joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413410
Capabilities:
Create thread

Disassembly:
push rbp
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov rax, qword [0x00442300]
mov rax, qword [rax]
xor rax, rbp
mov qword [rbp + 0x18], rax
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x20], rdx
mov rax, qword [rbp - 0x18]
cmp qword [rax + 0x20f8], 0
je 0x41346a
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax + 0x20f8]
call fcn.00418620
mov rax, qword [rbp - 0x18]
mov qword [rax + 0x20f8], 0
mov qword [rbp + 0x10], 0
mov rcx, qword [rbp - 0x20]
lea rdx, [rbp + 0x10]
call fcn.0040cb40
mov ecx, 0x70
call fcn.0040afc0
mov qword [rbp - 0x28], rax
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp - 0x28]
mov qword [rax + 0x50], rcx
mov rax, qword [rbp - 0x18]
cmp dword [rax + 0x18ac], 0
jle 0x4134bc
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x18ac]
mov dword [rbp - 0x34], eax
jmp 0x4134c9
mov eax, 0x320
mov dword [rbp - 0x34], eax
jmp 0x4134c9
mov ecx, dword [rbp - 0x34]
mov rax, qword [rbp - 0x28]
mov dword [rax + 0x5c], ecx
mov rax, qword [rbp - 0x18]
cmp dword [rax + 0x18b0], 0
jle 0x4134f6
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x18b0]
mov dword [rbp - 0x38], eax
jmp 0x413503
mov eax, 0x258
mov dword [rbp - 0x38], eax
jmp 0x413503
mov ecx, dword [rbp - 0x38]
mov rax, qword [rbp - 0x28]
mov dword [rax + 0x60], ecx
mov rax, qword [rbp - 0x18]
cmp dword [rax + 0x18b8], 0
jle 0x413530
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x18b8]
mov dword [rbp - 0x3c], eax
jmp 0x413548
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, 0x320
mov ecx, 2
cdq
idiv ecx
mov dword [rbp - 0x3c], eax
mov ecx, dword [rbp - 0x3c]
mov rax, qword [rbp - 0x28]
mov dword [rax + 0x64], ecx
mov rax, qword [rbp - 0x18]
cmp dword [rax + 0x18bc], 0
jle 0x413575
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x18bc]
mov dword [rbp - 0x40], eax
jmp 0x413590
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, 0x258
mov ecx, 2
cdq
idiv ecx
mov dword [rbp - 0x40], eax
mov ecx, dword [rbp - 0x40]
mov rax, qword [rbp - 0x28]
mov dword [rax + 0x68], ecx
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
mov qword [rax + 0x20f8], rcx
mov rcx, qword [rbp - 0x18]
mov edx, 1
call fcn.0040c5c0
mov r9, qword [rbp - 0x18]
xor eax, eax
mov edx, eax
lea r8, [0x00418720]
xor eax, eax
mov rcx, rdx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x30], rax
cmp qword [rbp - 0x30], 0
je 0x4135fb
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x10]
call fcn.0040a930
mov ecx, 0xa
call fcn.0040a910
mov rcx, qword [rbp - 0x18]
xor edx, edx
call fcn.0040c5c0
test al, 1
jne 0x413626
jmp 0x41364b
lea rcx, [rbp - 0x10]
mov edx, 0x9c4
call fcn.0040a950
test al, 1
jne 0x413641
jmp 0x413646
jmp 0x41364b
jmp 0x413604
mov al, byte [0x0045ab32]
and al, 1
movzx eax, al
mov dword [rbp - 0x44], eax
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x413678
jmp 0x41367d
call fcn.0041bf30
mov eax, dword [rbp - 0x44]
add rsp, 0xa0
pop rbp
ret
Function at 0x419010
Capabilities:
Query environment variable

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
lea rcx, str.USERPROFILE
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x419045
lea rax, [0x00442537]
mov qword [rbp - 8], rax
jmp 0x41904d
mov rax, qword [rbp - 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
add rsp, 0x30
pop rbp
ret

Function at 0x41ac40
Capabilities:
Query environment variable

Disassembly:
push rbp
sub rsp, 0x5e0
lea rbp, [rsp + 0x80]
mov rax, qword [0x00442300]
mov rax, qword [rax]
xor rax, rbp
mov qword [rbp + 0x558], rax
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x50], rdx
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp + 0x450]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rdx, [rbp + 0x450]
lea rcx, [rbp - 0x38]
lea r8, [0x0044266b]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
cmp qword [rbp - 0x38], 0
jne 0x41acaf
mov byte [rbp - 0x39], 0
jmp 0x41ad39
lea rcx, [rbp + 0x3d0]
xor edx, edx
mov r8d, 0x80
call fcn.0041ba90
lea rcx, [rbp + 0x3d0]
mov r9, qword [rbp - 0x50]
lea r8, str.Name_s
mov edx, 0x80
call fcn.0043fd80
lea rcx, [rbp - 0x30]
mov r8, qword [rbp - 0x38]
mov edx, 0x400
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fgets
cmp rax, 0
je 0x41ad2c
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x3d0]
call sub.api_ms_win_crt_private_l1_1_0.dll_strstr
cmp rax, 0
je 0x41ad27
mov rcx, qword [rbp - 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov byte [rbp - 0x39], 1
jmp 0x41ad39
jmp 0x41acdf
mov rcx, qword [rbp - 0x38]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov byte [rbp - 0x39], 0
mov al, byte [rbp - 0x39]
and al, 1
movzx eax, al
mov dword [rbp - 0x54], eax
mov rcx, qword [rbp + 0x558]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x41ad66
jmp 0x41ad6b
call fcn.0041bf30
mov eax, dword [rbp - 0x54]
add rsp, 0x5e0
pop rbp
ret

Function at 0x41b660
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rsi, rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r8, qword [rbp]
mov rcx, rax
mov rdx, rsi
call fcn.004404d0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
int3

Function at 0x41c2f0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov dword [rbp - 4], ecx
mov ecx, dword [rbp - 4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
add rsp, 0x30
pop rbp
ret
Function at 0x421090
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rax
mov rbp, rsp
mov qword [rbp], rcx
mov rax, qword [rbp]
mov dword [rax + 4], 0
mov rax, qword [rbp]
mov dword [rax], 0
mov rax, qword [rbp]
mov dword [rax + 8], 0x67452301
mov rax, qword [rbp]
mov dword [rax + 0xc], 0xefcdab89
mov rax, qword [rbp]
mov dword [rax + 0x10], 0x98badcfe
mov rax, qword [rbp]
mov dword [rax + 0x14], 0x10325476
add rsp, 8
pop rbp
ret
Function at 0x429bf0
Capabilities:
Set thread local storage value

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov dword [rbp - 4], ecx
mov qword [rbp - 0x10], rdx
mov ecx, dword [rbp - 4]
mov rdx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, eax
mov eax, 1
xor ecx, ecx
cmp edx, 0
cmovne eax, ecx
add rsp, 0x30
pop rbp
ret
Function at 0x429ca0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Start tcp server

Disassembly:
push rbp
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov rax, qword [0x00442300]
mov rax, qword [rax]
xor rax, rbp
mov qword [rbp - 8], rax
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x38], rdx
mov rax, qword [0x0044a0a4]
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x3c], 0xffffffff
mov rax, qword [rbp - 0x30]
mov dword [rax], 0xffffffff
mov rax, qword [rbp - 0x38]
mov dword [rax], 0xffffffff
mov ecx, 2
mov edx, 1
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
mov dword [rbp - 0x3c], eax
cmp dword [rbp - 0x3c], 0
jl 0x429e4e
lea rax, [rbp - 0x20]
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x24], 0x10
lea rcx, [rbp - 0x20]
xor edx, edx
mov r8d, 0x10
call fcn.0041ba90
mov word [rbp - 0x20], 2
mov ecx, 0x7f000001
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rbp - 0x1c], eax
mov word [rbp - 0x1e], 0
movsxd rcx, dword [rbp - 0x3c]
mov rdx, qword [rbp - 0x48]
mov r8d, 0x10
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0
jne 0x429e49
movsxd rcx, dword [rbp - 0x3c]
mov rdx, qword [rbp - 0x48]
lea r8, [rbp - 0x24]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0
jne 0x429e49
movsxd rcx, dword [rbp - 0x3c]
mov edx, 1
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0
jne 0x429e49
mov ecx, 2
mov edx, 1
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
mov dword [rbp - 0x10], eax
cmp dword [rbp - 0x10], 0
jl 0x429e44
movsxd rcx, dword [rbp - 0x10]
mov rdx, qword [rbp - 0x48]
mov r8d, 0x10
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0
jne 0x429e44
movsxd rcx, dword [rbp - 0x3c]
mov rdx, qword [rbp - 0x48]
lea r8, [rbp - 0x24]
call qword [sym.imp.WS2_32.dll_accept]
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
jl 0x429e3f
movsxd rcx, dword [rbp - 0x3c]
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [rbp - 0x10]
mov rax, qword [rbp - 0x30]
mov dword [rax], ecx
mov ecx, dword [rbp - 0xc]
mov rax, qword [rbp - 0x38]
mov dword [rax], ecx
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax]
xor eax, eax
mov r8d, eax
mov rdx, r8
call fcn.004335f0
mov rax, qword [rbp - 0x38]
movsxd rcx, dword [rax]
xor eax, eax
mov r8d, eax
mov rdx, r8
call fcn.004335f0
mov dword [rbp - 0x28], 0
jmp 0x429e91
jmp 0x429e44
jmp 0x429e49
jmp 0x429e4e
cmp dword [rbp - 0x3c], 0
jl 0x429e62
movsxd rcx, dword [rbp - 0x3c]
call qword [sym.imp.WS2_32.dll_closesocket]
cmp dword [rbp - 0x10], 0
jl 0x429e76
movsxd rcx, dword [rbp - 0x10]
call qword [sym.imp.WS2_32.dll_closesocket]
cmp dword [rbp - 0xc], 0
jl 0x429e8a
movsxd rcx, dword [rbp - 0xc]
call qword [sym.imp.WS2_32.dll_closesocket]
mov dword [rbp - 0x28], 0xffffffff
mov eax, dword [rbp - 0x28]
mov dword [rbp - 0x4c], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x429eb6
jmp 0x429ebb
call fcn.0041bf30
mov eax, dword [rbp - 0x4c]
add rsp, 0x70
pop rbp
ret
Function at 0x42aaf0
Capabilities:
Create thread

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], rdx
mov qword [rbp - 0x18], r8
mov dword [rbp - 0x2c], 0xffffffff
mov r8, qword [rbp - 8]
mov r9, qword [rbp - 0x10]
xor eax, eax
mov ecx, eax
xor edx, edx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x28], rax
cmp qword [rbp - 0x20], 0
je 0x42ab66
cmp qword [rbp - 0x18], 0
je 0x42ab66
mov rcx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
mov qword [rax], rcx
mov dword [rbp - 0x2c], 0
mov eax, dword [rbp - 0x2c]
add rsp, 0x60
pop rbp
ret
Function at 0x42be50
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rdx
cmp qword [rbp - 0x10], 0
je 0x42be96
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
mov rax, qword [rbp - 0x10]
mov dword [rax], ecx
mov rax, qword [rbp - 0x10]
mov edx, dword [rax]
mov eax, 0xffffffff
xor ecx, ecx
cmp edx, 0xffffffff
cmovne eax, ecx
mov dword [rbp - 4], eax
jmp 0x42be9d
mov dword [rbp - 4], 0xfffffffe
mov eax, dword [rbp - 4]
add rsp, 0x40
pop rbp
ret

Function at 0x42c010
Capabilities:
Resolve dns

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], rdx
mov qword [rbp - 0x18], r8
mov rax, qword [rbp - 8]
mov byte [rax], 0
cmp qword [rbp - 0x18], 0
jne 0x42c03d
jmp 0x42c084
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp eax, 2
jne 0x42c084
mov rcx, qword [rbp - 0x18]
mov r8, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r9d, eax
mov edx, 0x10
xor eax, eax
xor eax, eax
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 2
call qword [sym.imp.WS2_32.dll_getnameinfo]
nop
add rsp, 0x50
pop rbp
ret
Function at 0x42ff30
Capabilities:
Check if file exists

Disassembly:
push rbp
sub rsp, 0x8b0
lea rbp, [rsp + 0x80]
mov rax, qword [0x00442300]
mov rax, qword [rax]
xor rax, rbp
mov qword [rbp + 0x828], rax
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x30], r9
lea rax, [0x00430140]
mov qword [rbp - 0x40], rax
lea rcx, [rbp + 0x510]
mov rdx, qword [rbp - 0x20]
mov r8d, 0x30c
call fcn.004207d0
lea rcx, [rbp + 0x510]
call fcn.00430230
mov rcx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x30]
shl r8, 1
xor edx, edx
call fcn.0041ba90
lea r8, [rbp + 0x510]
mov r10, qword [rbp - 0x28]
mov rax, qword [rbp - 0x30]
mov ecx, 0xfde9
xor edx, edx
mov r9d, 0xffffffff
mov qword [rsp + 0x20], r10
mov dword [rsp + 0x28], eax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r8, qword [rbp - 0x28]
mov rax, qword [rbp - 0x30]
mov r9d, eax
lea rax, [rbp + 0x200]
mov ecx, 0xfde9
xor edx, edx
xor r10d, r10d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x30c
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rbp + 0x510]
lea rdx, [rbp + 0x200]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
cmp eax, 0
je 0x430034
mov rax, qword [rbp - 0x28]
mov word [rax], 0
cmp qword [rbp - 0x18], 0
je 0x430089
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x8e8]
cmp qword [rax + 0x50], 0
je 0x430084
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x8e8]
mov rcx, qword [rax + 0x50]
lea rdx, [0x0044728e]
call fcn.0041c040
cmp eax, 0
jne 0x430084
lea rax, [0x00440c70]
mov qword [rbp - 0x40], rax
jmp 0x430089
lea rcx, [rbp - 0x10]
xor edx, edx
mov r8d, 0x20a
call fcn.0041ba90
mov rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x10]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov dword [rbp - 0x34], eax
cmp dword [rbp - 0x34], 0
jne 0x4300d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x38], eax
cmp dword [rbp - 0x38], 2
jne 0x4300d3
jmp 0x430107
jmp 0x4300d8
mov eax, dword [rbp - 0x34]
cmp rax, 0x105
jae 0x4300fe
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x10]
call rax
cmp eax, 0
je 0x430107
mov rax, qword [rbp - 0x28]
mov word [rax], 0
mov rcx, qword [rbp + 0x828]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x430129
jmp 0x43012e
call fcn.0041bf30
nop
add rsp, 0x8b0
pop rbp
ret
Function at 0x431e40
Capabilities:
Get file attributes

Disassembly:
push rbp
sub rsp, 0x260
lea rbp, [rsp + 0x80]
mov rax, qword [0x00442300]
mov rax, qword [rax]
xor rax, rbp
mov qword [rbp + 0x1d8], rax
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x48], 0
cmp qword [rbp - 0x40], 0
jne 0x431e8f
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x431f64
mov ecx, 0x568
call fcn.0041d350
mov qword [rbp - 0x48], rax
cmp rax, 0
jne 0x431eb7
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x431f5f
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x40]
lea r8, [rbp - 0x30]
mov r9d, 0x104
call fcn.0042ff30
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rbp - 0x4c], eax
lea rcx, [rbp - 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add rax, 2
cmp rax, 0x104
jae 0x431f49
cmp dword [rbp - 0x4c], 0xffffffff
je 0x431f49
mov eax, dword [rbp - 0x4c]
and eax, 0x10
cmp eax, 0
je 0x431f49
lea rcx, [rbp - 0x30]
lea rdx, [0x00449840]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscat
lea rcx, [rbp - 0x30]
mov rdx, qword [rbp - 0x48]
add rdx, 8
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rax
mov rax, qword [rbp - 0x48]
mov qword [rax], rcx
mov rax, qword [rbp - 0x48]
mov byte [rax + 0x258], 0
jmp 0x431f5a
mov rcx, qword [rbp - 0x48]
call fcn.0041d370
mov qword [rbp - 0x48], 0
jmp 0x431f5f
jmp 0x431f64
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x58], rax
mov rcx, qword [rbp + 0x1d8]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x431f8e
jmp 0x431f93
call fcn.0041bf30
mov rax, qword [rbp - 0x58]
add rsp, 0x260
pop rbp
ret

Function at 0x432450
Capabilities:
Create directory

Disassembly:
push rbp
sub rsp, 0x250
lea rbp, [rsp + 0x80]
mov rax, qword [0x00442300]
mov rax, qword [rax]
xor rax, rbp
mov qword [rbp + 0x1c8], rax
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x50], rdx
mov dword [rbp - 0x54], r8d
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x50]
lea r8, [rbp - 0x40]
mov r9d, 0x104
call fcn.0042ff30
lea rcx, [rbp - 0x40]
xor eax, eax
mov edx, eax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, eax
mov eax, 0xffffffff
xor ecx, ecx
cmp edx, 0
cmovne eax, ecx
mov dword [rbp - 0x58], eax
mov rcx, qword [rbp + 0x1c8]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x4324d9
jmp 0x4324de
call fcn.0041bf30
mov eax, dword [rbp - 0x58]
add rsp, 0x250
pop rbp
ret
Function at 0x4324f0
Capabilities:
Delete file

Disassembly:
push rbp
sub rsp, 0x250
lea rbp, [rsp + 0x80]
mov rax, qword [0x00442300]
mov rax, qword [rax]
xor rax, rbp
mov qword [rbp + 0x1c8], rax
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x50], rdx
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x50]
lea r8, [rbp - 0x40]
mov r9d, 0x104
call fcn.0042ff30
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, eax
mov eax, 0xffffffff
xor ecx, ecx
cmp edx, 0
cmovne eax, ecx
mov dword [rbp - 0x54], eax
mov rcx, qword [rbp + 0x1c8]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x432571
jmp 0x432576
call fcn.0041bf30
mov eax, dword [rbp - 0x54]
add rsp, 0x250
pop rbp
ret
Function at 0x432cb0
Capabilities:
Set socket configuration

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov rax, qword [0x00442300]
mov rax, qword [rax]
xor rax, rbp
mov qword [rbp - 8], rax
mov qword [rbp - 0x18], rcx
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp - 0x18]
mov edx, 0x8004667e
lea r8, [rbp - 0xc]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [rbp - 0x1c], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x432d0b
jmp 0x432d10
call fcn.0041bf30
mov eax, dword [rbp - 0x1c]
add rsp, 0x40
pop rbp
ret
Function at 0x433430
Capabilities:
Resolve dns

Disassembly:
push rbp
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov eax, dword [rbp + 0x50]
mov rax, qword [0x00442300]
mov rax, qword [rax]
xor rax, rbp
mov qword [rbp + 0x18], rax
mov dword [rbp - 0x28], ecx
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x38], r8
mov qword [rbp - 0x40], r9
mov dword [rbp - 0x4c], 0
lea rcx, [rbp - 0x18]
xor edx, edx
mov r8d, 0x30
call fcn.0041ba90
mov eax, dword [rbp - 0x28]
mov dword [rbp - 0x14], eax
cmp dword [rbp + 0x50], 0
jne 0x433492
mov dword [rbp - 0x18], 4
mov rcx, qword [rbp - 0x30]
xor eax, eax
mov edx, eax
lea r8, [rbp - 0x18]
lea r9, [rbp - 0x20]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [rbp - 0x50], eax
cmp dword [rbp - 0x50], 0
je 0x4334c1
mov dword [rbp - 0x24], 0
jmp 0x43353b
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x48], rax
cmp qword [rbp - 0x20], 0
je 0x43352b
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x20]
cmp rax, qword [rcx + 0x10]
jb 0x43351a
mov rax, qword [rbp - 0x20]
mov rax, qword [rax + 0x20]
movzx eax, word [rax]
cmp eax, dword [rbp - 0x28]
jne 0x43351a
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x20]
mov rdx, qword [rax + 0x20]
mov rax, qword [rbp - 0x20]
mov r8, qword [rax + 0x10]
call fcn.0041bba0
mov dword [rbp - 0x4c], 1
mov rax, qword [rbp - 0x20]
mov rax, qword [rax + 0x28]
mov qword [rbp - 0x20], rax
jmp 0x4334c9
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, dword [rbp - 0x4c]
mov dword [rbp - 0x24], eax
mov eax, dword [rbp - 0x24]
mov dword [rbp - 0x54], eax
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x433560
jmp 0x433565
call fcn.0041bf30
mov eax, dword [rbp - 0x54]
add rsp, 0xa0
pop rbp
ret

Function at 0x433580
Capabilities:
Set socket configuration

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov rax, qword [0x00442300]
mov rax, qword [rax]
xor rax, rbp
mov qword [rbp - 8], rax
mov qword [rbp - 0x18], rcx
mov dword [rbp - 0xc], 1
mov rcx, qword [rbp - 0x18]
mov edx, 0x8004667e
lea r8, [rbp - 0xc]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [rbp - 0x1c], eax
mov rcx, qword [rbp - 8]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x4335db
jmp 0x4335e0
call fcn.0041bf30
mov eax, dword [rbp - 0x1c]
add rsp, 0x40
pop rbp
ret
Function at 0x43cc80
Capabilities:
Hash data using sha1

Disassembly:
push rbp
push rax
mov rbp, rsp
mov qword [rbp], rcx
mov rax, qword [rbp]
mov dword [rax], 0x67452301
mov rax, qword [rbp]
mov dword [rax + 4], 0xefcdab89
mov rax, qword [rbp]
mov dword [rax + 8], 0x98badcfe
mov rax, qword [rbp]
mov dword [rax + 0xc], 0x10325476
mov rax, qword [rbp]
mov dword [rax + 0x10], 0xc3d2e1f0
mov rax, qword [rbp]
mov dword [rax + 0x18], 0
mov rax, qword [rbp]
mov dword [rax + 0x14], 0
add rsp, 8
pop rbp
ret

Function at 0x43ce00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov rax, qword [0x00442300]
mov rax, qword [rax]
xor rax, rbp
mov qword [rbp - 8], rax
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x20], rdx
mov dword [rbp - 0x24], 0
cmp dword [rbp - 0x24], 8
jae 0x43ce7f
mov rax, qword [rbp - 0x20]
mov r8d, dword [rbp - 0x24]
mov ecx, 1
xor edx, edx
cmp r8d, 4
cmovae ecx, edx
movsxd rcx, ecx
mov eax, dword [rax + rcx*4 + 0x14]
mov edx, dword [rbp - 0x24]
and edx, 3
mov ecx, 3
sub ecx, edx
shl ecx, 3
shr eax, cl
and eax, 0xff
mov cl, al
mov eax, dword [rbp - 0x24]
mov byte [rbp + rax - 0x10], cl
mov eax, dword [rbp - 0x24]
add eax, 1
mov dword [rbp - 0x24], eax
jmp 0x43ce2a
mov rcx, qword [rbp - 0x20]
lea rdx, [0x0044a888]
mov r8d, 1
call fcn.0043cce0
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x14]
and eax, 0x1f8
cmp eax, 0x1c0
je 0x43cec7
mov rcx, qword [rbp - 0x20]
lea rdx, [0x0044a88a]
mov r8d, 1
call fcn.0043cce0
jmp 0x43ce95
mov rcx, qword [rbp - 0x20]
lea rdx, [rbp - 0x10]
mov r8d, 8
call fcn.0043cce0
mov dword [rbp - 0x24], 0
cmp dword [rbp - 0x24], 0x14
jae 0x43cf2b
mov rax, qword [rbp - 0x20]
mov ecx, dword [rbp - 0x24]
shr ecx, 2
mov ecx, ecx
mov eax, dword [rax + rcx*4]
mov edx, dword [rbp - 0x24]
and edx, 3
mov ecx, 3
sub ecx, edx
shl ecx, 3
shr eax, cl
and eax, 0xff
mov dl, al
mov rax, qword [rbp - 0x18]
mov ecx, dword [rbp - 0x24]
mov byte [rax + rcx], dl
mov eax, dword [rbp - 0x24]
add eax, 1
mov dword [rbp - 0x24], eax
jmp 0x43cee1
mov rcx, qword [rbp - 0x20]
xor edx, edx
mov r8d, 0x5c
call fcn.0041ba90
mov rcx, qword [rbp - 8]
xor rcx, rbp
mov rax, qword [0x00442300]
mov rax, qword [rax]
sub rax, rcx
jne 0x43cf5b
jmp 0x43cf60
call fcn.0041bf30
nop
add rsp, 0x50
pop rbp
ret