joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440d66
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x459190]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x440e08
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x440f0a
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x440eb8
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocStringLen
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x440f0b
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x440ead
cmp dword [ebp - 0x24], 1
jne 0x440ead
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x448e0c
push eax
call fcn.0042bcb7
add esp, 0xc
cmp eax, 1
jne 0x440ead
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x440f0b
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x440f0b
lea ecx, [ebp - 0x18]
push ecx
push 0x440d50
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x440f0b
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x440f31
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.00440cd1
cmp eax, ebx
pop ecx
pop ecx
jne 0x440f33
inc edi
cmp edi, esi
jl 0x440f1a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0042a6e1
leave
ret 4
Function at 0x440f42
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x4581e4
je 0x440ffe
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x440fe6
mov esi, dword [ebx + 4]
jmp 0x440fe0
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x440fd0
cmp dword [ebp - 0xc], 4
jne 0x440fd0
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x440fc8
or dword [eax + 0x9c], ecx
jmp 0x440fd0
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x440f94
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x440f77
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x4413ec
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x44569e
call fcn.0042bcec
sub esp, 0x11c
mov eax, dword [0x459190]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x4414e5
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x4414b9
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00402040
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.004413ec
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004018a0
test bl, bl
jne 0x4414b9
or dword [ebp - 4], 0xffffffff
jmp 0x44142a
cmp esi, 0x103
je 0x4414c9
cmp esi, 0x3f2
jne 0x4414d9
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.0042a6e1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x442715
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x44274a
cmp edi, dword [esi + 0xc]
jge 0x44274a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x44274a
cmp edi, dword [eax + 8]
jge 0x44274a
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x44274c
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x442850
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x442884
jmp fcn.004379d6
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x4428f5
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x4429ee
cmp eax, dword [edi + 0xc]
jge 0x4429ee
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x442946
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x4429d7
cmp dword [ebp + 0xc], ebx
je 0x4429d7
jmp 0x442970
push 0x10
call fcn.004425e1
cmp eax, ebx
je 0x44295c
mov ecx, eax
call fcn.00442847
mov esi, eax
jmp 0x44295e
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x442987
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x442997
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x4429a9
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.004379d6
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.0042c110
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x4429e9
cmp ecx, dword [esi + 8]
jge 0x4429e9
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x4429ef
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x442aad
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x442adb
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x442af9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00442a17
jmp 0x442af9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x442af9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00442a17
test edi, edi
mov eax, edi
jne 0x442ae3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x56d32c]
test ecx, ecx
je 0x442bac
jmp 0x442aac
ret 8
Function at 0x403ba0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
xorps xmm0, xmm0
mov esi, edx
mov edi, ecx
mov ebp, esp
movups xmmword [esp + 0x10], xmm0
movups xmmword [esp], xmm0
push 2
push 0x20
push ebp
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x403bdc
mov ebx, eax
push 0x20
push ebp
call dword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x403c25
movups xmm0, xmmword [esp]
movups xmm1, xmmword [esp + 0x10]
movups xmmword [edi], xmm0
xorps xmm0, xmm0
movups xmmword [edi + 0x10], xmm1
movsd qword [edi + 0x20], xmm0
movsd qword [edi + 0x28], xmm0
mov dword [edi + 0x40], 0
mov ecx, 0xffffff00
mov edx, esi
mov eax, dword [edi + 0x34]
add ecx, dword [edi + 0x30]
adc eax, 0xffffffff
mov dword [edi + 0x38], ecx
mov ecx, edi
mov dword [edi + 0x3c], eax
call fcn.00405480
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, byte [0x62314d]
xor ecx, ecx
mov edx, 4
call fcn.0048bb80
test eax, eax
je 0x403c55
and ebx, 0x7fffffff
mov dword [eax], ebx
push eax
push 0
push dword [0x623140]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x403bf9
ud2
Function at 0x406ee0
Capabilities:
Check if file exists
Delete file
Encode data using xor
Encrypt data using speck
Enumerate files on windows
Get common file path
Get local ipv4 addresses
Get socket information
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x2830
call fcn.004db820
call fcn.00406ef8
Function at 0x413100
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x80
jb 0x4132d4
movdqu xmm4, xmmword [edx]
not ecx
movdqu xmm3, xmmword [edx + 0x10]
movdqu xmm2, xmmword [edx + 0x20]
movdqu xmm1, xmmword [edx + 0x30]
movdqa xmm5, xmmword [0x4e1370]
add edx, 0x40
add eax, 0xffffffc0
movd xmm0, ecx
pxor xmm0, xmm4
movq xmm4, qword [0x4e1360]
nop word cs:[eax + eax]
nop dword [eax]
movdqa xmm6, xmm0
movdqa xmm7, xmm0
movdqu xmm0, xmmword [edx]
add eax, 0xffffffc0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm7, xmm5, 0x11
pxor xmm0, xmm6
movdqu xmm6, xmmword [edx + 0x10]
pxor xmm0, xmm7
movdqa xmm7, xmm3
pclmulqdq xmm3, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
movdqu xmm6, xmmword [edx + 0x20]
pxor xmm3, xmm7
movdqa xmm7, xmm2
pclmulqdq xmm2, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
movdqu xmm6, xmmword [edx + 0x30]
add edx, 0x40
cmp eax, 0x3f
pxor xmm2, xmm7
movdqa xmm7, xmm1
pclmulqdq xmm1, xmm5, 0x11
pclmulqdq xmm7, xmm4, 0
pxor xmm7, xmm6
pxor xmm1, xmm7
ja 0x413150
movq xmm4, qword [0x4e1380]
pmovzxdq xmm5, qword [0x4e13c0]
movdqa xmm6, xmm0
cmp eax, 0x10
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm3, xmm4, 0
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm0, xmm5, 0x11
pclmulqdq xmm2, xmm4, 0
pxor xmm0, xmm2
pxor xmm0, xmm1
jb 0x413267
nop word cs:[eax + eax]
nop
movdqu xmm1, xmmword [edx]
movdqa xmm2, xmm0
add eax, 0xfffffff0
pclmulqdq xmm0, xmm5, 0x11
add edx, 0x10
pclmulqdq xmm2, xmm4, 0
cmp eax, 0xf
pxor xmm2, xmm1
pxor xmm0, xmm2
ja 0x413240
pmovzxdq xmm1, qword [0x4e13c0]
pxor xmm2, xmm2
test eax, eax
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pblendw xmm2, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm2, xmmword [0x4e1390], 0
pxor xmm0, xmm2
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x4e13a0], 0x10
pblendw xmm2, xmm1, 0xfc
pclmulqdq xmm2, xmmword [0x4e13b0], 0
pxor xmm2, xmm0
pextrd ecx, xmm2, 1
not ecx
je 0x4132de
push eax
call fcn.00412d60
add esp, 4
ret
mov eax, ecx
ret

Function at 0x4150b0
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x128
cmp dword [esp + 0x140], 0
call fcn.004150c7
Function at 0x437b50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
cmp dword [esp + 0x30], 0x10
mov esi, ecx
jne 0x437c12
mov eax, dword [esp + 0x2c]
mov ecx, dword [edx + 0xf8]
mov edi, dword [esp + 0x3c]
lea ebx, [esp + 0xc]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
mov ecx, dword [ecx + 4]
lea eax, [esp + 7]
movsd qword [esp + 0x14], xmm1
movsd qword [esp + 0xc], xmm0
push ebx
push edx
push eax
call ecx
add esp, 0xc
movzx eax, word [esp + 7]
movzx edx, byte [esp + 9]
movzx ecx, word [esp + 0xa]
cmp edi, 4
mov word [esp], ax
mov byte [esp + 2], dl
mov word [esp + 3], cx
jbe 0x437c6d
movzx eax, byte [0x62314d]
xor ecx, ecx
mov edx, 0x16
mov edi, 0x16
call fcn.0048bb80
test eax, eax
je 0x437cc7
mov word [eax + 0x14], 0x676e
mov dword [eax + 0x10], 0x6f6c206f
mov dword [eax + 0xc], 0x6f742072
mov dword [eax + 8], 0x65626d75
mov dword [eax + 4], 0x6e207465
mov dword [eax], 0x6b636170
mov byte [esi], 0xd
mov dword [esi + 4], 0x16
jmp 0x437c65
movzx eax, byte [0x62314d]
xor ecx, ecx
mov edx, 0x18
mov edi, 0x18
call fcn.0048bb80
test eax, eax
je 0x437cc7
mov dword [eax + 0x14], 0x6874676e
mov dword [eax + 0x10], 0x656c2064
mov dword [eax + 0xc], 0x696c6176
mov dword [eax + 8], 0x6e692066
mov dword [eax + 4], 0x6f20656c
mov dword [eax], 0x706d6173
mov byte [esi], 0xd
mov dword [esi + 4], 0x18
mov dword [esi + 8], eax
mov dword [esi + 0xc], edi
jmp 0x437cc0
mov eax, dword [esp + 0x34]
movzx ecx, byte [esp]
movzx edx, byte [eax]
mov ch, dl
not ch
shr ch, 3
or ch, 0xf
and ch, cl
xor ch, dl
test edi, edi
mov byte [eax], ch
je 0x437cbd
movzx ebx, cl
xor ecx, ecx
cmp byte [esp + 0x40], 0
mov eax, dword [esp + 0x38]
cmove ebx, ecx
dec edi
xor bl, dl
and bl, 3
movzx edx, bl
cmp edi, edx
cmovae edi, edx
inc edi
nop dword [eax]
movzx edx, byte [esp + ecx + 1]
xor byte [eax + ecx], dl
inc ecx
cmp edi, ecx
jne 0x437cb0
mov byte [esi], 0x16
add esp, 0x1c
pop esi
pop edi
pop ebx
ret
ud2

Function at 0x449cc0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xe8
mov edi, ecx
mov esi, edx
call fcn.00449cd3
Function at 0x455480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x5b0
mov eax, dword [ebp + 0x28]
mov edi, dword [ebp + 0x20]
mov esi, edx
call fcn.0045549c
Function at 0x45bcc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x260
mov esi, dword [ebp + 0x14]
call fcn.0045bcd7
Function at 0x47b0c0
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x44]
mov esi, ecx
mov ecx, dword [esp + 0x48]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x47b115
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0x103
je 0x47b136
test eax, eax
js 0x47b121
mov eax, dword [esp + 8]
mov bl, 4
jmp 0x47b12a
xor ebx, ebx
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [esi + 4], eax
mov byte [esi], bl
add esp, 0x34
pop esi
pop edi
pop ebx
ret
mov eax, esp
mov dword [esp + 0x1c], 0x5e37a8
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
call fcn.0047b4d0
add esp, 4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0047b570
mov ecx, 7
int 0x29
ud2
Function at 0x47db80
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
sub esp, 0x34
mov eax, dword [esp + 0x40]
mov esi, ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
push 0
push 0
push ecx
push eax
push edx
push 0
push 0
push 0
push edi
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x47dbcd
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
cmp eax, 0xc0000011
jne 0x47dbdd
mov dword [esi + 4], 0
jmp 0x47dbef
cmp eax, 0x103
je 0x47dc0b
test eax, eax
js 0x47dbf8
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov byte [esi], 0
mov dword [esi + 4], eax
add esp, 0x34
pop esi
pop edi
ret
mov eax, esp
mov dword [esp + 0x1c], 0x5e37a8
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
call fcn.0047b4d0
add esp, 4
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0047b570
mov ecx, 7
int 0x29
ud2
Function at 0x481d90
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push edi
push esi
test dl, 1
mov eax, 0x17
mov edi, 2
mov esi, ecx
cmovne edi, eax
push 0x81
push 0
push 0
push 0
push 1
push edi
call dword [sym.imp.WS2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x481dc6
mov dword [esi + 4], eax
mov byte [esi], 4
pop esi
pop edi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2726
je 0x481dda
cmp eax, 0x2739
jne 0x481e0a
push 1
push 0
push 0
push 0
push 1
push edi
call dword [sym.imp.WS2_32.dll_WSASocketW]
cmp eax, 0xffffffff
je 0x481e13
mov edi, eax
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x481e25
mov dword [esi + 4], edi
mov byte [esi], 4
pop esi
pop edi
ret
mov byte [esi], 0
mov dword [esi + 4], eax
pop esi
pop edi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
pop esi
pop edi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 4], eax
mov dword [esi], 0
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
pop edi
ret

Function at 0x481fa0
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ecx, dword [esp + 0x28]
xor ebx, ebx
mov edi, edx
cmp ecx, 0x3b9aca00
je 0x482006
mov eax, dword [esp + 0x24]
mov dword [esp + 4], edi
mov edi, dword [esp + 0x20]
mov ebp, 0x3e8
mul ebp
mov ebx, eax
mov eax, edi
seto byte [esp + 3]
mul ebp
mov ebp, edx
mov edi, eax
add ebp, ebx
mov ebx, 0xffffffff
setb al
or al, byte [esp + 3]
jne 0x482002
mov edx, 0x431bde83
mov eax, ecx
mul edx
mov eax, edi
shr edx, 0x12
add eax, edx
mov eax, ebp
adc eax, 0
jae 0x482048
mov edi, dword [esp + 4]
mov dword [esp + 8], ebx
lea eax, [esp + 8]
push 4
push eax
push 0x1006
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x48203e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
imul eax, edx, 0xf4240
sub ecx, eax
add edi, edx
adc ebp, 0
xor eax, eax
test ecx, ecx
mov edx, edi
setne al
add eax, edi
mov edi, dword [esp + 4]
mov eax, ebp
adc eax, 0
jb 0x482006
xor eax, eax
test ecx, ecx
setne al
add edx, eax
adc ebp, 0
xor ebx, ebx
neg ebp
sbb ebx, ebx
or ebx, edx
jne 0x482006
mov eax, dword [0x5e37e0]
mov ecx, dword [0x5e37e4]
mov dword [esi + 4], ecx
mov dword [esi], eax
jmp 0x482040
Function at 0x4820a0
Capabilities:
Set socket configuration

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov ecx, dword [esp + 0x28]
xor ebx, ebx
mov edi, edx
cmp ecx, 0x3b9aca00
je 0x482106
mov eax, dword [esp + 0x24]
mov dword [esp + 4], edi
mov edi, dword [esp + 0x20]
mov ebp, 0x3e8
mul ebp
mov ebx, eax
mov eax, edi
seto byte [esp + 3]
mul ebp
mov ebp, edx
mov edi, eax
add ebp, ebx
mov ebx, 0xffffffff
setb al
or al, byte [esp + 3]
jne 0x482102
mov edx, 0x431bde83
mov eax, ecx
mul edx
mov eax, edi
shr edx, 0x12
add eax, edx
mov eax, ebp
adc eax, 0
jae 0x482148
mov edi, dword [esp + 4]
mov dword [esp + 8], ebx
lea eax, [esp + 8]
push 4
push eax
push 0x1005
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x48213e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor ecx, ecx
mov byte [esi + 3], 0
mov word [esi + 1], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
imul eax, edx, 0xf4240
sub ecx, eax
add edi, edx
adc ebp, 0
xor eax, eax
test ecx, ecx
mov edx, edi
setne al
add eax, edi
mov edi, dword [esp + 4]
mov eax, ebp
adc eax, 0
jb 0x482106
xor eax, eax
test ecx, ecx
setne al
add edx, eax
adc ebp, 0
xor ebx, ebx
neg ebp
sbb ebx, ebx
or ebx, edx
jne 0x482106
mov eax, dword [0x5e37e0]
mov ecx, dword [0x5e37e4]
mov dword [esi + 4], ecx
mov dword [esi], eax
jmp 0x482140

Function at 0x482fa0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Encode data using base64
Get common file path
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50c
mov esi, dword [edx + 0x50]
call fcn.00482fb2

Function at 0x487d90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.0047d3c0
add esp, 4
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov edx, ecx
neg edx
jo 0x487de4
mov dword [esp + 0x18], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
call fcn.00487e70
mov edi, dword [esp]
mov eax, edi
neg eax
jno 0x487e35
movzx eax, byte [esp + 4]
mov edi, dword [esp + 8]
cmp al, 3
jne 0x487e27
mov ebp, dword [edi + 4]
mov ebx, dword [edi]
mov eax, dword [ebp]
test eax, eax
je 0x487dfa
push ebx
call eax
add esp, 4
cmp dword [ebp + 4], 0
je 0x487e18
cmp dword [ebp + 8], 9
jb 0x487e09
mov ebx, dword [ebx - 4]
push ebx
push 0
push dword [0x623140]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push 0
push dword [0x623140]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], connect
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x487e53
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebp
jmp 0x487e2d
test edi, edi
mov dword [esi], connect
je 0x487e2d
push ebx
push 0
push dword [0x623140]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x487e2d