joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9710
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.004c8120
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
test edx, edx
je 0x4d9775
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.004d9650
mov edi, dword [esp]
test edi, edi
je 0x4d9784
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4d9799
mov dword [esi], edi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebp
jmp 0x4d9791
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], 0
mov ecx, esp
call fcn.004c82d0
mov dword [esi], 0
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
test ebx, ebx
mov dword [esi], 0
je 0x4d9791
mov ecx, edi
mov edx, 2
call fcn.004155d0
jmp 0x4d9791
Function at 0x4db4d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4f6eb0
mov esi, edx
mov edi, ecx
mov ecx, 8
mov edx, 4
mov eax, dword fs:[0]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword fs:[0], eax
movzx eax, byte [0x57eac8]
call fcn.00415570
test eax, eax
je 0x4db5ab
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 4], eax
push 0
push 0x10000
push ebx
push 0x4db650
push esi
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
test eax, eax
je 0x4db54d
mov dword [edi + 4], eax
mov byte [edi], 4
jmp 0x4db59a
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x24], eax
push eax
mov dword [ebp - 0x20], ecx
call dword [ecx]
add esp, 4
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x2c]
cmp dword [eax + 4], 0
je 0x4db582
mov edx, dword [eax + 8]
mov ecx, dword [ebp - 0x24]
call fcn.004155d0
mov ecx, dword [ebp - 0x28]
mov edx, 4
call fcn.004155d0
call sub.kernel32.dll_GetLastError
mov byte [esi], 0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 4
mov edx, 8
mov dword [ebp - 0x10], 0
call fcn.00506930
ud2
Function at 0x4dba40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1038
call fcn.004f7080
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4f6ee0
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], edx
lea esi, [ebp - 0x1044]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x1000
push 0
push esi
call fcn.004f8400
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push 0x4d3a00
push eax
push 0x1000
push esi
push edi
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x4dbb94
mov ebx, dword [sym.imp.kernel32.dll_SleepEx]
mov dword [ebp - 0x20], edi
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x4dbaca
cmp dword [ebp - 0x2c], 0
jne 0x4dbba3
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x4dbba3
cmp esi, 0x1000
ja 0x4dbbdf
xor edi, edi
nop dword [eax]
mov eax, esi
sub eax, edi
jb 0x4dbbc5
xorps xmm0, xmm0
lea edx, [ebp - 0x30]
lea ecx, [ebp + edi - 0x1044]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], edx
push 0x4d3a00
lea edx, [ebp - 0x44]
push edx
push eax
push ecx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WriteFileEx]
test eax, eax
je 0x4dbb9b
nop dword [eax]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x4dbb40
cmp dword [ebp - 0x2c], 0
jne 0x4dbba0
add edi, dword [ebp - 0x28]
cmp edi, esi
jne 0x4dbb00
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
push 0x4d3a00
lea eax, [ebp - 0x44]
push eax
push 0x1000
lea eax, [ebp - 0x1044]
push eax
mov edi, dword [ebp - 0x20]
push edi
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
jne 0x4dbaca
call sub.kernel32.dll_GetLastError
jmp 0x4dbba3
call sub.kernel32.dll_GetLastError
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push edi
call esi
push dword [ebp - 0x24]
call esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1038
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, edi
mov edx, esi
push 0x54992c
call fcn.00506ea0
add esp, 4
jmp 0x4dbbfa
mov dword [ebp - 0x10], 0
mov ecx, esi
mov edx, 0x1000
push 0x54992c
call fcn.00506c60
add esp, 4
ud2
Function at 0x4dbcd0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x54], 0x4f6f00
mov edi, ecx
lea eax, [esi + 0x50]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x50], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x30], xmm0
lea eax, [esi + 0x30]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x4dbd38
movaps xmm0, xmmword [esi + 0x30]
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
movups xmmword [edi], xmm0
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call sub.kernel32.dll_GetLastError
lea edx, [esi + 8]
lea ecx, [esi + 0x10]
mov dword [esi + 0x18], 0x549a40
mov dword [esi + 0x1c], 1
mov dword [esi + 0x28], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x10], edx
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x18]
mov edx, 0x549a6c
mov dword [esi + 0x14], fcn.004cd1c0
mov dword [esi + 0x24], 1
call fcn.00506b50
ud2
Function at 0x4e0820
Capabilities:
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, dword [0x57e0b0]
test eax, eax
je 0x4e0905
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4e0851
mov esi, eax
mov eax, dword [eax]
or eax, dword [esi + 4]
jne 0x4e08fa
mov eax, dword [0x57e0b0]
test eax, eax
je 0x4e0914
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x4e08d7
mov esi, eax
test eax, eax
jne 0x4e08b7
movzx eax, byte [0x57eac8]
mov ecx, 0x20
mov edx, 8
call fcn.00415570
test eax, eax
je 0x4e092f
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x57e0b0
mov esi, eax
mov eax, dword [0x57e0b0]
test eax, eax
je 0x4e0923
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 2
push 0x10
push eax
push 0
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x4e08db
movaps xmm0, xmmword [esp]
jmp 0x4e08e9
xor esi, esi
jmp 0x4e08fd
lea ecx, [esp + 0x10]
call fcn.004dbcd0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add esi, 8
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x57e0b0
call fcn.0050a660
jmp 0x4e0838
mov ecx, 0x57e0b0
call fcn.0050a660
jmp 0x4e085f
mov ecx, 0x57e0b0
call fcn.0050a660
jmp 0x4e08af
mov ecx, 8
mov edx, 0x20
call fcn.00506930
ud2

Function at 0x4e1468
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push eax
mov esi, ecx
mov bl, byte [esp + 0x10]
mov ecx, edx
call fcn.004e11b8
mov eax, dword [eax]
movzx ecx, bl
mov edx, esp
mov dword [edx], ecx
push 4
push edx
push 1
push 6
push eax
call dword [sym.imp.ws2_32.dll_setsockopt]
mov cl, 4
cmp eax, 0xffffffff
jne 0x4e14aa
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
and word [esi + 1], 0
mov byte [esi + 3], 0
mov dword [esi + 4], eax
xor ecx, ecx
mov byte [esi], cl
add esp, 4
pop esi
pop ebx
ret
Function at 0x4e16fc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov edi, edx
mov dword [esp], ecx
mov eax, dword [esp + 0x48]
lea esi, [edx + 0xc]
xor ecx, ecx
cmp dword [edx + 0xc], 0xffffffff
cmove esi, ecx
mov ecx, 0x7fffffff
cmp eax, ecx
cmovb ecx, eax
mov dword [esp + 0x20], ecx
mov edx, dword [edi + 8]
lea ecx, [esp + 0xc]
push dword [esp + 0x40]
call fcn.004e145a
pop eax
mov edx, dword [esp + 0xc]
cmp edx, 2
je 0x4e1859
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
test edx, edx
jne 0x4e1861
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
mov ecx, esi
mov edx, 0x54aa08
call fcn.00442a76
push 0
push dword [esp + 0x24]
push dword [esp + 0x4c]
push dword [esi]
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x4e178d
mov dword [esp + 8], eax
mov byte [esp + 4], 4
jmp 0x4e181d
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ebp, eax
xor eax, eax
mov byte [esp + 4], al
mov byte [esp + 7], al
and word [esp + 5], 0
mov dword [esp + 8], ebp
lea ecx, [esp + 4]
call fcn.00469f1c
cmp al, 0xd
jne 0x4e181d
mov eax, dword [esi + 4]
test eax, eax
je 0x4e1810
mov edx, dword [eax]
mov ebx, dword [eax + 4]
lock inc dword [ebx]
jle 0x4e1883
add edx, 8
lea ecx, [esp + 0xc]
push dword [eax + 0xc]
push dword [eax + 8]
push ebx
call fcn.0046b713
add esp, 0xc
push 4
pop ecx
call fcn.0046a24c
cmp byte [esp + 0xc], 4
je 0x4e181d
mov ebx, dword [esp + 0xc]
cmp bl, 4
je 0x4e181d
mov edx, ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebp
xor ecx, ecx
call fcn.0046a24c
jmp 0x4e1832
and dword [esp + 0x10], 0
mov dword [esp + 0xc], 4
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebx
cmp bl, 4
je 0x4e186b
lea ecx, [esp + 0x18]
call fcn.00469f1c
cmp al, 0xd
jne 0x4e1873
mov ecx, edi
lea edx, [esp + 0x24]
call fcn.004e121f
movzx ecx, bl
mov edx, ebp
call fcn.004c2ea6
jmp 0x4e1726
mov eax, dword [esp]
mov byte [eax], 5
jmp 0x4e187b
mov edx, dword [esp]
mov dword [edx], ecx
mov dword [edx + 4], eax
jmp 0x4e187b
mov eax, dword [esp]
mov byte [eax], 4
jmp 0x4e1878
mov eax, dword [esp]
mov dword [eax], ebx
mov dword [eax + 4], ebp
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
ud2

Function at 0x4e2945
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x4e2947
test al, 1
je 0x4e295e
test al, 2
jne 0x4e296d
xor eax, 3
ret
push 0x23
pop edx
mov ecx, str.assertion_failed:_prev.is_running__
push 0x54aec4
jmp 0x4e297a
push 0x25
pop edx
mov ecx, 0x54aed4
push 0x54aefc
call fcn.00506cd0
pop eax
ud2
Function at 0x4f7a0e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x4f7a4d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4f7a4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4f7a4d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4f7a4d
cmp dword [ecx + 0x74], 0xe
jbe 0x4f7a4d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4ffa12
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4ffaaf
push ebx
push esi
call fcn.004ff9db
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004ff96f
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4ffa5c
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4ffaae
push edi
push eax
call fcn.0050062f
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4ffa7c
call fcn.004fe4cf
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4ffaad
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004ff96f
add esp, 0x20
test eax, eax
jne 0x4ffa9b
push edi
call fcn.004fe4cf
jmp 0x4ffaa3
push ebx
call fcn.004fe4cf
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x500dac
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x573a58
push 0x573a50
push str.FlsAlloc
push 0x1f
call fcn.00500c6b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x500de0
push dword [ebp + 8]
mov ecx, esi
call dword [0x50c378]
call esi
jmp 0x500de6
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x500e2a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x573a68
push 0x573a60
push str.FlsGetValue
push 0x21
call fcn.00500c6b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x500e61
push dword [ebp + 8]
mov ecx, esi
call dword [0x50c378]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]

Function at 0x500e69
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x573a70
push 0x573a68
push str.FlsSetValue
push 0x22
call fcn.00500c6b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x500ea3
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x50c378]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsSetValue]
Function at 0x506300
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x50632d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x50632d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x508d0f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
push str.api_ms_win_core_synch_l1_2_0.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x508d4d
mov edi, eax
push str.WaitOnAddress
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x508d4d
mov esi, eax
push str.WakeByAddressSingle
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x508d4d
mov ebp, eax
xor edi, edi
jmp 0x508dad
push 0x53dc2c
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x508df1
mov esi, eax
push str.NtCreateKeyedEvent
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x508df1
mov ebx, eax
push str.NtReleaseKeyedEvent
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x508df1
mov edi, eax
push str.NtWaitForKeyedEvent
push esi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x508df1
mov esi, eax
mov eax, esp
push 0
push 0
push 0xc0000000
push eax
call ebx
test eax, eax
jne 0x508df1
mov ebp, dword [esp]
push 0xc
pop ecx
call fcn.0046a2f8
mov ebx, eax
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ebp
xor eax, eax
lock cmpxchg dword [0x57e9d4], ebx
je 0x508de7
mov esi, eax
cmp dword [ebx], 0
je 0x508ddb
push dword [ebx + 8]
call dword [sym.imp.kernel32.dll_CloseHandle]
push 4
pop edx
mov ecx, ebx
call fcn.004155d0
mov ebx, esi
mov eax, ebx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x5b
pop edx
mov ecx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_main.rs_src_thread_parkerwindowsmod.rs
push 0x53dc0c
call fcn.00508e06
pop eax
ud2
Function at 0x50a660
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x50a6e1
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x50a71c
cmp dword [esp + 4], 0
je 0x50a703
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x50a73f
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x57ea5c]
nop word cs:[eax + eax]
nop
mov dword [esi + 8], eax
lock cmpxchg dword [0x57ea5c], esi
jne 0x50a6c0
mov byte [0x57ea58], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x50a713
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x50a782
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x50a707
mov edi, dword [esp]
jmp 0x50a713
mov edi, dword [esi]
jmp 0x50a712
mov edi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 8], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x549d6c
push 0x549dcc
push eax
call fcn.0050a7c0
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x549dbc
mov dword [esp + 8], 0x549d84
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], str.OutOfRangeImpossibleNotEnoughInvalidTooShortTooLongBadFormat__NonexhaustiveEmpty
mov dword [esp + 0x14], 0
call fcn.00506b50
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x549d84
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], str.OutOfRangeImpossibleNotEnoughInvalidTooShortTooLongBadFormat__NonexhaustiveEmpty
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.0050a800
ud2

Function at 0x50ac80
Capabilities:
Resolve dns

Disassembly:
push ebx
push edi
push esi
sub esp, 0x34
mov esi, ecx
lea ecx, [esp + 4]
push dword [esp + 0x44]
call fcn.00415990
add esp, 4
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x50acc0
mov eax, dword [0x548d20]
mov edx, dword [0x548d24]
cmp dword [esp + 8], 0
mov dword [esi + 8], edx
mov dword [esi + 4], eax
mov dword [esi], 1
jne 0x50ad2f
jmp 0x50ad39
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0xc]
xorps xmm0, xmm0
mov eax, esp
mov dword [esp], 0
lea ecx, [esp + 0x14]
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x1c], 1
push eax
push ecx
push 0
push edi
call dword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x50ad10
call dword [sym.imp.ws2_32.dll_WSAGetLastError]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, 1
jmp 0x50ad24
mov ecx, dword [esp]
movzx eax, word [esp + 0x48]
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov word [esi + 0xc], ax
xor eax, eax
test ebx, ebx
mov dword [esi], eax
mov byte [edi], 0
je 0x50ad39
mov ecx, edi
mov edx, 1
call fcn.004155d0
add esp, 0x34
pop esi
pop edi
pop ebx
ret
Function at 0x4159c2
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x419b78
call fcn.00415970
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x400000], 0x5a4d
jne 0x415a16
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x415a16
movzx ecx, word [eax + 0x400018]
cmp ecx, 0x10b
je 0x415a2e
cmp ecx, 0x20b
je 0x415a1b
mov dword [ebp - 0x1c], ebx
jmp 0x415a45
cmp dword [eax + 0x400084], 0xe
jbe 0x415a16
xor ecx, ecx
cmp dword [eax + 0x4000f8], ebx
jmp 0x415a3f
cmp dword [eax + 0x400074], 0xe
jbe 0x415a16
xor ecx, ecx
cmp dword [eax + 0x4000e8], ebx
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x41dce4], edi
mov dword [0x41dce8], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x41d8d0]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x41d8cc]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x41dce0], eax
call fcn.00415c98
cmp dword [0x41d5f0], ebx
jne 0x415aa2
push fcn.00415c98
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.00415c86
push 0x418350
push 0x41834c
call sub.msvcrt.dll__initterm
mov eax, dword [0x41d8c8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x41d8c4]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x418348
push 0x418300
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x22
jne 0x415b2d
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x415b0d
cmp cl, 0x22
jne 0x415afe
cmp byte [eax], 0x22
jne 0x415b16
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x415b21
cmp cl, 0x20
jbe 0x415b12
test byte [ebp - 0x54], 1
je 0x415b38
movzx ecx, word [ebp - 0x50]
jmp 0x415b3b
cmp byte [eax], 0x20
jbe 0x415b16
inc eax
mov dword [ebp - 0x20], eax
jmp 0x415b2d
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call fcn.0040541b
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x415b59
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x415b95
mov eax, esi
jmp 0x415ba9
call fcn.004159ab
ret
Function at 0x446fa8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x8c], 0
je 0x446fdd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403c40
jmp 0x446fe7
mov eax, esi
mov edx, dword [ebx + 0x74]
call fcn.00403bf4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x447ed4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x447f0c
mov eax, esi
call fcn.00430ee8
test al, al
je 0x447f0c
mov eax, dword [ebx + 0x6c]
call fcn.00430ac0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x447f0c
push 0
mov eax, dword [ebx + 0x6c]
call fcn.00430ac0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x452518
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.004521ba
aaa
fcom dword [edi - 0x17ba72c5]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
invalid
inc ebp

Function at 0x4525e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004521ca
push eax
push esi
push dword [ebp + 8]
call fcn.0045217f
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004521ba
xchg dword [ebx + 0x1e], eax
enter 0xffffffffffff9d88, 0x7c
invalid

Function at 0x45f157
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x47f87e
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45f1af
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x47f89f
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45f1a5
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x45f1b3
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x10008ac3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10008b02
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10008b02
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10008b02
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10008b02
cmp dword [ecx + 0x74], 0xe
jbe 0x10008b02
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret