joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416da6
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x6ba0d0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x24
mov eax, 0x62808f
call fcn.0058c0ed
lea eax, [ebp - 0x14]
push eax
push 1
xor esi, esi
push esi
push str.SoftwareZhorn_stickies
push reloc.WS2_32.dll_accept
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x416df9
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x416f7b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
push esi
push esi
push str.Path
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416de9
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00402035
lea eax, [ebp - 0x10]
add edi, 0x1628
push eax
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.00401dd7
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401493
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push str._PROFILE_
mov ecx, edi
call fcn.0040bb49
mov ebx, eax
mov esi, 0x6431a4
cmp ebx, 0xffffffff
je 0x416f3d
push 0
push 0x28
lea eax, [ebp]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebx + 0xa]
push eax
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
call fcn.0040d75e
mov dword [ebp - 0x18], eax
push ebx
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.00403286
lea ecx, [ebp]
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.0040e47a
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 3
call fcn.0040e47a
push dword [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0040e423
add esp, 0x24
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.00402e5b
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.00401dd7
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp - 0x20]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401493
push 1
lea eax, [ebp - 0x28]
push eax
mov ecx, edi
call fcn.0040cce9
push esi
mov ecx, eax
mov dword [ebp - 4], 7
call fcn.00406897
mov ecx, dword [ebp - 0x28]
test eax, eax
setne bl
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.00401493
test bl, bl
je 0x416f79
push esi
mov ecx, edi
call fcn.00405a72
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0058c0de
add ebp, 0x20c
leave
ret
Function at 0x41778d
Capabilities:
Create directory

Disassembly:
push 0x10
mov eax, 0x6281ca
call fcn.0058c0ed
mov dword [ebp - 0x10], ecx
push 1
lea eax, [ebp - 0x14]
xor esi, esi
push eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], esi
call fcn.0040cce9
push 0x5c
pop edi
push edi
push eax
call fcn.0040cd4d
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov bl, al
call fcn.00401493
test bl, bl
je 0x4177d5
push edi
lea ecx, [ebp + 8]
call fcn.004032c4
push 2
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 8]
call fcn.00403286
push 0x645aac
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00406897
mov ecx, dword [ebp - 0x14]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
mov byte [ebp - 4], 0
call fcn.00401493
test bl, bl
je 0x417880
push 3
push edi
lea ecx, [ebp + 8]
call fcn.0040bb17
push eax
push edi
lea ecx, [ebp + 8]
call fcn.0040bb17
mov esi, eax
inc esi
inc esi
jmp 0x417880
push esi
push edi
lea ecx, [ebp + 8]
call fcn.0040bb17
push eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 8]
call fcn.00403286
mov ebx, dword [ebp - 0x14]
cmp dword [ebx - 0xc], 3
mov byte [ebp - 4], 2
jle 0x417867
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x417867
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x417893
push esi
push edi
lea ecx, [ebp + 8]
call fcn.0040bb17
inc eax
lea ecx, [ebx - 0x10]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.00401493
push esi
push edi
lea ecx, [ebp + 8]
call fcn.0040bb17
cmp eax, 0xffffffff
jne 0x417829
mov bl, 1
jmp 0x4178cf
mov ecx, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00411509
push ecx
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 3
call fcn.00402e5b
mov ecx, dword [ebp - 0x10]
push 3
call fcn.00415cb2
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401493
lea ecx, [ebx - 0x10]
call fcn.00401493
xor bl, bl
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401493
mov al, bl
call fcn.0058c1c5
ret 4

Function at 0x4178e4
Capabilities:
Copy file

Disassembly:
push 8
mov eax, 0x6281f5
call fcn.0058c0ed
mov esi, ecx
and dword [ebp - 4], 0
call fcn.00414955
mov ecx, esi
call fcn.00413c29
push 0x6431a4
lea eax, [esi + 0x1628]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040e47a
push str.stickies.db
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.0040e47a
mov eax, dword [eax]
add esp, 0x18
push 0
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x10]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.00401493
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401493
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
lea ecx, [ebp + 8]
push ecx
push str.515_backup_taken_to:
push eax
call fcn.00405a0e
add esp, 0xc
mov ecx, esi
call fcn.0040c986
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401493
mov al, bl
call fcn.0058c1c5
ret 4
Function at 0x4189d5
Capabilities:
Reference sql statements

Disassembly:
push 0x10
mov eax, 0x6284b3
call fcn.0058c0ed
mov esi, ecx
xor ebx, ebx
mov byte [ebp - 0xd], bl
call fcn.0054f69d
push eax
lea ecx, [ebp - 0x18]
call fcn.004018a6
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push str.SELECT__rtf__FROM__content_rtf__WHERE__key____i
push eax
mov dword [ebp - 4], ebx
call fcn.00401e49
mov edi, dword [ebp - 0x18]
push ebx
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
push edi
push dword [esi + 0xbb4]
call fcn.004830b7
add esp, 0x20
mov dword [ebp - 0x1c], eax
cmp eax, ebx
jne 0x418a74
push dword [ebp - 0x14]
call fcn.004887a0
pop ecx
cmp eax, 0x65
je 0x418a74
mov byte [ebp - 0xd], 1
push ebx
push dword [ebp - 0x14]
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
call fcn.00413b8e
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 1
call fcn.00401dd7
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.00401493
push dword [ebp - 0x14]
call fcn.004887a0
pop ecx
cmp eax, 0x65
jne 0x418a3c
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.0041195f
push dword [ebp - 0x14]
call fcn.00477166
pop ecx
lea ecx, [edi - 0x10]
call fcn.00401493
mov al, byte [ebp - 0xd]
call fcn.0058c1c5
ret 8
Function at 0x41cfed
Capabilities:
Log keystrokes via polling
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0xffffffffffffffff
push 0
push 1
push ecx
mov esi, ecx
mov dword [ebp - 8], esp
mov ecx, esp
push 0x6477c0
call fcn.00402035
mov ecx, esi
call fcn.0041b93f
push 0x10
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
push dword [esi + 0x20]
test ax, ax
setl al
mov byte [ebp - 8], al
mov edi, 0xff
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41d087
mov esi, dword [sym.imp.USER32.dll_EnumClipboardFormats]
push 0
jmp 0x41d06c
cmp eax, 2
je 0x41d052
cmp eax, 8
je 0x41d052
cmp eax, 0x11
jne 0x41d05a
cmp edi, 1
jle 0x41d05a
xor edi, edi
inc edi
cmp eax, 0xd
je 0x41d069
cmp eax, 1
je 0x41d069
cmp eax, 7
jne 0x41d06b
xor edi, edi
push eax
call esi
test eax, eax
jne 0x41d043
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp edi, 1
jne 0x41d087
mov ecx, dword [ebp - 4]
call fcn.005004ef
jmp 0x41d098
mov ecx, dword [ebp - 4]
push dword [ebp - 8]
add ecx, 0x84
call fcn.0049f4fc
pop edi
pop esi
leave
ret
Function at 0x41d53b
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x6ba0d0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x14
mov eax, 0x628cce
call fcn.0058c0ed
mov esi, ecx
push dword [esi + 0x1650]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp byte [esi + 0x110], bl
je 0x41d57e
mov ecx, esi
call fcn.00419972
mov ecx, esi
call fcn.00409855
lea ecx, [esi + 0x104c]
call fcn.0048d111
mov ecx, esi
call fcn.00409f53
push ecx
mov dword [ebp - 0x14], esp
mov ecx, esp
push str.Restore:_Launching_new_instance_and_terminating
call fcn.00402035
push 0x14
mov ecx, esi
call fcn.00415cb2
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00402035
push 0x6431a4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 4], ebx
call fcn.0040e47a
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 1
call fcn.0055da6c
mov eax, dword [eax + 4]
push dword [eax + 0x60]
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.0040e47a
push str..exe
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 2
call fcn.0040e47a
add esp, 0x18
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00402e5b
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401493
push 1
push ebx
push ebx
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
call fcn.0058fac0
int3
Function at 0x42266f
Capabilities:
Copy file

Disassembly:
push 0xc
mov eax, 0x629388
call fcn.0058c0ed
mov esi, ecx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x14]
push str.Restoring_from:__
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00405a0e
push 0x645d74
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.0040e47a
add esp, 0x14
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 2
call fcn.00402e5b
push 0x14
mov ecx, esi
call fcn.00415cb2
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.00401493
push ecx
mov eax, esp
mov dword [ebp - 0x18], esp
lea ecx, [ebp + 8]
push ecx
push str.516_stickies_is_exiting_for_a_restore_from_file:
push eax
call fcn.00405a0e
add esp, 0xc
mov ecx, esi
call fcn.0040c986
mov ecx, esi
call fcn.00414955
push dword [esi + 0x102c]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
push dword [esi + 0x20]
call edi
push dword [esi + 0x1028]
push dword [esi + 0x20]
call edi
push dword [esi + 0x1030]
push dword [esi + 0x20]
call edi
push dword [esi + 0x1034]
push dword [esi + 0x20]
call edi
mov ecx, esi
call fcn.00409f53
mov eax, dword [esi + 0xbac]
cmp dword [eax + 0x18a0], 1
jne 0x42275d
mov dword [eax + 0x18a0], 0x63
jmp 0x42275d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0xbac]
cmp dword [eax + 0x18a0], ebx
jne 0x422755
push 0x6431a4
lea eax, [esi + 0x1628]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040e47a
push str.stickies.db
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 3
call fcn.0040e47a
mov eax, dword [eax]
add esp, 0x18
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.00401493
mov ecx, esi
call fcn.0041d53b
int3
Function at 0x427116
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push esi
mov esi, dword [esp + 0x10]
cmp dword [esi], 0
jne 0x427137
push esi
push 0
push 0
push 0x8003
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x427149
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
pop esi
ret 0xc

Function at 0x42717c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6ba0d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov word [ebp - 0x20c], ax
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4271e4
push 0x6431a4
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0058fd6b
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0058fd6b
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0058c0de
leave
ret

Function at 0x42a229
Capabilities:
Get hostname

Disassembly:
push 0x20c
mov eax, 0x62a238
call fcn.0058c156
mov edi, dword [ebp + 8]
mov esi, ecx
push 0x64b49c
mov ecx, edi
call fcn.00406897
test eax, eax
jne 0x42a2d1
push 0x102
push eax
mov word [ebp - 0x114], ax
lea eax, [ebp - 0x112]
push eax
call fcn.0058d7c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x42a2d1
lea eax, [ebp - 0x214]
mov dword [ebp - 0x218], eax
push 3
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x218]
call fcn.004280cd
push dword [ebp - 0x218]
and dword [ebp - 4], 0
lea ecx, [esi + 0x1c]
call fcn.00401e24
lea eax, [ebp - 0x214]
cmp dword [ebp - 0x218], eax
je 0x42a2da
push dword [ebp - 0x218]
call fcn.0058c433
pop ecx
jmp 0x42a2da
push edi
lea ecx, [esi + 0x1c]
call fcn.00401dd7
call fcn.0058c1d9
ret 4

Function at 0x42f290
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
lea esi, [ecx + 4]
mov eax, dword [esi]
test eax, eax
je 0x42f2aa
push eax
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
and dword [esi], 0
push 0x20
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.0058d7c0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
push esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
pop esi
leave
ret 0x18

Function at 0x42f4de
Capabilities:
Connect socket

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x42f4fb
push 0
call fcn.0042f365
ret 8
Function at 0x42f5ad
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
mov esi, ecx
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov edi, eax
test edi, edi
jne 0x42f5c9
push eax
call fcn.0042f365
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSAEventSelect]
push 0x10
push edi
push dword [esi + 4]
call ebx
cmp eax, 0xffffffff
jne 0x42f5ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
push esi
jmp 0x42f5c4
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x42f669
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0xc], eax
cmp eax, 0x2733
jne 0x42f65a
push dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42f649
lea eax, [ebp - 0x2c]
push eax
push edi
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
cmp eax, 0xffffffff
je 0x42f5dd
cmp dword [ebp - 0x18], 0
je 0x42f669
push edi
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
push dword [ebp - 0x18]
jmp 0x42f5c4
push edi
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
push 0x274c
jmp 0x42f5c4
push edi
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
push dword [ebp + 0xc]
jmp 0x42f5c4
push 0
push edi
push dword [esi + 4]
call ebx
push edi
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
xor edi, edi
pop ebx
cmp dword [ebp + 0x14], edi
je 0x42f6a0
lea eax, [ebp + 0xc]
push eax
push 0x8004667e
push dword [esi + 4]
mov dword [ebp + 0xc], edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x42f6a0
push edi
jmp 0x42f5c4
pop edi
pop esi
leave
ret 0x10

Function at 0x42f6a6
Capabilities:
Receive data
Receive data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x42f6c7
push 0
call fcn.0042f365
ret 0xc

Function at 0x42f6f5
Capabilities:
Send data
Send data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x42f716
push 0
call fcn.0042f365
ret 0xc

Function at 0x42f7c4
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [ebp + 8]
push esi
xor edx, edx
mov esi, 0x3e8
div esi
xor esi, esi
mov dword [ebp - 0x10c], 1
mov dword [ebp - 8], eax
imul edx, edx, 0x3e8
mov eax, dword [ecx + 4]
mov dword [ebp - 0x108], eax
lea eax, [ebp - 8]
push eax
push esi
push esi
lea eax, [ebp - 0x10c]
push eax
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x42f81a
push esi
call fcn.0042f365
xor ecx, ecx
cmp eax, esi
setne cl
pop esi
mov eax, ecx
leave
ret 4
Function at 0x4303f2
Capabilities:
Resolve dns

Disassembly:
push 0x2c
mov eax, 0x62b304
call fcn.0058c18c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x24], ecx
call fcn.0054f69d
push eax
lea ecx, [ebp - 0x28]
call fcn.004018a6
push dword [ebp + 0x14]
lea eax, [ebp - 0x28]
push 0x64c4b8
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00401e49
mov ecx, dword [ebp - 0x24]
add esp, 0xc
push dword [ebp - 0x28]
push esi
call fcn.0042f4fe
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
mov byte [ebp - 0x20], 4
mov byte [ebp - 0x1f], 1
call dword [sym.imp.WS2_32.dll_htons]
push edi
lea ecx, [ebp - 0x2c]
mov word [ebp - 0x1e], ax
call fcn.004108dc
push dword [ebp - 0x2c]
mov byte [ebp - 4], 2
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x430488
push dword [ebp - 0x2c]
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x4304d7
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x24]
push ebx
push 9
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 0x18], bl
call fcn.0042f6f5
push 8
lea eax, [ebp - 0x34]
push ebx
push eax
call fcn.0058d7c0
add esp, 0xc
xor esi, esi
cmp esi, 8
jae 0x4304e4
push dword [ebp + 0x18]
mov ecx, dword [ebp - 0x24]
call fcn.0042f7c4
cmp eax, ebx
je 0x4304dd
mov ecx, dword [ebp - 0x24]
push ebx
push 8
pop eax
sub eax, esi
push eax
lea eax, [ebp + esi - 0x34]
push eax
call fcn.0042f6a6
add esi, eax
jmp 0x4304ab
push ebx
call fcn.0042f365
push 0x5b4
jmp 0x4304d8
cmp byte [ebp - 0x34], bl
jne 0x43050d
cmp byte [ebp - 0x33], 0x5a
jne 0x43050d
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.00401493
call fcn.0058c1e8
ret 0x14
push 0x3a
jmp 0x4304d8

Function at 0x434ab9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [eax + 0x14]
dec dword [esi + 0x78]
lea ecx, [esi + 0x88]
mov edx, dword [ecx]
mov dword [eax + 0x10], edx
mov dword [ecx], eax
push dword [eax + 4]
mov ecx, dword [eax + 0x18]
mov eax, dword [esi + 0x98]
cdq
push edx
push eax
dec ecx
push 0
push ecx
call fcn.0058cdb0
push edx
push eax
mov eax, dword [esi + 0x3c]
call fcn.00431470
add esp, 0xc
pop esi
ret
test byte [eax + 0x1c], 0x20
je 0x434ac4
jmp 0x4349a6
jmp fcn.00433771

Function at 0x434ac9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test eax, eax
je 0x434ad2
jmp fcn.00434ab9
ret

Function at 0x435b3a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test eax, eax
je 0x435b43
jmp fcn.00435b32
ret

Function at 0x435cf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dl, byte [ecx + 0x44]
and byte [ecx + 1], 0xf9
xor eax, eax
mov word [ecx + 0x32], ax
movsx eax, dl
mov ax, word [ecx + eax*2 + 0x46]
dec dl
mov byte [ecx + 0x44], dl
movsx edx, dl
mov word [ecx + 0x46], ax
mov edx, dword [ecx + edx*4 + 0x78]
mov eax, dword [ecx + 0x74]
mov dword [ecx + 0x74], edx
jmp fcn.00435b32
Function at 0x43db97
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [edi + 0x88]
push esi
mov esi, dword [eax]
xor ecx, ecx
cmp esi, ecx
je 0x43dbc7
mov dword [ebx], esi
mov edx, dword [esi + 0x10]
push 8
mov dword [eax], edx
push ecx
push dword [esi + 8]
mov dword [esi + 0x10], ecx
call fcn.0058d7c0
add esp, 0xc
jmp 0x43dc22
movzx eax, word [edi + 0x8c]
add eax, 0x28
push ecx
push eax
call fcn.0043c38c
mov esi, eax
pop ecx
pop ecx
mov dword [ebx], esi
test esi, esi
jne 0x43dc0b
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 0x98]
push esi
cdq
dec ecx
push ecx
push edx
push eax
call fcn.0058cdb0
push edx
push eax
mov eax, dword [edi + 0x3c]
call fcn.00431470
add esp, 0xc
push 7
pop eax
jmp 0x43dc33
lea eax, [esi + 0x28]
mov dword [esi + 8], eax
push 0x20
pop eax
mov word [esi + 0x1c], ax
xor eax, eax
inc eax
mov word [esi + 0x1e], ax
mov dword [esi + 0x14], edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
inc dword [edi + 0x78]
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x43f54e
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
xor ebx, ebx
push ebx
push 0x14
mov dword [eax], ebx
call fcn.0043c20e
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
jne 0x43c716
push 7
pop eax
jmp 0x43c77d
cmp byte [0x6b5964], bl
je 0x43c752
push 0xc8
call fcn.00431b62
pop ecx
test eax, eax
jne 0x43c752
mov eax, dword [esp + 0x10]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push ebx
push esi
push 0x431a7d
push ebx
push ebx
mov dword [esi + 0xc], edi
call fcn.005910f6
add esp, 0x18
mov dword [esi], eax
cmp eax, ebx
jne 0x43c75e
push 0x14
push ebx
push esi
call fcn.0058d7c0
add esp, 0xc
cmp dword [esi + 8], ebx
jne 0x43c775
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [esp + 0x14]
pop ecx
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0xc]
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
ret
jmp 0x43c6f7
Function at 0x45c4e2
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0xc]
mov edi, eax
push dword [ebp + 8]
push dword [ebp + 8]
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
call fcn.0044e7bf
add esp, 0x10
cmp dword [ebp + 0xc], 0
jne 0x45c513
push dword [ebp + 8]
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
call fcn.0044e7bf
pop ecx
pop ecx
pop edi
pop ebp
ret