joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420074
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x47b870]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4200b7
cmp word [esi], dx
jne 0x4200b7
or byte [edi + eax + 0x28], 4
jmp 0x4200bc
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x42020f
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4201ef
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4200fe
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x420134
cmp eax, edx
jae 0x420140
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4200d6
jmp 0x42020f
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4201eb
cmp dword [ebp - 0x14], 0
je 0x4201eb
mov eax, dword [ebx*4 + 0x47b870]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4201c3
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x42018c
mov word [esi], cx
jmp 0x4201bf
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x47b870]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x47b870]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x47b870]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x42020f
pop ebx
cmp word [ebp - 4], bx
jne 0x4201d4
cmp esi, dword [ebp + 0xc]
jne 0x4201d4
mov word [esi], bx
jmp 0x42020c
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00420aa8
add esp, 0x10
cmp word [ebp - 4], bx
je 0x42020f
push 0xd
jmp 0x420208
mov ecx, dword [ebx*4 + 0x47b870]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x420206
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x42020f
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10011023
Capabilities:
Terminate process

Disassembly:
jmp 0x1001cb00
jmp fcn.1001cb30
cmp ecx, dword [0x10021054]
jne 0x1001cb0a
repz ret
jmp 0x100110b9

Function at 0x10013d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10013d6f
pop dword [ebp - 0x28]
mov eax, 0xce756723
sub eax, 0xbe7429b4
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x47793b3c
add dword [ebp - 0x38], 0x6d90a0f
mov dword [ebp - 0x34], 0x619b3359
sub dword [ebp - 0x34], 0x2f67e714
mov dword [ebp - 0x30], 0x13ecb62a
add dword [ebp - 0x30], 0x385f8e04
mov dword [ebp - 0x2c], 0x316f5cb3
sub dword [ebp - 0x2c], 0x316f5cb3
lea eax, [ebp - 0x38]
push eax
mov eax, 0x53a66d2a
sub eax, 0x43a44b3e
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x3e11d4b1
add dword [ebp - 0x38], 0x366094a5
mov dword [ebp - 0x34], 0xe22fc37c
add dword [ebp - 0x34], 0x5f3c9df9
mov dword [ebp - 0x30], 0xca0370b0
add dword [ebp - 0x30], 0x996bfbbc
mov dword [ebp - 0x2c], 0xd86462cf
add dword [ebp - 0x2c], 0x279b9d31
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x2b766680
add eax, 0xe48bbb70
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x38bde
push 0
call eax
mov ecx, 0x9970983b
add ecx, 0x668fb4e8
xor esi, esi
add esi, eax
mov edx, 0x5547a0e8
sub edx, 0x454556e8
add edx, dword [ebp - 0x28]
mov ebx, 0xfe45197b
add ebx, 0xc5f16415
xor dword [ebp - 4], edx
mov edi, dword [edx]
xor dword [ebp - 0x24], esi
sub edi, ebx
sub dword [ebp - 0xc], ebx
mov dword [esi], edi
sub dword [ebp - 0x20], 0x69dc0bf8
add esi, 4
add edx, 0x541b15c7
sub edx, 0x541b15c3
loop 0x10013e93
add eax, 0x9814e5f1
sub eax, 0x9813be92
mov ebx, eax
add eax, 5
mov ecx, 0xedb3d2ef
add ecx, 0x224c2d11
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x42c306
Capabilities:
Create process on windows

Disassembly:
push ebp
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x42c30c
call fcn.004448c0
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00430000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00430000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00430000
lea ebp, [esp + 0xc]
mov dword [ebp], 0x3c
mov eax, str.runas
push eax
pop eax
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 4]
push eax
pop eax
mov dword [ebp + 0x14], eax
mov eax, dword [esp]
push eax
pop eax
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 8]
push eax
pop eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], 1
lea eax, [esp + 0xc]
push eax
call sub.SHELL32.DLL_ShellExecuteExA
jmp 0x42c388
push dword [esp + 4]
call fcn.00444920
push dword [esp]
call fcn.00444920
push dword [esp + 8]
call fcn.00444920
add esp, 0x48
pop ebp
ret 0xc

Function at 0x42c6c2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004448c0
push dword [esp + 0x28]
call fcn.004301f0
mov edx, dword [esp + 0x20]
lea ecx, [esp]
call fcn.00430000
mov edx, dword [esp + 0x24]
lea ecx, [esp + 4]
call fcn.00430000
mov dword [esp + 8], 0
push edx
call fcn.00444720
pop edx
push eax
push edx
call fcn.00444720
pop edx
push eax
push 0xff
call fcn.00431400
lea eax, [esp + 0x10]
push eax
call fcn.004447c0
mov dword [esp + 0x10], 0xff
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push dword [esp + 0xc]
push dword [esp + 0x2c]
call sub.ADVAPI32.DLL_RegOpenKeyExA
and eax, eax
je 0x42c755
mov edx, str.Error_Opening_Key
lea ecx, [esp + 0xc]
call fcn.00430008
jmp 0x42c7bc
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegQueryValueExA
and eax, eax
je 0x42c78a
mov edx, str.Error_Reading_Key
lea ecx, [esp + 0xc]
call fcn.00430008
jmp 0x42c7b3
push edx
call fcn.00444720
pop edx
push eax
push edx
call fcn.00444720
pop edx
push eax
mov ebx, dword [esp + 0x18]
dec ebx
push ebx
push dword [esp + 0x18]
call fcn.00430f80
lea eax, [esp + 0x10]
push eax
call fcn.004447c0
push dword [esp + 8]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [esp + 0xc]
push edx
call fcn.00444720
pop edx
push eax
push edx
call fcn.00444760
pop eax
push eax
call fcn.004301c0
pop edx
add eax, edx
jmp 0x42c7e2
push dword [esp + 0xc]
call fcn.00444920
push dword [esp]
call fcn.00444920
push dword [esp + 4]
call fcn.00444920
add esp, 0x14
pop ebx
ret 0xc
Function at 0x42c803
Capabilities:
Get storage device properties

Disassembly:
push ebp
push ebx
mov edx, 0x10
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x42c80a
call fcn.004448c0
mov edx, dword [esp + 0x4c]
lea ecx, [esp]
call fcn.00430000
push dword [esp]
mov edx, 0x497021
pop ecx
call fcn.00430180
je 0x42c842
xor eax, eax
movsx eax, al
jmp 0x42c982
push 0
push 0
push 3
push 0
push 3
push 0
push dword [esp + 0x18]
call sub.KERNEL32.dll_CreateFileA
mov dword [esp + 4], eax
mov ebx, dword [esp + 4]
cmp ebx, 0xffffffff
je 0x42c976
lea ebp, [esp + 0x10]
mov dword [ebp], 8
mov dword [ebp + 4], 0
mov dword [esp + 8], 0
push 0
lea eax, [esp + 0xc]
push eax
push 0xc
lea eax, [esp + 0x28]
push eax
push 0xc
lea eax, [esp + 0x24]
push eax
push 0x2d1400
push dword [esp + 0x20]
call sub.KERNEL32.dll_DeviceIoControl
and eax, eax
je 0x42c8d4
mov ebx, dword [esp + 8]
cmp ebx, 0xc
jne 0x42c8d4
mov eax, 1
jmp 0x42c8d6
xor eax, eax
and eax, eax
je 0x42c8f3
lea ebp, [esp + 0x1c]
movsx ebx, byte [ebp + 8]
cmp ebx, 1
jne 0x42c8f3
movsx ebx, byte [esp + 0xc]
inc ebx
push ebx
pop eax
mov byte [esp + 0xc], al
lea ebp, [esp + 0x28]
mov dword [ebp], 7
mov dword [ebp + 4], 0
mov dword [esp + 8], 0
push 0
lea eax, [esp + 0xc]
push eax
push 0xc
lea eax, [esp + 0x40]
push eax
push 0xc
lea eax, [esp + 0x3c]
push eax
push 0x2d1400
push dword [esp + 0x20]
call sub.KERNEL32.dll_DeviceIoControl
and eax, eax
je 0x42c94d
mov ebx, dword [esp + 8]
cmp ebx, 0xc
jne 0x42c94d
mov eax, 1
jmp 0x42c94f
xor eax, eax
and eax, eax
je 0x42c96d
lea ebp, [esp + 0x34]
movsx ebx, byte [ebp + 8]
and ebx, ebx
jne 0x42c96d
movsx ebx, byte [esp + 0xc]
add ebx, 2
push ebx
pop eax
mov byte [esp + 0xc], al
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
movsx eax, byte [esp + 0xc]
movsx eax, al
jmp 0x42c982
push dword [esp]
call fcn.00444920
add esp, 0x40
pop ebx
pop ebp
ret 4
Function at 0x42ca0c
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
push ebx
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x42ca13
call fcn.004448c0
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00430000
mov edx, dword [esp + 0x38]
lea ecx, [esp + 4]
call fcn.00430000
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 8]
call fcn.00430000
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0xc]
call fcn.00430000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x10]
call fcn.00430000
mov edx, dword [esp + 0x50]
lea ecx, [esp + 0x14]
call fcn.00430000
push dword [esp]
mov edx, 0x497021
pop ecx
call fcn.00430180
jne 0x42caaa
push dword [esp + 4]
mov edx, 0x497021
pop ecx
call fcn.00430180
jne 0x42caaa
mov ebx, dword [esp + 0x48]
and ebx, ebx
jl 0x42caaa
mov ebx, dword [esp + 0x54]
and ebx, ebx
jl 0x42caaa
mov eax, 1
jmp 0x42caac
xor eax, eax
and eax, eax
je 0x42cab4
xor eax, eax
jmp 0x42cab9
mov eax, 1
and eax, eax
je 0x42cac4
xor eax, eax
jmp 0x42cbfd
push 0
call sub.OLE32.DLL_CoInitialize
lea eax, [esp + 0x18]
push eax
mov ebp, 0x4a3567
push ebp
push 1
push 0
mov ebp, 0x4a3557
push ebp
call sub.OLE32.DLL_CoCreateInstance
mov ebx, eax
and ebx, ebx
jne 0x42cbf0
sub esp, 4
push dword [esp + 4]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
push eax
pop eax
add esp, 4
sub esp, 4
push dword [esp + 0xc]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
push eax
pop eax
add esp, 4
sub esp, 4
push dword [esp + 0x14]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
push eax
pop eax
add esp, 4
sub esp, 4
push dword [esp + 0x10]
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
push eax
pop eax
add esp, 4
push dword [esp + 0x48]
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
push dword [esp + 0x4c]
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 0x34]
sub esp, 4
push dword [esp + 0x58]
push dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
push eax
pop eax
add esp, 4
lea eax, [esp + 0x1c]
push eax
mov ebp, 0x4a3577
push ebp
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [eax]
call dword [eax]
mov ebx, eax
and ebx, ebx
jne 0x42cbe6
sub esp, 4
push 1
push dword [esp + 0xc]
call fcn.00444980
push eax
mov dword [esp + 8], eax
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
push eax
push dword [esp + 4]
call fcn.004449f0
pop eax
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 1
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 8]
jmp 0x42cbe6
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 8]
call sub.OLE32.DLL_CoUninitialize
mov eax, dword [esp + 0x24]
jmp 0x42cbfd
push dword [esp]
call fcn.00444920
push dword [esp + 8]
call fcn.00444920
push dword [esp + 0x10]
call fcn.00444920
push dword [esp + 0x14]
call fcn.00444920
push dword [esp + 4]
call fcn.00444920
push dword [esp + 0xc]
call fcn.00444920
add esp, 0x28
pop ebx
pop ebp
ret 0x24
Function at 0x42df23
Capabilities:
Get disk size

Disassembly:
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x42df29
call fcn.004448c0
mov edx, dword [esp + 0x28]
lea ecx, [esp]
call fcn.00430000
push edx
call fcn.00444720
pop edx
push eax
push edx
call fcn.00444720
pop edx
push eax
push dword [esp + 8]
call fcn.00430980
lea eax, [esp + 4]
push eax
call fcn.004447c0
push dword [esp]
mov edx, 0x497021
pop ecx
call fcn.00430180
je 0x42df87
mov edx, 0x498274
lea ecx, [esp]
call fcn.00430008
push edx
call fcn.00444720
pop edx
push eax
push edx
call fcn.00444720
pop edx
push eax
push 2
push dword [esp + 0xc]
call fcn.00431160
call fcn.00444850
mov edx, 0x49d7b5
pop ecx
push ecx
call fcn.004301b0
mov ecx, eax
call fcn.00430180
jne 0x42dfe5
mov edx, dword [esp]
push edx
call fcn.00444720
pop edx
push eax
push edx
call fcn.00444760
mov edx, 0x49d7b5
push edx
call fcn.00444760
lea eax, [esp + 4]
push eax
call fcn.004447c0
mov dword [esp + 0x1c], 0xbf800000
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetDiskFreeSpaceExA
mov ebx, eax
and ebx, ebx
je 0x42e047
fild qword [esp + 0xc]
fild qword [esp + 0x14]
fsubp st(1)
fadd dword [0x4a0b90]
fild qword [esp + 0xc]
fdivp st(1)
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fmul qword [0x4a0bb8]
sub esp, 8
fstp qword [esp]
call fcn.00433970
push eax
fild dword [esp]
fstp dword [esp]
pop eax
mov dword [esp + 0x1c], eax
fld dword [esp + 0x1c]
fistp dword [esp - 4]
mov eax, dword [esp - 4]
jmp 0x42e057
push dword [esp]
call fcn.00444920
add esp, 0x20
pop ebx
ret 4
Function at 0x4323c3
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x432418
push dword [esp + 0x10]
push 0x432342
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x4a6448]
test esi, esi
je 0x432471
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x432410
cmp byte [esi + 0x10], 0
je 0x432410
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x4323ec
jmp 0x432471
mov esi, dword [0x4a6448]
test esi, esi
je 0x432471
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x43246a
cmp byte [esi + 0x11], 0
je 0x432446
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x43245d
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0x4a6448
call fcn.00444656
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x432425
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x433a00
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x4a6454], 0
jne 0x433a0e
call fcn.00433980
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x4a6458]
call esi
test eax, eax
jne 0x433a31
call fcn.00433980
push dword [0x4a6458]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x433a40
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x433aa0
mov ebx, 0x10
test edi, edi
jns 0x433aa9
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x433a72
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x433ac0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x4a6454], 0
jne 0x433ace
call fcn.00433980
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x4a6458]
call esi
mov edx, eax
test edx, edx
jne 0x433af5
call fcn.00433980
push dword [0x4a6458]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x433b28
mov ebx, 0x10
test esi, esi
jns 0x433b31
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x433b40
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x434606
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x434690
cmp dword [ebp + 0xc], edi
je 0x434690
push esi
push 0x28
push 8
push dword [0x4a5a70]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 8]
mov esi, eax
or dword [esi + 4], 0xffffffff
mov dword [esi], edi
call sub.MSVCRT.dll__strdup
push dword [ebp + 0xc]
mov dword [esi + 8], eax
call sub.MSVCRT.dll__strdup
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
pop ecx
pop ecx
test al, 1
je 0x43467f
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x434794
push 0x2000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x434677
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, esi
jmp 0x43468f
push esi
call fcn.004349b1
jmp 0x43468e
push esi
call fcn.004346a9
push esi
mov edi, eax
call fcn.004349b1
pop ecx
pop ecx
pop esi
mov eax, edi
pop edi
pop ebp
ret 0xc

Function at 0x4346a9
Capabilities:
Delete file

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov eax, dword [esi + 8]
mov ebp, dword [esi + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ebp
call fcn.0045cd90
mov edi, eax
test edi, edi
je 0x434779
push dword [esp + 0x18]
call fcn.00481f40
push ebx
push pe_nt_image_headers32
push 2
push ebx
push 1
push 0xc0000000
push ebp
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x434769
test byte [esi + 0x1c], 2
mov dword [esi + 0x10], ebp
jne 0x434712
push 1
push 0x34
push edi
call fcn.0045ce20
add esp, 0xc
push dword [esp + 0x18]
push 0x2712
push edi
call fcn.0045ce20
push 0x4347a3
push 0x4e2b
push edi
call fcn.0045ce20
push esi
push 0x2711
push edi
call fcn.0045ce20
push edi
call fcn.0045ce10
add esp, 0x28
test eax, eax
jne 0x434754
xor ebx, ebx
mov dword [esi + 4], 0xfffffffe
inc ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x434769
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esp + 0x18]
call fcn.00481f30
push edi
call fcn.0045cd70
pop ecx
cmp dword [esi + 4], 0xfffffffe
je 0x43478c
cmp dword [esi + 4], 0xfffffffc
je 0x43478c
mov dword [esi + 4], 0xfffffffd
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x434b3c
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
push edi
xor edi, edi
inc edi
cmp dword [0x4a6490], 0
jne 0x434b68
push fcn.00434a8b
push 0x10
push 0x2c
mov dword [0x4a6490], edi
call fcn.00444021
mov dword [0x4a648c], eax
cmp word [0x4a6484], 0
jne 0x434c04
lea eax, [esp + 4]
push eax
push 0x101
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
test eax, eax
jne 0x434b93
mov word [0x4a6484], di
jmp 0x434b9b
xor eax, eax
mov word [0x4a6484], ax
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4a64a0], eax
test eax, eax
je 0x434c04
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4890c8
push eax
call esi
push 0x4890d4
push dword [0x4a64a0]
mov dword [0x4a6494], eax
call esi
push str.getnameinfo
push dword [0x4a64a0]
mov dword [0x4a6498], eax
call esi
cmp dword [0x4a6494], 0
mov dword [0x4a649c], eax
pop esi
je 0x434c04
cmp dword [0x4a6498], 0
je 0x434c04
test eax, eax
je 0x434c04
mov dword [0x4a6488], edi
movsx eax, word [0x4a6484]
pop edi
add esp, 0x190
ret
Function at 0x434d4a
Capabilities:
Set socket configuration

Disassembly:
push ecx
push ecx
push ebx
push esi
push dword [esp + 0x14]
xor esi, esi
push dword [0x4a648c]
call fcn.00443f8d
mov ebx, eax
test ebx, ebx
je 0x434ed7
cmp dword [esp + 0x18], 0xffff
push ebp
push edi
ja 0x434ebe
mov ebp, dword [esp + 0x24]
push 2
pop ecx
push 0x17
pop eax
test ebp, 0x10000000
je 0x434d99
mov edi, eax
and ebp, 0xefffffff
mov dword [esp + 0x24], edi
jmp 0x434d9f
mov edi, ecx
mov dword [esp + 0x24], ecx
test ebp, ebp
jne 0x434da4
inc ebp
push esi
push ebp
push edi
call dword [sym.imp.WSOCK32.DLL_socket]
mov esi, eax
mov dword [esp + 0x14], esi
cmp esi, 0xffffffff
je 0x434ebc
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0x8004667e
push esi
call dword [sym.imp.WSOCK32.DLL_ioctlsocket]
cmp eax, 0xffffffff
jle 0x434ead
push 0x17
pop eax
cmp edi, eax
je 0x434de8
push 2
pop eax
push dword [esp + 0x20]
mov word [ebx + 4], ax
call dword [sym.imp.WSOCK32.DLL_htons]
mov word [ebx + 6], ax
mov eax, dword [esp + 0x28]
test eax, eax
je 0x434e3b
cmp byte [eax], 0
je 0x434e3b
push eax
call fcn.00481f40
mov dword [esp + 0x20], eax
cmp edi, 0x17
jne 0x434e26
lea ecx, [ebx + 4]
push ecx
push eax
push edi
call fcn.00434cbf
add esp, 0xc
jmp 0x434e30
push eax
call dword [sym.imp.WSOCK32.DLL_inet_addr]
mov dword [ebx + 8], eax
push dword [esp + 0x20]
call fcn.00481f30
jmp 0x434e5a
cmp edi, 0x17
jne 0x434e56
mov esi, 0x4890ac
lea edi, [ebx + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x24]
jmp 0x434e5f
and dword [ebx + 8], 0
cmp edi, 0x17
jne 0x434e63
push 0x1c
jmp 0x434e65
push 0x10
lea eax, [ebx + 4]
push eax
push esi
call dword [sym.imp.WSOCK32.DLL_bind]
test eax, eax
jne 0x434ead
cmp ebp, 1
jne 0x434e86
push 0x64
push esi
call dword [sym.imp.WSOCK32.DLL_listen]
test eax, eax
jne 0x434ead
xor eax, eax
mov dword [ebx], esi
cmp edi, 0x17
mov word [ebx + 0x20], bp
sete al
mov word [ebx + 0x22], ax
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
jne 0x434ea6
mov dword [ebx + 0x24], ebx
jmp 0x434ea9
mov dword [ebx + 0x24], eax
mov esi, ebx
jmp 0x434eb6
push esi
call dword [sym.imp.WSOCK32.DLL_closesocket]
xor esi, esi
test esi, esi
jne 0x434ed5
jmp 0x434ebe
xor esi, esi
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x434ec9
mov ebx, eax
push ebx
push dword [0x4a648c]
call fcn.00443eff
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
pop ecx
pop ecx
ret 0x10