joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41efb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0
push 0
push 1
mov esi, ecx
push 0
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, dword [ebp + 8]
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
jne 0x41effe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov esi, eax
call dword [edx]
mov dword [ebp - 0x10], esi
call fcn.0044b890
mov dword [ebp - 0xc], eax
test esi, esi
jne 0x41f0bc
mov esi, dword [ebp - 4]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 8], eax
mov dword [ebx + 8], eax
cmp dword [esi + 8], 0
jne 0x41f03e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov esi, eax
call dword [edx]
mov dword [ebp - 0x10], esi
call fcn.0044b890
mov dword [ebp - 0xc], eax
test esi, esi
jne 0x41f0ca
mov esi, dword [ebp - 4]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push ebx
push 0x41f4b0
push dword [ebp + 0xc]
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x41f0a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebx]
mov ecx, ebx
push 1
mov dword [ebp + 8], eax
call dword [edx]
test edi, edi
je 0x41f084
push edi
call esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
test eax, eax
je 0x41f091
push eax
call esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], ebx
call fcn.0044b890
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x41f0d8
test edi, edi
je 0x41f0b3
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.thread.entry_event
lea eax, [ebp - 0x10]
push eax
call fcn.0040d260
push str.thread.exit_event
lea eax, [ebp - 0x10]
push eax
call fcn.0040d260
push str.thread
lea eax, [ebp - 0x10]
push eax
call fcn.0040d260
int3
Function at 0x41f1a0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4ec560]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x20]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x110], eax
cmp edi, 0xffffffff
jne 0x41f1e9
call fcn.0044b890
mov dword [esi + 4], eax
xor eax, eax
pop edi
mov dword [esi], 0x2719
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004385c0
mov esp, ebp
pop ebp
ret
push ebx
mov bh, byte [ebp + 0xc]
mov bl, bh
and bl, 0x10
cmp byte [ebp + 0x1c], 0
mov byte [ebp - 0x109], bl
je 0x41f212
test bl, bl
je 0x41f218
call fcn.0044b890
mov dword [esi], 0
jmp 0x41f30f
mov byte [ebp - 0x109], bl
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push edi
call fcn.0041e370
add esp, 0x14
test eax, eax
jg 0x41f314
test bl, bl
je 0x41f23d
test eax, eax
je 0x41f304
test bh, 1
jne 0x41f312
call fcn.0044b890
cmp dword [esi + 4], eax
jne 0x41f258
cmp dword [esi], 0x2733
je 0x41f272
call fcn.0044b890
cmp dword [esi + 4], eax
jne 0x41f312
cmp dword [esi], 0x4d5
jne 0x41f312
push 0
mov dword [ebp - 0x104], edi
mov dword [ebp - 0x108], 1
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov ebx, eax
call fcn.0044b890
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi], eax
mov dword [esi + 4], edi
test ebx, ebx
jne 0x41f2c5
call fcn.0044b890
mov dword [esi], ebx
mov dword [esi + 4], eax
jmp 0x41f2d9
jle 0x41f2d5
call fcn.0044b890
mov dword [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
js 0x41f312
mov edi, dword [ebp + 8]
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0x110]
push edi
call fcn.0041e370
add esp, 0x14
test eax, eax
jg 0x41f314
mov bl, byte [ebp - 0x109]
mov bh, byte [ebp + 0xc]
jmp 0x41f231
call fcn.0040d680
mov dword [esi], 2
mov dword [esi + 4], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.004385c0
mov esp, ebp
pop ebp
ret
Function at 0x42c5d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x459829
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ec560]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1b2
push dword [ebp + 8]
mov dword [ebp - 4], 0
push str.Do:_t_t_CSIPServerConnector::RequestAnswerCall____s____LINE___d
call fcn.0042eb70
add esp, 0xc
mov ecx, 0x4ee748
push 0xffffffffffffffff
call sub.mfc140.dll_Ordinal_8442
mov esi, dword [0x4ee750]
cmp esi, dword [0x4ee754]
je 0x42c6f9
mov ebx, dword [esi]
push ebx
call sub.liblinphone_7.dll_linphone_call_get_call_log
push eax
call sub.liblinphone_7.dll_linphone_call_log_get_call_id
add esp, 8
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 8]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
je 0x42c664
add esi, 4
cmp esi, dword [0x4ee754]
jne 0x42c632
jmp 0x42c6f9
push dword [0x4ee7ac]
call sub.liblinphone_7.dll_linphone_core_create_default_call_parameters
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [0x4ee770], 0
je 0x42c6e9
push 0x100
call sub.mfc140.dll_Ordinal_265
add esp, 4
mov edi, eax
push edi
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
push str._record_
push 0x100
push edi
call esi
push dword [ebp - 0x14]
push 0x100
push edi
call esi
push str..wav
push 0x100
push edi
call esi
push 0x1cc
push edi
push 0x4669c0
call fcn.0042eb70
push edi
push dword [ebp - 0x10]
call sub.liblinphone_7.dll_linphone_call_params_set_record_file
push edi
call sub.mfc140.dll_Ordinal_266
mov eax, dword [ebp - 0x10]
add esp, 0x3c
push eax
push ebx
push dword [0x4ee7ac]
call sub.liblinphone_7.dll_linphone_core_accept_call_with_params
add esp, 0xc
mov ecx, 0x4ee748
call fcn.00437943
push 0x1d8
push dword [ebp + 8]
push 0x466a10
call fcn.0042eb70
add esp, 0xc
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e310
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x459c39
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push esi
mov eax, dword [0x4ec560]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 8]
mov dword [ebp - 4], 0
push str.Do:_t_t__s
call fcn.0042eb70
push 0x40
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x60], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x14
mov dword [ebp - 0x34], 1
xor eax, eax
lea ecx, [ebp + 8]
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
push 0
call dword [sym.imp.mfc140.dll_Ordinal_5095]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x42e3bb
push dword [ebp + 0xc]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
mov esi, dword [ebp - 0x14]
jmp 0x42e3bd
xor esi, esi
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42e7c0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x4ec560]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
mov dword [ebp - 0x12c], pe_nt_image_headers32
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x42e81b
mov edi, dword [ebp + 8]
nop
mov eax, dword [ebp - 0x124]
cmp edi, eax
je 0x42e834
lea eax, [ebp - 0x12c]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x42e800
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004385c0
mov esp, ebp
pop ebp
ret
push eax
push 0
push 0x401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004385c0
mov esp, ebp
pop ebp
ret
Function at 0x42e870
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x459d29
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x4ec560]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140.dll_Ordinal_8146]
test al, al
je 0x42e8b6
xor esi, esi
jmp 0x42e931
push 0
push 2
mov dword [ebp - 0x138], pe_nt_image_headers32
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
xor esi, esi
lea eax, [ebp - 0x138]
push eax
push edi
call sub.KERNEL32.dll_Process32First
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42e92e
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_2986]
test eax, eax
jne 0x42e91d
push dword [ebp - 0x130]
push eax
push 0x401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
mov esi, 1
lea eax, [ebp - 0x138]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x42e8e4
push edi
call ebx
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004385c0
mov esp, ebp
pop ebp
ret
Function at 0x42fb80
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4ec560]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x390
push str.Echo:_t_t_Aphone_start_listen_soft_phone____LINE___d
mov edi, ecx
call fcn.0042eb70
add esp, 8
lea eax, [ebp - 0x194]
push eax
push 0x102
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x42fbe7
push 0x394
push str.Error:_t_t_WSAStartup____LINE___d
call fcn.0042eb70
add esp, 8
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004385c0
mov esp, ebp
pop ebp
ret
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 0xa8], eax
cmp eax, 0xffffffff
jne 0x42fc21
push 0x39e
push str.Error:_t_t_invalid_socket____LINE___d
call fcn.0042eb70
add esp, 8
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004385c0
mov esp, ebp
pop ebp
ret
push esi
mov eax, 2
mov dword [edi + 0xb0], 0
lea esi, [edi + 0xac]
mov word [esi], ax
movzx eax, word [0x4ee790]
push eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
push esi
push dword [edi + 0xa8]
mov word [edi + 0xae], ax
call dword [sym.imp.WS2_32.dll_bind]
pop esi
cmp eax, 0xffffffff
jne 0x42fc7e
push 0x3a9
push str.Error:_t_t_bind____LINE___d
call fcn.0042eb70
add esp, 8
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
cmp dword [0x4ee76c], 0
je 0x42fc8c
call fcn.00434c30
push 0x29
push 0x2410
push dword [edi + 0x20]
push dword [edi + 0xa8]
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
jne 0x42fcca
push 0x3b9
push str.Error:_t_t_WSAAsyncSelect____LINE___d
call fcn.0042eb70
add esp, 8
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004385c0
mov esp, ebp
pop ebp
ret
push 0
push dword [edi + 0xa8]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x42fd00
push 0x3c0
push str.Error:_t_t_listen____LINE___d
call fcn.0042eb70
add esp, 8
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004385c0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop edi
call fcn.004385c0
mov esp, ebp
pop ebp
ret

Function at 0x430420
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
mov eax, dword [0x4ec560]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push edi
mov edi, ecx
push 1
push dword [edi + 0x20]
call esi
push 2
push dword [edi + 0x20]
call esi
push 3
push dword [edi + 0x20]
call esi
push 0
push ecx
mov ecx, esp
push str.EventAPhoneClose
call dword [sym.imp.mfc140.dll_Ordinal_310]
mov ecx, edi
call fcn.004325e0
call fcn.0042d5d0
cmp dword [0x4ee76c], 0
je 0x43047c
call fcn.00434c30
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x1f8], eax
lea eax, [ebp - 0x1fc]
push eax
push 2
mov dword [ebp - 0x1fc], 0x1f8
mov dword [ebp - 0x1f4], 0x7db
mov dword [ebp - 0x1f0], 7
mov dword [ebp - 0x1ec], 0x2412
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov ecx, edi
call fcn.004304d0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x4325e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45a4b2
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4ec560]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x575
push dword [esi + 0xc0]
mov dword [ebp - 4], 0
push dword [ebp + 8]
push str.Do:_t_t_SendEvent2SoftPhone____msg___s__m_bHandShaked___d__LINE___d
call fcn.0042eb70
add esp, 0x10
cmp dword [esi + 0xc0], 0
jne 0x43264b
push dword [ebp + 8]
push 0x579
push str.Fail:_t_t_SendMsg2WebClient____LINE___d_r_n_s
call fcn.0042eb70
add esp, 0xc
jmp 0x432756
cmp byte [ebp + 0xc], 1
jne 0x4326a5
push 0x580
push str.Do:_t_t_send____LINE___d
call fcn.0042eb70
add esp, 8
lea ecx, [ebp + 8]
push 0
call dword [sym.imp.mfc140.dll_Ordinal_5861]
push eax
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
push dword [esi + 0xbc]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x432756
push 0x583
push 0x469864
call fcn.0042eb70
add esp, 8
jmp 0x432756
push ecx
lea eax, [ebp + 8]
mov ecx, esp
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
lea eax, [ebp + 0xc]
push eax
call fcn.0042df90
add esp, 8
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc140.dll_Ordinal_1526]
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push 0x58a
push dword [ebp + 8]
push str.Echo:_t_t_send_message_data_of_content_is___s__LINE___d
call fcn.0042eb70
add esp, 0xc
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1661]
push eax
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_5861]
cdq
push edx
push eax
push 1
push 1
call fcn.004327f0
mov edi, eax
push 0x58c
push dword [edi]
push str.Echo:_t_t_send_message_data_of_fb_is___s__LINE___d
call fcn.0042eb70
add esp, 0x20
push 0
push dword [edi + 8]
push dword [edi]
push dword [esi + 0xbc]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x43274d
push 0x590
push str.Error:_t_t_send____LINE___d
call fcn.0042eb70
add esp, 8
push edi
call fcn.004327c0
add esp, 4
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x434c30
Capabilities:
Enumerate processes
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x4ec560]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x434c7f
push 0x24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Fail:_t_t_CreateToolhelp32Snapshot____INVALID_HANDLE_VALUE____fail__ld___in_line__d_n
call fcn.0042eb70
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004385c0
mov esp, ebp
pop ebp
ret
push 0x27
push ebx
push str.Succ:_t_t_CreateToolhelp32Snapshot____ret_p____succ__in_line__d_n
call fcn.0042eb70
push 0x124
lea eax, [ebp - 0x128]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x12c], pe_nt_image_headers32
lea eax, [ebp - 0x12c]
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x434e0c
mov eax, 0x46d28c
lea ecx, [ebp - 0x108]
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x434cf0
test dl, dl
je 0x434cec
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x434cf0
add ecx, 2
add eax, 2
test dl, dl
jne 0x434cd0
xor eax, eax
jmp 0x434cf5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x434ded
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x124]
push str.Echo:_t_Process32Next____th32ProcessID_ld__szExeFile_s_n
call fcn.0042eb70
add esp, 0xc
xor esi, esi
xor edi, edi
nop dword [eax + eax]
test esi, esi
jne 0x434ded
push 0xbb8
push dword [ebp - 0x124]
call fcn.0042e0d0
push 0x39
mov esi, eax
inc edi
push esi
push edi
push 0x46d314
call fcn.0042eb70
add esp, 0x18
cmp edi, 0xa
jl 0x434d20
test esi, esi
jne 0x434ded
push 0x3d
push dword [ebp - 0x124]
push 0x46d348
call fcn.0042eb70
push dword [ebp - 0x124]
call fcn.0042e7c0
push 0x3f
push dword [ebp - 0x124]
mov esi, eax
push 0x46d368
call fcn.0042eb70
add esp, 0x1c
test esi, esi
jne 0x434ded
push 0x43
push 0x46d388
call fcn.0042eb70
add esp, 4
mov ecx, esp
push 0x46d3a8
call dword [sym.imp.mfc140.dll_Ordinal_310]
call fcn.0042e870
push 0x45
push 0x46d3b0
mov esi, eax
call fcn.0042eb70
add esp, 0xc
test esi, esi
jne 0x434ded
push 0x49
push 0x46d3d0
call fcn.0042eb70
push 0x46d3f0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push 0x4b
push 0x46d400
call fcn.0042eb70
add esp, 0x14
lea eax, [ebp - 0x12c]
mov dword [0x484148], 0xffffffff
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x434cc1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004385c0
mov esp, ebp
pop ebp
ret
Function at 0x434f50
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x96
push str.Do:_t_t_StopScreenCapture____LINE___d
call fcn.0042eb70
mov eax, dword [ebp + 8]
add esp, 8
test eax, eax
jne 0x434f8b
push 0x98
push str.StopScreenCapture____LINE___d__Invalid_Param
call fcn.0042eb70
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [eax + 0x7c], 0
mov ebx, dword [0x484148]
cmovne ebx, dword [0x48414c]
cmp ebx, 0xffffffff
je 0x435085
push ebx
push str.Stop_ffmpeg_process__pid:__d
xor esi, esi
call fcn.0042eb70
add esp, 8
xor edi, edi
test esi, esi
jne 0x435085
push 0xbb8
push ebx
call fcn.0042e0d0
push 0xab
mov esi, eax
inc edi
push esi
push edi
push str.Echo:_t_t_Retry_Count_:__d__Result_:__d__LINE___d
call fcn.0042eb70
add esp, 0x18
cmp edi, 0xa
jl 0x434fb7
test esi, esi
jne 0x435085
push 0xaf
push ebx
push str.Do:_t_t_Kill_cmd_:__d__LINE___d
call fcn.0042eb70
push ebx
call fcn.0042e7c0
push 0xb1
push ebx
push str.Succ:_t_t_Kill_cmd:__d__LINE___d
mov esi, eax
call fcn.0042eb70
add esp, 0x1c
test esi, esi
jne 0x435085
push 0xb5
push str.Do:_t_t_Kill_ffmpeg__LINE___d
call fcn.0042eb70
add esp, 4
mov ecx, esp
push str.ffmpeg
call dword [sym.imp.mfc140.dll_Ordinal_310]
call fcn.0042e870
push 0xb7
push str.Succ:_t_t_Kill_ffmpeg__LINE___d
mov esi, eax
call fcn.0042eb70
add esp, 0xc
test esi, esi
jne 0x435085
push 0xbb
push str.Do:_t_t_tskill_ffmpeg__LINE___d
call fcn.0042eb70
push str.tskill_ffmpeg
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push 0xbd
push str.Succ:_t_t_tskill_ffmpeg__LINE___d
call fcn.0042eb70
add esp, 0x14
mov ebx, dword [ebp + 8]
cmp byte [ebx + 0x7c], 0
je 0x43509a
mov dword [0x48414c], 0xffffffff
jmp 0x4350a4
mov dword [0x484148], 0xffffffff
push 0xc7
push str.Succ:_t_t_StopScreenCapture____LINE___d
call fcn.0042eb70
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4351d0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4ec560]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
push 0x100
mov esi, eax
lea eax, [ebp - 0x104]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x104]
push 0x100
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
test ecx, ecx
je 0x435281
movsx eax, word [esi + 0xa]
push eax
push ecx
lea eax, [ebp - 0x108]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [ebp - 0x108]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov esi, eax
push esi
push 0x46dc4c
push 0x4ee858
call dword [sym.imp.mfc140.dll_Ordinal_4807]
push 0x11e
push esi
push str.Echo:_t_t_LocalIP_:__s__LINE___d
call fcn.0042eb70
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004385c0
mov esp, ebp
pop ebp
ret
Function at 0x436160
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4ec560]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x436203
cmp byte [esi + 0x3d], 0
je 0x436203
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4361b8
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x4361ca
sub eax, 1
je 0x4361ce
sub eax, 2
je 0x436203
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004385c0
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4361ec
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4361b8
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004385c0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004385c0
mov esp, ebp
pop ebp
ret