joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422df0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x45d780]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
mov esi, ecx
push 0xffffffffffffffff
push esi
mov dword [ebp - 0x10c], eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 0xffffffff
lea ecx, [esi + 4]
setne bl
call fcn.00401f30
test al, al
je 0x422e4f
mov ecx, dword [esi]
mov eax, dword [str.mzRkDcUhfbI]
push ecx
movzx edx, bl
push edx
push str.__d__socket___d
push eax
lea ecx, [esi + 8]
push ecx
call fcn.00404720
add esp, 0x14
test bl, bl
je 0x422f79
test edi, edi
je 0x422f79
mov ebx, dword [ebp + 0xc]
cmp ebx, 1
jb 0x422f79
push pe_nt_image_headers32
lea edx, [ebp - 0x104]
push 0
push edx
mov dword [ebp - 0x108], 0
call fcn.0042fa50
mov ecx, dword [ebp + 0x14]
add esp, 0xc
xor edx, edx
cmp ecx, 0xffffffff
je 0x422ebf
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov dword [ebp - 0x114], edx
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x3e8
mov dword [ebp - 0x110], ecx
lea edx, [ebp - 0x114]
mov ecx, dword [ebp - 0x108]
mov esi, dword [esi]
xor eax, eax
test ecx, ecx
je 0x422ede
lea ecx, [ecx]
cmp dword [ebp + eax*4 - 0x104], esi
je 0x422ede
inc eax
cmp eax, ecx
jb 0x422ed0
cmp eax, ecx
jne 0x422ef4
cmp ecx, 0x40
jae 0x422ef4
mov dword [ebp + eax*4 - 0x104], esi
inc dword [ebp - 0x108]
test edx, edx
je 0x422f0f
push edx
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x422f61
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x422f38
lea ecx, [ebp - 0x10c]
push ecx
push eax
push 0
push ebx
push edi
push esi
mov dword [ebp - 0x10c], 0x80
call dword [sym.imp.WS2_32.dll_recvfrom]
jmp 0x422f43
push 0
push ebx
push edi
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x422f61
push 0x2746
call dword [sym.imp.WS2_32.dll_WSASetLastError]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x422f79
cmp eax, 0xffffffff
jne 0x422f75
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x422f79
test eax, eax
jns 0x422f7c
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430215
mov esp, ebp
pop ebp
ret 0x10
Function at 0x422f90
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x45d780]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0xffffffffffffffff
mov esi, ecx
push 0xffffffffffffffff
push esi
mov dword [ebp - 0x10c], eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 0xffffffff
lea ecx, [esi + 4]
setne bl
call fcn.00401f30
test al, al
je 0x422fef
mov ecx, dword [esi]
mov eax, dword [str.mzRkDcUhfbI]
push ecx
movzx edx, bl
push edx
push str.__d__socket___d
push eax
lea ecx, [esi + 8]
push ecx
call fcn.00404720
add esp, 0x14
test bl, bl
je 0x4230e6
test edi, edi
je 0x4230e6
push pe_nt_image_headers32
lea edx, [ebp - 0x104]
push 0
push edx
mov dword [ebp - 0x108], 0
call fcn.0042fa50
mov ecx, dword [ebp + 0x14]
add esp, 0xc
xor edx, edx
cmp ecx, 0xffffffff
je 0x423053
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov dword [ebp - 0x114], edx
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x3e8
mov dword [ebp - 0x110], ecx
lea edx, [ebp - 0x114]
mov ecx, dword [ebp - 0x108]
mov esi, dword [esi]
xor eax, eax
test ecx, ecx
je 0x42306f
cmp dword [ebp + eax*4 - 0x104], esi
je 0x42306f
inc eax
cmp eax, ecx
jb 0x423061
cmp eax, ecx
jne 0x423085
cmp ecx, 0x40
jae 0x423085
mov dword [ebp + eax*4 - 0x104], esi
inc dword [ebp - 0x108]
test edx, edx
je 0x4230a0
push edx
push 0
lea eax, [ebp - 0x108]
push eax
push 0
push esi
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x4230ce
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x4230c0
mov ecx, dword [ebp + 0xc]
push 0x80
push eax
push 0
push ecx
push edi
push esi
call dword [sym.imp.WS2_32.dll_sendto]
jmp 0x4230ce
mov edx, dword [ebp + 0xc]
push 0
push edx
push edi
push esi
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x4230e2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4230e6
test eax, eax
jns 0x4230e9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430215
mov esp, ebp
pop ebp
ret 0x10

Function at 0x423100
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x45d780]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x18e
push eax
lea ecx, [ebp - 0x192]
push ecx
mov word [ebp - 0x194], ax
call fcn.0042fa50
mov eax, dword [ebp + 8]
add esp, 0xc
lea edx, [ebp - 0x194]
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor ecx, ecx
test eax, eax
mov dword [0x45d2cc], eax
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430215
mov esp, ebp
pop ebp
ret
Function at 0x423360
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x45d780]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x110], eax
test eax, eax
je 0x423485
cmp dword [ebp + 0xc], 0
jbe 0x423485
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.0042fa50
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x42347c
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x423412
mov edx, dword [eax]
lea eax, [ebp - 0x108]
mov ecx, eax
push esi
mov esi, 0x104
sub edx, ecx
lea esp, [esp]
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x423409
mov cl, byte [edx + eax]
test cl, cl
je 0x423409
mov byte [eax], cl
inc eax
dec esi
jne 0x4233f0
jmp 0x42340d
test esi, esi
jne 0x42340e
dec eax
mov byte [eax], 0
pop esi
push edi
lea edi, [ebp - 0x10c]
mov ecx, 0x104
lea edx, [ebp - 0x108]
mov dword [ebp - 0x10c], 0
call fcn.00422aa0
pop edi
test eax, eax
js 0x423447
mov edx, dword [ebp - 0x10c]
cmp edx, dword [ebp + 0xc]
jbe 0x423447
push 0x7a
jmp 0x423487
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x110]
push eax
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x108]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430215
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
jmp 0x423487
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
call fcn.00430215
mov esp, ebp
pop ebp
ret
Function at 0x4234a0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x45d780]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
movsx ecx, word [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x41c], eax
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], eax
push 0x206
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x412]
xor edx, edx
push ebx
push eax
mov dword [ebp - 0x420], 0x30
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x440], 0x400
mov dword [ebp - 0x43c], ecx
mov word [ebp - 0x414], dx
call fcn.0042fa50
add esp, 0xc
cmp esi, ebx
je 0x423544
cmp word [esi], bx
jne 0x42355e
lea ecx, [ebp - 0x414]
push 0x104
push ecx
call fcn.00423360
add esp, 8
lea esi, [ebp - 0x414]
cmp edi, ebx
je 0x423567
cmp word [edi], bx
jne 0x42356d
lea edi, [ebp - 0x420]
push 0x103
lea edx, [ebp - 0x20b]
push ebx
push edx
mov byte [ebp - 0x20c], bl
call fcn.0042fa50
add esp, 0xc
push ebx
push ebx
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push 0xfde9
call esi
push 0x103
lea ecx, [ebp - 0x107]
push ebx
push ecx
mov byte [ebp - 0x108], bl
call fcn.0042fa50
add esp, 0xc
push ebx
push ebx
push 0x104
lea edx, [ebp - 0x108]
push edx
push 0xffffffffffffffff
push edi
push ebx
push 0xfde9
call esi
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x440]
push ecx
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
cmp eax, 0xffffffff
je 0x423645
mov eax, dword [ebp - 0x418]
cmp eax, ebx
je 0x423645
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp - 0x41c]
push ecx
push edx
push eax
mov bl, 1
call fcn.0042fad0
mov ecx, dword [ebp - 0x418]
add esp, 0xc
push ecx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430215
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00430215
mov esp, ebp
pop ebp
ret
Function at 0x423a20
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x45d780]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push ebx
push edi
push 0xffffffffffffffff
mov edi, ecx
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
push edi
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], edx
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 0xffffffff
lea ecx, [edi + 4]
setne bl
call fcn.00401f30
test al, al
je 0x423a8e
mov eax, dword [edi]
mov edx, dword [str.mzRkDcUhfbI]
push eax
movzx ecx, bl
push ecx
push str.__d__socket___d
push edx
lea eax, [edi + 8]
push eax
call fcn.00404720
add esp, 0x14
test bl, bl
je 0x423aae
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430215
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x14]
push esi
push 1
push 0
push 0
push 0
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov esi, eax
cmp esi, 0xffffffff
je 0x423ba8
push 0x80
lea edx, [ebp - 0x84]
push 0
push edx
call fcn.0042fa50
mov ecx, dword [ebp - 0x90]
lea eax, [ebp - 0x84]
push eax
push ebx
push 0x44ff84
push ecx
call fcn.004234a0
add esp, 0x1c
push 0x45f4e8
lea ecx, [ebp - 0x84]
call fcn.00422ae0
test al, al
jne 0x423b7d
xor eax, eax
cmp word [ebp - 0x84], 2
lea edx, [ebp - 0x84]
setne al
dec eax
and eax, 0xffffff90
sub eax, 0xffffff80
push eax
push edx
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x423b7d
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x8c]
push ebx
push eax
push ecx
lea ecx, [ebp - 0x84]
call fcn.00423670
xor eax, eax
cmp word [ebp - 0x84], 2
lea edx, [ebp - 0x84]
setne al
dec eax
and eax, 0xffffff90
sub eax, 0xffffff80
push eax
push edx
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x423ba6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00430215
mov esp, ebp
pop ebp
ret 0x14
mov dword [edi], esi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp esi, 0xffffffff
pop esi
setne al
pop edi
xor ecx, ebp
pop ebx
call fcn.00430215
mov esp, ebp
pop ebp
ret 0x14
Function at 0x424550
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
push edi
lea edx, [ebp - 0x24]
push edx
mov dword [esi], vtable.CStream.0
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], bl
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x20]
mov dword [esi + 0x28], edi
cmp eax, ebx
jbe 0x4245e0
mov ecx, dword [esi + 0x2c]
xor edx, edx
cmp eax, ecx
jbe 0x4245ba
div ecx
inc eax
imul eax, ecx
xor edx, edx
jmp 0x4245bc
mov eax, ecx
div edi
push 1
push 0x2000
mov dword [esi + 0x38], eax
imul eax, edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 8], eax
cmp eax, ebx
jne 0x4245e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x42b6b0
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esi, ecx
push 1
lea eax, [esi + 0x2e0]
push eax
call edi
push 1
lea ecx, [esi + 0x50c]
push ecx
call edi
lea ecx, [esi + 0x24]
call fcn.00422bf0
test al, al
je 0x42b71b
lea ecx, [esi + 0x24]
call fcn.00423300
mov eax, dword [esi + 8]
test eax, eax
je 0x42b71b
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x42b70a
mov edx, dword [esi + 8]
push 1
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
pop edi
pop esi
ret
Function at 0x42d5a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x20]
mov ecx, esi
call fcn.00422bf0
test al, al
je 0x42d5bd
pop edi
xor al, al
pop esi
pop ebp
ret 0x14
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
push eax
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
mov ecx, esi
call fcn.00423760
mov bl, al
test bl, bl
je 0x42d614
push 0
push 0
push edi
push 0x42d580
push 0
push 0
call fcn.0043141f
add esp, 0x18
mov dword [edi + 4], eax
test eax, eax
jne 0x42d614
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov edi, eax
call fcn.00423300
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor bl, bl
mov al, bl
pop ebx
pop edi
pop esi
pop ebp
ret 0x14

Function at 0x42dcb0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x45d780]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00402c20
test esi, esi
je 0x42dd28
test edi, edi
je 0x42dd28
lea eax, [ebp - 0x20]
push eax
push esi
mov esi, dword [sym.imp.WS2_32.dll_inet_pton]
push 2
call esi
cmp eax, 1
jne 0x42dd28
lea ecx, [ebp - 0x28]
push ecx
push edi
push 2
call esi
cmp eax, 1
jne 0x42dd28
mov edx, dword [ebp - 0x28]
push 0x16
lea eax, [ebp - 0x1c]
push eax
not edx
or edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x24]
push ecx
push 2
mov dword [ebp - 0x24], edx
call sub.WS2_32.dll_inet_ntop
test eax, eax
je 0x42dd28
lea edx, [ebp - 0x1c]
push edx
mov ecx, ebx
call fcn.004039f0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430215
mov esp, ebp
pop ebp
ret

Function at 0x42e1a0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea ecx, [esi + 0xc]
call fcn.00423300
mov eax, dword [esi + 4]
test eax, eax
je 0x42e1e4
mov ecx, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x42e1d3
mov edx, dword [esi + 4]
push 1
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
pop esi
pop ebp
ret 4

Function at 0x42e1f0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x42e260
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
push eax
call edi
test eax, eax
je 0x42e24e
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi + 8]
push 0x7d0
push ecx
call edi
test eax, eax
je 0x42e24e
mov edx, dword [esi + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ecx, [esi + 0xec]
call fcn.00422bf0
test al, al
je 0x42e24e
push 0x3e8
lea ecx, [esi + 0xe0]
call fcn.0042e1a0
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
pop edi
pop esi
ret
Function at 0x42ea80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esi + 0xc]
call fcn.00422bf0
test al, al
je 0x42ea9e
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0x18
push ebx
push edi
mov edi, dword [ebp + 8]
lea ecx, [esi + 0x2b4]
test edi, edi
jne 0x42eab1
xor eax, eax
jmp 0x42eac5
mov eax, edi
lea ebx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x42eab6
sub eax, ebx
sar eax, 1
push eax
push edi
call fcn.00403750
mov edi, dword [ebp + 0xc]
lea ecx, [esi + 0x2b8]
test edi, edi
jne 0x42eadd
xor eax, eax
jmp 0x42eaf1
mov eax, edi
lea ebx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x42eae2
sub eax, ebx
sar eax, 1
push eax
push edi
call fcn.00403750
mov edi, dword [ebp + 0x10]
lea ecx, [esi + 0x2bc]
test edi, edi
jne 0x42eb09
xor eax, eax
jmp 0x42eb1f
mov eax, edi
lea ebx, [eax + 2]
mov edi, edi
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x42eb10
sub eax, ebx
sar eax, 1
push eax
push edi
call fcn.00403750
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x1c]
push 0
push 0
push 1
push 0
mov dword [esi + 0x2c0], eax
mov dword [esi + 0x2c4], ecx
mov dword [esi + 0x2c8], edx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push esi
push 0x42e5e0
push 0
push 0
mov dword [esi + 8], eax
call fcn.0043141f
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
jne 0x42eb84
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [esi + 8]
push 0xffffffffffffffff
push 0
lea edx, [ebp - 8]
push edx
push 2
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov edi, eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
pop edi
pop ebx
mov dword [esi + 8], 0
setne al
pop esi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x42f0d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x42f0fb
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42f0fb
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
cmp dword [esi + 8], 0
jne 0x42f1a6
mov eax, dword [ebp + 8]
mov dword [esi + 0x47c], 1
mov dword [esi + 0x480], 1
test eax, eax
je 0x42f126
mov dword [esi + 0x484], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42f133
mov dword [esi + 0x488], eax
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea edx, [ebp + 8]
push edx
push 0
push esi
push 0x42eff0
push 0
push 0
mov dword [ebp + 8], 0
call fcn.0043141f
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
jne 0x42f1a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42f177
and eax, 0xffff
or eax, 0x80070000
mov ecx, dword [esi + 0x484]
mov dword [esi + 0x48c], eax
mov dword [esi + 0x480], 0
test ecx, ecx
je 0x42f1a6
mov esi, dword [esi + 0x488]
test esi, esi
je 0x42f1a6
push 0
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
pop ebp
ret 8
Function at 0x42f747
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x45f96c], 0
push esi
push edi
jne 0x42f6bd
call fcn.0042f629
test eax, eax
je 0x42f702
mov eax, dword [0x45f96c]
cmp eax, 1
jne 0x42f6de
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x42f702
jmp 0x42f744
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x42f744
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x42f706
xor eax, eax
jmp 0x42f744
mov eax, dword [esi]
push dword [0x45f96c]
call edi
mov edi, eax
test edi, edi
je 0x42f728
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x42f744
lea edi, [esi + 0xff0]
push esi
push dword [0x45f96c]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x42f72e
mov eax, esi
pop edi
pop esi
ret
jmp 0x42f6a9

Function at 0x430215
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45d780]
jne 0x43021f
repz ret
jmp fcn.0043634c
Function at 0x44266f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45d780]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00435d3e
and dword [ebp - 0x14], 0
cmp dword [0x460838], 0
mov dword [ebp - 0x18], eax
jne 0x442722
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4427ca
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x453ed4
push ebx
call edi
test eax, eax
je 0x4427ca
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x453ec4
push ebx
mov dword [0x460838], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46083c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x460840], eax
call edi
push eax
call esi
mov dword [0x460848], eax
test eax, eax
je 0x442722
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x460844], eax
mov eax, dword [0x460844]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x44277b
cmp dword [0x460848], ecx
je 0x44277b
push eax
call esi
push dword [0x460848]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x44277b
test ebx, ebx
je 0x44277b
call edi
test eax, eax
je 0x442772
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x442772
test byte [ebp - 8], 1
jne 0x44277b
or dword [ebp + 0x10], 0x200000
jmp 0x4427ae
mov eax, dword [0x46083c]
cmp eax, dword [ebp - 0x18]
je 0x4427ae
push eax
call esi
test eax, eax
je 0x4427ae
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4427ae
mov eax, dword [0x460840]
cmp eax, dword [ebp - 0x18]
je 0x4427ae
push eax
call esi
test eax, eax
je 0x4427ae
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x460838]
call esi
test eax, eax
je 0x4427ca
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4427cc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430215
leave
ret