joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461cab
Capabilities:
Check http status code

Disassembly:
mov eax, 0x66d28b
call fcn.006313fc
sub esp, 0x44
push ebx
push ebp
push esi
push 4
pop ebp
lea eax, [esp + 0x14]
mov dword [esp + 0xc], ebp
push eax
lea eax, [esp + 0x10]
mov esi, ecx
push eax
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
push 0x20000013
push dword [esi]
mov dword [esp + 0x28], ebx
call dword [0x75e0a8]
test eax, eax
je 0x461d2f
cmp dword [esp + 0x10], 0xc8
je 0x461d2f
push dword [esp + 0x10]
lea eax, [esp + 0x3c]
push str.HTTP_Reply__d
push eax
call fcn.0047224d
add esp, 0xc
cmp dword [eax + 0x14], 8
mov dword [esp + 0x58], ebx
jb 0x461d16
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.00461c76
push ebx
push 1
lea ecx, [esp + 0x40]
call fcn.0042341c
jmp 0x461dfb
push edi
xor eax, eax
mov byte [esp + 0x28], bl
lea edi, [esp + 0x29]
mov dword [esp + 0x10], 0x14
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x30]
push eax
push 0x1d
push dword [esi]
call dword [0x75e0a8]
test eax, eax
je 0x461d7f
lea eax, [esp + 0x28]
push str.gzip
push eax
call fcn.00638078
pop ecx
pop ecx
test eax, eax
jne 0x461d7f
or byte [esi + 0x25], 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x10], 0x20
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x20], ebx
push eax
lea eax, [esi + 5]
push eax
push 1
push dword [esi]
call dword [0x75e0a8]
push ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ebp
push eax
lea eax, [esp + 0x2c]
push eax
push 0x20000005
push dword [esi]
call dword [0x75e0a8]
test eax, eax
je 0x461dcd
mov eax, dword [esp + 0x24]
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], ebx
push 0xa
pop ecx
xor eax, eax
lea edi, [esi + 0x2c]
rep stosd dword es:[edi], eax
mov edi, 0x2000
mov dword [esi + 0x2c], 0x28
push edi
call fcn.0045d923
mov ecx, esi
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], edi
mov byte [esi + 4], 1
call fcn.00461e4e
pop edi
mov ecx, dword [esp + 0x50]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x466e60
Capabilities:
Create thread

Disassembly:
mov eax, 0x66daac
call fcn.006313fc
sub esp, 0x14
and dword [ebp - 0x10], 0
push esi
push edi
mov edi, dword [ebp + 0x20]
test edi, edi
jne 0x466e7d
lea edi, [ebp - 0x10]
push edi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, dword [edi]
mov esi, eax
mov edi, 0x75e1f4
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 8]
push edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], edi
mov byte [ebp - 0x1c], 1
call fcn.00466f49
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
push 0x75e1dc
call fcn.00466432
push edi
call fcn.0046703c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x46818d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, dword [0x73b330]
cmp esi, 0x270
jl 0x468252
xor esi, esi
push ebx
mov edx, esi
mov ebx, SysReAllocString
mov ecx, dword [edx*4 + 0x75e37c]
xor ecx, dword [edx*4 + 0x75e378]
and ecx, ebx
xor ecx, dword [edx*4 + 0x75e378]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x73b538]
xor ecx, dword [edx*4 + 0x75e9ac]
mov dword [edx*4 + 0x75e378], ecx
inc edx
cmp edx, 0xe3
jl 0x4681aa
cmp edx, 0x26f
jge 0x468223
push edi
lea edi, [edx*4 + 0x75e378]
mov ecx, dword [edi]
xor ecx, dword [edi + 4]
and ecx, ebx
xor ecx, dword [edi]
mov eax, ecx
shr ecx, 1
and eax, 1
mov eax, dword [eax*4 + 0x73b538]
xor eax, dword [edi - 0x38c]
xor eax, ecx
mov dword [edi], eax
add edi, 4
cmp edi, 0x75ed34
jl 0x4681f6
pop edi
mov ecx, dword [0x75e378]
xor ecx, dword [0x75ed34]
and ecx, ebx
xor ecx, dword [0x75ed34]
mov eax, ecx
shr ecx, 1
and eax, 1
pop ebx
xor ecx, dword [eax*4 + 0x73b538]
xor ecx, dword [0x75e9a8]
mov dword [0x75ed34], ecx
mov ecx, dword [esi*4 + 0x75e378]
mov eax, ecx
shr eax, 0xb
inc esi
xor ecx, eax
mov dword [0x73b330], esi
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop esi
ret

Function at 0x4682d4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
mov dword [0x75e378], eax
inc edx
mov ecx, 0x75e378
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x75ed34
jl 0x4682e5
mov dword [0x73b330], edx
ret 4

Function at 0x468f55
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x468f8b
xor eax, eax
cmp dword [ebp + 0x14], eax
je 0x468f70
inc eax
cmp dword [ebp + 0x18], 0
je 0x468f79
or eax, 2
test ecx, eax
je 0x468f8b
not eax
and eax, ecx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
pop ebp
ret 0x14
Function at 0x469277
Capabilities:
Copy file

Disassembly:
mov eax, 0x66dd37
call fcn.006313fc
sub esp, 0xcc
push ebx
push ebp
mov ebp, dword [esp + 0xe8]
push esi
mov esi, dword [esp + 0xf0]
push edi
push dword [esp + 0xfc]
mov edi, dword [esp + 0xfc]
push esi
push ebp
and dword [edi], 0
call fcn.00460a7d
mov ebx, eax
test ebx, ebx
jne 0x4692d0
push ebp
call fcn.0045e93a
xor ecx, ecx
test al, al
setne cl
add ecx, 2
xor eax, eax
mov dword [edi], ecx
jmp 0x46941f
cmp byte [ebx], 0x64
jne 0x46941d
cmp dword [esi], 0x39
jb 0x46941d
push 0x11
push str.d10:.fileguard40:
push ebx
call fcn.006342b2
add esp, 0xc
test eax, eax
je 0x46930e
push 0x11
push str.d10:file_guard40:
push ebx
call fcn.006342b2
add esp, 0xc
test eax, eax
jne 0x46941d
push 0xa
pop ecx
push 1
push 0x28
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x34]
lea esi, [ebx + 0x11]
lea edi, [esp + 0x48]
rep movsd dword es:[edi], dword [esi]
push eax
mov byte [esp + 0x74], 0
call fcn.0046c175
test al, al
jne 0x469340
mov eax, str.malformed_guard
jmp 0x4693ce
mov esi, dword [esp + 0xf4]
add dword [esi], 0xffffffc8
mov eax, dword [esi]
dec eax
push eax
lea eax, [ebx + 0x39]
push eax
lea eax, [ebx + 1]
push eax
call fcn.00630c90
mov eax, dword [esi]
lea ecx, [esp + 0x74]
add esp, 0xc
mov byte [ebx + eax], 0
call fcn.0046638e
push dword [esi]
and dword [esp + 0xe8], 0
lea ecx, [esp + 0x6c]
push ebx
call fcn.0046632a
mov edx, eax
lea esi, [esp + 0x28]
xor ecx, ecx
mov eax, dword [esi + ecx*4]
cmp eax, dword [edx + ecx*4]
jne 0x4693b8
inc ecx
cmp ecx, 5
jne 0x469389
push ebp
push str.File_passed_integrity_check:__s
call fcn.00409edb
or dword [esp + 0xec], 0xffffffff
lea ecx, [esp + 0x70]
add esp, 8
call fcn.00409edb
jmp 0x46941d
or dword [esp + 0xe4], 0xffffffff
lea ecx, [esp + 0x68]
call fcn.00409edb
mov eax, str.hash_doesnt_match
push ebp
push eax
push str.Warning:_file_integrity_check_failed___s_:__s
call fcn.004790ad
push str.Ignore_this_warning_if_you_switched_to_1.6.1_or_older_and_back
call fcn.004790ad
add esp, 0x10
lea eax, [esp + 0x10]
push 0x695f58
push ebp
push eax
call fcn.0046963e
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x469406
lea eax, [esp + 0x10]
push 0
push eax
push ebp
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.0042341c
mov eax, ebx
mov ecx, dword [esp + 0xdc]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x46b083
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov esi, eax
test esi, esi
jne 0x46b0c3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x46b0c3
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov esi, eax
mov eax, esi
pop esi
ret 4
Function at 0x46c5f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x669663
call fcn.006313fc
sub esp, 0x18
push edi
mov edi, dword [esp + 0x34]
cmp edi, 0x14
ja 0x46c613
mov eax, dword [esp + 0x30]
mov byte [eax], 0
jmp 0x46c7a4
push esi
mov esi, dword [esp + 0x3c]
lea eax, [esi + 0x38]
cmp dword [eax + 0x14], 0x10
jb 0x46c623
mov eax, dword [eax]
push ebx
mov ebx, dword [esp + 0x38]
push eax
lea eax, [esi + 0x1d]
push eax
push str.magnet:_xturn:btih:_Hdn_U
push edi
push ebx
call fcn.00471605
add ebx, eax
sub edi, eax
mov eax, dword [esi + 0xa0]
add esp, 0x14
sub eax, dword [esi + 0x9c]
je 0x46c6a5
mov eax, dword [esi + 0xa0]
sub eax, dword [esi + 0x9c]
push eax
push dword [esi + 0x9c]
lea eax, [esp + 0x14]
push eax
call fcn.0046c20e
and dword [esp + 0x2c], 0
cmp dword [esp + 0x20], 0x10
mov eax, dword [esp + 0xc]
jae 0x46c67f
lea eax, [esp + 0xc]
push eax
push str.key_s
push edi
push ebx
call fcn.00471605
or dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x1c]
add esp, 0x10
add ebx, eax
sub edi, eax
push 0
push 1
call fcn.0040a0e9
mov eax, dword [esi + 0x88]
sub eax, dword [esi + 0x84]
push ebp
push 0x18
pop ecx
cdq
idiv ecx
and dword [esp + 0x3c], 0
mov dword [esp + 0x40], ecx
test eax, eax
je 0x46c71a
xor ebp, ebp
mov eax, dword [esi + 0x84]
add eax, ebp
cmp dword [eax + 0x14], 0x10
jb 0x46c6d7
mov eax, dword [eax]
push eax
push str.tr_U
push edi
push ebx
call fcn.00471605
sub edi, eax
add esp, 0x10
add ebx, eax
cmp edi, 1
jbe 0x46c7a1
push 0x18
pop eax
add ebp, eax
mov ecx, dword [esp + 0x3c]
mov eax, dword [esi + 0x88]
inc ecx
sub eax, dword [esi + 0x84]
cdq
idiv dword [esp + 0x40]
mov dword [esp + 0x3c], ecx
cmp ecx, eax
jb 0x46c6c7
push 0x18
pop ecx
mov eax, dword [esi + 0x94]
sub eax, dword [esi + 0x90]
cdq
idiv ecx
and dword [esp + 0x3c], 0
test eax, eax
je 0x46c780
xor ebp, ebp
mov eax, dword [esi + 0x90]
add eax, ebp
cmp dword [eax + 0x14], 0x10
jb 0x46c744
mov eax, dword [eax]
push eax
push str.ws_U
push edi
push ebx
call fcn.00471605
sub edi, eax
add esp, 0x10
add ebx, eax
cmp edi, 1
jbe 0x46c7a1
push 0x18
pop eax
add ebp, eax
mov ecx, dword [esp + 0x3c]
mov eax, dword [esi + 0x94]
inc ecx
sub eax, dword [esi + 0x90]
cdq
idiv dword [esp + 0x40]
mov dword [esp + 0x3c], ecx
cmp ecx, eax
jb 0x46c734
cmp dword [esi + 0x78], 0
je 0x46c7a1
add esi, 0x68
cmp dword [esi + 0x14], 0x10
jb 0x46c791
mov esi, dword [esi]
push esi
push str.as_U
push edi
push ebx
call fcn.00471605
add esp, 0x10
pop ebp
pop ebx
pop esi
mov ecx, dword [esp + 0x1c]
pop edi
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x46e2e7
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x66e1d4
call fcn.006313fc
push ecx
push ecx
push ebp
push esi
push edi
xor edx, edx
lea edi, [ecx + 0xeb4]
cmp dword [edi + 0x14], 8
mov dword [esp + 0xc], edx
jb 0x46e30c
mov eax, dword [edi]
jmp 0x46e30e
mov eax, edi
push edx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
xor ecx, ecx
mov ebp, eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0061c0ee
mov esi, eax
pop ecx
mov dword [esp + 0x10], esi
and dword [esp + 0x1c], 0
cmp dword [edi + 0x14], 8
jb 0x46e341
mov edi, dword [edi]
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
mov ecx, dword [esp + 0x28]
push esi
call fcn.004249e7
test esi, esi
je 0x46e35f
push esi
call fcn.006341e9
pop ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4755e9
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0xffffffff
je 0x4756eb
push ebp
xor ebp, ebp
inc ebp
cmp byte [esp + 0x10], 0
je 0x475628
xor eax, eax
mov word [esp + 0x10], bp
push 4
mov word [esp + 0x16], ax
lea eax, [esp + 0x14]
push eax
push 0x80
push 0xffff
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_setsockopt]
test byte [edi + 0xe], 0x20
je 0x4756b7
mov ecx, dword [edi + 0x54]
test ecx, ecx
jns 0x47563d
neg ecx
jmp 0x47563f
xor ecx, ecx
mov esi, dword [edi + 0x90]
test esi, esi
jns 0x47564d
neg esi
jmp 0x47564f
xor esi, esi
xor eax, eax
push ebx
mov dword [esp + 0x14], eax
cmp dword [edi + 0xf4], eax
jle 0x475688
lea ebp, [edi + 0xe0]
mov ebx, dword [ebp]
test ebx, ebx
je 0x475678
mov eax, ecx
cdq
add dword [ebx + 0x2c], eax
mov eax, dword [esp + 0x14]
adc dword [ebx + 0x30], edx
inc eax
add ebp, 4
mov dword [esp + 0x14], eax
cmp eax, dword [edi + 0xf4]
jl 0x475664
xor ebp, ebp
cmp dword [edi + 0xf4], ebp
jle 0x4756b3
lea ebx, [edi + 0xe0]
mov ecx, dword [ebx]
test ecx, ecx
je 0x4756a7
mov eax, esi
cdq
add dword [ecx + 0x34], eax
adc dword [ecx + 0x38], edx
inc ebp
add ebx, 4
cmp ebp, dword [edi + 0xf4]
jl 0x475698
xor ebp, ebp
inc ebp
pop ebx
push dword [edi + 4]
call fcn.00476f79
or dword [edi + 4], 0xffffffff
test byte [edi + 0xe], 0x20
je 0x4756ea
cmp byte [edi + 0x18], 6
jb 0x4756ea
push ebp
push 2
push 0x40
lea ecx, [edi + 0x4c]
call fcn.004736a6
push 0
push 2
push 0x40
lea ecx, [edi + 0x4c]
call fcn.004736a6
pop ebp
and byte [edi + 0xe], 0xdf
test byte [edi + 0xe], 0x80
je 0x475714
mov esi, dword [edi + 0xf8]
and dword [edi + 0xf8], 0
test esi, esi
je 0x475714
push esi
call fcn.004dcaae
push 0
push esi
call fcn.004dd429
pop edi
pop esi
ret 4
Function at 0x476266
Capabilities:
Terminate process

Disassembly:
mov eax, 0x66d28b
call fcn.006313fc
sub esp, 0x18
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call fcn.0047a1e1
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x47628b
mov eax, dword [eax]
push eax
push 0x689854
push 0x10
call fcn.0049166b
add esp, 0xc
lea ecx, [ebp - 0x24]
push 0
push 1
call fcn.0042341c
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x47685f
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_getsockname]
mov ecx, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x476892
call fcn.004c61dc
jmp 0x47689e
lea eax, [ebp - 0x84]
push eax
call fcn.004c6122
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x476996
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
cmp dword [ecx + 4], 0xffffffff
jne 0x4769aa
or eax, 0xffffffff
jmp 0x4769dd
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x98]
push eax
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x4769a5
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x18]
call fcn.004c6122
movzx eax, word [eax + 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x476a62
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ebx, ecx
push 0
push 0
push 1
push ebp
call fcn.004662da
movzx eax, al
mov ecx, ebx
neg eax
sbb eax, eax
and eax, 0xffffffeb
add eax, 0x17
push eax
call fcn.00476c1d
cmp dword [ebx + 4], 0xffffffff
jne 0x476a9b
xor al, al
jmp 0x476b7e
cmp byte [esp + 0x24], 0
push esi
push edi
mov dword [esp + 0x28], 1
je 0x476af0
push 4
lea eax, [esp + 0x2c]
push eax
push 4
push 0xffff
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x476af0
call fcn.00635bba
mov esi, eax
call fcn.00635bba
push dword [esi]
mov edi, eax
call fcn.00639401
push eax
push dword [edi]
push dword [ebx + 4]
push str.Cant_set_SO_REUSEADDR_option_on_socket__d____d__s
call fcn.00479036
add esp, 0x14
push ebp
mov ecx, ebx
call fcn.004751a3
cmp eax, 0xffffffff
jne 0x476b40
cmp byte [esp + 0x2c], 0
mov edi, 0x2740
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
jne 0x476b15
call esi
cmp eax, edi
je 0x476b72
call esi
cmp eax, edi
jne 0x476b72
push 5
pop ecx
xor eax, eax
lea edi, [esp + 0x10]
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
mov word [esp + 0x20], ax
mov ecx, ebx
lea eax, [esp + 0x10]
push eax
call fcn.004751a3
cmp eax, 0xffffffff
je 0x476b72
jmp 0x476b51
push ebp
push dword [ebx + 4]
push str.Bound_listening_socket__d_to_IP__A
call fcn.00479036
add esp, 0xc
push 0xa
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x476b76
push ebp
push dword [ebx + 4]
push str.Cant_listen_on_socket__d_IP__A
call fcn.00479036
add esp, 0xc
xor al, al
jmp 0x476b7c
mov byte [ebx + 0xe], 0
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x4788c2
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
mov eax, 0x66e79c
call fcn.006313fc
sub esp, 0x40
push ebx
push edi
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
push 0x690b18
push 1
push ebx
push 0x690b08
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x4789f7
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push edx
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 1
call dword [ecx + 0x1c]
mov edi, eax
test edi, edi
js 0x4789e7
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push edx
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 2
call dword [ecx + 0x1c]
mov edi, eax
test edi, edi
js 0x4789d6
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push edx
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 3
call dword [ecx + 0x50]
mov edi, eax
mov eax, dword [ebp - 0x10]
test edi, edi
js 0x4789c8
test eax, eax
jne 0x47895e
mov edi, 0x80004005
jmp 0x4789c8
push dword [ebp + 8]
lea ecx, [ebp - 0x4c]
call fcn.004249e7
push eax
lea eax, [ebp - 0x34]
mov byte [ebp - 4], 4
push eax
call fcn.0043d0b6
cmp dword [eax + 0x14], 8
jb 0x47897f
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp + 8], esi
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.0042341c
push ebx
push 1
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 6
call fcn.0042341c
mov eax, dword [ebp - 0x10]
test esi, esi
jne 0x4789b4
mov edi, 0x8007000e
jmp 0x4789c7
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x24]
push esi
mov edi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x10]
pop esi
mov byte [ebp - 4], 2
test eax, eax
je 0x4789d6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 1
test eax, eax
je 0x4789e7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], bl
test eax, eax
je 0x4789f7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x478a08
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x479a81
Capabilities:
Check if file exists
Get common file path
Get disk information

Disassembly:
mov eax, 0x66e89b
call fcn.006313fc
sub esp, 0x414
push ebx
push esi
push edi
push 0x104
xor ecx, ecx
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x434], ecx
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x10]
push 0x68aba4
push eax
lea eax, [esp + 0x220]
push eax
call ebx
mov edi, dword [esp + 0x434]
mov ecx, edi
push eax
call fcn.004249e7
and dword [esp + 0x428], 0
cmp dword [edi + 0x14], 8
mov dword [esp + 0xc], 1
jb 0x479b00
mov eax, dword [edi]
jmp 0x479b02
mov eax, edi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
test eax, eax
setne al
test al, al
jne 0x479bbd
push ebp
mov ebp, 0x68abc0
push ebp
call fcn.004236bc
pop ecx
push eax
push ebp
mov ecx, edi
call fcn.004234f9
cmp dword [edi + 0x14], 8
pop ebp
jb 0x479b39
mov eax, dword [edi]
jmp 0x479b3b
mov eax, edi
push eax
call esi
test eax, eax
setne al
test al, al
jne 0x479bbd
push 1
push 0x1a
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x479bb1
call fcn.00490b0d
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x220]
push eax
call ebx
mov esi, eax
push esi
call fcn.004236bc
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00434a57
cmp dword [edi + 0x14], 8
jb 0x479b8d
mov eax, dword [edi]
jmp 0x479b8f
mov eax, edi
push 0x68aba4
push eax
lea eax, [esp + 0x220]
push eax
call ebx
mov esi, eax
push esi
call fcn.004236bc
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00434a57
mov eax, dword [esp + 0x438]
mov byte [eax], 0
jmp 0x479bdf
cmp dword [edi + 0x14], 8
jb 0x479bc7
mov eax, dword [edi]
jmp 0x479bc9
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
mov ecx, dword [esp + 0x438]
cmp eax, 2
sete dl
or byte [ecx], dl
mov ecx, dword [esp + 0x420]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x47dc97
Capabilities:
Reference l3 dns server

Disassembly:
mov eax, 0x66eb9c
call fcn.006313fc
sub esp, 0x80
cmp byte [ebp + 8], 2
jne 0x47dce1
mov eax, dword [0x763970]
test al, 1
jne 0x47dcd0
or eax, 1
push str.4.2.2.1
mov dword [0x763970], eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x76396c], eax
jmp 0x47dcd5
mov eax, dword [0x76396c]
push dword [ebp + 0xc]
push eax
call dword [0x763950]
jmp 0x47dd3e
cmp dword [0x763954], 0
jne 0x47dcf1
mov eax, 0x2741
jmp 0x47dd3e
mov eax, dword [0x763970]
push edi
mov edi, 0x763974
test al, 2
jne 0x47dd1d
or eax, 2
mov dword [0x763970], eax
and dword [ebp - 4], 0
push 0
push str.2001:db8::1428:57ab
push edi
call fcn.004c687b
or dword [ebp - 4], 0xffffffff
push 0
lea eax, [ebp - 0x8c]
mov ecx, edi
push eax
call fcn.004768a7
push dword [ebp + 0xc]
lea eax, [ebp - 0x8c]
push eax
call dword [0x763954]
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8