joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bd60
Capabilities:
Create tcp socket
Create udp socket
Get hostname
Get local ipv4 addresses
Get socket information
Resolve dns
Start tcp server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 1
push 2
mov dword [ebp - 0x124], 0
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
jne 0x43bdaa
push 0x4a3214
call fcn.0046b670
push eax
push 0x4a3214
jmp 0x43beb2
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x104
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x118], xmm0
mov cx, word [eax + 8]
mov word [ebp - 0x118], cx
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x114]
push eax
call fcn.00471f50
add esp, 0xc
push 0x5ab3
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x116], ax
lea eax, [ebp - 0x118]
push 0x10
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x43be3c
push 0x4a3244
call fcn.0046b670
push eax
push 0x4a3244
jmp 0x43beb2
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], 0x10
push eax
lea eax, [ebp - 0x118]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x43be71
push 0x4a3270
call fcn.0046b670
push eax
push 0x4a3270
jmp 0x43beb2
push 0
push edi
call dword [sym.imp.WS2_32.dll_listen]
push 0
push 0
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [0x4bc118], eax
cmp eax, 0xffffffff
jne 0x43bea1
push 0x4a32a4
call fcn.0046b670
push eax
push 0x4a32a4
jmp 0x43beb2
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
call fcn.0046b670
push eax
push 0
call fcn.0046b800
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [esi], eax
xor ecx, ebp
mov eax, esi
pop edi
pop esi
call fcn.00470e77
mov esp, ebp
pop ebp
ret

Function at 0x43d320
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
lea eax, [ebp - 0x118]
mov dword [ebp - 0x120], 0x11c
push 0
push eax
mov dword [ebp - 0x11c], 0
call fcn.00471730
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jb 0x43d385
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x43d3c9
mov eax, dword [ebp - 0x118]
test eax, eax
je 0x43d3c9
cmp eax, 1
jne 0x43d3af
cmp word [ebp - 0xc], 2
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x43d3c9
cmp byte [ebp - 6], 1
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
Function at 0x445a80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48be0b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4bc1dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
test eax, eax
je 0x445b01
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [edi + 0x34]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x34]
call fcn.00445920
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x445b40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48be38
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4bc1dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [esi], vtable.CResizer.0
mov dword [esi + 0xc], 0
mov dword [esi + 0x2c], 0x32
mov dword [esi + 0x30], 0x43
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov byte [esi + 0x34], 1
test eax, eax
je 0x445bb1
push eax
call fcn.004466a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x447280
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c0db
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x240]
mov ebx, dword [ebp + 0xc]
push eax
call fcn.0040e710
add esp, 4
mov eax, dword [ebp - 0x240]
mov dword [ebp - 4], 0
test eax, eax
je 0x4472d8
mov eax, dword [eax]
jmp 0x4472da
xor eax, eax
lea ecx, [ebp - 0x23c]
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x447445
test byte [ebp - 0x23c], 0x10
jne 0x447445
call fcn.0043b2f0
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
test ebx, ebx
jne 0x4473e7
cmp dword [ebp - 0x21c], 0
jne 0x447359
cmp dword [ebp - 0x220], 0
jne 0x447359
push 0x30
push 0x49794c
push 0x4a68a0
push esi
call edi
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x44734b
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x447445
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x447445
push 0x24
push 0x49794c
push 0x4a6988
push esi
call edi
cmp eax, 6
jne 0x447445
push 0x4a6a88
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00470605
push 0x54
lea eax, [ebp - 0x294]
push 0
push eax
call fcn.00471730
add esp, 0x18
mov dword [ebp - 0x298], 0x58
lea eax, [ebp - 0x218]
mov dword [ebp - 0x294], esi
mov dword [ebp - 0x27c], eax
lea eax, [ebp - 0x298]
mov dword [ebp - 0x278], 0x104
push eax
mov dword [ebp - 0x28c], 0x4a4d30
mov dword [ebp - 0x264], 0x20008
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
jne 0x4473fc
jmp 0x447445
push ebx
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00470605
add esp, 0xc
push 0x4a4440
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00435f40
add esp, 0xc
lea eax, [ebp - 0x218]
mov ecx, 0x4bda08
push 0x4be1c0
push 0x4bdfb8
push 0
push eax
call fcn.00416710
test al, al
jne 0x4474b4
push 0x10
push 0x49794c
push 0x4a6aa0
push esi
call edi
xor bl, bl
mov esi, dword [ebp - 0x240]
test esi, esi
je 0x447496
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x447496
test esi, esi
je 0x447496
mov eax, dword [esi]
test eax, eax
je 0x447476
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x44748d
push eax
call fcn.004705af
add esp, 4
mov dword [esi + 4], 0
push esi
call fcn.004705af
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x240]
test eax, eax
je 0x4474c2
mov eax, dword [eax]
jmp 0x4474c4
xor eax, eax
push eax
push esi
call fcn.0043afd0
mov ecx, dword [ebp - 0x240]
add esp, 8
mov bl, al
test ecx, ecx
je 0x4474de
mov ecx, dword [ecx]
jmp 0x4474e0
xor ecx, ecx
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test bl, bl
jne 0x4474fc
push 0x10
push 0x49794c
push 0x4a6af0
jmp 0x447442
mov bl, 1
jmp 0x447447
Function at 0x44e680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c89b
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x224], esi
mov eax, dword [esi]
mov ebx, dword [ebp + 8]
push dword [eax + 4]
call fcn.0046ee40
mov eax, dword [esi]
xor edi, edi
push edi
push edi
push edi
mov dword [eax + 4], eax
mov eax, dword [esi]
push edi
mov dword [ebp - 0x21c], 0x104
mov dword [eax], eax
mov eax, dword [esi]
mov dword [eax + 8], eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
mov dword [esi + 4], 0
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x44e7c3
jmp 0x44e710
push dword [0x4bc124]
lea eax, [ebp - 0x218]
push 0x4a4424
push eax
call fcn.00471574
add esp, 0xc
test eax, eax
jne 0x44e792
mov eax, dword [0x4bc124]
lea esi, [ebp - 0x218]
lea esi, [esi + eax*2]
push esi
call fcn.0046b670
push eax
push esi
call fcn.0046b800
add esp, 0xc
mov dword [ebp - 0x220], eax
movzx eax, byte [0x4bebdf]
mov ecx, dword [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 4], 0
push eax
push 0
lea eax, [ebp - 0x22c]
push eax
call fcn.0041ce00
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x44e792
call fcn.0046b840
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0x104
push eax
lea eax, [ebp - 0x218]
inc edi
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x44e710
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret 4

Function at 0x453c40
Capabilities:
Get memory capacity
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4bec00]
test eax, eax
je 0x453c6d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4bec00], 0
push dword [0x4bde3c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
push 0
call fcn.0043af40
add esp, 8
cmp byte [0x4bdfb4], 0
jne 0x453cef
push 0x38
lea eax, [ebp - 0x244]
mov dword [ebp - 0x24c], 0x40
push 0
push eax
mov dword [ebp - 0x248], 0
call fcn.00471730
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x4a7508
push eax
call fcn.00401fc0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x10
push 0x49794c
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4590e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 0x50]
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
push edi
mov edi, dword [ebp + 8]
push edx
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push edx
push 0
push 0
push eax
push ecx
movdqu xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x50], 0x2c
movdqu xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x459268
cmp dword [ebp - 0x30], 0x2c
jne 0x459268
push ebx
push esi
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, eax
mov eax, dword [ebp - 0x28]
sub eax, 2
je 0x459166
dec eax
jne 0x45917c
and ebx, 0xdfffffff
or ebx, 0x1000000
jmp 0x459172
and ebx, 0xfeffffff
or ebx, 0x20000000
push ebx
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x40]
shr ebx, 0x12
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
and bl, 1
je 0x4591a8
mov ecx, edx
sub ecx, eax
mov eax, dword [ebp - 0xc]
sub eax, esi
cmp eax, ecx
jge 0x4591af
mov eax, dword [ebp - 0x40]
sub edx, eax
add edx, esi
mov dword [ebp - 0xc], edx
mov esi, dword [ebp - 0x10]
test bl, bl
mov edx, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x3c]
je 0x4591c9
mov eax, dword [ebp - 8]
mov ecx, edx
sub ecx, ebx
sub eax, esi
cmp eax, ecx
jge 0x4591d0
sub edx, ebx
add edx, esi
mov dword [ebp - 8], edx
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4c
call esi
push 0x4d
mov dword [ebp - 0x4c], eax
call esi
push 0x4e
mov dword [ebp - 0x44], eax
call esi
push 0x4c
mov ebx, eax
call esi
push 0x4f
add ebx, eax
call esi
push 0x4d
mov dword [ebp - 0x48], eax
call esi
mov ecx, dword [ebp - 0x48]
mov esi, dword [sym.imp.USER32.dll_OffsetRect]
add ecx, eax
mov eax, dword [ebp - 8]
cmp eax, ecx
jle 0x459218
sub ecx, eax
lea eax, [ebp - 0x14]
push ecx
push 0
push eax
call esi
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
cmp ecx, eax
jge 0x45922d
sub eax, ecx
push eax
push 0
lea eax, [ebp - 0x14]
push eax
call esi
mov eax, dword [ebp - 0xc]
cmp eax, ebx
jle 0x45923f
push 0
sub ebx, eax
lea eax, [ebp - 0x14]
push ebx
push eax
call esi
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
jge 0x459254
push 0
sub eax, ecx
push eax
lea eax, [ebp - 0x14]
push eax
call esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x28], 0
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowPlacement]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00470e77
mov esp, ebp
pop ebp
ret
Function at 0x463590
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48de90
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
cmp byte [ebp + 0xc], 0
mov eax, dword [ebp + 8]
je 0x4635d4
movdqu xmm0, xmmword [eax]
movdqu xmmword [ebp - 0x20], xmm0
jmp 0x4635ed
mov eax, dword [eax]
xorps xmm0, xmm0
mov dword [ebp - 0x20], eax
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
movdqu xmm0, xmmword [ebp - 0x20]
push ebx
movdqu xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x38], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add ebx, 0x1c
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x30], ebx
push eax
mov ecx, ebx
call fcn.00464560
mov ecx, dword [ebx]
cmp eax, ecx
je 0x46366d
lea edi, [eax + 0x10]
mov ebx, 0xc
lea esi, [ebp - 0x20]
mov edx, dword [esi]
cmp edx, dword [edi]
jne 0x46363a
add esi, 4
add edi, 4
sub ebx, 4
jae 0x463625
xor ebx, ebx
jmp 0x463666
movzx ebx, dl
movzx edx, byte [edi]
sub ebx, edx
jne 0x463666
movzx ebx, byte [esi + 1]
movzx edx, byte [edi + 1]
sub ebx, edx
jne 0x463666
movzx ebx, byte [esi + 2]
movzx edx, byte [edi + 2]
sub ebx, edx
jne 0x463666
movzx ebx, byte [esi + 3]
movzx edx, byte [edi + 3]
sub ebx, edx
mov dword [ebp - 0x28], eax
test ebx, ebx
jns 0x463670
mov dword [ebp - 0x28], ecx
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x28]
mov eax, dword [eax]
cmp eax, dword [esi]
je 0x463699
lea ecx, [eax + 0x20]
call fcn.0046b860
push dword [ebp - 0x2c]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
jmp 0x46374e
movdqu xmm0, xmmword [ebp - 0x4c]
push 0x490b00
movdqu xmmword [ebp - 0x24], xmm0
call fcn.0046b670
push eax
push 0x490b00
call fcn.0046b800
add esp, 0xc
mov dword [ebp - 0x14], eax
movzx eax, byte [0x4c3484]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 1
push eax
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.00463310
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
test ecx, ecx
je 0x4636eb
call fcn.0046b840
mov edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x2c]
add edi, 0x20
push ebx
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x1c
call fcn.004705b4
add esp, 4
lea ecx, [ebx + 0x18]
mov esi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov al, byte [ebp + 0xc]
movdqu xmm0, xmmword [ebp - 0x4c]
mov byte [esi + 0x14], al
lea eax, [ebp - 0x3c]
push eax
push 0
push esi
push 0x4638f0
push 0
push 0
mov dword [esi], ebx
movdqu xmmword [esi + 4], xmm0
mov dword [esi + 0x18], edi
call fcn.00474460
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00470e77
mov esp, ebp
pop ebp
ret 8
Function at 0x463770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ded0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4bc1dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
movzx esi, byte [ebp + 0xc]
movzx eax, word [ebp + 8]
shl esi, 0x10
push ebx
or esi, eax
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0x1c]
mov edx, eax
mov dword [ebp - 4], 0
mov ecx, dword [eax + 4]
cmp byte [ecx + 0xd], 0
jne 0x4637e4
lea esp, [esp]
cmp dword [ecx + 0x10], esi
jae 0x4637da
mov ecx, dword [ecx + 8]
jmp 0x4637de
mov edx, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x4637d0
cmp edx, eax
je 0x4637f0
mov dword [ebp - 0x10], edx
cmp esi, dword [edx + 0x10]
jae 0x4637f3
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [ebx + 0x1c]
je 0x463829
lea ecx, [eax + 0x14]
call fcn.0046b860
push dword [ebp - 0x18]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x490b00
mov dword [ebp - 0x1c], esi
call fcn.0046b670
push eax
push 0x490b00
call fcn.0046b800
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x18], esi
movzx edx, byte [0x4c3484]
lea eax, [ebp - 0x1c]
push edx
push eax
push 0
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebx + 0x1c]
call fcn.00463200
mov byte [ebp - 4], 0
test esi, esi
je 0x463876
mov ecx, esi
call fcn.0046b840
mov edi, dword [ebp - 0x14]
push ebx
add edi, 0x14
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0xc
call fcn.004705b4
add esp, 4
lea ecx, [ebx + 0x18]
mov esi, eax
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ax, word [ebp + 8]
mov word [esi + 4], ax
mov al, byte [ebp + 0xc]
mov byte [esi + 6], al
lea eax, [ebp - 0x24]
push eax
push 0
push esi
push 0x463b30
push 0
push 0
mov dword [esi], ebx
mov dword [esi + 8], edi
call fcn.00474460
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x465240
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4bc1dc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4c3434], 0
mov dword [ebp - 0x230], 0x4a83e8
mov dword [ebp - 0x22c], 0x464d50
mov dword [ebp - 0x228], 0x4a83f4
mov dword [ebp - 0x224], 0x464ff0
mov dword [ebp - 0x220], 0x4a8400
mov dword [ebp - 0x21c], fcn.00464d00
jne 0x4653c2
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4653b8
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.00474e85
push 0x4a8410
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.00474eda
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x465318
push 0x4a83e8
push edi
call ebx
test eax, eax
jne 0x46536d
push edi
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.00474e85
push 0x4a8418
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.00474eda
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4653b5
push 0x4a83e8
push edi
call ebx
test eax, eax
jne 0x46536d
push edi
call esi
jmp 0x4653b5
xor esi, esi
nop
push dword [ebp + esi*8 - 0x230]
push edi
call ebx
mov dword [ebp + esi*8 - 0x22c], eax
test eax, eax
je 0x4653ae
inc esi
cmp esi, 3
jl 0x465370
mov eax, dword [ebp - 0x22c]
mov dword [0x4bc19c], eax
mov eax, dword [ebp - 0x224]
mov dword [0x4bc1a4], eax
mov eax, dword [ebp - 0x21c]
mov dword [fcn.00464d00], eax
jmp 0x4653b5
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov dword [0x4c3434], 1
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
movzx eax, ax
xor ecx, ebp
mov eax, dword [eax*8 + 0x4bc19c]
call fcn.00470e77
mov esp, ebp
pop ebp
ret 4
Function at 0x465650
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push edi
mov edi, dword [ebp + 0x1c]
push dword [ebp + 8]
mov dword [edi], 0
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x4656de
cmp word [ebx + 8], 2
push esi
jne 0x4656b2
cmp word [ebx + 0xa], 4
jne 0x4656b2
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x4656b2
jmp 0x465690
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00465580
mov dword [edi], eax
test eax, eax
je 0x4656d2
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x465690
push 0x400
push dword [ebx]
push 0x401
push dword [ebp + 0x18]
call fcn.00474f3d
add esp, 0x10
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
pop esi
pop edi
mov eax, 8
pop ebx
pop ebp
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x4656ee.11001
jmp dword [eax*4 + 0x465718]
pop edi
mov eax, 0x2af9
pop ebx
pop ebp
ret 0x18
pop edi
mov eax, 0x2afa
pop ebx
pop ebp
ret 0x18
pop edi
mov eax, 0x2afb
pop ebx
pop ebp
ret 0x18

Function at 0x465db0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x465e41
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push edi
push eax
mov dword [ebp - 4], 0
call ebx
test eax, eax
jne 0x465e36
push dword [ebp - 4]
call fcn.004704a9
add esp, 4
mov dword [ebp + 8], eax
lea ecx, [ebp - 4]
push ecx
push eax
push 0
push 0
push edi
push dword [esi]
call ebx
push dword [ebp - 4]
mov esi, dword [ebp + 8]
push esi
call fcn.0046b800
mov edi, dword [ebp + 0xc]
add esp, 8
mov ebx, eax
mov ecx, dword [edi]
test ecx, ecx
je 0x465e20
call fcn.0046b840
push esi
mov dword [edi], ebx
call fcn.00471723
add esp, 4
mov al, 1
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x465e5e
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call fcn.00465a00
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret 8
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8