joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4219f0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x420
push ebp
push esi
push edi
mov esi, ecx
call fcn.00424270
test eax, eax
jne 0x421a0e
pop edi
pop esi
pop ebp
add esp, 0x420
ret
mov ebp, dword [sym.imp.USER32.dll_GetKeyboardState]
mov ecx, 0x47
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x10], 0x114d
mov dword [esp + 0x1c], 0x101
call ebp
push 0
lea ecx, [esp + 0x10]
push 0x11c
push ecx
mov ecx, dword [esi + 0x5a74]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], 0xa5
call fcn.00442430
test eax, eax
jne 0x421a79
pop edi
pop esi
pop ebp
add esp, 0x420
ret
mov ecx, dword [esi + 0x5a74]
push 0
lea edx, [esp + 0x10]
push 0x11c
push edx
mov dword [esp + 0x1c], 0xa4
call fcn.00442430
test eax, eax
jne 0x421aa6
pop edi
pop esi
pop ebp
add esp, 0x420
ret
mov ecx, dword [esi + 0x5a74]
push 0
lea eax, [esp + 0x10]
push 0x11c
push eax
mov dword [esp + 0x1c], 0x12
call fcn.00442430
test eax, eax
jne 0x421ad3
pop edi
pop esi
pop ebp
add esp, 0x420
ret
push 0
lea ecx, [esp + 0x10]
push 0x11c
push ecx
mov ecx, dword [esi + 0x5a74]
mov dword [esp + 0x1c], 0xa2
call fcn.00442430
test eax, eax
jne 0x421b00
pop edi
pop esi
pop ebp
add esp, 0x420
ret
mov ecx, dword [esi + 0x5a74]
push 0
lea edx, [esp + 0x10]
push 0x11c
push edx
mov dword [esp + 0x1c], 0xa0
call fcn.00442430
test eax, eax
jne 0x421b2d
pop edi
pop esi
pop ebp
add esp, 0x420
ret
mov ecx, dword [esi + 0x5a74]
push 0
lea eax, [esp + 0x10]
push 0x11c
push eax
mov dword [esp + 0x1c], 0xa3
call fcn.00442430
test eax, eax
jne 0x421b5a
pop edi
pop esi
pop ebp
add esp, 0x420
ret
push 0
lea ecx, [esp + 0x10]
push 0x11c
push ecx
mov ecx, dword [esi + 0x5a74]
mov dword [esp + 0x1c], 0xa1
call fcn.00442430
test eax, eax
jne 0x421b87
pop edi
pop esi
pop ebp
add esp, 0x420
ret
mov ecx, dword [esi + 0x5a74]
push 0
lea edx, [esp + 0x10]
push 0x11c
push edx
mov dword [esp + 0x1c], 0x10
call fcn.00442430
test eax, eax
jne 0x421bb4
pop edi
pop esi
pop ebp
add esp, 0x420
ret
mov ecx, dword [esi + 0x5a74]
push 0
lea eax, [esp + 0x10]
push 0x11c
push eax
mov dword [esp + 0x1c], 0x11
call fcn.00442430
test eax, eax
jne 0x421be1
pop edi
pop esi
pop ebp
add esp, 0x420
ret
mov ecx, 0xc1
xor eax, eax
lea edi, [esp + 0x128]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x12c]
mov dword [esp + 0x128], 0xd80
push ecx
call ebp
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x14
call edi
and al, 1
push 0x90
mov byte [esp + 0x144], al
call edi
and al, 1
push 0x91
mov byte [esp + 0x1c0], al
call edi
and al, 1
push 0x15
mov byte [esp + 0x1c1], al
call edi
mov ecx, dword [esi + 0x5a74]
push 0
lea edx, [esp + 0x12c]
and al, 1
push 0x304
push edx
mov byte [esp + 0x14d], al
call fcn.00442430
test eax, eax
jne 0x421c7b
mov ecx, dword [esi + 0x5a74]
call fcn.00442080
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x420
ret
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x420
ret
Function at 0x424810
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0x114
push ebx
push edi
mov ebx, ecx
xor edi, edi
call fcn.00424f90
mov ecx, ebx
call fcn.00424ae0
mov eax, dword [esp + 0x120]
push edi
push edi
push 0xffffffffffffffff
push eax
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
cmp ax, 0xffff
jne 0x424854
mov ecx, ebx
call fcn.00424e30
pop edi
xor eax, eax
pop ebx
add esp, 0x114
ret 4
cmp ax, di
push esi
jbe 0x424916
and eax, 0xffff
push ebp
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x128]
lea ecx, [esp + 0x1c]
push 0x106
push ecx
push edx
push eax
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
test eax, eax
jbe 0x4248fd
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.00511c2c
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x4248fd
lea edx, [esp + 0x1c]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [ebx + 0x6c78]
push 0xc
mov edi, dword [esi + 4]
call fcn.00511c2c
add esp, 4
mov ecx, esi
test esi, esi
jne 0x4248cf
mov ecx, eax
test edi, edi
mov dword [eax], ecx
jne 0x4248d7
mov edi, eax
mov dword [eax + 4], edi
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
add eax, 8
test eax, eax
je 0x4248eb
mov dword [eax], ebp
mov eax, dword [ebx + 0x6c7c]
mov edi, 1
inc eax
mov dword [ebx + 0x6c7c], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
inc ecx
dec eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jne 0x42486c
pop ebp
lea edx, [esp + 0x14]
push edx
push 4
push ebx
push 0x450260
push 0
push 0
call fcn.00461973
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x424939
xor edi, edi
jmp 0x424954
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x42495b
mov ecx, ebx
call fcn.00424e30
mov eax, edi
pop esi
pop edi
pop ebx
add esp, 0x114
ret 4
Function at 0x424970
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
xor ebp, ebp
mov ebx, ecx
cmp esi, ebp
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebp
je 0x424ac9
cmp dword [esp + 0x24], ebp
je 0x424ac9
call fcn.00424f90
mov ecx, ebx
call fcn.00424ae0
mov eax, dword [esi + 8]
cmp eax, 0xffff
jae 0x424ac2
cmp eax, ebp
je 0x424ac2
mov dword [esp + 0x14], ebp
jbe 0x424a5e
push edi
mov eax, dword [esp + 0x28]
lea esi, [eax + ebp]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0x10
push eax
call fcn.00511c2c
mov edi, eax
add esp, 4
test edi, edi
je 0x424a38
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [ebx + 0x6c78]
push 0xc
mov ebx, dword [esi + 4]
call fcn.00511c2c
add esp, 4
mov ecx, esi
test esi, esi
jne 0x424a08
mov ecx, eax
test ebx, ebx
mov dword [eax], ecx
jne 0x424a10
mov ebx, eax
mov dword [eax + 4], ebx
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
add eax, 8
test eax, eax
je 0x424a24
mov dword [eax], edi
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], 1
mov ebx, eax
inc dword [eax + 0x6c7c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0x24]
lea ebp, [eax + ebp + 1]
mov eax, dword [esp + 0x18]
mov ecx, dword [edx + 8]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jb 0x4249c5
xor ebp, ebp
pop edi
lea eax, [esp + 0x18]
push eax
push 4
push ebx
push 0x450260
push ebp
push ebp
call fcn.00461973
mov esi, eax
add esp, 0x18
cmp esi, ebp
jne 0x424a91
mov ecx, ebx
mov dword [esp + 0xc], ebp
call fcn.00424e30
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0xc], ebp
jne 0x424ab5
mov ecx, ebx
call fcn.00424e30
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov ecx, ebx
call fcn.00424e30
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x424b50
Capabilities:
Copy file
Get common file path
Move file

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
mov eax, dword [esi + 0x17e0]
mov ecx, dword [eax + 0x118]
test ecx, ecx
jne 0x424dbf
mov eax, dword [esi + 0x69a0]
push ebx
test eax, eax
push edi
jne 0x424b9b
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
test eax, eax
mov dword [esi + 0x69a0], eax
jne 0x424b9b
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
call edi
mov dword [esi + 0x69a0], eax
call fcn.00435840
test eax, eax
jne 0x424ce9
mov eax, dword [esi + 0x69c4]
test eax, eax
jne 0x424c9e
push ebp
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.00433ca0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 8
lea edx, [esp + 0x10]
push 0x590d18
push edx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x114]
push 0x104
push eax
call ebx
lea ecx, [esp + 0x114]
push 0x590d08
push ecx
call edi
lea edx, [esp + 0x10]
lea eax, [esp + 0x114]
push edx
push eax
call fcn.00435db0
add esp, 8
test eax, eax
jne 0x424c74
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x114]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call ebp
test eax, eax
jne 0x424c74
lea eax, [esp + 0x10]
push 0x104
push eax
call ebx
lea ecx, [esp + 0x10]
push 0x590d18
push ecx
call edi
lea edx, [esp + 0x114]
push 0
lea eax, [esp + 0x14]
push edx
push eax
call ebp
test eax, eax
je 0x424c74
lea ecx, [esp + 0x114]
push 5
lea edx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [esp + 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x69c4], eax
pop ebp
jne 0x424c9e
push 0x590cf8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0x69c4], eax
mov eax, dword [esi + 0x69c4]
test eax, eax
je 0x424dac
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x590ce0
push eax
call ebx
mov ecx, dword [esi + 0x69c4]
push 0x590ccc
push ecx
mov edi, eax
call ebx
test edi, edi
mov ebx, eax
je 0x424cda
call edi
test eax, eax
jne 0x424dac
test ebx, ebx
je 0x424dac
call ebx
jmp 0x424dac
lea edx, [esp + 0xc]
push 0x104
push edx
call fcn.00433ca0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 8
lea eax, [esp + 0xc]
push 0x590cbc
push eax
call edi
lea ecx, [esp + 0x110]
push 0x104
push ecx
call fcn.00435880
add esp, 8
lea edx, [esp + 0x110]
push 0x590ca8
push edx
call edi
lea eax, [esp + 0xc]
lea ecx, [esp + 0x110]
push eax
push ecx
call fcn.00435db0
add esp, 8
test eax, eax
jne 0x424dac
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileA]
push eax
lea edx, [esp + 0x114]
lea eax, [esp + 0x10]
push edx
push eax
call ebx
test eax, eax
jne 0x424dac
lea ecx, [esp + 0xc]
push 0x104
push ecx
call fcn.00435880
add esp, 8
lea edx, [esp + 0xc]
push 0x590cbc
push edx
call edi
lea eax, [esp + 0x110]
push 0
lea ecx, [esp + 0x10]
push eax
push ecx
call ebx
test eax, eax
je 0x424dac
lea edx, [esp + 0x110]
push 5
lea eax, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov eax, dword [esi + 0x69b8]
pop edi
test eax, eax
pop ebx
jne 0x424dbf
mov ecx, esi
call fcn.00425330
pop esi
add esp, 0x208
ret
Function at 0x425330
Capabilities:
Create thread

Disassembly:
sub esp, 0x22c
push ebx
mov ebx, ecx
mov cl, byte [0x5a17b0]
lea eax, [esp + 0x14]
push edi
mov dword [esp + 0x10], eax
mov byte [esp + 0x2c], cl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebx + 0x69b8]
lea edi, [ebx + 0x69b8]
test eax, eax
mov dword [esp + 0xc], 0xc
mov dword [esp + 0x14], 1
jne 0x4254f6
mov edx, dword [ebx + 0x69a0]
push ebp
push esi
push 0xa
push edx
lea eax, [esp + 0x3c]
push 0x590d84
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [edi]
add esp, 0x10
test eax, eax
jne 0x42543d
lea ecx, [esp + 0x20]
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x42543d
push 0
push 0
lea edx, [esp + 0x28]
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x42543d
lea eax, [esp + 0x34]
lea ecx, [esp + 0x14]
push eax
push 0
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esi, eax
test esi, esi
jne 0x425418
mov ebp, dword [sym.imp.KERNEL32.dll_OpenEventA]
lea edx, [esp + 0x34]
push edx
push eax
push 0x1f0003
call ebp
mov esi, eax
test esi, esi
jne 0x425418
lea eax, [esp + 0x34]
push eax
push esi
push 0x100000
call ebp
mov esi, eax
test esi, esi
je 0x42543d
push 2
push 1
push 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test esi, esi
je 0x42543d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov cl, byte [0x5a17b0]
xor eax, eax
mov byte [esp + 0x138], cl
mov ecx, 0x40
lea edi, [esp + 0x139]
push 0x590d74
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x13c]
push 0x57c890
push edx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x138]
lea ecx, [esp + 0x14]
push eax
push 0x400000
push 0
push 4
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
pop esi
mov dword [ebx + 0x69b4], eax
test eax, eax
pop ebp
jne 0x4254ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4254ca
lea edx, [esp + 0x130]
push edx
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebx + 0x69b4], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 0
push ebx
push 0x425500
push 0
push 0
call fcn.00461973
add esp, 0x18
test eax, eax
je 0x4254f6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
add esp, 0x22c
ret
Function at 0x4260b0
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, 0x1114
call fcn.00461830
push ebx
push esi
push edi
mov ebx, ecx
call fcn.004257c0
test eax, eax
jne 0x4260d2
pop edi
pop esi
pop ebx
add esp, 0x1114
ret
mov ecx, 0x444
xor eax, eax
lea edi, [esp + 0x10]
mov dword [ebx + 0x70e0], 0x20
rep stosd dword es:[edi], eax
lea edi, [ebx + 0x710c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], 0xd6d8
mov eax, dword [edi]
mov dword [esp + 0x20], 0x10
test eax, eax
mov dword [esp + 0x28], 2
jne 0x426190
lea eax, [esp + 0xc]
push eax
push 4
push ebx
push 0x426230
push 0
push 0
call fcn.00461973
mov esi, eax
add esp, 0x18
test esi, esi
je 0x42617b
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 2
push 0
push 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
push esi
jne 0x42616e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x1114
ret
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call esi
push 0xfa
call esi
push 0
call esi
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.00426010
neg eax
sbb eax, eax
pop edi
pop esi
pop ebx
neg eax
add esp, 0x1114
ret
Function at 0x42a4d0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x158
lea eax, [esp + 0x54]
push esi
push edi
push 0x104
push eax
call fcn.00433ca0
add esp, 8
lea ecx, [esp + 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [esp + eax + 0x5b]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp cl, 0x5c
je 0x42a510
lea edx, [esp + 0x5c]
push 0x5909e8
push edx
call esi
lea eax, [esp + 0x5c]
push 0x591864
push eax
call esi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
mov word [esp + 0x48], ax
push ecx
push edx
push eax
push eax
push eax
push 1
push eax
push eax
push eax
lea eax, [esp + 0x80]
push eax
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x48], 0x591854
mov dword [esp + 0x6c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
test eax, eax
jne 0x42a579
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x158
ret
mov eax, dword [esp]
cmp eax, 0xffffffff
je 0x42a589
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x158
ret

Function at 0x42e9c0
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push esi
push edi
push 0
push 0
push 0
mov edi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x184], eax
lea eax, [esp + 8]
push eax
push 4
push edi
push 0x42ea40
push 0
push 0
call fcn.00461973
mov esi, eax
add esp, 0x18
test esi, esi
je 0x42ea33
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 2
push 0
add edi, 0x180
push 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
push esi
je 0x42ea2d
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ecx
ret

Function at 0x432d50
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push esi
push edi
push 0
push 0
push 0
mov edi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x170], eax
lea eax, [esp + 8]
push eax
push 4
push edi
push 0x432dd0
push 0
push 0
call fcn.00461973
mov esi, eax
add esp, 0x18
test esi, esi
je 0x432dc3
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 2
push 0
add edi, 0x16c
push 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
push esi
je 0x432dbd
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ecx
ret
Function at 0x434660
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x98
push ebx
push ebp
push esi
mov esi, dword [esp + 0xb0]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
jne 0x4347a6
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
mov dword [esp + 0x10], eax
je 0x4347a6
mov ebp, dword [esp + 0xa8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp], 0
mov edx, dword [eax + 0xc]
cmp dword [edx], 0
je 0x434770
push edi
mov dword [esp + 0x10], 0
jmp 0x4346c3
mov eax, dword [esp + 0x14]
movsx ecx, word [eax + 0xa]
mov eax, dword [esp + 0x10]
lea edi, [esp + 0x1c]
mov esi, dword [eax + edx]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
lea ecx, [esp + 0x2c]
push 0x57c890
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x28]
push edx
call ebx
push ebp
mov esi, eax
call ebx
mov ecx, dword [esp + 0xb0]
sub ecx, eax
cmp esi, ecx
jge 0x434753
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x28]
push edx
push ebp
call esi
push ebp
call ebx
cmp byte [eax + ebp - 1], 0x2e
jne 0x434738
push ebp
call ebx
mov byte [eax + ebp - 1], 0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 0xc]
mov eax, dword [edx + ecx + 4]
test eax, eax
je 0x434753
push 0x57c88c
push ebp
call esi
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add eax, 4
mov edx, dword [ecx + 0xc]
mov dword [esp + 0x10], eax
cmp dword [eax + edx], 0
jne 0x4346bf
pop edi
push ebp
call ebx
cmp byte [eax + ebp - 1], 0xa
jne 0x434782
push ebp
call ebx
mov byte [eax + ebp - 1], 0
push ebp
call ebx
cmp byte [eax + ebp - 1], 0xd
jne 0x434794
push ebp
call ebx
mov byte [eax + ebp - 1], 0
push ebp
call ebx
cmp byte [eax + ebp - 1], 0x2c
jne 0x4347a6
push ebp
call ebx
mov byte [eax + ebp - 1], 0
pop esi
pop ebp
pop ebx
add esp, 0x98
ret

Function at 0x434da0
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x434de1
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
je 0x434dff
mov eax, dword [esp + 0x18]
sub eax, 2
jne 0x434dff
cmp dword [esp + 0xc], 5
jb 0x434dff
pop edi
mov eax, 1
pop esi
add esp, 0x9c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x9c
ret
Function at 0x4361a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x260
mov dl, byte [0x5a17b0]
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x61]
mov byte [esp + 0x60], dl
mov byte [esp + 0x164], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x165]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x64]
push eax
call fcn.00436010
add esp, 8
lea ecx, [esp + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [esp + eax + 0x5f]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp cl, 0x5c
je 0x436214
lea edx, [esp + 0x60]
push 0x5909e8
push edx
call esi
lea eax, [esp + 0x60]
push 0x5926c4
push eax
call esi
lea ecx, [esp + 0x164]
push 0x579d7c
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 0x26c]
lea eax, [esp + 0x164]
push edx
push eax
call esi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0x44
push ecx
push edx
push eax
push eax
push eax
push 1
push eax
push eax
lea eax, [esp + 0x184]
lea ecx, [esp + 0x80]
push eax
push ecx
mov dword [esp + 0x4c], 0x591854
mov word [esp + 0x74], 5
mov dword [esp + 0x70], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
test eax, eax
jne 0x4362ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
add esp, 0x260
ret
mov eax, dword [esp + 4]
cmp eax, 0xffffffff
je 0x4362a4
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4362e1
mov eax, dword [esp + 4]
lea edx, [esp]
push edx
push eax
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add esp, 0x260
ret

Function at 0x436330
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x20c
mov dl, byte [0x5a17b0]
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], dl
mov byte [esp + 0xc], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0
push eax
call fcn.00433ca0
mov ecx, dword [esp + 0x220]
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x110]
push ecx
push edx
push 0x5926d4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x110]
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4363fd
mov edi, dword [esp + 0x21c]
lea edx, [esp + 8]
push 0
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
add esp, 0x20c
ret