joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a4f5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x868
mov eax, 0x58ce8f
call fcn.004321e7
mov esi, ecx
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x828]
mov edx, dword [ebp + 0x18]
test edx, edx
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x870], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x86c], edi
mov dword [ebp - 0x86c], eax
mov eax, 0x5fbe8c
cmovne eax, edx
push eax
call fcn.00404085
xor ecx, ecx
add esi, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 0x868], ecx
mov dword [ebp - 0x864], ecx
mov dword [ebp - 0x860], ecx
cmp dword [esi + 0x10], ecx
ja 0x41a584
lea eax, [ebp - 0x858]
push eax
call fcn.00419d5b
pop ecx
push eax
mov ecx, esi
call fcn.00406168
lea ecx, [ebp - 0x858]
call fcn.00406253
xor ecx, ecx
cmp dword [esi + 0x14], 8
jb 0x41a58c
mov esi, dword [esi]
lea eax, [ebp - 0x85c]
push eax
push 0x20119
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push reloc.WS2_32.dll_closesocket
call esi
test eax, eax
je 0x41a5cc
cmp dword [ebp - 0x814], 8
lea ecx, [ebp - 0x828]
cmovae ecx, dword [ebp - 0x828]
push ecx
mov ecx, edi
call fcn.00404085
jmp 0x41a753
lea eax, [ebp - 0x868]
push eax
push 0x20119
push 0
push 0x591d5c
push dword [ebp - 0x85c]
call esi
test eax, eax
je 0x41a60e
push dword [ebp - 0x85c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
jmp 0x41a5c0
lea eax, [ebp - 0x864]
push eax
push 0x20119
push 0
push ebx
push dword [ebp - 0x868]
call esi
test eax, eax
je 0x41a641
push dword [ebp - 0x868]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x85c]
call esi
jmp 0x41a5f7
lea eax, [ebp - 0x860]
xor ebx, ebx
push eax
push 0x20119
push ebx
push dword [ebp - 0x870]
push dword [ebp - 0x864]
call esi
test eax, eax
je 0x41a678
push dword [ebp - 0x860]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x864]
jmp 0x41a635
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.0044b1c0
add esp, 0xc
mov dword [ebp - 0x874], 0x400
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push dword [ebp - 0x86c]
push dword [ebp - 0x860]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x860]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x864]
call esi
push dword [ebp - 0x868]
call esi
push dword [ebp - 0x85c]
call esi
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41a6e8
sub ecx, edx
sar ecx, 1
je 0x41a5f7
xor eax, eax
mov dword [ebp - 0x830], ebx
mov word [ebp - 0x840], ax
lea ecx, [ebp - 0x840]
lea eax, [ebp - 0x810]
mov dword [ebp - 0x82c], 7
push eax
call fcn.0040405e
cmp dword [ebp - 0x82c], 8
lea eax, [ebp - 0x840]
mov ecx, edi
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0x840]
push eax
call fcn.00404085
lea ecx, [ebp - 0x840]
call fcn.00406253
lea ecx, [ebp - 0x828]
call fcn.00406253
mov eax, edi
call fcn.00432191
ret 0x14
Function at 0x41a768
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x60a1bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
cmp dword [esi + 0x14], ebx
ja 0x41a7c0
lea eax, [ebp - 0x1c]
push eax
call fcn.00419d5b
pop ecx
lea ecx, [esi + 4]
push eax
call fcn.00406168
lea ecx, [ebp - 0x1c]
call fcn.00406253
lea eax, [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x41a7cb
mov eax, dword [eax]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x20]
push ecx
push 0xf013f
push ebx
push eax
push reloc.WS2_32.dll_closesocket
call esi
test eax, eax
je 0x41a7ee
xor al, al
jmp 0x41a8a7
lea eax, [ebp - 0x24]
push eax
push 0xf013f
push ebx
push 0x591d5c
push dword [ebp - 0x20]
call esi
test eax, eax
je 0x41a811
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41a7e7
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x2c]
push ebx
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x41a843
push dword [ebp - 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x20]
call esi
jmp 0x41a7e7
push ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp - 0x34]
push dword [ebp - 0x2c]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41a896
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41a868
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push ebx
push dword [ebp - 0x38]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x28]
call esi
mov bl, 1
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x20]
call esi
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004318a9
leave
ret 0x10
Function at 0x41b42e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x60a1bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x20c]
push 0
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x220], edi
mov edi, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x21c], esi
call fcn.0044b1c0
add esp, 0xc
mov ebx, 0x20019
lea eax, [ebp - 0x210]
push eax
push ebx
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x41b4f9
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x218]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x41b4ed
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push dword [ebp - 0x218]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
jne 0x41b51e
cmp edi, reloc.WS2_32.dll_bind
jne 0x41b51e
cmp ebx, 0x20019
jne 0x41b51e
mov esi, dword [ebp - 0x21c]
mov ebx, 0x20119
jmp 0x41b483
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x20c]
push eax
call fcn.00404085
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x220]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004318a9
leave
ret
Function at 0x41c883
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
cmp byte [edx + 4], 0
je 0x41c8b3
push esi
xor esi, esi
cmp dword [edx + 0x3cc], esi
jle 0x41c8b2
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, ecx
mov al, byte [edi + ecx]
xor byte [ecx], al
inc ecx
inc esi
cmp esi, dword [edx + 0x3cc]
jl 0x41c8a2
pop edi
pop esi
pop ebp
ret 8

Function at 0x41caa1
Capabilities:
Encode data using base64

Disassembly:
push 0x10
mov eax, 0x58d06c
call fcn.004321b3
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 8]
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], 0xf
mov byte [edi], bl
mov eax, dword [ebp + 0x10]
mov edi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], 1
test eax, eax
je 0x41cc28
push 3
pop esi
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0x10], eax
mov al, byte [ecx]
mov byte [ebp + edi - 0x14], al
inc edi
mov dl, byte [ebp - 0x13]
inc ecx
mov dword [ebp + 0xc], ecx
mov ch, byte [ebp - 0x12]
mov cl, byte [ebp - 0x14]
mov byte [ebp - 0xf], ch
mov byte [ebp - 0xd], dl
mov byte [ebp - 0xe], cl
cmp edi, esi
jne 0x41cb71
mov esi, dword [ebp + 8]
mov al, cl
shr al, 2
and cl, 3
mov byte [ebp - 0x18], al
mov edi, ebx
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov al, ch
mov byte [ebp - 0x17], cl
mov cl, dl
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, ch
and al, 0x3f
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], al
cmp dword [0x60a120], 0x10
mov ecx, 0x60a10c
movzx eax, byte [ebp + edi - 0x18]
cmovae ecx, dword [0x60a10c]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.0040a12b
inc edi
cmp edi, 4
jl 0x41cb39
mov dl, byte [ebp - 0xd]
mov edi, ebx
mov cl, byte [ebp - 0xe]
mov ch, byte [ebp - 0xf]
push 3
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x41cadb
mov dword [ebp + 0x10], edi
test edi, edi
je 0x41cc28
mov eax, edi
cmp edi, esi
jge 0x41cba7
cmp eax, esi
jae 0x41cc31
mov byte [ebp + eax - 0x14], bl
inc eax
cmp eax, esi
jl 0x41cb8f
mov ch, byte [ebp - 0x12]
mov dl, byte [ebp - 0x13]
mov cl, byte [ebp - 0x14]
mov al, cl
and cl, 3
shr al, 2
mov byte [ebp - 0x18], al
mov al, dl
shr al, 4
and dl, 0xf
shl cl, 4
add cl, al
shl dl, 2
mov al, ch
mov byte [ebp - 0x17], cl
shr al, 6
and ch, 0x3f
add dl, al
mov byte [ebp - 0x15], ch
lea eax, [edi + 1]
mov byte [ebp - 0x16], dl
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x41cc13
mov esi, dword [ebp + 8]
mov edi, eax
cmp dword [0x60a120], 0x10
mov ecx, 0x60a10c
movzx eax, byte [ebp + ebx - 0x18]
cmovae ecx, dword [0x60a10c]
movzx eax, byte [eax + ecx]
mov ecx, esi
push eax
call fcn.0040a12b
inc ebx
cmp ebx, edi
jl 0x41cbe4
mov edi, dword [ebp + 0x10]
push 3
pop esi
cmp edi, esi
jge 0x41cc28
sub esi, edi
mov ecx, dword [ebp + 8]
push 0x3d
call fcn.0040a12b
sub esi, 1
jne 0x41cc19
mov eax, dword [ebp + 8]
call fcn.0043217c
ret
call fcn.00432497
int3
Function at 0x41eaee
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x20
mov eax, 0x58d1a0
call fcn.004321b3
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 8], 0
jne 0x41eb0d
mov eax, 0x80004003
jmp 0x41ebe0
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 5
push connect
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41eb3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41ebe0
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, 0xffffffff
je 0x41eb2f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
cmp eax, ebx
ja 0x41ebdd
cmp edi, 0xffffffff
jae 0x41ebdd
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.0041f6de
mov ebx, dword [ebp - 0x28]
cmp edi, ebx
mov edi, dword [ebp - 0x2c]
jne 0x41ebc9
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x41ebc9
push eax
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41ebaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41ebc5
cmp dword [ebp + 8], ebx
je 0x41ebb4
push 0x26
pop esi
jmp 0x41ebce
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
push ebx
push edi
call fcn.0041e8d5
mov esi, eax
jmp 0x41ebce
mov esi, 0x8007000e
test edi, edi
je 0x41ebd9
push edi
call fcn.0044d3e8
pop ecx
mov eax, esi
jmp 0x41ebe0
xor eax, eax
inc eax
call fcn.0043217c
ret 4

Function at 0x41fb6c
Capabilities:
Check mutex on windows

Disassembly:
push 0x1c
mov eax, 0x58d234
call fcn.004321b3
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.004209e5
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004209fe
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0xc
call fcn.004209fa
push dword [ebp + 8]
and dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
lea ecx, [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 4], eax
call fcn.004209f5
call fcn.0043217c
ret 4
Function at 0x42dc40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58dff0
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x60a1bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x67
push 0x6f
push 0x6c
push 0x74
push 0x6e
push 0x65
push 0x74
push 0x6e
push 0x6f
push 0x43
push 0x70
push 0x74
push 0x74
push 0x48
push 0x77
push 0x6f
push 0x68
push 0x53
push 0x590b48
lea eax, [ebp - 0x28]
push eax
call fcn.0040953f
add esp, 0x50
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00405c9a
mov byte [ebp - 4], 1
push 0x590b40
lea ecx, [ebp - 0x40]
call fcn.00406a05
push 0x590b44
lea ecx, [ebp - 0x40]
call fcn.00406a05
push 0x59083c
lea ecx, [ebp - 0x40]
call fcn.00406a05
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00409f55
lea ecx, [ebp - 0x40]
call fcn.004042b1
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42dd02
mov byte [ebp - 0x82], 1
jmp 0x42dd09
mov byte [ebp - 0x82], 0
mov al, byte [ebp - 0x82]
mov byte [ebp - 0x81], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00406281
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406281
mov al, byte [ebp - 0x81]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004318a9
mov esp, ebp
pop ebp
ret
Function at 0x42e370
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
je 0x42e388
cmp dword [ebp + 0xc], 0
jne 0x42e392
mov eax, 1
jmp 0x42e48d
push 0
push 0x80
push 3
push 0
push 5
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x42e3c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42e48d
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x42e3eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42e48d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jb 0x42e401
mov eax, 8
jmp 0x42e48d
cmp dword [ebp + 0x10], 0
je 0x42e40f
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
call fcn.0043228f
add esp, 4
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x60]
mov dword [ecx], edx
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
push 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call fcn.0044b1c0
add esp, 0xc
mov dword [ebp - 0x18], 0
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x42e472
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42e48d
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
je 0x42e481
mov eax, 1
jmp 0x42e48d
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42ea60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], 0
je 0x42ea7c
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x42ea83
mov eax, 1
jmp 0x42eae5
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x42eab0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42eae5
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x42ead9
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42eae5
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x433a2c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x46945d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00469120

Function at 0x469468
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004692a1

Function at 0x46d264
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0046cf24
Function at 0x47b570
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x47b5b9
mov al, byte [esi]
push eax
call fcn.0048a940
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0x47b597
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret
Function at 0x485ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x6f2], 0
je 0x485b63
cmp dword [edi + 0x1b0], 0
je 0x485b2d
push esi
push 1
push edi
call fcn.00477840
push dword [edi + 0x14c]
mov eax, dword [edi + 0x1b0]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call eax
push 0
push edi
mov esi, eax
call fcn.00477840
add esp, 0x24
mov eax, esi
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x485b63
push dword [edi + 0x148]
lea eax, [eax + eax*2]
push 1
add eax, 0x5a5ba0
push 2
push eax
call fcn.0045bf92
push dword [edi + 0x148]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0045bf92
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret

Function at 0x485ee0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x60a1bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov eax, dword [edx + 0xc]
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x10]
mov ebx, dword [eax + ecx*4 + 0x148]
push ecx
push eax
push edx
mov dword [ebp - 0x108], edx
call fcn.00486360
add esp, 0xc
test eax, eax
je 0x485f3b
pop edi
mov dword [esi], 0x1b
or eax, 0xffffffff
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004318a9
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp + 0x14]
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
mov dword [esi], 0
cmp edi, 0xffffffff
jne 0x485fb8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2733
jne 0x485f80
xor edi, edi
mov dword [esi], 0x51
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004318a9
mov esp, ebp
pop ebp
ret
push 0x100
lea eax, [ebp - 0x104]
push eax
push ebx
call fcn.004737a0
push eax
push str.Send_failure:__s
push dword [ebp - 0x108]
call fcn.00485b70
mov eax, dword [ebp - 0x108]
add esp, 0x18
mov dword [eax + 0x93c], ebx
mov dword [esi], 0x37
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004318a9
mov esp, ebp
pop ebp
ret
Function at 0x486360
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
lea esi, [edx + 0x17]
mov eax, dword [ecx + 0x288]
shl esi, 4
add esi, ecx
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x486431
cmp dword [ecx + edx*4 + 0x160], 0x485de0
jne 0x486431
cmp dword [esi], 0
je 0x4863a8
test edi, edi
je 0x486431
mov ebx, dword [ecx + edx*4 + 0x148]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.00494640
add esp, 0x14
cmp eax, 0xffffffff
je 0x486431
test al, 1
je 0x486431
mov ecx, dword [esi]
test ecx, ecx
jne 0x48640c
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4c8]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x60abe4]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
jne 0x4863f7
pop edi
pop esi
lea eax, [ecx + 0x1b]
pop ebx
pop ebp
ret
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test ecx, ecx
je 0x48642a
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x486431
add dword [esi + 8], eax
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov dword [esi + 4], 0
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x4865c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp byte [eax + 0x19c], 0
je 0x4865e0
push eax
call fcn.0047fac0
add esp, 4
test eax, eax
jne 0x4865fe
xor al, al
pop ebp
ret
mov eax, dword [eax + 0x148]
cmp eax, 0xffffffff
je 0x4865dc
push 2
push 1
lea ecx, [ebp + 0xb]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x4865dc
mov al, 1
pop ebp
ret

Function at 0x4867f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x60a1bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x184]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
push 0x80
push 0
push eax
mov dword [ebp - 0x188], 0x80
call fcn.0044b1c0
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x184]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x48686d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push esi
call fcn.004737a0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
jmp 0x4868b0
push edi
push esi
push dword [ebp - 0x188]
lea eax, [ebp - 0x184]
push eax
call fcn.00486440
add esp, 0x10
test al, al
jne 0x4868b9
call fcn.00451308
mov esi, dword [eax]
call fcn.00451308
mov edi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push esi
call fcn.004737a0
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.00485b70
add esp, 0x1c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004318a9
mov esp, ebp
pop ebp
ret
Function at 0x487040
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x615e2c]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x487091
push 3
push 2
push eax
push 6
call fcn.004b1620
add esp, 0x10
test al, al
je 0x487085
mov dword [0x615e2c], 2
mov esp, ebp
pop ebp
ret
mov dword [0x615e2c], 1
jmp 0x487096
cmp eax, 2
je 0x4870d6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4870bd
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x4870d6
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret