joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4349a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0
push eax
mov ebx, ecx
mov dword [ebp - 8], 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
mov dword [ebx], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x434b3c
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x434b3c
xor edi, edi
cmp dword [ebp - 0x10], edi
jbe 0x434b3c
nop
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0xff
push eax
lea eax, [ebp - 0x220]
push eax
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x434b2a
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x434b3c
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push str.Enabled
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x434b1e
cmp byte [ebp - 0x220], al
je 0x434b1e
cmp dword [ebp - 0x14], eax
je 0x434b1e
lea edx, [ebp - 0x220]
mov byte [ebp - 0x120], al
lea ecx, [ebp - 0x120]
call fcn.00401c90
test eax, eax
je 0x434b1e
cmp byte [ebp - 0x120], 0
je 0x434b1e
push 0x108
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x434b36
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x120]
call fcn.00401ae0
movzx eax, ax
mov ecx, pe_nt_image_headers32
cmp ax, cx
ja 0x434b0e
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [esi + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x434b12
mov byte [esi + 8], 0
mov eax, dword [ebx]
mov dword [esi], eax
mov dword [ebx], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call esi
mov dword [ebp - 4], 0
inc edi
cmp edi, dword [ebp - 0x10]
jb 0x434a20
jmp 0x434b3c
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
test eax, eax
je 0x434b46
push eax
call esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x434b50
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4352b0
Capabilities:
Create udp socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
push edi
mov edi, edx
cmp esi, 1
push 0x11
sete al
mov dword [ebp - 4], edi
mov dword [ebp + 0x14], eax
movzx eax, word [edi]
push 2
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x43536c
test esi, esi
je 0x435365
push dword [ebp + 8]
dec esi
push edi
push 0
push 0x66
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.WS2_32.dll_sendto]
mov edi, eax
cmp edi, 0x66
je 0x435318
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.SendWakeupPacket_error:_sent__d_bytes:__d_n
push 0
call fcn.0041dc40
add esp, 0x10
cmp dword [ebp + 0x14], 0
je 0x435350
push dword [ebp + 8]
push dword [ebp - 4]
push 0
push 0x66
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.WS2_32.dll_sendto]
mov edi, eax
cmp edi, 0x66
je 0x435350
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.SendWakeupPacket_error:_sent__d_bytes:__d_n
push 0
call fcn.0041dc40
add esp, 0x10
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x43535e
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 4]
test esi, esi
jne 0x4352e7
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4353c0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov eax, ecx
mov dword [ebp - 4], 0
xor edi, edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov dword [eax], edi
lea eax, [ebp - 4]
push eax
push 0x44b978
push 1
push edi
push 0x44b958
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x43544c
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x43544f
mov eax, dword [ecx]
lea edx, [ebp - 8]
push edx
push ecx
call dword [eax + 0x1c]
mov esi, eax
test esi, esi
js 0x43544c
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x43545c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0xc]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x1c]
mov esi, eax
test esi, esi
je 0x435444
push 0x3e8
call ebx
mov eax, edi
inc edi
cmp eax, 0x1e
jge 0x435444
mov ecx, dword [ebp - 8]
jmp 0x435421
xor eax, eax
test esi, esi
pop ebx
cmovns esi, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
test edx, edx
je 0x43545f
mov eax, dword [edx]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x435469
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x436140
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x436181
call edi
test eax, eax
je 0x43624a
call edi
test eax, eax
jne 0x436279
push ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x4361ab
call edi
test eax, eax
je 0x436256
call edi
test eax, eax
jne 0x436278
push esi
push 0
push 0
push str.Tcpip
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push 1
push 2
push 0x20
push 0xf01ff
push str.niZeroconfService
push str.niZeroconfService
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
mov dword [ebp + 0xc], esi
test esi, esi
jne 0x4361f6
call edi
test eax, eax
je 0x436263
call edi
mov esi, eax
test esi, esi
jne 0x436268
mov esi, dword [ebp + 0xc]
call fcn.00436390
mov eax, dword [ebp + 8]
test eax, eax
je 0x43620a
push eax
mov ecx, ebx
call fcn.00436730
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x436227
call edi
test eax, eax
je 0x436280
call edi
mov esi, eax
test esi, esi
jne 0x436238
push str.installed_service_n
push 0
call fcn.00436880
add esp, 8
xor esi, esi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x436268
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call edi
jmp 0x43626e
mov eax, 0xffffe5d0
pop edi
mov esp, ebp
pop ebp
ret 8
pop ebx
mov eax, 0xffffe59d
pop edi
mov esp, ebp
pop ebp
ret 8
mov esi, 0xffffe5b6
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x436275
push ebx
call edi
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 8
mov esi, 0xffffe5bf
jmp 0x436238
Function at 0x436290
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x4362ca
call edi
test eax, eax
je 0x436359
call edi
test eax, eax
jne 0x43637c
push esi
push 0x10024
push str.niZeroconfService
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x4362f0
call edi
test eax, eax
je 0x436364
call edi
mov esi, eax
test esi, esi
jne 0x436369
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x43630d
call edi
test eax, eax
je 0x436382
call edi
mov esi, eax
test esi, esi
jne 0x43634a
cmp dword [ebp - 0x1c], 1
je 0x436320
lea eax, [ebp - 0x20]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x436339
call edi
test eax, eax
je 0x436389
call edi
mov esi, eax
test esi, esi
jne 0x43634a
push str.Removed_service_n
push 0
call fcn.00436880
add esp, 8
xor esi, esi
test ebx, ebx
je 0x436369
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
call edi
jmp 0x43636f
pop edi
mov eax, 0xffffe59d
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 0xffffe5b9
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
test eax, eax
je 0x436379
push eax
call edi
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 0xffffe59e
jmp 0x43634a
mov esi, 0xffffe5ba
jmp 0x43634a

Function at 0x436390
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
push str.SOFTWARENational_InstrumentsNI_Zeroconf
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
test esi, esi
jne 0x436401
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.ManageLLRouting
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x436401
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 4
push 0
push str.ManageLLRouting
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x43640f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x436420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push str.SOFTWARENational_InstrumentsNI_Zeroconf
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
test esi, esi
jne 0x43649b
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.ManageLLRouting
push dword [ebp - 4]
call esi
test eax, eax
jne 0x43647a
cmp dword [ebp - 0xc], eax
setne byte [0x44f029]
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.CacheEntryCount
push dword [ebp - 4]
call esi
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4364a9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x436730
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x43676d
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
jne 0x43676d
call edi
test eax, eax
je 0x436858
call edi
test eax, eax
jne 0x436850
push esi
call dword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov dword [ebp - 8], eax
test eax, eax
jne 0x43678f
call edi
test eax, eax
je 0x436865
call edi
test eax, eax
jne 0x436850
push ebx
push 0x12
push str.niZeroconfService
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
test ebx, ebx
jne 0x4367ba
call edi
test eax, eax
je 0x436872
call edi
mov esi, eax
test esi, esi
jne 0x43683f
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x4367e3
call edi
test eax, eax
je 0x436879
call edi
mov esi, eax
test esi, esi
jne 0x436834
lea eax, [ebp - 0x10]
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
push 2
push ebx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 0x1f4
mov dword [ebp - 0x10], 1
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x436832
call edi
test eax, eax
je 0x436879
call edi
mov esi, eax
test esi, esi
jne 0x436834
xor esi, esi
test ebx, ebx
je 0x43683f
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
pop ebx
test eax, eax
je 0x43684e
push eax
call dword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, 0xffffe59d
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
mov eax, 0xffffe5bf
pop esi
mov esp, ebp
pop ebp
ret 4
mov esi, 0xffffe5b9
jmp 0x43683f
mov esi, 0xffffe5cf
jmp 0x436834

Function at 0x436880
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
cmp dword [0x44f518], 0
push esi
jne 0x436920
cmp dword [0x44f4ec], 0
je 0x4368f7
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [esp + 0x14]
push 0xffffffffffffffff
push eax
call fcn.00428a60
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf]
add esp, 0x1c
lea eax, [esp + 8]
mov dword [esp + 4], eax
lea eax, [esp + 4]
push 0
push eax
push 0
push 1
push 0
push 0x64
push 0
push dword [ebp + 8]
push dword [0x44f4ec]
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
pop esi
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
lea ecx, [ebp + 0x10]
push ecx
push 0
push esi
push eax
call fcn.00428a60
push dword [eax + 4]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfprintf]
add esp, 0x18
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x436b90
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push str.SYSTEMCurrentControlSetServicesEventLogApplication_niZeroconfService
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
test esi, esi
jne 0x436c68
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x436be2
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x210]
push eax
push 2
push 0
push str.EventMessageFile
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x436c68
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x1f
push eax
push 4
push esi
push str.TypesSupported
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x436c68
push str.niZeroconfService
push eax
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [0x44f4ec], eax
test eax, eax
jne 0x436c68
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x436c63
call esi
mov esi, eax
jmp 0x436c68
mov esi, 0xffffe5cf
mov eax, dword [ebp - 4]
test eax, eax
je 0x436c76
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x437d60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x44f4e4], 0
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], 0
jne 0x437d82
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x44f4fc], 0
je 0x437d7a
lea eax, [ebp - 4]
push eax
push str.SOFTWARENational_InstrumentsNI_ZeroconfPower_Management
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x437daa
xor bl, bl
jmp 0x437ea6
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x44b6d4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x437dd6
xor bl, bl
jmp 0x437ea6
cmp dword [ebp - 0xc], 0
jne 0x437de3
xor bl, bl
jmp 0x437ea6
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
test al, al
jne 0x437df8
xor bl, bl
jmp 0x437ea6
cmp byte [ebp - 0x20], 1
je 0x437e05
xor bl, bl
jmp 0x437ea6
mov ecx, 0x46dca0
call fcn.004351b0
test al, al
jne 0x437e1a
xor bl, bl
jmp 0x437ea6
mov ecx, 0x46dca0
call fcn.00412d90
test al, al
jne 0x437e2c
xor bl, bl
jmp 0x437ea6
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, edx
mov dword [ebp - 0x10], eax
mov esi, eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [0x46dca0]
add esp, 4
add esi, 0x1c20
adc edx, 0
mov eax, dword [ecx + 0x14]
cmp eax, edx
jg 0x437e63
jl 0x437e5e
cmp dword [ecx + 0x10], esi
jae 0x437e63
mov esi, dword [ecx + 0x10]
mov edx, eax
sub esi, dword [ebp - 0x10]
mov ecx, esi
sbb edx, dword [ebp - 0x14]
call fcn.0043b140
mulsd xmm0, qword [0x44c588]
cvttsd2si esi, xmm0
push esi
push str.enabling_sleep_proxy_client_with_next_maintenance_wake_in__d_seconds
push 4
call fcn.00436880
add esp, 0xc
neg esi
mov eax, esi
cdq
push 0
push 0x989680
push edx
push eax
call fcn.0043ad80
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov bl, 1
mov eax, dword [ebp - 4]
test eax, eax
je 0x437eb4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437ec0
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0
lea eax, [ebp - 4]
mov dword [ebp - 8], ecx
push eax
push 0
mov edi, edx
mov dword [ebp - 4], 0
xor bl, bl
call dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
cmp eax, 0x7a
jne 0x437f76
push esi
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x437f6b
push 0
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
test eax, eax
jne 0x437f61
mov edx, dword [esi]
xor ecx, ecx
test edx, edx
je 0x437f61
lea eax, [esi + 4]
nop dword [eax]
cmp dword [eax], edi
je 0x437f2e
inc ecx
add eax, 0x38
cmp ecx, edx
jb 0x437f20
jmp 0x437f61
lea eax, [ecx*8]
mov bl, 1
sub eax, ecx
mov ecx, dword [ebp - 8]
movups xmm0, xmmword [esi + eax*8 + 4]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [esi + eax*8 + 0x14]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [esi + eax*8 + 0x24]
movups xmmword [ecx + 0x20], xmm0
movq xmm0, qword [esi + eax*8 + 0x34]
movq qword [ecx + 0x30], xmm0
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x438170
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push str.169.254.0.0
mov dword [ebp - 0xc], edx
mov edi, ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
push edi
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetBestInterface]
test eax, eax
je 0x43819a
mov dword [edi], 0
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [ebp - 8]
push eax
push 0
call esi
cmp eax, 0x6f
je 0x4381b8
pop edi
mov eax, 0xffffe5d4
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4381d7
pop ebx
pop edi
mov eax, 0xffffe5b8
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push ebx
call esi
mov dword [ebp - 4], eax
test eax, eax
jne 0x438306
mov esi, ebx
mov dword [ebp - 4], 0xffffe5d4
cmp dword [esi + 0x1a0], 6
jne 0x43823a
cmp dword [esi + 0x190], 6
jne 0x43823a
cmp byte [esi + 0x194], 0x44
jne 0x43823a
cmp byte [esi + 0x195], 0x45
jne 0x43823a
cmp byte [esi + 0x196], 0x53
jne 0x43823a
cmp byte [esi + 0x197], 0x54
jne 0x43823a
cmp byte [esi + 0x198], 0x42
jne 0x43823a
cmp byte [esi + 0x199], 0
je 0x438255
push ecx
lea ecx, [esi + 0x10c]
call fcn.00438380
test eax, eax
jne 0x438255
mov ecx, esi
call fcn.00438320
test al, al
je 0x43826a
lea eax, [esi + 0x1b0]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
test eax, eax
jne 0x438306
mov esi, dword [esi]
test esi, esi
jne 0x4381f2
mov dword [ebp - 4], 0xffffe5d4
nop word [eax + eax]
mov esi, ebx
cmp dword [esi + 0x1a0], 6
jne 0x4382d7
lea eax, [esi + 0x1b0]
test eax, eax
je 0x4382d7
mov ecx, str.0.0.0.0
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4382c0
test dl, dl
je 0x4382bc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4382c0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4382a0
xor eax, eax
jmp 0x4382c5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4382d7
mov eax, dword [edi]
test eax, eax
je 0x4382e5
cmp dword [esi + 0x19c], eax
je 0x4382e5
mov esi, dword [esi]
test esi, esi
jne 0x438282
cmp dword [edi], esi
je 0x438306
mov dword [edi], esi
jmp 0x438280
lea eax, [esi + 0x1b0]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], 0
mov dword [ecx], eax
mov eax, dword [esi + 0x19c]
mov dword [edi], eax
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 4]
add esp, 4
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x438780
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
mov ecx, dword [0x44f55c]
test ecx, ecx
je 0x43879b
mov eax, dword [0x44f560]
mov dword [eax + ecx], edi
jmp 0x4387a1
mov dword [0x44f558], edi
mov eax, dword [0x44f560]
mov dword [eax + edi], 0
inc dword [0x44f564]
cmp dword [0x44f57c], 0x40
mov dword [0x44f55c], edi
jae 0x4387f3
mov dword [edi + 0x10], 0x44f568
mov ecx, dword [0x44f57c]
mov dword [ecx*4 + 0x44f580], edi
mov ecx, dword [0x44f57c]
mov edx, dword [edi + 4]
pop edi
mov dword [ecx*4 + 0x44f680], edx
inc dword [0x44f57c]
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edx, dword [0x44f788]
test edx, edx
je 0x438810
nop dword [eax]
cmp dword [edx + 0x14], 0x40
jb 0x438830
mov edx, dword [edx + 0x21c]
test edx, edx
jne 0x438800
push esi
push 0x220
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x438851
pop esi
mov eax, 0xfffefffd
pop edi
mov esp, ebp
pop ebp
ret
mov dword [edi + 0x10], edx
mov eax, dword [edx + 0x14]
mov dword [edx + eax*4 + 0x18], edi
mov ecx, dword [edx + 0x14]
mov eax, dword [edi + 4]
pop edi
mov dword [edx + ecx*4 + 0x118], eax
inc dword [edx + 0x14]
xor eax, eax
mov esp, ebp
pop ebp
ret
push 0x220
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 8], eax
test eax, eax
jne 0x438880
mov edi, 0xfffefffd
jmp 0x43893a
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x43889f
mov edi, 0xfffefffd
jmp 0x43893a
mov ecx, esi
call fcn.00438f60
test eax, eax
jne 0x438938
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x438fd0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4388d6
mov dword [ebp - 4], 0
jmp 0x4388ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x438931
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
test eax, eax
jne 0x438938
mov edx, esi
mov ecx, 0x44f788
call fcn.00408200
mov eax, dword [0x44f894]
mov ecx, dword [esi + 0xc]
mov dword [eax*4 + 0x44f794], ecx
inc dword [0x44f894]
mov dword [edi + 0x10], esi
mov eax, dword [esi + 0x14]
mov dword [esi + eax*4 + 0x18], edi
mov ecx, dword [esi + 0x14]
mov eax, dword [edi + 4]
mov dword [esi + ecx*4 + 0x118], eax
inc dword [esi + 0x14]
mov eax, dword [ebp - 4]
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov edi, 0xffffe5d4
jmp 0x43893a
mov edi, eax
mov eax, dword [esi + 8]
mov ecx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x438957
push eax
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x438968
push eax
call ecx
mov dword [esi + 0xc], 0
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov eax, edi
pop esi
pop edi
mov esp, ebp
pop ebp
ret