joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473a10
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x480
mov ecx, dword [esp + 0x484]
mov dword [esp], 0x378
test ecx, ecx
je 0x473ad1
mov eax, dword [esp + 0x488]
test eax, eax
je 0x473ad1
lea edx, [esp]
push edx
lea edx, [esp + 0x10c]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x473ad1
cmp dword [esp], 0x378
jne 0x473ad1
lea eax, [esp + 4]
push 0x104
lea ecx, [esp + 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x473ad1
lea edx, [esp + 4]
push edx
call fcn.004734a0
add esp, 4
test eax, eax
je 0x473ad1
cmp dword [esp + 0x234], 1
jne 0x473ac3
cmp dword [esp + 0x258], 2
jne 0x473ac3
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x473ad1
push str.WSPStartup
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x473ad1
mov eax, 1
add esp, 0x480
ret 8
xor eax, eax
add esp, 0x480
ret 8

Function at 0x473ae0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
je 0x473b3f
push esi
call fcn.004734a0
add esp, 4
test eax, eax
je 0x473b3f
lea eax, [esp + 4]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x473b3f
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x473b3f
push str.SetPara
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x104
ret 4
xor eax, eax
pop esi
add esp, 0x104
ret 4
Function at 0x473bd0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x473c04
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.00473ae0
test eax, eax
jne 0x473c1d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.00473b50
cmp eax, 1
je 0x473daa
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x473c56
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x473cd2
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x473d52
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.00473a10
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x473d69
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x473c72
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x473d20
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.004736c0
test eax, eax
je 0x473d52
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x473cee
cmp dword [esp + 0x18], 1
jb 0x473d52
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push closesocket
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.004735a0
cmp eax, 1
je 0x473d9b
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x473d79
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x473d52
push ebp
mov ecx, ebx
call fcn.00473dc0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x473daa
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x473dc0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x473df2
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.00473b50
test eax, eax
jne 0x473e0f
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x473e36
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x473e84
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.00473860
test eax, eax
jne 0x473e6d
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x473e53
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
mov ecx, edi
call fcn.00473630
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x473ea7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4

Function at 0x480200
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x520a6c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x480213
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x480254
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x520b14]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x480286
mov bl, byte [esp + ecx + 0x4c]
jmp 0x48028a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x48027b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4802a8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4802ac
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x48029d
xor ecx, ecx
mov eax, 0x520a7c
xor ebx, ebx
mov bl, byte [ecx + 0x520b24]
cmp byte [esp + ebx + 0x14], 0
je 0x4802d7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x520b3c]
cmp byte [esp + ebx + 0x14], 0
je 0x4802ee
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4802be
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x480247
lea edx, [esp + 0x84]
push edx
call fcn.00480330
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x495bd7
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x495c0f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00493c8b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00493c63
jmp 0x495c1b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4972ce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x497310
call fcn.0049ce83
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x497310
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x497307
xor eax, eax
jmp 0x497318
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0049731e
pop edi
pop esi
pop ebx
ret 4

Function at 0x49d3b3
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49d3e1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49d3ff
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049d319
jmp 0x49d3ff
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49d3ff
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049d319
test edi, edi
mov eax, edi
jne 0x49d3e9
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x41db75
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528b46
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5de390]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x30]
xor al, al
mov ecx, dword [esi + 0x2c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
call fcn.0050c82a
pop ecx
and dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x41dbbf
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41edd4
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
call fcn.0041f9be
lea edx, [ebx + 0x60]
xor eax, eax
mov byte [edx + 0x49], al
mov dword [edx + 0x50], 0x10
test al, al
jne 0x41ee05
mov eax, edx
mov byte [edx + 0x49], 1
neg eax
and eax, 0xf
add eax, edx
push 8
mov dword [edx + 0x54], eax
mov esi, 0x5b88b0
mov edi, dword [ebx + 0xb4]
mov eax, ebx
pop ecx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [ebx], vtable.CryptoPP::SHA256.0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4209b6
Capabilities:
Create thread

Disassembly:
push 0x28
mov eax, 0x52a4aa
call fcn.004e49d2
push str.ConnectionManager::Start
push str._s:_enter
push 1
xor esi, esi
push esi
call fcn.0043a0a0
add esp, 0x10
mov edi, 0x5e7330
mov ecx, edi
push 1
call fcn.004208b6
push ecx
push dword [0x5e7340]
lea ecx, [ebp - 0x2c]
call fcn.0045c8f0
xor ecx, ecx
mov dword [ebp - 4], esi
cmp byte [ebp + 8], cl
movzx eax, byte [0x5e7630]
cmove eax, ecx
sub esp, 0x18
mov ecx, esp
mov byte [0x5e7630], al
call fcn.00458691
call fcn.00456a26
add esp, 0x18
mov dword [0x5e7620], eax
call fcn.004585ce
mov byte [0x5e7625], al
call fcn.00450017
push 0xe1
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x5e7344]
test eax, eax
jne 0x420a9e
cmp dword [0x5e7614], eax
jne 0x420a9e
push 1
mov ecx, edi
call fcn.0042077b
push esi
push esi
push edi
push 0x420b02
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x5e7614], eax
test eax, eax
jne 0x420a90
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Start:_CreateThread_failed___d_
push esi
push esi
call fcn.0043a0a0
add esp, 0x10
mov ecx, edi
push esi
call fcn.0042077b
push str.ConnectionManager::Start
push str._s:_exit
push 1
jmp 0x420aa5
push eax
push str.Invalid_connection_manager_state_in_Start___d_
push esi
push esi
call fcn.0043a0a0
add esp, 0x10
lea ecx, [ebp - 0x2c]
call fcn.0045c98b
call fcn.004e497c
ret 4
Function at 0x42381c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, 0x5dee10
mov dword [0x5dee0c], 0x5e7330
xor esi, esi
cmp dword [ebp + 8], ecx
je 0x423841
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
call fcn.00416c90
mov eax, dword [0x5e761c]
test eax, eax
je 0x423856
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
jne 0x4238a1
push esi
push esi
push 0x5dee0c
push 0x4238a6
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x5e761c], eax
test eax, eax
jne 0x4238a1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.ConnectionManager::SendFeedback
push str._s:_CreateThread_failed___d_
push esi
push esi
call fcn.0043a0a0
add esp, 0x14
push esi
push esi
push 0x466
push dword [0x5e67b0]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
pop ebp
ret 4
Function at 0x42bb24
Capabilities:
Get file version info

Disassembly:
push 0x98
mov eax, 0x52b99d
call fcn.004e49d2
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x84], edi
mov eax, dword fs:[0x2c]
xor esi, esi
mov dword [ebp - 0x94], esi
mov ecx, dword [eax]
mov eax, dword [0x5e957c]
cmp eax, dword [ecx + 0x139c]
jle 0x42bba8
push 0x5e957c
call fcn.004e3f82
cmp dword [0x5e957c], 0xffffffff
pop ecx
jne 0x42bba8
mov dword [ebp - 4], esi
mov dword [0x5e9580], esi
mov dword [0x5e9584], esi
call fcn.00430925
push 0x53b590
mov dword [0x5e9580], eax
call fcn.004e45f2
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x5e957c
call fcn.004e3f43
pop ecx
push ebx
lea eax, [ebp - 0x7c]
mov ecx, 0x5e9580
push eax
call fcn.0042f53d
mov esi, dword [ebp - 0x7c]
cmp esi, dword [0x5e9580]
je 0x42bbd4
lea eax, [esi + 0x10]
mov ecx, ebx
push eax
call fcn.004146f4
shr eax, 0x1f
test al, al
je 0x42bbda
mov esi, dword [0x5e9580]
cmp esi, dword [0x5e9580]
je 0x42bbf2
add esi, 0x28
mov ecx, edi
push esi
call fcn.0042669f
jmp 0x42bd24
cmp dword [ebx + 0x14], 0x10
jb 0x42bbfc
mov eax, dword [ebx]
jmp 0x42bbfe
mov eax, ebx
lea ecx, [ebp - 0x98]
push ecx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov dword [ebp - 0x78], eax
test eax, eax
je 0x42bd18
push eax
call fcn.004e461a
mov esi, eax
mov dword [ebp - 0x84], esi
pop ecx
test esi, esi
jne 0x42bc4b
push str.GetDLLVersion:324:_memory_allocation_failed
lea ecx, [ebp - 0xa4]
call fcn.0040ea4b
push 0x5da418
lea eax, [ebp - 0xa4]
push eax
call fcn.004fda0a
push esi
lea ecx, [ebp - 0x7c]
call fcn.0041ffcf
add esp, 4
mov dword [ebp - 4], 1
cmp dword [ebx + 0x14], 0x10
jb 0x42bc68
mov eax, dword [ebx]
jmp 0x42bc6a
mov eax, ebx
push esi
push dword [ebp - 0x78]
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x42bd0b
and dword [ebp - 0x80], 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x88]
push eax
push str.VarFileInfoTranslation
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x42bd0b
mov ecx, dword [ebp - 0x80]
xor esi, esi
test ecx, 0xfffffffc
jbe 0x42bd0b
mov eax, dword [ebp - 0x88]
movzx edx, word [eax + esi*4]
cmp dl, 9
jne 0x42bd01
movzx eax, word [eax + esi*4 + 2]
push eax
push edx
push str.StringFileInfo_04x_04xFileVersion
lea eax, [ebp - 0x74]
push 0x32
push eax
call fcn.00431c6c
and dword [ebp - 0x78], 0
lea eax, [ebp - 0x8c]
and dword [ebp - 0x8c], 0
add esp, 0x14
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x84]
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x42bd2c
mov ecx, dword [ebp - 0x80]
mov eax, ecx
inc esi
shr eax, 2
cmp esi, eax
jb 0x42bcab
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x7c]
call fcn.004e3e1e
pop ecx
push 0x5ab3a4
mov ecx, edi
call fcn.00426582
mov eax, edi
call fcn.004e497c
ret
mov edi, dword [ebp - 0x78]
mov ecx, 0x5e9580
push ebx
call fcn.0042f1d6
push edi
mov esi, eax
call fcn.0042655b
pop ecx
push eax
push edi
mov ecx, esi
call fcn.004264e2
push dword [ebp - 0x78]
mov ecx, dword [ebp - 0x90]
call fcn.00426582
push dword [ebp - 0x7c]
call fcn.004e3e1e
mov eax, dword [ebp - 0x90]
pop ecx
jmp 0x42bd26
Function at 0x430a11
Capabilities:
Print debug messages

Disassembly:
push 0xa4
mov eax, 0x52c38e
call fcn.004e49d2
mov edi, edx
mov esi, ecx
push 7
lea ecx, [ebp - 0xb0]
call fcn.004112f7
xor ebx, ebx
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], ebx
call fcn.0045bbdb
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x60]
call fcn.004264be
sub esp, 0x18
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x98], esp
push eax
call fcn.0041140f
push str.timestamp__timestamp
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 3
call fcn.004126d5
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0041163b
push ebx
push 1
lea ecx, [ebp - 0x60]
call fcn.00416ab1
push ebx
push 1
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], bl
call fcn.00427ba9
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x98], esp
push esi
call fcn.004113dd
push 0x5ade90
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 4
call fcn.004126d5
mov ecx, eax
mov byte [ebp - 4], bl
call fcn.0041163b
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x98], esp
push edi
call fcn.00411451
push str.data
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 5
call fcn.004126d5
mov ecx, eax
call fcn.0041163b
lea ecx, [ebp - 0x48]
call fcn.0041343f
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041345e
mov byte [ebp - 4], 7
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov esi, dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
cmovae eax, dword [ebp - 0x28]
push eax
call esi
push 0x550680
call esi
push ecx
push dword [0x5e7150]
lea ecx, [ebp - 0x94]
call fcn.0045c8f0
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 8
push eax
mov ecx, 0x5e7158
call fcn.0041272d
lea ecx, [ebp - 0x94]
call fcn.0045c98b
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00416ab1
lea ecx, [ebp - 0x48]
call fcn.0040f5b8
lea ecx, [ebp - 0xb0]
call fcn.0041159b
call fcn.004e497c
ret
Function at 0x433c5c
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0x28
mov eax, 0x52a4aa
call fcn.004e49d2
mov esi, ecx
push ecx
push dword [esi + 8]
lea ecx, [ebp - 0x2c]
call fcn.0045c8f0
and dword [ebp - 4], 0
cmp dword [esi + 0x24], 0
je 0x433ccf
and dword [ebp - 0x34], 0
lea edi, [esi + 0x14]
xor bl, bl
cmp dword [edi + 0x14], 0x10
jb 0x433c93
mov eax, dword [edi]
jmp 0x433c95
mov eax, edi
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0
push 1
push dword [esi + 0x24]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x433ce3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x2d2
movzx eax, byte [esi + 4]
push str.HTTPSRequest::ValidateServerCert:_d___CryptStringToBinaryA_failed___d_
push eax
push 0
call fcn.0043a0a0
add esp, 0x14
xor bl, bl
lea ecx, [ebp - 0x2c]
call fcn.0045c98b
mov al, bl
call fcn.004e497c
ret 4
push 0x5e5266
push dword [ebp - 0x34]
call fcn.004e46bb
mov dword [ebp - 0x30], eax
pop ecx
pop ecx
test eax, eax
jne 0x433d0f
movzx eax, byte [esi + 4]
push str.ValidateServerCert:_memory_allocation_failed
push eax
push 0
call fcn.0043a0a0
add esp, 0xc
jmp 0x433ccf
cmp dword [edi + 0x14], 0x10
jb 0x433d17
mov edi, dword [edi]
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push eax
push 1
push dword [esi + 0x24]
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x433d41
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x2e2
jmp 0x433cbb
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x30]
cmp dword [eax + 8], edx
jne 0x433d75
xor edi, edi
mov bl, 1
test edx, edx
je 0x433d75
mov eax, dword [eax + 4]
mov ecx, esi
sub eax, esi
mov dword [ebp - 0x30], eax
mov al, byte [eax + ecx]
cmp al, byte [ecx]
jne 0x433d73
mov eax, dword [ebp - 0x30]
inc edi
inc ecx
cmp edi, edx
jb 0x433d61
jmp 0x433d75
xor bl, bl
push 1
push esi
call fcn.004e460c
pop ecx
pop ecx
jmp 0x433cd1

Function at 0x435fea
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
cmp dword [eax + 0x3c], 0
je 0x436050
add eax, 0x2c
cmp dword [eax + 0x14], 8
jb 0x436000
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x436050
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov eax, dword [esi]
add eax, 0x2c
cmp dword [eax + 0x14], 8
jb 0x436023
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x436050
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0xed
push str.LocalProxy::Cleanup::_lambda_52991c160c154cbdad19d351afea2101_::operator___
push str._s:_d___DeleteFile_failed:__d
push 1
push 0
call fcn.0043a0a0
add esp, 0x18
mov eax, dword [esi]
and dword [eax + 0x3c], 0
add eax, 0x2c
pop esi
cmp dword [eax + 0x14], 8
jb 0x436062
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
ret
Function at 0x436332
Capabilities:
Check for time delay via gettickcount
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ecx, ecx
push edi
cmp dword [esi + 0x24], ecx
je 0x436528
mov ebx, dword [ebp + 8]
cmp byte [esi + 0xa8], cl
jne 0x43635e
test bl, bl
jne 0x43635e
mov eax, ecx
jmp 0x436361
xor eax, eax
inc eax
mov byte [esi + 0xa8], al
mov dword [esp + 0x10], ecx
cmp dword [esi + 0x74], ecx
jne 0x43637b
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esi + 0x74], eax
xor ecx, ecx
push ecx
lea eax, [esp + 0x14]
push eax
push ecx
push ecx
push ecx
push dword [esi + 0x70]
call dword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
test eax, eax
jne 0x4363ba
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x1d0
push str.LocalProxy::ProcessStatsAndStatus
push str._s:_d___PeekNamedPipe_failed___d_
push 0
push 0
call fcn.0043a0a0
add esp, 0x18
xor al, al
jmp 0x43652a
mov eax, dword [esp + 0x10]
test eax, eax
je 0x436419
inc eax
push eax
call fcn.004e461a
and dword [esp + 0x18], 0
mov edi, eax
pop ecx
push 0
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
push edi
push dword [esi + 0x70]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x436402
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x1db
push str.LocalProxy::ProcessStatsAndStatus
push str._s:_d___ReadFile_failed___d_
jmp 0x4363a7
mov eax, dword [esp + 0x14]
mov ecx, esi
push edi
mov byte [eax + edi], 0
call fcn.0043686a
push edi
call fcn.004e3e1e
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edi, eax
cmp edi, dword [esi + 0x74]
jae 0x43642a
and dword [esi + 0x74], 0
test bl, bl
jne 0x436451
mov eax, dword [esi + 0x74]
add eax, dword [0x5dede4]
cmp eax, edi
jb 0x436451
mov eax, dword [0x5dede0]
cmp dword [esi + 0x7c], eax
jae 0x436451
cmp dword [esi + 0x84], eax
jb 0x436528
mov ecx, str.non_final
test bl, bl
mov eax, str.final
cmove eax, ecx
push eax
push str.LocalProxy::ProcessStatsAndStatus
push str._s:_Sending__s_stats.
push 1
push 0
call fcn.0043a0a0
mov ecx, dword [esi + 0x24]
lea edx, [esi + 0x80]
add esp, 0x14
mov eax, dword [ecx]
push dword [esi + 0x8c]
push dword [esi + 0x88]
push edx
lea edx, [esi + 0x78]
push edx
push ebx
call dword [eax]
push str.LocalProxy::ProcessStatsAndStatus
test al, al
je 0x436503
push str._s:_Stats_send_success
push 1
push 0
call fcn.0043a0a0
lea eax, [esp + 0x24]
mov dword [0x5dede0], 0x3e8
mov ebx, 0x493e0
push eax
mov dword [0x5dede4], ebx
call fcn.0050cc97
mov eax, dword [esp + 0x28]
lea ecx, [esi + 0x78]
xor edx, edx
add esp, 0x14
div ebx
add dword [0x5dede4], edx
call fcn.00436b96
lea ecx, [esi + 0x80]
call fcn.00436b96
and dword [esi + 0x88], 0
and dword [esi + 0x8c], 0
mov dword [esi + 0x74], edi
jmp 0x436528
push str._s:_Stats_send_failure
push 1
push 0
call fcn.0043a0a0
add dword [0x5dede4], 0x493e0
add esp, 0x10
add dword [0x5dede0], 0x3e8
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4