joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e555
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x443420]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x42e5f7
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x42e6f9
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x42e6a7
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocStringLen
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e6fa
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42e69c
cmp dword [ebp - 0x24], 1
jne 0x42e69c
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x43abe8
push eax
call fcn.004157e0
add esp, 0xc
cmp eax, 1
jne 0x42e69c
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42e6fa
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x42e6fa
lea ecx, [ebp - 0x18]
push ecx
push 0x42e53f
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x42e6fa
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x42e720
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.0042e4c0
cmp eax, ebx
pop ecx
pop ecx
jne 0x42e722
inc edi
cmp edi, esi
jl 0x42e709
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00415769
leave
ret 4
Function at 0x42e731
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x442140
je 0x42e7ed
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42e7d5
mov esi, dword [ebx + 4]
jmp 0x42e7cf
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42e7bf
cmp dword [ebp - 0xc], 4
jne 0x42e7bf
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x42e7b7
or dword [eax + 0x9c], ecx
jmp 0x42e7bf
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x42e783
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x42e766
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x42ebda
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4326d2
call fcn.00415ce0
sub esp, 0x11c
mov eax, dword [0x443420]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x42ecd3
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x42eca7
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00405c30
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.0042ebda
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401390
test bl, bl
jne 0x42eca7
or dword [ebp - 4], 0xffffffff
jmp 0x42ec18
cmp esi, 0x103
je 0x42ecb7
cmp esi, 0x3f2
jne 0x42ecc7
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.00415769
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x42f3c5
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov eax, 0x432799
call fcn.00415ce0
mov eax, 0x1014
call fcn.004162e0
mov eax, dword [0x443420]
push ebx
push edi
xor edi, edi
mov dword [ebp - 0x101c], edi
cmp dword [ecx + 0x50], edi
mov dword [ebp - 0x10], eax
je 0x42f4c0
push dword [ebp + 0xc]
call fcn.0042f37f
cmp eax, edi
mov dword [ebp - 0x1014], eax
jne 0x42f40e
push dword [ebp + 0x14]
jmp 0x42f4f1
push esi
call fcn.00424eee
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp + 0xc], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1020]
push eax
push edi
lea eax, [ebp - 0x101c]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp - 0x1014]
call esi
cmp eax, edi
mov dword [ebp - 0x1018], eax
jne 0x42f48b
lea eax, [ebp - 0x1020]
push eax
push dword [ebp - 0x1020]
lea ecx, [ebp + 0xc]
call fcn.00403f50
push eax
lea eax, [ebp - 0x101c]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x1014]
call esi
push 0xffffffffffffffff
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x1018], eax
call fcn.0040a0a6
mov ebx, dword [ebp + 0xc]
push dword [ebp - 0x1014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1018], edi
mov ecx, dword [ebp + 8]
pop esi
jne 0x42f4ae
lea eax, [ebp + 0xc]
push eax
call fcn.00403dc0
jmp 0x42f4b6
push dword [ebp + 0x14]
call fcn.00405c30
lea ecx, [ebx - 0x10]
call fcn.00401390
jmp 0x42f4f9
cmp dword [ebp + 0x14], edi
jne 0x42f4cc
mov dword [ebp + 0x14], 0x43a7b0
push dword [ecx + 0x64]
lea eax, [ebp - 0x1010]
push 0x1000
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, dword [ebp + 8]
call fcn.00405c30
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.00415769
leave
ret 0x10

Function at 0x4300b5
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x4300ea
cmp edi, dword [esi + 0xc]
jge 0x4300ea
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4300ea
cmp edi, dword [eax + 8]
jge 0x4300ea
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x4300ec
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x4301f0
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x430224
jmp fcn.004237c8
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret
Function at 0x430295
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x43038e
cmp eax, dword [edi + 0xc]
jge 0x43038e
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x4302e6
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x430377
cmp dword [ebp + 0xc], ebx
je 0x430377
jmp 0x430310
push 0x10
call fcn.0042ff81
cmp eax, ebx
je 0x4302fc
mov ecx, eax
call fcn.004301e7
mov esi, eax
jmp 0x4302fe
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x430327
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x430337
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x430349
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.004237c8
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.00415780
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x430389
cmp ecx, dword [esi + 8]
jge 0x430389
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x43038f
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x43044e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43047c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43049a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004303b8
jmp 0x43049a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43049a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004303b8
test edi, edi
mov eax, edi
jne 0x430484
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x44624c]
test ecx, ecx
je 0x43054d
jmp 0x43044d
ret 8
Function at 0x401938
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4019d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x104
call sub.VCL30.dpl_System._GetMem_51F89FF7
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4019af
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call sub.VCL30.dpl_System._LStrFromPChar_F19DF0A0
mov eax, dword [ebp - 0x10]
call sub.vclx30.dpl_FileCtrl.DirectoryExists_3C9BDBFB
test al, al
jne 0x4019a2
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call sub.VCL30.dpl_System._LStrFromPChar_F19DF0A0
mov eax, dword [ebp - 0x10]
call sub.vclx30.dpl_FileCtrl.ForceDirectories_D425663E
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call sub.VCL30.dpl_System._LStrFromPChar_F19DF0A0
jmp 0x4019b7
mov eax, dword [ebp - 4]
call sub.VCL30.dpl_System._LStrClr_40929B27
mov eax, dword [ebp - 8]
call sub.VCL30.dpl_System._FreeMem_51F89FF7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4019dc
lea eax, [ebp - 0x10]
call sub.VCL30.dpl_System._LStrClr_40929B27
ret
Function at 0x413200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.EYZtqSKO
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x413222
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x413229
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413218
mov eax, 1
add ebx, ebx
jne 0x41323b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x413230
jne 0x41324c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413230
xor ecx, ecx
sub eax, 3
jb 0x413260
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4132d2
mov ebp, eax
add ebx, ebx
jne 0x41326b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x413278
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41329c
inc ecx
add ebx, ebx
jne 0x413288
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41327d
jne 0x413299
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41327d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4132bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4132ad
jmp 0x41321e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4132bc
add edi, ecx
jmp 0x41321e
pop esi
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x41331b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x130b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1311c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4132d9
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13124]
or eax, eax
je 0x413315
mov dword [ebx], eax
add ebx, 4
jmp 0x4132f6
call dword [esi + 0x13120]
mov ebp, dword [esi + 0x13128]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41334f
sub esp, 0xffffff80
jmp section.WZqkObwJ
Function at 0x4014ab
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x250
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
call ebx
push esi
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x228], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x21c], 6
push eax
push eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push edx
push edx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x220], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push ecx
push ecx
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push esi
mov dword [esp], 0
call ebx
lea ebx, [ebp - 0x210]
push edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push ecx
push ecx
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
push esi
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
lea esp, [ebp - 8]
lea eax, [ebx - 3]
pop ebx
pop esi
pop ebp
ret

Function at 0x4016af
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 1
call fcn.004014ab
test eax, eax
jne 0x401749
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x4021b2
sub eax, 0x401750
mov dword [esp], 0x401750
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x401749
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401423
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.00401630
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1ba00
mov dword [esp], 0x40300c
call fcn.00401eb5
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x401c29
Capabilities:
Reference cloudflare dns server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, edx
xor edx, edx
push edi
mov edi, ecx
push ecx
mov ecx, dword [esi + 0x28]
call fcn.004054b6
mov dword [ebp - 8], eax
pop ecx
test eax, eax
jne 0x401c56
mov ecx, str.UNKNOWN
call fcn.004050ed
mov dword [ebp - 8], eax
mov ecx, dword [esi + 0x28]
cmp ecx, 0xffffffff
jne 0x401c69
mov dword [ebp - 4], 0x10000
or ecx, ecx
jmp 0x401c77
xor edx, edx
inc edx
call fcn.0040557a
mov ecx, dword [esi + 0x28]
mov dword [ebp - 4], eax
xor edx, edx
push ecx
inc edx
call fcn.004054b6
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x401c93
mov ecx, str.UNKNOWN
call fcn.004050ed
mov ebx, eax
mov ecx, dword [esi + 0x28]
xor edx, edx
call fcn.0040557a
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x401cbf
push ebx
call fcn.0040dae7
pop ecx
mov ecx, str.127.0.0.1
call fcn.004050ed
mov ebx, eax
mov dword [ebp - 0xc], 0xffff
push dword [esi + 0x90]
call fcn.0040dae7
mov dword [esp], 0x400
call fcn.0040dba8
pop ecx
push dword [ebp - 4]
mov dword [esi + 0x90], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
push dword [esi + 0x8c]
push dword [esi + 0x80]
push dword [esi + 0x84]
push dword [ebp + 8]
push str._s:_listening_port__d_for__.100s_port__d__connect_from__.200s_port__d_to__.100s_port__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push dword [ebp + 8]
mov ecx, edi
push esi
call fcn.00401642
push str.direct_tcpip
push dword [ebp + 8]
call fcn.0040d940
add esp, 0x38
test eax, eax
jne 0x401d47
mov ecx, dword [edi]
mov edx, dword [esi + 0x80]
mov ecx, dword [ecx + 0x1c]
call fcn.00408099
test eax, eax
jne 0x401e24
mov edx, dword [esi + 0x8c]
jmp 0x401d9a
push str.direct_streamlocal_openssh.com
push dword [ebp + 8]
call fcn.0040d940
pop ecx
pop ecx
test eax, eax
jne 0x401d6c
mov ecx, dword [edi]
mov edx, dword [esi + 0x80]
mov ecx, dword [ecx + 0x1c]
call fcn.00408099
jmp 0x401da4
push str.forwarded_streamlocal_openssh.com
push dword [ebp + 8]
call fcn.0040d940
mov edx, dword [esi + 0x80]
pop ecx
pop ecx
mov ecx, dword [edi]
mov ecx, dword [ecx + 0x1c]
test eax, eax
je 0x401d65
call fcn.00408099
test eax, eax
jne 0x401e24
mov edx, dword [ebp - 4]
mov ecx, dword [edi]
mov ecx, dword [ecx + 0x1c]
call fcn.00407fe0
test eax, eax
jne 0x401e24
push str.forwarded_streamlocal_openssh.com
push dword [ebp + 8]
call fcn.0040d940
pop ecx
pop ecx
mov ecx, dword [edi]
mov ecx, dword [ecx + 0x1c]
test eax, eax
jne 0x401dfd
mov edx, 0x421c9a
call fcn.00408099
test eax, eax
jne 0x401e24
mov ecx, dword [edi]
mov ecx, dword [ecx + 0x1c]
call fcn.00408306
cmp eax, 6
jb 0x401e1a
mov ecx, edi
call fcn.00406400
test eax, eax
jne 0x401e1a
push ebx
call fcn.0040dae7
pop ecx
push dword [ebp - 8]
call fcn.0040dae7
pop ecx
pop edi
pop esi
pop ebx
leave
ret
mov edx, str.1.1.1.1
call fcn.00408099
test eax, eax
jne 0x401e24
mov ecx, dword [edi]
push 0x50
pop edx
mov ecx, dword [ecx + 0x1c]
call fcn.00407fe0
jmp 0x401dca
push dword [esi + 4]
push str.channel__i:_send
jmp 0x401e2c
push dword [esi + 4]
push str.channel__i:_reply
call fcn.00404f05
int3
Function at 0x403dc1
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
jmp 0x403ea1
mov ecx, dword [eax + 4]
sub ecx, 1
je 0x403e17
sub ecx, 1
je 0x403ded
sub ecx, 0x15
jne 0x403e98
push 0xa
push 0x6c
lea ecx, [ebp - 0x6c]
push ecx
push 0x401
lea ecx, [ebp - 0x470]
push ecx
push dword [eax + 0x10]
push dword [eax + 0x18]
call dword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x403e98
jmp 0x403e3e
mov esi, dword [eax + 0x18]
lea ecx, [ebp - 0x470]
push 0x401
mov edx, str.unix
call fcn.00404f54
push 0x6c
lea edx, [esi + 2]
lea ecx, [ebp - 0x6c]
call fcn.00404f54
pop ecx
pop ecx
mov ecx, dword [edi + 8]
push dword [ecx + 0xc]
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 4]
call fcn.0040863a
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
je 0x403e98
mov ecx, ebx
call fcn.00405b9b
cmp eax, 0xffffffff
je 0x403ece
mov edx, dword [edi + 8]
mov ecx, ebx
push dword [edx + 0x10]
mov edx, dword [edx + 0x18]
call fcn.00408a7e
pop ecx
cmp eax, 0xffffffff
jne 0x403eb1
call fcn.0040dad4
cmp dword [eax], 0x70
je 0x403eb1
call fcn.0040dad4
mov ecx, ebx
mov esi, dword [eax]
call fcn.00408c54
call fcn.0040dad4
mov dword [eax], esi
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x1c]
mov dword [edi + 8], eax
test eax, eax
jne 0x403dd7
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [edi + 8]
cmp dword [eax + 4], 1
je 0x403ec4
mov ecx, ebx
call fcn.004053af
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x1c]
mov dword [edi + 8], eax
mov eax, ebx
jmp 0x403eac
push ebx
push str.set_nonblock__d_
call fcn.00404f05
int3

Function at 0x404d0e
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
and dword [esp], 0
lea eax, [esp + 8]
push esi
push edi
push 0x190
push 0
push eax
mov edi, edx
mov dword [esp + 0x18], 0x2710
mov esi, ecx
call fcn.0040a390
lea eax, [esi - 4]
add esp, 0xc
test eax, eax
jne 0x404dd2
push dword [edi + 0xc]
call fcn.0040deaa
pop ecx
mov dword [0x4248d0], eax
push dword [edi + 8]
call fcn.0040deaa
pop ecx
push eax
call dword [sym.imp.WS2_32.dll_htons]
push 2
mov word [0x425346], ax
pop eax
mov word [0x425344], ax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x425348], eax
call fcn.00408524
lea eax, [esp + 0x10]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x404dd2
push ecx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
call fcn.0040430b
pop ecx
pop ecx
test eax, eax
jne 0x404dda
mov esi, dword [esp + 8]
mov ecx, esi
mov eax, dword [esi]
or dword [eax + 0x50], 0xffffffff
call fcn.00401032
mov ecx, esi
call fcn.00404cca
call dword [sym.imp.WS2_32.dll_WSACleanup]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00404efa
int3