joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496af5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4d4938]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x496b38
cmp word [esi], dx
jne 0x496b38
or byte [edi + eax + 0x28], 4
jmp 0x496b3d
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x496c90
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x496c70
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x496b7f
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x496bb5
cmp eax, edx
jae 0x496bc1
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x496b57
jmp 0x496c90
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x496c6c
cmp dword [ebp - 0x14], 0
je 0x496c6c
mov eax, dword [ebx*4 + 0x4d4938]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x496c44
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x496c0d
mov word [esi], cx
jmp 0x496c40
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4d4938]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4d4938]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4d4938]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x496c90
pop ebx
cmp word [ebp - 4], bx
jne 0x496c55
cmp esi, dword [ebp + 0xc]
jne 0x496c55
mov word [esi], bx
jmp 0x496c8d
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004018f2
add esp, 0x10
cmp word [ebp - 4], bx
je 0x496c90
push 0xd
jmp 0x496c89
mov ecx, dword [ebx*4 + 0x4d4938]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x496c87
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x496c90
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x49e96f
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4d1040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x49e9ba
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0049ee31
test al, al
jne 0x49e9b4
sub edx, 2
cmp edx, edi
jne 0x49e99a
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x49e9dc
lea eax, [edi + 2]
cmp edx, eax
je 0x49e9dc
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0049e568
add esp, 0x10
jmp 0x49ead6
push esi
lea ecx, [ebp - 0x255]
call fcn.0049ee31
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49ea1f
push dword [ebp - 0x25c]
jmp 0x49e9cc
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x49ea5c
cmp word [ebp - 0x226], 0
je 0x49ea7d
cmp word [ebp - 0x226], ax
jne 0x49ea5c
cmp word [ebp - 0x224], 0
je 0x49ea7d
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0049e568
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x49eac9
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x49ea36
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x49eab1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x49ead6
push 0x49df50
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040541b
add esp, 0x10
jmp 0x49eaa6
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402fdb
leave
ret
Function at 0x401467
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x4014b4
mov al, cl
cmp al, 0x61
jb 0x40148f
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x4014b4
mov al, cl
cmp al, 0x61
jb 0x4014a7
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x401480
cmp edx, dword [esp + 0x18]
je 0x4014c4
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x401479
xor eax, eax
jmp 0x4014c7
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x4014cf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x4015b6
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x4015bc
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40151b
cmp al, 0x61
jb 0x401513
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x401506
cmp edx, dword [esp + 0x14]
je 0x40152b
dec ecx
jne 0x4014fb
xor eax, eax
jmp 0x4015b6
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x4015b6
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x4015b6
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x401567
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x401576
jmp 0x40155e
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.00401467
test eax, eax
je 0x4015b6
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x4015b1
cmp al, 0x61
jb 0x4015a9
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40159c
call fcn.004014cf
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x4015d4
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x4015d4
sub edx, ecx
mov ecx, edx
jmp 0x40152b
xor eax, eax
jmp 0x4015b6
Function at 0x405fac
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.004c88b0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x406019
push 0x2a
push 0x40fa62a
push 6
call fcn.004c4d9c
add esp, 0xc
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x406029
push ebx
call fcn.004c4d90
add esp, 4
cmp dword [ebp - 4], 0
jg 0x40603a
mov dword [ebp - 4], 0x100
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.004c9690
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40606d
push ebx
call fcn.004c4d90
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4060a6
push 0x125
push 0x40fa62a
push 6
call fcn.004c4d9c
add esp, 0xc
push getsockname
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x4060b9
mov eax, 0x4ee2e4
push eax
push 1
mov ebx, 0x174
call fcn.004c96d0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4060e3
push ebx
call fcn.004c4d90
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0x4ee2e4
push dword [ebp - 8]
call fcn.004026a4
add esp, 8
cmp eax, 0
jne 0x406120
call fcn.00406158
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40611c
push ebx
call fcn.004c4d90
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x40613c
push eax
mov ebx, eax
call fcn.004025dc
inc eax
push eax
call fcn.004c4d96
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x406141
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x406152
push ebx
call fcn.004c4d90
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x406610
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 0
jne 0x40662a
mov dword [ebp + 8], 1
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp + 8]
push 2
mov ebx, 0xc8
call fcn.004c91f0
add esp, 0x1c
mov dword [ebp - 4], eax
push 0x80000301
push 0
push SysReAllocString
push 0x80000301
push 0
push 3
push 0x80000301
push 0
push 0x20000
push 3
mov ebx, 0xc8
call fcn.004c91f0
add esp, 0x28
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4066bd
push 0xdd
push 0x40fa5df
push 6
call fcn.004c4d9c
add esp, 0xc
jmp 0x4066c2
mov esp, ebp
pop ebp
ret 8
Function at 0x407a64
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push reloc.WS2_32.dll_getsockname
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.004c87b0
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x407aae
mov eax, 0
jmp 0x407b17
mov dword [ebp - 0xc], esp
push dword [ebp + 0x24]
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
push dword [ebp - 4]
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x407aed
push 0x100
push 0x40fa3c2
push 6
call fcn.004c4d9c
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp + 0x18], 0
jne 0x407b07
push dword [ebp - 8]
call fcn.004042b8
jmp 0x407b0f
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
mov eax, dword [ebp - 8]
jmp 0x407b17
mov esp, ebp
pop ebp
ret 0x24
Function at 0x40e6f0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x40e720
mov edx, 0xffffffff
mov eax, 0xffffffff
jmp 0x40e75b
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40e750
push 0xa0
push 0x40fa0ed
push 6
call fcn.004c4d9c
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
jmp 0x40e75b
mov esp, ebp
pop ebp
ret 4

Function at 0x4104d8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x410503
mov eax, 0x532144
jmp 0x410665
cmp dword [ebp + 0xc], 0
jg 0x41055b
mov dword [ebp - 0xc], esp
mov eax, dword [ebp + 0xc]
cdq
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x410547
push 0xe2
push 0x40fa0ec
push 6
call fcn.004c4d9c
add esp, 0xc
cmp dword [ebp + 0xc], 0
jg 0x41055b
mov eax, 0x532144
jmp 0x410665
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call fcn.00410680
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x410592
mov eax, 0x532144
jmp 0x410665
mov dword [ebp - 0xc], esp
push 0
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4105cc
push 0x2a4
push 0x40fa0ec
push 6
call fcn.004c4d9c
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4105e3
mov eax, 0x532144
jmp 0x410665
push 0x80000301
push 0
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0x910
call fcn.004c9570
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x410622
push ebx
call fcn.004c4d90
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.00410710
mov eax, dword [ebp - 8]
test eax, eax
je 0x410660
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.004c4d96
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x410665
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x410676
push ebx
call fcn.004c4d90
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x14
Function at 0x42119c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x4211c0
mov eax, 0
jmp 0x421229
mov dword [ebp - 8], esp
push dword [ebp + 0x24]
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 8], esp
je 0x4211ff
push 0xb9
push 0x40fa3c3
push 6
call fcn.004c4d9c
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x421219
push dword [ebp - 4]
call fcn.004042b8
jmp 0x421221
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
mov eax, dword [ebp - 4]
jmp 0x421229
mov esp, ebp
pop ebp
ret 0x24
Function at 0x43e65c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
cmp dword [0x61a0d0], 0
je 0x43e6fb
mov dword [ebp - 8], esp
push 0
push dword [0x61a0d0]
xor eax, eax
call dword [0x61a284]
nop
nop
cmp dword [ebp - 8], esp
je 0x43e6ad
push 0x5f
push 0x40c4bb1
push 6
call fcn.004c4d9c
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x102
jne 0x43e6c2
jmp 0x43e798
mov dword [ebp - 8], esp
push dword [0x61a0d0]
xor eax, eax
call dword [0x61a274]
nop
nop
cmp dword [ebp - 8], esp
je 0x43e6f1
push 0x9a
push 0x40c4bb1
push 6
call fcn.004c4d9c
add esp, 0xc
mov dword [0x61a0d0], 0
call fcn.00408958
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
fild qword [0x61a0d4]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
fadd qword [0x5cf224]
fstp qword [ebp - 0x1c]
fild qword [ebp - 0xc]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
fsub qword [ebp - 0x1c]
fcomp qword [0x532468]
fnstsw ax
test ah, 1
je 0x43e73d
jmp 0x43e798
call fcn.00408958
mov dword [0x61a0d4], eax
mov dword [0x61a0d8], edx
mov dword [ebp - 8], esp
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x43f1b6
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 8], esp
je 0x43e793
push 0x1c7
push 0x40c4bb1
push 6
call fcn.004c4d9c
add esp, 0xc
mov dword [0x61a0d0], eax
mov esp, ebp
pop ebp
ret

Function at 0x4409b8
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jne 0x4409d5
mov eax, 0
jmp 0x440a20
mov dword [ebp - 4], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
nop
nop
cmp dword [ebp - 4], esp
je 0x440a04
push 0xac
push 0x40fa39c
push 6
call fcn.004c4d9c
add esp, 0xc
test eax, eax
je 0x440a16
mov eax, 1
jmp 0x440a20
mov eax, 0
jmp 0x440a20
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4485f8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
cmp dword [0x61a134], 0
jne 0x44873f
push 1
push 0x400
push 0x61a138
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
push 0x61a13c
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.004c88b0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 0x10]
push 0
push 1
push 0
xor eax, eax
call dword [0x61a3c4]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4486a4
push 0x12b
push 0x4012d50
push 6
call fcn.004c4d9c
add esp, 0xc
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4486b7
push ebx
call fcn.004c4d90
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [0x61a134], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 8]
push eax
push 0
push dword [0x61a134]
push 0x448da6
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x448706
push 0x162
push 0x4012d50
push 6
call fcn.004c4d9c
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44873f
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
xor eax, eax
call dword [0x61a274]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x44873f
push 0x1da
push 0x4012d50
push 6
call fcn.004c4d9c
add esp, 0xc
push 0x61a13c
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
cmp dword [ebp + 0xc], 0
je 0x448776
push 1
push 1
push dword [ebp + 8]
push 0x61a138
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x18]
jmp 0x448794
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
push dword [ebp + 8]
push 0x61a138
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x1c]
push 0x61a13c
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x10]
mov dword [ebp - 0x10], esp
push dword [0x61a134]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4487d2
push 0x2b2
push 0x4012d50
push 6
call fcn.004c4d9c
add esp, 0xc
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0x5d0898
mov ecx, 2
call fcn.00402647
add esp, 8
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
push 1
lea eax, [ebp - 0x10]
push eax
push 1
mov eax, str.SendDesktop
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
call fcn.00407cbc
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x448821
push ebx
call fcn.004c4d90
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x448831
push ebx
call fcn.004c4d90
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x448839
mov esp, ebp
pop ebp
ret 0xc
Function at 0x460cf8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 1
push getsockname
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x460d29
mov eax, 0x4ee2e4
push eax
push 2
mov ebx, 0x138
call fcn.004c95d0
add esp, 0x1c
mov dword [ebp - 8], eax
push 0x4ee344
push dword [ebp - 8]
call fcn.004026a4
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x460d6d
push ebx
call fcn.004c4d90
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x460ded
push 0x80000301
push 0
push 1
push getsockname
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x460d98
mov eax, 0x4ee2e4
push eax
push 2
mov ebx, 0x138
call fcn.004c95d0
add esp, 0x1c
mov dword [ebp - 0x10], eax
push 0x532558
push dword [ebp - 0x10]
call fcn.004026a4
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x460ddc
push ebx
call fcn.004c4d90
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x460ded
mov eax, 1
jmp 0x460df2
mov eax, 0
test eax, eax
je 0x460e30
push 0x4ee344
mov ebx, dword [ebp + 8]
push dword [ebx]
mov ecx, 2
call fcn.00402647
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x460e2a
push ebx
call fcn.004c4d90
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
push 0x80000301
push 0
push 0x40000000
push 0x80000301
push 0
push SysReAllocString
push 2
mov ebx, 0xc8
call fcn.004c91f0
add esp, 0x1c
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push 1
push 3
mov ebx, 0xc8
call fcn.004c91f0
add esp, 0x28
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0
push 0x2000000
push 3
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x460ede
push 0x12c
push 0x40465af
push 6
call fcn.004c4d9c
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x460ef5
mov eax, 0
jmp 0x460f71
mov dword [ebp - 8], esp
push 0
push 0
push dword [ebp - 4]
push 0x461fd8
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 8], esp
je 0x460f3a
push 0x1d2
push 0x40465af
push 6
call fcn.004c4d9c
add esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x460f69
push 0x1d2
push 0x40465af
push 6
call fcn.004c4d9c
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x460f71
mov esp, ebp
pop ebp
ret 4
Function at 0x460f78
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
push 0x80000301
push 0
push 0x100
push 0x80000301
push 0
push 0x40
push 0x80000301
push 0
push 0x20
push 0x80000301
push 0
push 0x10
push 0x80000301
push 0
push 8
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push 1
push 8
mov ebx, 0xc8
call fcn.004c91f0
add esp, 0x64
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], esp
push 0x100c
push 0x40
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x46105a
push 0xea
push 0x40465b2
push 6
call fcn.004c4d9c
add esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push 0x1000
push dword [ebp - 0x10]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4610a5
push 0x130
push 0x40465b2
push 6
call fcn.004c4d9c
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4610e3
mov dword [ebp - 0x18], esp
push dword [ebp - 0x10]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x4610de
push 0x1f7
push 0x40465b2
push 6
call fcn.004c4d9c
add esp, 0xc
jmp 0x461161
mov dword [ebp - 0x18], esp
push 0
push 0
push dword [ebp - 0x10]
push 0x461fb9
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x461128
push 0x24b
push 0x40465b2
push 6
call fcn.004c4d9c
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], esp
push dword [ebp - 0x1c]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x461157
push 0x24b
push 0x40465b2
push 6
call fcn.004c4d9c
add esp, 0xc
cmp dword [ebp - 0x14], 0
jne 0x461020
mov esp, ebp
pop ebp
ret 4