joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd171b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d17140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d17140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d17140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d17140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd17bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd17c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd2987c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd17c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd17c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x95c740
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3e3000]
push edi
or ebp, 0xffffffff
jmp 0x95c762
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x95c769
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x95c758
mov eax, 1
add ebx, ebx
jne 0x95c77b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x95c78c
jne 0x95c7ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x95c7ab
dec eax
add ebx, ebx
jne 0x95c798
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x95c770
add ebx, ebx
jne 0x95c7a7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x95c7fd
xor ecx, ecx
sub eax, 3
jb 0x95c7c3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x95c832
sar eax, 1
mov ebp, eax
jmp 0x95c7ce
add ebx, ebx
jne 0x95c7ce
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x95c79c
inc ecx
add ebx, ebx
jne 0x95c7dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x95c79c
add ebx, ebx
jne 0x95c7e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x95c7de
jne 0x95c7fa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x95c7de
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x95c81c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x95c80e
jmp 0x95c75e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x95c81c
add edi, ecx
jmp 0x95c75e
pop esi
mov edi, esi
mov ecx, 0x873b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x95c83a
cmp byte [edi], 0x23
jne 0x95c83a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x95c83f
lea edi, [esi + 0x558000]
mov eax, dword [edi]
or eax, eax
je 0x95c8ae
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x564290]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x564420]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x95c86c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x564424]
or eax, eax
je 0x95c8a8
mov dword [ebx], eax
add ebx, 4
jmp 0x95c889
call dword [esi + 0x56442c]
mov ebp, dword [esi + 0x564428]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x95c8e2
sub esp, 0xffffff80
jmp 0x50063c
Function at 0x403f68
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [ecx + 0x80]
mov ebx, dword [ecx + 0x84]
mov esi, ecx
sub ebx, 1
jb 0x403f8e
mov ecx, edi
call fcn.00403ce8
add edi, 0x10
jmp 0x403f7d
lea eax, [esi + 0x7c]
push 0x10
push 4
push eax
call fcn.00423b3f
add esp, 0xc
lea ecx, [esi + 0x60]
call fcn.004047a7
lea ecx, [esi + 0x64]
call fcn.00403f1f
mov ecx, dword [esi + 0x68]
lea edi, [esi + 0x68]
lock dec dword [ecx + 0x150]
jne 0x403fc5
add ecx, 0x40
call fcn.00401add
mov ecx, edi
call fcn.00403433
lea ecx, [esi + 0x6c]
call fcn.004045eb
lea ecx, [esi + 0x74]
call fcn.00403ae6
lea ecx, [esi + 0x78]
call fcn.0040464d
mov ebp, dword [esi + 0x1c]
test ebp, ebp
je 0x404076
mov eax, dword [esi + 0x24]
mov edi, dword [esi + 0x18]
test eax, eax
je 0x404052
lea ecx, [edi + ebp + 1]
movdqa xmm0, xmmword [edi]
lea ebx, [esp + 8]
mov dword [esp + 4], edi
mov dword [esp], ecx
lea ecx, [edi + 0x10]
mov dword [ebx], edi
xor edi, edi
mov dword [ebx + 4], ecx
mov ecx, dword [esp]
inc edi
pmovmskb edx, xmm0
not edx
mov dword [ebx + 8], ecx
mov word [ebx + 0xc], dx
mov dword [ebx + 0x10], eax
test edi, edi
je 0x40404e
mov ecx, ebx
call fcn.0041870a
mov edi, dword [esp + 0x18]
dec edi
test eax, eax
mov dword [esp + 0x18], edi
je 0x40404e
add eax, 0xfffffff0
mov ecx, eax
call fcn.00403ce8
jmp 0x40402a
mov edi, dword [esp + 4]
inc ebp
lea ebx, [esp + 8]
push 0x10
pop edx
mov ecx, ebx
push ebp
push 0x10
call fcn.00418164
pop eax
pop ecx
sub edi, dword [ebx + 8]
mov edx, dword [ebx]
mov ecx, edi
push dword [ebx + 4]
call fcn.0040fecf
pop eax
mov edi, dword [esi + 0x58]
mov ebp, dword [edi + 4]
test ebp, ebp
je 0x4040ab
mov ecx, edi
call fcn.004181a5
inc ebp
lea ebx, [esp + 8]
push 0x14
pop edx
mov ecx, ebx
push ebp
push 0x10
call fcn.00418164
pop eax
pop ecx
mov ecx, dword [edi]
mov edx, dword [ebx]
sub ecx, dword [ebx + 8]
push dword [ebx + 4]
call fcn.0040fecf
pop eax
push 8
push 0x20
push edi
call fcn.00421250
add esp, 0xc
mov ebx, dword [esi + 0x3c]
test ebx, ebx
je 0x4040f0
lea ecx, [esi + 0x38]
call fcn.00418205
inc ebx
lea edi, [esp + 8]
push 0x10
pop edx
mov ecx, edi
push ebx
push 0x10
call fcn.00418164
pop eax
pop ecx
mov ecx, dword [esi + 0x38]
mov edx, dword [edi]
sub ecx, dword [edi + 8]
push dword [edi + 4]
call fcn.0040fecf
add esp, 0x20
jmp 0x4040f3
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x427580
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 8], 0
movups xmmword [ebp - 0x18], xmm0
movups xmmword [ebp - 0x28], xmm0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4275b5
mov dword [esi + 4], eax
mov byte [esi], 4
jmp 0x4275c5
mov eax, dword [0x484400]
mov ecx, dword [0x484404]
mov dword [esi + 4], ecx
mov dword [esi], eax
mov eax, esi
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x428700
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x438
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x433ac0
mov edi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x2c], 2
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x20], 0
cmp edi, 0x201
jae 0x428790
jmp 0x42877e
jbe 0x42881a
cmp edi, 0x201
jae 0x428790
mov dword [ebp - 0x30], 0x200
lea ebx, [ebp - 0x444]
mov esi, edi
jmp 0x4287c5
mov esi, dword [ebp - 0x34]
sub edi, esi
je 0x4287b9
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x28]
mov edx, esi
push 2
push 2
push edi
call fcn.0047b3a0
add esp, 0xc
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
jne 0x4287e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42887d
cmp edi, esi
jne 0x428770
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42889c
lea edi, [esi + esi]
test esi, esi
mov eax, 0xffffffff
cmovs edi, eax
cmp edi, 0x201
jb 0x42877e
jmp 0x428790
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], 0
cmp edi, eax
ja 0x4288b9
lea eax, [ebp - 0x44]
push edi
push ebx
push eax
call fcn.0042adc0
add esp, 0xc
movsd xmm0, qword [ebp - 0x44]
mov esi, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x3c]
movsd qword [esi + 8], xmm1
movsd qword [esi], xmm0
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x428867
add eax, eax
push 2
push eax
push dword [ebp - 0x24]
call fcn.00421250
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x438
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp + 8]
mov byte [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi], 0x80000000
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x428857
jmp 0x428867
mov dword [ebp - 0x10], 0
push 0x4844fc
push 0x28
push str.internal_error:_entered_unreachable_code_rustc_2c93fabd98d2c183bcb3afed1f7d51b2517ac5edlibrary_alloc_src_vecmod.rs
call fcn.0047c070
add esp, 0xc
jmp 0x4288c8
push 0x4844ec
push eax
push edi
call fcn.0047c380
add esp, 0xc
ud2
Function at 0x430640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov edi, edx
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x103
lea ebx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], edx
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x20], edx
xor edx, edx
test cl, 1
lea ecx, [esp + 0x20]
cmovne edx, ecx
mov ecx, dword [ebp + 0xc]
push 0
push edx
push ecx
push eax
push ebx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x4306c0
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
cmp eax, 0x103
je 0x4306e2
test eax, eax
js 0x4306cc
mov eax, dword [esp + 0xc]
mov bl, 4
jmp 0x4306d5
xor ebx, ebx
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
mov byte [esi], bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 4]
mov dword [esp + 0x2c], 0x48400c
mov dword [esp + 0x30], 1
mov dword [esp + 0x3c], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
lea ecx, [esp + 0x10]
lea esi, [esp + 0x44]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x38], 0
push eax
push ecx
push esi
call fcn.0042a160
add esp, 0xc
mov ecx, esi
call fcn.00425610
mov ecx, 7
int 0x29
ud2

Function at 0x430740
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, 2
cmp byte [eax], 0
mov eax, 0x17
cmovne ebx, eax
push 0x81
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x430784
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x430798
cmp eax, 0x2739
jne 0x4307c3
push 1
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ws2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x4307cb
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x4307dc
mov dword [esi + 4], edi
jmp 0x43077a
mov byte [esi], 0
mov dword [esi + 4], eax
jmp 0x43077d
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x43077d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
push edi
call dword [sym.imp.ws2_32.dll_closesocket]
jmp 0x43077d
Function at 0x431430
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x433d00
lea eax, [ebp - 0x18]
mov ebx, dword [ebp + 0x10]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
movzx eax, byte [0x4af991]
push 4
push 8
call fcn.00421240
add esp, 8
test eax, eax
je 0x43151b
mov esi, eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [esi], ebx
mov dword [esi + 4], ecx
push 0
push 0x10000
push esi
push 0x431590
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4314ad
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x431508
mov eax, dword [esi]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [eax]
test eax, eax
je 0x4314d3
mov dword [ebp - 0x10], 1
push dword [ebp - 0x24]
call eax
mov edi, dword [ebp + 8]
add esp, 4
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
test eax, eax
je 0x4314ed
push dword [edx + 8]
push eax
push ecx
call fcn.00421250
add esp, 0xc
push 4
push 8
push dword [ebp - 0x28]
call fcn.00421250
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [edi], 0
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 8
push 4
call fcn.0047be20
add esp, 8
ud2
Function at 0x4317b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov esi, esp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x2c], esp
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x34], 0x433d30
lea eax, [esi + 0x30]
mov ecx, dword fs:[0]
mov dword [esi + 0x30], ecx
mov dword fs:[0], eax
movq xmm0, qword [0x4afa10]
movd ecx, xmm0
pshufd xmm0, xmm0, 0x55
movd edx, xmm0
mov eax, ecx
or eax, edx
jne 0x431839
mov eax, esi
mov dword [esi + 4], 0
mov dword [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x4318d7
mov ecx, dword [esi]
mov edx, dword [esi + 4]
movq xmm0, qword [esi]
mov eax, ecx
movq qword [0x4afa10], xmm0
or eax, edx
je 0x43190d
mov eax, dword [ebp + 8]
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], eax
push edx
push ecx
push dword [ebp + 0xc]
push eax
mov ebx, ecx
mov dword [esi + 0x1c], ecx
call fcn.00479a40
mov edi, edx
mov dword [esi + 0x14], eax
mul ebx
imul ecx, edi, 0x3b9aca00
imul edi, ebx
mov ebx, dword [esi + 0x14]
add edi, edx
mov dword [esi + 0x18], ecx
mov ecx, dword [ebp + 0xc]
mov edx, ebx
imul edx, dword [esi + 0x10]
add edi, edx
sub dword [esi + 0xc], eax
mov edx, 0x3b9aca00
mov eax, ebx
sbb ecx, edi
mul edx
mov edi, eax
mov eax, dword [esi + 0xc]
mov ebx, edx
mov edx, 0x3b9aca00
imul ecx, ecx, 0x3b9aca00
add ebx, dword [esi + 0x18]
mul edx
add edx, ecx
push dword [esi + 0x10]
push dword [esi + 0x1c]
push edx
push eax
call fcn.00479a40
add edi, eax
adc edx, ebx
push 0
push 0x3b9aca00
push edx
push edi
call fcn.00479a40
imul ecx, eax, 0x3b9aca00
sub edi, ecx
mov ecx, dword [esi + 0x30]
mov dword fs:[0], ecx
mov ecx, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x38], 0
lea eax, [esi + 0x20]
push 0x48446c
push 0x482a08
push eax
push 0x2b
push 0x482a18
call fcn.0047c2b0
add esp, 0x14
ud2
push 0x48398c
call fcn.0047c570
nop word [eax + eax]
push ebp
sub esp, 0x14
lea esi, [ebp - 0x3c]
mov ebp, dword [esi + 0x28]
lea eax, [esi + 0x20]
push eax
call fcn.00425200
add esp, 0x18
pop ebp
ret
Function at 0x433370
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1b8
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [eax]
mov ebx, dword [eax + 4]
movzx eax, word [eax + 8]
mov word [ebp - 0xe], ax
mov eax, dword [0x4afa04]
cmp eax, 3
jne 0x433460
lea eax, [ebp - 0xe]
cmp ebx, 0x17f
mov dword [ebp - 0x18], eax
ja 0x433477
lea esi, [ebp - 0x1c4]
push ebx
push edi
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebp + ebx - 0x1c4], 0
inc ebx
lea eax, [ebp - 0x24]
push ebx
push esi
push eax
call fcn.00435140
add esp, 0xc
test byte [ebp - 0x24], 1
je 0x4333fc
mov eax, dword [0x4837f8]
mov esi, dword [ebp + 8]
mov ecx, dword [0x4837fc]
mov dword [esi + 8], ecx
mov dword [esi + 4], eax
mov dword [esi], 1
jmp 0x433488
mov eax, dword [ebp - 0x20]
xorps xmm0, xmm0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x44]
movups xmmword [ebp - 0x44], xmm0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x3c], 1
push ecx
push edx
push 0
push eax
call dword [sym.imp.ws2_32.dll_getaddrinfo]
mov esi, dword [ebp + 8]
test eax, eax
je 0x433449
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, 1
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], ecx
jmp 0x433488
mov eax, dword [ebp - 0x14]
movzx ecx, word [ebp - 0xe]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
xor eax, eax
mov word [esi + 0xc], cx
mov dword [esi], eax
jmp 0x433488
call fcn.0047b4f0
lea eax, [ebp - 0xe]
cmp ebx, 0x17f
mov dword [ebp - 0x18], eax
jbe 0x4333af
lea eax, [ebp - 0x18]
mov ecx, esi
mov edx, edi
push eax
push ebx
call fcn.0047b590
add esp, 8
mov eax, esi
add esp, 0x1b8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x449e0b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword fs:[0x30]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov esi, dword [eax + 0xc]
mov edi, dword [esi + 0x18]
add esi, 0x14
mov esi, dword [esi]
movzx eax, word [esi + 0x24]
shr eax, 1
push ebx
push ebp
push eax
push dword [esi + 0x28]
call dword [esp + 0x30]
add esp, 0x10
cmp al, 3
je 0x449e4f
cmp esi, edi
jne 0x449e26
mov eax, dword [esp + 0x14]
mov cl, 1
mov byte [eax + 1], 1
jmp 0x449e5b
mov ecx, dword [esi + 0x10]
mov eax, dword [esp + 0x14]
mov dword [eax + 4], ecx
xor ecx, ecx
mov byte [eax], cl
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x449e62
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword fs:[0x30]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0xc]
test edi, edi
je 0x449ea8
mov esi, edi
mov edi, dword [edi]
movzx eax, word [esi + 0x2c]
shr eax, 1
push ebx
push ebp
push eax
push dword [esi + 0x30]
call dword [esp + 0x30]
add esp, 0x10
cmp al, 3
jne 0x449e7a
mov eax, dword [esp + 0x14]
mov dword [eax + 4], esi
mov byte [eax], 0
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x48b1d4
call fcn.0047bf30
Function at 0x44cd73
Capabilities:
Get session user name

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, esp
and dword [ebx], 0
push ebx
push 0
call dword [sym.imp.advapi32.dll_GetUserNameW]
test eax, eax
jne 0x44ce29
mov esi, dword [esp + 0x24]
call fcn.00430800
lea ecx, [esp + 4]
mov edi, eax
mov byte [ecx], 0
mov dword [ecx + 4], eax
call fcn.0043c394
cmp edi, 0x7a
jne 0x44cde3
mov edx, dword [esp]
lea edi, [esp + 4]
mov ecx, edi
call fcn.0044cbde
mov eax, dword [edi]
mov ebp, dword [edi + 4]
mov dword [esp], eax
push ebx
push ebp
call dword [sym.imp.advapi32.dll_GetUserNameW]
test eax, eax
je 0x44cdf7
mov eax, dword [esp]
test eax, eax
mov dword [esp + 0xc], eax
je 0x44ce0b
dec eax
mov dword [esp + 0xc], eax
jmp 0x44ce0d
call fcn.00430800
and dword [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi], 0x80000000
jmp 0x44ce1f
call fcn.00430800
and dword [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi], 0x80000000
jmp 0x44ce18
xor eax, eax
push eax
push ebp
push esi
call fcn.0042adc0
add esp, 0xc
push edi
call fcn.00423df8
pop eax
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x48c124
push 0x16
push 0x48c0a7
call fcn.0047c070

Function at 0x450ea4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x128
call fcn.00450eb8
Function at 0x45ed3d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov eax, dword [0x49c1fc]
mov cl, byte [esp + 0x80]
mov esi, dword [esp + 0x74]
mov eax, dword [eax]
test eax, eax
je 0x45ee3a
mov ebx, dword [esp + 0x70]
cmp cl, 2
jae 0x45ee23
lea edi, [esi + 0x140]
mov ecx, edi
call fcn.0045bb36
lea ebp, [esi + 0x150]
mov al, byte [esi + 0x148]
mov dword [esp], ebp
mov dword [esp + 4], edi
cmp dword [esi + 0x15c], 0
je 0x45eea0
lea eax, [esi + 0x160]
lea esi, [esp + 0x78]
push esi
push eax
call fcn.0045c29f
pop ecx
pop ecx
mov edi, edx
mov ecx, ebp
mov edx, eax
push esi
mov esi, dword [esp + 0x78]
push edi
call fcn.0045d0db
pop ecx
pop edx
test eax, eax
je 0x45eea0
mov ebp, dword [eax - 4]
lock inc dword [ebp]
jle 0x45ef73
mov eax, esp
mov dword [esp + 0x18], ebp
push eax
call fcn.0045caca
pop eax
movzx eax, byte [esp + 0x80]
mov edx, dword [esp + 0x7c]
lea ecx, [ebp + 8]
push eax
call fcn.0045f166
pop ecx
test al, al
je 0x45eeb5
mov edi, esp
mov edx, esi
mov ecx, edi
push ebp
call fcn.0045ef75
pop eax
cmp byte [edi], 4
je 0x45ee1b
mov eax, dword [esp]
cmp al, 4
jne 0x45ef65
mov byte [ebx], 4
jmp 0x45eec1
push 0x27
push str.edge_triggered_events_are_not_supported
push 0x14
push ebx
call fcn.0045bab5
add esp, 0x10
jmp 0x45eec1
mov ecx, 0x49c180
call fcn.00401acd
mov cl, byte [esp + 0x80]
test al, al
je 0x45ed5e
movzx eax, al
push eax
push dword [0x49c180]
call fcn.0045fa60
mov cl, byte [esp + 0x88]
add esp, 8
test al, al
je 0x45ed5e
mov ecx, dword [0x49c180]
mov edx, dword [ecx + 0x20]
lea edi, [ecx + 0x1c]
test edx, edx
je 0x45eecb
mov eax, dword [ecx + 0x1c]
mov ebx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x28]
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
and dword [esp + 0x10], 0
jmp 0x45eecd
and dword [ebx + 4], 0
mov eax, esp
mov dword [ebx], 1
push eax
call fcn.0045caca
pop eax
jmp 0x45eec1
lea ecx, [esp + 0x18]
mov byte [ebx], 4
call fcn.0045c1f8
mov eax, ebx
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
lea ebx, [esp + 0x48]
mov ebp, esp
mov ecx, ebx
mov dword [ebp], eax
mov edx, ebp
push 0x48f854
call fcn.0045c454
pop eax
lea eax, [esi + 0x170]
mov dword [ebp], eax
lea eax, [esp + 0x78]
mov dword [ebp + 4], fcn.0045c66b
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x7c]
mov dword [ebp + 0xc], fcn.0045c484
mov dword [ebp + 0x10], eax
lea eax, [esp + 0x18]
mov dword [ebp + 0x14], fcn.0045f850
mov dword [eax], str.modify_waitable:_handled
push 3
pop ecx
mov dword [eax + 4], ecx
and dword [eax + 0x10], 0
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ecx
lea ecx, [esp + 0x3c]
mov dword [ecx], ebx
mov dword [ecx + 4], eax
lea eax, [esp + 0x30]
mov dword [ecx + 8], 0x48f508
mov dword [eax], ecx
mov dword [eax + 4], 1
mov dword [eax + 8], edi
push eax
push dword [0x49c180]
call fcn.0045fd95
pop eax
pop ecx
mov cl, byte [esp + 0x80]
jmp 0x45ed5e
mov ecx, dword [esp + 4]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
jmp 0x45eec1
ud2