joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100018a0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
sub esp, 0x128
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x124], eax
push 1
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10001770
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1000198b
push ebx
mov ebx, dword [sym.imp.MSVCR90.dll_sprintf]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
push edi
mov edx, dword [esp + 0x20]
push edx
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000195c
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov edi, eax
cmp edi, 0xf
je 0x1000192d
cmp edi, 0xfffffff1
jne 0x1000195c
push esi
call fcn.100016e0
cmp eax, dword [0x1000cf44]
jne 0x1000195c
push edi
push eax
lea eax, [esp + 0x3c]
push str.stop:_x_d_n
push eax
call ebx
add esp, 0x10
push esi
call ebp
cmp eax, 0xffffffff
je 0x10001978
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10001901
jmp 0x10001987
push esi
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x124]
mov eax, dword [esp]
xor ecx, esp
call fcn.100059ce
add esp, 0x128
ret
Function at 0x10002580
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x278
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
mov ebp, dword [esp + 0x284]
push esi
push edi
push 0x100
xor ebx, ebx
lea eax, [esp + 0x128]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x100
lea ecx, [esp + 0x20]
push ebx
push ecx
mov dword [esp + 0x24], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x130], ebp
mov dword [esp + 0x12c], 1
call sub.MSVCR90.dll_memset
mov eax, dword [0x10009038]
add esp, 0xc
push eax
lea ecx, [esp + 0x22c]
push 0x10007204
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10002621
sub eax, esi
push eax
lea edx, [esp + 0x22c]
push edx
mov esi, ebp
call fcn.10002970
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebx
mov ecx, 0x41
lea esi, [esp + 0x128]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10002765
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea eax, [esp + 0x230]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
mov byte [esp + eax + 0x234], bl
call sub.MSVCR90.dll_memset
mov edx, dword [0x1000a50c]
add esp, 0xc
push edx
lea eax, [esp + 0x22c]
push 0x10007204
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100026e0
sub eax, esi
push eax
lea ecx, [esp + 0x22c]
push ecx
mov esi, ebp
call fcn.10002970
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
mov ecx, 0x41
lea esi, [esp + 0x130]
lea edi, [esp + 0x28]
push ebx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10002765
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea edx, [esp + 0x230]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov eax, 1
jmp 0x10002767
xor eax, eax
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100059ce
add esp, 0x278
ret
Function at 0x10002970
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x30
push ebx
push ebp
push edi
mov ebp, 1
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov ecx, dword [esp + 0x40]
mov ebx, dword [sym.imp.WS2_32.dll_WSASend]
mov edi, eax
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
push 0
lea edx, [esp + 0x28]
push edx
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x28]
push ecx
push esi
call ebx
cmp eax, 0xffffffff
jne 0x100029e1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x10002a30
push 0
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x28]
push edx
push 1
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
cmp eax, 0xffffffff
je 0x10002a30
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
lea ecx, [esp + 0x10]
push ecx
push 0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x10002a30
mov eax, dword [esp + 0xc]
sub dword [esp + 0x14], eax
je 0x10002a32
add dword [esp + 0x18], eax
jmp 0x100029b7
xor ebp, ebp
push edi
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x100037b0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x278
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
mov ebp, dword [esp + 0x284]
push esi
push edi
push 0x100
xor ebx, ebx
lea eax, [esp + 0x128]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x100
lea ecx, [esp + 0x20]
push ebx
push ecx
mov dword [esp + 0x24], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x130], ebp
mov dword [esp + 0x12c], 1
call sub.MSVCR90.dll_memset
mov eax, dword [0x1000a53c]
add esp, 0xc
push eax
lea ecx, [esp + 0x22c]
push 0x10007204
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10003851
sub eax, esi
push eax
lea edx, [esp + 0x22c]
push edx
mov esi, ebp
call fcn.10002970
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebx
mov ecx, 0x41
lea esi, [esp + 0x128]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10003995
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea eax, [esp + 0x230]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
mov byte [esp + eax + 0x234], bl
call sub.MSVCR90.dll_memset
mov edx, dword [0x1000ba10]
add esp, 0xc
push edx
lea eax, [esp + 0x22c]
push 0x10007204
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10003910
sub eax, esi
push eax
lea ecx, [esp + 0x22c]
push ecx
mov esi, ebp
call fcn.10002970
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
mov ecx, 0x41
lea esi, [esp + 0x130]
lea edi, [esp + 0x28]
push ebx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10003995
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea edx, [esp + 0x230]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov eax, 1
jmp 0x10003997
xor eax, eax
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100059ce
add esp, 0x278
ret
Function at 0x10004760
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x278
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
mov ebp, dword [esp + 0x284]
push esi
push edi
push 0x100
xor ebx, ebx
lea eax, [esp + 0x128]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x100
lea ecx, [esp + 0x20]
push ebx
push ecx
mov dword [esp + 0x24], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x130], ebp
mov dword [esp + 0x12c], 1
call sub.MSVCR90.dll_memset
mov eax, dword [0x1000ba40]
add esp, 0xc
push eax
lea ecx, [esp + 0x22c]
push 0x10007204
push ecx
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10004801
sub eax, esi
push eax
lea edx, [esp + 0x22c]
push edx
mov esi, ebp
call fcn.10002970
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebx
mov ecx, 0x41
lea esi, [esp + 0x128]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10004945
push 0x51
lea edx, [esp + 0x22c]
push ebx
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea eax, [esp + 0x230]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
mov byte [esp + eax + 0x234], bl
call sub.MSVCR90.dll_memset
mov edx, dword [0x1000cf14]
add esp, 0xc
push edx
lea eax, [esp + 0x22c]
push 0x10007204
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
lea eax, [esp + 0x234]
add esp, 0xc
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100048c0
sub eax, esi
push eax
lea ecx, [esp + 0x22c]
push ecx
mov esi, ebp
call fcn.10002970
add esp, 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
mov ecx, 0x41
lea esi, [esp + 0x130]
lea edi, [esp + 0x28]
push ebx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], 0x14
mov dword [esp + 0x28], ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x10004945
push 0x51
lea ecx, [esp + 0x22c]
push ebx
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x51
lea edx, [esp + 0x230]
push edx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov eax, 1
jmp 0x10004947
xor eax, eax
mov ecx, dword [esp + 0x284]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100059ce
add esp, 0x278
ret
Function at 0x10004ea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [0x1000d1b0]
lea eax, [esp]
push eax
push 0x1000cf54
push 0
push 0
push 0x1000808c
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x1000cf54
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004ed0
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x10004efd
mov edx, eax
and edx, 0x80000001
jns 0x10004ef0
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + 0x1000cf54], dl
inc eax
cmp eax, ecx
jl 0x10004ee1
pop ecx
ret

Function at 0x10004f00
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [0x1000d1b0]
lea eax, [esp]
push eax
push 0x1000cf64
push 0
push 0
push 0x100080a4
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x1000cf64
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004f30
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x10004f5d
mov edx, eax
and edx, 0x80000001
jns 0x10004f50
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + 0x1000cf64], dl
inc eax
cmp eax, ecx
jl 0x10004f41
pop ecx
ret

Function at 0x10004f60
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [0x1000d1b0]
lea eax, [esp]
push eax
push 0x1000cf74
push 0
push 0
push 0x100080bc
push ecx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, 0x1000cf74
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10004f90
sub eax, edx
mov ecx, eax
xor eax, eax
test ecx, ecx
jle 0x10004fbd
mov edx, eax
and edx, 0x80000001
jns 0x10004fb0
dec edx
or edx, 0xfffffffe
inc edx
add dl, al
sub byte [eax + 0x1000cf74], dl
inc eax
cmp eax, ecx
jl 0x10004fa1
pop ecx
ret

Function at 0x10004fc0
Capabilities:
Create thread

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x10005060
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10004fec
push eax
call edi
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0x100019b0
push 0
push 0
call esi
test eax, eax
je 0x10005007
push eax
call edi
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x10002be0
push 0
push 0
call esi
test eax, eax
je 0x10005022
push eax
call edi
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x10003ba0
push 0
push 0
call esi
test eax, eax
je 0x1000503d
push eax
call edi
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0x100055d0
push 0
push 0
call esi
test eax, eax
je 0x10005058
push eax
call edi
pop edi
pop esi
add esp, 0x14
ret
Function at 0x10005280
Capabilities:
Create process on windows

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [sym.imp.MSVCR90.dll_sprintf]
push esi
push str._c_route_delete__s
push 0x1000cf88
call edi
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0xc
push 0
push 0
push 0x1000cf88
push str.cmd.exe
push 0
push 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call ebp
push 0x104
push 0
push 0x1000cf88
call sub.MSVCR90.dll_memset
push esi
push str._c_route_add__s_mask_255.255.255.255_0.0.0.0
push 0x1000cf88
call edi
add esp, 0x18
push 0
push 0
push 0x1000cf88
push str.cmd.exe
push 0
push 0
call ebx
push 0x7d0
call ebp
pop edi
pop ebp
pop ebx
ret
Function at 0x100059ce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x100059d8
repz ret
jmp fcn.10005d8b

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2e332962
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1af416f7
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401110
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push esi
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x401128
cmp eax, 0x80010106
jne 0x4011a6
push edi
push esi
push 0x6a918c
push 1
push 0
push 0x6a917c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x401157
push edi
push str.CoCreateInstance_NetFwMgr_failed:_0x_08lx_n
call fcn.00568bd0
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push ebx
lea edi, [esi + 4]
push edi
push eax
call edx
mov ebx, eax
test ebx, ebx
jge 0x401180
push ebx
push str.get_LocalPolicy_failed:_0x_08lx_n
call fcn.00568bd0
add esp, 8
mov eax, ebx
pop ebx
pop edi
pop esi
ret
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
add esi, 8
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x4011a4
push esi
push str.get_CurrentProfile_failed:_0x_08lx_n
call fcn.00568bd0
mov eax, esi
add esp, 8
pop ebx
pop edi
pop esi
ret

Function at 0x4014a0
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push esi
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x4014b8
cmp eax, 0x80010106
jne 0x40150c
push edi
push esi
push 0x6a91cc
push 1
push 0
push 0x6a91bc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x4014e7
push edi
push str.CoCreateInstance_NetFwPolicy2_failed:_0x_08lx_n
call fcn.00568bd0
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
add esi, 4
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x40150b
push esi
push str.get_Rules_failed:_0x_08lx_n
call fcn.00568bd0
mov eax, esi
add esp, 8
pop edi
pop esi
ret
Function at 0x401590
Capabilities:
Access firewall rule properties via inetfwrule

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 4], 0
jne 0x4015a6
mov eax, 0x80004001
pop esi
pop ecx
ret 0xc
push ebx
push ebp
push edi
push str.Infestation_Fantasy_By_NewGTX
call fcn.00401050
mov edi, eax
mov eax, dword [esp + 0x20]
push eax
call fcn.00401050
mov ecx, dword [esp + 0x28]
push ecx
mov ebp, eax
call fcn.00401050
mov dword [esp + 0x28], eax
add esp, 0xc
lea ebx, [esp + 0x20]
mov eax, esi
mov dword [esp + 0x10], 0
call fcn.00401510
mov esi, eax
test esi, esi
jge 0x401603
push esi
push str.IsAppEnabled_failed:_0x_08lx_n
call fcn.00568bd0
add esp, 8
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0xc
cmp dword [esp + 0x20], 0
je 0x401614
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret 0xc
lea edx, [esp + 0x10]
push edx
push 0x6a91ec
push 1
push 0
push 0x6a91dc
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jge 0x40163e
push esi
push str.CoCreateInstance_NetFwRule_failed:_0x_08lx_n
jmp 0x4016cd
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push edi
push eax
call edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
push ebp
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
push 0x100
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x98]
push 6
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa8]
push 1
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push 0xffffffffffffffff
push eax
call edx
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
mov esi, eax
test esi, esi
jge 0x4016d5
push esi
push str.Firewall_Rule_Add_failed:_0x_08lx_n
call fcn.00568bd0
add esp, 8
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push ebp
call edi
mov ecx, dword [esp + 0x1c]
push ecx
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4016f8
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0xc
Function at 0x401930
Capabilities:
Copy file

Disassembly:
sub esp, 0x614
mov eax, dword [0x6d6dfc]
xor eax, esp
mov dword [esp + 0x610], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x114]
push 0x5c
push ecx
call fcn.005b3190
mov esi, eax
inc esi
add esp, 8
cmp esi, 1
jne 0x40198b
push 0
push 0x14
push str..GenerateUpdaterXML.cpp
push str._DWORD_fname___1
call fcn.00568ee0
add esp, 0x10
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x11c]
push ecx
call fcn.00569940
add esp, 0xc
test al, al
jne 0x4019be
lea edx, [esp + 0x114]
push edx
push str.failed_to_get_crc_for__s_n
call fcn.00568da0
add esp, 8
push 0x6d95b0
push esi
lea eax, [esp + 0x18]
push str._s__s.exe
push eax
call fcn.00401ac0
add esp, 0x10
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x4019fb
lea edx, [esp + 0x10]
push edx
push esi
push str.unable_to_copy__s___s_n
call fcn.00568da0
add esp, 0xc
push 0x2f
push str.http:__147.50.253.97_Fantasy_NewGTX_Update_ifupd.xml
call fcn.005b3190
mov esi, eax
add esp, 8
test esi, esi
jne 0x401a25
push eax
push 0x21
push str..GenerateUpdaterXML.cpp
push str.updater_file
call fcn.00568ee0
add esp, 0x10
lea edi, [esi + 1]
push 0x6a927c
push edi
call fcn.00569e50
mov esi, eax
push 0x6a9280
push esi
call fcn.005b31bd
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push eax
push 0x6d95b0
push ecx
lea edx, [esp + 0x2c]
push edx
push str.http:__147.50.253.97_Fantasy_NewGTX_Update_
push str.__u_url__s_s__crc__u__ver__s__size__u____n
push esi
call fcn.005b31bd
push str.__p__n
push esi
call fcn.005b31bd
push esi
call fcn.005b3350
lea eax, [esp + 0x48]
push eax
push edi
lea ecx, [esp + 0x258]
push str.XML__s_generated_nnew_exe:_s
push ecx
call fcn.00401ae0
add esp, 0x48
push 0
push str.Updater_XML
lea edx, [esp + 0x220]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x618]
pop edi
pop esi
xor ecx, esp
call fcn.005b2ec7
add esp, 0x614
ret