joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41daf0
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
push 0
push 0x4cb498
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0
call fcn.0043c200
lea ecx, [esp + 0xc]
push ecx
push str.DisplayIcon
mov ecx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallFlux
mov eax, reloc.WSOCK32.dll_bind
lea edi, [esp + 0x18]
call fcn.0041e540
mov esi, dword [esp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test esi, esi
je 0x41db61
push esi
call ebx
and eax, 0xff
cmp eax, 0x80
jl 0x41db58
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x41db61
test eax, eax
jne 0x41db61
call fcn.0045f130
lea edx, [esp + 0xc]
lea ecx, [esp + 0x10]
call fcn.004024a0
mov esi, dword [esp + 0xc]
mov dword [esp + 0xc], esi
test esi, esi
je 0x41dbaf
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
call edi
and eax, 0xff
cmp eax, 0x80
jl 0x41db92
push esi
call ebx
push esi
call ebx
and eax, 0xff
cmp eax, 0x80
jl 0x41dba6
push esi
call edi
jmp 0x41dbaf
test eax, eax
jne 0x41dbaf
call fcn.0045f130
push 0x22
lea eax, [esp + 0x10]
call fcn.0043c500
mov esi, dword [esp + 0xc]
test esi, esi
je 0x41dc3f
lea edi, [esi + 4]
test edi, edi
je 0x41dc0e
cmp byte [edi], 0
je 0x41dc0e
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41dc0e
mov edx, dword [ebp + 8]
push 5
push 0
push edx
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0xc]
call fcn.00401420
lea edi, [esp + 0x10]
call fcn.004026d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call ebx
and eax, 0xff
cmp eax, 0x80
jl 0x41dc36
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edi, [esp + 0x10]
call fcn.004026d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x41dc3f
call fcn.0045f130
lea edi, [esp + 0x10]
call fcn.004026d0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4274f0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x1c
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x427512
or eax, 0xffffffff
add esp, 0x1c
ret
lea ecx, [esp + 0xc]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 4]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x80020003
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
dec eax
add esp, 0x1c
ret

Function at 0x427570
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push ebp
push esi
push edi
call fcn.004489f0
test al, al
je 0x4275a6
call fcn.00448940
test al, al
jne 0x4275a6
push 1
push str._adminlockwingamma
call fcn.004481b0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x28]
xor eax, eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
push 0xf003f
xor eax, eax
xor esi, esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionICM_
mov dword [esp + 0x20], eax
push reloc.WSOCK32.dll_bind
lea eax, [esp + 0x2c]
push eax
mov edx, str.GdiICMGammaRange
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], esi
call fcn.00455250
push 0xf013f
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionICM_
push reloc.WSOCK32.dll_bind
lea ecx, [esp + 0x1c]
push ecx
mov edx, str.GdiICMGammaRange
mov edi, eax
call fcn.00455250
mov ebp, eax
mov eax, dword [esp + 0x2c]
cmp eax, esi
je 0x427621
add eax, 4
jmp 0x427623
xor eax, eax
mov edx, dword [esp + 0x20]
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push eax
push 0x4cb498
push edx
call ebx
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x427643
add eax, 4
jmp 0x427645
xor eax, eax
push eax
mov eax, dword [esp + 0x14]
push 0x4cb498
push eax
call ebx
cmp edi, esi
jne 0x427676
cmp ebp, esi
jne 0x427676
lea edi, [esp + 0x10]
call fcn.004551d0
lea edi, [esp + 0x20]
call fcn.004551d0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [esp + 0x10]
call fcn.004551d0
lea edi, [esp + 0x20]
call fcn.004551d0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4277a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [esp + 0x14]
push ebx
push esi
push edi
xor eax, eax
push 0xf003f
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
push eax
xor ebx, ebx
push closesocket
lea ecx, [esp + 0x24]
push ecx
mov edx, str.Data
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], ebx
call fcn.00455250
test eax, eax
je 0x4277f8
lea edi, [esp + 0x18]
call fcn.004551d0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 0x800
call fcn.0045eff0
mov esi, eax
mov eax, dword [esp + 0x24]
mov edi, esi
neg edi
sbb edi, edi
and edi, 0x800
cmp eax, ebx
je 0x42781d
add eax, 4
jmp 0x42781f
xor eax, eax
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x1c]
push esi
lea ecx, [esp + 0x1c]
push ecx
push ebx
push eax
push edx
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
test ebx, ebx
jne 0x4278b4
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 0xc]
cmp edx, ecx
je 0x427872
test edi, edi
je 0x42785d
test esi, esi
je 0x42785d
call fcn.0045f130
lea edi, [esp + 0x18]
call fcn.004551d0
mov eax, 0xf4242
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub ecx, dword [ebp + 0x10]
cmp ecx, 0x14
jbe 0x42788e
lea eax, [esi + 0x14]
add ecx, 0xffffffec
mov ebx, dword [ebp + 0x10]
mov bl, byte [eax + ebx]
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x427880
mov eax, dword [esp + 0x24]
sub edx, dword [ebp + 0x10]
test eax, eax
je 0x42789e
add eax, 4
jmp 0x4278a0
xor eax, eax
push edx
push esi
push 3
push 0
push eax
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
test edi, edi
je 0x4278c1
test esi, esi
je 0x4278c1
call fcn.0045f130
lea edi, [esp + 0x18]
call fcn.004551d0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4278e0
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
sub esp, 0x50
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [esp + 8]
push ebx
push esi
push edi
push 0xf003f
xor eax, eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionCloudStoreStoreDefaultAccountCurrentdefault_windows.data.bluelightreduction.settingswindows.data.bluelightreduction.settings_
mov dword [esp + 0x1c], eax
xor ebx, ebx
push closesocket
lea eax, [esp + 0x18]
push eax
mov edx, str.Data
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
call fcn.00455250
test eax, eax
je 0x427949
lea edi, [esp + 0xc]
call fcn.004551d0
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0049ca20
add esp, 0x50
ret
mov cl, 0x42
mov al, 0x2a
mov dl, 6
mov byte [esp + 0x1d], cl
mov byte [esp + 0x24], al
mov byte [esp + 0x2b], al
mov al, 0xe
mov byte [esp + 0x30], cl
mov cl, 0xca
push ebx
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x22], 1
mov byte [esp + 0x23], bl
mov byte [esp + 0x24], 0xa
mov byte [esp + 0x25], 2
mov byte [esp + 0x26], 1
mov byte [esp + 0x27], bl
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0xe7
mov byte [esp + 0x2b], 0xb2
mov byte [esp + 0x2c], 0xb5
mov byte [esp + 0x2d], 0x9f
mov byte [esp + 0x2e], dl
mov byte [esp + 0x30], 0x2b
mov byte [esp + 0x31], al
mov byte [esp + 0x32], 0x21
mov byte [esp + 0x33], 0x43
mov byte [esp + 0x35], 1
mov byte [esp + 0x36], bl
mov byte [esp + 0x37], cl
mov byte [esp + 0x38], 0x14
mov byte [esp + 0x39], al
mov byte [esp + 0x3a], 0x15
mov byte [esp + 0x3b], bl
mov byte [esp + 0x3c], cl
mov byte [esp + 0x3d], 0x1e
mov byte [esp + 0x3e], al
mov byte [esp + 0x3f], 7
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], 0xcf
mov byte [esp + 0x42], 0x28
mov byte [esp + 0x43], 0xc4
mov byte [esp + 0x44], 0x35
mov byte [esp + 0x45], cl
mov byte [esp + 0x46], 0x32
mov byte [esp + 0x47], al
mov byte [esp + 0x48], 0x13
mov byte [esp + 0x49], 0x2e
mov byte [esp + 0x4a], 0x11
mov byte [esp + 0x4b], bl
mov byte [esp + 0x4c], cl
mov byte [esp + 0x4d], 0x3c
mov byte [esp + 0x4e], al
mov byte [esp + 0x4f], dl
mov byte [esp + 0x50], 0x2e
mov byte [esp + 0x51], 0x26
mov byte [esp + 0x52], bl
mov byte [esp + 0x53], bl
mov byte [esp + 0x54], bl
mov byte [esp + 0x55], bl
mov byte [esp + 0x56], bl
call fcn.0049d454
mov edx, eax
shr edx, 7
mov cl, al
or cl, 0x80
or dl, 0x80
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2b], dl
mov ecx, eax
mov edx, eax
shr ecx, 0xe
shr edx, 0x15
or cl, 0x80
or dl, 0x80
shr eax, 0x1c
add esp, 4
and al, 0x7f
mov byte [esp + 0x28], cl
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], al
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x427a97
add eax, 4
jmp 0x427a99
xor eax, eax
mov edx, dword [esp + 0xc]
push 0x37
lea ecx, [esp + 0x20]
push ecx
push 3
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edi, [esp + 0xc]
mov esi, eax
call fcn.004551d0
mov ecx, dword [esp + 0x54]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0049ca20
add esp, 0x50
ret
Function at 0x427cb0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x30
push ebx
push esi
push edi
call fcn.00427b50
test al, al
jle 0x427df6
mov eax, dword [esp + 0x20]
xor eax, eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
push 0xf013f
xor eax, eax
xor edi, edi
push str.SYSTEMControlSet001ControlClass4d36e968_e325_11ce_bfc1_08002be103180000
mov dword [esp + 0x38], eax
push reloc.WSOCK32.dll_bind
lea eax, [esp + 0x24]
push eax
mov edx, str.FeatureTestControl
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x44], edi
call fcn.00455250
push 0xf013f
push str.SYSTEMControlSet001ControlClass4d36e968_e325_11ce_bfc1_08002be103180001
push reloc.WSOCK32.dll_bind
lea ecx, [esp + 0x34]
push ecx
mov edx, str.FeatureTestControl
mov esi, eax
call fcn.00455250
mov ebx, eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], 4
cmp esi, edi
jne 0x427da1
lea edx, [esp + 0x10]
push edx
lea esi, [esp + 0x18]
lea ecx, [esp + 0x1c]
call fcn.004553d0
test eax, eax
jne 0x427da1
mov eax, dword [esp + 0x24]
or dword [esp + 0x10], 0x10
cmp eax, edi
je 0x427d69
add eax, 4
jmp 0x427d6b
xor eax, eax
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 4
push edi
push eax
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edi, [esp + 0x28]
mov esi, eax
call fcn.004551d0
lea edi, [esp + 0x18]
call fcn.004551d0
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x30
ret
cmp ebx, edi
jne 0x427de4
lea ecx, [esp + 0x10]
push ecx
lea esi, [esp + 0x18]
lea ecx, [esp + 0x2c]
call fcn.004553d0
test eax, eax
jne 0x427de4
mov eax, dword [esp + 0x24]
or dword [esp + 0x10], 0x10
cmp eax, edi
je 0x427dcd
add eax, 4
jmp 0x427dcf
xor eax, eax
mov edx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push 4
push edi
push eax
push edx
jmp 0x427d7e
lea edi, [esp + 0x28]
call fcn.004551d0
lea edi, [esp + 0x18]
call fcn.004551d0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x30
ret
Function at 0x42e3e0
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x1a4
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x19c], eax
cmp dword [esi], 0
jne 0x42e465
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x42e465
cmp dword [esi], eax
jne 0x42e426
push 0x11
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [esi], eax
test eax, eax
jge 0x42e43e
mov dword [esi], 0
or eax, 0xffffffff
mov ecx, dword [esp + 0x19c]
xor ecx, esp
call fcn.0049ca20
add esp, 0x1a4
ret
push 4
lea ecx, [esp + 8]
push ecx
push 0x20
push 0xffff
push eax
mov dword [esp + 0x18], 1
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
je 0x42e426
mov dword [esi], 0
mov ecx, dword [esp + 0x19c]
xor ecx, esp
xor eax, eax
call fcn.0049ca20
add esp, 0x1a4
ret

Function at 0x42e710
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [sym.imp.WSOCK32.dll_inet_addr]
pxor xmm0, xmm0
push str.239.255.255.250
movq qword [esp + 8], xmm0
mov dword [esp + 0x10], 0
call esi
push str.0.0.0.0
mov dword [esp + 8], eax
call esi
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x28]
push 0xc
mov dword [esp + 0x10], eax
lea eax, [esp + 8]
push eax
push 0xf
push 0
push edx
call dword [sym.imp.WSOCK32.dll_setsockopt]
pop esi
add esp, 0xc
ret 4

Function at 0x42e770
Capabilities:
Send data
Send data on socket
Send http request
Send http request with host header
Set socket configuration

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x14], eax
cmp dword [esi + 0x28], 0
jne 0x42e796
or eax, 0xffffffff
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0049ca20
add esp, 0x1c
ret
pxor xmm0, xmm0
push str.239.255.255.250
movq qword [esp + 8], xmm0
movq qword [esp + 0x10], xmm0
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [esp + 8], eax
mov eax, 2
push 0x7be
mov word [esp + 8], ax
call dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 6], ax
mov eax, str.M_SEARCH__HTTP_1.1_r_nHOST:_239.255.255.250:1982_r_nMAN:__ssdp:discover__r_nST:_wifi_bulb_r_n
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42e7d7
push 0x10
lea ecx, [esp + 8]
push ecx
push 0
sub eax, edx
mov edx, dword [esi + 0x28]
push eax
push str.M_SEARCH__HTTP_1.1_r_nHOST:_239.255.255.250:1982_r_nMAN:__ssdp:discover__r_nST:_wifi_bulb_r_n
push edx
call dword [sym.imp.WSOCK32.dll_sendto]
mov ecx, dword [esp + 0x14]
xor ecx, esp
xor eax, eax
call fcn.0049ca20
add esp, 0x1c
ret
Function at 0x42e970
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x1c
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x14], eax
cmp dword [esi + 0x20], 0
jne 0x42e996
or eax, 0xffffffff
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0049ca20
add esp, 0x1c
ret
mov eax, dword [esi + 0x34]
test eax, eax
je 0x42e984
add eax, 4
je 0x42e984
cmp byte [eax], 0
je 0x42e984
pxor xmm0, xmm0
mov eax, 2
movq qword [esp + 4], xmm0
mov word [esp + 4], ax
mov eax, dword [esi + 0x34]
movq qword [esp + 0xc], xmm0
test eax, eax
je 0x42e9cd
add eax, 4
jmp 0x42e9cf
xor eax, eax
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
movzx ecx, word [esi + 0x20]
push ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.WSOCK32.dll_htons]
push 0
push 1
push 2
mov word [esp + 0x12], ax
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [esi + 0x1c], eax
test eax, eax
jl 0x42e984
push 0x10
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
xor ecx, ecx
test eax, eax
setge cl
dec ecx
mov eax, ecx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0049ca20
add esp, 0x1c
ret
Function at 0x42f5c0
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x1b4
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x1ac], eax
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x42f691
lea eax, [esp + 0x18]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x42f607
xor eax, eax
mov ecx, dword [esp + 0x1ac]
xor ecx, esp
call fcn.0049ca20
add esp, 0x1b4
ret
push 0x11
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [esi + 0x28], eax
test eax, eax
jge 0x42f639
mov dword [esi + 0x28], 0
or eax, 0xffffffff
mov ecx, dword [esp + 0x1ac]
xor ecx, esp
call fcn.0049ca20
add esp, 0x1b4
ret
push 4
lea ecx, [esp + 8]
push ecx
push 4
push 0xffff
push eax
mov dword [esp + 0x18], 1
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x42f621
mov ecx, dword [esi + 0x28]
push 0x10
lea eax, [esp + 0xc]
pxor xmm0, xmm0
push eax
mov edx, 2
movq qword [esp + 0x10], xmm0
push ecx
movq qword [esp + 0x1c], xmm0
mov word [esp + 0x14], dx
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, 0xffffffff
je 0x42f621
push esi
call fcn.0042e710
mov ecx, dword [esp + 0x1ac]
xor ecx, esp
call fcn.0049ca20
add esp, 0x1b4
ret

Function at 0x42f6b0
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x1a4
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x19c], eax
mov eax, dword [0x566a4c]
test eax, eax
jne 0x42f742
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
jne 0x42f705
cmp dword [0x566a4c], eax
jne 0x42f73d
push 0x11
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [0x566a4c], eax
test eax, eax
jge 0x42f71c
mov dword [0x566a4c], 0
xor eax, eax
mov ecx, dword [esp + 0x19c]
xor ecx, esp
call fcn.0049ca20
add esp, 0x1a4
ret
push 4
lea ecx, [esp + 8]
push ecx
push 0x20
push 0xffff
push eax
mov dword [esp + 0x18], 1
call dword [sym.imp.WSOCK32.dll_setsockopt]
test eax, eax
jne 0x42f6fb
mov eax, dword [0x566a4c]
mov ecx, dword [esp + 0x19c]
xor ecx, esp
call fcn.0049ca20
add esp, 0x1a4
ret
Function at 0x42f760
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x34], eax
cmp dword [0x566a4c], 0
push esi
push edi
je 0x42f979
pxor xmm0, xmm0
movdqa xmmword [esp + 0x20], xmm0
mov eax, 2
push 0x1796
mov word [esp + 0x24], ax
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.WSOCK32.dll_htons]
cmp dword [0x566a4c], 0
mov word [esp + 0x22], ax
je 0x42f979
xorps xmm1, xmm1
movsd xmm2, qword [0x4bab50]
mov ecx, 0x19c8
sub ecx, dword [ebp + 8]
cvtsi2sd xmm0, ecx
divsd xmm0, qword [0x4d3ac8]
comisd xmm1, xmm0
movsd qword [esp + 8], xmm0
jbe 0x42f7ef
movsd qword [esp + 8], xmm1
jmp 0x42f7fb
comisd xmm0, xmm2
jbe 0x42f7fb
movsd qword [esp + 8], xmm2
mov edi, 0x18
call fcn.0045eff0
mov esi, eax
test esi, esi
jne 0x42f80f
xor edi, edi
jmp 0x42f821
pxor xmm0, xmm0
movq qword [esi], xmm0
movq qword [esi + 8], xmm0
movq qword [esi + 0x10], xmm0
movsd xmm1, qword [0x4c88e8]
movsd xmm0, qword [esp + 8]
comisd xmm1, xmm0
mov dword [esi], 0x4adc0104
mov edx, 2
mov word [esi + 4], dx
mov eax, 0x101
mov word [esi + 6], ax
mov dword [esi + 0x10], 0xffffffff
jbe 0x42f866
mulsd xmm0, qword [0x4d3ac0]
mulsd xmm0, qword [0x4c3fb8]
jmp 0x42f87a
subsd xmm0, xmm1
mulsd xmm0, qword [0x4d3ab8]
addsd xmm0, qword [0x4d3ac0]
fld qword [ebp + 0xc]
movsd qword [esp + 8], xmm0
fld qword [0x4d3ab0]
call fcn.004b1f50
fst qword [esp + 0x10]
fld qword [0x4bab50]
movsd xmm0, qword [esp + 0x10]
fsub qword [esp + 8]
mulsd xmm0, qword [esp + 8]
divsd xmm0, qword [0x4d3aa8]
movsd xmm1, qword [0x4bab50]
comisd xmm0, xmm1
fmulp st(1)
movsd qword [esp + 8], xmm0
fstp qword [esp + 0x18]
jbe 0x42f8d0
movsd qword [esp + 8], xmm1
movsd xmm0, qword [esp + 0x18]
comisd xmm0, xmm1
jbe 0x42f8e2
movsd qword [esp + 0x18], xmm1
fld qword [esp + 8]
fld qword [0x4d3aa0]
call fcn.004b1f50
fmul qword [0x4d3580]
fstp dword [esp + 8]
fld dword [esp + 8]
fistp dword [esp + 0x10]
mov cl, byte [esp + 0x10]
fld qword [esp + 0x18]
fld qword [0x4d3aa0]
mov byte [esi + 0x15], cl
call fcn.004b1f50
fmul qword [0x4d3580]
fstp dword [esp + 8]
fld dword [esp + 8]
fistp dword [esp + 0x10]
mov ecx, dword [0x566a4c]
mov dl, byte [esp + 0x10]
push 0x10
lea eax, [esp + 0x24]
push eax
push 0
push edi
push esi
push ecx
mov byte [esi + 0x16], dl
mov byte [esi + 0x17], 0
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
jne 0x42f970
test edi, edi
je 0x42f95c
call fcn.0045f130
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.0049ca20
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x42f979
call fcn.0045f130
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0049ca20
mov esp, ebp
pop ebp
ret
Function at 0x430c90
Capabilities:
Get disk size

Disassembly:
sub esp, 0x30
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x28], eax
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push eax
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
push str._d_d_d_d
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0
call fcn.00401470
mov ebp, dword [esp + 0x20]
add esp, 0x14
pxor xmm0, xmm0
movq qword [esp + 0x20], xmm0
movq qword [esp + 0x28], xmm0
mov byte [esp + 0x30], 0
test ebp, ebp
je 0x430d8b
mov eax, dword [ebp]
shr eax, 8
lea ecx, [ebp + 4]
dec eax
test ecx, ecx
jne 0x430d1c
mov ecx, 0x4cb498
push eax
push ecx
lea esi, [esp + 0x28]
call fcn.00478580
add esp, 8
mov eax, esi
call fcn.00430c30
mov eax, dword [edi]
test eax, eax
je 0x430d59
lea ecx, [eax + 4]
test ecx, ecx
je 0x430d59
cmp byte [ecx], 0
je 0x430d59
movzx ecx, byte [eax]
cmp ecx, 1
jbe 0x430d51
push edi
call fcn.0043bf30
mov edi, dword [edi]
add edi, 4
mov byte [edi], 0x61
test ebp, ebp
je 0x430d9a
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x430d8f
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
xor eax, eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0049ca20
add esp, 0x30
ret
xor eax, eax
jmp 0x430d17
test eax, eax
jne 0x430d9a
mov esi, ebp
call fcn.0045f130
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0049ca20
add esp, 0x30
ret

Function at 0x430db0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub esp, 0x18
mov eax, dword [0x4e2204]
xor eax, esp
mov dword [esp + 0x10], eax
cmp dword [0x566aa0], 0
push edi
mov edi, ecx
jne 0x430de4
push 0xf0000000
push 1
push 0
push 0
push 0x566aa0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x430e1d
mov ecx, dword [0x566aa0]
lea eax, [esp + 4]
push eax
push 0x10
pxor xmm0, xmm0
push ecx
movq qword [esp + 0x10], xmm0
movq qword [esp + 0x18], xmm0
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x430e1d
xor eax, eax
mov edi, edi
cmp byte [esp + eax + 4], 0
jne 0x430e34
inc eax
cmp eax, 0x10
jb 0x430e10
mov ecx, edi
call fcn.00430c90
pop edi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0049ca20
add esp, 0x18
ret
lea eax, [esp + 4]
call fcn.00430c30
mov ecx, dword [esp + 0x14]
pop edi
xor ecx, esp
call fcn.0049ca20
add esp, 0x18
ret

Function at 0x4315f0
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
xor ecx, ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
pxor xmm0, xmm0
movq qword [eax + 0x68], xmm0
movq qword [eax + 0x70], xmm0
movq qword [eax + 0x78], xmm0
movq qword [eax + 0x80], xmm0
ret