joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428b20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [ebp + 0x18], 0
push 0
je 0x428b53
mov ecx, dword [esi + 4]
push 0
push dword [ebp + 0x1c]
call fcn.004180d0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
jne 0x428b75
mov ecx, dword [esi + 4]
push 0x2719
push dword [ebp + 0x1c]
call fcn.004180d0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x1c]
push edi
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x428baf
mov eax, 0x2746
jmp 0x428bbc
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
je 0x428bdc
cmp eax, 0x3e5
je 0x428bdc
push dword [ebp + 0x18]
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.004180d0
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
mov ecx, dword [esi + 4]
push edi
call fcn.00418060
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x18
Function at 0x42d710
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword fs:[0x2c]
push esi
mov esi, ecx
mov dword [ebp - 0xc], 0
mov byte [ebp - 8], 0
mov edx, dword [eax]
mov eax, dword [0x65b810]
cmp eax, dword [edx + 4]
jle 0x42d761
push 0x65b810
call fcn.00571a96
add esp, 4
cmp dword [0x65b810], 0xffffffff
jne 0x42d761
call fcn.00404c90
push 0x65b810
call fcn.00571a57
add esp, 4
mov eax, dword [esi + 4]
mov dword [ebp - 4], 0x65b830
pop esi
cmp eax, 0xffffffff
jne 0x42d78f
mov edx, 0x2719
lea ecx, [ebp - 0x18]
call fcn.00417620
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0xc], xmm0
mov dword [ebp - 4], eax
jmp 0x42d7ac
push 4
push dword [ebp + 8]
push 1
push 6
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea ecx, [ebp - 0xc]
setne dl
call fcn.00418400
cmp byte [ebp - 8], 0
jne 0x42d7b8
mov esp, ebp
pop ebp
ret 4
mov edx, 0x61f610
lea ecx, [ebp - 0xc]
call fcn.004059e0
int3

Function at 0x42d7d0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword fs:[0x2c]
push esi
mov esi, ecx
mov dword [ebp - 0xc], 0
mov byte [ebp - 8], 0
mov edx, dword [eax]
mov eax, dword [0x65b810]
cmp eax, dword [edx + 4]
jle 0x42d821
push 0x65b810
call fcn.00571a96
add esp, 4
cmp dword [0x65b810], 0xffffffff
jne 0x42d821
call fcn.00404c90
push 0x65b810
call fcn.00571a57
add esp, 4
mov eax, dword [esi + 4]
mov dword [ebp - 4], 0x65b830
pop esi
cmp eax, 0xffffffff
jne 0x42d84f
mov edx, 0x2719
lea ecx, [ebp - 0x18]
call fcn.00417620
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0xc], xmm0
mov dword [ebp - 4], eax
jmp 0x42d872
push 4
push dword [ebp + 8]
push 0x1001
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea ecx, [ebp - 0xc]
setne dl
call fcn.00418400
cmp byte [ebp - 8], 0
jne 0x42d87e
mov esp, ebp
pop ebp
ret 4
mov edx, 0x61f610
lea ecx, [ebp - 0xc]
call fcn.004059e0
int3

Function at 0x42d890
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword fs:[0x2c]
push esi
mov esi, ecx
mov dword [ebp - 0xc], 0
mov byte [ebp - 8], 0
mov edx, dword [eax]
mov eax, dword [0x65b810]
cmp eax, dword [edx + 4]
jle 0x42d8e1
push 0x65b810
call fcn.00571a96
add esp, 4
cmp dword [0x65b810], 0xffffffff
jne 0x42d8e1
call fcn.00404c90
push 0x65b810
call fcn.00571a57
add esp, 4
mov eax, dword [esi + 4]
mov dword [ebp - 4], 0x65b830
pop esi
cmp eax, 0xffffffff
jne 0x42d90f
mov edx, 0x2719
lea ecx, [ebp - 0x18]
call fcn.00417620
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0xc], xmm0
mov dword [ebp - 4], eax
jmp 0x42d932
push 4
push dword [ebp + 8]
push 0x1002
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea ecx, [ebp - 0xc]
setne dl
call fcn.00418400
cmp byte [ebp - 8], 0
jne 0x42d93e
mov esp, ebp
pop ebp
ret 4
mov edx, 0x61f610
lea ecx, [ebp - 0xc]
call fcn.004059e0
int3
Function at 0x430a00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ceb4e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x649fe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x24]
mov dword [ebp - 4], 0
push dword [0x65cc54]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x430a70
mov eax, dword [eax + 4]
test eax, eax
je 0x430a70
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x430a70
mov dword [eax + 8], 0
mov al, byte [ecx]
cmp al, 9
jb 0x430a67
mov byte [ecx + 0x24], al
jmp 0x430a80
push ecx
call fcn.0043b800
add esp, 4
push 0x25
call fcn.0043b7c9
mov ecx, eax
add esp, 4
mov byte [ecx + 0x24], 9
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
test ecx, ecx
je 0x430acc
mov eax, dword [ebp + 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ecx + 0xc], eax
movq xmm0, qword [ebp + 0x14]
mov dword [ebp + 0xc], 0
mov dword [ebp + 0x10], 0
movq qword [ecx + 0x10], xmm0
mov eax, dword [ebp + 0x1c]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ecx + 0x1c], eax
mov dword [ecx], 0x431ad0
jmp 0x430ace
xor ecx, ecx
mov dword [edi], ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.00430ec0
mov dword [ebp - 4], 1
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x430b0e
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x430b0e
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x430b0e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x430ec0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce3c6
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x649fe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x430f24
mov dword [ebp - 4], 0
mov esi, dword [esi + 0xc]
test esi, esi
je 0x430f1d
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x430f1d
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x430f1d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x430f62
push dword [0x65cc54]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x430f52
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x430f52
cmp dword [ecx + 8], 0
jne 0x430f52
mov al, byte [esi + 0x24]
mov byte [esi], al
mov dword [ecx + 8], esi
jmp 0x430f5b
push esi
call fcn.0043b800
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431a00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d03e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x649fe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x38]
mov dword [ebp - 4], 0
push dword [0x65cc54]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x431a6f
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x431a6f
mov eax, dword [ecx + 8]
test eax, eax
je 0x431a6f
mov dword [ecx + 8], 0
mov cl, byte [eax]
cmp cl, 0xe
jb 0x431a66
mov byte [eax + 0x38], cl
jmp 0x431a7d
push eax
call fcn.0043b800
add esp, 4
push 0x39
call fcn.0043b7c9
add esp, 4
mov byte [eax + 0x38], 0xe
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
test eax, eax
je 0x431a99
push ecx
lea ecx, [ebp + 8]
push ecx
mov ecx, eax
call fcn.00431c60
jmp 0x431a9b
xor eax, eax
lea ecx, [ebp - 0x18]
mov dword [esi], eax
mov dword [ebp - 0x14], 0
call fcn.00431bc0
lea ecx, [ebp + 8]
call fcn.0042ee40
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x34

Function at 0x431bc0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x431bda
add ecx, 4
call fcn.0042ee40
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x431c20
push dword [0x65cc54]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x431c10
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x431c10
cmp dword [ecx + 8], 0
jne 0x431c10
mov al, byte [esi + 0x38]
mov byte [esi], al
mov dword [ecx + 8], esi
mov dword [edi + 4], 0
pop edi
pop esi
ret
push esi
call fcn.0043b800
add esp, 4
mov dword [edi + 4], 0
pop edi
pop esi
ret
Function at 0x431fe0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d048e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x649fe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x38]
mov dword [ebp - 4], 0
push dword [0x65cc54]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x432050
mov eax, dword [eax + 4]
test eax, eax
je 0x432050
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x432050
mov dword [eax + 8], 0
mov al, byte [ecx]
cmp al, 0xe
jb 0x432047
mov byte [ecx + 0x38], al
jmp 0x432060
push ecx
call fcn.0043b800
add esp, 4
push 0x39
call fcn.0043b7c9
mov ecx, eax
add esp, 4
mov byte [ecx + 0x38], 0xe
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
test ecx, ecx
je 0x4320c8
mov eax, dword [ebp + 8]
mov dword [ecx + 4], eax
movq xmm0, qword [ebp + 0xc]
movq qword [ecx + 8], xmm0
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ecx + 0x20], eax
movq xmm0, qword [ebp + 0x28]
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0
movq qword [ecx + 0x24], xmm0
mov eax, dword [ebp + 0x30]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp + 0x34]
mov dword [ecx + 0x30], eax
mov dword [ecx], 0x432330
jmp 0x4320ca
xor ecx, ecx
mov dword [edi], ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.00432270
mov dword [ebp - 4], 1
mov esi, dword [ebp + 0x24]
test esi, esi
je 0x43210a
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x43210a
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x43210a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x34
Function at 0x432120
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d048e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x649fe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x38]
mov dword [ebp - 4], 0
push dword [0x65cc54]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x432190
mov eax, dword [eax + 4]
test eax, eax
je 0x432190
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x432190
mov dword [eax + 8], 0
mov al, byte [ecx]
cmp al, 0xe
jb 0x432187
mov byte [ecx + 0x38], al
jmp 0x4321a0
push ecx
call fcn.0043b800
add esp, 4
push 0x39
call fcn.0043b7c9
mov ecx, eax
add esp, 4
mov byte [ecx + 0x38], 0xe
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
test ecx, ecx
je 0x432208
mov eax, dword [ebp + 8]
mov dword [ecx + 4], eax
movq xmm0, qword [ebp + 0xc]
movq qword [ecx + 8], xmm0
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ecx + 0x20], eax
movq xmm0, qword [ebp + 0x28]
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0
movq qword [ecx + 0x24], xmm0
mov eax, dword [ebp + 0x30]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp + 0x34]
mov dword [ecx + 0x30], eax
mov dword [ecx], 0x432430
jmp 0x43220a
xor ecx, ecx
mov dword [edi], ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], 0
call fcn.00432270
mov dword [ebp - 4], 1
mov esi, dword [ebp + 0x24]
test esi, esi
je 0x43224a
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x43224a
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x43224a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x34
Function at 0x432270
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ce3c6
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x649fe8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi + 8]
test esi, esi
je 0x4322d4
mov dword [ebp - 4], 0
mov esi, dword [esi + 0x20]
test esi, esi
je 0x4322cd
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x4322cd
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x4322cd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [edi + 8], 0
mov esi, dword [edi + 4]
test esi, esi
je 0x432312
push dword [0x65cc54]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x432302
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x432302
cmp dword [ecx + 8], 0
jne 0x432302
mov al, byte [esi + 0x38]
mov byte [esi], al
mov dword [ecx + 8], esi
jmp 0x43230b
push esi
call fcn.0043b800
add esp, 4
mov dword [edi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x434f90
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x61fe38
push 1
mov edi, ecx
mov dword [ebp - 4], 0
push 0
push 0x61fe28
mov dword [edi], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jns 0x434fd4
push esi
push 0x61fb8c
jmp 0x435005
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jns 0x434fef
push esi
push 0x61fbb0
jmp 0x435005
mov eax, dword [ebp - 4]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
jns 0x43500d
push esi
push 0x61fc14
call fcn.00434f60
add esp, 8
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x43501a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x435027
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x435530
Capabilities:
Reference google public dns server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x649fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x20], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x1c], esi
mov eax, 2
movq qword [ebp - 0x12], xmm0
push 0x61ffac
mov dword [ebp - 0xa], esi
mov word [ebp - 6], si
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x5a
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetBestInterfaceEx]
test eax, eax
jne 0x435618
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x435618
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x435618
push edi
push eax
call fcn.00594b37
mov edi, eax
add esp, 4
test edi, edi
je 0x435606
lea eax, [ebp - 0x18]
push eax
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x4355fd
mov ecx, dword [ebp - 0x1c]
mov eax, edi
nop dword [eax]
cmp dword [eax + 0x19c], ecx
je 0x4355e0
mov eax, dword [eax]
test eax, eax
jne 0x4355d0
jmp 0x4355fd
push 0x104
push dword [ebp - 0x20]
add eax, 8
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, 1
push edi
call fcn.00590ab7
add esp, 4
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00571951
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00571951
mov esp, ebp
pop ebp
ret
Function at 0x435840
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x649fe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x61fe90
xor ebx, ebx
mov esi, ecx
push 0x61fe68
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push 0x61ffb4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 8], bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x435918
push edi
push 0x828
call fcn.0043b805
mov edi, eax
add esp, 4
test edi, edi
je 0x435914
push 0x828
push ebx
push edi
call fcn.0058db90
add esp, 0xc
lea eax, [ebp - 0x18]
push ebx
push eax
push 0x826
push edi
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push dword [ebp - 0x14]
call dword [ebp - 0x1c]
test eax, eax
je 0x435909
cmp dword [ebp - 0x18], ebx
jbe 0x435909
mov eax, dword [edi + 0x10]
test eax, eax
je 0x435909
cmp eax, 0xffffffff
je 0x435909
lea ecx, [eax + edi]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi], al
lea esi, [esi + 1]
test al, al
jne 0x4358f6
mov ebx, 1
push 0x28
push edi
call fcn.00571e42
add esp, 8
mov eax, dword [ebp - 0x14]
pop edi
test eax, eax
je 0x435928
cmp eax, 0xffffffff
je 0x435928
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00571951
mov esp, ebp
pop ebp
ret
Function at 0x435a20
Capabilities:
Get hostname
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d0a10
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x649fe8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push 0x114
lea eax, [ebp - 0x168]
push 0
push eax
call fcn.0058db90
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 0x170]
mov dword [ebp - 0x170], 0xf
push eax
lea eax, [esi + 0x7a]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0x40
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.0058db90
add esp, 0xc
mov dword [ebp - 0x54], 0x40
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x435ac1
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
shrd ecx, eax, 0x14
shr eax, 0x14
mov word [esi + 0x28], cx
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ax, word [ebp - 0x180]
push 0x114
mov word [esi + 0x2a], ax
lea eax, [ebp - 0x168]
push 0
push eax
call fcn.0058db90
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
add esp, 0xc
mov dword [ebp - 0x168], 0x114
push 0x61fea0
push 0x61feb0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
je 0x435b21
lea ecx, [ebp - 0x168]
push ecx
call eax
mov eax, dword [ebp - 0x164]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 0x160]
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 0x15c]
mov dword [esi + 0x34], eax
call fcn.00405f10
lea ecx, [esi + 0xa7]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], edx
call fcn.00435840
call fcn.00435630
mov dword [esi + 0x4c], edx
lea ecx, [esi + 0x5c]
lea edx, [esi + 0x38]
mov dword [esi + 0x48], eax
call fcn.00435940
call fcn.00435340
test eax, eax
je 0x435b75
or dword [esi + 0x50], 1
call fcn.004353e0
test eax, eax
je 0x435b82
or dword [esi + 0x50], 0x20
push 0x61ff58
push 0x61fe68
call edi
push eax
call ebx
test eax, eax
je 0x435b9f
call eax
test eax, eax
je 0x435b9f
or dword [esi + 0x50], 0x40
push 0x61fe58
push 0x61fe68
mov dword [ebp - 0x16c], 0
call edi
push eax
call ebx
mov edi, eax
test edi, edi
je 0x435bce
lea eax, [ebp - 0x16c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
cmp dword [ebp - 0x16c], 0
je 0x435bde
or dword [esi + 0x50], 0x800
call fcn.004354b0
test al, al
je 0x435bee
or dword [esi + 0x50], 0x8000
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00571951
mov esp, ebp
pop ebp
ret
Function at 0x435c20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
mov edi, ecx
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x435c83
push edi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x435c83
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435c50
sub ecx, edx
sar ecx, 1
cmp word [edi + ecx*2 - 2], 0x5c
je 0x435c83
add edi, 0xfffffffe
nop word [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x435c70
mov eax, dword [0x61ff8c]
mov dword [edi], eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x435c90
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x649fe8]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [esp + 0x1c], ecx
xor edi, edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
xor esi, esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
nop word [eax + eax]
push 0x206
lea eax, [esp + 0x2e]
push 0
push eax
call fcn.0058db90
mov ax, word [esi + 0x61ff90]
push 0x61ffdc
mov word [esp + 0x38], ax
lea eax, [esp + 0x38]
push 0x104
push eax
call fcn.00594e56
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x435d6b
push 0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x435d6b
mov ecx, dword [esp + 0x14]
cmp ecx, edi
jb 0x435d6b
mov eax, dword [esp + 0x10]
ja 0x435d51
cmp eax, ebx
jbe 0x435d6b
mov ebx, eax
mov edi, ecx
lea eax, [esp + 0x28]
push eax
push 0x104
push dword [esp + 0x24]
call fcn.005961f3
add esp, 0xc
add esi, 2
cmp esi, 0x18
jb 0x435ce0
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00571951
mov esp, ebp
pop ebp
ret