joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10043450
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, eax
movzx eax, byte [edi]
movzx ebx, byte [edi]
movzx edx, word [edi + 2]
and eax, 0xf
and ebx, 0xf
lea ecx, [edi + eax*4]
xor ebp, ebp
add ebx, ebx
push edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebp
add ebx, ebx
call sub.WS2_32.dll_ntohs
movzx esi, ax
sub esi, ebx
mov eax, esi
shr eax, 1
add eax, eax
cmp eax, esi
je 0x1004349a
add ebx, esi
lea ecx, [ebp + 1]
mov byte [ebx + edi], 0
jmp 0x1004349e
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
movzx ecx, cx
add ecx, esi
mov word [eax + 0x10], bp
je 0x100434cf
add ecx, 0xffffffff
shr ecx, 1
add eax, 1
add ecx, 1
movzx ebx, byte [eax]
xor edx, edx
mov dh, byte [eax - 1]
add eax, 2
movzx edx, dx
xor edx, ebx
add ebp, edx
sub ecx, 1
jne 0x100434b8
mov ebx, dword [edi + 0xc]
mov edi, dword [edi + 0x10]
mov eax, ebx
shr eax, 0x10
push eax
mov dword [esp + 0x1c], edi
call sub.WS2_32.dll_ntohs
movzx ecx, ax
push ebx
mov dword [esp + 0x18], ecx
call sub.WS2_32.dll_ntohs
movzx edx, ax
add edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1a]
push eax
add ebp, edx
call sub.WS2_32.dll_ntohs
push edi
movzx ebx, ax
call sub.WS2_32.dll_ntohs
movzx ecx, ax
movzx edx, si
add ecx, ebx
add edx, ecx
pop edi
lea eax, [edx + ebp + 6]
pop esi
mov ecx, eax
shr ecx, 0x10
pop ebp
pop ebx
je 0x10043532
movzx eax, ax
add eax, ecx
mov ecx, eax
shr ecx, 0x10
jne 0x10043526
not eax
push eax
call sub.WS2_32.dll_htons
mov ecx, dword [esp]
mov word [ecx + 0x10], ax
add esp, 0x10
ret
Function at 0x10043550
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, eax
movzx eax, byte [edi]
movzx ebx, byte [edi]
movzx edx, word [edi + 2]
and eax, 0xf
and ebx, 0xf
lea ecx, [edi + eax*4]
xor ebp, ebp
add ebx, ebx
push edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebp
add ebx, ebx
call sub.WS2_32.dll_ntohs
movzx esi, ax
sub esi, ebx
mov eax, esi
shr eax, 1
add eax, eax
cmp eax, esi
je 0x1004359a
add ebx, esi
lea ecx, [ebp + 1]
mov byte [ebx + edi], 0
jmp 0x1004359e
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
movzx ecx, cx
add ecx, esi
mov word [eax + 6], bp
je 0x100435cf
add ecx, 0xffffffff
shr ecx, 1
add eax, 1
add ecx, 1
movzx ebx, byte [eax]
xor edx, edx
mov dh, byte [eax - 1]
add eax, 2
movzx edx, dx
xor edx, ebx
add ebp, edx
sub ecx, 1
jne 0x100435b8
mov ebx, dword [edi + 0xc]
mov edi, dword [edi + 0x10]
mov eax, ebx
shr eax, 0x10
push eax
mov dword [esp + 0x1c], edi
call sub.WS2_32.dll_ntohs
movzx ecx, ax
push ebx
mov dword [esp + 0x18], ecx
call sub.WS2_32.dll_ntohs
movzx edx, ax
add edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1a]
push eax
add ebp, edx
call sub.WS2_32.dll_ntohs
push edi
movzx ebx, ax
call sub.WS2_32.dll_ntohs
movzx ecx, ax
movzx edx, si
add ecx, ebx
add edx, ecx
pop edi
lea eax, [edx + ebp + 0x11]
pop esi
mov ecx, eax
shr ecx, 0x10
pop ebp
pop ebx
je 0x10043632
movzx eax, ax
add eax, ecx
mov ecx, eax
shr ecx, 0x10
jne 0x10043626
not eax
push eax
call sub.WS2_32.dll_ntohs
mov ecx, dword [esp]
mov word [ecx + 6], ax
add esp, 0x10
ret

Function at 0x10043650
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, eax
movzx eax, byte [esi]
movzx ebx, byte [esi]
movzx edx, word [esi + 2]
push edi
and eax, 0xf
and ebx, 0xf
lea ecx, [esi + eax*4]
add ebx, ebx
push edx
xor ebp, ebp
xor edi, edi
mov dword [esp + 0x14], ecx
add ebx, ebx
call sub.WS2_32.dll_ntohs
movzx eax, ax
sub eax, ebx
mov ecx, eax
shr ecx, 1
add ecx, ecx
cmp ecx, eax
je 0x10043694
add ebx, eax
lea ebp, [edi + 1]
mov byte [ebx + esi], 0
mov esi, dword [esp + 0x10]
movzx ecx, bp
add ecx, eax
mov word [esi + 2], di
je 0x100436c7
add ecx, 0xffffffff
shr ecx, 1
lea eax, [esi + 1]
add ecx, 1
mov edi, edi
movzx ebx, byte [eax]
xor edx, edx
mov dh, byte [eax - 1]
add eax, 2
movzx edx, dx
xor edx, ebx
add edi, edx
sub ecx, 1
jne 0x100436b0
mov eax, edi
shr eax, 0x10
je 0x100436dc
mov edi, edi
movzx edi, di
add edi, eax
mov eax, edi
shr eax, 0x10
jne 0x100436d0
not edi
push edi
call sub.WS2_32.dll_ntohs
pop edi
mov word [esi + 2], ax
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100436f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
movzx eax, byte [edi]
xor ecx, ecx
and eax, 0xf
add eax, eax
add eax, eax
mov word [edi + 0xa], cx
je 0x10043739
movzx edx, byte [edi]
push ebx
push esi
and edx, 0xf
lea esi, [edx*4 - 1]
shr esi, 1
lea eax, [edi + 1]
add esi, 1
lea esp, [esp]
movzx ebx, byte [eax]
xor edx, edx
mov dh, byte [eax - 1]
add eax, 2
movzx edx, dx
xor edx, ebx
add ecx, edx
sub esi, 1
jne 0x10043720
pop esi
pop ebx
mov eax, ecx
shr eax, 0x10
je 0x1004374c
movzx ecx, cx
add ecx, eax
mov eax, ecx
shr eax, 0x10
jne 0x10043740
not ecx
push ecx
call sub.WS2_32.dll_htons
mov word [edi + 0xa], ax
ret

Function at 0x100442d0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x10076fbb
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1008f3a0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0xc], 0x10092600
mov dword [0x10092668], esi
mov dword [esp + 0x18], esi
push 0xc
mov dword [0x10092600], esi
mov dword [0x10092604], esi
mov dword [0x10092608], esi
mov dword [0x1009260c], esi
mov dword [0x10092610], esi
mov dword [0x10092660], esi
mov dword [0x10092664], esi
call fcn.100551e8
add esp, 4
cmp eax, esi
jne 0x10044343
xor edi, edi
jmp 0x10044367
push esi
push esi
push eax
push 0x10012c60
push esi
push esi
mov dword [eax], 0x10092600
mov dword [eax + 8], esi
mov dword [eax + 4], 0x10044a10
call fcn.10058070
add esp, 0x18
mov edi, eax
mov eax, dword [0x10092668]
cmp eax, esi
je 0x10044377
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x10092614
mov dword [0x10092668], edi
call esi
push 0x1009262c
call esi
push 0x10092644
call esi
push 0x10092670
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, 0x10092600
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x10046940
Capabilities:
Check os version

Disassembly:
xor eax, eax
mov dword [esi], vtable.CNdisApi.0
mov dword [esi + 0x18], 0
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
push edi
lea edi, [esi + 0x13c]
mov dword [esi + 0x20], eax
mov dword [esi + 0x1c], eax
mov dword [edi], eax
lea eax, [esi + 0x24]
push eax
mov dword [eax], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esi + 0x28]
cmp eax, 5
jne 0x1004698d
cmp dword [esi + 0x2c], 1
jae 0x1004698f
cmp eax, eax
jbe 0x100469c4
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100469c4
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [esi + 0x138], eax
je 0x100469c4
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov eax, dword [esi + 0x138]
call eax
mov eax, esi
pop edi
ret
Function at 0x100472b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x1008f3a0]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
lea eax, [esp + 4]
push eax
mov ebx, ecx
mov dword [esp + 8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x14], 2
jne 0x10047319
mov eax, dword [esp + 8]
cmp eax, 5
jb 0x100472f2
push esi
call fcn.100474e0
jmp 0x1004731f
cmp eax, 4
jne 0x10047301
push ebx
mov ecx, esi
call fcn.10047340
jmp 0x1004731f
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.1005574a
add esp, 0x118
ret
push esi
call fcn.100476c0
mov ecx, dword [esp + 0x11c]
add esp, 4
pop ebx
xor ecx, esp
call fcn.1005574a
add esp, 0x118
ret

Function at 0x10047340
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x43c
mov eax, dword [0x1008f3a0]
xor eax, esp
mov dword [esp + 0x438], eax
mov eax, dword [esp + 0x440]
push ebx
push ebp
push esi
push edi
lea edx, [esp + 0x10]
push edx
push 0x20019
xor esi, esi
push esi
mov dword [esp + 0x38], eax
mov eax, 0x208
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push closesocket
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x34], 0x410
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea edi, [esi + 1]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100474c2
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x14]
push esi
push esi
push esi
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x4c]
push edx
push esi
push eax
call ebx
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x100474b9
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x44]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10047487
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x244]
push edx
lea eax, [esp + 0x2c]
push eax
push 0
push str.ServiceName
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10047474
mov edx, dword [esp + 0x2c]
add edx, 8
push edx
lea eax, [esp + 0x244]
push eax
call fcn.1005a398
add esp, 8
test eax, eax
jne 0x10047476
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
push str.Title
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x14]
push ecx
mov esi, eax
call ebp
mov edx, dword [esp + 0x10]
push edx
call ebp
xor eax, eax
test esi, esi
sete al
jmp 0x100474c6
xor edi, edi
mov ecx, dword [esp + 0x14]
push ecx
call ebp
mov dword [esp + 0x1c], 0x208
jmp 0x10047489
xor edi, edi
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x4c]
push ecx
add esi, 1
push esi
push edx
mov dword [esp + 0x38], 0x104
call ebx
test eax, eax
je 0x100473d2
mov eax, dword [esp + 0x10]
push eax
call ebp
jmp 0x100474c4
xor edi, edi
mov eax, edi
mov ecx, dword [esp + 0x448]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1005574a
add esp, 0x43c
ret
Function at 0x100474e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x1008f3a0]
xor eax, esp
mov dword [esp + 0x214], eax
push ebp
mov ebp, dword [esp + 0x220]
push esi
push edi
push str.DEVICENDISWANIP
push ebx
mov dword [esp + 0x18], 0x410
call fcn.1005a398
add esp, 8
test eax, eax
jne 0x10047546
mov edi, ebp
mov ecx, 6
mov esi, str.WAN_Network_Interface__IP_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1005574a
add esp, 0x218
ret
push str.DEVICENDISWANBH
push ebx
call fcn.1005a398
add esp, 8
test eax, eax
jne 0x10047586
mov edi, ebp
mov ecx, 6
mov esi, str.WAN_Network_Interface__BH_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1005574a
add esp, 0x218
ret
push str.DEVICENDISWANIPV6
push ebx
call fcn.1005a398
add esp, 8
test eax, eax
jne 0x100475c4
mov edi, ebp
mov ecx, 7
mov esi, str.WAN_Network_Interface__IPv6_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1005574a
add esp, 0x218
ret
mov ecx, 0x14
mov esi, str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x18]
movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100475e0
sub eax, edx
mov ecx, eax
lea eax, [ebx + 8]
lea edx, [esp + ecx + 0x18]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x100475f6
lea eax, [esp + 0x18]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10047610
mov ecx, dword [str.Connection]
sub eax, edx
mov edx, dword [0x100869d0]
lea eax, [esp + eax + 0x18]
mov dword [eax], ecx
mov ecx, dword [0x100869d4]
mov dword [eax + 4], edx
lea edx, [esp + 0xc]
push edx
push 0x20019
mov dword [eax + 8], ecx
push 0
lea eax, [esp + 0x24]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1004769d
lea ecx, [esp + 0x10]
push ecx
push ebp
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [esp + 0x1c]
push str.Name
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1005574a
add esp, 0x218
ret
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.1005574a
add esp, 0x218
ret
Function at 0x100476c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
mov eax, dword [0x1008f3a0]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
push ebp
push esi
push edi
mov ecx, 0xb
mov esi, str.SYSTEMCurrentControlSetServicesClassNet_
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], 0x410
mov ebp, 1
movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10047707
sub eax, edx
lea edx, [esp + eax + 0x1c]
mov ecx, ebx
sub edx, ebx
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx + ecx], al
add ecx, ebp
test al, al
jne 0x10047720
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x28]
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10047797
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push str.DriverDesc
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10047772
xor ebp, ebp
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.1005574a
add esp, 0x21c
ret
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.1005574a
add esp, 0x21c
ret

Function at 0x10048ea0
Capabilities:
Get routing table

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push 1
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
or ebp, 0xffffffff
push ebx
or esi, ebp
mov dword [esp + 0x1c], ebx
call sub.IPHLPAPI.DLL_GetIpForwardTable
cmp eax, 0x7a
jne 0x10048f7d
mov ecx, dword [esp + 0x10]
push edi
push ecx
call fcn.1005587a
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [esp + 0x10], edi
je 0x10048f73
push 1
lea edx, [esp + 0x18]
push edx
push edi
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
jne 0x10048f6a
mov edi, dword [edi]
test edi, edi
jbe 0x10048f66
xor ecx, ecx
test edi, edi
jbe 0x10048f2b
mov eax, dword [esp + 0x10]
add eax, 0x28
lea edx, [eax - 0x24]
test edx, edx
je 0x10048f21
cmp dword [eax - 0x24], 0
jne 0x10048f21
mov edx, dword [eax]
cmp esi, edx
jbe 0x10048f21
mov ebp, dword [eax - 0x14]
mov esi, edx
mov ebx, ecx
add ecx, 1
add eax, 0x38
cmp ecx, edi
jb 0x10048f07
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10048f66
cmp ebx, edi
jae 0x10048f66
mov edx, dword [esp + 0x10]
lea ecx, [ebx*8]
sub ecx, ebx
lea esi, [edx + ecx*8 + 4]
mov edi, eax
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
mov edi, edx
push edi
call fcn.1005552d
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
mov edi, dword [esp + 0x10]
push edi
call fcn.1005552d
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100491c0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x100777db
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x1008f3a0]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push edi
mov eax, dword [0x1008f3a0]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov dword [esp + 0xc], esi
mov word [esi + 4], di
push 0x206
lea eax, [esp + 0x16]
push edi
mov dword [esp + 0x22c], edi
push eax
mov word [esp + 0x1c], di
call fcn.1005a450
add esp, 0xc
push 0x104
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.cmd.exe
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10049255
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x14]
push eax
call fcn.10008a30
mov eax, esi
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.1005574a
add esp, 0x21c
ret
Function at 0x1004a810
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10078538
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1008f3a0]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push edi
mov eax, dword [0x1008f3a0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
lea ebp, [edi + 0x1c]
push ebp
mov ebx, edx
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x30], 0
mov eax, dword [ebx]
mov cx, word [ebx + 4]
lea ebx, [edi + 0xc]
lea edx, [esp + 0x10]
mov dword [esp + 0x1c], eax
push edx
lea edi, [esp + 0x20]
mov eax, ebx
mov word [esp + 0x24], cx
call fcn.1004ada0
mov edi, dword [esp + 0x10]
test edi, edi
mov eax, dword [ebx + 4]
mov dword [esp + 0x20], eax
je 0x1004a890
cmp edi, ebx
je 0x1004a895
call fcn.10055f58
mov ebx, dword [esp + 0x14]
cmp ebx, dword [esp + 0x20]
je 0x1004a8f6
test edi, edi
jne 0x1004a8a8
call fcn.10055f58
cmp ebx, dword [edi + 4]
jne 0x1004a8b2
call fcn.10055f58
push 0xffffffffffffffff
push 0
lea edi, [ebx + 0x14]
push edi
mov ecx, esi
call fcn.10001720
mov ecx, dword [edi + 0x1c]
mov dword [esi + 0x1c], ecx
mov edx, dword [edi + 0x20]
mov dword [esi + 0x20], edx
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x28]
mov dword [esi + 0x28], ecx
mov edx, dword [edi + 0x2c]
mov dword [esi + 0x2c], edx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov cl, byte [edi + 0x34]
push ebp
mov byte [esi + 0x34], cl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x1004a8ff
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1005574a
add esp, 0x24
ret

Function at 0x1004bf10
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
sete bl
test bl, bl
je 0x1004bf35
mov eax, dword [eax + 8]
mov ecx, dword [esi + 0xc]
push eax
push ebp
push 1
push edi
call ecx
jmp 0x1004bf67
cmp dword [esi + 8], 0
jne 0x1004bf5a
mov edx, dword [eax + 8]
push 0x100852a4
push edx
call fcn.10059ade
add esp, 8
test eax, eax
mov dword [esi + 8], eax
jne 0x1004bf5a
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esi + 8]
push eax
push ebp
push 1
push edi
call fcn.10058eb1
mov edi, eax
add esp, 0x10
test edi, edi
je 0x1004bf74
cmp edi, ebp
jbe 0x1004bf91
test bl, bl
jne 0x1004bf8b
mov ecx, dword [esi + 8]
push ecx
call fcn.100573e0
add esp, 4
mov dword [esi + 8], 0
mov edx, dword [esi]
mov eax, dword [edx]
mov dword [esi], eax
mov eax, edi
pop edi
pop ebp
pop ebx
ret
Function at 0x1004cb60
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x1004cb92
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
neg eax
sbb eax, eax
and eax, 0x39
add eax, 0xffffffff
ret
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
ret

Function at 0x1004ccf0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x140]
test ecx, ecx
je 0x1004cd0b
mov edx, dword [esi + 0xe4]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
jl 0x1004cd3f
cmp eax, 2
jg 0x1004cd3f
mov ecx, dword [esi + 0xe0]
push ecx
push 1
lea edx, [eax + eax*2 + 0x1007c7a4]
push 2
push edx
call fcn.100572ec
mov eax, dword [esi + 0xe0]
push eax
push 1
push edi
push ebx
call fcn.100572ec
add esp, 0x20
xor eax, eax
ret

Function at 0x1004cf70
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [edi + eax*4 + 0xd4]
push esi
push 0
push ecx
push edx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1004cfb5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x1004cf9b
xor eax, eax
pop esi
ret
push eax
push edi
call fcn.100536c0
push eax
mov eax, dword [edi]
push str.Send_failure:__s
push eax
call fcn.1004ced0
add esp, 0x14
mov eax, esi
pop esi
ret