joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a380
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x202c
call fcn.0042bc90
mov eax, dword [0x456d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4586a0]
push esi
xor esi, esi
push edi
cmp eax, dword [ebp + 8]
jl 0x41a458
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.0042b807
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x1018]
push 0x1000
push eax
call fcn.00427a37
mov esi, eax
add esp, 0x18
cmp esi, 0xffffffff
jne 0x41a3f0
pop edi
or eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
cmp dword [0x455078], 0
lea eax, [ebp - 0x1018]
push eax
je 0x41a421
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [ebp - 0x202c]
push str._d:__s::__s
push eax
call fcn.00419fc0
add esp, 0x14
jmp 0x41a435
lea eax, [ebp - 0x202c]
push 0x1014
push eax
call fcn.00427b16
add esp, 0xc
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x202c]
push eax
call fcn.0041a1a0
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004265fb
mov esp, ebp
pop ebp
ret

Function at 0x41a470
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2034
call fcn.0042bc90
mov eax, dword [0x456d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2030], eax
mov eax, dword [0x4586a0]
cmp eax, dword [ebp + 8]
jl 0x41a5a0
push ebx
push esi
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.0042b807
mov ebx, dword [ebp + 0x10]
add esp, 8
xor esi, esi
test ebx, ebx
je 0x41a58e
push edi
lea esp, [esp]
mov byte [ebp - 0x202c], 0
xor edi, edi
lea esp, [esp]
cmp esi, ebx
jae 0x41a512
mov eax, dword [ebp - 0x2030]
movzx eax, byte [eax + esi]
push eax
lea eax, [ebp - 0x2034]
push str._02x
push eax
call fcn.00419fa0
lea eax, [ebp - 0x2034]
push eax
lea eax, [ebp - 0x202c]
push 0x1000
push eax
call fcn.00427b8d
inc edi
add esp, 0x18
inc esi
cmp edi, 0x10
jl 0x41a4d0
cmp dword [0x455078], 0
lea eax, [ebp - 0x202c]
push eax
je 0x41a543
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea eax, [ebp - 0x102c]
push str._d:__s::__s
push eax
call fcn.00419fc0
add esp, 0x14
jmp 0x41a557
lea eax, [ebp - 0x102c]
push 0x1014
push eax
call fcn.00427b16
add esp, 0xc
lea eax, [ebp - 0x102c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x102c]
push eax
call fcn.0041a1a0
add esp, 4
cmp esi, ebx
jb 0x41a4c0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
Function at 0x41a5b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x402c
call fcn.0042bc90
mov eax, dword [0x456d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4586a0]
push esi
xor esi, esi
cmp eax, dword [ebp + 8]
jl 0x41a693
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.0042b807
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x402c]
push 0x1000
push eax
call fcn.0042af86
mov esi, eax
add esp, 0x18
cmp esi, 0xffffffff
jne 0x41a616
or eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x80
lea eax, [ebp - 0x1018]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x402c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [0x455078], 0
lea eax, [ebp - 0x1018]
push eax
je 0x41a663
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x202c]
push str._s::__s
push eax
call fcn.00419fc0
add esp, 0x10
jmp 0x41a677
lea eax, [ebp - 0x202c]
push 0x1014
push eax
call fcn.00427b16
add esp, 0xc
lea eax, [ebp - 0x202c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea eax, [ebp - 0x202c]
push eax
call fcn.0041a1a0
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004265fb
mov esp, ebp
pop ebp
ret

Function at 0x41a780
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4587bc], 0
je 0x41a88c
push ebx
mov ebx, dword [ebp + 8]
push 0
push 0xc
push 0x4587d0
push ebx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x41a886
test eax, eax
je 0x41a886
push esi
push edi
cmp eax, 0xc
jge 0x41a7f2
mov esi, 0xc
lea edi, [eax + 0x4587d0]
sub esi, eax
je 0x41a7f2
jmp 0x41a7d0
push 0
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x41a87e
test eax, eax
je 0x41a87e
add edi, eax
sub esi, eax
jne 0x41a7d0
push 0xc
push 0x4587d0
call fcn.00419ad0
mov eax, dword [0x45507c]
add esp, 8
cmp dword [0x4587d8], eax
jne 0x41a87e
mov esi, dword [0x4587d4]
inc eax
mov edi, dword [ebp + 0xc]
mov dword [0x45507c], eax
test esi, esi
je 0x41a83b
push 0
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x41a83b
cmp eax, 0xffffffff
je 0x41a861
add edi, eax
sub esi, eax
jne 0x41a821
push dword [0x4587d4]
push dword [ebp + 0xc]
call fcn.00419ad0
mov ecx, dword [0x4587d4]
add esp, 8
or edx, 0xffffffff
test eax, eax
cmovs ecx, edx
pop edi
pop esi
mov eax, ecx
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.recv_failed:__u_n
call fcn.0042bd55
add eax, 0x40
push eax
call fcn.0042b372
add esp, 0xc
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
or eax, 0xffffffff
pop ebx
pop ebp
ret
push str.PragmaReceiveBytes_recv_n
push 4
call fcn.0041a380
add esp, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
pop ebp
ret
Function at 0x41a8c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
mov eax, dword [0x456d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push str.PRAGMASYS_REMOTE_ADDR
mov dword [ebp - 0x1ac], eax
lea eax, [ebp - 0x2c]
push 0x28
push eax
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x1a4], esi
push eax
mov byte [esi], bl
call fcn.00427325
push 2
lea eax, [ebp - 0x2c]
push eax
push 0x4467c8
call fcn.00429520
add esp, 0x1c
test eax, eax
jne 0x41a929
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.WS2_32.dll_inet_addr]
lea eax, [ebp - 0x2c]
push eax
call edi
lea eax, [ebp - 0x19c]
push eax
push dword [ebp - 0x1ac]
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41aaf1
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0x1a0], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x1a8], ebx
push eax
lea eax, [ebp - 0x198]
push eax
push 0
push dword [ebp - 0x19c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x41aab2
jmp 0x41a9a0
lea eax, [ebp - 0x198]
push eax
push dword [ebp - 0x1ac]
push str._s_s
push dword [ebp + 0x10]
push esi
call fcn.004268c3
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x198]
push 0x4467cc
push eax
call fcn.0042be31
mov esi, eax
add esp, 0x20
test esi, esi
je 0x41aa1c
push esi
call edi
push esi
lea eax, [ebp - 0x94]
push 0x32
push eax
call fcn.00427b16
lea eax, [ebp - 0x1b0]
push eax
push 0x4467cc
push 0
call fcn.0042be31
mov esi, eax
add esp, 0x18
test esi, esi
je 0x41aa1c
push esi
call edi
push esi
lea eax, [ebp - 0x60]
push 0x32
push eax
call fcn.00427b16
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
call edi
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov esi, eax
lea eax, [ebp - 0x94]
push eax
call edi
push eax
call dword [sym.imp.WS2_32.dll_htonl]
cmp esi, eax
jb 0x41aa5f
lea eax, [ebp - 0x2c]
push eax
call edi
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov esi, eax
lea eax, [ebp - 0x60]
push eax
call edi
push eax
call dword [sym.imp.WS2_32.dll_htonl]
cmp esi, eax
jbe 0x41aaad
mov eax, dword [ebp - 0x1a8]
lea ecx, [ebp - 0x1bc]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 0x1a0], 0x104
push ecx
lea ecx, [ebp - 0x198]
inc eax
push ecx
push eax
push dword [ebp - 0x19c]
mov dword [ebp - 0x1a8], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x41aab2
mov esi, dword [ebp - 0x1a4]
jmp 0x41a9a0
mov ebx, 1
push dword [ebp - 0x19c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
test ebx, ebx
je 0x41aaf1
lea eax, [ebp - 0x19c]
push eax
push 9
push 0
push dword [ebp - 0x1a4]
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
je 0x41aaf1
push dword [ebp - 0x19c]
call esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004265fb
mov esp, ebp
pop ebp
ret
Function at 0x41ac50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x456d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
push 0x800
mov dword [ebp - 0x810], eax
xor edi, edi
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.0042bf20
add esp, 0xc
mov dword [ebp - 0x80c], 0x800
lea eax, [ebp - 0x808]
mov dword [ebx], edi
push eax
push 1
push edi
push esi
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41acd5
push eax
push str.RegOpenKeyEx_Error___d_n
push 1
call fcn.0041a380
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
push eax
push ebx
push 0
push dword [ebp - 0x810]
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
je 0x41ad3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push dword [ebp - 0x810]
push str.RegQueryValueEx__s_Error___d__GetLastError___d_n
push 1
call fcn.0041a380
add esp, 0x14
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
cmp dword [ebx], 7
jne 0x41ae16
lea ebx, [ebp - 0x804]
xor esi, esi
cmp byte [ebp - 0x804], 0
mov edx, ebx
je 0x41ad70
mov ecx, edx
inc esi
lea edi, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41ad60
sub ecx, edi
inc edx
add edx, ecx
cmp byte [edx], al
jne 0x41ad56
mov eax, dword [ebp - 0x80c]
inc eax
add eax, esi
push eax
push 0
mov dword [ebp - 0x814], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x41ad1b
mov byte [edi], 0
cmp byte [ebp - 0x804], 0
je 0x41ade1
lea ebx, [ebx]
test esi, esi
jle 0x41ade1
push ebx
push dword [ebp - 0x814]
push edi
call fcn.00427b8d
push 0x44f000
push dword [ebp - 0x814]
push edi
call fcn.00427b8d
mov ecx, ebx
add esp, 0x18
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41add0
sub ecx, edx
inc ebx
add ebx, ecx
dec esi
cmp byte [ebx], al
jne 0x41ada0
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push dword [ebp - 0x810]
push str.PtnGetFromRegistry_for___s_____s__n_r
push 1
call fcn.0041a380
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004265fb
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x80c]
test edx, edx
je 0x41ade1
lea ecx, [ebp - 0x804]
lea esi, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41ae30
sub ecx, esi
cmp edx, ecx
cmovae edx, ecx
mov dword [ebp - 0x80c], edx
cmp edx, 0x800
jae 0x41ae86
mov byte [ebp + edx - 0x804], al
lea eax, [edx + 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x41ad1b
mov eax, dword [ebp - 0x80c]
inc eax
push eax
lea eax, [ebp - 0x804]
push eax
push edi
call fcn.0042a7d0
add esp, 0xc
jmp 0x41ade1
call fcn.00428745
int3
Function at 0x41b4a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x456d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x80c], eax
lea eax, [ebp - 0x804]
push ebx
push eax
call fcn.0042bf20
add esp, 0xc
mov dword [ebp - 0x808], 0x800
lea eax, [ebp - 0x808]
mov dword [edi], ebx
push eax
lea eax, [ebp - 0x804]
push eax
push edi
push ebx
push dword [ebp - 0x80c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
je 0x41b53b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push dword [ebp - 0x80c]
push str.RegQueryValueEx__s_Error___d__GetLastError___n
push 1
call fcn.0041a380
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x804]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b544
mov eax, dword [ebp - 0x808]
sub ecx, edx
cmp eax, ecx
cmovae eax, ecx
mov dword [ebp - 0x808], eax
cmp eax, 0x800
jae 0x41b63e
cmp dword [edi], 7
mov byte [ebp + eax - 0x804], bl
jne 0x41b5e5
add eax, 0x41
lea esi, [ebp - 0x804]
push eax
push 0
mov edi, 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x41b528
mov byte [ebx], 0
cmp byte [ebp - 0x804], 0
je 0x41b615
mov edi, edi
test edi, edi
jle 0x41b615
mov eax, dword [ebp - 0x808]
push esi
add eax, 0x41
push eax
push ebx
call fcn.00427b8d
mov eax, dword [ebp - 0x808]
push 0x44f000
add eax, 0x41
push eax
push ebx
call fcn.00427b8d
mov eax, esi
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41b5d2
sub eax, edx
inc esi
add esi, eax
dec edi
cmp byte [esi], cl
jne 0x41b5a0
jmp 0x41b615
test eax, eax
je 0x41b615
inc eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x41b528
mov eax, dword [ebp - 0x808]
inc eax
push eax
lea eax, [ebp - 0x804]
push eax
push ebx
call fcn.0042a7d0
add esp, 0xc
push ebx
push dword [ebp - 0x80c]
push str._s___s_n
push 2
call fcn.0041a380
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004265fb
mov esp, ebp
pop ebp
ret
call fcn.00428745
int3
Function at 0x41b950
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x850
mov eax, dword [0x456d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x24]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp + 0x28]
push esi
mov esi, dword [ebp + 0x1c]
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp + 0x2c]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x848], eax
xor eax, eax
mov dword [ebp - 0x820], eax
mov dword [ebp - 0x81c], eax
mov dword [ebp - 0x810], esi
xor esi, esi
mov byte [ebp - 0x804], al
mov eax, dword [edi]
mov dword [ebp - 0x850], 0x44
mov dword [ebp - 0x84c], 0
mov dword [ebp - 0x844], 0
mov dword [ebp - 0x840], 0
mov dword [ebp - 0x83c], 0
mov dword [ebp - 0x838], 0x84
mov dword [ebp - 0x834], 0x3c
mov dword [ebp - 0x830], 0x84
mov dword [ebp - 0x82c], 0x3c
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x824], 0x10a
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], edx
test eax, eax
je 0x41ba66
lea esp, [esp]
push eax
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.00427b8d
push 0x44e8e4
lea eax, [ebp - 0x804]
push 0x800
push eax
call fcn.00427b8d
mov eax, dword [edi + esi*4 + 4]
lea esi, [esi + 1]
add esp, 0x18
test eax, eax
jne 0x41ba30
lea eax, [ebp - 0x804]
push eax
push 0x45071c
push 1
call fcn.0041a380
add esp, 0xc
lea eax, [ebp - 0x850]
push ebx
push eax
push dword [ebp - 0x80c]
lea eax, [ebp - 0x804]
push 0
push dword [ebp + 0x20]
push 1
push 0
push 0
push eax
push dword [ebp - 0x808]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 1
jne 0x41bab0
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004265fb
mov esp, ebp
pop ebp
ret
Function at 0x41d620
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x456d10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push str.Create_New_Instance_of_Named_Pipe_n
push 2
call fcn.0041a380
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x104]
push str..pipePragmaServerPipe_d
push eax
call fcn.00404cd0
add esp, 0xc
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], 0x14
push eax
push 0x4e20
push 0
push 0
push 0xff
push 6
push 0x40000003
lea eax, [ebp - 0x104]
mov dword [ebp - 0x10c], esi
push eax
mov dword [ebp - 0x108], 1
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41d6e2
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
push edi
push ebx
call fcn.0041d5b0
add esp, 8
mov esi, eax
push esi
push edi
mov dword [esi + 0x18], 0x21
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x41d715
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x41d715
cmp eax, 0x218
jne 0x41d6cf
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004265fb
mov esp, ebp
pop ebp
ret

Function at 0x41d730
Capabilities:
Create thread
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x41d75e
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41fb40
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a0
mov eax, dword [0x456d10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0xfe
push eax
mov word [ebp - 0x1dc], ax
lea eax, [ebp - 0x1da]
push eax
call fcn.0042bf20
add esp, 0xc
mov dword [ebp - 0x698], 0xc8
lea eax, [ebp - 0x6a0]
mov dword [ebp - 0x690], 0xc8
mov dword [ebp - 0x694], 0x10
mov byte [ebp - 0xdc], 0
push eax
push 0x3e8
lea eax, [ebp - 0x68c]
push eax
push 1
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x690]
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x698]
push eax
lea eax, [ebp - 0x2a4]
push eax
push dword [ebp - 0x68c]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004266cb
add esp, 8
pop esi
test eax, eax
jne 0x41fc24
mov dword [0x458fac], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x1dc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xdc]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x458fac
lea eax, [ebp - 0x1dc]
push eax
push 0
call sub.NETAPI32.dll_NetGetAnyDCName
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
Function at 0x420340
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x456d10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.Enter_NetworkCleanup_r_n
push 1
mov dword [ebp - 0xa4], 0xffffffff
mov dword [ebp - 0xa8], 0x4000
call fcn.0041a380
push 0x9c
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.0042bf20
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0x14
mov dword [ebp - 0xa0], 0x9c
mov dword [ebp - 0x9c], 5
mov dword [ebp - 0x98], 0
push 5
push 2
push 0
push 0
call esi
push 5
push 1
push edx
push eax
call esi
push edx
push eax
push 3
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
je 0x4204df
push str.Do_NetworkCleanup_n
push 1
call fcn.0041a380
add esp, 8
lea eax, [ebp - 0xac]
push eax
push 0
push 0
push 1
push 5
call sub.MPR.dll_WNetOpenEnumA
mov esi, eax
push esi
push str.WNetOpenEnum_returned__d_n
push 3
call fcn.0041a380
add esp, 0xc
test esi, esi
jne 0x4204d0
push ebx
push dword [ebp - 0xa8]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4204c4
push edi
push dword [ebp - 0xa8]
push 0
push ebx
call fcn.0042bf20
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
push ebx
lea eax, [ebp - 0xa4]
push eax
push dword [ebp - 0xac]
call sub.MPR.dll_WNetEnumResourceA
mov esi, eax
push esi
push str.WNetEnumResource_returned__d_n
push 3
call fcn.0041a380
add esp, 0xc
test esi, esi
jne 0x4204b0
cmp dword [ebp - 0xa4], esi
jbe 0x420430
lea edi, [ebx + 0x10]
lea esp, [esp]
push dword [edi]
push esi
push str._d_Close_connection__s_n
push 2
call fcn.0041a380
mov eax, dword [edi]
add esp, 0x10
test eax, eax
je 0x4204a2
push 1
push 0
push eax
call sub.MPR.dll_WNetCancelConnection2A
inc esi
add edi, 0x20
cmp esi, dword [ebp - 0xa4]
jb 0x420480
jmp 0x420430
cmp esi, 0x103
jne 0x420430
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
push dword [ebp - 0xac]
call sub.MPR.dll_WNetCloseEnum
pop ebx
push str.Done_NetworkCleanup_n
push 1
call fcn.0041a380
add esp, 8
push str.Exit_NetworkCleanup_r_n
push 1
call fcn.0041a380
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop esi
call fcn.004265fb
mov esp, ebp
pop ebp
ret

Function at 0x420500
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x456d10]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push 0x104
push 0
push eax
call fcn.0042bf20
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleBaseNameA
test eax, eax
je 0x420576
lea eax, [ebp - 0x108]
push str.csrss.exe
push eax
call fcn.004266cb
add esp, 8
test eax, eax
je 0x420576
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265fb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.004265fb
mov esp, ebp
pop ebp
ret