joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420e00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x60c
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0x400
xor edx, edx
mov eax, str.O5GO4LCN_QRjilQtQIXlVch_A_PK__noSVbCafagb
test eax, eax
je 0x420e46
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jae 0x420e46
mov cl, byte [edx + str.O5GO4LCN_QRjilQtQIXlVch_A_PK__noSVbCafagb]
add cl, byte [edx + str.WARNINGCOPYRIGHTVALORCOMPU_TERIZEDSYSTEMSLIMITED___]
sub cl, 0x41
mov byte [esp + edx + 0x11c], cl
inc edx
jmp 0x420e14
mov byte [esp + edx + 0x11c], 0
xor edx, edx
mov eax, str.KdZcXpEU
test eax, eax
je 0x420e7f
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jae 0x420e7f
mov cl, byte [edx + str.FORKSLEEPEXIT]
add cl, byte [edx + str.KdZcXpEU]
sub cl, 0x41
mov byte [esp + edx + 0x1c], cl
inc edx
jmp 0x420e50
mov byte [esp + edx + 0x1c], 0
lea edx, [esp + 0x14]
push edx
push 1
push 0
lea eax, [esp + 0x128]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x420ec6
push 0x56e
push 0x488d50
call fcn.0041cc10
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x60c
ret
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x220]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push 0
lea ecx, [esp + 0x2c]
push ecx
push edx
call ebx
test eax, eax
je 0x420f12
push 0x579
push 0x488d68
call fcn.0041cc10
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x60c
ret
mov eax, dword [esp + 0x10]
dec eax
cmp eax, 0x13
jae 0x420f43
cmp eax, 0x1b
jbe 0x420f43
push 0x57e
push 0x488d80
call fcn.0041cc10
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x60c
ret
mov esi, dword [esp + 0x628]
mov ebp, dword [esp + 0x624]
mov ecx, dword [esp + 0x620]
push esi
push ebp
push ecx
lea edx, [esp + 0x228]
push str._9d_9d_d
push edx
call fcn.00463e9f
add esp, 0x14
cmp eax, 1
je 0x420f7e
cmp eax, 2
jne 0x421020
xor edx, edx
mov eax, 0x488d34
test eax, eax
je 0x420fb1
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jae 0x420fb1
mov cl, byte [edx + 0x488d34]
mov eax, edx
inc cl
shr eax, 1
mov byte [esp + eax + 0x9c], cl
add edx, 2
jmp 0x420f80
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x220]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
push 0
lea ecx, [esp + 0xac]
push ecx
push edx
call ebx
test eax, eax
je 0x420ffa
push 0x590
push str.G:_s90_gen_gen_com.c
call fcn.0041cc10
add esp, 8
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x60c
ret
push 4
lea eax, [esp + 0x220]
push eax
push ebp
call fcn.0041d990
add esp, 0xc
mov dword [esi], 0xe333335e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x60c
ret
cmp eax, 3
je 0x421013
pop edi
pop esi
pop ebp
mov eax, 0x1389
pop ebx
add esp, 0x60c
ret
Function at 0x421150
Capabilities:
Create thread
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x42117c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x4c1fc8
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x421199
mov edi, dword [ebx]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
shr ecx, 2
mov edi, 0x4c1fc8
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x4c1fc8
and ecx, 3
push str.Valor__s_Server
push 0x4c2188
rep movsb byte es:[edi], byte [esi]
call fcn.00463a12
push 0x4c1fc8
push str.Frontline__s_Server
push 0x4c1f30
call fcn.00463a12
mov al, byte [esp + 0x34]
mov edi, dword [esp + 0x28]
add esp, 0x18
neg al
sbb eax, eax
add eax, 3
cmp edi, 1
mov dword [0x4c202c], eax
jle 0x42128c
mov ecx, dword [ebx + 4]
mov al, byte [ecx]
cmp al, 0x2d
lea esi, [ebx + 4]
je 0x4211fa
cmp al, 0x2f
jne 0x42128c
inc ecx
push ecx
push str.install
call fcn.00466150
add esp, 8
test eax, eax
jne 0x421214
call fcn.00421610
jmp 0x421285
mov ecx, dword [esi]
inc ecx
push ecx
push str.remove
call fcn.00466150
add esp, 8
test eax, eax
jne 0x421230
call fcn.00421730
jmp 0x421285
mov edx, dword [esi]
inc edx
push edx
push str.debug
call fcn.00466150
add esp, 8
test eax, eax
jne 0x42126b
push ebx
push edi
call fcn.004218a0
add esp, 8
cmp edi, 1
jle 0x421264
mov eax, esi
lea ecx, [edi - 1]
mov edx, dword [eax + 4]
mov dword [eax], edx
add eax, 4
dec ecx
jne 0x421259
lea eax, [edi - 1]
pop edi
pop esi
pop ebx
ret
mov eax, dword [esi]
inc eax
push eax
push 0x488e94
call fcn.00466150
add esp, 8
test eax, eax
jne 0x42128c
call fcn.00421110
push 0
call fcn.0046393d
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0
push 0
push 0
push 0
mov dword [0x4c2240], eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0x4c2238], eax
je 0x421308
push 0x4c2238
call fcn.004215e0
add esp, 4
push 0x4c223c
push 0
push 0
push 0x421320
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x4c2244], eax
je 0x4212f8
push 0x4c2244
call fcn.004215e0
mov ecx, dword [0x4c2238]
add esp, 4
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x4c2238]
test eax, eax
je 0x421308
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4d9fb0]
pop edi
pop esi
pop ebx
ret
Function at 0x421380
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x488870]
test eax, eax
je 0x421453
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0x4214d0
push 0x4c2188
mov dword [0x4d9fb0], eax
mov dword [0x4d9fb4], ecx
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
test eax, eax
mov dword [0x4de39c], eax
je 0x42148b
push 0xbb8
push 1
push 0
push 2
mov dword [0x4de380], 0x10
mov dword [0x4de390], 0
call fcn.00421570
add esp, 0x10
test eax, eax
je 0x42148b
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [0x4c2234], eax
je 0x42149b
push 0x4c2234
call fcn.004215e0
push 0xbb8
push 2
push 0
push 2
call fcn.00421570
add esp, 0x14
test eax, eax
je 0x42148b
push 0xbb8
push 3
push 0
push 2
call fcn.00421570
add esp, 0x10
test eax, eax
je 0x42148b
push 0
push 0
push 0
push 4
call fcn.00421570
add esp, 0x10
test eax, eax
je 0x42148b
mov edx, dword [0x4c2238]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x488870]
test eax, eax
je 0x4214c0
push 0
push 0
push 0
push 4
call fcn.00421570
add esp, 0x10
test eax, eax
je 0x42148b
mov eax, dword [0x4c2234]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x4c2234]
test eax, eax
je 0x42149b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4de39c]
test eax, eax
je 0x4214b9
mov ecx, dword [0x4de360]
push 0
push 0
push ecx
push 1
call fcn.00421570
add esp, 0x10
push 0
call fcn.0046393d
ret

Function at 0x421610
Capabilities:
Create service

Disassembly:
sub esp, 0x200
push edi
push 0x200
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x421657
push 0x100
push 0x4de260
call fcn.004218e0
push eax
push 0x4c1f30
push str.Unable_to_install__s____s_n
call fcn.00463b77
add esp, 0x14
pop edi
add esp, 0x200
ret
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x4216fd
mov edx, dword [0x4c202c]
push ebx
push esi
push 0
push 0
push str.tcpip
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push 1
push edx
push 0x10
push 0xf01ff
push 0x4c1f30
push 0x4c2188
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x4216d3
push 0x4c1f30
push str._s_installed._n
call fcn.00463b77
add esp, 8
push esi
call ebx
push edi
call ebx
pop esi
pop ebx
pop edi
add esp, 0x200
ret
push 0x100
push 0x4de260
call fcn.004218e0
push eax
push str.CreateService_failed____s_n
call fcn.00463b77
add esp, 0x10
push edi
call ebx
pop esi
pop ebx
pop edi
add esp, 0x200
ret
push 0x100
push 0x4de260
call fcn.004218e0
push eax
push 0x488f1c
call fcn.00463b77
add esp, 0x10
pop edi
add esp, 0x200
ret
Function at 0x421730
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
je 0x42187f
push esi
push 0xf01ff
push 0x4c2188
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x421858
push 0x4de380
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x4217fc
push ebx
push edi
push 0x4c1f30
push str.Stopping__s.
call fcn.00463b77
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x3e8
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push 0x4de380
push esi
call ebx
test eax, eax
je 0x4217d8
cmp dword [0x4de384], 3
jne 0x4217d8
push 0x488f48
call fcn.00463b77
add esp, 4
push 0x3e8
call edi
push 0x4de380
push esi
call ebx
test eax, eax
jne 0x4217af
cmp dword [0x4de384], 1
pop edi
pop ebx
push 0x4c1f30
jne 0x4217ef
push str._n_s_stopped._n
jmp 0x4217f4
push str._n_s_failed_to_stop._n
call fcn.00463b77
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x42182a
push 0x4c1f30
push str._s_removed._n
call fcn.00463b77
add esp, 8
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
ret
push 0x100
push 0x4de260
call fcn.004218e0
push eax
push str.DeleteService_failed____s_n
call fcn.00463b77
add esp, 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
ret
push 0x100
push 0x4de260
call fcn.004218e0
push eax
push str.OpenService_failed____s_n
call fcn.00463b77
add esp, 0x10
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop ebp
ret
push 0x100
push 0x4de260
call fcn.004218e0
push eax
push str.OpenSCManager_failed____s_n
call fcn.00463b77
add esp, 0x10
pop ebp
ret
Function at 0x429690
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push 0
xor bl, bl
call fcn.0042e670
mov esi, dword [esp + 0x10]
push esi
call fcn.00429770
add esp, 8
test al, al
je 0x4296ca
mov eax, dword [esi + 0xcbc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esi + 0xcbc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4296e1
push eax
call fcn.004643ff
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x18]
test eax, eax
je 0x4296f8
push eax
call fcn.004643ff
add esp, 4
mov dword [esi + 0x18], 0
mov byte [esi], 0
call fcn.00429790
pop esi
mov al, bl
pop ebx
ret
Function at 0x42f4e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42f4f3
xor eax, eax
ret
test al, 0x10
mov eax, 0
setne al
inc eax
ret

Function at 0x42f600
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call fcn.0046757d
add esp, 0xc
ret

Function at 0x42f850
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x42f87c
push eax
push str.WSAStartup_failed._Error_Code__d
push 0x49dc44
call fcn.0041b0a0
add esp, 0xc
mov dword [0x4d68bc], 1
add esp, 0x190
ret

Function at 0x42f890
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x118]
cmp ebx, 0x3e8
push ebp
push esi
push edi
ja 0x42f8d1
mov eax, dword [str.gen_unix.c]
push 0xca1
push eax
push str.L_PTR__cbuf__
call fcn.0041cad0
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0xb0451
pop ebx
add esp, 0x10c
ret
mov ebp, dword [esp + 0x12c]
cmp ebp, 0x3e8
ja 0x42f909
mov ecx, dword [str.gen_unix.c]
push 0xca2
push ecx
push str.L_PTR__bytes_was_read__
call fcn.0041cad0
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 0xb0451
pop ebx
add esp, 0x10c
ret
mov esi, dword [esp + 0x120]
lea edx, [esp + 0x10]
push edx
push 0
push 0
lea eax, [esp + 0x24]
push eax
push esi
mov dword [esp + 0x24], 0x3c
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], 1
call sub.WS2_32.dll_select
test eax, eax
je 0x42f9ba
mov edi, dword [esp + 0x128]
push 0
push edi
push ebx
push esi
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
jne 0x42f9bc
call sub.WS2_32.dll_WSAGetLastError
add eax, 0xffffd8ec
cmp eax, 0x38
ja case.0x42f971.10007
xor ecx, ecx
mov cl, byte [eax + 0x42f9dc]
jmp dword [ecx*4 + 0x42f9cc]
pop edi
pop esi
pop ebp
mov eax, 0xb0454
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
mov eax, 0xb0455
pop ebx
add esp, 0x10c
ret
mov eax, edi
pop edi
pop esi
mov dword [ebp], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
pop ebp
mov eax, 0xb0453
pop ebx
add esp, 0x10c
ret
xor eax, eax
pop edi
pop esi
mov dword [ebp], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
Function at 0x4302b0
Capabilities:
Get hostname

Disassembly:
push ebp
push edi
push 0x32
xor eax, eax
mov ecx, 0x3a
mov edi, 0x4d6a28
push 0x4d6a28
rep stosd dword es:[edi], eax
call sub.WS2_32.dll_gethostname
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x4302fd
or ecx, 0xffffffff
xor eax, eax
mov edi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x31
jle 0x4302fd
mov eax, dword [str.csl_com.c]
push 0x137
push eax
push str._int_STRLEN__proc_name_____int___int___int_sizeof_my_id.proc_name__1__
call fcn.0041cad0
add esp, 0xc
push 0x31
push ebp
push 0x4d6a5a
call fcn.00419840
mov edx, dword [esp + 0x1c]
add esp, 0xc
test edx, edx
je 0x430322
mov cl, byte [edx]
xor eax, eax
test cl, cl
sete al
test eax, eax
je 0x430333
lea ecx, [esp + 0x10]
push ecx
call fcn.0042e640
mov edx, dword [esp + 0x14]
add esp, 4
test edx, edx
je 0x430365
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x31
jle 0x430365
mov edx, dword [str.csl_com.c]
push 0x13b
push edx
push 0x49dfe0
call fcn.0041cad0
mov edx, dword [esp + 0x1c]
add esp, 0xc
push esi
push 0x31
push edx
push 0x4d6a8c
call fcn.00419840
push str.DISPLAY
call fcn.00463afa
mov esi, eax
add esp, 0x10
cmp esi, 0x3e8
jbe 0x4303dd
test esi, esi
je 0x4303b7
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x31
jle 0x4303b7
mov eax, dword [str.csl_com.c]
push 0x13e
push eax
push str._int_STRLEN__p_____int___int___int_sizeof_my_id.disp_name__1__
call fcn.0041cad0
add esp, 0xc
push 0x31
push esi
push 0x4d6abe
call fcn.00419840
push 0x3a
push 0x4d6abe
call fcn.00419f90
add esp, 0x14
cmp eax, 0x3e8
jbe 0x4303dd
mov byte [eax], 0
mov ecx, 0x4d6abe
test ecx, ecx
pop esi
je 0x4303f8
mov dl, byte [0x4d6abe]
xor eax, eax
test dl, dl
sete al
test eax, eax
je 0x43043e
mov edx, 0x4d6a28
test edx, edx
je 0x43042a
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x31
jle 0x43042a
mov eax, dword [str.csl_com.c]
push 0x149
push eax
push str._int_STRLEN__my_id.host_name_____int___int___int_sizeof_my_id.disp_name__1__
call fcn.0041cad0
add esp, 0xc
push 0x31
push 0x4d6a28
push 0x4d6abe
call fcn.00419840
add esp, 0xc
call fcn.0042fa50
mov dword [0x4d6af0], eax
mov eax, dword [esp + 0x14]
mov ecx, eax
dec ecx
je 0x4304bc
dec ecx
je 0x4304b0
test eax, eax
mov dword [0x4d6b20], 0
jge 0x430464
neg eax
push 0x4d6af4
mov dword [0x4d6af8], eax
mov dword [0x4d6afc], 0
call fcn.00420d40
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push 0x49e0c0
push ebp
mov dword [0x4d6b08], ecx
mov dword [0x4d6b0c], edx
call fcn.00419ed0
add esp, 0xc
test eax, eax
pop edi
pop ebp
jne 0x4304aa
mov byte [0x49deb0], al
mov eax, 0x4d6a28
ret
mov dword [0x4d6b20], 1
jmp 0x430464
mov dword [0x4d6b20], 2
jmp 0x430464
Function at 0x432990
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [esp + 0x110]
push esi
mov esi, dword [esp + 0x118]
lea ecx, [eax + 1]
mov dword [esp + 0x10], eax
lea eax, [esp + 4]
push eax
push 0
push 0
lea edx, [esp + 0x18]
push edx
push ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 1
call sub.WS2_32.dll_select
test eax, eax
jge 0x432a18
cmp dword [0x4d9f94], 4
jne 0x4329fe
push esi
push str.CSL_COM:_..._SELECT_INTERRUPTED__timeout___d__n
push 0x4a99e0
call fcn.00465bec
add esp, 0xc
xor eax, eax
pop esi
add esp, 0x10c
ret
mov eax, dword [str.csl_com.c]
push 0x78d
push eax
push str.select
call fcn.0041cb50
add esp, 0xc
xor eax, eax
pop esi
add esp, 0x10c
ret

Function at 0x432ae0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x2c8
push ebx
push esi
mov esi, dword [esp + 0x2d4]
cmp esi, 0x3e8
push edi
jbe 0x432c17
mov ebx, dword [esp + 0x2dc]
test ebx, ebx
jle 0x432c17
push 0xc8
lea eax, [esp + 0x10]
push eax
call sub.WS2_32.dll_gethostname
test eax, eax
je 0x432b5c
mov ecx, dword [str.csl_com.c]
push 0x7cb
push ecx
push str.gethostname_hostname__sizeof_hostname____0
call fcn.0041cad0
mov edx, dword [str.csl_com.c]
push 0x7cb
push edx
push str.gethostname
call fcn.0041cb50
add esp, 0x18
pop edi
pop esi
mov eax, 0x445c1
pop ebx
add esp, 0x2c8
ret
lea eax, [esp + 0xc]
push eax
call fcn.00420b70
add esp, 4
test eax, eax
jne 0x432b8a
lea ecx, [esp + 0xc]
push ecx
push str.___G:_s90_csl_csl_com.c___GENERAL___2001___Cannot_get_IP_address__writing_hostname____s_n
push str.ERROR
call fcn.0041b0a0
add esp, 0xc
lea edi, [esp + 0xc]
jmp 0x432b8c
mov edi, eax
mov al, byte [0x4d68fc]
test al, al
je 0x432c0b
push esi
push 0x4d68fc
lea edx, [esp + 0xdc]
push 0x49eb50
push edx
call fcn.00463a12
mov eax, dword [str.csl_com.c]
push 0x7da
push eax
lea ecx, [esp + 0xec]
push 0x49eb58
push ecx
call fcn.0041f150
mov esi, eax
add esp, 0x20
cmp esi, 0x3e8
ja 0x432bea
mov edx, dword [str.csl_com.c]
push 0x7db
push edx
push 0x49eb5c
jmp 0x432c28
push edi
push ebx
push 0x49eb68
push esi
call fcn.00465bec
mov eax, dword [str.csl_com.c]
push 0x7df
push eax
push esi
call fcn.0041f240
add esp, 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2c8
ret
mov ecx, dword [str.csl_com.c]
push 0x7c8
push ecx
push str.L_PTR__name___port___0
call fcn.0041cad0
add esp, 0xc
pop edi
pop esi
mov eax, 0x445c1
pop ebx
add esp, 0x2c8
ret

Function at 0x440060
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x4400c1
mov al, byte [edi]
test al, al
je 0x4400c1
push ebx
push ebp
mov ebx, 0x100
movsx eax, al
or eax, ebx
mov ebp, esi
mov edx, eax
mov ecx, eax
shr edx, 2
and edx, 0xf
and ecx, 0xf
xor edx, ecx
mov ecx, 0x20
sub ecx, edx
add ebx, 0x100
shr ebp, cl
mov ecx, edx
mov edx, eax
imul edx, eax
shl esi, cl
mov al, byte [edi + 1]
or ebp, esi
xor ebp, edx
inc edi
test al, al
mov esi, ebp
jne 0x440079
mov eax, esi
pop ebp
shr eax, 0x10
pop ebx
xor eax, esi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x4440c0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
ret
Function at 0x4669cb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4669eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0046d28d
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x466a0c
test byte [esp + 8], 2
je 0x466a0c
mov dword [0x4d9f94], 0xd
mov dword [0x4d9f98], 5
jmp 0x4669e7
xor eax, eax
ret

Function at 0x46e875
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4aa288
cmp edx, dword [eax]
je 0x46e897
add eax, 8
inc ecx
cmp eax, 0x4aa318
jl 0x46e888
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4aa288]
jne 0x46e9c5
mov eax, dword [0x4da064]
cmp eax, 1
je 0x46e99f
test eax, eax
jne 0x46e8c8
cmp dword [0x4a9c34], 1
je 0x46e99f
cmp edx, 0xfc
je 0x46e9c5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x46e8ff
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0046b490
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004690c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x46e942
lea eax, [ebp - 0x1a4]
push eax
call fcn.004690c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4772a0
push edi
call fcn.00465600
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0046b490
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0046b4a0
lea eax, [ebp - 0xa0]
push 0x47729c
push eax
call fcn.0046b4a0
push dword [esi + 0x4aa28c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0046b4a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0046ea80
add esp, 0x2c
pop edi
jmp 0x46e9c5
lea eax, [ebp + 8]
lea esi, [esi + 0x4aa28c]
push 0
push eax
push dword [esi]
call fcn.004690c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx