joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ee90
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
cmp eax, 0x7a
jne 0x42eef2
mov eax, dword [ebp - 8]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
test eax, eax
jne 0x42eee8
mov eax, dword [ebp - 4]
jmp 0x42eef4
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x42f100
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x55d68c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x68], ecx
lea ecx, [ebp - 0x38]
call fcn.00402b30
mov dword [ebp - 4], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov word [ebp - 0xb], ax
mov dword [ebp - 0x40], 0
push 0x288
call fcn.0045585b
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x3c], 0x288
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
je 0x42f198
mov eax, dword [ebp - 4]
push eax
call fcn.00455821
add esp, 4
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.0045585b
add esp, 4
mov dword [ebp - 4], eax
lea edx, [ebp - 0x3c]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x42f293
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x44], 0
je 0x42f293
mov edx, dword [ebp - 0x44]
add edx, 0x1b0
push edx
lea ecx, [ebp - 0x64]
call fcn.00402b60
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x64]
push ecx
call fcn.00417af0
add esp, 8
movzx edx, al
test edx, edx
je 0x42f27e
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0x190], 6
jne 0x42f268
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov word [ebp - 0xc], cx
mov byte [ebp - 0xa], cl
mov edx, dword [ebp - 0x44]
movzx eax, byte [edx + 0x199]
push eax
mov ecx, dword [ebp - 0x44]
movzx edx, byte [ecx + 0x198]
push edx
mov eax, dword [ebp - 0x44]
movzx ecx, byte [eax + 0x197]
push ecx
mov edx, dword [ebp - 0x44]
movzx eax, byte [edx + 0x196]
push eax
mov ecx, dword [ebp - 0x44]
movzx edx, byte [ecx + 0x195]
push edx
mov eax, dword [ebp - 0x44]
movzx ecx, byte [eax + 0x194]
push ecx
push str._02X__02X__02X__02X__02X__02X
push 0x12
push 0x13
lea edx, [ebp - 0x1c]
push edx
call fcn.00455cd4
add esp, 0x28
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x38]
call fcn.00408070
lea ecx, [ebp - 0x64]
call fcn.00402c40
jmp 0x42f293
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx]
mov dword [ebp - 0x44], edx
lea ecx, [ebp - 0x64]
call fcn.00402c40
jmp 0x42f1b9
cmp dword [ebp - 4], 0
je 0x42f2a5
mov eax, dword [ebp - 4]
push eax
call fcn.00455821
add esp, 4
lea ecx, [ebp - 0x38]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402bf0
lea ecx, [ebp - 0x38]
call fcn.00402c40
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00455328
mov esp, ebp
pop ebp
ret 8
Function at 0x434100
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x55d68c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], 0x3f
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemBIOS_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4341c0
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x48]
push edx
push 0
push 0
push str.SystemManufacturer
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x54]
add edx, 1
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x54]
mov cl, byte [eax]
mov byte [ebp - 0x59], cl
add dword [ebp - 0x54], 1
cmp byte [ebp - 0x59], 0
jne 0x434167
mov edx, dword [ebp - 0x54]
sub edx, dword [ebp - 0x58]
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x60]
push eax
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.USER32.dll_CharLowerBuffA]
push 0x550e5c
lea edx, [ebp - 0x48]
push edx
call fcn.0041a280
add esp, 8
test eax, eax
je 0x4341b6
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4341c2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00455328
mov esp, ebp
pop ebp
ret
Function at 0x4341d0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x55d68c]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x10], str.qemu
mov dword [ebp - 0xc], str.virtual
mov dword [ebp - 8], str.vmware
mov dword [ebp - 4], 0
push 0
push 0
push 3
push 0
push 3
push 0
push str..PhysicalDrive0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xffffffff
je 0x43441d
mov dword [ebp - 0x138], 0
xor eax, eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], 0
push 0x80
push 0
lea ecx, [ebp - 0x98]
push ecx
call fcn.004611e0
add esp, 0xc
push 0x80
push 0
lea edx, [ebp - 0x120]
push edx
call fcn.004611e0
add esp, 0xc
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80
lea ecx, [ebp - 0x98]
push ecx
push 0xc
lea edx, [ebp - 0x134]
push edx
push 0x2d1400
mov eax, dword [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x434410
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x13c], ecx
mov edx, dword [ebp - 0x13c]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
mov ecx, dword [ebp - 0x144]
mov dword [ebp - 0x148], ecx
jmp 0x43431b
mov edx, dword [ebp - 0x148]
add edx, 1
mov dword [ebp - 0x148], edx
mov eax, dword [ebp - 0x148]
movsx ecx, byte [ebp + eax - 0x98]
test ecx, ecx
je 0x434358
mov edx, dword [ebp - 0x140]
mov eax, dword [ebp - 0x148]
mov cl, byte [ebp + eax - 0x98]
mov byte [ebp + edx - 0x120], cl
mov edx, dword [ebp - 0x140]
add edx, 1
mov dword [ebp - 0x140], edx
jmp 0x43430c
lea eax, [ebp - 0x120]
mov dword [ebp - 0x154], eax
mov ecx, dword [ebp - 0x154]
add ecx, 1
mov dword [ebp - 0x158], ecx
mov edx, dword [ebp - 0x154]
mov al, byte [edx]
mov byte [ebp - 0x159], al
add dword [ebp - 0x154], 1
cmp byte [ebp - 0x159], 0
jne 0x434373
mov ecx, dword [ebp - 0x154]
sub ecx, dword [ebp - 0x158]
mov dword [ebp - 0x160], ecx
mov edx, dword [ebp - 0x160]
push edx
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffA]
mov dword [ebp - 0x14c], 0
jmp 0x4343d2
mov ecx, dword [ebp - 0x14c]
add ecx, 1
mov dword [ebp - 0x14c], ecx
cmp dword [ebp - 0x14c], 3
jae 0x434410
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp + edx*4 - 0x10]
movsx ecx, byte [eax]
test ecx, ecx
je 0x43440e
mov edx, dword [ebp - 0x14c]
mov eax, dword [ebp + edx*4 - 0x10]
push eax
lea ecx, [ebp - 0x120]
push ecx
call fcn.0041a280
add esp, 8
test eax, eax
je 0x43440e
mov al, 1
jmp 0x43441f
jmp 0x4343c3
mov edx, dword [ebp - 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00455328
mov esp, ebp
pop ebp
ret
Function at 0x439110
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.0043b9e0
mov ecx, dword [ebp - 8]
add ecx, 0x1c
call fcn.0043b9e0
mov eax, dword [ebp - 8]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x38], 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x3c], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x40], eax
mov edx, dword [ebp - 8]
add edx, 0x44
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x40]
push ecx
push str.m_hSemaphore__08x
call fcn.0041a270
add esp, 8
mov dword [ebp - 4], 0
jmp 0x439197
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jge 0x4391c3
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x4393b0
call fcn.00457fcd
add esp, 0xc
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x34]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x34], eax
jmp 0x43918e
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x439250
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add eax, 0x44
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
jmp 0x439278
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 8]
jae 0x4392a4
mov eax, dword [ebp - 8]
push eax
push 0
push 0x4393b0
call fcn.00457fcd
add esp, 0xc
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x34]
add edx, 1
mov eax, dword [ebp - 8]
mov dword [eax + 0x34], edx
jmp 0x43926f
mov ecx, dword [ebp - 8]
add ecx, 0x44
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x439820
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x56bcb8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x100000
call fcn.0045441e
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax + 0x10c], ecx
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x10c], 0
jne 0x439866
mov eax, 1
jmp 0x439969
push 0x100000
push 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x10c]
push ecx
call fcn.004611e0
add esp, 0xc
call fcn.0043f7e0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x104], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x104], 0xffffffff
jne 0x4398c3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.could_not_create_socket__d
call fcn.0041a270
add esp, 8
mov eax, 2
jmp 0x439969
mov ecx, 2
mov edx, dword [ebp - 0xc]
mov word [edx + 0xe0], cx
mov eax, dword [ebp - 0xc]
mov dword [eax + 0xe4], 0
movzx ecx, word [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [ebp - 0xc]
mov word [edx + 0xe2], ax
push 0x10
mov eax, dword [ebp - 0xc]
add eax, 0xe0
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x104]
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x43993f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Bind_failed_with_error_code_:__d
call fcn.0041a270
add esp, 8
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x104]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, 3
jmp 0x439969
mov dword [ebp - 4], 0x10
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x104]
push ecx
call dword [sym.imp.WS2_32.dll_listen]
push str.listening
call fcn.0041a270
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x43de00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x56c630]
and eax, 1
jne 0x43de30
mov ecx, dword [0x56c630]
or ecx, 1
mov dword [0x56c630], ecx
push str.C90BB3C4_F94A_4D8F_ADA7_C7CED8C1B66A
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x56c62c], eax
cmp dword [0x56c62c], 0
jne 0x43de3f
xor al, al
jmp 0x43de52
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43de50
xor al, al
jmp 0x43de52
mov al, 1
pop ebp
ret

Function at 0x43de60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x55b590
push 0x45e340
mov eax, dword fs:[0]
push eax
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, dword [0x55d68c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
push 0x4408e0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [ebp - 4], 0
push 0x54d56c
call fcn.0043fd50
add esp, 4
push 0x54d584
call fcn.0043fd50
add esp, 4
push 0x54d59c
call fcn.0043f910
add esp, 4
call fcn.0043de00
movzx eax, al
test eax, eax
jne 0x43defb
push str.InitPassGuard_failure
call fcn.0043c740
add esp, 4
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x28]
jmp 0x43dfc3
mov dword [ebp - 4], 0xfffffffe
jmp 0x43df4e
push 0
push 0
push 0
push 0x43dc60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x1c], eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x43da30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x20], eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x54d5e4
call fcn.0043c740
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43f110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x55d68c]
xor eax, ebp
mov dword [ebp - 0xc], eax
push esi
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
cmp dword [eax + 0x44], 0
je 0x43f138
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x43f144
mov al, 1
jmp 0x43f2bd
mov dword [ebp - 4], 8
call fcn.00406690
push eax
mov eax, dword [ebp - 0x4c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x30], eax
call fcn.00406690
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x34]
push edx
call fcn.00406640
add esp, 8
movzx eax, al
test eax, eax
je 0x43f187
xor al, al
jmp 0x43f2bd
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00408030
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x38]
push edx
lea ecx, [ebp - 0x28]
call fcn.00411730
mov ecx, eax
call fcn.00417c30
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.004324d0
add esi, eax
push esi
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00411730
mov ecx, eax
call fcn.00417c30
push eax
mov ecx, dword [ebp - 0x4c]
add ecx, 0x4c
push ecx
mov edx, dword [ebp - 0x4c]
mov ecx, dword [edx + 0x44]
call fcn.0043f5d0
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x43f1fb
cmp dword [ebp - 0x50], 1
je 0x43f202
cmp dword [ebp - 0x50], 3
je 0x43f28e
jmp 0x43f29f
mov eax, dword [ebp - 0x4c]
mov byte [eax + 0x49], 0
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00411730
mov ecx, eax
call fcn.00417c30
mov edx, dword [ebp - 8]
sub edx, eax
mov dword [ebp - 0x2c], edx
je 0x43f25e
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
push 1
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x28]
call fcn.00411730
mov ecx, eax
call fcn.00417c30
push eax
call fcn.00458efb
add esp, 0x10
cmp dword [ebp - 0x2c], eax
je 0x43f25e
mov byte [ebp - 0x45], 0
lea ecx, [ebp - 0x28]
call fcn.00402c40
mov al, byte [ebp - 0x45]
jmp 0x43f2bd
mov ecx, dword [ebp - 0x4c]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x43f27a
mov byte [ebp - 0x46], 1
lea ecx, [ebp - 0x28]
call fcn.00402c40
mov al, byte [ebp - 0x46]
jmp 0x43f2bd
cmp dword [ebp - 0x2c], 0
jne 0x43f28c
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00409670
jmp 0x43f2b0
mov byte [ebp - 0x47], 1
lea ecx, [ebp - 0x28]
call fcn.00402c40
mov al, byte [ebp - 0x47]
jmp 0x43f2bd
mov byte [ebp - 0x48], 0
lea ecx, [ebp - 0x28]
call fcn.00402c40
mov al, byte [ebp - 0x48]
jmp 0x43f2bd
jmp 0x43f193
pop esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00455328
mov esp, ebp
pop ebp
ret
Function at 0x43f7e0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov eax, dword [0x55d68c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x202
mov word [ebp - 0x19c], ax
lea ecx, [ebp - 0x198]
push ecx
movzx edx, word [ebp - 0x19c]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
je 0x43f837
push 0x54c3f8
call fcn.0041a270
add esp, 4
mov eax, 1
jmp 0x43f88c
movzx eax, word [ebp - 0x198]
and eax, 0xff
movzx ecx, al
cmp ecx, 2
jne 0x43f863
movzx edx, word [ebp - 0x198]
shr edx, 8
and edx, 0xff
movzx eax, dl
cmp eax, 2
je 0x43f87d
push str.Tell_the_user_that_we_could_not_find_a_usable_WinSock_DLL
call fcn.0041a270
add esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x43f88c
push str.init_socket_success
call fcn.0041a270
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455328
mov esp, ebp
pop ebp
ret
Function at 0x4406e0
Capabilities:
Check if file exists
Create directory
Create process memory minidump
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x55d68c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x148], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 4]
mov dword [ebp - 0x144], eax
mov byte [ebp - 0x248], 0
push 0xff
push 0
lea ecx, [ebp - 0x247]
push ecx
call fcn.004611e0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x248]
push edx
push 0x54c804
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x44075e
push 0
lea ecx, [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [ebp - 0x140], 0
push 0xff
push 0
lea edx, [ebp - 0x13f]
push edx
call fcn.004611e0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov dword [ebp - 0x3c], 0
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
movzx edx, word [ebp - 0x14]
sub edx, 0x76c
mov dword [ebp - 0x28], edx
movzx eax, word [ebp - 0x12]
sub eax, 1
mov dword [ebp - 0x2c], eax
movzx ecx, word [ebp - 0xe]
mov dword [ebp - 0x30], ecx
movzx edx, word [ebp - 0xc]
mov dword [ebp - 0x34], edx
movzx eax, word [ebp - 0xa]
mov dword [ebp - 0x38], eax
movzx ecx, word [ebp - 8]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xffffffff
lea edx, [ebp - 0x3c]
push edx
call fcn.0043f7c0
add esp, 4
push edx
push eax
push 0x54c81c
lea eax, [ebp - 0x140]
push eax
call fcn.00455c32
add esp, 0x10
lea ecx, [ebp - 0x140]
push ecx
lea edx, [ebp - 0x248]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x4408c7
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x258], ecx
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x24c], 0
push 0
push 0
lea edx, [ebp - 0x25c]
push edx
mov eax, dword [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
mov dword [ebp - 0x250], eax
lea edx, [ebp - 0x248]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0x54c828
call fcn.0043c740
add esp, 0xc
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00455328
mov esp, ebp
pop ebp
ret
Function at 0x443e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp esi, ebx
je 0x443f03
cmp dword [ebp + 8], ebx
je 0x443f03
mov eax, dword [esi + 0x24]
push edi
mov edi, dword [esi + 0x20]
mov ecx, edi
xor ecx, 0x18
shr ecx, 3
and ecx, 0x3f
mov byte [ecx + esi + 0x28], 0x80
add dword [esi + 0x20], 8
mov dword [ebp - 4], eax
jne 0x443e6e
inc dword [esi + 0x24]
mov dword [esi + 0x20], ebx
test dword [esi + 0x20], 0x1ff
jne 0x443e80
push esi
call fcn.00443920
add esp, 4
mov edx, dword [esi + 0x20]
and edx, 0x1ff
cmp edx, 0x1c0
je 0x443ed0
mov eax, dword [esi + 0x20]
xor eax, 0x18
shr eax, 3
and eax, 0x3f
mov byte [eax + esi + 0x28], bl
add dword [esi + 0x20], 8
jne 0x443ead
inc dword [esi + 0x24]
mov dword [esi + 0x20], ebx
test dword [esi + 0x20], 0x1ff
jne 0x443ebf
push esi
call fcn.00443920
add esp, 4
mov ecx, dword [esi + 0x20]
and ecx, 0x1ff
cmp ecx, 0x1c0
jne 0x443e91
mov edx, dword [ebp - 4]
push esi
mov dword [esi + 0x60], edx
mov dword [esi + 0x64], edi
call fcn.00443920
add esp, 4
xor eax, eax
pop edi
mov ecx, eax
xor ecx, 3
mov dl, byte [ecx + esi]
mov ecx, dword [ebp + 8]
mov byte [eax + ecx], dl
inc eax
cmp eax, 0x20
jl 0x443ee5
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x443f10
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
mov eax, dword [0x55d68c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
xor ecx, 0xa3b1bac6
xor edx, 0x56aa3350
mov dword [ebp - 0x124], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x120], edx
mov edx, dword [eax + 0xc]
push ebx
xor ecx, 0x677d9197
xor edx, 0xb27022dc
push esi
mov dword [ebp - 0x84], 0x70e15
mov dword [ebp - 0x80], 0x1c232a31
mov dword [ebp - 0x7c], 0x383f464d
mov dword [ebp - 0x78], 0x545b6269
mov dword [ebp - 0x74], 0x70777e85
mov dword [ebp - 0x70], 0x8c939aa1
mov dword [ebp - 0x6c], 0xa8afb6bd
mov dword [ebp - 0x68], 0xc4cbd2d9
mov dword [ebp - 0x64], 0xe0e7eef5
mov dword [ebp - 0x60], 0xfc030a11
mov dword [ebp - 0x5c], 0x181f262d
mov dword [ebp - 0x58], 0x343b4249
mov dword [ebp - 0x54], 0x50575e65
mov dword [ebp - 0x50], 0x6c737a81
mov dword [ebp - 0x4c], 0x888f969d
mov dword [ebp - 0x48], 0xa4abb2b9
mov dword [ebp - 0x44], 0xc0c7ced5
mov dword [ebp - 0x40], 0xdce3eaf1
mov dword [ebp - 0x3c], 0xf8ff060d
mov dword [ebp - 0x38], 0x141b2229
mov dword [ebp - 0x34], 0x30373e45
mov dword [ebp - 0x30], 0x4c535a61
mov dword [ebp - 0x2c], 0x686f767d
mov dword [ebp - 0x28], 0x848b9299
mov dword [ebp - 0x24], 0xa0a7aeb5
mov dword [ebp - 0x20], 0xbcc3cad1
mov dword [ebp - 0x1c], 0xd8dfe6ed
mov dword [ebp - 0x18], 0xf4fb0209
mov dword [ebp - 0x14], 0x10171e25
mov dword [ebp - 0x10], 0x2c333a41
mov dword [ebp - 0xc], 0x484f565d
mov dword [ebp - 8], 0x646b7279
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], edx
xor esi, esi
jmp 0x444050
mov eax, dword [ebp + esi - 0x84]
xor eax, dword [ebp + esi - 0x120]
add esi, 4
xor eax, dword [ebp + esi - 0x11c]
xor eax, dword [ebp + esi - 0x120]
mov ebx, eax
mov ecx, eax
shr ecx, 0x18
movzx ecx, byte [ecx + 0x54aa10]
mov edx, eax
shr ebx, 0x10
shr edx, 8
shl ecx, 8
movzx ebx, bl
movzx ebx, byte [ebx + 0x54aa10]
movzx edx, dl
movzx edx, byte [edx + 0x54aa10]
or ecx, ebx
movzx eax, al
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 0x54aa10]
shl ecx, 8
or ecx, edx
mov eax, ecx
rol eax, 0xd
mov edx, ecx
ror edx, 9
xor eax, edx
xor eax, dword [ebp + esi - 0x128]
xor eax, ecx
mov dword [ebp + esi - 0x118], eax
mov dword [esi + edi - 4], eax
cmp esi, 0x80
jb 0x444050
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00455328
mov esp, ebp
pop ebp
ret