joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cae5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40cb24
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40cb24
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40cb24
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40cb24
cmp dword [ecx + 0x74], 0xe
jbe 0x40cb24
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x417b8d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x424520
push 0x424518
push str.FlsAlloc
push 0x1f
call fcn.00417a4c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417bc1
push dword [ebp + 8]
mov ecx, esi
call dword [0x422220]
call esi
jmp 0x417bc7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x417c0b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x424530
push 0x424528
push str.FlsGetValue
push 0x21
call fcn.00417a4c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417c42
push dword [ebp + 8]
mov ecx, esi
call dword [0x422220]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x417c4a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x424538
push 0x424530
push str.FlsSetValue
push 0x22
call fcn.00417a4c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x417c84
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x422220]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x419481
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41951e
push ebx
push esi
call fcn.0041944a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004193de
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4194cb
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41951d
push edi
push eax
call fcn.00415005
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4194eb
call fcn.00414fcb
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41951c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004193de
add esp, 0x20
test eax, eax
jne 0x41950a
push edi
call fcn.00414fcb
jmp 0x419512
push ebx
call fcn.00414fcb
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x419521
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x419532
pop esi
ret
push ebx
push edi
push esi
call fcn.0041944a
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00415005
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x41955a
push ebx
push esi
push edi
call fcn.0040eed0
add esp, 0xc
push 0
call fcn.00414fcb
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x41992a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041956f
Function at 0x421300
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42132d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42132d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40596d
pop dword [ebp - 0x18]
mov eax, 0x8ff932c2
sub eax, 0x8fb8d955
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x923a6ed8
sub dword [ebp - 0x28], 0x43e8298d
mov dword [ebp - 0x24], 0x58d460bd
add dword [ebp - 0x24], 0xd95eeb88
mov dword [ebp - 0x20], 0x7e703f03
sub dword [ebp - 0x20], 0x3223fad5
mov dword [ebp - 0x1c], 0xce1f1b86
add dword [ebp - 0x1c], 0x31e0e47a
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x2c3b18e
sub dword [ebp - 0x28], 0x8e514838
mov dword [ebp - 0x24], 0xf7ff766f
add dword [ebp - 0x24], 0x496ceb06
mov dword [ebp - 0x20], 0x1945cf
add dword [ebp - 0x20], 0x6356269d
mov dword [ebp - 0x1c], 0x13845dd6
sub dword [ebp - 0x1c], 0x13845dd6
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xa3fc2a42
add eax, 0x5c4446be
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3c81f
push 0
call eax
mov ecx, 0x39db147a
add ecx, 0xc6254ab0
xor edi, edi
add edi, eax
mov ebx, 0xbd1bf7f9
add ebx, 0x43250807
add ebx, dword [ebp - 0x18]
mov edx, 0x6e7f85a
sub edx, 0x554e12d8
sub dword [ebp - 0x10], ebx
mov esi, dword [ebx]
xor dword [ebp - 0xc], 0x83423e88
xor esi, edx
sub dword [ebp - 8], ecx
mov dword [edi], esi
xor dword [ebp - 0x14], 0xd7647b0e
add edi, 0x22fc6dc4
sub edi, 0x22fc6dc0
add ebx, 4
loop 0x405a8c
add eax, 0x16f7b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xcc490911
sub ecx, 0xcc090911
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x4461b8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
xor eax, eax
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
push dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push str._ls.R
push edi
call main
mov esi, eax
add esp, 0xc
test esi, esi
js 0x4462c4
push 0
push 0x80
push 4
push 0
push 4
push 0xc0000000
push dword [edi]
call dword [sym.imp.kernel32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x446242
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x446226
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x44622d
mov esi, 0x80004005
push esi
push 0xc1
push str.c:_agent_work138_s_srclibsdutildlutil.cpp
call fcn.004038f5
jmp 0x4462c4
mov ecx, dword [ebp - 4]
push 0
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, ecx
push eax
lea eax, [ecx + ebx]
push eax
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x44628a
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
cmp dword [ebp - 8], 0
mov dword [ebp - 4], ecx
je 0x446274
cmp ecx, 8
jb 0x446245
cmp ecx, 8
je 0x446280
and dword [ebx], 0
and dword [ebx + 4], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
or edi, 0xffffffff
jmp 0x4462b8
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4462a1
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4462a8
mov esi, 0x80004005
push esi
push 0xc8
push str.c:_agent_work138_s_srclibsdutildlutil.cpp
call fcn.004038f5
cmp edi, 0xffffffff
je 0x4462c4
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4468bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x4468ca
pop dword [ebp - 4]
mov eax, 0xa9fe476a
sub eax, 0xa9b9dea0
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x50e54
push 0
mov eax, 0x46ddb103
sub eax, 0x4698fe53
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x4b2d
mov edi, eax
mov ebx, 0x6994e723
add ebx, 0x96b3a6dd
add ebx, dword [ebp - 4]
mov edx, 0x6956c913
mov esi, dword [ebx]
xor esi, edx
mov dword [edi], esi
add edi, 0xaa08a76a
sub edi, 0xaa08a766
add ebx, 4
loop 0x44691d
add eax, 0x11f87
xor ebx, ebx
add ebx, eax
add eax, 0xbf293a26
add eax, 0x40d6c5df
mov ecx, 0x400000
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x493330
Capabilities:
Authenticate hmac

Disassembly:
pushal
mov esi, ebx
add dl, 0x5b
push 0x4c555
dec eax
xor cl, bl
adc eax, 0xc613df28
inc al
mov cl, 0xa6
inc ebp
mov cl, bh
mov ah, bh
mov dh, dh
call 0x493355
mov al, 1
or al, 0x5c
imul ebx, ecx
js 0x493366
test esi, 0x37986b9e
sbb edx, ebp
mov esi, 0x6703cb20
mov ecx, esi
xchg ch, ah
sbb al, 0x90
mov dl, bh
inc ecx
mov ah, 0x76
mov edi, 0xfffce3f2
and dl, ah
xor edi, 0xa95c
adc ah, dh
mov eax, ebx
xor edi, 0x7a7c7
lea ecx, [0x41507556]
push edi
jmp 0x4933a3
pop ebx
ja 0x4933ae
test esi, 0x727cad37
mov ch, bh
xor ebx, 0x720
dec ecx
lea edx, [0xfa279f46]
sub ebp, ebx
or al, 0x36
mov esi, edi
sub ebp, 0x4e1ba
pop esi
mov ah, 0x4e
mov ah, al
test dh, dl
push 0x2c5485
push 0xfdb706
cmp esi, 0x7542
jne 0x4933e9
xchg ebx, ebp
test ecx, ebp
imul edx, eax
mov al, dh
cmp edx, 0xad94
jbe 0x4933f8
test esi, ebp
mov ecx, edi
lea ecx, [0xffd26efb]
lea ecx, [0xffd26efb]
mov cl, al
add ebx, 0x9927
inc cl
xchg edx, ebp
sub ebx, 0x314c
ja 0x493414
or bh, cl
and dh, bl
and al, 0x83
mov ah, dl
mov edx, esi
test cl, 0x7d
mov al, 0x2f
or al, 0xf6
adc edx, edi
lea eax, [0x2adbefed]
jmp 0x493432
or ecx, eax
add esi, 0x778ed
sub cl, cl
sub esi, 0x74b6a
cmp edi, 0x478a
jo 0x493455
adc dl, 0x14
lea ebx, [0x62ee6107]
xor ah, al
cmp ebp, esi
jno 0x493461
or eax, 0xc8ebf3aa
movsx edx, dh
add cl, ch
mov al, 0xa1
test ch, 0xfb
jmp 0x493478
cmp ebp, 0x1bd8
jno 0x49348f
imul eax, edx, 0x186ad5f8
imul edi, eax, 0xe2bd8e0e
movzx eax, bh
mov ecx, 0
jmp 0x4934a2
add ecx, eax
adc dh, bh
xchg edx, ebx
xor ebp, ecx
mov ebx, esi
imul edi, edi, 0x772c94b5
xor al, 0xe1
test eax, ecx
test bh, dh
inc ecx
and eax, 0
mov dl, 0x61
test ebp, 0xea13ac10
mov cl, 0x46
inc cl
mov bh, 0x47
add eax, 0x8df
mov edx, ecx
xchg ebx, ebx
mov ebx, 0x4c19354f
sub eax, 0x8de
mov bl, 0xca
xchg edx, ebx
test ebp, eax
mov bh, bl
imul ebp, ebp, 0x8d4942a0
cmp eax, 0xc5
jb 0x4934be
cmp edi, 0xfc5feb3a
push 0xa1ed2d
jmp 0x49350d
push esi
je 0x49351a
imul eax, ebp, 0x770e3a85
mov ch, bh
inc bh
ret
Function at 0x424a1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
movzx eax, byte [eax + 0x14]
mov byte [edx + 0x14], al
mov eax, dword [ebp - 4]
add eax, 0x15
mov edx, dword [ebp + 8]
add edx, 0x15
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x10], ecx
mov ecx, dword [edx + 0x14]
mov dword [eax + 0x14], ecx
mov ecx, dword [edx + 0x18]
mov dword [eax + 0x18], ecx
mov ecx, dword [edx + 0x1c]
mov dword [eax + 0x1c], ecx
mov ecx, dword [edx + 0x20]
mov dword [eax + 0x20], ecx
mov ecx, dword [edx + 0x24]
mov dword [eax + 0x24], ecx
mov ecx, dword [edx + 0x28]
mov dword [eax + 0x28], ecx
mov ecx, dword [edx + 0x2c]
mov dword [eax + 0x2c], ecx
mov ecx, dword [edx + 0x30]
mov dword [eax + 0x30], ecx
mov ecx, dword [edx + 0x34]
mov dword [eax + 0x34], ecx
mov ecx, dword [edx + 0x38]
mov dword [eax + 0x38], ecx
mov ecx, dword [edx + 0x3c]
mov dword [eax + 0x3c], ecx
mov ecx, dword [edx + 0x40]
mov dword [eax + 0x40], ecx
mov ecx, dword [edx + 0x44]
mov dword [eax + 0x44], ecx
mov ecx, dword [edx + 0x48]
mov dword [eax + 0x48], ecx
mov ecx, dword [edx + 0x4c]
mov dword [eax + 0x4c], ecx
mov ecx, dword [edx + 0x50]
mov dword [eax + 0x50], ecx
mov ecx, dword [edx + 0x54]
mov dword [eax + 0x54], ecx
mov ecx, dword [edx + 0x58]
mov dword [eax + 0x58], ecx
mov ecx, dword [edx + 0x5c]
mov dword [eax + 0x5c], ecx
mov ecx, dword [edx + 0x60]
mov dword [eax + 0x60], ecx
mov ecx, dword [edx + 0x64]
mov dword [eax + 0x64], ecx
mov ecx, dword [edx + 0x68]
mov dword [eax + 0x68], ecx
mov ecx, dword [edx + 0x6c]
mov dword [eax + 0x6c], ecx
mov ecx, dword [edx + 0x70]
mov dword [eax + 0x70], ecx
mov ecx, dword [edx + 0x74]
mov dword [eax + 0x74], ecx
mov ecx, dword [edx + 0x78]
mov dword [eax + 0x78], ecx
mov edx, dword [edx + 0x7c]
mov dword [eax + 0x7c], edx
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x4421b0
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa24
xor eax, eax
mov dword [ebp - 0xa24], eax
mov dword [ebp - 0xa20], eax
mov dword [ebp - 0xa1c], eax
mov dword [ebp - 0xa18], 0x400
mov eax, dword [0x4615f0]
mov dword [ebp - 0xa14], eax
mov eax, dword [ebp - 0xa14]
mov eax, dword [eax + 0x9c]
cmp eax, 2
jne 0x4422e2
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xa24], eax
mov eax, dword [ebp - 0xa14]
mov eax, dword [eax + 0x98]
neg eax
add eax, dword [ebp - 0xa24]
cmp eax, 0xea60
jbe 0x4423cd
add esp, 0xffffffec
lea eax, [ebp - 0xa1c]
mov dword [esp], eax
mov dword [esp + 4], 3
lea eax, [ebp - 0xa10]
mov dword [esp + 8], eax
lea eax, [ebp - 0xa18]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.oraocr10.dll_procr_init_ext
add esp, 0x14
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xa20], eax
mov eax, dword [ebp - 0xa20]
test eax, eax
je 0x442295
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount]
call eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xa14]
mov edx, dword [ebp - 8]
mov dword [eax + 0x98], edx
jmp 0x4423cd
mov eax, dword [ebp - 0xa14]
mov dword [eax + 0x98], 0
mov eax, dword [ebp - 0xa14]
mov dword [eax + 0x9c], 3
push edi
mov eax, dword [ebp - 0xa14]
mov eax, dword [eax + 0x94]
mov dword [esp], eax
call sub.oraocr10.dll_procr_terminate
pop ecx
mov eax, dword [ebp - 0xa14]
mov edx, dword [ebp - 0xa1c]
mov dword [eax + 0x94], edx
jmp 0x4423cd
mov eax, dword [ebp - 0xa14]
mov eax, dword [eax + 0x9c]
cmp eax, 3
jne 0x4423cd
add esp, 0xffffffec
lea eax, [ebp - 0xa1c]
mov dword [esp], eax
mov dword [esp + 4], 2
lea eax, [ebp - 0xa10]
mov dword [esp + 8], eax
lea eax, [ebp - 0xa18]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call sub.oraocr10.dll_procr_init_ext
add esp, 0x14
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xa20], eax
mov eax, dword [ebp - 0xa20]
test eax, eax
je 0x4423a5
add esp, 0xfffffff0
lea eax, [ebp - 0x610]
mov dword [esp], eax
mov dword [esp + 4], str.clsgenv_switch_ocr_mode:_procr_init_failed_rc___d_err_s_aborting
mov eax, dword [ebp - 0xa20]
mov dword [esp + 8], eax
lea eax, [ebp - 0xa10]
mov dword [esp + 0xc], eax
call sub.oracore10.dll_lstprintf
add esp, 0x10
mov eax, dword [sym.imp.MSVCR71.dll_printf]
add esp, 0xfffffff8
mov dword [esp], 0x457360
lea edx, [ebp - 0x610]
mov dword [esp + 4], edx
call eax
add esp, 8
mov eax, dword [sym.imp.MSVCR71.dll_exit]
push edi
mov dword [esp], 1
call eax
pop ecx
jmp 0x4423cd
push edi
mov eax, dword [ebp - 0xa14]
mov eax, dword [eax + 0x94]
mov dword [esp], eax
call sub.oraocr10.dll_procr_terminate
pop ecx
mov eax, dword [ebp - 0xa14]
mov edx, dword [ebp - 0xa1c]
mov dword [eax + 0x94], edx
mov eax, dword [ebp - 0xa14]
mov eax, dword [eax + 0x9c]
leave
ret
Function at 0x445cc8
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.004479e4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x445cea
mov eax, 0x12
leave
ret
mov eax, dword [sym.imp.MSVCR71.dll__strdup]
push edi
mov edx, dword [ebp - 0x14]
mov dword [esp], edx
call eax
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov eax, dword [sym.imp.WS2_32.dll_gethostbyname]
push edi
mov edx, dword [ebp - 0x14]
mov dword [esp], edx
call eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x445d37
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [edx], eax
xor eax, eax
leave
ret
mov eax, 0x12
leave
ret
Function at 0x445d40
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
xor eax, eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
add esp, 0xfffffff0
mov eax, dword [ebp + 8]
mov dword [esp], eax
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x100
mov dword [esp + 0xc], 0x40
call sub.orahasgen10.dll_clscgetaddr
add esp, 0x10
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x445f05
mov eax, dword [sym.imp.MSVCR71.dll_strstr]
add esp, 0xfffffff8
lea edx, [ebp - 0x128]
mov dword [esp], edx
mov dword [esp + 4], str.HOST
call eax
add esp, 8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x445efe
mov eax, dword [sym.imp.MSVCR71.dll_strstr]
add esp, 0xfffffff8
mov edx, dword [ebp - 0x12c]
mov dword [esp], edx
mov dword [esp + 4], 0x457700
call eax
add esp, 8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x445ef7
inc dword [ebp - 0x130]
mov eax, dword [sym.imp.MSVCR71.dll_strtok]
add esp, 0xfffffff8
mov edx, dword [ebp - 0x130]
mov dword [esp], edx
mov dword [esp + 4], 0x4535d8
call eax
add esp, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x445ef0
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
push edi
mov edx, dword [ebp - 0x12c]
mov dword [esp], edx
call eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
jne 0x445eb4
mov eax, dword [sym.imp.WS2_32.dll_gethostbyname]
push edi
mov edx, dword [ebp - 0x12c]
mov dword [esp], edx
call eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x445ead
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [edx], eax
mov eax, dword [sym.imp.MSVCR71.dll__strdup]
push edi
mov edx, dword [ebp - 0x12c]
mov dword [esp], edx
call eax
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
leave
ret
mov eax, 0x12
leave
ret
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
push edi
mov edx, dword [ebp - 0x12c]
mov dword [esp], edx
call eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov dword [eax], edx
push edi
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [esp], eax
call fcn.00445f0c
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [eax], edx
xor eax, eax
leave
ret
mov eax, 0x12
leave
ret
mov eax, 0x12
leave
ret
mov eax, 0x12
leave
ret
mov eax, 0x14
leave
ret
Function at 0x447164
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], str.Memory_allocation_failure
call fcn.0044ac64
add esp, 0x10
mov eax, dword [sym.imp.MSVCR71.dll_exit]
push edi
mov dword [esp], 0xe
call eax
pop ecx
leave
ret

Function at 0x447308
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [sym.imp.MSVCR71.dll__setmode]
add esp, 0xfffffff8
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov dword [esp + 4], 0x8000
call eax
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [sym.imp.MSVCR71.dll__read]
add esp, 0xfffffff4
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
call eax
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [sym.imp.MSVCR71.dll__setmode]
add esp, 0xfffffff8
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
call eax
add esp, 8
mov eax, dword [ebp - 0xc]
leave
ret