joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4af19c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4af1cd
mov ecx, dword [0x4ba1c4]
mov dl, 1
mov eax, dword [0x4ab4c4]
call fcn.004154c8
call fcn.00405868
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x4af1fa
mov ecx, dword [0x4ba150]
mov dl, 1
mov eax, dword [0x4ab4c4]
call fcn.004154c8
call fcn.00405868
xor eax, eax
push ebp
push 0x4af276
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00405034
cmp byte [ebp + 8], 0
je 0x4af252
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004aefb8
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.004ae9b0
jmp 0x4af26c
mov eax, dword [ebp + 0x10]
push eax
movzx eax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004ae328
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4af293
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4af508
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004ae744
xor eax, eax
push ebp
push 0x4af67b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4af665
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x4af554
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4af55e
call fcn.0040595c
jmp 0x4af682
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00432b30
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x4af65a
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x4af60d
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x4af5fa
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00405034
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.004af4c0
pop ecx
mov eax, dword [ebp - 4]
movzx edx, byte [0x4af690]
cmp dl, byte [eax + 0x28]
je 0x4af661
call fcn.0041538c
jmp 0x4af661
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00432b50
jmp 0x4af661
cmp edi, ebx
jge 0x4af629
mov eax, dword [ebp - 0xc]
add eax, edi
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00432b50
jmp 0x4af55e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00432b30
cmp edx, dword [esp + 4]
jne 0x4af649
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4af55e
push ebp
call fcn.004af4c0
pop ecx
jmp 0x4af661
push ebp
call fcn.004af4c0
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af682
mov eax, dword [ebp - 4]
call fcn.004ae74c
ret
movzx eax, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af6c4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4af7e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004ae744
xor eax, eax
push ebp
push 0x4af7c9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4af714
call fcn.0040595c
jmp 0x4af7d0
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4af7b3
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4af7b3
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00405034
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4af7b3
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.004149d8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4af804
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4ba2a8]
mov dl, 1
mov eax, dword [0x4ab4c4]
call fcn.00415598
call fcn.00405868
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af7d0
mov eax, dword [ebp - 4]
call fcn.004ae74c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af7ed
lea eax, [ebp - 0x28]
call fcn.00406850
ret
Function at 0x4af854
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4af9c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004ae744
xor eax, eax
push ebp
push 0x4af9a8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x4af8b9
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4af8b9
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x4af992
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4af8cc
call fcn.0040595c
jmp 0x4af9af
lea eax, [ebp - 0x10]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
test eax, eax
jne 0x4af8f3
cmp dword [ebp - 0x10], 0
jle 0x4af8f3
cmp ebx, dword [ebp - 0x10]
jle 0x4af8f3
mov ebx, dword [ebp - 0x10]
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4af992
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4af992
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00405034
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4af992
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.004149d8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0x11
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov eax, 0x4af9e4
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
lea eax, [ebp - 0x28]
push eax
push 2
mov ecx, dword [0x4ba2a8]
mov dl, 1
mov eax, dword [0x4ab4c4]
call fcn.00415598
call fcn.00405868
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af9af
mov eax, dword [ebp - 4]
call fcn.004ae74c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af9cc
lea eax, [ebp - 0x2c]
call fcn.00406850
ret
Function at 0x40d4b0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x44e448
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x452650]
push esi
mov esi, ecx
push edi
mov ecx, dword [esp + 0x34]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x10], esi
call fcn.004155e0
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
xor edi, edi
lea ecx, [esi + 0x44]
mov dword [esp + 0x24], edi
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 2
mov dword [esi + 0x40], edi
call fcn.00405490
mov dword [esi + 0x90], 0x3f800000
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi], 0x4526dc
call fcn.004361d7
cdq
mov ecx, 0x3e8
idiv ecx
sub edx, 0x1f4
mov dword [esp + 0x34], edx
fild dword [esp + 0x34]
fstp dword [esp + 0x2c]
call fcn.004361d7
cdq
mov ecx, 0x3e8
idiv ecx
sub edx, 0x1f4
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x2c]
fild dword [esp + 0x34]
fstp dword [esi + 0xa0]
mov dword [esi + 0xa4], edx
call fcn.004361d7
cdq
mov ecx, 0x64
idiv ecx
mov dword [esp + 0x34], edx
fild dword [esp + 0x34]
fstp dword [esp + 0x30]
call fcn.004361d7
cdq
mov ecx, 0x64
idiv ecx
mov dword [esp + 0x34], edx
fild dword [esp + 0x34]
fstp dword [esp + 0x2c]
call fcn.004361d7
cdq
mov ecx, 0x64
mov dword [esp + 0x18], edi
idiv ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x2c]
fild dword [esp + 0x34]
mov dword [esp + 0x10], edx
fadd dword [0x4515b0]
fstp dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x90], ecx
mov dword [esi + 0x94], edx
mov ecx, edi
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], ecx
call fcn.00425730
mov ecx, dword [esp + 0x1c]
cmp eax, 0x100000
setge dl
mov byte [esi + 0xa8], dl
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10
Function at 0x411940
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x44e853
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
push esi
push edi
push fcn.0042c2b0
push 0x411700
mov ebx, ecx
push 8
push 0x14
push ebx
mov dword [esp + 0x2c], ebx
call fcn.00436b41
push fcn.0042c2b0
push 0x411700
push 8
lea eax, [ebx + 0xe0]
push 0x14
push eax
mov dword [esp + 0x5c], 0
call fcn.00436b41
mov edi, ebx
mov byte [esp + 0x48], 1
mov dword [esp + 0x10], edi
lea ebp, [ebx + 0xa0]
mov dword [esp + 0x14], 8
push str.Lost_Boys
mov ecx, edi
call fcn.0042c890
mov dword [ebp], 0
mov dword [ebp + 0x20], 0
mov esi, dword [ebp]
push edi
lea ecx, [esp + 0x30]
call fcn.0042c1d0
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x4c], 2
call fcn.0042cb40
push 0
lea ecx, [esp + 0x30]
call fcn.0042cb40
mov esi, dword [esp + 0x30]
test esi, esi
je 0x4119ff
lea eax, [esi + 1]
jmp 0x411a01
xor eax, eax
mov edx, dword [esp + 0x34]
xor ecx, ecx
test edx, edx
jle 0x411a20
mov dl, byte [eax]
xor dl, 0x51
mov byte [eax], dl
mov edx, dword [esp + 0x34]
inc eax
inc ecx
cmp ecx, edx
jl 0x411a0b
mov esi, dword [esp + 0x30]
test esi, esi
je 0x411a29
lea eax, [esi + 1]
jmp 0x411a2b
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
push edx
push eax
call fcn.004154d0
add esp, 0xc
lea esi, [edi + 0xe0]
mov ecx, esi
push 0x10
call fcn.0042c920
push 0x10
mov ecx, esi
call fcn.0042c5b0
test eax, eax
je 0x411a8e
lea esi, [esp + 0x1c]
mov ecx, eax
sub esi, eax
mov edi, 0x10
xor eax, eax
mov ebx, 0x1a
mov al, byte [esi + ecx]
cdq
idiv ebx
add dl, 0x41
mov byte [ecx], dl
inc ecx
dec edi
jne 0x411a63
mov edi, dword [esp + 0x10]
lea esi, [edi + 0xe0]
mov ecx, esi
call fcn.0042c5e0
mov ebx, dword [esp + 0x18]
push 0x10
mov ecx, esi
call fcn.0042c2d0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x48], 1
call fcn.0042c2b0
mov eax, dword [esp + 0x14]
add ebp, 4
add edi, 0x14
dec eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
jne 0x4119b1
mov ecx, ebx
call fcn.00411b50
mov ecx, dword [esp + 0x40]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret
Function at 0x41d190
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x44f4f3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0041b9b0
xor edi, edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], edi
mov dword [esi], 0x45467c
mov cl, byte [esp + 0x24]
mov al, byte [esp + 0x28]
mov ebx, dword [esp + 0x20]
mov byte [esi + 0x2c], cl
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], edi
mov dword [esi + 0x20], edi
mov byte [esi + 0x24], al
mov dword [esi + 0x28], edi
mov word [esi + 0x2e], bx
call fcn.004241a0
mov eax, 1
push ebx
mov ecx, esi
mov byte [esp + 0x1c], al
mov dword [esi + 0x5c], 0x3f3f3f3f
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], eax
mov dword [esi], 0x454694
call fcn.0041d560
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x41d230
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44f51e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0041b9b0
lea edi, [esi + 0x10]
xor ebx, ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 4], ebx
mov dword [edi], ebx
mov dword [edi + 8], ebx
mov dword [esi], 0x45467c
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], ebx
mov dword [esi + 0x20], ebx
mov byte [esi + 0x24], bl
mov dword [esi + 0x28], ebx
mov byte [esi + 0x2c], bl
mov word [esi + 0x2e], bx
call fcn.004241a0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x5c], 0x3f3f3f3f
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], 1
mov dword [esi], 0x454694
mov byte [esi + 9], bl
push 0x50
mov byte [esp + 0x1c], 1
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
call fcn.0044748b
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0x18], 2
je 0x41d2e5
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push 1
push edx
push edi
push ecx
mov ecx, eax
call fcn.0041e4c0
jmp 0x41d2e7
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x20], eax
mov byte [esi + 8], 1
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x41d310
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44f54e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0041b9b0
lea edi, [esi + 0x10]
xor ebx, ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 4], ebx
mov dword [edi], ebx
mov dword [edi + 8], ebx
mov dword [esi], 0x45467c
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], ebx
mov dword [esi + 0x20], ebx
mov byte [esi + 0x24], bl
mov dword [esi + 0x28], ebx
mov byte [esi + 0x2c], bl
mov word [esi + 0x2e], bx
call fcn.004241a0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x5c], 0x3f3f3f3f
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], 1
mov dword [esi], 0x454694
mov byte [esi + 9], bl
push 0x50
mov byte [esp + 0x1c], 1
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
call fcn.0044748b
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebx
mov byte [esp + 0x18], 2
je 0x41d3be
mov edx, dword [esp + 0x20]
push edi
push edx
mov ecx, eax
call fcn.0041e550
jmp 0x41d3c0
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x20], eax
mov byte [esi + 8], 1
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x41d3f8
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x44f57e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x454694
mov edi, dword [esi + 0x20]
mov dword [esp + 0x18], 1
test edi, edi
je 0x41d425
mov ecx, edi
call fcn.0041e5e0
push edi
call fcn.004474b4
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x41d434
lea ecx, [eax + 8]
mov eax, dword [eax + 8]
call dword [eax]
lea edi, [esi + 0x30]
mov dword [esp + 0xc], edi
lea ecx, [edi + 0x18]
mov byte [esp + 0x18], 2
call fcn.0042c2b0
lea ecx, [edi + 4]
mov byte [esp + 0x18], 0
call fcn.0042c2b0
mov ecx, esi
mov dword [esi], 0x45467c
call fcn.0041b9f0
mov ecx, dword [esp + 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x424480
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x44f70b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, ecx
push edi
mov al, byte [ebp]
lea edx, [ebp + 4]
lea edi, [esi + 4]
push edx
mov dword [esp + 0x14], edi
mov byte [edi], al
mov cl, byte [ebp + 1]
mov byte [edi + 1], cl
lea ecx, [edi + 4]
call fcn.0042c1d0
add ebp, 0x18
xor ebx, ebx
push ebp
lea ecx, [edi + 0x18]
mov dword [esp + 0x20], ebx
call fcn.0042c1d0
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
or eax, 0xffffffff
mov dword [esi + 0x34], ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x30], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x38], edx
mov byte [esi + 0x3c], bl
mov byte [esi + 0x3d], bl
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi], 0x4547c0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x425640
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x42564e
inc eax
jmp 0x425650
xor eax, eax
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov al, cl
ret

Function at 0x425730
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x18]
sub eax, 0x182
je 0x42576b
sub eax, 0x64
je 0x425762
sub eax, 0x64
je 0x425759
xor eax, eax
add esp, 0x24
ret
mov eax, 0x100000
add esp, 0x24
ret
mov eax, 0x80000
add esp, 0x24
ret
mov eax, 0x40000
add esp, 0x24
ret
Function at 0x425890
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44f795
push eax
mov dword fs:[0], esp
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov esi, ecx
xor edi, edi
push 4
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov byte [esi + 0x18], 1
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [esi], 0x4549d8
call fcn.0044748b
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, edi
mov dword [esp + 0x14], edi
je 0x425901
push ebp
mov ecx, eax
call fcn.00424170
jmp 0x425903
xor eax, eax
cmp eax, edi
mov dword [esp + 0x14], 0xffffffff
mov dword [esi + 0x20], eax
je 0x425956
cmp dword [ebp], edi
je 0x425956
push 0x10
call fcn.0044748b
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, edi
mov dword [esp + 0x14], 1
je 0x42593a
mov ecx, eax
call fcn.0044b2b0
jmp 0x42593c
xor eax, eax
cmp eax, edi
mov dword [esp + 0x14], 0xffffffff
mov dword [esi + 4], eax
je 0x425956
mov ecx, dword [ebp]
push ecx
mov ecx, eax
call fcn.0044b367
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0xc
ret 4

Function at 0x42ddb0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x44fc08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push 0x80
lea ecx, [esp + 0x10]
call fcn.0042c180
xor ebx, ebx
push 0x20
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], ebx
call fcn.0042c5b0
cmp eax, ebx
je 0x42de30
mov ecx, dword [esi + 4]
cmp ecx, ebx
je 0x42ddfb
lea esi, [ecx + 1]
jmp 0x42ddfd
xor esi, esi
mov ecx, dword [esp + 0x34]
mov ecx, dword [ecx + 4]
cmp ecx, ebx
je 0x42de0d
lea edx, [ecx + 1]
jmp 0x42de0f
xor edx, edx
mov ecx, dword [esp + 0x30]
mov ecx, dword [ecx + 4]
cmp ecx, ebx
je 0x42de1d
inc ecx
jmp 0x42de1f
xor ecx, ecx
push esi
push 0x20
push eax
push 0x46aa1c
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0xc]
call fcn.0042c5e0
cmp dword [esp + 0x14], ebx
jle 0x42de59
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
push edx
call fcn.0042c440
test al, al
je 0x42de59
mov eax, dword [esp + 8]
mov bl, 1
jmp 0x42de5d
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x28], 0xffffffff
mov dword [ecx], eax
lea ecx, [esp + 0xc]
call fcn.0042c2b0
mov ecx, dword [esp + 0x20]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
Function at 0x42df00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44fc28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push 0x80
lea ecx, [esp + 0xc]
call fcn.0042c180
mov eax, dword [esp + 0x34]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x28], 0
call fcn.0042cb40
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 8]
push ecx
push edx
push eax
mov ecx, esi
call fcn.0042de90
lea ecx, [esp + 8]
mov bl, al
mov dword [esp + 0x24], 0xffffffff
call fcn.0042c2b0
mov ecx, dword [esp + 0x1c]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc

Function at 0x431fd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x45004b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [esi + 0x1c]
mov dword [esp + 8], esi
mov dword [esi], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 0xffffffff
call fcn.004347c0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov word [esi + 0x28], di
mov word [esi + 0x26], di
mov word [esi + 0x24], di
cmp ecx, edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x2c], edx
mov dword [esi + 0x30], ecx
mov word [esi + 0x34], di
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov word [esi + 0x48], di
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
je 0x43205d
call fcn.004324e0
movsx eax, ax
jmp 0x432065
mov eax, dword [edx + 0x1c]
mov ecx, dword [edx + 0x14]
sub eax, ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x3c], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc

Function at 0x434970
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
call sub.KERNEL32.dll_GetTickCount
cmp eax, dword [esi + 4]
jge 0x4349a1
push edi
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 0
push 0
push 0
lea eax, [esp + 0x14]
push 0
push eax
call edi
call sub.KERNEL32.dll_GetTickCount
cmp eax, dword [esi + 4]
jl 0x434987
pop edi
pop esi
add esp, 0x1c
ret