joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429d40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x4d3fac], 0
push ebx
push esi
push edi
mov esi, edx
jne 0x429e0f
test cl, 8
je 0x429e0f
cmp byte [0x4d4c92], 0
jne 0x429d6f
call fcn.00449ae0
mov eax, dword [0x4d5a14]
test eax, eax
je 0x429d8c
call eax
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x429d8e
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
push esi
push ebx
push str._nK7TSMngr:Execing_task_on_station__lu___s_
call fcn.00419250
push 0x510
mov dword [ebp - 4], 4
call fcn.004609df
mov edi, eax
add esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [edi + 0xc]
push ecx
mov dword [edi], 0x510
mov dword [edi + 8], 0
call esi
push dword [ebp + 8]
lea eax, [edi + 0x40c]
push eax
call esi
lea eax, [ebp - 4]
mov edx, 0x10007
push eax
lea eax, [ebp - 8]
mov ecx, ebx
push eax
push 0x510
push edi
call fcn.00449e90
push 0x510
push edi
lea esi, [eax - 1]
neg esi
sbb esi, esi
inc esi
call fcn.004609d1
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push str._nK7TSMngr:Execing_task_locally__s_
call fcn.00419250
push 0x44
call fcn.004609df
push 0x10
mov ebx, eax
call fcn.004609df
add esp, 0x10
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov edi, eax
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
push edi
push ebx
push dword [ebp + 8]
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
push 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
push 0x20
mov dword [ebx + 0x28], 0
push 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
push 0
mov dword [ebx + 0x34], 0
push 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
push esi
mov dword [ebx + 0x40], 0
push 0
mov dword [ebx], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
mov eax, 1
test esi, esi
push 0x44
push ebx
cmovne esi, eax
call fcn.004609d1
push 0x10
push edi
call fcn.004609d1
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42aeb0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x4d044c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x334], edx
mov esi, ecx
lea edx, [ebp - 0x110]
push edi
mov edi, dword [ebp + 0xc]
sub edx, esi
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x42aee0
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x42af12
mov ecx, edi
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x42af03
jmp 0x42af4d
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x42b08f
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, edi
sub edx, eax
nop dword [eax + eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x42af40
push 6
push 1
push 2
xor ebx, ebx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x42b07c
lea ecx, [ebp - 0x218]
sub ecx, edi
nop
mov al, byte [edi]
lea edi, [edi + 1]
mov byte [ecx + edi - 1], al
test al, al
jne 0x42af70
mov eax, 2
mov word [ebp - 0x228], ax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [ebp - 0x334]
mov dword [ebp - 0x224], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x226], ax
lea eax, [ebp - 0x33c]
push eax
push 0x8004667e
push esi
mov dword [ebp - 0x33c], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 0x10
lea eax, [ebp - 0x228]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x42b070
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x42b075
lea eax, [ebp - 0x338]
mov dword [ebp - 0x10c], esi
push eax
lea eax, [ebp - 0x330]
mov dword [ebp - 0x110], 1
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x32c], esi
push eax
push 0
push 0
mov dword [ebp - 0x330], 1
mov dword [ebp - 0x338], 2
mov dword [ebp - 0x334], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x42b075
mov edi, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
lea eax, [ebp - 0x330]
push eax
push esi
call edi
test eax, eax
jne 0x42b075
lea eax, [ebp - 0x110]
push eax
push esi
call edi
test eax, eax
je 0x42b075
nop word [eax + eax]
mov ebx, 1
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004606ac
mov esp, ebp
pop ebp
ret
Function at 0x42b0b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x344
mov eax, dword [0x4d044c]
xor eax, esp
mov dword [esp + 0x340], eax
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0xc], edi
cmp byte [esi], 0
je 0x42b299
push 0x2c
push esi
call fcn.00490bba
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x42b299
lea edx, [esp + 0x138]
mov byte [ebx], 0
mov ecx, esi
sub edx, esi
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x42b106
lea eax, [esp + 0x138]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x42b136
mov ecx, edi
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x42b127
jmp 0x42b16d
lea eax, [esp + 0x138]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x42b289
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, edi
sub edx, eax
nop dword [eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x42b160
push 6
push 1
push 2
xor edi, edi
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x42b27c
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x240]
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x42b193
mov eax, 2
mov word [esp + 0x20], ax
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [esp + 0x10]
mov dword [esp + 0x28], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x22], ax
lea eax, [esp + 0x14]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x20], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 0x10
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x42b270
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x42b275
lea eax, [esp + 0x18]
mov dword [esp + 0x13c], esi
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x13c], 1
push eax
lea eax, [esp + 0x140]
mov dword [esp + 0x3c], esi
push eax
push 0
push 0
mov dword [esp + 0x44], 1
mov dword [esp + 0x2c], 2
mov dword [esp + 0x30], edi
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x42b275
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x42b275
lea eax, [esp + 0x138]
push eax
push esi
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x42b275
nop dword [eax]
mov edi, 1
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov byte [ebx], 0x2c
test edi, edi
jne 0x42b2be
mov edi, dword [esp + 0xc]
jmp 0x42b28c
mov byte [ebx], 0x2c
cmp byte [ebx + 1], 0
lea esi, [ebx + 1]
jne 0x42b0e3
mov edx, dword [esp + 0x10]
push edi
push ecx
mov ecx, esi
call fcn.0042aeb0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x340]
xor ecx, esp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x34c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
Function at 0x42cfc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x610
mov eax, dword [0x4d044c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
lea edx, [ebp - 0x60c]
push edi
push ebx
push ebx
push ebx
push ebx
mov esi, ecx
mov dword [ebp - 0x608], ebx
push ebx
push ebx
xor ecx, ecx
mov dword [ebp - 0x60c], ebx
mov dword [ebp - 0x610], ebx
call fcn.004385d0
add esp, 0x18
push ebx
push str.SOFTWAREK7_ComputingK7TotalSecurityCommonInfoUpdatesBranchAddon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045e060
mov edi, eax
test edi, edi
je 0x42d031
lea eax, [ebp - 0x610]
push eax
push str.MasterServerComm
push edi
call fcn.0045e500
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 1
jne 0x42d052
cmp dword [ebp - 0x60c], 3
je 0x42d064
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x60c], 3
je 0x42d064
cmp dword [ebp - 0x610], 1
jne 0x42d0a7
push 0
push str.SoftwareK7_ComputingK7TotalSecurity
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 0x204], bl
call fcn.0045e060
mov edi, eax
test edi, edi
je 0x42d09f
push 0x104
lea eax, [ebp - 0x204]
push eax
push str.DirProductBase
push edi
call fcn.0045e550
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x204], bl
jne 0x42d0ba
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
cmp esi, 2
je 0x42d0ec
cmp esi, 3
je 0x42d0ec
push str._updtbranchaddon
push str.K7TSHlpr.exe
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x604]
push str._s_s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
jmp 0x42d117
push str._updtdynlist
push str._updtbranchaddon
push str.K7TSHlpr.exe
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x604]
push str._s_s__s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x608]
push eax
push 0
lea eax, [ebp - 0x604]
push eax
call fcn.0045eb50
mov eax, dword [ebp - 0x608]
test eax, eax
je 0x42d167
push 0x2bf20
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42d156
push 0xffffffffffffffff
push dword [ebp - 0x608]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x42d15b
mov ebx, 1
push dword [ebp - 0x608]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004606ac
mov esp, ebp
pop ebp
ret
Function at 0x42f1f0
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x4d044c]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [0x4d3aec]
push ebx
push esi
push edi
cmp eax, 2
je 0x42f21a
cmp eax, 0xffffffff
jne 0x42f372
mov ecx, 2
mov byte [0x4d3af8], 0
call fcn.0042cfc0
call fcn.00416ca0
mov ecx, 1
call fcn.00417bb0
mov ecx, 1
call fcn.004185c0
cmp dword [0x4d0dd0], 0
je 0x42f372
cmp dword [0x4d3fb4], 0
jne 0x42f267
cmp dword [0x4d3fb8], 0
je 0x42f362
call fcn.00442130
cmp eax, 1
jne 0x42f362
call fcn.00443880
test eax, eax
je 0x42f362
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [esp + 0x14], eax
test eax, eax
je 0x42f35d
push 0xf003f
push str.K7WscShl
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call ebx
test edi, edi
je 0x42f353
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov esi, eax
call ebx
test esi, esi
je 0x42f34c
mov eax, dword [esp + 0x1c]
cmp eax, 4
je 0x42f34c
cmp eax, 2
je 0x42f34c
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov esi, eax
call ebx
test esi, esi
je 0x42f34c
push 0
call fcn.0048baa1
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
add esp, 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x18]
push eax
push edi
call ebx
test eax, eax
je 0x42f34c
mov esi, dword [sym.imp.KERNEL32.dll_SleepEx]
nop dword [eax + eax]
cmp dword [esp + 0x1c], 4
je 0x42f34c
push 0
call fcn.0048baa1
sub eax, dword [esp + 0x14]
add esp, 4
cmp eax, 0x78
ja 0x42f34c
push 1
push 0x14
call esi
lea eax, [esp + 0x18]
push eax
push edi
call ebx
test eax, eax
jne 0x42f320
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.00415d20
cmp byte [0x4d3fac], 0
jne 0x42f372
xor cl, cl
call fcn.0042bdb0
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
Function at 0x4300b0
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov dword [ebp - 4], ecx
push 0x8000
mov dword [ebp - 8], 0
mov dword [edi], 3
call fcn.00460a14
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x430198
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x430163
push 0xf01ff
push dword [ebp - 4]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 4]
test eax, eax
je 0x43015c
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push ecx
push 0x2000
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x43014f
mov eax, dword [ebx + 4]
mov dword [edi], eax
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 1
push ebx
call fcn.004609d1
add esp, 8
cmp dword [ebp - 8], 0
pop esi
je 0x430198
mov eax, dword [edi]
cmp eax, 3
je 0x430186
cmp eax, 4
mov eax, 1
jne 0x43018b
mov eax, 2
mov dword [edi], eax
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, edx
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
mov ebx, ecx
mov edx, dword [ebp - 4]
test edi, edi
je 0x4305de
mov esi, dword [ebp - 8]
nop
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor eax, esi
shrd esi, edx, 8
movzx ecx, al
shr edx, 8
xor esi, dword [ecx*8 + 0x4bebd0]
xor edx, dword [ecx*8 + 0x4bebd4]
sub edi, 1
jne 0x4305b0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4306b0
Capabilities:
Get hostname
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4d044c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
test edi, edi
jne 0x4306d9
lea eax, [ecx + 0x57]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x48]
mov dword [edi], 0
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x48], 0x10
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x430778
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x48], 0
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x4c], 0x10
push eax
lea eax, [ebp - 0x48]
push eax
push 0
lea eax, [ebp - 0x24]
push eax
push 0
call esi
test eax, eax
jne 0x43073e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x7a
jne 0x430780
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
push dword [ebp - 0x48]
call fcn.0048b928
add esp, 4
mov dword [edi], eax
test eax, eax
jne 0x430754
lea esi, [eax + 0xe]
jmp 0x430784
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x4c], 0x10
push ecx
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x48]
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
push 0
call esi
test eax, eax
jne 0x4307ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x430799
mov eax, dword [edi]
test eax, eax
je 0x430799
push eax
call fcn.0048b923
add esp, 4
mov dword [edi], 0
mov eax, esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop edi
call fcn.004606ac
mov esp, ebp
pop ebp
ret
Function at 0x4307c0
Capabilities:
Get hostname
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x4d044c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x40c], 0
test edi, edi
jne 0x43080c
lea eax, [ecx + 0x57]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004606ac
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x410]
mov dword [edi], 0
push eax
lea eax, [ebp - 0x408]
mov dword [ebp - 0x410], 0x200
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x430841
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4308f0
lea eax, [ebp - 0x414]
xorps xmm0, xmm0
push eax
push 0x800
lea eax, [ebp - 0x438]
movq qword [ebp - 0x428], xmm0
push eax
movups xmmword [ebp - 0x438], xmm0
push 0
mov dword [ebp - 0x438], 0x18
call dword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
test eax, eax
jne 0x4308e9
lea ecx, [ebp - 0x408]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x430885
sub ecx, edx
sar ecx, 1
cmp ecx, 0x7ffe
ja 0x43093d
lea eax, [ebp - 0x408]
mov dword [ebp - 0x41c], eax
lea eax, [ecx + ecx]
mov word [ebp - 0x420], ax
add eax, 2
mov word [ebp - 0x41e], ax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_LsaLookupNames2]
test eax, eax
je 0x4308f8
push eax
call dword [sym.imp.ADVAPI32.dll_LsaNtStatusToWinError]
mov esi, eax
test esi, esi
je 0x430957
jmp 0x430942
mov eax, dword [ebp - 0x40c]
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push eax
mov dword [ebp - 0x410], eax
call fcn.0048b928
mov ecx, eax
add esp, 4
mov dword [edi], ecx
test ecx, ecx
jne 0x430923
lea esi, [eax + 0xe]
jmp 0x430942
mov eax, dword [ebp - 0x40c]
push dword [eax + 4]
push ecx
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_CopySid]
xor esi, esi
jmp 0x430957
mov esi, 0x507
mov eax, dword [edi]
test eax, eax
je 0x430957
push eax
call fcn.0048b923
add esp, 4
mov dword [edi], 0
mov eax, dword [ebp - 0x418]
mov edi, dword [sym.imp.ADVAPI32.dll_LsaFreeMemory]
test eax, eax
je 0x43096a
push eax
call edi
mov eax, dword [ebp - 0x40c]
test eax, eax
je 0x430977
push eax
call edi
mov eax, dword [ebp - 0x414]
test eax, eax
je 0x430988
push eax
call dword [sym.imp.ADVAPI32.dll_LsaClose]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004606ac
mov esp, ebp
pop ebp
ret
Function at 0x4309a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, edx
mov dword [ebp - 8], eax
push edi
test esi, esi
jne 0x4309c5
lea eax, [ecx + 0x57]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test al, 7
je 0x4309d5
mov eax, 9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
call fcn.004306b0
test eax, eax
je 0x4309f4
lea ecx, [ebp - 4]
call fcn.004307c0
mov edi, eax
test edi, edi
je 0x4309f4
mov ebx, dword [ebp - 4]
jmp 0x430a34
mov ebx, dword [ebp - 4]
push ebx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov edx, eax
mov ecx, ebx
call fcn.00430590
mov ecx, dword [ebp + 0xc]
add ecx, eax
mov eax, dword [ebp + 0x10]
adc eax, edx
mov edx, dword [ebp - 8]
test edx, edx
je 0x430a32
dec edx
shr edx, 3
inc edx
nop dword [eax]
xor dword [esi + 4], ecx
lea esi, [esi + 8]
xor dword [esi - 8], eax
add ecx, eax
add eax, ecx
sub edx, 1
jne 0x430a20
xor edi, edi
test ebx, ebx
je 0x430a41
push ebx
call fcn.0048b923
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432480
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x4d044c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x800
mov dword [ebp - 0x814], eax
mov esi, ecx
lea eax, [ebp - 0x804]
mov dword [ebp - 0x80c], edx
push ebx
push eax
mov dword [ebp - 0x818], esi
mov dword [ebp - 0x810], edi
call fcn.004644e0
push dword [ebp - 0x80c]
lea eax, [ebp - 0x804]
mov dword [ebp - 0x808], 0x280
push str.GetNetworkAdapterInfo
push str.Entering__s_with_Adapter_GUID__s
push 0x800
push eax
call fcn.00431b30
add esp, 0x20
test esi, esi
je 0x43263a
mov esi, dword [esi]
test esi, esi
jne 0x43259e
push 0x280
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x43263a
lea eax, [ebp - 0x808]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x432565
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x808]
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x43263a
lea eax, [ebp - 0x808]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
je 0x432596
push eax
push str.GetAdaptersInfo_Failed_with_error_code__d_n
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.00431b30
add esp, 0x10
jmp 0x43263a
mov eax, dword [ebp - 0x818]
mov dword [eax], esi
mov dword [edi], ebx
test esi, esi
je 0x43263a
test ebx, ebx
jne 0x432634
push dword [ebp - 0x80c]
lea edi, [esi + 8]
push edi
call fcn.0048b841
add esp, 8
test eax, eax
sete bl
test eax, eax
jne 0x43262a
push 1
push dword [esi + 0x190]
call fcn.0048e95f
mov ecx, dword [ebp - 0x810]
add esp, 8
mov dword [ecx], eax
test eax, eax
je 0x432634
mov edx, dword [ebp - 0x814]
mov eax, dword [esi + 0x190]
mov dword [edx], eax
lea eax, [esi + 0x194]
push dword [esi + 0x190]
push eax
push dword [ecx]
call fcn.0046c5d0
lea eax, [esi + 0x10c]
push eax
push edi
push str._tAdapter_Name:__t_S_n_tAdapter_Desc:__t_S_n_t
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.00431b30
add esp, 0x20
mov esi, dword [esi]
test esi, esi
jne 0x4325a8
mov edi, dword [ebp - 0x810]
push dword [ebp - 0x814]
lea eax, [ebp - 0x804]
push edi
push str.GetNetworkAdapterInfo
push str.Exiting__s_returned__X_with_Length__d
push 0x800
push eax
call fcn.00431b30
mov ecx, dword [ebp - 4]
add esp, 0x18
mov eax, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004606ac
mov esp, ebp
pop ebp
ret