joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429880
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
sub esp, 0xc
xor eax, eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [edi]
mov edx, dword [eax + 0x4ac568]
mov dword [eax + ecx], edx
add eax, 4
cmp eax, 0x48
jl 0x42988b
xor eax, eax
mov ecx, 0x100
mov edx, dword [edi + 4]
mov esi, dword [eax + 0x4ac5b0]
mov dword [eax + edx], esi
add eax, 4
dec ecx
jne 0x4298a5
cmp eax, 0x1000
jl 0x4298a0
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
xor esi, esi
xor eax, eax
mov dword [esp + 0x18], eax
mov edx, dword [edi]
xor ebx, ebx
add eax, edx
mov dword [esp + 0x24], eax
lea eax, [esi + 1]
cdq
idiv ebp
lea eax, [esi + 2]
mov bl, byte [edx + ecx]
cdq
idiv ebp
mov bh, byte [esi + ecx]
xor eax, eax
shl ebx, 8
mov al, byte [edx + ecx]
or ebx, eax
lea eax, [esi + 3]
cdq
idiv ebp
xor eax, eax
shl ebx, 8
mov al, byte [edx + ecx]
or ebx, eax
mov eax, dword [esp + 0x24]
mov edx, dword [eax]
xor edx, ebx
mov dword [eax], edx
lea eax, [esi + 4]
cdq
idiv ebp
mov eax, dword [esp + 0x18]
add eax, 4
cmp eax, 0x48
mov dword [esp + 0x18], eax
mov esi, edx
jl 0x4298ce
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, edi
call fcn.00429080
mov eax, dword [edi]
mov ecx, dword [esp + 0x10]
mov dword [esi + eax], ecx
mov edx, dword [edi]
mov eax, dword [esp + 0x14]
mov dword [esi + edx + 4], eax
add esi, 8
cmp esi, 0x48
jl 0x429930
mov esi, 4
mov ebx, 0x80
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, edi
call fcn.00429080
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x10]
mov dword [esi + eax - 4], ecx
mov edx, dword [edi + 4]
mov eax, dword [esp + 0x14]
mov dword [esi + edx], eax
add esi, 8
dec ebx
jne 0x429966
cmp esi, 0x1004
jl 0x429961
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x429ba0
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x40
push ebx
push ebp
mov ebp, ecx
push esi
mov ecx, dword [eax]
mov esi, dword [esp + 0x50]
mov dword [ebp], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 4], edx
mov ecx, dword [eax]
mov dword [ebp + 8], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x54]
push edi
cmp eax, 1
mov dword [ebp + 0xc], edx
jae 0x429bd7
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x38
jbe 0x429be1
mov eax, 0x38
mov ecx, eax
lea edi, [esp + 0x18]
mov edx, ecx
lea ebx, [ebp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x18]
and ecx, 3
mov dword [esp + 0x58], 0x12
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x12
mov esi, 0x482f64
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp + 0x58]
mov ecx, 0x400
mov esi, 0x482fac
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov edi, ebx
xor esi, esi
mov dword [esp + 0x5c], 4
xor ebx, ebx
mov bl, byte [edx]
shl esi, 8
or esi, ebx
inc edx
inc ecx
cmp ecx, eax
jne 0x429c44
xor ecx, ecx
lea edx, [esp + 0x18]
mov ebx, dword [esp + 0x5c]
dec ebx
mov dword [esp + 0x5c], ebx
jne 0x429c2f
mov ebx, dword [edi]
add edi, 4
xor ebx, esi
mov esi, dword [esp + 0x58]
mov dword [edi - 4], ebx
dec esi
mov dword [esp + 0x58], esi
jne 0x429c25
xor edi, edi
lea esi, [ebp + 0x10]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.00429cf0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi], ecx
add esi, 4
inc edi
mov dword [esi], edx
inc edi
add esi, 4
cmp edi, 0x12
jb 0x429c71
lea eax, [ebp + 0x58]
mov dword [esp + 0x5c], 4
mov ebx, eax
xor edi, edi
mov esi, ebx
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.00429cf0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esi], ecx
add esi, 4
inc edi
mov dword [esi], edx
inc edi
add esi, 4
cmp edi, 0x100
jl 0x429ca7
mov eax, dword [esp + 0x5c]
add ebx, 0x400
dec eax
mov dword [esp + 0x5c], eax
jne 0x429ca3
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 0xc
Function at 0x42c8e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x214
push esi
lea eax, [esp + 0x38]
push edi
push eax
call fcn.004097a0
mov edx, dword [esp + 0x228]
mov eax, dword [esp + 0x224]
lea ecx, [esp + 0x40]
push ecx
push edx
push eax
call fcn.004097b0
mov edx, dword [esp + 0x23c]
mov eax, dword [esp + 0x238]
mov ecx, 0x28
lea esi, [esp + 0x4c]
lea edi, [esp + 0x18c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x18c]
push ecx
push edx
push eax
call fcn.00409850
mov ecx, dword [esp + 0x254]
add esp, 0x1c
dec ecx
mov eax, 0xcccccccd
mul ecx
shr edx, 4
inc edx
mov dword [esp + 0x10], edx
je 0x42ca6c
push ebx
push ebp
mov dword [esp + 0x10], 0
mov ebx, 1
lea ebp, [esp + 0x1c]
xor edx, edx
mov ecx, 0x28
mov dword [esp + 0x1c], edx
lea esi, [esp + 0x184]
lea edi, [esp + 0xe4]
mov dword [esp + 0x20], edx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], edx
mov ecx, ebx
mov dword [esp + 0x28], edx
mov eax, ebx
shr ecx, 0x10
mov dword [esp + 0x2c], edx
mov byte [esp + 0x31], cl
mov ecx, dword [esp + 0x238]
mov edx, ebx
shr eax, 0x18
shr edx, 8
mov byte [esp + 0x30], al
mov byte [esp + 0x32], dl
test ecx, ecx
mov byte [esp + 0x33], bl
mov eax, 4
jbe 0x42ca29
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0xe4]
lea edx, [esp + 0x30]
push ecx
push eax
push edx
call fcn.00409850
lea eax, [esp + 0xf0]
lea ecx, [esp + 0x3c]
push eax
push 0x14
push ecx
call fcn.00409900
add esp, 0x18
xor eax, eax
mov dl, byte [esp + eax + 0x30]
mov cl, byte [esp + eax + 0x1c]
xor cl, dl
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 0x14
jb 0x42c9f8
mov ecx, 0x28
lea esi, [esp + 0x44]
lea edi, [esp + 0xe4]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
dec ecx
mov dword [esp + 0x14], ecx
jne 0x42c9cc
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, dword [esp + 0x240]
jae 0x42ca4c
mov esi, dword [esp + 0x23c]
mov dl, byte [eax + ebp]
inc ecx
mov byte [eax + esi], dl
inc eax
cmp ecx, 0x14
jb 0x42ca2f
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc ebx
add esi, 0x14
sub ebp, 0x14
mov dword [esp + 0x10], esi
lea eax, [ebx - 1]
cmp eax, ecx
jb 0x42c96e
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x214
ret 0x1c

Function at 0x42cc10
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], 1
mov eax, dword [esi + 8]
test eax, eax
jl 0x42cc29
call fcn.0042cc80
push 0
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
test eax, eax
mov dword [esi + 8], eax
jge 0x42cc42
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov edi, dword [sym.imp.WSOCK32.dll_setsockopt]
lea ecx, [esp + 8]
push 4
push ecx
push 4
push 0xffff
push eax
call edi
test eax, eax
je 0x42cc63
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 8]
lea edx, [esp + 8]
push 4
push edx
push 1
push 6
push eax
call edi
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
pop ecx
ret
Function at 0x42cde0
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
jge 0x42cdf8
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 8], eax
push esi
mov dword [esp + 0x10], eax
mov word [esp + 0xc], 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42ce47
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x42cdee
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
test eax, eax
jne 0x42ce41
pop edi
pop esi
add esp, 0x10
ret 8
mov edx, dword [eax]
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov edx, dword [edi + 8]
lea ecx, [esp + 8]
push 0x10
push ecx
push edx
mov word [esp + 0x16], ax
call dword [sym.imp.WSOCK32.dll_connect]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x10
ret 8

Function at 0x42cea0
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov eax, dword [ecx + 8]
push edi
test eax, eax
mov dword [esp + 4], 1
jge 0x42ceb6
xor eax, eax
pop edi
pop ecx
ret
push 0
push 0
push eax
call dword [sym.imp.WSOCK32.dll_accept]
mov edi, eax
test edi, edi
jge 0x42cecc
xor eax, eax
pop edi
pop ecx
ret
push esi
push 0x38
call fcn.0045c9ed
add esp, 4
test eax, eax
je 0x42ceed
mov ecx, eax
call fcn.0042cbb0
mov esi, eax
test esi, esi
je 0x42ceef
mov dword [esi + 8], edi
jmp 0x42ceff
xor esi, esi
push 2
push edi
call dword [sym.imp.WSOCK32.dll_shutdown]
push edi
call dword [sym.imp.WSOCK32.dll_closesocket]
mov ecx, dword [esi + 8]
lea eax, [esp + 8]
push 4
push eax
push 1
push 6
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov eax, esi
pop esi
pop edi
pop ecx
ret

Function at 0x42cf60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
lea eax, [esp]
lea edx, [esp + 4]
push eax
mov eax, dword [ecx + 8]
push edx
push eax
mov dword [esp + 0xc], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
test eax, eax
jne 0x42cf93
mov eax, 0x4ae780
add esp, 0x14
ret
Function at 0x42dec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x478ac8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x4b12d8]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0x40]
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0
push ecx
push edi
call ebx
mov eax, dword [esi + 0x74]
test eax, eax
je 0x42df51
push 0x1d
lea ecx, [esp + 0x10]
call fcn.0045d23c
mov edx, dword [esi + 0x70]
mov eax, dword [esi + 0x68]
mov ecx, dword [esp + 0x14]
sub edx, eax
mov eax, dword [esi + 0x6c]
push 1
push edx
mov edx, dword [esi + 0x64]
sub eax, edx
mov edx, dword [esp + 0x18]
push eax
push ecx
push edx
push edi
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [esp + 0xc]
mov ecx, esi
push eax
push 0x4bf
call fcn.0045c11b
mov dword [esi + 0x74], 0
jmp 0x42dfac
push 0x1e
lea ecx, [esp + 0x10]
call fcn.0045d23c
lea ecx, [esp + 0x20]
push ecx
push 0x4c0
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call ebx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
sub edx, eax
sub edx, 4
push 1
push edx
mov edx, dword [esp + 0x20]
sub edx, ecx
push edx
push eax
push ecx
push edi
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [esp + 0xc]
mov ecx, esi
push eax
push 0x4bf
call fcn.0045c11b
mov dword [esi + 0x74], 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x38], 0xffffffff
call fcn.0045ccac
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 4

Function at 0x42fff1
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
lea edi, [esi + 0x164]
mov dword [esi + 0x168], eax
mov ecx, dword [0x4b5754]
lea eax, [esi + 0x5c]
mov edx, dword [ecx + 0x1c]
lea ecx, [esi + 0x174]
push eax
push ecx
mov dword [edi], edx
call fcn.004372b0
mov edx, dword [esi + 0x398]
mov eax, dword [esi + 0x39c]
lea ecx, [esp + 0x10]
mov dword [esi + 0x16c], 0
push ecx
push 4
push edi
push 0x4304b0
push 0
push 0
mov dword [esi + 0x280], esi
mov dword [esi + 0x388], edx
mov dword [esi + 0x27c], 0
mov dword [esi + 0x38c], eax
call fcn.00447b63
mov edi, eax
add esp, 0x20
test edi, edi
jne 0x430074
pop edi
pop esi
pop ecx
ret
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 2
push 0
add esi, 0x390
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
push eax
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
push edi
jne 0x4300ae
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
pop ecx
ret
Function at 0x431340
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
lea edi, [esi + 0x178]
mov dword [esi + 0x17c], eax
mov ecx, dword [0x4b5754]
lea eax, [esi + 0x5c]
mov edx, dword [ecx + 0x1c]
lea ecx, [esi + 0x184]
push eax
push ecx
mov dword [edi], edx
call fcn.004372b0
mov edx, dword [esi + 0x16c]
mov eax, dword [esi + 0x170]
lea ecx, [esp + 0x10]
mov dword [esi + 0x180], 0
push ecx
push 4
push edi
push 0x431410
push 0
push 0
mov dword [esi + 0x290], esi
mov dword [esi + 0x49c], edx
mov dword [esi + 0x4a0], eax
call fcn.00447b63
mov edi, eax
add esp, 0x20
test edi, edi
jne 0x4313ba
pop edi
pop esi
pop ecx
ret
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 2
push 0
add esi, 0x4a4
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call esi
push eax
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
push edi
jne 0x4313f4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
pop ecx
ret
Function at 0x433d10
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 0x114
call fcn.00447df9
mov edi, eax
mov ecx, 0x45
xor eax, eax
mov dword [esi + 0x74], edi
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x74]
mov ecx, dword [esi + 0x1c]
mov dword [eax + 4], ecx
mov eax, dword [0x4b5754]
mov edx, dword [esi + 0x74]
mov ecx, dword [eax + 0x1c]
mov dword [edx], ecx
mov edx, dword [esi + 0x74]
mov dword [edx + 8], 0
mov eax, dword [esi + 0x74]
mov ecx, dword [esi + 0x60]
lea edx, [esp + 0x10]
mov dword [eax + 0x110], ecx
mov eax, dword [esi + 0x74]
push edx
push 4
push eax
push 0x433e60
push 0
push 0
call fcn.00447b63
add esp, 0x1c
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
lea ecx, [esi + 0x70]
push 0
push ecx
call ebx
push eax
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x433db4
push eax
push 0x498738
push 0x49871c
mov ecx, esi
call fcn.0045a962
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x433fb0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x415c
call fcn.00447a20
push ebx
push ebp
mov ebp, dword [esp + 0x416c]
push esi
push edi
mov ecx, 0x1056
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, 1
mov ecx, 0xf8d
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], eax
mov eax, dword [esp + 0x4170]
mov esi, ebp
lea edi, [esp + 0x234]
mov dword [esp + 0x14], eax
push 0x104
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x1c]
xor ebx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x18]
push 0x4aed00
push edx
call esi
lea eax, [esp + 0x18]
push eax
call fcn.00437b20
add esp, 4
test eax, eax
jne 0x43405a
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.00437860
add esp, 8
lea edx, [esp + 0x18]
push 0x4aed00
push edx
call esi
push 0x4aec64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
mov dword [esp + 0x10], esi
je 0x4340aa
push 0x4aecf0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4340a3
lea ecx, [esp + 0x14]
push ecx
call eax
test eax, eax
je 0x4340a3
mov ecx, 0xf8d
lea esi, [esp + 0x234]
mov edi, ebp
mov ebx, 1
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x415c
ret
Function at 0x435700
Capabilities:
Create directory

Disassembly:
sub esp, 0x208
push ebx
push ebp
push esi
mov esi, dword [esp + 0x218]
xor ebx, ebx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4357e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4357e7
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov byte [esp + 0x114], bl
mov byte [esp + 0x10], bl
lea ecx, [esp + 0x10]
mov al, byte [esi]
cmp al, 0x5c
je 0x435764
cmp al, bl
je 0x435764
mov byte [ecx], al
mov al, byte [esi + 1]
inc ecx
inc esi
cmp al, 0x5c
jne 0x435755
lea eax, [esp + 0x10]
mov byte [ecx], bl
push eax
call edi
cmp eax, 1
jl 0x4357e7
lea ecx, [esp + 0x10]
lea edx, [esp + 0x114]
push ecx
push edx
call ebp
lea eax, [esp + 0x114]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4357a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4357d3
cmp byte [esi], bl
je 0x4357e7
lea ecx, [esp + 0x10]
push ecx
call edi
cmp eax, 1
jl 0x4357e7
cmp byte [esi], 0x5c
jne 0x4357c6
lea edx, [esp + 0x114]
push 0x4ab1fc
push edx
call ebp
inc esi
mov byte [esp + 0x10], bl
lea ecx, [esp + 0x10]
jmp 0x43574f
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x208
ret
Function at 0x438180
Capabilities:
Get hostname
Get session user name

Disassembly:
sub esp, 0xa78
push ebx
push esi
push edi
mov ecx, 0x108
xor eax, eax
lea edi, [esp + 0x5c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x47c]
mov esi, 0x104
push eax
push ecx
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [esp + 0xc]
lea eax, [esp + 0x580]
push edx
push eax
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov ebx, dword [esp + 0xa88]
mov ecx, dword [ebx + 0x13c]
mov edx, dword [ebx + 0x138]
mov eax, dword [ebx + 0x24]
push ecx
push edx
push eax
lea ecx, [esp + 0x690]
push 0x4aeecc
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0x698]
lea eax, [esp + 0x70]
push edx
push eax
call fcn.004382c0
add esp, 0x1c
test eax, eax
jne 0x438218
pop edi
pop esi
pop ebx
add esp, 0xa78
ret
mov ecx, 0xa
mov esi, 0x4aeed4
lea edi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x14]
call fcn.00428ca0
lea edx, [esp + 0x5c]
push 0x420
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 0x420
call fcn.00428e40
test eax, eax
jne 0x43826a
lea ecx, [esp + 0x10]
call fcn.00428d10
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xa78
ret
lea eax, [esp + 0x5c]
lea ecx, [ebx + 0x1c]
push eax
call fcn.0045ce35
lea ecx, [esp + 0x160]
push ecx
lea ecx, [ebx + 0x20]
call fcn.0045ce35
lea edx, [esp + 0x264]
lea ecx, [ebx + 0x18]
push edx
call fcn.0045ce35
lea eax, [esp + 0x368]
lea ecx, [ebx + 0x2c]
push eax
call fcn.0045ce35
lea ecx, [esp + 0x10]
call fcn.00428d10
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0xa78
ret

Function at 0x4382c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
lea eax, [esp + 0xc]
push 0x4aeefc
push eax
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp]
lea edx, [esp + 0xc]
push ecx
push 0xf003f
push 0
push edx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x438307
xor eax, eax
add esp, 0x110
ret
mov ecx, dword [esp + 0x114]
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x11c]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x20], 3
mov dword [esp + 0x1c], 0x420
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [esp]
je 0x43835a
test eax, eax
je 0x438351
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x110
ret
test eax, eax
je 0x438365
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0x110
ret
Function at 0x438380
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe40
push ebx
push esi
push edi
call fcn.00439000
test eax, eax
je 0x4383ae
mov eax, dword [ebp + 8]
push eax
call fcn.00438180
add esp, 4
lea esp, [ebp - 0xe4c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4b5a54]
xor esi, esi
cmp eax, esi
jne 0x4383cf
call fcn.00438c40
test eax, eax
jne 0x4383cf
lea esp, [ebp - 0xe4c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x108
xor eax, eax
lea edi, [ebp - 0x640]
mov dword [ebp - 0x10], esi
rep stosd dword es:[edi], eax
lea ecx, [ebp - 8]
mov dword [ebp - 4], esi
lea edx, [ebp - 0x220]
mov esi, 0x104
push ecx
push edx
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 8]
lea ecx, [ebp - 0x11c]
push eax
push ecx
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [ebp - 0x220]
test edx, edx
jne 0x438425
xor edi, edi
jmp 0x438450
lea eax, [ebp - 0x220]
push eax
call ebx
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.00447a20
mov eax, esp
lea ecx, [ebp - 0x220]
push esi
push ecx
push eax
call fcn.0045d1e9
mov edi, eax
lea edx, [ebp - 0x11c]
test edx, edx
jne 0x43845e
xor eax, eax
jmp 0x438487
lea eax, [ebp - 0x11c]
push eax
call ebx
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.00447a20
mov eax, esp
lea ecx, [ebp - 0x11c]
push esi
push ecx
push eax
call fcn.0045d1e9
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x13c]
mov ecx, dword [ebx + 0x138]
push edx
push ecx
push edi
push eax
lea edx, [ebp - 0xe40]
push 0x4aeeb8
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xe40]
lea ecx, [ebp - 0x18]
push eax
push ecx
call fcn.00438b50
lea edx, [ebp - 4]
push edx
push 0x20
push 0
call fcn.00438bc0
add esp, 0x2c
test eax, eax
je 0x4384e6
push ebx
call fcn.00438180
add esp, 4
lea esp, [ebp - 0xe4c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x18]
push eax
push ecx
push edx
call dword [fcn.004b5a68]
test eax, eax
jne 0x438563
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x420
jne 0x43855c
mov esi, dword [eax + 4]
mov ecx, 0x108
lea edi, [ebp - 0x640]
lea eax, [ebp - 0x640]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebx + 0x1c]
call fcn.0045ce35
lea ecx, [ebp - 0x53c]
push ecx
lea ecx, [ebx + 0x20]
call fcn.0045ce35
lea edx, [ebp - 0x438]
lea ecx, [ebx + 0x18]
push edx
call fcn.0045ce35
lea eax, [ebp - 0x334]
lea ecx, [ebx + 0x2c]
push eax
call fcn.0045ce35
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], 1
push eax
call dword [fcn.004b5a5c]
mov eax, dword [ebp - 4]
test eax, eax
je 0x438571
push eax
call dword [fcn.004b5a60]
mov eax, dword [ebp - 0x10]
lea esp, [ebp - 0xe4c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret