joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495660
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
jne 0x495670
mov esi, 1
push esi
call fcn.004b3207
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4956c2
call fcn.004b4c7a
mov edi, eax
call fcn.004981b0
mov ecx, dword [edi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov edi, eax
and edi, 8
je 0x4956a6
mov edx, dword [0x510698]
mov dword [0x510694], edx
test al, 0x18
je 0x4956b7
push esi
push 0x24
push 5
call fcn.00498a00
add esp, 0xc
test edi, edi
je 0x4956dd
push 1
call fcn.004b4955
test byte [esp + 0x14], 0x20
je 0x4956dd
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x4967e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov edx, dword [ebp + 0x10]
test edx, edx
push ebx
push esi
push edi
je 0x4968d4
cmp byte [edx], 0
je 0x4968c7
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add eax, 8
or ecx, 0xffffffff
mov dword [esp + 0xc], eax
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x20]
push ecx
mov esi, ebx
call fcn.00496760
mov edi, dword [ebp + 0xc]
push 8
lea edx, [esp + 0x20]
push edi
push edx
call fcn.00496760
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
xor eax, edx
push eax
xor ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.004966d0
mov eax, dword [esp + 0x30]
add esp, 0x24
cmp edi, eax
jae 0x496891
sub eax, edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.00496710
fmul qword [0x4ecde0]
push ecx
fstp qword [esp]
call fcn.004b1b38
fadd qword [0x4ecdd8]
add esp, 8
call fcn.004b1c08
mov byte [ebx], al
inc ebx
dec edi
jne 0x496864
lea ecx, [esp + 0x20]
push ecx
call fcn.00496710
fmul qword [0x4ecde0]
push ecx
fstp qword [esp]
call fcn.004b1b38
add esp, 8
call fcn.004b1c08
cmp esi, ebx
je 0x4968bd
xor byte [esi], al
inc esi
cmp esi, ebx
jne 0x4968b6
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov byte [edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x496ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
lea eax, [ebx + 0x134]
push edi
lea esi, [ebx + 0x34]
mov dword [esp + 0x14], eax
xor edi, edi
mov ecx, dword [ebx + 0x1c]
mov ebp, edi
and ebp, 0xff
mov al, byte [ecx + ebp + 1]
test al, 3
je 0x496cd0
mov byte [edi + esi], 2
jmp 0x496d07
test al, 4
je 0x496cda
mov byte [edi + esi], 0xd
jmp 0x496d07
mov edx, dword [ebx + 0x240]
push edi
push ebx
call dword [edx + 4]
add esp, 8
cmp eax, 1
jle 0x496cf3
mov byte [edi + esi], 2
jmp 0x496d07
mov eax, dword [ebx + 0x1c]
test byte [eax + ebp + 1], 0x17
jne 0x496d03
mov byte [edi + esi], 0x19
jmp 0x496d07
mov byte [edi + esi], 1
inc edi
cmp edi, 0x100
jb 0x496cb7
mov ecx, dword [esp + 0x14]
mov al, 7
mov byte [esi + 0x21], al
mov byte [esi + 0x3d], al
mov byte [esi + 0x3e], al
mov al, 0x10
mov byte [esi + 0x7c], al
mov byte [esi + 0x26], al
mov byte [esi + 0x24], 2
mov byte [esi + 0x5f], 2
mov byte [esi + 0x27], 9
mov byte [esi + 0x2e], 0xf
mov byte [esi + 0x3c], 8
mov byte [esi + 0x23], 0xa
mov byte [esi + 0x3b], 0x15
mov byte [esi + 0x3a], 0x16
mov byte [esi], 0x11
mov byte [esi + 0x5c], 0x12
mov byte [esi + 0x2f], 0x13
mov byte [esi + 0x2a], 0x14
mov byte [esi + 0x40], 0x17
mov byte [esi + 0x60], 0x1a
mov byte [esi + 0x22], 0x20
mov eax, esi
sub ecx, esi
mov edi, 0x100
mov dl, byte [eax]
cmp dl, 2
je 0x496d7b
cmp dl, 0xd
je 0x496d7b
xor edx, edx
jmp 0x496d80
mov edx, 1
mov byte [ecx + eax], dl
inc eax
dec edi
jne 0x496d6b
mov al, 0x1d
mov byte [esi + 0x58], al
mov byte [esi + 0x78], al
mov al, 0x1f
pop edi
mov byte [esi + 0x62], 0x1e
mov byte [esi + 0x4e], al
mov byte [esi + 0x6e], al
pop esi
pop ebp
pop ebx
ret

Function at 0x496da0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push 0x4000
call fcn.00495660
mov esi, eax
add esp, 8
test esi, esi
jne 0x496dc1
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x10]
push ebx
push 0
push eax
call fcn.004983f0
mov edi, eax
add esp, 0xc
test edi, edi
jge 0x496de6
push esi
call fcn.004956f0
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret
push ebp
push 0x4000
push esi
push edi
call fcn.004bed62
push ebx
push edi
mov ebp, eax
call fcn.00498460
push 0x496e20
push ebp
push esi
call fcn.00499790
push esi
call fcn.004956f0
add esp, 0x24
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x498120
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x60b8c0
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x60b7f8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x49819b
push 0x4c
push 1
call fcn.004b47ce
mov esi, eax
add esp, 8
test esi, esi
jne 0x498163
push 0x60b8c0
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x60b7f8]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x600b44]
inc eax
lea edx, [esi + 0xc]
mov dword [0x600b44], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.0049bc10
add esp, 8
mov byte [esi + 0x3c], 1
push 0x60b8c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret

Function at 0x498620
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.004b4c7a
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.004bed62
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x49871a
call fcn.004b4c7a
cmp dword [eax], 0
je 0x498667
call fcn.004b4c7a
mov ebp, dword [eax]
jmp 0x49866a
or ebp, 0xffffffff
call fcn.004981b0
test esi, esi
mov dword [eax], ebp
jne 0x49867f
call fcn.004b4c7a
cmp dword [eax], 4
je 0x4986cf
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x4986b2
cmp esi, 0xffffffff
je 0x4986f4
test al, 6
je 0x4986b2
call fcn.004981b0
mov ecx, dword [eax]
push ecx
push ebx
call fcn.0049bc40
add esp, 4
push eax
push 0x24
push 9
call fcn.00498a00
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x498712
test al, 6
je 0x4986c0
test ah, 2
je 0x498712
test esi, esi
jbe 0x49871e
test ah, 2
je 0x49871e
add dword [esp + 0x18], esi
sub edi, esi
call fcn.004b4c7a
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.004bed62
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x49871a
jmp 0x498654
call fcn.004981b0
mov eax, dword [eax]
push eax
push ebx
call fcn.0049bc40
add esp, 4
push eax
push 0x24
push 2
call fcn.00498a00
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x49872b
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x498734
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x4b5e14
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4b5e34
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004b4c07
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4b5e57
test byte [esp + 8], 2
je 0x4b5e57
call fcn.004b4c7a
mov dword [eax], 0xd
call fcn.004b4c83
mov dword [eax], 5
jmp 0x4b5e30
xor eax, eax
ret
Function at 0x4ca2ef
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4ca327
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c836a
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c8342
jmp 0x4ca333
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4cbae6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4cbb28
call fcn.004d2217
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4cbb28
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4cbb1f
xor eax, eax
jmp 0x4cbb30
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004cbb36
pop edi
pop esi
pop ebx
ret 4

Function at 0x4d2747
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d2775
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4d2793
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d26ad
jmp 0x4d2793
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d2793
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d26ad
test edi, edi
mov eax, edi
jne 0x4d277d
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401063
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401138
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401127
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x401111
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x401127
push eax
push edi
push dword [ebp - 0x110]
call section..text
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x40113a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00470e77
leave
ret 4

Function at 0x403b50
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x4908f8
mov dword [ebp - 4], 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 0
mov edi, eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x4aa83c
push 1
push 0
push 0x4aa90c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jne 0x403bc0
mov eax, dword [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push ebx
mov ecx, dword [eax]
push esi
push esi
push esi
push esi
push esi
push esi
push edi
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jne 0x403bbf
push eax
push eax
push 3
push 4
push eax
push eax
push 0xa
push dword [ebx]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
pop ebx
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x403bd4
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42e3d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48a658
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x4bc1dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0
call fcn.0046b860
test eax, eax
jne 0x42e422
push 0x30
push 0x49794c
push str.The_full_name_of_the_selected_directory_or_file_is_not_available.
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x42e58c
push 0x3c
lea eax, [ebp - 0x70]
mov dword [ebp - 0x78], 0x44
push 0
push eax
mov dword [ebp - 0x74], 0
call fcn.00471730
xorps xmm0, xmm0
push str.explorer__select_
movdqu xmmword [ebp - 0x34], xmm0
call fcn.0046b670
push eax
push str.explorer__select_
call fcn.0046b800
add esp, 0x18
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
call fcn.0046b3d0
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x42e484
call fcn.0046b840
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.0046b310
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x42e56a
push 0x49cdcc
call fcn.0046b670
push eax
push 0x49cdcc
call fcn.0046b800
mov dword [ebp - 0x1c], eax
push str.Explorer_could_not_open
mov byte [ebp - 4], 4
call fcn.0046b670
push eax
push str.Explorer_could_not_open
call fcn.0046b800
add esp, 0x18
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
call fcn.0046b3d0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 6
push ecx
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.0046b3d0
mov ecx, dword [ebp - 0x24]
mov byte [ebp - 4], 8
test ecx, ecx
je 0x42e51f
call fcn.0046b840
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 9
test ecx, ecx
je 0x42e52f
call fcn.0046b840
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0xa
test ecx, ecx
je 0x42e53f
call fcn.0046b840
push 0x30
push 0x49794c
lea ecx, [ebp - 0x20]
call fcn.0046b310
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 4], 3
test ecx, ecx
je 0x42e57c
call fcn.0046b840
jmp 0x42e57c
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x42e58c
call fcn.0046b840
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x42e59f
call fcn.0046b840
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x432210
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x218], 0
call fcn.00471730
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea eax, [ebp - 0x210]
push eax
push 0x12
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jns 0x432283
push 0
call fcn.0046b670
push eax
push 0
jmp 0x43230d
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x238]
push eax
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x22c], str.Select_Remote_Computer
mov dword [ebp - 0x228], 0x1000
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
test eax, eax
je 0x4322e7
mov ecx, dword [ebp - 0x214]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [ebp - 0x214]
push dword [ebp - 0x210]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea eax, [ebp - 0x20c]
push eax
call fcn.0046b670
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0046b800
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [esi], eax
xor ecx, ebp
mov eax, esi
pop edi
pop esi
call fcn.00470e77
mov esp, ebp
pop ebp
ret

Function at 0x434270
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4342ee
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
call fcn.0046b860
lea eax, [eax*2 + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, edi
mov esi, eax
call fcn.0046b860
mov ecx, edi
lea eax, [eax*2 + 2]
push eax
call fcn.0046b310
push eax
push esi
call fcn.00471f50
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret
xor al, al
pop ebp
ret
Function at 0x437b30
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
push 0x38
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x248]
push 0
push eax
call fcn.00471730
add esp, 0xc
mov dword [ebp - 0x23c], esi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, str.Open
test bl, bl
mov dword [ebp - 0x24c], 0x3c
mov eax, str.Runas
mov dword [ebp - 0x248], 0x40
cmove eax, ecx
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x230], eax
lea eax, [ebp - 0x24c]
push eax
mov dword [ebp - 0x238], edi
call esi
test eax, eax
je 0x437bdd
mov eax, dword [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x437bfb
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x210]
push 0x104
mov byte [eax], 1
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x24c]
push eax
call esi
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
and eax, dword [ebp - 0x214]
pop esi
pop ebx
call fcn.00470e77
mov esp, ebp
pop ebp
ret
Function at 0x43b320
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 1
push 2
mov dword [ebp - 0x18], 0
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
jne 0x43b361
push str.Unable_to_create_socket
call fcn.0046b670
push eax
push str.Unable_to_create_socket
jmp 0x43b3ce
mov eax, 2
mov dword [ebp - 0xa], 0
xorps xmm0, xmm0
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 0xc]
movq qword [ebp - 0x12], xmm0
push 0x5ab3
mov word [ebp - 6], 0
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x43b3be
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push str.Unable_to_connect_to_remote_system
call fcn.0046b670
push eax
push str.Unable_to_connect_to_remote_system
jmp 0x43b3ce
push 0
mov dword [0x4bc118], edi
call fcn.0046b670
push eax
push 0
call fcn.0046b800
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [esi], eax
xor ecx, ebp
mov eax, esi
pop edi
pop esi
call fcn.00470e77
mov esp, ebp
pop ebp
ret
Function at 0x43bd60
Capabilities:
Create tcp socket
Create udp socket
Get hostname
Get local ipv4 addresses
Get socket information
Resolve dns
Start tcp server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 1
push 2
mov dword [ebp - 0x124], 0
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
jne 0x43bdaa
push str.Unable_to_create_socket
call fcn.0046b670
push eax
push str.Unable_to_create_socket
jmp 0x43beb2
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x118], xmm0
mov cx, word [eax + 8]
mov word [ebp - 0x118], cx
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x114]
push eax
call fcn.00471f50
add esp, 0xc
push 0x5ab3
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x116], ax
lea eax, [ebp - 0x118]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x43be3c
push str.Unable_to_bind_socket
call fcn.0046b670
push eax
push str.Unable_to_bind_socket
jmp 0x43beb2
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], 0x10
push eax
lea eax, [ebp - 0x118]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x43be71
push str.Unable_to_query_the_port
call fcn.0046b670
push eax
push str.Unable_to_query_the_port
jmp 0x43beb2
push 0
push edi
call dword [sym.imp.WS2_32.dll_listen]
push 0
push 0
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [0x4bc118], eax
cmp eax, 0xffffffff
jne 0x43bea1
push str.Accept_failed
call fcn.0046b670
push eax
push str.Accept_failed
jmp 0x43beb2
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.0046b670
push eax
push 0
call fcn.0046b800
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [esi], eax
xor ecx, ebp
mov eax, esi
pop edi
pop esi
call fcn.00470e77
mov esp, ebp
pop ebp
ret

Function at 0x43d320
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
lea eax, [ebp - 0x118]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
mov dword [ebp - 0x11c], 0
call fcn.00471730
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jb 0x43d385
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x43d3c9
mov eax, dword [ebp - 0x118]
test eax, eax
je 0x43d3c9
cmp eax, 1
jne 0x43d3af
cmp word [ebp - 0xc], 2
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x43d3c9
cmp byte [ebp - 6], 1
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret