joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005350
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x10058074]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
push 0x1a
push eax
push 0
call fcn.10005c90
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005396
sub ecx, edx
sar ecx, 1
mov dword [ebp - 0x210], ecx
call fcn.10010140
test al, al
je 0x100053ce
pop edi
pop edi
push esp
pop esp
pop edx
pop esi
pop ebx
pop ebx
push edi
push eax
pop esi
pop edx
pop ebx
pop ecx
push ebx
pop edi
pop ebx
pop esi
pop esi
push ebx
pop edx
pop ecx
push ecx
push esi
pop ebp
push eax
call fcn.10010ae0
test al, al
je 0x100053e8
pop ebx
pop ebp
push esi
push eax
pop edi
push ecx
pop esi
pop edx
pop edx
push ebx
pop esi
push ebp
pop ebp
pop ebx
pop esi
pop ebx
pop edi
cmp dword [ebp - 0x210], 0
je 0x10005536
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10005400
mov eax, dword [0x10043334]
mov edx, dword [ebp - 0x214]
mov esi, edx
mov dword [edi], eax
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x10005420
lea edi, [ebp - 0x20c]
sub edx, esi
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10005436
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax]
mov cx, word [edi + 2]
lea edi, [edi + 2]
test cx, cx
jne 0x10005460
mov dword [edi], eax
call fcn.10010450
test al, al
je 0x10005493
pop eax
pop ebp
pop edi
push ebx
push esi
pop edx
pop esp
push edx
pop esi
pop edx
push esp
pop edx
push ebx
pop edi
push esp
push ebp
push edx
pop esp
push edx
push edi
push esp
pop esp
pop ecx
pop ecx
pop ebx
push edi
push ebp
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100054b3
lea eax, [ebp - 0x20c]
push eax
call fcn.10005190
add esp, 4
call fcn.100100d0
test al, al
je 0x100054d7
pop esi
pop eax
push edx
push edx
push esi
pop esp
pop eax
pop edi
pop esi
pop esp
push esi
pop eax
push esp
push eax
push ebp
push ebx
pop ebp
push edx
push esp
pop edx
push edx
pop edx
push edx
push eax
pop eax
pop ecx
push esp
call fcn.100108b0
test al, al
je 0x100054fd
push edx
pop ebp
pop ebx
pop ecx
pop ebx
push ebx
pop ebx
push edi
pop esi
push edx
push ebx
pop ebp
push ecx
push ecx
pop esp
pop edi
pop edx
push eax
pop ebp
pop esi
pop edi
push edx
pop ebp
push ebp
pop eax
push ebx
push edx
push eax
pop eax
cmp word [ebp - 0x20c], 0
jne 0x1000550b
xor ecx, ecx
jmp 0x10005523
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005514
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
call fcn.10004960
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001212b
mov esp, ebp
pop ebp
ret
Function at 0x10007a40
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov byte [esi + 0x89], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x10007a84
mov eax, dword [eax]
push ecx
push eax
mov ecx, esi
call fcn.10008d50
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10014caf
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10039f61
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10039c21

Function at 0x405cd6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405d15
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405d15
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405d15
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405d15
cmp dword [ecx + 0x74], 0xe
jbe 0x405d15
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x402840
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417ddf
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x420008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x24], esi
mov dword [esi], 0x16fc1508
xor ecx, ecx
mov dword [esi + 4], 0x88a08ddc
mov dword [esi + 8], 0x403a2f11
mov dword [esi + 0xc], 0xff906aa5
mov dword [esi + 0x10], 0x2aaa0010
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 7
mov dword [ebp - 0x28], esi
mov word [esi + 0x18], cx
mov dword [ebp - 4], ecx
mov dword [esi + 0x64], ecx
mov dword [esi + 0x8c], ecx
mov dword [esi + 0xb4], ecx
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov byte [ebp - 4], 3
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x20]
push eax
mov dword [esi + 0x38], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x34], ecx
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.RPCRT4.dll_UuidCreate]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.RPCRT4.dll_UuidToStringW]
mov edi, dword [ebp - 0x24]
test edi, edi
je 0x402933
mov edx, edi
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402910
sub edx, ecx
lea ecx, [esi + 0x18]
sar edx, 1
push edx
push edi
call fcn.00402320
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov ecx, esi
call fcn.00403bc0
mov ecx, esi
call fcn.00403fd0
lea edi, [esi + 0x40]
mov byte [ebp - 4], 4
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x402964
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
lea edi, [esi + 0x68]
mov byte [ebp - 4], 5
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x402987
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
lea edi, [esi + 0x90]
mov byte [ebp - 4], 6
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x4029ad
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
push 0x400
lea ecx, [esi + 0xbc]
mov byte [esi + 0xb8], 0
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004168de
mov esp, ebp
pop ebp
ret 4
Function at 0x402a50
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417e30
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x420008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x38]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x402a8e
push eax
call edi
mov dword [esi + 0x38], 0xffffffff
mov eax, dword [esi + 0x3c]
cmp eax, 0xffffffff
je 0x402aa0
push eax
call edi
mov dword [esi + 0x3c], 0xffffffff
mov eax, dword [esi + 0x30]
cmp eax, 0xffffffff
je 0x402acb
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x402ac6
push 0
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x30]
call edi
lea eax, [esi + 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea edi, [esi + 0x90]
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x402b01
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
lea edi, [esi + 0x68]
mov dword [ebp - 4], 1
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x402b27
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
lea edi, [esi + 0x40]
mov dword [ebp - 4], 2
mov ecx, dword [edi + 0x24]
test ecx, ecx
je 0x402b4d
mov edx, dword [ecx]
cmp ecx, edi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [edi + 0x24], 0
mov ecx, dword [esi + 0x2c]
cmp ecx, 8
jb 0x402b83
mov eax, dword [esi + 0x18]
lea ecx, [ecx*2 + 2]
cmp ecx, 0x1000
jb 0x402b79
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402ba8
mov eax, edx
push ecx
push eax
call fcn.00416baa
add esp, 8
xor eax, eax
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 7
mov word [esi + 0x18], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x402f00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x420008]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], eax
push edi
xor edi, edi
mov eax, dword [esi + 0x38]
cmp eax, 0xffffffff
je 0x402f30
cmp dword [esi + 0x3c], 0xffffffff
jne 0x402f3f
call fcn.00403bc0
mov ecx, esi
call fcn.00403fd0
mov eax, dword [esi + 0x38]
cmp eax, 0xffffffff
je 0x402ffd
cmp dword [esi + 0x3c], 0xffffffff
je 0x402ffd
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
xorps xmm0, xmm0
push ecx
push 0xc
lea ecx, [esp + 0x24]
movq qword [esp + 0x24], xmm0
push ecx
push eax
mov word [esp + 0x2c], 0xe51c
call edi
test eax, eax
jne 0x402f8f
mov ecx, esi
call fcn.00403bc0
mov ecx, esi
call fcn.00403fd0
mov al, byte [ebp + 8]
mov ebx, dword [ebp + 0x10]
push 0
mov byte [esp + 0x1f], al
lea eax, [esp + 0x18]
push eax
push 0xc
lea eax, [esp + 0x24]
mov byte [esp + 0x25], 0xe6
push eax
push dword [esi + 0x38]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], ebx
call edi
mov edi, eax
test edi, edi
je 0x402fe7
mov eax, dword [esp + 0x10]
test eax, eax
je 0x402fe3
test ebx, ebx
jle 0x402fe3
push 0
lea ecx, [esp + 0x18]
push ecx
push ebx
push eax
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test edi, edi
jne 0x402ffd
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004168de
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004168de
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403a80
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x38]
cmp eax, 0xffffffff
je 0x403a9c
push eax
call edi
mov dword [esi + 0x38], 0xffffffff
mov eax, dword [esi + 0x3c]
cmp eax, 0xffffffff
je 0x403aae
push eax
call edi
mov dword [esi + 0x3c], 0xffffffff
mov eax, dword [esi + 0x30]
cmp eax, 0xffffffff
je 0x403ae0
push 0xbb8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x403ad4
push 0
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x30]
call edi
mov dword [esi + 0x30], 0xffffffff
pop edi
pop esi
ret
Function at 0x404e20
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417e10
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x420008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
mov dword [esi], vtable.CUploadScheduler.0
test eax, eax
je 0x404e69
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 8], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x404e7d
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], 0
test byte [ebp + 8], 1
je 0x404e8e
push 0x10
push esi
call fcn.00416baa
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x404fd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x420008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0x400
jne 0x405052
cmp dword [ebp + 0xc], 0
jne 0x405052
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x41a0c0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40509f
push 0xc
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.00404f50
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push 0
push str.ExpireTimeHigh
push dword [ebp - 0x14]
call esi
lea eax, [ebp - 0x10]
jmp 0x40508e
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push 0
push 0x41a0c0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40509f
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp + 8]
push 4
push eax
push 4
push 0
push str.ExpireTimeHigh
push dword [ebp - 0x14]
call esi
lea eax, [ebp + 0xc]
push 4
push eax
push 4
push 0
push str.ExpireTimeLow
push dword [ebp - 0x14]
call esi
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4050ad
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004168de
mov esp, ebp
pop ebp
ret 8
Function at 0x4050c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x420008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push 0x41a0c0
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4051a4
test eax, eax
jne 0x4051a4
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebx + 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.ExpireTimeHigh
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 0
push str.ExpireTimeLow
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test edi, edi
pop edi
jne 0x405186
test eax, eax
jne 0x405186
push dword [ebp - 0x10]
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004168de
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 0x10]
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004168de
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x11]
xor ecx, ebp
pop ebx
call fcn.004168de
mov esp, ebp
pop ebp
ret 4
Function at 0x405450
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418030
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x420008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x34], 0
mov dword [esi], vtable.CGiftBoxService.0
je 0x4054d4
mov edi, dword [0x420cf8]
test edi, edi
je 0x4054cd
mov eax, dword [edi]
test eax, eax
je 0x4054ae
push eax
call dword [sym.imp.wevtapi.dll_EvtClose]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [edi], 0
cmp dword [0x420cf8], edi
jne 0x4054b8
mov dword [0x420cf8], 0
push 8
push edi
call fcn.00416baa
add esp, 8
mov dword [0x420cf8], 0
mov dword [esi + 0x34], 0
mov ecx, dword [0x420cfc]
test ecx, ecx
je 0x4054ee
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [0x420cfc], 0
mov ebx, dword [esi + 0x30]
test ebx, ebx
je 0x405597
mov edi, dword [ebx + 0x20]
test edi, edi
je 0x405569
mov ecx, dword [edi + 4]
mov dword [edi + 0x10], 1
test ecx, ecx
je 0x405513
call fcn.0040e1a0
mov eax, dword [edi + 8]
test eax, eax
je 0x405538
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x405538
push 0
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x40554c
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 4], 0
mov dword [edi + 0x10], 0
mov edi, dword [ebx + 0x20]
test edi, edi
je 0x405569
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov dword [ebx + 0x20], 0
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x40557d
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebx + 0x24], 0
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x405597
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x30], 0
cmp dword [esi + 0x2c], 0
je 0x40560d
push 0
push 0
push 0x419648
call dword [sym.imp.RPCRT4.dll_RpcServerUnregisterIf]
push 0
push dword [0x420d34]
push 0x419648
call dword [sym.imp.RPCRT4.dll_RpcEpUnregister]
cmp dword [0x420d34], 0
je 0x4055dd
push 0x420d34
call dword [sym.imp.RPCRT4.dll_RpcBindingVectorFree]
mov dword [0x420d34], 0
push 0x1388
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4055fd
push 0
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x2c], 0
mov dword [esi], vtable.CServiceBase.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405630
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x420008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
mov esi, ecx
push eax
push 0
push 0
push 0x405380
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2c], eax
test eax, eax
je 0x40567e
lea eax, [ebp - 8]
push eax
push 0
push esi
push 0x405370
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x28], eax
test eax, eax
jne 0x405685
mov ecx, esi
call fcn.00410510
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004168de
mov esp, ebp
pop ebp
ret 8
Function at 0x405950
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x34]
test eax, eax
je 0x4059b3
mov edi, dword [0x420cf8]
mov dword [eax + 4], 0
test edi, edi
je 0x4059ac
mov eax, dword [edi]
test eax, eax
je 0x40598d
push eax
call dword [sym.imp.wevtapi.dll_EvtClose]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [edi], 0
cmp dword [0x420cf8], edi
jne 0x405997
mov dword [0x420cf8], 0
push 8
push edi
call fcn.00416baa
add esp, 8
mov dword [0x420cf8], 0
mov dword [esi + 0x34], 0
mov ecx, dword [0x420cfc]
test ecx, ecx
je 0x4059cd
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [0x420cfc], 0
push ebx
mov ebx, dword [esi + 0x30]
test ebx, ebx
je 0x405a77
mov edi, dword [ebx + 0x20]
test edi, edi
je 0x405a49
mov ecx, dword [edi + 4]
mov dword [edi + 0x10], 1
test ecx, ecx
je 0x4059f3
call fcn.0040e1a0
mov eax, dword [edi + 8]
test eax, eax
je 0x405a18
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x405a18
push 0
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x405a2c
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 4], 0
mov dword [edi + 0x10], 0
mov edi, dword [ebx + 0x20]
test edi, edi
je 0x405a49
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
mov dword [ebx + 0x20], 0
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x405a5d
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebx + 0x24], 0
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x405a77
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x30], 0
cmp dword [esi + 0x2c], 0
pop ebx
je 0x405aee
push 0
push 0
push 0x419648
call dword [sym.imp.RPCRT4.dll_RpcServerUnregisterIf]
push 0
push dword [0x420d34]
push 0x419648
call dword [sym.imp.RPCRT4.dll_RpcEpUnregister]
cmp dword [0x420d34], 0
je 0x405abe
push 0x420d34
call dword [sym.imp.RPCRT4.dll_RpcBindingVectorFree]
mov dword [0x420d34], 0
push 0x1388
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x405ade
push 0
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x2c], 0
pop edi
pop esi
ret

Function at 0x405b20
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
lea eax, [edx - 5]
cmp eax, 3
ja 0x405b3e
mov ecx, dword [ecx + 0x30]
test ecx, ecx
je 0x405b3e
mov dword [ebp + 0xc], edx
pop ebp
jmp fcn.00406230
pop ebp
ret 8
Function at 0x40e8d0
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x420008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0xffffffff
jne 0x40ea2c
push 0
push 1
push 2
mov dword [esi + 0x30], 0
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x40e93b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x41aa80
push 0x400
push dword [esi + 4]
call fcn.00404b30
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004168de
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x30], 0
lea ebx, [esi + 0xc]
mov eax, 2
mov word [ebx], ax
je 0x40e950
push 0
jmp 0x40e955
push 0x7f000001
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esi + 0x10], eax
xor edi, edi
movzx eax, word [esi + 0x3c]
push eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
push ebx
push dword [esi + 8]
mov word [esi + 0xe], ax
call dword [sym.imp.WS2_32.dll_bind]
mov edx, eax
test edx, edx
je 0x40e990
inc dword [esi + 0x3c]
inc edi
mov ecx, dword [esi + 0x3c]
movzx eax, cx
cmp edi, 0xa
jl 0x40e964
cmp edx, 0xffffffff
jne 0x40ea0e
push 0x10
push ebx
push dword [esi + 8]
xor eax, eax
mov word [esi + 0xe], ax
call dword [sym.imp.WS2_32.dll_bind]
mov edi, eax
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
push ebx
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_getsockname]
movzx ecx, word [esi + 0xe]
push ecx
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [esi + 0x3c], eax
cmp edi, 0xffffffff
jne 0x40ea0e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Failed_to_bind_stream_socket_:__d_n
push 0x400
push dword [esi + 4]
call fcn.00404b30
add esp, 0x10
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004168de
mov esp, ebp
pop ebp
ret 4
push 4
push dword [esi + 8]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x40ea2c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Failed_to_listen_stream_socket_:__d_n
jmp 0x40e9e0
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004168de
mov esp, ebp
pop ebp
ret 4