joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434d30
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484706
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4a5294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00451930
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [0x48d5e4]
push edx
push 0x100
lea eax, [ebp - 0x21c]
push eax
call fcn.004567b2
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.00475ed0
push eax
call fcn.00475ee0
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x434dd4
jmp 0x434f44
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x224]
call fcn.00437b20
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x20
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
push edx
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1b0
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x190
push ecx
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x340
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x320
push eax
call fcn.004567b2
add esp, 0x10
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x4d0]
mov dword [ecx + 0x4b0], eax
mov edx, dword [edx + 0x4d4]
mov dword [ecx + 0x4b4], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x4d8]
mov dword [eax + 0x4b8], edx
mov ecx, dword [ecx + 0x4dc]
mov dword [eax + 0x4bc], ecx
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x4e0
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x4c0
push eax
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x670
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x650
push edx
call fcn.004567b2
add esp, 0x10
lea eax, [ebp - 0x228]
call fcn.00401b91
mov byte [ebp - 4], 1
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp + 8]
call fcn.00434f70
lea eax, [ebp - 0x228]
call fcn.004256a6
push eax
lea eax, [ebp - 0x228]
call fcn.00426ab2
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x7e0
push ecx
call fcn.004567b2
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x228]
call fcn.00401bb4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.00437b50
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00451a25
mov esp, ebp
pop ebp
ret 8
Function at 0x435320
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48462b
mov eax, dword fs:[0]
push eax
sub esp, 0x3cc
mov eax, dword [0x4a5294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00451930
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [0x48d42c]
push edx
push 0x100
lea eax, [ebp - 0x21c]
push eax
call fcn.004567b2
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
call fcn.00437bf0
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.00475ed0
push eax
call fcn.00475ee0
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x4353cc
jmp 0x4354e0
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x224]
call fcn.00437b20
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
call fcn.00430e90
lea ecx, [ebp - 0x3c8]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00437df0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], eax
jmp 0x435429
push 0
lea ecx, [ebp - 0x3d0]
push ecx
lea ecx, [ebp - 0x22c]
call fcn.00437cc0
lea edx, [ebp - 0x3d8]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00430e00
push eax
lea ecx, [ebp - 0x22c]
call fcn.00437ba0
movzx eax, al
test eax, eax
je 0x4354bc
lea ecx, [ebp - 0x22c]
call fcn.00437dd0
mov ecx, dword [eax]
mov dword [ebp - 0x3c0], ecx
mov word [ebp - 0x3bc], 0
push 0x18e
push 0
lea edx, [ebp - 0x3ba]
push edx
call fcn.00451930
add esp, 0xc
cmp dword [ebp - 0x3c0], 0
jne 0x43548b
jmp 0x435415
push 0xffffffffffffffff
mov eax, dword [ebp - 0x3c0]
push eax
push 0xc8
lea ecx, [ebp - 0x3bc]
push ecx
call fcn.004567b2
add esp, 0x10
lea edx, [ebp - 0x3bc]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00437b70
jmp 0x435415
mov ecx, dword [ebp + 8]
call fcn.00435510
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.00437b50
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00451a25
mov esp, ebp
pop ebp
ret 8
Function at 0x435ae0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4a5294]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 0x80004005
mov word [ebp - 0x210], 0
push 0x1fe
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00451930
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
push 0xffffffffffffffff
mov edx, dword [0x48d474]
push edx
push 0x100
lea eax, [ebp - 0x210]
push eax
call fcn.004567b2
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
push 0xa
lea edx, [ebp - 0x210]
push edx
call fcn.00475ed0
push eax
call fcn.00475ee0
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x435b6c
jmp 0x435c9d
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x218]
call fcn.00437b20
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
push edx
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1ac
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x190
push ecx
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x33c
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x320
push eax
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x4cc
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x4b0
push edx
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x65c
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x640
push ecx
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x7ec
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x7d0
push eax
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x97c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
add edx, 0x960
push edx
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0xb0c
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0xaf0
push ecx
call fcn.004567b2
add esp, 0x10
lea ecx, [ebp - 0x218]
call fcn.00437b50
mov dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451a25
mov esp, ebp
pop ebp
ret 8
Function at 0x435fb0
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4845bb
mov eax, dword fs:[0]
push eax
sub esp, 0x6ec
mov eax, dword [0x4a5294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00451930
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [str.SELECT__FROM_Win32_UserAccount]
push edx
push 0x100
lea eax, [ebp - 0x21c]
push eax
call fcn.004567b2
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
call fcn.00437bf0
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.00475ed0
push eax
call fcn.00475ee0
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x43605c
jmp 0x43618b
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x224]
call fcn.00437b20
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
call fcn.00430e90
lea ecx, [ebp - 0x6e8]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00437df0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], eax
jmp 0x4360b9
push 0
lea ecx, [ebp - 0x6f0]
push ecx
lea ecx, [ebp - 0x22c]
call fcn.00437cc0
lea edx, [ebp - 0x6f8]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00430e00
push eax
lea ecx, [ebp - 0x22c]
call fcn.00437ba0
movzx eax, al
test eax, eax
je 0x436167
lea ecx, [ebp - 0x22c]
call fcn.00437dd0
mov ecx, dword [eax]
mov dword [ebp - 0x6e0], ecx
mov word [ebp - 0x6dc], 0
push 0x18e
push 0
lea edx, [ebp - 0x6da]
push edx
call fcn.00451930
add esp, 0xc
push 0x320
push 0
lea eax, [ebp - 0x54c]
push eax
call fcn.00451930
add esp, 0xc
cmp dword [ebp - 0x6e0], 0
jne 0x436138
jmp 0x4360a5
push 0x4b0
mov ecx, dword [ebp - 0x6e0]
push ecx
lea edx, [ebp - 0x6dc]
push edx
call fcn.00451cb0
add esp, 0xc
lea eax, [ebp - 0x6dc]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00437c90
jmp 0x4360a5
mov ecx, dword [ebp + 8]
call fcn.00435510
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.00437b50
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00451a25
mov esp, ebp
pop ebp
ret 8
Function at 0x436510
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48454b
mov eax, dword fs:[0]
push eax
sub esp, 0x87c
mov eax, dword [0x4a5294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00451930
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [0x48d55c]
push edx
push 0x100
lea eax, [ebp - 0x21c]
push eax
call fcn.004567b2
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
call fcn.00437bf0
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.00475ed0
push eax
call fcn.00475ee0
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x4365bc
jmp 0x43673f
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x224]
call fcn.00437b20
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
call fcn.00430e90
lea ecx, [ebp - 0x878]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00437df0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], eax
jmp 0x436619
push 0
lea ecx, [ebp - 0x880]
push ecx
lea ecx, [ebp - 0x22c]
call fcn.00437cc0
lea edx, [ebp - 0x888]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00430e00
push eax
lea ecx, [ebp - 0x22c]
call fcn.00437ba0
movzx eax, al
test eax, eax
je 0x436723
lea ecx, [ebp - 0x22c]
call fcn.00437dd0
mov ecx, dword [eax]
mov dword [ebp - 0x870], ecx
mov word [ebp - 0x86c], 0
push 0x18e
push 0
lea edx, [ebp - 0x86a]
push edx
call fcn.00451930
add esp, 0xc
push 0x4b0
push 0
lea eax, [ebp - 0x6dc]
push eax
call fcn.00451930
add esp, 0xc
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x870]
push ecx
push 0xc8
lea edx, [ebp - 0x86c]
push edx
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp - 0x870]
add eax, 0x190
push eax
push 0xc8
lea ecx, [ebp - 0x6dc]
push ecx
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp - 0x870]
add edx, 0x320
push edx
push 0xc8
lea eax, [ebp - 0x54c]
push eax
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x870]
add ecx, 0x4b0
push ecx
push 0xc8
lea edx, [ebp - 0x3bc]
push edx
call fcn.004567b2
add esp, 0x10
lea eax, [ebp - 0x86c]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00437d70
jmp 0x436605
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.00437b50
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00451a25
mov esp, ebp
pop ebp
ret 8
Function at 0x436a60
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4a5294]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 0x80004005
mov word [ebp - 0x210], 0
push 0x1fe
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00451930
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
push 0xffffffffffffffff
mov edx, dword [0x48d368]
push edx
push 0x100
lea eax, [ebp - 0x210]
push eax
call fcn.004567b2
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
push 0xa
lea edx, [ebp - 0x210]
push edx
call fcn.00475ed0
push eax
call fcn.00475ee0
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x436aec
jmp 0x436b71
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x218]
call fcn.00437b20
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
push edx
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1ac
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x190
push ecx
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x33c
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x320
push eax
call fcn.004567b2
add esp, 0x10
lea ecx, [ebp - 0x218]
call fcn.00437b50
mov dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451a25
mov esp, ebp
pop ebp
ret 8
Function at 0x436e20
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4844db
mov eax, dword fs:[0]
push eax
sub esp, 0x560
mov eax, dword [0x4a5294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00451930
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [0x48d3a8]
push edx
push 0x100
lea eax, [ebp - 0x21c]
push eax
call fcn.004567b2
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
call fcn.00437bf0
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.00475ed0
push eax
call fcn.00475ee0
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x436ecc
jmp 0x43701f
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x224]
call fcn.00437b20
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
call fcn.00430e90
lea ecx, [ebp - 0x55c]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00437df0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], eax
jmp 0x436f29
push 0
lea ecx, [ebp - 0x564]
push ecx
lea ecx, [ebp - 0x22c]
call fcn.00437cc0
lea edx, [ebp - 0x56c]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00430e00
push eax
lea ecx, [ebp - 0x22c]
call fcn.00437ba0
movzx eax, al
test eax, eax
je 0x436ffb
lea ecx, [ebp - 0x22c]
call fcn.00437dd0
mov ecx, dword [eax]
mov dword [ebp - 0x230], ecx
mov word [ebp - 0x554], 0
push 0x18e
push 0
lea edx, [ebp - 0x552]
push edx
call fcn.00451930
add esp, 0xc
push 0x190
push 0
lea eax, [ebp - 0x3c4]
push eax
call fcn.00451930
add esp, 0xc
cmp dword [ebp - 0x230], 0
jne 0x436fa8
jmp 0x436f15
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x230]
push ecx
push 0xc8
lea edx, [ebp - 0x554]
push edx
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp - 0x230]
add eax, 0x190
push eax
push 0xc8
lea ecx, [ebp - 0x3c4]
push ecx
call fcn.004567b2
add esp, 0x10
lea edx, [ebp - 0x554]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00437da0
jmp 0x436f15
mov ecx, dword [ebp + 8]
call fcn.00435510
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.00437b50
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00451a25
mov esp, ebp
pop ebp
ret 8
Function at 0x437370
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4a5294]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 0x80004005
mov word [ebp - 0x210], 0
push 0x1fe
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00451930
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
push 0xffffffffffffffff
mov edx, dword [0x48d3ac]
push edx
push 0x100
lea eax, [ebp - 0x210]
push eax
call fcn.004567b2
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
push 0xa
lea edx, [ebp - 0x210]
push edx
call fcn.00475ed0
push eax
call fcn.00475ee0
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x4373fc
jmp 0x437481
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x218]
call fcn.00437b20
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
push 0xc8
mov edx, dword [ebp + 0xc]
push edx
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
add eax, 0x1ac
push eax
push 0xc8
mov ecx, dword [ebp + 0xc]
add ecx, 0x190
push ecx
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
add edx, 0x33c
push edx
push 0xc8
mov eax, dword [ebp + 0xc]
add eax, 0x320
push eax
call fcn.004567b2
add esp, 0x10
lea ecx, [ebp - 0x218]
call fcn.00437b50
mov dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00451a25
mov esp, ebp
pop ebp
ret 8
Function at 0x437860
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48446b
mov eax, dword fs:[0]
push eax
sub esp, 0x884
mov eax, dword [0x4a5294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x220], 0x80004005
mov word [ebp - 0x21c], 0
push 0x1fe
push 0
lea eax, [ebp - 0x21a]
push eax
call fcn.00451930
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
push 0xffffffffffffffff
mov edx, dword [str.SELECT__FROM_Win32_LogicalDisk_WHERE__FileSystem_IS_NOT_NULL_]
push edx
push 0x100
lea eax, [ebp - 0x21c]
push eax
call fcn.004567b2
add esp, 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0xc]
call fcn.00437bf0
push 0xa
lea edx, [ebp - 0x21c]
push edx
call fcn.00475ed0
push eax
call fcn.00475ee0
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x43790c
jmp 0x437ab6
mov eax, dword [ebp + 8]
add eax, 4
push eax
lea ecx, [ebp - 0x224]
call fcn.00437b20
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x22c]
call fcn.00430e90
lea ecx, [ebp - 0x880]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00437df0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], eax
jmp 0x437969
push 0
lea ecx, [ebp - 0x888]
push ecx
lea ecx, [ebp - 0x22c]
call fcn.00437cc0
lea edx, [ebp - 0x890]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x1c
call fcn.00430e00
push eax
lea ecx, [ebp - 0x22c]
call fcn.00437ba0
movzx eax, al
test eax, eax
je 0x437a92
lea ecx, [ebp - 0x22c]
call fcn.00437dd0
mov ecx, dword [eax]
mov dword [ebp - 0x878], ecx
mov word [ebp - 0x874], 0
push 0x18e
push 0
lea edx, [ebp - 0x872]
push edx
call fcn.00451930
add esp, 0xc
push 0x4b4
push 0
lea eax, [ebp - 0x6e4]
push eax
call fcn.00451930
add esp, 0xc
cmp dword [ebp - 0x878], 0
jne 0x4379e8
jmp 0x437955
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x878]
push ecx
push 0xc8
lea edx, [ebp - 0x874]
push edx
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp - 0x878]
add eax, 0x190
push eax
push 0xc8
lea ecx, [ebp - 0x6e4]
push ecx
call fcn.004567b2
add esp, 0x10
mov edx, dword [ebp - 0x878]
mov eax, dword [edx + 0x320]
mov dword [ebp - 0x554], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x878]
add ecx, 0x324
push ecx
push 0xc8
lea edx, [ebp - 0x550]
push edx
call fcn.004567b2
add esp, 0x10
push 0xffffffffffffffff
mov eax, dword [ebp - 0x878]
add eax, 0x4b4
push eax
push 0xc8
lea ecx, [ebp - 0x3c0]
push ecx
call fcn.004567b2
add esp, 0x10
lea edx, [ebp - 0x874]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00437e20
jmp 0x437955
mov ecx, dword [ebp + 8]
call fcn.00435510
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.00437b50
mov dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00451a25
mov esp, ebp
pop ebp
ret 8
Function at 0x43bbfc
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x4a5294]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x43bc3c
cmp byte [esp], 1
jne 0x43bc36
cmp byte [esp + 1], 1
je 0x43bc3f
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 2
pop eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00451a25
mov esp, ebp
pop ebp
ret

Function at 0x43bcf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test edx, edx
jne 0x43bcf8
push 0x2b
pop eax
ret
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
jmp fcn.0043c4b6

Function at 0x43c0b9
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esi + 0x88]
test eax, eax
je 0x43c0d6
push dword [esi + 0x14]
push dword [esp + 0xc]
push dword [esp + 0xc]
push ecx
push esi
call eax
add esp, 0x14
ret
test ecx, ecx
jl 0x43c107
cmp ecx, 2
jg 0x43c107
push dword [esi + 0x10]
push 1
push 2
push dword [ecx*4 + 0x48ba38]
call fcn.00457286
push dword [esi + 0x10]
push 1
push dword [esp + 0x20]
push dword [esp + 0x20]
call fcn.00457286
add esp, 0x20
xor eax, eax
ret
Function at 0x43f6d1
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
lea edx, [ecx + eax]
cmp ecx, edx
mov eax, 0x1505
jae 0x43f6ec
push esi
movsx esi, byte [ecx]
imul eax, eax, 0x21
xor eax, esi
inc ecx
cmp ecx, edx
jb 0x43f6de
pop esi
ret
Function at 0x443f92
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x4a5294]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi]
push dword [esi + 0x74]
mov dword [ebp - 0x124], edi
call fcn.00452390
pop ecx
mov ecx, 0xff
cmp eax, ecx
jae 0x4440f5
and dword [ebp - 0x120], 0
push ecx
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.00451930
mov ebx, dword [sym.imp.WS2_32.dll_inet_addr]
add esp, 0xc
push dword [esi + 0x74]
call ebx
lea eax, [ebp - 0x120]
push eax
push 0
push dword [esi + 0x74]
push edi
call fcn.0043f524
add esp, 0x10
cmp eax, 1
jne 0x44401c
lea eax, [ebp - 0x120]
push eax
push edi
call fcn.00444a5a
pop ecx
pop ecx
mov edi, dword [ebp - 0x120]
test edi, edi
je 0x444037
push dword [esi + 0x74]
lea eax, [ebp - 0x10c]
push eax
call fcn.00456880
pop ecx
pop ecx
cmp byte [ebp - 0x10c], 0
jne 0x44404d
push dword [esi + 0x74]
push str.Couldnt_bind_to__s
jmp 0x4440ee
lea eax, [ebp - 0x10c]
push eax
push str.We_bind_local_end_to__s_n
call fcn.0043bdf0
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x4440e2
test edi, edi
je 0x4440e2
mov ebx, dword [edi]
call fcn.0043f670
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jl 0x4440bd
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x128], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jge 0x4440de
push str.getsockname___failed
call fcn.0043be59
jmp 0x4440f4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esi + 0x8318], eax
mov ebx, eax
mov eax, dword [ebp - 0x124]
call fcn.00443eaf
push eax
push str.bind_failure:__s
jmp 0x4440ee
xor eax, eax
jmp 0x4440f8
lea eax, [ebp - 0x10c]
push eax
push str.couldnt_find_my_own_IP_address___s_
call fcn.0043be59
pop ecx
pop ecx
push 0x2d
pop eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00451a25
leave
ret