joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bbb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x459c78
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x4714d0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0x465da0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.004037a0
lea eax, [esp + 0xc]
mov dword [esp + 0x30], 0
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [esi - 0x10]
movzx eax, al
push eax
push 9
push dword [ebp + 8]
call fcn.0040b680
cmp dword [esp + 0x20], 0x10
mov bl, al
jb 0x40bc38
push dword [esp + 0xc]
call fcn.0043e223
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40bc50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x459c78
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x4714d0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0x465da0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.004037a0
lea eax, [esp + 0xc]
mov dword [esp + 0x30], 0
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [esi - 0x10]
movzx eax, al
push eax
push 5
push dword [ebp + 8]
call fcn.0040b680
cmp dword [esp + 0x20], 0x10
mov bl, al
jb 0x40bcd8
push dword [esp + 0xc]
call fcn.0043e223
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40bcf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x459c78
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x4714d0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0x465da0
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
call fcn.004037a0
lea eax, [esp + 0xc]
mov dword [esp + 0x30], 0
push eax
push dword [ebp + 0xc]
lea ecx, [esi - 0x10]
push 0xa
push dword [ebp + 8]
call fcn.0040b680
cmp dword [esp + 0x20], 0x10
mov bl, al
jb 0x40bd74
push dword [esp + 0xc]
call fcn.0043e223
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40f580
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4714d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [ebp - 8]
push eax
push 0
mov ebx, ecx
mov dword [ebp - 8], 0
call esi
push dword [ebp - 8]
call fcn.0043fcf8
add esp, 4
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 8]
push ecx
push eax
call esi
mov ecx, dword [ebp - 0xc]
xor esi, esi
test ecx, ecx
je 0x40f618
push edi
xor edi, edi
cmp dword [ecx + 0x190], esi
jle 0x40f617
lea eax, [ecx + 0x194]
jmp 0x40f5e0
mov cl, byte [eax + edi]
lea edx, [ebx + esi]
call fcn.0040f540
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x190]
dec eax
cmp edi, eax
jge 0x40f600
mov byte [ebx + esi + 2], 0x3a
jmp 0x40f605
mov byte [ebx + esi + 2], 0x23
inc edi
lea eax, [ecx + 0x194]
add esi, 3
cmp edi, dword [ecx + 0x190]
jl 0x40f5e0
pop edi
push ecx
call fcn.0043e084
add esp, 4
test esi, esi
jle 0x40f63c
mov byte [ebx + esi - 1], 0
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop esi
xor ecx, ebp
pop ebx
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret

Function at 0x40f650
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4714d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x288
mov dword [ebp - 0x20], ecx
xor bl, bl
mov dword [ebp - 0x1c], 0x288
call fcn.0043fcf8
mov esi, eax
add esp, 4
test esi, esi
jne 0x40f693
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x40f6ba
push esi
call fcn.0043e084
push dword [ebp - 0x1c]
call fcn.0043fcf8
mov esi, eax
add esp, 8
test esi, esi
je 0x40f681
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x40f75c
mov eax, esi
test esi, esi
je 0x40f75c
cmp dword [eax + 0x1a0], 6
jne 0x40f6e9
cmp dword [eax + 0x190], 6
je 0x40f6f1
mov eax, dword [eax]
test eax, eax
jne 0x40f6d7
jmp 0x40f75c
movzx ecx, byte [eax + 0x199]
xorps xmm0, xmm0
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
movdqu xmmword [ebp - 0x17], xmm0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
call fcn.0043eae5
mov ecx, dword [ebp - 0x20]
add esp, 0x20
movdqu xmm0, xmmword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov bl, 1
movdqu xmmword [ecx], xmm0
mov dword [ecx + 0x10], eax
push esi
call fcn.0043e084
mov ecx, dword [ebp - 4]
add esp, 4
mov al, bl
xor ecx, ebp
pop esi
pop ebx
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret
Function at 0x40f780
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4714d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x178
mov dword [ebp - 0x20], ecx
xor bl, bl
mov dword [ebp - 0x1c], 0x178
call fcn.0043fcf8
mov esi, eax
add esp, 4
test esi, esi
jne 0x40f7c3
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
push eax
push esi
push 0
push 0
push 0
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
cmp eax, 0x6f
jne 0x40f7f0
push esi
call fcn.0043e084
push dword [ebp - 0x1c]
call fcn.0043fcf8
mov esi, eax
add esp, 8
test esi, esi
je 0x40f7b1
lea eax, [ebp - 0x1c]
push eax
push esi
push 0
push 0
push 0
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
test eax, eax
jne 0x40f878
mov eax, esi
test esi, esi
je 0x40f878
jmp 0x40f810
cmp dword [eax + 0x34], 6
je 0x40f81f
mov eax, dword [eax + 8]
test eax, eax
jne 0x40f810
jmp 0x40f878
movzx ecx, byte [eax + 0x31]
xorps xmm0, xmm0
push ecx
movzx ecx, byte [eax + 0x30]
push ecx
movzx ecx, byte [eax + 0x2f]
push ecx
movzx ecx, byte [eax + 0x2e]
push ecx
movzx ecx, byte [eax + 0x2d]
movzx eax, byte [eax + 0x2c]
push ecx
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
movdqu xmmword [ebp - 0x17], xmm0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
call fcn.0043eae5
mov ecx, dword [ebp - 0x20]
add esp, 0x20
movdqu xmm0, xmmword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov bl, 1
movdqu xmmword [ecx], xmm0
mov dword [ecx + 0x10], eax
push esi
call fcn.0043e084
mov ecx, dword [ebp - 4]
add esp, 4
mov al, bl
xor ecx, ebp
pop esi
pop ebx
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret

Function at 0x40f8a0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x4714d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x198]
mov esi, ecx
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40f8dd
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret
push 0x100
push 0x4769b0
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x40f8cc
push 0x4769b0
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40f8cc
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
sub esi, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [esi + eax - 1], cl
test cl, cl
jne 0x40f910
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret
Function at 0x40fb20
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45a9f2
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x4714d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0xd0]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xd4], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x18
mov dword [ebp - 0xac], 0x9c
mov ecx, esi
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push str.unknown_OperatingSystem.
mov byte [esi], 0
call fcn.004037a0
lea eax, [ebp - 0xac]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0xd4], 1
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je case.default.0x40fcb0
mov eax, dword [ebp - 0xa8]
add eax, 0xfffffffc
cmp eax, 6
ja case.default.0x40fcb0
jmp dword [eax*4 + 0x40fd50]
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x40fc06
cmp eax, 0xa
je 0x40fbfc
cmp eax, 0x5a
jne case.default.0x40fcb0
push str.Microsoft_Windows_Me
jmp 0x40fd2a
push str.Microsoft_Windows_98
jmp 0x40fd2a
mov eax, dword [ebp - 0x9c]
cmp eax, 2
jne 0x40fc1b
push str.Microsoft_Windows_NT_4.0
jmp 0x40fd2a
cmp eax, 1
jne case.default.0x40fcb0
push str.Microsoft_Windows_95
jmp 0x40fd2a
mov eax, dword [ebp - 0xa4]
sub eax, 0
je 0x40fc97
dec eax
je 0x40fc8d
dec eax
jne case.default.0x40fcb0
cmp byte [ebp - 0x12], 1
jne 0x40fc5d
cmp word [ebp - 0xd0], 9
jne 0x40fc5d
push str.Microsoft_Windows_XP_Professional_x64_Edition
jmp 0x40fd2a
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x40fc73
push str.Microsoft_Windows_Server_2003
jmp 0x40fd2a
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je case.default.0x40fcb0
push str.Microsoft_Windows_Server_2003_R2
jmp 0x40fd2a
push str.Microsoft_Windows_XP
jmp 0x40fd2a
push str.Microsoft_Windows_2000
jmp 0x40fd2a
mov eax, dword [ebp - 0xa4]
cmp eax, 3
ja case.default.0x40fcb0
jmp dword [eax*4 + 0x40fd6c]
cmp byte [ebp - 0x12], 1
mov ecx, esi
jne 0x40fcc6
push str.Microsoft_Windows_Vista
jmp 0x40fd2c
push str.Microsoft_Windows_Server_2008
jmp 0x40fd2c
cmp byte [ebp - 0x12], 1
mov ecx, esi
jne 0x40fcdc
push str.Microsoft_Windows_7
jmp 0x40fd2c
push str.Microsoft_Windows_Server_2008_R2
jmp 0x40fd2c
cmp byte [ebp - 0x12], 1
mov ecx, esi
jne 0x40fcf2
push str.Microsoft_Windows_8
jmp 0x40fd2c
push str.Microsoft_Windows_Server_2012
jmp 0x40fd2c
cmp byte [ebp - 0x12], 1
mov ecx, esi
jne 0x40fd08
push str.Microsoft_Windows_8.1
jmp 0x40fd2c
push str.Microsoft_Windows_Server_2012_R2
jmp 0x40fd2c
cmp dword [ebp - 0xa4], 0
jne case.default.0x40fcb0
cmp byte [ebp - 0x12], 1
jne 0x40fd25
push str.Microsoft_Windows_10
jmp 0x40fd2a
push str.Microsoft_Windows_Server_2016_Technical_Preview
mov ecx, esi
call fcn.00403f80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret
Function at 0x40ff00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45aa41
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4714d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
push 0
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
push 0x465da0
mov byte [esi], 0
call fcn.004037a0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
push 0x467f90
cmovae eax, dword [ebp + 8]
push eax
mov dword [ebp - 0x18], 1
call fcn.0043f3ae
mov edi, eax
add esp, 8
mov dword [ebp - 0x10], edi
test edi, edi
je 0x410090
push 2
push 0
push edi
call fcn.0043f965
push edi
call fcn.0043f817
mov edi, eax
add esp, 0x10
test edi, edi
jle 0x410085
push edi
call fcn.0043fcf8
push 0
push 0
push dword [ebp - 0x10]
mov esi, eax
call fcn.0043f965
push dword [ebp - 0x10]
push edi
push 1
push esi
call fcn.004408e3
add esp, 0x20
cmp edi, 6
jle 0x40ffd8
mov cl, byte [esi + 5]
mov al, byte [esi + 1]
mov byte [esi + 5], al
mov byte [esi + 1], cl
cmp edi, 0xa
jle 0x40ffe9
mov cl, byte [esi + 9]
mov al, byte [esi + 6]
mov byte [esi + 9], al
mov byte [esi + 6], cl
cmp edi, 0x14
jle 0x40fffa
mov cl, byte [esi + 0x14]
mov al, byte [esi + 0xf]
mov byte [esi + 0x14], al
mov byte [esi + 0xf], cl
xor ecx, ecx
test edi, edi
jle 0x410058
cmp edi, 0x20
jb 0x410048
mov eax, edi
and eax, 0x8000001f
jns 0x410013
dec eax
or eax, 0xffffffe0
inc eax
movdqa xmm1, xmmword [0x46a4c0]
mov edx, edi
sub edx, eax
lea eax, [esi + 0x10]
movdqu xmm0, xmmword [eax - 0x10]
add ecx, 0x20
lea eax, [eax + 0x20]
pandn xmm0, xmm1
movdqu xmmword [eax - 0x30], xmm0
movdqu xmm0, xmmword [eax - 0x20]
pandn xmm0, xmm1
movdqu xmmword [eax - 0x20], xmm0
cmp ecx, edx
jl 0x410022
cmp ecx, edi
jge 0x410058
lea esp, [esp]
not byte [ecx + esi]
inc ecx
cmp ecx, edi
jl 0x410050
cmp byte [esi], 0
jne 0x410061
xor ecx, ecx
jmp 0x41006f
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x410066
sub ecx, edx
push ecx
mov ecx, dword [ebp - 0x14]
push esi
call fcn.00402ed0
push esi
call fcn.0043e084
mov esi, dword [ebp - 0x14]
add esp, 4
push dword [ebp - 0x10]
call fcn.0043e4ba
add esp, 4
cmp dword [ebp + 0x1c], 0x10
jb 0x4100a1
push dword [ebp + 8]
call fcn.0043e223
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411020
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x4714d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, edx
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], ebx
test ebx, ebx
je 0x411165
test eax, eax
je 0x411165
push esi
push edi
lea eax, [ebp - 0x25c]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x41110a
cmp byte [ebp - 0x25c], 0
je 0x41110a
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea esi, [ebp - 0x25c]
lea esp, [esp]
push 0x468718
push esi
call edi
test eax, eax
je 0x4110fc
push 0x46871c
push esi
call edi
test eax, eax
je 0x4110fc
movzx eax, byte [esi]
mov byte [ebp - 0x260], al
movzx eax, byte [esi + 1]
mov byte [ebp - 0x25f], al
lea eax, [ebp - 0x68]
push 0x64
push eax
lea eax, [ebp - 0x260]
mov byte [ebp - 0x25e], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x411118
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
lea eax, [ebp - 0x68]
push ebx
push eax
push dword [ebp - 0x264]
call fcn.00440c64
add esp, 0xc
test eax, eax
je 0x41112b
add esi, 4
cmp byte [esi], 0
jne 0x411090
mov ebx, dword [ebp - 0x264]
mov esi, dword [ebp - 0x268]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x268]
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x264]
add eax, ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop ebx
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret

Function at 0x411180
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4714d0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, edx
test edi, edi
jne 0x4111ab
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret
push esi
push ecx
push 0
push 0x400
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4111e1
push 0x104
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameA]
test eax, eax
jne 0x4111f3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret
mov edx, edi
lea ecx, [ebp - 0x108]
call fcn.00411020
push esi
test eax, eax
je 0x4111db
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop edi
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret
Function at 0x411220
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x121c
call fcn.0044c170
mov eax, dword [0x4714d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x1210]
push eax
push 0x1000
lea eax, [ebp - 0x120c]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
mov esi, dword [ebp - 0x1210]
lea eax, [ebp - 0x20b]
push 0x103
push 0
shr esi, 2
push eax
mov dword [ebp - 0x121c], esi
mov byte [ebp - 0x20c], 0
call fcn.00443760
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.00443760
add esp, 0x18
xor edi, edi
test esi, esi
je 0x4113c6
push ebx
lea esp, [esp]
push dword [ebp + edi*4 - 0x120c]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x4113b4
lea eax, [ebp - 0x1214]
push eax
push 4
lea eax, [ebp - 0x1218]
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x4113ad
push 0x104
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x1218]
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
cmp dword [0x474e08], 0x10
mov eax, 0x474df4
cmovae eax, dword [0x474df4]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0044e15a
add esp, 8
test eax, eax
jne 0x4113ad
mov ecx, dword [ebp + edi*4 - 0x120c]
lea edx, [ebp - 0x108]
call fcn.00411180
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.00440d80
push 0x5c
mov byte [eax + 1], 0
lea eax, [ebp - 0x20c]
push eax
call fcn.00440d80
mov byte [eax + 1], 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0044e15a
add esp, 0x18
test eax, eax
jne 0x4113ad
push dword [ebp + edi*4 - 0x120c]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x121c]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, esi
jb 0x4112a0
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret
Function at 0x413d70
Capabilities:
Create directory
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ad9b
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x4714d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x130
call fcn.0043e531
mov esi, eax
add esp, 4
test esi, esi
je 0x413dcd
push 0x130
push 0
push esi
call fcn.00443760
add esp, 0xc
mov ecx, esi
call fcn.00419850
mov esi, eax
jmp 0x413dcf
xor esi, esi
lea eax, [ebp - 0x118]
mov dword [esi + 0x120], 0xdac3
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esi + 0x48]
cmp ecx, edi
je 0x413dfc
push 0xffffffffffffffff
push 0
push edi
call fcn.00402fc0
lea eax, [edi + 0x18]
lea ecx, [esi + 0x60]
cmp ecx, eax
je 0x413e10
push 0xffffffffffffffff
push 0
push eax
call fcn.00402fc0
lea eax, [edi + 0x60]
lea ecx, [esi + 0x90]
cmp ecx, eax
je 0x413e27
push 0xffffffffffffffff
push 0
push eax
call fcn.00402fc0
lea eax, [edi + 0x30]
lea ecx, [esi + 0x78]
cmp ecx, eax
je 0x413e3b
push 0xffffffffffffffff
push 0
push eax
call fcn.00402fc0
lea eax, [edi + 0x78]
push eax
lea edx, [ebp - 0x118]
lea ecx, [ebp - 0x130]
call fcn.00405ce0
add esp, 4
push 0x467ea8
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x148]
call fcn.00407f60
mov edi, eax
add esp, 4
cmp esi, edi
je 0x413e9e
cmp dword [esi + 0x14], 0x10
jb 0x413e85
push dword [esi]
call fcn.0043e223
add esp, 4
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], 0
push edi
mov byte [esi], 0
call fcn.00402db0
cmp dword [ebp - 0x134], 0x10
jb 0x413eb5
push dword [ebp - 0x148]
call fcn.0043e223
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x11c], 0x10
mov dword [ebp - 0x134], 0xf
mov dword [ebp - 0x138], 0
mov byte [ebp - 0x148], 0
jb 0x413eee
push dword [ebp - 0x130]
call fcn.0043e223
add esp, 4
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
jb 0x413f13
mov eax, dword [esi]
jmp 0x413f15
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x413f37
cmp dword [esi + 0x14], 0x10
jb 0x413f2c
mov eax, dword [esi]
jmp 0x413f2e
mov eax, esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp byte [ebp - 0x118], 0
jne 0x413f44
xor ecx, ecx
jmp 0x413f59
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413f50
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
push eax
lea ecx, [esi + 0x18]
call fcn.004037a0
mov ecx, esi
call fcn.004191f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret
Function at 0x419fc0
Capabilities:
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x4714d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x198]
mov esi, ecx
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x41a042
mov eax, dword [ebp - 0x198]
cmp al, 2
jne 0x41a03c
shr eax, 8
cmp al, 2
jne 0x41a03c
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0xe0], eax
cmp eax, 0xffffffff
jne 0x41a02b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop esi
call fcn.0043d8bb
mov esp, ebp
pop ebp
ret