joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412710
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x43467b
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
push ebx
push ebp
push esi
push edi
mov eax, dword [0x445018]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov esi, ecx
test esi, esi
je 0x4128c4
cmp dword [esi + 0x140], 0
jbe 0x4128c4
mov edi, 8
cmp dword [esi + 0x144], edi
jb 0x412769
mov eax, dword [esi + 0x130]
jmp 0x41276f
lea eax, [esi + 0x130]
test eax, eax
je 0x4128c4
push 0
push eax
call dword [sym.imp.MSVCR80.dll__waccess]
add esp, 8
cmp eax, 0xffffffff
je 0x4128c4
cmp dword [esi + 0x144], edi
jb 0x41279c
mov esi, dword [esi + 0x130]
jmp 0x4127a2
add esi, 0x130
push 1
mov ebx, esi
call fcn.00404e60
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x4128c4
mov edi, dword [ebp]
mov esi, dword [sym.imp.MSVCR80.dll_fseek]
push 2
push 0
push edi
call esi
add esp, 0xc
push edi
call dword [sym.imp.MSVCR80.dll_ftell]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4127e3
xor edi, edi
mov dword [esp + 0x18], edi
jmp 0x4127f3
push ebx
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
mov dword [esp + 0x18], eax
mov edi, eax
mov eax, dword [ebp]
push 0
push 0
push eax
call esi
mov eax, dword [ebp]
add esp, 0xc
push eax
push ebx
push 1
push edi
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x10
cmp eax, ebx
je 0x41286e
call fcn.00402130
call fcn.00429250
test al, 1
je 0x41286e
push 0x10f
mov edx, str.yh_FileUpload::CFileUploadUtility::GetFileDataFromReq
mov ecx, str..FileUploadFileUploadUtility.cpp
mov eax, 1
lea esi, [esp + 0x20]
call fcn.004287e0
add eax, 0x1c
push str.CFileUploadUtility::GetFileDataFromReq___failed.
push eax
mov dword [esp + 0xc8], 0
call fcn.00401ae0
add esp, 8
mov ecx, esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.00428850
push 0x14
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
test eax, eax
je 0x412891
mov edi, 0x40
mov esi, eax
call fcn.00404c10
mov edi, dword [esp + 0x18]
mov esi, eax
jmp 0x412893
xor esi, esi
mov eax, dword [esi + 0xc]
push ebx
push edi
call fcn.00404d00
test edi, edi
mov ebx, dword [sym.imp.MSVCR80.dll_free]
je 0x4128ad
push edi
call ebx
add esp, 4
mov eax, dword [ebp]
push eax
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 4
push ebp
call ebx
add esp, 4
mov eax, esi
jmp 0x4128c6
xor eax, eax
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret
Function at 0x413750
Capabilities:
Get hostname
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x432eb9
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x445018]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push esi
mov eax, dword [0x445018]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
push 0x63
lea eax, [esp + 0x49]
push ebx
mov dword [esp + 0xc0], 1
push eax
mov byte [esp + 0x50], bl
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x63
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x4137db
push edi
lea ecx, [esp + 0x18]
call fcn.004017f0
jmp 0x413839
lea edx, [esp + 0x44]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x41382f
mov eax, dword [eax + 0xc]
cmp eax, ebx
je 0x41382f
mov eax, dword [eax]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [esp + 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea edx, [esp + 0x28]
push edx
lea esi, [esp + 0x18]
mov byte [esp + 0xbc], 2
call fcn.004149f0
lea ecx, [esp + 0x28]
mov byte [esp + 0xb8], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push edi
lea ecx, [esp + 0x18]
call fcn.004017f0
mov byte [esp + 0xb8], bl
lea ebx, [esp + 0x14]
mov dword [esp + 0x10], 1
call fcn.00401920
mov eax, edi
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.00431147
add esp, 0xb0
ret
Function at 0x413880
Capabilities:
Get networking parameters

Disassembly:
push 0xffffffffffffffff
push 0x432e62
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x445018]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x4c]
xor ebp, ebp
mov dword [esp + 0x1c], ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esp + 0x44], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x248
push 0x40
mov dword [esp + 0x24], 1
call ebx
mov edi, eax
lea eax, [esp + 0x18]
push eax
push edi
mov dword [esp + 0x20], 0x248
call sub.iphlpapi.dll_GetNetworkParams
cmp eax, 0x6f
jne 0x413901
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x18]
push ecx
push 0x40
call ebx
mov edi, eax
lea edx, [esp + 0x18]
push edx
push edi
call sub.iphlpapi.dll_GetNetworkParams
cmp eax, ebp
je 0x413924
push eax
push str.Call_to_GetNetworkParams_failed._Return_Value:__08x_n
call dword [sym.imp.MSVCR80.dll_printf]
add esp, 8
jmp 0x4139a5
mov ebx, dword [sym.imp.MSVCR80.dll_printf]
push edi
push str.Host_Name:__s_n
call ebx
lea eax, [edi + 0x84]
push eax
push str.Domain_Name:__s_n
call ebx
push str.DNS_Servers:_n
call ebx
add esp, 0x14
lea ecx, [edi + 0x110]
push ecx
push str._t_s_n
call ebx
mov edi, dword [edi + 0x10c]
add esp, 8
cmp edi, ebp
je 0x4139a5
lea ebp, [edi + 4]
push ebp
push str._t_s_n
call ebx
add esp, 8
push ebp
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x48], 1
call fcn.004149f0
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov edi, dword [edi]
test edi, edi
jne 0x413965
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x416580
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x433423
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x445018]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea ecx, [esi + 0xc]
mov dword [esi], vtable.CFileUploadTaskResponse.0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esi], vtable.yh_FileUpload::CPictureUploadResponse.0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
lea eax, [esi + 0x50]
push eax
mov byte [esp + 0x18], 1
call fcn.00415eb0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
Function at 0x41a140
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x432cf1
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x445018]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 4], vtable.yh_FileUpload::CFUNetWorkChannelObserver.0
mov dword [esi + 8], vtable.yh_FileUpload::UploadTaskManagerObserver.0
lea eax, [esi + 0x10]
mov dword [esi], vtable.yh_FileUpload::CUploadTaskManager.0
mov dword [esi + 4], vtable.yh_FileUpload::CUploadTaskManager.1.0
mov dword [esi + 8], vtable.yh_FileUpload::CUploadTaskManager.2.0
mov ebp, vtable.SyncVar_bool_.0
push eax
mov dword [esi + 0xc], ebp
call edi
mov byte [esi + 0x28], bl
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x2c], ebp
call edi
mov byte [esi + 0x48], bl
lea edx, [esi + 0x50]
push edx
mov dword [esi + 0x4c], ebp
call edi
mov byte [esi + 0x68], bl
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
lea eax, [esi + 0x94]
push eax
mov byte [esp + 0x20], 5
call fcn.00401e10
mov ebp, dword [sym.imp.MSVCR80.dll_malloc]
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x148], ebx
push 0x18
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x130], ebx
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x14c], ebx
mov dword [esi + 0x150], ebx
mov dword [esi + 0x70], ebx
call ebp
add esp, 4
cmp eax, ebx
je 0x41a250
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
jmp 0x41a252
xor eax, eax
push eax
mov dword [esi + 0x154], eax
call edi
push 0x18
call ebp
add esp, 4
cmp eax, ebx
je 0x41a279
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
jmp 0x41a27b
xor eax, eax
push eax
mov dword [0x4464d8], eax
call edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x421920
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x43438e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x445018]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov dword [esi], vtable.yh_FileUpload::CFUNetWorkChannel.0
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov byte [esp + 0x20], 1
call fcn.00425ac0
mov dword [esi + 0x2c], eax
mov byte [eax + 0x65], 1
mov eax, dword [esi + 0x2c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x2c]
mov dword [eax], eax
mov eax, dword [esi + 0x2c]
mov dword [eax + 8], eax
mov dword [esi + 0x30], ebx
mov eax, dword [esp + 0x2c]
mov edi, dword [sym.imp.MSVCR80.dll_malloc]
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
push 0x18
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0x34], ebx
mov byte [esi + 4], bl
mov byte [esi + 0x4c], bl
call edi
add esp, 4
cmp eax, ebx
je 0x4219cf
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
jmp 0x4219d1
xor eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push eax
mov dword [esi + 0x54], eax
call ebp
push 0x18
call edi
add esp, 4
cmp eax, ebx
je 0x4219fb
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
jmp 0x4219fd
xor eax, eax
push eax
mov dword [esi + 0x50], eax
call ebp
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x428787
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x1c
push esi
mov esi, ecx
push eax
lea ecx, [esp + 8]
push ecx
call fcn.004286c0
add esp, 8
cmp dword [eax + 0x18], 8
jb 0x4287a3
mov eax, dword [eax + 4]
jmp 0x4287a6
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [esp + 4]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov dword [esi + 4], 0x1f
pop esi
add esp, 0x1c
ret 4

Function at 0x4298a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4353c7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x445018]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 0xc]
mov dword [esi], vtable.SocketChannelParam.0
mov dword [esi + 4], 4
push eax
mov dword [esi + 8], vtable.SyncVar_enum_ChannelDivision::Value____cdecl___char___int__class_DivisionResult___.0
call edi
xor ebx, ebx
mov dword [esi + 0x24], ebx
lea ecx, [esi + 0x30]
mov dword [esp + 0x20], ebx
push ecx
mov dword [esi + 0x2c], vtable.SyncVar_class_IChannelCallback__.0
call edi
mov dword [esi + 0x48], ebx
mov byte [esp + 0x20], 1
mov dword [esi + 0x54], ebx
call fcn.0042cef0
push 0x1c
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], ebx
call dword [sym.imp.MSVCR80.dll_malloc]
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x429935
lea edx, [ebp + 4]
push edx
mov dword [ebp], vtable.CriticalObjectWapper.0
call edi
jmp 0x429937
xor ebp, ebp
mov dword [esi + 0x68], ebp
lea eax, [esi + 0x70]
push eax
mov dword [esi + 0x6c], vtable.SyncVar_enum_ChannelState::Value_.0
call edi
mov dword [esi + 0x88], 2
lea ecx, [esi + 0x94]
mov byte [esi + 0x8c], 1
push ecx
mov dword [esi + 0x90], vtable.SyncVar_bool_.0
call edi
mov byte [esi + 0xac], bl
mov edx, dword [esp + 0x2c]
lea eax, [esi + 0xb0]
push eax
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], edx
call edi
mov ebp, dword [sym.imp.MSVCR80.dll_malloc]
push 8
call ebp
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, ebx
mov byte [esp + 0x20], 5
je 0x4299ac
push eax
call fcn.0042d2b0
jmp 0x4299ae
xor eax, eax
push 0xc
mov dword [esi + 0x28], eax
call ebp
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x4299db
push 0x40000
mov dword [ebp + 4], 0x40000
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
mov dword [ebp], eax
mov dword [ebp + 8], ebx
jmp 0x4299dd
xor ebp, ebp
push 0x1c
mov dword [esi + 0x4c], ebp
call dword [sym.imp.MSVCR80.dll_malloc]
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x429a03
lea ecx, [ebp + 4]
push ecx
mov dword [ebp], vtable.CriticalObjectWapper.0
call edi
mov dword [esi + 0x50], ebp
jmp 0x429a06
mov dword [esi + 0x50], ebx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x429a50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4323bc
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x445018]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi], vtable.SocketChannelParam.0
mov dword [esp + 0x1c], 4
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x429a9e
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov dword [esi + 0x50], 0
mov edi, dword [esi + 0x4c]
test edi, edi
je 0x429ac4
mov eax, dword [edi]
test eax, eax
mov ebx, dword [sym.imp.MSVCR80.dll_free]
je 0x429ab7
push eax
call ebx
add esp, 4
push edi
call ebx
add esp, 4
mov dword [esi + 0x4c], 0
mov ecx, dword [esi + 0x28]
test ecx, ecx
je 0x429ad8
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
mov dword [esi + 0x28], 0
mov edi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea eax, [esi + 0xb0]
push eax
call edi
lea ecx, [esi + 0x94]
push ecx
mov dword [esi + 0x90], vtable.SyncVar_bool_.0
call edi
lea edx, [esi + 0x70]
push edx
mov dword [esi + 0x6c], vtable.SyncVar_enum_ChannelState::Value_.0
call edi
lea eax, [esi + 0x5c]
push eax
mov byte [esp + 0x20], 1
call fcn.0042c890
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x2c], vtable.SyncVar_class_IChannelCallback__.0
call edi
mov dword [esi + 8], vtable.SyncVar_enum_ChannelDivision::Value____cdecl___char___int__class_DivisionResult___.0
add esi, 0xc
push esi
call edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x42d7e0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x445018]
xor eax, esp
mov dword [esp + 0x1c], eax
xor edx, edx
push esi
mov dword [esp + 4], edx
mov esi, dword [ecx + 4]
cmp esi, edx
push edi
mov edi, dword [ebp + 8]
je 0x42d85b
lea eax, [esi + 0xc8]
push eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x14], dl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [esi + 0xe0]
lea ecx, [esp + 0xc]
call fcn.004021e0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x14], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x42d855
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
jmp 0x42d860
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x438598
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00431147
mov esp, ebp
pop ebp
ret 4

Function at 0x42d880
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x58
mov eax, dword [0x445018]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
mov dword [esp + 8], 0
mov esi, dword [ecx + 4]
test esi, esi
push edi
mov edi, dword [ebp + 8]
je 0x42d92c
lea eax, [esi + 0xc8]
push eax
mov dword [esp + 0x14], eax
mov byte [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [esi + 0xe0]
lea ecx, [esp + 0x10]
call fcn.004021e0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
push esi
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x42d926
push 0x31
push eax
lea edx, [esp + 0x31]
push edx
mov byte [esp + 0x34], al
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0x24]
add esp, 0xc
shr eax, 0x10
push eax
push 0x43879c
lea ecx, [esp + 0x30]
push 0x32
push ecx
call dword [sym.imp.MSVCR80.dll_sprintf_s]
add esp, 0x10
lea edx, [esp + 0x28]
push edx
jmp 0x42d931
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0x438598
mov ecx, edi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov ecx, dword [esp + 0x5c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00431147
mov esp, ebp
pop ebp
ret 4
Function at 0x431147
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x445018]
jne 0x431151
repz ret
jmp fcn.004315bc

Function at 0x410f5c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42104c]
jne 0x413fe3
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x422720], eax
mov dword [0x42271c], ecx
mov dword [0x422718], edx
mov dword [0x422714], ebx
mov dword [0x422710], esi
mov dword [0x42270c], edi
mov word [0x422738], ss
mov word [0x42272c], cs
mov word [0x422708], ds
mov word [0x422704], es
mov word [0x422700], fs
mov word [0x4226fc], gs
pushfd
pop dword [0x422730]
mov eax, dword [ebp]
mov dword [0x422724], eax
mov eax, dword [ebp + 4]
mov dword [0x422728], eax
lea eax, [ebp + 8]
mov dword [0x422734], eax
mov eax, dword [ebp - 0x320]
mov dword [0x422670], 0x10001
mov eax, dword [0x422728]
mov dword [0x422624], eax
mov dword [0x422618], 0xc0000409
mov dword [0x42261c], 1
mov eax, dword [0x42104c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x421050]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x422668], eax
push 1
call fcn.00415efd
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x402cf0
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x422668], 0
jne 0x4140cf
push 1
call fcn.00415efd
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x41334a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x413359
pop dword [ebp - 0x20]
mov eax, 0x11e358a8
sub eax, 0x11a2254f
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3bed9
push 0
mov eax, 0xce53749d
sub eax, 0xce13637d
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x4d01
xor ebx, ebx
add ebx, eax
mov esi, 0x1d06bf6e
sub esi, 0x1cc4496e
add esi, dword [ebp - 0x20]
mov edi, 0x50a56581
add edi, 0x61667011
sub dword [ebp - 0x10], edx
mov edx, dword [esi]
xor dword [ebp - 0x14], edx
xor edx, edi
xor dword [ebp - 0x14], 0xbde718c2
mov dword [ebx], edx
xor dword [ebp - 0x1c], 0x619fcf67
add ebx, 4
add esi, 0x1c92bc41
add esi, 0xe36d43c3
loop 0x4133b4
add eax, 0x126d7
xor ebx, ebx
add ebx, eax
add eax, 0x399ca0a3
add eax, 0xc6635f62
mov ecx, 0x78734f82
add ecx, 0x87ccb07e
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x10008660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000866f
pop dword [ebp - 0xc]
mov eax, 0xfc82f18f
add eax, 0x137d94e0
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x5b9531e
sub dword [ebp - 0x1c], 0xb7670dd3
mov dword [ebp - 0x18], 0x5a06b1e0
add dword [ebp - 0x18], 0xd82c9a65
mov dword [ebp - 0x14], 0x42e2854b
add dword [ebp - 0x14], 0x969bee3
mov dword [ebp - 0x10], 0xb71385d4
add dword [ebp - 0x10], 0x48ec7a2c
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x79c6c798
add eax, 0x963ae878
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x519d6a7d
add dword [ebp - 0x1c], 0x22d4fed9
mov dword [ebp - 0x18], 0xa3774d2b
sub dword [ebp - 0x18], 0x620aebb6
mov dword [ebp - 0x14], 0xa8fa4f4f
sub dword [ebp - 0x14], 0x458ae2e3
mov dword [ebp - 0x10], 0xedbeafd8
sub dword [ebp - 0x10], 0xedbeafd8
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3d0ed
push 0
call eax
mov ecx, 0x543c0250
add ecx, 0xabc440f7
xor edx, edx
add edx, eax
mov ebx, 0xdd6f15bd
sub ebx, 0xcd6c65bd
add ebx, dword [ebp - 0xc]
mov edi, 0x8b2212ca
add dword [ebp - 8], eax
mov esi, dword [ebx]
mov dword [ebp - 4], 0x3121bf9f
sub esi, edi
xor dword [ebp - 4], eax
mov dword [edx], esi
sub dword [ebp - 8], 0x128212cd
add edx, 0x9820e68
add edx, 0xf67df19c
add ebx, 0x578596fe
sub ebx, 0x578596fa
loop 0x10008788
add eax, 0xffef
xor ebx, ebx
add ebx, eax
add eax, 0xc04b404f
sub eax, 0xc04b404a
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x900c236
Capabilities:
Get common file path

Disassembly:
push 0x224
mov eax, 0x90a819f
call fcn.09007445
cmp byte [ebp + 0x10], 0
mov edi, dword [ebp + 8]
push 0x1a
pop esi
push 0x2b
pop eax
cmove esi, eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov eax, esi
or eax, 0x8000
cmp byte [ebp + 0xc], bl
push ebx
push ebx
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x900c292
xor al, al
jmp 0x900c2e2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0900cf2c
push dword [ebp + 0xc]
lea ecx, [ebp - 0x230]
mov dword [ebp - 4], ebx
push str.Adobe
call fcn.0900d7af
test al, al
je 0x900c2d5
lea eax, [ebp - 0x230]
mov ecx, edi
push eax
call fcn.0901bec8
mov ecx, edi
call fcn.0900e6d7
mov bl, al
lea ecx, [ebp - 0x230]
call fcn.0901bec8
mov al, bl
call fcn.090091e6
ret