x238], 0
push 0x103
push 0
lea eax, [ebp - 0x237]
push eax
call fcn.00562540
add esp, 0xc
lea ecx, [ebp - 0x238]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x238]
push edx
mov ecx, dword [ebp - 0x23c]
add ecx, 0x14
call fcn.00405fb0
jmp 0x42dbdd
push 0x5f4bcc
mov ecx, dword [ebp - 0x23c]
add ecx, 0x14
call fcn.00405fb0
mov ecx, dword [ebp - 0x23c]
add ecx, 0x14
call fcn.00459160
sub eax, 1
push eax
mov ecx, dword [ebp - 0x23c]
add ecx, 0x14
call fcn.004191b0
movsx eax, byte [eax]
cmp eax, 0x5c
je 0x42dc18
push 0x5f4bd0
mov ecx, dword [ebp - 0x23c]
add ecx, 0x14
call fcn.00407fd0
lea ecx, [ebp - 0x110]
push ecx
mov ecx, dword [ebp - 0x23c]
add ecx, 0x14
call fcn.00407fd0
mov ecx, dword [ebp - 0x23c]
add ecx, 0x14
call fcn.00459160
cmp eax, dword [ebp + 0xc]
jb 0x42dc44
xor eax, eax
jmp 0x42dc77
mov ecx, dword [ebp - 0x23c]
add ecx, 0x14
call fcn.00459160
push eax
mov ecx, dword [ebp - 0x23c]
add ecx, 0x14
call fcn.00406030
push eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0055b733
add esp, 0x10
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret 8
Function at 0x42dc90
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0xc8
call fcn.0042b6d0
mov ecx, dword [ebp - 4]
call fcn.0042de00
test eax, eax
jne 0x42dcc0
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x42dce0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x4c], 0
mov ecx, dword [ebp - 4]
call fcn.0042de40
test eax, eax
jne 0x42dcfb
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 4]
cmp dword [edx + 0x50], 0
je 0x42dd1b
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x50], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x54], 0xffffffff
je 0x42dd3b
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [eax + 0x54], 0xffffffff
mov ecx, dword [ebp - 4]
add ecx, 0x90
call fcn.0042e510
mov esp, ebp
pop ebp
ret
Function at 0x433580
Capabilities:
Check if file exists
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586ea3
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 0
je 0x4335fb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x94], eax
mov ecx, dword [ebp - 0x94]
add ecx, 1
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x94]
mov al, byte [edx]
mov byte [ebp - 0x99], al
add dword [ebp - 0x94], 1
cmp byte [ebp - 0x99], 0
jne 0x4335c9
mov ecx, dword [ebp - 0x94]
sub ecx, dword [ebp - 0x98]
mov dword [ebp - 0xa0], ecx
jne 0x433602
xor eax, eax
jmp 0x433736
cmp dword [ebp + 0x10], 0
je 0x433623
cmp dword [ebp + 0x14], 0
je 0x43361c
mov edx, dword [ebp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x433623
mov dword [ebp + 0x10], 0
mov dword [ebp - 0x10], 0x11
lea eax, [ebp - 0x10]
push eax
push 0x63a854
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0x63a854
push str.Get_local_computer_name_S
push str.LoggingHelper::LogInit
call fcn.0040c050
add esp, 0xc
call fcn.004334d0
call fcn.00431140
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x433734
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00405ef0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0x14]
push edx
lea ecx, [ebp - 0x50]
call fcn.00405ef0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x70]
call fcn.00405ef0
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x8c]
call fcn.00405ef0
mov byte [ebp - 4], 3
lea edx, [ebp - 0x70]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x8c]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.0042c720
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8c]
call fcn.00405f70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00405f70
cmp dword [ebp - 0x54], 0
je 0x433719
mov dword [ebp - 0x90], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.00405f70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00405f70
mov eax, dword [ebp - 0x90]
jmp 0x433736
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.00405f70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00405f70
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret
Function at 0x436200
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x684], ecx
mov dword [ebp - 0x430], 0
xor eax, eax
mov word [ebp - 0x680], ax
push 0x206
push 0
lea ecx, [ebp - 0x67e]
push ecx
call fcn.00562540
add esp, 0xc
xor edx, edx
mov word [ebp - 0x418], dx
push 0x40e
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.00562540
add esp, 0xc
movzx ecx, word [ebp - 0x680]
test ecx, ecx
jne 0x43629f
push 0x208
lea edx, [ebp - 0x680]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x680]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.BreakOffINet64.exe
lea ecx, [ebp - 0x680]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x680]
push edx
push str.__s__DisableNetCardDevice
lea eax, [ebp - 0x418]
push eax
call fcn.00436b00
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x478]
push ecx
call fcn.00562540
add esp, 0xc
mov dword [ebp - 0x478], 0x44
xor edx, edx
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], edx
mov dword [ebp - 0x420], edx
lea eax, [ebp - 0x680]
push eax
push str.wszProgramName__s
push 0x5f05f4
call fcn.0040c050
add esp, 0xc
lea ecx, [ebp - 0x418]
push ecx
push str.wszCommandLine__s
push 0x5f064c
call fcn.0040c050
add esp, 0xc
lea edx, [ebp - 0x42c]
push edx
lea eax, [ebp - 0x478]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x680]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x436383
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x680]
push eax
push str.Err__d_:_executing__s
push 0x5f06ac
call fcn.0040c050
add esp, 0x10
mov eax, dword [ebp - 0x430]
jmp 0x43642f
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x42c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x41c], 0
lea eax, [ebp - 0x41c]
push eax
mov ecx, dword [ebp - 0x42c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x436403
cmp dword [ebp - 0x41c], 0
jne 0x4363e8
push str.Disable_net_card_device_succeed._r_n
push 0x5f0728
call fcn.0040c050
add esp, 8
mov dword [ebp - 0x430], 1
jmp 0x436401
mov edx, dword [ebp - 0x41c]
push edx
push str.Disable_net_card_device_failed___d_._r_n
push 0x5f07a8
call fcn.0040c050
add esp, 0xc
jmp 0x43641c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Err__d_:_GetExitCodeProcess._r_n
push str.CNetCmdBreakOffINetMgr::DisableNetCardDevice64
call fcn.0040c050
add esp, 0xc
mov eax, dword [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x430]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret
Function at 0x43f060
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x615000]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x63aaf0
push 7
call fcn.00433780
add esp, 8
mov ecx, 0x63abe0
call fcn.004408a0
push 0x63abe0
push 4
call fcn.00433780
add esp, 8
push 0x63aab0
push 5
call fcn.00433780
add esp, 8
push 0x63ab68
push 2
call fcn.00433780
add esp, 8
push 0x63ab68
push 3
call fcn.00433780
add esp, 8
push 0x63aba4
push 6
call fcn.00433780
add esp, 8
push 0x63ab2c
push 8
call fcn.00433780
add esp, 8
mov byte [ebp - 0x210], 0
push 0x207
push 0
lea eax, [ebp - 0x20f]
push eax
call fcn.00562540
add esp, 0xc
push 0x207
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push 0x5eec10
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x43f158
push 0
lea edx, [ebp - 0x210]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
call fcn.00466550
lea eax, [ebp - 0x210]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00433580
add esp, 0x10
test eax, eax
jne 0x43f197
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Err:_LoggingInit_failed__err_d__OUT_r_n
push str.InitNetReportComponent
call fcn.0040c050
add esp, 0xc
xor eax, eax
jmp 0x43f19c
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055abea
mov esp, ebp
pop ebp
ret
Function at 0x440260
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x585005
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x615000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.CNetCmdPolicyInspectionMgr.0
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xb0], 1
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0xac], 0
je 0x44032d
push 0xbb8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x440300
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 0x10]
push edx
push str._CNetCmdPolicyInspectionMgr_Wait_trace_thread_fail__ret_d__err_d._n
push 0x5ec6bc
call fcn.0040c050
add esp, 0x10
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x44031d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, dword [ebp - 0x10]
push edx
push str._CNetCmdPolicyInspectionMgr_Wait_trace_thread_thread_exit_OK..._n
push str.CNetCmdPolicyInspectionMgr::CNetCmdPolicyInspectionMgr
call fcn.0040c050
add esp, 0x10
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0xac], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x14]
add ecx, 0xb4
call fcn.0042e5a0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
add ecx, 0x94
call fcn.0043d9d0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0x7c
call fcn.0043d9d0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
add ecx, 0x5c
call fcn.00440240
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x3c
call fcn.00440100
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
call fcn.00435d90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4408a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0xb0], 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x440860
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0xac], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xac], 0
je 0x4408e9
mov eax, 1
jmp 0x4408fd
push str._NetCmdPolicyInspectionMgr__CreateThread_Failed__n
push str.CNetCmdPolicyInspectionMgr::StartHandlerWork
call fcn.0040c050
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x444760
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], vtable.AuthorizeMonitor.0
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], 1
mov edx, dword [ebp - 8]
cmp dword [edx + 4], 0
je 0x4447bc
push 0xbb8
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4447af
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0
mov esp, ebp
pop ebp
ret

Function at 0x444860
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x4448f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x4448a0
mov eax, 1
jmp 0x4448a2
xor eax, eax
mov esp, ebp
pop ebp
ret