joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40eea0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
push 0
mov dword [ebp - 8], edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 1
push 0
push 0
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov edi, eax
call fcn.00569210
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebx], eax
mov dword [ebx + 4], esi
cmp edi, 0xffffffff
jne 0x40ef02
or eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 8], 0x17
jne 0x40ef20
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x1b
push 0x29
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
call fcn.00569210
mov ecx, dword [ebp - 4]
mov dword [ebx + 4], eax
xor ecx, ebp
mov eax, edi
mov dword [ebx], 0
pop edi
pop esi
pop ebx
call fcn.0053cd12
mov esp, ebp
pop ebp
ret

Function at 0x4103c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5ede30
push 0x542a70
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x600f80]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.asio_58CCDC44_6264_4842_90C2_F3C545CB8AA7__u__p
push 0x80
lea eax, [ebp - 0x11c]
push eax
call fcn.0053e8b3
add esp, 0x14
lea eax, [ebp - 0x11c]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x120], edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test edi, edi
jne 0x410448
call ebx
jmp 0x4104e6
cmp eax, 0xb7
jne 0x410458
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [esi], 0
jne 0x41049e
mov dword [ebp - 4], 0
push bind
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x410494
call ebx
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4104e6
mov dword [ebp - 4], 0xfffffffe
mov byte [esi], 1
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4104e6
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
Function at 0x41bae0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
call fcn.00569210
mov esi, dword [esi]
cmp esi, 0xffffffff
jne 0x41bb0b
mov ebx, 0x2719
jmp 0x41bb41
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 4
push edi
push 4
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edi, eax
call fcn.00569210
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0xc], esi
mov ebx, eax
mov dword [ebp - 0x10], ebx
test edi, edi
jne 0x41bb4c
xor ebx, ebx
call fcn.00569210
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
jne 0x41bb63
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 4
mov edx, str.set_option
lea ecx, [ebp - 0x10]
call fcn.00406920
int3

Function at 0x421000
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [ebp + 0x18], 0
push 0
je 0x421054
mov ecx, dword [edi + 4]
push 0
push ebx
call fcn.0040e4f0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x42107c
mov ecx, dword [edi + 4]
push 0x2719
push ebx
call fcn.0040e4f0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 0x18
push ebx
push dword [ebp + 0x14]
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push dword [ebp + 0x10]
push dword [ebp - 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
je 0x4210d8
cmp eax, 0x3e5
je 0x4210d8
push dword [ebp - 8]
mov ecx, dword [edi + 4]
push eax
push ebx
call fcn.0040e4f0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [edi + 4]
push ebx
call fcn.0040e480
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 0x18
Function at 0x421100
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x10], eax
push edi
mov edi, dword [ebp + 0x1c]
mov eax, dword [esi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [ebp + 0x18], 0
push 0
je 0x421154
mov ecx, dword [esi + 4]
push 0
push edi
call fcn.0040e4f0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebx]
cmp ecx, 0xffffffff
jne 0x42117c
mov ecx, dword [esi + 4]
push 0x2719
push edi
call fcn.0040e4f0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x4211b3
mov eax, 0x2746
jmp 0x4211c0
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x4211eb
cmp eax, 0x3e5
je 0x4211eb
push dword [ebp - 8]
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.0040e4f0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esi + 4]
push edi
call fcn.0040e480
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 0x18
Function at 0x425f40
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x589446
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0x26
lea eax, [ebp - 0x118]
mov dword [ebp - 0x164], 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
js 0x42604b
push 0xffffffffffffffff
push 0x5dc5dc
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.0053d744
add esp, 0x10
lea ecx, [ebp - 0x160]
call fcn.00425f00
cmp dword [eax + 0x14], 0x10
jb 0x425fc1
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.0053d744
add esp, 0x10
cmp dword [ebp - 0x14c], 0x10
jb 0x425fef
push dword [ebp - 0x160]
call fcn.0053e195
add esp, 4
push 0xffffffffffffffff
push 0x5dc5dc
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.0053d744
add esp, 0x10
lea ecx, [ebp - 0x160]
call fcn.00425f20
cmp dword [eax + 0x14], 0x10
jb 0x42601d
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.0053d744
add esp, 0x10
cmp dword [ebp - 0x14c], 0x10
jb 0x42604b
push dword [ebp - 0x160]
call fcn.0053e195
add esp, 4
cmp byte [ebp - 0x118], 0
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
jne 0x426073
xor ecx, ecx
jmp 0x426089
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x426080
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x130]
call fcn.004085a0
lea eax, [ebp - 0x130]
mov dword [ebp - 4], 0
push eax
mov edx, 0x5db650
lea ecx, [ebp - 0x148]
call fcn.004290f0
push 0x5db650
mov edx, eax
mov byte [ebp - 4], 1
mov ecx, esi
call fcn.00408ab0
add esp, 8
cmp dword [ebp - 0x134], 0x10
jb 0x4260e6
push dword [ebp - 0x148]
call fcn.0053e195
add esp, 4
cmp dword [ebp - 0x11c], 0x10
mov dword [ebp - 0x134], 0xf
mov dword [ebp - 0x138], 0
mov byte [ebp - 0x148], 0
jb 0x426118
push dword [ebp - 0x130]
call fcn.0053e195
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
Function at 0x426140
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5894d3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x600f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
sub esp, 8
mov byte [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.00428fd0
mov dword [esi + 4], eax
mov dword [ebp - 4], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
push 0
mov byte [ebp - 4], 1
push 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
call fcn.00429000
mov dword [esi + 0x1c], eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.00566870
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
push 0
mov byte [ebp - 4], 4
push 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
call fcn.00429000
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 6
call fcn.00425ec0
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 7
call fcn.00425ee0
mov byte [ebp - 4], 8
mov byte [esi + 0x78], 1
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
call fcn.004290c0
mov dword [esi + 0x7c], eax
mov eax, esi
mov byte [esi + 0x78], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42ca60
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x548
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, 0x607770
lea ecx, [ebp - 0xe8]
call fcn.0049a4f0
lea eax, [ebp - 0x14]
mov edx, 3
push eax
push 0x20
push 0x606ce0
lea ecx, [ebp - 0xe8]
call fcn.0049a83a
add esp, 0xc
lea eax, [ebp - 0xe8]
push 0xd0
push 0
push eax
call fcn.00540250
add esp, 8
lea ecx, [ebp - 0x14]
mov edx, 0x606cd0
push 0x606cc0
push 0xa95120
push 0x10
push 0x606cb0
sub esp, 8
push 0x10
call fcn.0049aa47
push 0x10
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00540250
add esp, 0x2c
lea ecx, [ebp - 0x4e8]
call fcn.0048fd34
lea eax, [ebp - 0x4e8]
mov dword [ebp - 0x548], 0x67452301
mov dword [ebp - 0x544], 0xefcdab89
lea edx, [eax + 1]
mov dword [ebp - 0x540], 0x98badcfe
mov dword [ebp - 0x53c], 0x10325476
mov dword [ebp - 0x538], 0xc3d2e1f0
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x534], 0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42cb44
sub eax, edx
lea ecx, [ebp - 0x548]
push eax
lea edx, [ebp - 0x4e8]
call fcn.00491311
add esp, 4
lea ecx, [ebp - 0x548]
mov edx, 0xa95120
push 0x10
call fcn.00491311
add esp, 4
lea edx, [ebp - 0x548]
mov ecx, 0xa95120
call fcn.004913b6
mov ecx, dword [ebp - 4]
mov eax, 0xa95120
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
Function at 0x42d080
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 0x26
lea eax, [ebp - 0x110]
mov dword [ebp - 0x114], 0
push eax
push 0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
js 0x42d12e
push 0xffffffffffffffff
push 0x5dc5dc
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0053d744
add esp, 0x10
lea ecx, [ebp - 0x12c]
call fcn.00425f00
cmp dword [eax + 0x14], 0x10
jb 0x42d0e5
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0053d744
add esp, 0x10
cmp dword [ebp - 0x118], 0x10
jb 0x42d113
push dword [ebp - 0x12c]
call fcn.0053e195
add esp, 4
push 0xffffffffffffffff
push 0x5dc5dc
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0053d744
add esp, 0x10
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x110], 0
jne 0x42d14c
xor ecx, ecx
jmp 0x42d15e
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42d155
sub ecx, edx
push ecx
lea eax, [ebp - 0x110]
mov ecx, esi
push eax
call fcn.004085a0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0053cd12
mov esp, ebp
pop ebp
ret

Function at 0x42d180
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x110]
mov dword [ebp - 0x114], 0
push eax
push 0
push 0
push 0x23
push 0
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x42d243
push 0xffffffffffffffff
push 0x5dc5dc
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0053d744
add esp, 0x10
lea ecx, [ebp - 0x12c]
call fcn.00425f00
cmp dword [eax + 0x14], 0x10
jb 0x42d1eb
mov eax, dword [eax]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0053d744
add esp, 0x10
cmp dword [ebp - 0x118], 0x10
jb 0x42d219
push dword [ebp - 0x12c]
call fcn.0053e195
add esp, 4
push 0xffffffffffffffff
push 0x5dc5dc
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.0053d744
add esp, 0x10
lea eax, [ebp - 0x110]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [ebp - 0x110], 0
jne 0x42d261
xor ecx, ecx
jmp 0x42d279
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x42d270
sub ecx, edx
push ecx
lea eax, [ebp - 0x110]
mov ecx, esi
push eax
call fcn.004085a0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
Function at 0x42d510
Capabilities:
Create thread
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov dword [esi], vtable.BrowserExtension.0
call fcn.00425ba2
cmp eax, 7
jl 0x42d573
mov dword [esi + 4], 0
call fcn.00479d50
mov eax, dword [0x611980]
test eax, eax
je 0x42d557
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [0x611980]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x611980], 0
push 0
push 0
push 0
push 0x479220
push 0
push 0
call fcn.0053eb86
add esp, 0x18
mov dword [0x611980], eax
mov eax, esi
pop esi
ret
Function at 0x42fab0
Capabilities:
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a5bf
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xb0
xorps xmm0, xmm0
mov byte [ebp - 0x30], 0
lea eax, [ebp - 0xf8]
movq qword [ebp - 0x1f], xmm0
push 0
push eax
movdqu xmmword [ebp - 0x2f], xmm0
mov dword [ebp - 0x17], 0
mov word [ebp - 0x13], 0
mov byte [ebp - 0x11], 0
call fcn.00540250
add esp, 4
lea ecx, [ebp - 0xf8]
call fcn.00432ff0
lea ecx, [ebp - 0x110]
mov dword [ebp - 4], 0
call fcn.0042d020
mov esi, eax
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 1
call fcn.0042d080
push esi
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.004207d0
add esp, 4
cmp dword [ebp - 0x114], 0x10
jb 0x42fb6b
push dword [ebp - 0x128]
call fcn.0053e195
add esp, 4
mov dword [ebp - 0x114], 0xf
mov dword [ebp - 0x118], 0
mov byte [ebp - 0x128], 0
mov byte [ebp - 4], 5
cmp dword [ebp - 0xfc], 0x10
jb 0x42fba1
push dword [ebp - 0x110]
call fcn.0053e195
add esp, 4
mov dword [ebp - 0xfc], 0xf
mov dword [ebp - 0x100], 0
mov byte [ebp - 0x110], 0
call fcn.00425ba2
cmp eax, 7
jl 0x42fc90
lea ecx, [ebp - 0x144]
call fcn.0042d020
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 0x10
jb 0x42fbe1
mov eax, dword [eax]
mov edx, eax
lea ecx, [ebp - 0xe8]
call fcn.0041b540
mov edx, str.__c
mov ecx, eax
call fcn.0041b540
mov byte [ebp - 4], 5
cmp dword [ebp - 0x130], 0x10
jb 0x42fc15
push dword [ebp - 0x144]
call fcn.0053e195
add esp, 4
cmp dword [ebp - 0x34], 0x10
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x30]
cmovae ecx, dword [ebp - 0x48]
call fcn.00494767
call fcn.00425ba2
cmp eax, 7
jl 0x42fc90
lea eax, [ebp - 0x30]
push str.1.0.0.1
push eax
call fcn.0053cde2
add esp, 8
test eax, eax
je 0x42fc90
sub esp, 0x18
lea edx, [ebp - 0x48]
mov ecx, esp
call fcn.0042cf60
call fcn.0047b1f0
add esp, 0x18
test eax, eax
je 0x42fc90
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0xf8]
call fcn.00433150
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 0x10
jb 0x42fc7e
mov eax, dword [eax]
mov ecx, eax
call fcn.00491fc0
lea ecx, [ebp - 0x144]
call fcn.00407cb0
cmp dword [ebp - 0x34], 0x10
jb 0x42fca1
push dword [ebp - 0x48]
call fcn.0053e195
add esp, 4
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
mov dword [ebp - 4], 0xffffffff
call fcn.004330a0
lea eax, [ebp - 0x90]
mov dword [ebp - 0x90], vtable.std::ios_base.0
push eax
call fcn.00565104
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
Function at 0x430410
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x58a690
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x600f80]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x600f80]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
call fcn.00425ba2
cmp eax, 7
jl 0x430620
sub esp, 0x18
mov ecx, esp
call fcn.0042d020
push dword [ebp + 0x18]
mov edx, dword [ebp + 0xc]
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
call fcn.0047cf50
lea ecx, [esp + 0x38]
call fcn.0042d020
mov esi, eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x90], 0
call fcn.0042d080
push esi
mov edx, eax
mov byte [esp + 0x94], 1
lea ecx, [esp + 0x6c]
call fcn.004207d0
add esp, 0x24
cmp dword [esp + 0x44], 0x10
jb 0x4304b9
push dword [esp + 0x30]
call fcn.0053e195
add esp, 4
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
mov byte [esp + 0x70], 4
cmp dword [esp + 0x2c], 0x10
jb 0x4304e6
push dword [esp + 0x18]
call fcn.0053e195
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
cmp esi, 6
jge 0x43054a
lea ecx, [esp + 0x48]
call fcn.00491997
mov ebx, eax
push ebx
push 0
push 0x401
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x430537
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x5dc
call edi
inc esi
cmp ebx, 0xffffffff
jne 0x430503
call fcn.00425ba2
cmp eax, 7
jl 0x430592
sub esp, 0x18
mov ecx, esp
call fcn.0042d020
call fcn.0047d0e0
add esp, 0x18
test eax, eax
jne 0x430592
sub esp, 0x18
mov ecx, esp
call fcn.0042d020
call fcn.0047d290
add esp, 0x18
test eax, eax
jne 0x430592
sub esp, 0x18
mov ecx, esp
call fcn.0042d020
call fcn.0047d930
add esp, 0x18
xorps xmm0, xmm0
mov dword [esp + 0x38], 0
movq qword [esp + 0x30], xmm0
mov byte [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
lea ecx, [esp + 0x30]
mov byte [esp + 0x70], 5
call fcn.00493361
test al, al
je 0x4305dd
call fcn.0042eb70
call fcn.0042f0e0
lea ecx, [esp + 0x30]
call fcn.004933e6
call fcn.00425ba2
cmp eax, 7
jl 0x4305f1
call fcn.0042d6d0
call fcn.0042e120
push 0xea60
call edi
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x43060d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x5c], 0x10
jb 0x430620
push dword [esp + 0x48]
call fcn.0053e195
add esp, 4
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4331e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a75b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x600f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x10]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
mov dword [ecx], 0
mov byte [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov byte [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov byte [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov byte [ecx + 0x34], 0
mov dword [ebp - 4], 0
push dword [esi]
mov edx, dword [esi + 8]
push dword [esi + 0xc]
push dword [esi + 4]
push dword [esi]
call fcn.00433fe0
add esp, 0x10
test al, al
mov eax, esi
jne 0x4332a2
mov dword [esi + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4343e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a8ce
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x600f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x10]
mov dword [edi], 0
push eax
push 0
lea ecx, [edi + 4]
mov dword [ebp - 0x10], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.004346a0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [edi + 0x20], 0
lea ecx, [edi + 0x24]
push eax
push 0
mov dword [ebp - 0x10], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.004346a0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea ecx, [edi + 0x40]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], edx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
je 0x434508
test dl, 0x10
jne 0x434508
mov eax, 1
jmp 0x43450a
xor eax, eax
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
push dword [esi + 0x18]
call fcn.00434530
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c