joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e60
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x18
mov dword [esp], str.Closing_this_connection_r_n
call dbg.logEvent
call dbg.closeAllPortForwardingConnections
mov eax, dword [0x44d1e4]
test eax, eax
jle 0x405e85
call dbg._closesocket
call dbg.stopStreaming
call dbg.stopMalwareProtection
call dbg.resetGlobalSocketVars
cmp dword [0x4454c4], 2
je 0x405ec3
mov dword [esp + 4], ebx
mov dword [esp], str.Waiting__d_seconds..._r_n
imul ebx, ebx, 0x3e8
call dbg.logEvent
mov dword [esp], ebx
call sym._Sleep_4
sub esp, 4
add esp, 0x18
pop ebx
ret
mov eax, dword [0x44d1e0]
test eax, eax
je 0x405e9d
mov dword [esp], str.This_process_is_proxy_BKG_process__terminating_as_no_longer_needed__we_will_not_reconnect_._r_n
call dbg.logEvent
call sym._GetCurrentProcess_0
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._TerminateProcess_8
sub esp, 8
add esp, 0x18
pop ebx
ret

Function at 0x405f00
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], str.ERROR_thrown:__s__d_r_n
call dbg.logEvent
mov eax, 5
add esp, 0x1c
jmp dbg.socketClosed

Function at 0x405f30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._recv_16
sub esp, 0x10
test eax, eax
mov ebx, eax
je 0x405f68
js 0x405f70
mov dword [esp], 0
call sym._time
mov dword [0x44cd9c], eax
add esp, 0x18
mov eax, ebx
pop ebx
ret
call sym._WSAGetLastError_0
cmp eax, 0x2733
mov ebx, 0xffffd8cd
je 0x405f68
mov edx, eax
mov eax, str.Socket_error_on_recv___in__readsocket__._Remote_connection_lost_
mov ebx, 0xffffffff
call dbg.handleSocketError
jmp 0x405f68

Function at 0x405fa0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push ebx
mov esi, eax
sub esp, 0x14
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
cmp eax, 0xffffffff
mov ebx, eax
je 0x405fd1
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret
call sym._WSAGetLastError_0
cmp eax, 0x2733
je 0x405ff3
cmp esi, dword [0x44d1e4]
jne 0x405fc9
mov edx, eax
mov eax, str.Socket_error_on_send___in__writesocket__._Remote_connection_lost_
call dbg.handleSocketError
jmp 0x405fc9
xor ebx, ebx
jmp 0x405fc9
Function at 0x406210
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
call dbg.isConsoleProcessRunning
test eax, eax
jne 0x406220
add esp, 0x1c
ret
mov eax, dword [0x445ee0]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._TerminateProcess_8
sub esp, 8
test eax, eax
je 0x4062a0
mov dword [esp], str.Console_process_successfully_terminated_r_n
call dbg.logEvent
mov eax, dword [0x445ee0]
mov dword [esp], eax
call sym._CloseHandle_4
mov eax, dword [0x445ee4]
sub esp, 4
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [0x445ee0], 0
mov dword [0x445ee4], 0
mov dword [0x445ee8], 0
mov dword [0x445eec], 0
add esp, 0x1c
jmp dbg.resetConsoleProcessGlobalVars
call sym._GetLastError_0
mov dword [esp], str.Console_error:_Unable_to_terminate_process._Error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x406248

Function at 0x406470
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
call dbg.isTaskStillRunning
test eax, eax
jne 0x406480
add esp, 0x1c
ret
mov eax, dword [0x445a98]
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._TerminateProcess_8
sub esp, 8
test eax, eax
je 0x4064b0
mov dword [esp], str.Task_process_successfully_terminated_r_n
call dbg.logEvent
add esp, 0x1c
jmp dbg.cleanupTaskProcess
call sym._GetLastError_0
mov dword [esp], str.Task_error:_Unable_to_terminate_process._Error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
add esp, 0x1c
jmp dbg.cleanupTaskProcess

Function at 0x4064d0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x30
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
mov dword [esp], str..mailslot_remotely_mailslot
call sym._CreateFileA_28
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x406592
mov dword [esp], esi
mov ebx, eax
call sym._strlen
lea edx, [esp + 0x2c]
add eax, 1
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp + 0xc], edx
mov dword [esp], ebx
call sym._WriteFile_20
sub esp, 0x14
test eax, eax
mov edi, eax
jne 0x406580
call sym._GetLastError_0
mov dword [esp], str.Mailslot_WriteFile_failed_with__d._r_n
mov dword [esp + 4], eax
call dbg.logEvent
mov dword [esp], ebx
call sym._CloseHandle_4
sub esp, 4
mov eax, edi
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], esi
mov dword [esp], str.Message___s__sent_to_mailslot_for_service_to_receive_r_n
call dbg.logEvent
jmp 0x406567
call sym._GetLastError_0
mov dword [esp], str.Mailslot_CreateFile_failed_with__d._r_n
mov dword [esp + 4], eax
xor edi, edi
call dbg.logEvent
add esp, 0x30
mov eax, edi
pop ebx
pop esi
pop edi
ret
Function at 0x406c30
Capabilities:
Start service

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov dword [esp + 8], 0xf003f
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._OpenSCManagerA_12
sub esp, 0xc
test eax, eax
je 0x406cf0
mov dword [esp + 8], 0xf01ff
mov dword [esp + 4], str.RemotelyClient
mov ebx, eax
mov dword [esp], eax
call sym._OpenServiceA_12
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x406d10
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._StartServiceA_12
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x406cd0
mov edi, 1
mov dword [esp], esi
call sym._CloseServiceHandle_4
sub esp, 4
mov dword [esp], ebx
call sym._CloseServiceHandle_4
sub esp, 4
add esp, 0x10
mov eax, edi
pop ebx
pop esi
pop edi
ret
call sym._GetLastError_0
mov dword [esp], str.StartServiceA_failed___lu__r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x406caa
call sym._GetLastError_0
mov dword [esp], str.OpenSCManager_failed___lu__r_n
mov dword [esp + 4], eax
xor edi, edi
call dbg.logEvent
add esp, 0x10
mov eax, edi
pop ebx
pop esi
pop edi
ret
call sym._GetLastError_0
mov dword [esp], str.OpenService_failed___lu__r_n
mov dword [esp + 4], eax
xor edi, edi
call dbg.logEvent
mov dword [esp], ebx
call sym._CloseServiceHandle_4
sub esp, 4
jmp 0x406cc0

Function at 0x406e30
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push edi
push esi
mov ecx, 0x11
push ebx
mov esi, eax
xor eax, eax
sub esp, 0x180
mov dword [0x445ed0], 0
mov dword [0x445ed4], 0
lea ebx, [esp + 0x38]
mov dword [0x445ed8], 0
mov dword [0x445edc], 0
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [0x445ec4]
lea edi, [esp + 0x7c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], str.cmd__c__s__NUL
mov dword [esp + 4], 0x104
mov dword [esp], edi
mov dword [esp + 0x38], 0x44
mov dword [esp + 0x78], eax
mov dword [esp + 0x74], eax
mov eax, dword [0x445ec8]
mov dword [esp + 0x64], 0x100
mov dword [esp + 0x70], eax
call sym.___mingw_snprintf
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0x445ed0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], 0
call sym._CreateProcessA_40
mov ebx, eax
mov eax, dword [0x445ec4]
sub esp, 0x28
mov dword [esp], eax
call sym._CloseHandle_4
mov eax, dword [0x445ec8]
sub esp, 4
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
test ebx, ebx
jne 0x406f45
mov dword [esp], str.WMIC_error:_CreateProcessA_r_n
call dbg.logEvent
add esp, 0x180
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], esi
mov dword [esp + 8], 0x400
mov ebx, 1
mov dword [esp], 0x445ac0
call sym._strncpy
mov dword [esp], str.WMIC_process_successfully_created__r_n
call dbg.logEvent
add esp, 0x180
mov eax, ebx
pop ebx
pop esi
pop edi
ret
Function at 0x406f80
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push esi
push ebx
mov esi, eax
sub esp, 0x34
lea ebx, [esp + 0x24]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x445ec4
mov dword [esp], 0x445ec0
mov dword [esp + 0x24], 0xc
mov dword [esp + 8], ebx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0
call sym._CreatePipe_16
sub esp, 0x10
test eax, eax
je 0x407070
mov eax, dword [0x445ec0]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._SetHandleInformation_12
sub esp, 0xc
test eax, eax
je 0x407050
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x445ecc
mov dword [esp], 0x445ec8
call sym._CreatePipe_16
sub esp, 0x10
test eax, eax
je 0x4070b0
mov eax, dword [0x445ecc]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._SetHandleInformation_12
sub esp, 0xc
test eax, eax
je 0x407090
mov eax, esi
call dbg.createWmicProcess
add esp, 0x34
pop ebx
pop esi
ret
mov dword [esp], str.WMIC_error:_Cannot_SetHandleInformation_for_STDOUT_r_n
mov dword [esp + 0x1c], eax
call dbg.logEvent
mov eax, dword [esp + 0x1c]
add esp, 0x34
pop ebx
pop esi
ret
mov dword [esp], str.WMIC_error:_Cannot_CreatePipe_for_STDOUT_r_n
mov dword [esp + 0x1c], eax
call dbg.logEvent
mov eax, dword [esp + 0x1c]
add esp, 0x34
pop ebx
pop esi
ret
mov dword [esp], str.WMIC_error:_Cannot_SetHandleInformation_for_STDIN_r_n
mov dword [esp + 0x1c], eax
call dbg.logEvent
mov eax, dword [esp + 0x1c]
jmp 0x407064
mov dword [esp], str.WMIC_error:_Cannot_CreatePipe_for_STDIN_r_n
mov dword [esp + 0x1c], eax
call dbg.logEvent
mov eax, dword [esp + 0x1c]
add esp, 0x34
pop ebx
pop esi
ret
Function at 0x407370
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, eax
sub esp, 0x38c
lea ebx, [esp + 0x38]
mov dword [esp + 4], eax
mov dword [esp], str.Scanning__s_for_malware..._r_n
lea ebp, [esp + 0x240]
mov dword [esp + 0x2c], eax
call dbg.logEvent
mov dword [esp + 0xc], esi
mov dword [esp], ebx
mov dword [esp + 8], 0x434871
mov dword [esp + 4], 0x104
call sym.___mingw_snprintf
mov dword [esp], ebx
mov dword [esp + 4], ebp
call sym._FindFirstFileA_8
sub esp, 8
cmp eax, 0xffffffff
mov edi, eax
lea ebx, [esp + 0x26c]
lea esi, [esp + 0x13c]
jne 0x407483
jmp 0x40750c
mov edx, ebx
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x4073e6
test eax, 0x8080
jne 0x407409
shr eax, 0x10
add edx, 2
mov ecx, eax
add cl, al
sbb edx, 3
sub edx, ebx
cmp byte [esp + edx + 0x26b], 0x2e
je 0x407458
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], str._s_s_
mov dword [esp + 4], 0x104
mov dword [esp], esi
mov dword [esp + 0xc], eax
call sym.___mingw_snprintf
mov dword [esp + 4], str._Recycle.Bin_
mov dword [esp], esi
call sym._strstr
test eax, eax
je 0x407500
mov dword [esp], 0xa
call sym._Sleep_4
sub esp, 4
mov dword [esp + 4], ebp
mov dword [esp], edi
call sym._FindNextFileA_8
sub esp, 8
test eax, eax
je 0x4074e3
mov eax, dword [0x445458]
test eax, eax
je 0x4074e3
test byte [esp + 0x240], 0x10
jne 0x4073e4
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], str._s_s
mov dword [esp + 4], 0x104
mov dword [esp], esi
mov dword [esp + 0xc], eax
call sym.___mingw_snprintf
mov eax, esi
call dbg.malwareTargetFile
test eax, eax
je 0x407458
mov dword [esp + 4], esi
mov dword [esp], str.Adding_file_to_scan_queue:__s_r_n
call dbg.logEvent
call dbg.waitForMalwareScanQueueToEmpty
xor edx, edx
mov eax, esi
call dbg.addPathnameToMalwareScanQueue
jmp 0x407458
mov dword [esp], edi
call sym._FindClose_4
sub esp, 4
add esp, 0x38c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, esi
call dbg.scanFolderForMalware
jmp 0x407458
call sym._GetLastError_0
cmp eax, 2
je 0x4074ee
mov dword [esp + 4], eax
mov dword [esp], str.FindFirstFile_failed_in_scanSystemForMalware___with_error_code__d_r_n
call dbg.logEvent
jmp 0x4074ee
Function at 0x407530
Capabilities:
Get disk information

Disassembly:
push edi
push esi
push ebx
sub esp, 0x120
lea edi, [esp + 0x1c]
mov dword [esp], 0x104
mov dword [esp + 4], edi
call sym._GetLogicalDriveStringsA_8
sub esp, 8
test eax, eax
je 0x4075d0
xor ebx, ebx
cmp byte [esp + 0x1c], 0
mov dword [0x445458], 1
je 0x4075c0
mov esi, esi
lea edi, [edi]
lea esi, [edi + ebx]
mov eax, esi
call dbg.scanFolderForMalware
mov dword [esp], esi
call sym._strlen
lea ebx, [ebx + eax + 1]
cmp byte [esp + ebx + 0x1c], 0
jne 0x407570
mov eax, dword [0x445458]
test eax, eax
jne 0x4075c0
mov eax, str.AV_scan_aborted_at_request_of_technician_server_r_n
mov dword [esp], eax
call dbg.logEvent
mov dword [0x445458], 0
add esp, 0x120
xor eax, eax
pop ebx
pop esi
pop edi
ret
mov eax, str.Any_all_qualifying_files_added_to_AV_scan_queue_r_n
jmp 0x40759b
call sym._GetLastError_0
mov dword [esp], str.Call_to_GetLogicalDriveStringsW_failed_in_scanAllDrivesForMalware___with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
add esp, 0x120
mov eax, 1
pop ebx
pop esi
pop edi
ret

Function at 0x407600
Capabilities:
Query service status

Disassembly:
push edi
push esi
push ebx
sub esp, 0x50
mov dword [esp + 8], 0x80000000
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._OpenSCManagerA_12
sub esp, 0xc
test eax, eax
je 0x4076e4
mov dword [esp + 8], 4
mov dword [esp + 4], str.RemotelyClient
mov ebx, eax
mov dword [esp], eax
call sym._OpenServiceA_12
sub esp, 0xc
test eax, eax
mov esi, eax
je 0x407704
lea eax, [esp + 0x28]
mov dword [esp + 0xc], 0x24
mov dword [esp + 4], 0
mov dword [esp], esi
mov dword [esp + 0x10], eax
lea eax, [esp + 0x2c]
mov dword [esp + 8], eax
call sym._QueryServiceStatusEx_20
sub esp, 0x14
test eax, eax
mov edi, eax
je 0x4076b0
mov dword [esp], esi
call sym._CloseServiceHandle_4
sub esp, 4
mov dword [esp], ebx
call sym._CloseServiceHandle_4
sub esp, 4
xor eax, eax
cmp dword [esp + 0x30], 4
sete al
mov edi, eax
add esp, 0x50
mov eax, edi
pop ebx
pop esi
pop edi
ret
call sym._GetLastError_0
mov dword [esp], str.QueryServiceStatusEx_call_failed___lu____suspicious_r_n
mov dword [esp + 4], eax
call dbg.logEvent
mov dword [esp], esi
call sym._CloseServiceHandle_4
sub esp, 4
mov dword [esp], ebx
call sym._CloseServiceHandle_4
sub esp, 4
mov eax, edi
add esp, 0x50
pop ebx
pop esi
pop edi
ret
call sym._GetLastError_0
mov dword [esp], str.OpenSCManager_call_failed___lu__r_n
mov dword [esp + 4], eax
xor edi, edi
call dbg.logEvent
add esp, 0x50
mov eax, edi
pop ebx
pop esi
pop edi
ret
call sym._GetLastError_0
mov dword [esp], str.OpenService_call_failed___lu___correct_result_if_service_isnt_installed__and_we_will_make_that_assumption__r_n
mov dword [esp + 4], eax
xor edi, edi
call dbg.logEvent
mov dword [esp], ebx
call sym._CloseServiceHandle_4
sub esp, 4
jmp 0x4076a7
Function at 0x407860
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [0x44d1e4]
test eax, eax
je 0x407887
push ebp
push edi
push esi
push ebx
sub esp, 0x13c
mov ebx, dword [0x446b20]
test ebx, ebx
jne 0x407889
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
repz ret
mov dword [esp], 0x19000
call sym._malloc
test ebx, ebx
mov esi, eax
jle 0x407952
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x2c]
mov edi, 0x19000
mov ebx, dword [eax*4 + 0x445f20]
xor ebp, ebp
lea esi, [esi]
mov eax, edi
mov dword [esp + 0xc], 0
mov dword [esp], ebx
sub eax, ebp
mov dword [esp + 8], eax
lea eax, [esi + ebp]
mov dword [esp + 4], eax
call sym._recv_16
sub esp, 0x10
test eax, eax
jle 0x4078f2
add ebp, eax
cmp ebp, 0x18fff
jle 0x4078c0
jmp 0x4078f6
test ebp, ebp
je 0x407970
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], str.PDATA__d__d__d
mov dword [esp + 4], 0x100
mov eax, dword [edx*4 + 0x446720]
mov dword [esp + 0x14], eax
mov eax, dword [edx*4 + 0x446320]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x30]
mov dword [esp], eax
call sym.___mingw_snprintf
lea eax, [esp + 0x30]
mov ecx, ebp
mov edx, esi
call dbg.sendMessageWithData
add dword [esp + 0x2c], 1
mov eax, dword [esp + 0x2c]
cmp dword [0x446b20], eax
jg 0x4078b0
mov dword [esp], esi
call sym._free
call dbg.deleteForwardedSocketsFlaggedForDeletion
add esp, 0x13c
pop ebx
pop esi
pop edi
pop ebp
jmp 0x407887
test eax, eax
je 0x407980
call sym._WSAGetLastError_0
cmp eax, 0x2733
je 0x40793d
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax*4 + 0x446720]
mov edx, dword [eax*4 + 0x446320]
mov eax, ebx
call dbg.closeForwardedConnection
jmp 0x40793d
Function at 0x407ab0
Capabilities:
Get disk size

Disassembly:
push ebp
push edi
mov eax, 0x6d6c
push esi
push ebx
call fcn.00421710
mov ecx, 0x3f
mov ebx, 0x41
sub esp, eax
xor eax, eax
lea edi, [esp + 0x64]
mov dword [esp + 0x60], 0x5c3a3f
mov dword [esp + 0x560], 0x56495244
mov dword [esp + 0x564], 0x464e4945
mov dword [esp + 0x568], 0x4f
lea ebp, [esp + 0x58]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x56c]
mov dword [esp + 8], 0x67f4
mov dword [esp + 4], 0
lea edi, [esp + 0x50]
lea esi, [esp + 0x48]
mov dword [esp], eax
call sym._memset
mov dword [esp + 0x3c], 1
jmp 0x407b3c
add ebx, 1
cmp bl, 0x5b
je 0x407bec
lea eax, [esp + 0x60]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov byte [esp + 0x60], bl
mov dword [esp], eax
call sym._GetDiskFreeSpaceExA_16
sub esp, 0x10
test eax, eax
je 0x407b30
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
add ebx, 1
mov dword [esp + 8], str.__s__I64u__I64u__I64u
mov dword [esp + 4], 0x400
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], eax
lea eax, [esp + 0x160]
mov dword [esp], eax
call sym.___mingw_snprintf
lea eax, [esp + 0x160]
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
lea eax, [esp + 0x560]
mov dword [esp], eax
call sym._strncat
cmp bl, 0x5b
mov dword [esp + 0x3c], 0
jne 0x407b3c
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x407c00
lea eax, [esp + 0x560]
call dbg.sendMessage
add esp, 0x6d6c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x407c10
Capabilities:
Get memory capacity

Disassembly:
push ebx
sub esp, 0x498
lea eax, [esp + 0x50]
mov dword [esp + 0x50], 0x40
mov dword [esp], eax
call sym._GlobalMemoryStatusEx_4
sub esp, 4
test eax, eax
je 0x407d11
mov edx, dword [esp + 0x8c]
mov eax, dword [esp + 0x88]
lea ebx, [esp + 0x90]
mov dword [esp + 8], str.MEMINFO__ld__I64d__I64d__I64d__I64d__I64d__I64d__I64d
mov dword [esp + 4], 0x400
shrd eax, edx, 0xa
shr edx, 0xa
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
mov eax, dword [esp + 0x80]
mov edx, dword [esp + 0x84]
shrd eax, edx, 0xa
shr edx, 0xa
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
mov eax, dword [esp + 0x78]
mov edx, dword [esp + 0x7c]
shrd eax, edx, 0xa
shr edx, 0xa
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
shrd eax, edx, 0xa
shr edx, 0xa
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
shrd eax, edx, 0xa
shr edx, 0xa
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
shrd eax, edx, 0xa
shr edx, 0xa
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
shrd eax, edx, 0xa
shr edx, 0xa
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call sym.___mingw_snprintf
mov eax, ebx
call dbg.sendMessage
add esp, 0x498
pop ebx
ret
Function at 0x4081e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, dword [0x44f374]
test eax, eax
je 0x40820a
push ebp
push edi
mov edx, 1
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x44cd98]
call dbg.checkTimer
test eax, eax
jne 0x408210
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
repz ret
mov dword [esp], 0
call sym._time
mov dword [esp], 0
mov dword [0x44cd98], eax
call sym._OpenClipboard_4
sub esp, 4
test eax, eax
je 0x408290
mov dword [esp], 1
call sym._GetClipboardData_4
sub esp, 4
test eax, eax
mov ebx, eax
je 0x4083c0
mov dword [esp], eax
call sym._GlobalLock_4
sub esp, 4
test eax, eax
mov esi, eax
je 0x408420
mov dword [esp + 4], eax
mov dword [esp], 0x446da0
call sym._strcmp
test eax, eax
jne 0x4082b1
mov dword [esp], ebx
call sym._GlobalUnlock_4
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp sym._CloseClipboard_0
call sym._GetLastError_0
mov dword [esp], str.Call_to_OpenClipboard_failed_with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp 0x40820a
mov dword [esp + 8], 0x5ff5
mov dword [esp + 4], 0
mov dword [esp], 0x446da0
call sym._memset
mov dword [esp + 4], esi
mov dword [esp + 8], 0x5ff4
mov esi, 0x446da0
mov dword [esp], 0x446da0
call sym._strncpy
mov dword [esp], str.Clipboard_content_has_changed_r_n
call dbg.logEvent
mov dword [esp], ebx
call sym._GlobalUnlock_4
sub esp, 4
call sym._CloseClipboard_0
mov edx, dword [esi]
add esi, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x408306
test eax, 0x8080
jne 0x408329
shr eax, 0x10
add esi, 2
mov ecx, eax
add cl, al
sbb esi, 0x446da3
lea ebp, [esi + 1]
lea esi, [esi + esi + 6]
mov dword [esp], ebp
call sym._malloc
mov dword [esp], esi
mov ebx, eax
call sym._malloc
mov dword [esp + 8], ebp
mov dword [esp + 4], 0x446da0
mov edi, eax
mov dword [esp], ebx
call sym._strncpy
test ebp, ebp
mov eax, ebx
lea ecx, [ebx + ebp]
jg 0x40837c
jmp 0x408390
cmp dl, 0xa
je 0x408384
add eax, 1
cmp ecx, eax
je 0x408390
movzx edx, byte [eax]
cmp dl, 0xd
jne 0x408370
mov byte [eax], 0
jmp 0x408375
mov dword [esp], esi
mov ecx, edi
mov edx, ebp
mov eax, ebx
call dbg.base64encode
test eax, eax
jne 0x4083e0
mov dword [esp], edi
call sym._free
mov dword [esp], ebx
call sym._free
jmp 0x408203
call sym._GetLastError_0
mov dword [esp], str.Call_to_GetClipboardData_1__failed_with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x408281
add esi, 0x1c
mov dword [esp], esi
call sym._malloc
mov dword [esp + 0xc], edi
mov ebp, eax
mov dword [esp + 8], str.CLIPBOARD__s
mov dword [esp + 4], esi
mov dword [esp], eax
call sym.___mingw_snprintf
mov eax, ebp
call dbg.sendMessage
mov dword [esp], ebp
call sym._free
jmp 0x4083a2
call sym._GetLastError_0
mov dword [esp], str.Call_to_GlobalLock___in_checkClipboard___failed_with_error_code__d_r_n
mov dword [esp + 4], eax
call dbg.logEvent
jmp 0x408281
Function at 0x408560
Capabilities:
Terminate process

Disassembly:
push ebx
mov edx, eax
mov ebx, eax
sub esp, 0x18
mov eax, dword [0x44cd9c]
call dbg.checkTimer
test eax, eax
jne 0x408580
add esp, 0x18
pop ebx
ret
mov dword [esp + 4], ebx
mov dword [esp], str.No_activity_on_socket_connection_to_server_for_over__d_seconds._Assume_connection_is_stale._r_n
call dbg.logEvent
add esp, 0x18
mov eax, 5
pop ebx
jmp dbg.socketClosed

Function at 0x4085a0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push esi
push ebx
mov esi, eax
mov ebx, edx
sub esp, 0x34
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x10], eax
mov eax, dword [0x445ec0]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp], eax
call sym._PeekNamedPipe_24
sub esp, 0x18
test eax, eax
je 0x4085fd
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x408610
mov dword [ebx], 0
add esp, 0x34
pop ebx
pop esi
ret
mov dword [esp + 4], eax
mov dword [esp], str.Bytes_available_on_pipe_to_be_read__from_WMIC_process_STDOUT_:__d_r_n
call dbg.logEvent
mov edx, dword [esp + 0x2c]
mov eax, dword [ebx]
cmp eax, edx
jbe 0x40862c
mov eax, edx
mov dword [ebx], eax
mov dword [esp + 8], eax
lea edx, [esp + 0x28]
mov eax, dword [0x445ec0]
mov dword [esp + 4], esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp], eax
call sym._ReadFile_20
sub esp, 0x14
mov eax, dword [esp + 0x28]
mov dword [esp], str.Bytes_read_from_pipe__from_WMIC_process_STDOUT_:__d_r_n
mov dword [ebx], eax
mov dword [esp + 4], eax
call dbg.logEvent
add esp, 0x34
pop ebx
pop esi
ret