joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42652f
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x439164]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x43c344
push ebx
call fcn.00410088
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4265ce
push 2
push 0
push esi
call fcn.0041054d
push esi
call fcn.0040f63e
add esp, 0x10
cmp eax, 0x2000
jle 0x4265dd
push 2
push 0xffffff00
push esi
call fcn.0041054d
push esi
push 0x100
lea eax, [ebp - 0x104]
push 1
push eax
call fcn.00410a42
push esi
mov edi, eax
call fcn.0040f1b7
push 0x43c348
push ebx
call fcn.00410088
add esp, 0x28
test edi, edi
mov esi, eax
jbe 0x4265dd
push 0x43c34c
push esi
call fcn.0040e846
push esi
push edi
lea eax, [ebp - 0x104]
push 1
push eax
call fcn.0040f005
add esp, 0x18
jmp 0x4265dd
push 0x43c350
push ebx
call fcn.00410088
pop ecx
pop ecx
mov esi, eax
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041070b
leave
ret

Function at 0x4272de
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x42731a
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.00426109
mov dword [0x441f58], eax
mov eax, dword [ebp - 0x3c]
add esp, 0x10
mov dword [0x441f54], eax
leave
ret

Function at 0x428208
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x439164]
xor eax, ebp
mov dword [ebp + 0x84], eax
push esi
xor esi, esi
push esi
lea eax, [ebp - 0x80]
push eax
push esi
push 2
push esi
push esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
je 0x428256
push eax
mov ecx, str.loadAtStartup:_Failed_openning_registry_key
call fcn.00427bd1
pop ecx
or eax, 0xffffffff
jmp 0x428298
push dword [0x43e498]
lea eax, [ebp - 0x7c]
push str.ruon._s
push eax
call fcn.0040f233
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp eax, esi
je 0x42828d
push eax
mov ecx, str.loadAtStartup:_Failed_removing_entry
call fcn.00427bd1
pop ecx
or esi, 0xffffffff
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
pop esi
call fcn.0041070b
add ebp, 0x88
leave
ret

Function at 0x4282ae
Capabilities:
Create thread

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0
mov esi, str.Agent_installed_successfuly
push esi
push 0x4273aa
push 0x4000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x427bc7
push esi
call fcn.0042647c
pop ecx
jmp 0x427bce
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
push edi
push 0
mov edi, 0x43c430
call fcn.0042740f
pop ecx
pop edi
jmp 0x427b99
Function at 0x4283eb
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x439164]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [esi + 0xc18]
push edi
push eax
mov edi, ecx
mov word [ebp - 0x14], 2
call sub.WS2_32.dll_htons
mov word [ebp - 0x12], ax
mov eax, dword [esi + 0xc28]
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 8]
push edi
push dword [esi]
call sub.WS2_32.dll_sendto
mov edi, eax
cmp edi, 0xffffffff
jne 0x42844d
push str.udpsend:_sendto_returned_with_an_error
mov dword [esi + 0xc20], 0xfffffffa
call fcn.004282c2
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0041070b
leave
ret

Function at 0x42845c
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
mov esi, dword [ebx]
xor eax, eax
inc eax
push edi
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x10c], eax
push 0x3c
pop eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10c]
xor edi, edi
xor ecx, ecx
cmp dword [ebp + 8], edi
push eax
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x108], esi
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x210]
je 0x4284ab
push eax
push edi
jmp 0x4284ad
push edi
push eax
lea eax, [esi + 1]
push eax
call sub.WS2_32.dll_select
cmp eax, edi
jge 0x4284db
cmp dword [ebp + 8], edi
mov eax, str.readytosend:_select_returned_an_error
jne 0x4284c9
mov eax, str.readytorecv:_select_returned_an_error
push eax
call fcn.004282c2
or eax, 0xffffffff
pop ecx
mov dword [ebx + 0xc20], eax
jmp 0x428547
lea eax, [ebp - 0x10c]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x428511
cmp dword [ebp + 8], edi
mov eax, str.readytosend:_disconnected__exception_bit_
jne 0x4284fb
mov eax, str.readytorecv:_disconnected__exception_bit_
push eax
call fcn.004282c2
mov dword [ebx + 0xc20], 0xfffffffa
pop ecx
or eax, 0xffffffff
jmp 0x428547
lea eax, [ebp - 0x210]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x428545
cmp dword [ebp + 8], edi
mov eax, str.readytosend:_timeout
jne 0x428531
mov eax, str.readytorecv:_timeout
push edi
mov edi, eax
call fcn.0042740f
mov dword [ebx + 0xc20], 0xfffffffb
jmp 0x42850b
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x428587
Capabilities:
Create thread

Disassembly:
call fcn.00426cc0
push 0
push 0
push eax
push 0x42797a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4285b1
push str.iao_spawnthread:_Failed_creating_thread
call fcn.004282c2
pop ecx
xor eax, eax
ret
Function at 0x428ac9
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push ebp
push edi
push closesocket
push 0x43c7a8
push 0
or ebp, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x428b3e
push ebx
push esi
push 0x20
call fcn.0042645e
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x428b2c
lea eax, [esp + 0x10]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x428b1c
xor ebp, ebp
jmp 0x428b27
push str.ServiceStop:_Sending_stop_signal_failed
call fcn.004282c2
pop ecx
push esi
call ebx
jmp 0x428b37
push str.ServiceStop:_Cant_open_service__assuming_not_there
call fcn.004282c2
pop ecx
push edi
call ebx
pop esi
pop ebx
jmp 0x428b49
push str.UninstallService:_Cant_open_the_Service_database
call fcn.004282c2
pop ecx
pop edi
mov eax, ebp
pop ebp
add esp, 0x1c
ret

Function at 0x428b51
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push ebp
push edi
push closesocket
push 0x43c700
push 0
or ebp, 0xffffffff
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x428bd2
push ebx
push esi
push 0x10020
call fcn.0042645e
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x428bbe
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x428bae
lea eax, [esp + 0x10]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
xor ebp, ebp
jmp 0x428bb9
push str.UninstallService:_Service_delete_failed
call fcn.004282c2
pop ecx
push esi
call ebx
jmp 0x428bcb
push str.UninstallService:_Cant_open_service__assuming_not_there
call fcn.004282c2
pop ecx
xor ebp, ebp
push edi
call ebx
pop esi
pop ebx
jmp 0x428bdd
push 0x43c774
call fcn.004282c2
pop ecx
pop edi
mov eax, ebp
pop ebp
add esp, 0x1c
ret
Function at 0x428c02
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0xdc]
sub esp, 0x15c
mov eax, dword [0x439164]
xor eax, ebp
mov dword [ebp + 0xd8], eax
push esi
xor esi, esi
push edi
lea eax, [ebp - 0x2c]
push 0x43c3d8
push eax
mov dword [ebp - 0x70], 0x44
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
mov word [ebp - 0x40], si
mov word [ebp - 0x3e], si
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
call fcn.0040f233
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push esi
push 0x8000000
push esi
push esi
push esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 1
jne 0x428ca1
push dword [ebp - 0x80]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x7c]
call esi
xor eax, eax
jmp 0x428caf
push str.span:_Spawn_failed
call fcn.004282c2
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp + 0xd8]
xor ecx, ebp
pop esi
call fcn.0041070b
add ebp, 0xdc
leave
ret

Function at 0x428cc5
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004122f0
mov eax, dword [0x439164]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x43c378
push eax
mov edi, ecx
call fcn.00410088
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x428d06
push str.copyfile:_Cant_open_src_file
call fcn.004282c2
pop ecx
or eax, 0xffffffff
jmp 0x428d30
push ebx
push 0x43c39c
push edi
call fcn.00410088
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x428d6b
push str.copyfile:_Cant_open_dst_file
call fcn.004282c2
push esi
call fcn.0040f1b7
pop ecx
pop ecx
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041070b
leave
ret
push esi
push 0x1000
lea eax, [ebp - 0x1004]
push 1
push eax
call fcn.00410a42
mov edi, eax
push ebx
push edi
lea eax, [ebp - 0x1004]
push 1
push eax
call fcn.0040f005
add esp, 0x20
cmp eax, edi
jne 0x428d7a
push esi
call fcn.0040f3ad
test eax, eax
pop ecx
je 0x428d3e
xor edi, edi
jmp 0x428d88
push str.copyfile:_Write_failed
call fcn.004282c2
pop ecx
or edi, 0xffffffff
push esi
call fcn.0040f1b7
push ebx
call fcn.0040f1b7
pop ecx
pop ecx
mov eax, edi
jmp 0x428d2f
Function at 0x428e8d
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x439164]
xor eax, esp
mov dword [esp + 0x194], eax
push esi
xor esi, esi
cmp dword [0x4423fc], esi
push edi
jne 0x428f5f
lea eax, [esp + 8]
push eax
push 2
call sub.WS2_32.dll_WSAStartup
cmp eax, esi
je 0x428f13
sub eax, 0x271e
je 0x428f03
sub eax, 0x16
je 0x428efc
sub eax, 0x1f
je 0x428ef5
sub eax, 0x18
je 0x428eee
dec eax
je 0x428ee7
push str.iao_tcpinit:_Unknow_reason
jmp 0x428f08
push str.iao_tcpinit:_WinSock_version__not_supported
jmp 0x428f08
push str.iao_tcpinit:_Underlying_network_subsystem_is_not_ready
jmp 0x428f08
push str.iao_tcpinit:_Maximum_WinSock_tasks_reached
jmp 0x428f08
push str.iao_tcpinit:_A_blocking_Windows_Sockets_1.1_operation_is_in_progress
jmp 0x428f08
push str.iao_tcpinit:_Invalid_pointer
call fcn.004282c2
pop ecx
or eax, 0xffffffff
jmp 0x428f61
call fcn.00401a3c
call fcn.00401646
call fcn.00401684
push eax
call fcn.0040106c
cmp eax, esi
pop ecx
mov dword [0x4423f8], eax
push esi
jne 0x428f3f
mov edi, str.Failed_creating_ssl_context
call fcn.0042740f
jmp 0x428f0d
push esi
push eax
call fcn.00401616
add esp, 0xc
call fcn.00428569
cmp eax, esi
mov dword [0x4423fc], eax
jne 0x428f5f
push esi
mov edi, str.Cant_create_gethostbyname_mutex
jmp 0x428f38
xor eax, eax
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
xor ecx, esp
call fcn.0041070b
mov esp, ebp
pop ebp
ret

Function at 0x428f75
Capabilities:
Resolve dns

Disassembly:
push esi
push 0xffffffffffffffff
push dword [0x4423fc]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x428f8f
call fcn.0042855a
push dword [esp + 8]
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x428fa3
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
mov eax, dword [esp + 8]
mov ecx, 0x43a7a4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x428fca
test dl, dl
je 0x428fc6
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x428fca
inc eax
inc eax
inc ecx
inc ecx
test dl, dl
jne 0x428fac
xor eax, eax
jmp 0x428fcf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x428fe5
test esi, esi
jne 0x428fdf
mov esi, dword [0x442400]
jmp 0x428fe5
mov dword [0x442400], esi
cmp dword [esp + 0xc], 0
je 0x428ff8
push dword [esp + 0xc]
mov eax, esi
call fcn.00426c77
pop ecx
push dword [0x4423fc]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp eax, 1
je 0x42900e
call fcn.0042854b
mov eax, esi
pop esi
ret
Function at 0x4291a2
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x439164]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x4435e0
lea eax, [ebp - 0x108]
push str._supgrade.exe
push eax
mov edi, ecx
call fcn.0040f233
lea eax, [ebp - 0x108]
push 0x43cde4
push eax
call fcn.00410088
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x429205
push str.upgrade:_Cant_write_binary
call fcn.004282c2
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
or eax, 0xffffffff
pop esi
call fcn.0041070b
leave
ret
push esi
push dword [ebp + 8]
push 1
push edi
call fcn.0040f005
push esi
call fcn.0040f1b7
push 0
mov edi, str.upgrade:_tmp_binary_written._executing...
call fcn.0042740f
add esp, 0x18
lea edi, [ebp - 0x108]
call fcn.00428c02
cmp eax, 0xffffffff
jne 0x42923d
push str.Cant_run_upgrade_image
jmp 0x4291ee
call fcn.00428ac9
test eax, eax
jne 0x429253
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x429260
push 0
mov edi, str.upgrade:_Couldnt_stop_service
call fcn.0042740f
pop ecx
push 0xffffffffffffffff
call fcn.0040f93c
int3
Function at 0x429268
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x18c]
sub esp, 0x20c
mov eax, dword [0x439164]
xor eax, ebp
mov dword [ebp + 0x188], eax
push ebx
push esi
call fcn.00428208
mov ebx, 0x4435e0
mov esi, ebx
call fcn.0042731c
lea eax, [ebp - 0x80]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4292ce
push str.uninstall:_Couldnt_obtain_TEMP_path__neccessary_to_perform_uninstall
call fcn.004282c2
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp + 0x188]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041070b
add ebp, 0x18c
leave
ret
mov eax, 0x43ccd8
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4292d5
push edi
lea edi, [ebp - 0x80]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4292e3
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x43e498]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x429300
lea edi, [ebp - 0x80]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x42930f
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, str..bat
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42932c
lea edi, [ebp - 0x80]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x42933b
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x80]
and ecx, 3
push 0x43cce4
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00410088
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x42937b
push str.uninstall:_Cant_create_uninst.bat
call fcn.004282c2
pop ecx
or eax, 0xffffffff
pop edi
jmp 0x4292b7
push 0x5c
push 0x2f
mov esi, ebx
call fcn.00426628
push str._echo_off_n
push edi
call fcn.0040e846
push dword [0x43e494]
push str.echo_Uninstalling_R_U_ON_agent__s_..._n
push edi
call fcn.0040e846
push str.ping__w_1000__n_10_127.0.0.1___NUL_n
push edi
call fcn.0040e846
push 0x443700
push ebx
push str.del___s_s__n
push edi
call fcn.0040e846
push ebx
push str.rmdir__q___s__n
push edi
call fcn.0040e846
add esp, 0x40
push dword [0x43e494]
push str.echo_Done._n
push edi
call fcn.0040e846
push str.ping__w_1000__n_2_127.0.0.1___NUL_n
push edi
call fcn.0040e846
lea eax, [ebp - 0x80]
push eax
push str.del__s_n
push edi
call fcn.0040e846
push edi
call fcn.0040f1b7
add esp, 0x24
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edi, [ebp - 0x80]
call fcn.00428c02
call fcn.00428b51
cmp eax, 0xffffffff
jne 0x429429
push str.Uninstall_service_failed
call fcn.004282c2
pop ecx
push 0xffffffffffffffff
call fcn.0040f93c
int3
Function at 0x4294c0
Capabilities:
Create service
Modify service
Persist via windows service
Start service

Disassembly:
push ebp
lea ebp, [esp - 0x390]
sub esp, 0x410
mov eax, dword [0x439164]
xor eax, ebp
mov dword [ebp + 0x38c], eax
or dword [ebp - 0x78], 0xffffffff
push esi
push edi
push 2
push 0x43c63c
xor esi, esi
push esi
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, esi
mov dword [ebp - 0x7c], eax
je 0x4295b2
push ebx
push edi
lea eax, [ebp - 0x74]
push str._s_service
push eax
call fcn.0040f233
add esp, 0xc
push 0x442425
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
push 1
push 2
push 0x110
push 0x20000006
call fcn.00426440
push eax
call fcn.0042645e
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebx, eax
cmp ebx, esi
je 0x42959b
call fcn.00426422
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x80]
push eax
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
lea eax, [ebp - 0x78]
push eax
push 1
push ebx
mov dword [ebp - 0x78], 0x43c4fc
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x42957e
call fcn.00428be5
mov dword [ebp - 0x78], eax
jmp 0x429581
mov dword [ebp - 0x78], esi
cmp dword [ebp - 0x78], esi
jne 0x429592
push esi
mov edi, str.InstallService:_Agent_Service_installed.
call fcn.0042740f
pop ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4295a6
push str.InstallService:_Error_creating_the_Agent_Service_in_the_Service_Database
call fcn.004282c2
pop ecx
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
jmp 0x4295bd
push str.InstallService:_Cant_open_Service_Database
call fcn.004282c2
pop ecx
mov ecx, dword [ebp + 0x38c]
mov eax, dword [ebp - 0x78]
pop edi
xor ecx, ebp
pop esi
call fcn.0041070b
add ebp, 0x390
leave
ret

Function at 0x42991c
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0xc28], 0
je 0x429933
push dword [esp + 8]
call fcn.004283eb
jmp 0x42998e
mov eax, dword [esi + 0xc24]
test eax, eax
jne 0x429965
push eax
push dword [esp + 0xc]
push ecx
push dword [esi]
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
jne 0x42998f
push str.iao_send:_send_returned_with_an_error
mov dword [esi + 0xc20], 0xfffffffa
call fcn.004282c2
jmp 0x42998b
push dword [esp + 8]
push ecx
push eax
call fcn.004010d9
add esp, 0xc
test eax, eax
jg 0x42998f
push str.iao_send:_SSL_write_returned_with_an_error
call fcn.004282c2
mov dword [esi + 0xc20], 0xfffffffa
or eax, 0xffffffff
pop ecx
pop esi
ret
Function at 0x429991
Capabilities:
Set socket configuration

Disassembly:
push ebp
lea ebp, [esp - 0x188]
sub esp, 0x208
mov eax, dword [0x439164]
xor eax, ebp
mov dword [ebp + 0x184], eax
push ebx
push esi
push edi
push dword [0x4423f8]
mov esi, ecx
xor ebx, ebx
call fcn.00401093
test eax, eax
pop ecx
mov dword [esi + 0xc24], eax
je 0x429a66
push dword [esi]
xor edi, edi
inc edi
push eax
mov ebx, edi
call fcn.004010c7
test eax, eax
pop ecx
pop ecx
je 0x429a66
call fcn.0042794d
test eax, eax
je 0x429a66
push 2
pop ebx
lea eax, [ebp - 0x80]
push eax
push 0x8004667e
push dword [esi]
mov dword [ebp - 0x80], edi
call sub.WS2_32.dll_ioctlsocket
test eax, eax
jne 0x429a66
push dword [esi + 0xc24]
call fcn.004016a5
mov ebx, eax
sub eax, 0
pop ecx
je 0x429a5d
dec eax
je 0x429acd
push ebx
push dword [esi + 0xc24]
call fcn.00401124
pop ecx
pop ecx
mov ecx, eax
dec ecx
dec ecx
je 0x429a4a
dec ecx
jne 0x429aab
push edi
mov ebx, esi
call fcn.0042845c
neg eax
pop ecx
sbb eax, eax
inc eax
push 6
jmp 0x429a61
push 0
mov ebx, esi
call fcn.0042845c
neg eax
pop ecx
sbb eax, eax
inc eax
push 5
jmp 0x429a61
xor eax, eax
push 4
test eax, eax
pop ebx
jne 0x429a07
push ebx
lea eax, [ebp - 0x7c]
push str.iao_sslconnect:_SSL_connect_failed__stage__d_
push eax
call fcn.0040f233
lea eax, [ebp - 0x7c]
push eax
call fcn.004282c2
add esp, 0x10
mov dword [esi + 0xc20], 0xfffffff9
call fcn.00426b52
or eax, 0xffffffff
mov ecx, dword [ebp + 0x184]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041070b
add ebp, 0x188
leave
ret
push eax
push ebx
lea eax, [ebp - 0x7c]
push str.iao_sslconnect:_SSL_get_error__d__d
push eax
call fcn.0040f233
push 0
lea edi, [ebp - 0x7c]
call fcn.0042740f
add esp, 0x14
push 7
pop ebx
jmp 0x429a66
call fcn.00427922
xor eax, eax
jmp 0x429a93
Function at 0x429ad6
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Get hostname
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x439164]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
xor ebx, ebx
push edi
inc ebx
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0x10
call fcn.00428e8d
mov eax, esi
call fcn.00426c3e
lea eax, [esi + 0x818]
push eax
push edi
call fcn.00428f75
test eax, eax
pop ecx
pop ecx
jne 0x429b36
push str.iao_connect:_Cant_translate_host_to_ip
call fcn.004282c2
pop ecx
mov dword [esi + 0xc20], 0xfffffffe
or eax, 0xffffffff
jmp 0x429c40
mov ecx, edi
lea edi, [esi + 0x418]
sub edi, ecx
mov dl, byte [ecx]
mov byte [edi + ecx], dl
inc ecx
test dl, dl
jne 0x429b40
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x14], eax
mov word [ebp - 0x18], 2
call sub.WS2_32.dll_htons
push 0
push ebx
push 2
mov word [ebp - 0x16], ax
call sub.WS2_32.dll_socket
or ebx, 0xffffffff
cmp eax, ebx
mov dword [esi], eax
jne 0x429b8b
push str.iao_connect:_Cant_obtain_file_descriptor
call fcn.004282c2
pop ecx
mov dword [esi + 0xc20], ebx
mov eax, ebx
jmp 0x429c40
push 4
lea ecx, [ebp - 0x30]
push ecx
push 8
push 0xffff
push eax
call sub.WS2_32.dll_setsockopt
cmp eax, ebx
jne 0x429bba
push str.iao_connect:_Set_keep_alive_on_socket_failed
call fcn.004282c2
mov dword [esi + 0xc20], ebx
pop ecx
call fcn.00426b52
jmp 0x429b84
push 0x10
lea eax, [ebp - 0x18]
push eax
push dword [esi]
call sub.WS2_32.dll_connect
cmp eax, ebx
jne 0x429bf8
call sub.WS2_32.dll_WSAGetLastError
mov edi, eax
push edi
call sub.WS2_32.dll_WSASetLastError
xor eax, eax
cmp edi, 0x274d
setne al
push str.iao_connect:_Remote_host_unreachable
add eax, 0xfffffffc
mov dword [esi + 0xc20], eax
call fcn.004282c2
jmp 0x429bb2
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [esi]
call sub.WS2_32.dll_getsockname
cmp eax, ebx
je 0x429c1b
lea eax, [esi + 0x404]
push eax
mov eax, dword [ebp - 0x24]
call fcn.00426c77
pop ecx
mov dword [esi + 0xc18], edi
push 0x400
lea edi, [esi + 4]
push edi
call sub.WS2_32.dll_gethostname
test eax, eax
je 0x429c3e
mov esi, str.undetermined
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041070b
leave
ret