joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a768
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x531e43
call fcn.004e499e
mov edi, edx
mov esi, ecx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 4
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwarePsiphon3
push SysReAllocString
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x45a7c8
cmp dword [esi + 0x14], 0x10
jb 0x45a7aa
mov esi, dword [esi]
push eax
push esi
push str.ReadRegistryDwordValue
push str._s:_RegOpenKeyEx_failed_for__hs_with_code__ld
push 1
push ebx
call fcn.0043a0a0
add esp, 0x18
xor al, al
jmp 0x45a858
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
call fcn.0041ffcf
add esp, 4
mov dword [ebp - 4], ebx
cmp dword [esi + 0x14], 0x10
jb 0x45a7e3
mov eax, dword [esi]
jmp 0x45a7e5
mov eax, esi
lea ecx, [ebp - 0x18]
push ecx
push edi
lea ecx, [ebp - 0x14]
push ecx
push ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x45a813
cmp dword [esi + 0x14], 0x10
jb 0x45a805
mov esi, dword [esi]
push eax
push esi
push str.ReadRegistryDwordValue
push str._s:_RegQueryValueExA_failed_for__hs_with_code__ld
jmp 0x45a82f
cmp dword [ebp - 0x14], 4
je 0x45a83c
cmp dword [esi + 0x14], 0x10
jb 0x45a821
mov esi, dword [esi]
push dword [ebp - 0x14]
push esi
push str.ReadRegistryDwordValue
push str._s:_RegQueryValueExA_says_type_of__hs_is__ld__not_REG_DWORD
push 1
push ebx
call fcn.0043a0a0
add esp, 0x18
jmp 0x45a83e
mov bl, 1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x1c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov al, bl
call fcn.004e4967
ret
Function at 0x45a85e
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x531e66
call fcn.004e499e
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
mov dword [ebp - 0x10], ebx
mov dword [eax], ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwarePsiphon3
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x45a8c0
cmp dword [esi + 0x14], 0x10
jb 0x45a8a2
mov esi, dword [esi]
push eax
push esi
push str.WriteRegistryStringValue
push str._s:_RegCreateKeyEx_failed_for__hs_with_code__ld
push 1
push ebx
call fcn.0043a0a0
add esp, 0x18
xor al, al
jmp 0x45a94a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.0041ffcf
add esp, 4
mov dword [ebp - 4], ebx
cmp dword [edi + 0x14], 0x10
mov eax, dword [edi + 0x10]
jb 0x45a8dc
mov edi, dword [edi]
cmp dword [esi + 0x14], 0x10
jb 0x45a8e6
mov ecx, dword [esi]
jmp 0x45a8e8
mov ecx, esi
inc eax
push eax
push edi
push 1
push ebx
push ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test edi, edi
je 0x45a92e
cmp dword [esi + 0x14], 0x10
jb 0x45a906
mov esi, dword [esi]
push edi
push esi
push str.WriteRegistryStringValue
xor esi, esi
push str._s:_RegSetValueExA_failed_for__hs_with_code__ld
inc esi
push esi
push ebx
call fcn.0043a0a0
add esp, 0x18
cmp edi, 0x5aa
jne 0x45a930
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x45a930
mov bl, 1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov al, bl
call fcn.004e4967
ret
Function at 0x45a950
Capabilities:
Set registry value

Disassembly:
push 0x30
mov eax, 0x531e91
call fcn.004e49d2
mov edi, edx
mov esi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
xor ebx, ebx
mov dword [ebp - 0x38], eax
mov edx, esi
mov dword [ebp - 0x34], ebx
mov dword [eax], ebx
call fcn.00425a9d
push ebx
lea eax, [ebp - 0x34]
mov dword [ebp - 4], ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwarePsiphon3
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x45a9c7
cmp dword [esi + 0x14], 0x10
jb 0x45a9a4
mov esi, dword [esi]
push eax
push esi
push str.WriteRegistryStringValue
xor ebx, ebx
push str._s:_RegCreateKeyEx_failed_for__hs_with_code__ld
inc ebx
push ebx
push 0
call fcn.0043a0a0
add esp, 0x18
mov byte [ebp - 0x2d], 0
jmp 0x45aa5a
push dword [ebp - 0x34]
lea ecx, [ebp - 0x3c]
call fcn.0041ffcf
add esp, 4
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x45a9e6
mov edi, dword [edi]
cmp dword [ebp - 0x18], 8
lea eax, [eax*2 + 2]
push eax
push edi
push ebx
lea ecx, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
push 0
push ecx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x45aa3f
cmp dword [esi + 0x14], 0x10
jb 0x45aa15
mov esi, dword [esi]
push edi
push esi
push str.WriteRegistryStringValue
push str._s:_RegSetValueExW_failed_for__hs_with_code__ld
push ebx
push 0
call fcn.0043a0a0
add esp, 0x18
cmp edi, 0x5aa
jne 0x45aa39
mov eax, dword [ebp - 0x38]
mov dword [eax], ebx
mov byte [ebp - 0x2d], 0
jmp 0x45aa42
mov byte [ebp - 0x2d], bl
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x3c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00427ba9
mov al, byte [ebp - 0x2d]
call fcn.004e497c
ret
Function at 0x45aa6e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x531e43
call fcn.004e499e
mov esi, edx
mov edi, ecx
xor ebx, ebx
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], ebx
jb 0x45aa8d
mov eax, dword [esi]
jmp 0x45aa8f
mov eax, esi
mov byte [eax], bl
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push str.SoftwarePsiphon3
push SysReAllocString
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x45aad0
push eax
push edi
push str.ReadRegistryStringValue
push str._s:_RegOpenKeyEx_failed_for__hs_with_code__ld
push 1
push ebx
call fcn.0043a0a0
add esp, 0x18
xor al, al
jmp 0x45ab83
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
call fcn.0041ffcf
add esp, 4
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
push ebx
push edi
push dword [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x45ab07
push eax
push edi
push str.ReadRegistryStringValue
push str._s:_RegQueryValueExA_1__failed_for__hs_with_code__ld
jmp 0x45ab5a
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x45ab18
push ebx
dec eax
mov ecx, esi
push eax
call fcn.00416b9d
cmp dword [esi + 0x14], 0x10
jb 0x45ab20
mov esi, dword [esi]
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x45ab46
push eax
push edi
push str.ReadRegistryStringValue
push str._s:_RegQueryValueExA_2__failed_for__hs_with_code__ld
jmp 0x45ab5a
cmp dword [ebp - 0x18], 1
je 0x45ab67
push dword [ebp - 0x18]
push edi
push str.ReadRegistryStringValue
push str._s:_RegQueryValueExA_says_type_of__hs_is__ld__not_REG_SZ
push 1
push ebx
call fcn.0043a0a0
add esp, 0x18
jmp 0x45ab69
mov bl, 1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x1c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
mov al, bl
call fcn.004e4967
ret
Function at 0x45ab89
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x34
mov eax, 0x531ec6
call fcn.004e49d2
mov esi, edx
mov edi, ecx
xor ebx, ebx
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], ebx
jb 0x45aba8
mov eax, dword [esi]
jmp 0x45abaa
mov eax, esi
xor ecx, ecx
mov edx, edi
mov word [eax], cx
lea ecx, [ebp - 0x2c]
call fcn.0042738f
lea eax, [ebp - 0x34]
mov dword [ebp - 4], ebx
push eax
push 0x20019
push ebx
push str.SoftwarePsiphon3
push SysReAllocString
mov dword [ebp - 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x45ac00
push eax
push edi
push str.ReadRegistryStringValue
xor ebx, ebx
push str._s:_RegOpenKeyEx_failed_for__hs_with_code__ld
inc ebx
push ebx
push 0
call fcn.0043a0a0
add esp, 0x18
mov byte [ebp - 0x2d], 0
jmp 0x45ace6
push dword [ebp - 0x34]
lea ecx, [ebp - 0x40]
call fcn.0041ffcf
add esp, 4
xor edx, edx
lea ecx, [ebp - 0x38]
push ecx
xor ebx, ebx
lea eax, [ebp - 0x2c]
push edx
inc ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], 8
push edx
cmovae eax, dword [ebp - 0x2c]
push edx
push eax
push dword [ebp - 0x34]
mov dword [ebp - 0x38], edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x45ac47
push eax
push edi
push str.ReadRegistryStringValue
push str._s:_RegQueryValueExW_1__failed_for__hs_with_code__ld
jmp 0x45acba
mov eax, dword [ebp - 0x38]
test al, 1
je 0x45ac5c
push eax
push edi
push str.ReadRegistryStringValue
push str._s:_RegQueryValueExW_1__for__hs_says_bufferLength_is_not_a_multiple_of_sizeof_wchar_t_:__ld
jmp 0x45acba
test eax, eax
je 0x45ac6d
shr eax, 1
mov ecx, esi
push 0
dec eax
push eax
call fcn.00431b38
cmp dword [esi + 0x14], 8
jb 0x45ac75
mov esi, dword [esi]
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x38]
push ecx
push esi
lea ecx, [ebp - 0x3c]
push ecx
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push 0
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x45aca7
push eax
push edi
push str.ReadRegistryStringValue
push str._s:_RegQueryValueExW_2__failed_for__hs_with_code__ld
jmp 0x45acba
cmp dword [ebp - 0x3c], ebx
je 0x45accb
push dword [ebp - 0x3c]
push edi
push str.ReadRegistryStringValue
push str._s:_RegQueryValueExW_says_type_of__hs_is__ld__not_REG_SZ
push ebx
push 0
call fcn.0043a0a0
add esp, 0x18
mov byte [ebp - 0x2d], 0
jmp 0x45acce
mov byte [ebp - 0x2d], bl
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x40]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00427ba9
mov al, byte [ebp - 0x2d]
call fcn.004e497c
ret
Function at 0x45aff8
Capabilities:
Encode data using base64 via winapi

Disassembly:
push 0x24
mov eax, 0x52fc10
call fcn.004e49d2
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x2c], esi
mov ebx, dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
lea eax, [ebp - 0x2c]
push eax
xor ecx, ecx
push ecx
push SysReAllocString
push dword [ebp + 8]
mov dword [ebp - 0x30], ecx
push edi
mov dword [ebp - 0x2c], ecx
call ebx
test eax, eax
jne 0x45b03e
push 0x550335
mov ecx, esi
call fcn.004147d9
jmp 0x45b0c2
xor eax, eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
push eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.00416b9d
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push SysReAllocString
push dword [ebp + 8]
push edi
call ebx
test eax, eax
jne 0x45b08d
push 0x550335
mov ecx, esi
call fcn.004147d9
xor ebx, ebx
jmp 0x45b0b7
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x28]
xor ebx, ebx
mov byte [ecx + eax], bl
lea eax, [ebp - 0x28]
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], ebx
push eax
mov byte [esi], bl
call fcn.00416ec8
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00416ab1
mov eax, esi
call fcn.004e497c
ret

Function at 0x45b0ca
Capabilities:
Decode data using base64 via winapi

Disassembly:
push 0x28
mov eax, 0x531fb7
call fcn.004e49d2
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x30], esi
xor edx, edx
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
jb 0x45b0ef
mov eax, dword [edi]
jmp 0x45b0f1
mov eax, edi
mov ebx, dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
lea ecx, [ebp - 0x30]
push edx
push edx
push ecx
push edx
push 1
push dword [edi + 0x10]
push eax
call ebx
test eax, eax
jne 0x45b118
push 0x550335
mov ecx, esi
call fcn.004147d9
jmp 0x45b191
xor eax, eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
push eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.00416b9d
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x10]
cmovae eax, dword [ebp - 0x2c]
cmp dword [edi + 0x14], 0x10
jb 0x45b14c
mov edi, dword [edi]
push 0
push 0
lea edx, [ebp - 0x30]
push edx
push eax
push 1
push ecx
push edi
call ebx
mov ecx, esi
test eax, eax
jne 0x45b16f
push 0x550335
call fcn.004147d9
push 0
jmp 0x45b187
xor ebx, ebx
mov dword [esi + 0x14], 0xf
lea eax, [ebp - 0x2c]
mov dword [esi + 0x10], ebx
push eax
mov byte [esi], bl
call fcn.00416ec8
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00416ab1
mov eax, esi
call fcn.004e497c
ret
Function at 0x45c6c0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 8
mov eax, 0x53239c
call fcn.004e499e
mov esi, edx
push dword [0x5e97b0]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x45c702
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.CopyToClipboard
push str._s:_OpenClipboard_failed:__d
push 1
push 0
call fcn.0043a0a0
add esp, 0x14
xor al, al
jmp 0x45c7fd
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x45c727
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.CopyToClipboard
push str._s:_EmptyClipboard_failed:__d
jmp 0x45c7e6
lea eax, [esi + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
lea eax, [eax*2 + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x45c75b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.CopyToClipboard
push str._s:_GlobalAlloc_failed:__d
jmp 0x45c7e6
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov ecx, eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
jne 0x45c77e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.CopyToClipboard
push str._s:_GlobalLock_failed:__d
jmp 0x45c7e6
cmp dword [esi + 0x14], 8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
jb 0x45c78b
mov esi, dword [esi]
add eax, eax
push eax
push esi
push ecx
call fcn.004fd330
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [eax]
push edi
mov word [ecx + eax*2], dx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x45c7cc
call esi
test eax, eax
je 0x45c7cc
call esi
push eax
push str.CopyToClipboard
push str._s:_GlobalUnlock_failed:__d
jmp 0x45c7e6
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x45c7f3
call esi
push eax
push str.CopyToClipboard
push str._s:_SetClipboardData_failed:__d
push 1
push ebx
call fcn.0043a0a0
add esp, 0x14
jmp 0x45c7f5
mov bl, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
call fcn.004e4967
ret

Function at 0x45c877
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
push 0xa
push ecx
push dword [0x5e97ac]
and dword [edi], 0
and dword [ebx], 0
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
jne 0x45c8ba
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.GetResourceBytes___FindResource_failed___d_
push 0
push 0
call fcn.0043a0a0
add esp, 0x10
xor al, al
jmp 0x45c8eb
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x45c8d5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.GetResourceBytes___LoadResource_failed___d_
jmp 0x45c8aa
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push 0
mov dword [edi], eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [ebx], eax
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x45c9fe
Capabilities:
Get common file path

Disassembly:
push 0x244
mov eax, 0x532415
call fcn.004e49d2
push 0x105
lea eax, [ebp - 0x220]
xor esi, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
je 0x45caaf
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x250]
call fcn.00426582
push 0x5b9e14
mov edx, eax
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x238]
call fcn.004250a2
or dword [ebp - 4], 0xffffffff
pop ecx
push esi
push 1
lea ecx, [ebp - 0x250]
call fcn.00427ba9
cmp dword [ebp - 0x224], 8
lea eax, [ebp - 0x238]
cmovae eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
push esi
push 1
lea ecx, [ebp - 0x238]
mov edi, eax
call fcn.00427ba9
test edi, edi
je 0x45caaf
push str.SetProcessDpiAwareness
push edi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x45caa8
push 2
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov eax, esi
call fcn.004e497c
ret
Function at 0x45cbf0
Capabilities:
Get local ipv4 addresses

Disassembly:
push 0x50
mov eax, 0x532478
call fcn.004e49d2
mov dword [ebp - 0x4c], ecx
mov eax, 0x3a98
xor ebx, ebx
mov dword [ebp - 0x44], eax
push 2
pop edi
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x50], esi
test esi, esi
je 0x45cd14
lea eax, [ebp - 0x44]
push eax
push esi
push 0
push 0xe
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov edi, eax
cmp edi, 0x6f
jne 0x45cc61
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
xor esi, esi
inc ebx
cmp ebx, 3
jge 0x45cce3
mov eax, dword [ebp - 0x44]
jmp 0x45cc09
test edi, edi
jne 0x45cce3
mov eax, esi
mov esi, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
mov ebx, dword [eax + 0x10]
test ebx, ebx
je 0x45ccd4
push 2
pop edx
mov ecx, dword [ebx + 0xc]
cmp word [ecx], dx
jne 0x45ccca
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
push 0x16
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x28]
push eax
lea eax, [ecx + 4]
push eax
push edx
call dword [sym.imp.WS2_32.dll_inet_ntop]
test eax, eax
je 0x45ccc7
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.0042738f
and dword [ebp - 4], 0
mov ecx, esi
push eax
call fcn.00424286
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
push 0
push 1
call fcn.00427ba9
push 2
pop edx
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x45cc77
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 8]
mov dword [ebp - 0x48], eax
test eax, eax
jne 0x45cc6d
mov esi, dword [ebp - 0x50]
jmp 0x45ccfa
push edi
push str.GetLocalIPv4Addresses
push str._s___GetAdaptersAddresses_failed___d_
push 0
push 0
call fcn.0043a0a0
add esp, 0x14
test esi, esi
je 0x45cd0e
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
call fcn.004e497c
ret
push str.GetLocalIPv4Addresses
push str._s___HeapAlloc_failed
push 0
push 0
call fcn.0043a0a0
add esp, 0x10
lea ecx, [ebp - 0x5c]
push str.GetLocalIPv4Addresses:2192:_memory_allocation_failed
call fcn.0040ea4b
push 0x5ddbe8
lea eax, [ebp - 0x5c]
push eax
call fcn.004fda0a
int3
Function at 0x460226
Capabilities:
Get common file path

Disassembly:
push 0x244
mov eax, 0x532415
call fcn.004e49d2
push 0x105
lea eax, [ebp - 0x220]
xor ebx, ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
je 0x460306
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x250]
call fcn.00426582
push str.DNSAPI.DLL
mov edx, eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x238]
call fcn.004250a2
or dword [ebp - 4], 0xffffffff
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x250]
call fcn.00427ba9
cmp dword [ebp - 0x224], 8
lea eax, [ebp - 0x238]
cmovae eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
push ebx
push 1
lea ecx, [ebp - 0x238]
mov esi, eax
call fcn.00427ba9
test esi, esi
je 0x460306
push str.DnsFlushResolverCache
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x4602ec
call eax
test eax, eax
jne 0x4602e8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.DnsFlushResolverCache_failed:__d
push ebx
push ebx
call fcn.0043a0a0
add esp, 0x10
jmp 0x4602fb
mov bl, 1
jmp 0x4602fb
push str.GetProcAddress_DnsFlushResolverCache_failed
push ebx
push ebx
call fcn.0043a0a0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov al, bl
jmp 0x460317
push str.LoadLibrary_DNSAPI_failed
push ebx
push ebx
call fcn.0043a0a0
add esp, 0xc
xor al, al
call fcn.004e497c
ret

Function at 0x460331
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 0x44
xor edi, edi
lea eax, [ebp - 0x58]
push edi
push eax
mov ebx, ecx
call fcn.004fd8b0
add esp, 0xc
mov esi, ebx
xorps xmm0, xmm0
movups xmmword [ebp - 0x10], xmm0
push 2
lea ecx, [esi + 2]
pop edx
mov ax, word [esi]
add esi, edx
cmp ax, di
jne 0x46035c
sub esi, ecx
xor ecx, ecx
sar esi, 1
inc esi
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e461a
push esi
push ebx
mov edi, eax
push esi
push edi
call fcn.0050e113
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
push edi
test eax, eax
je 0x4603b3
call fcn.004e3e1e
mov eax, dword [ebp - 0x10]
jmp 0x4603ba
call fcn.004e3e1e
xor eax, eax
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4750b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528b46
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x5e1390]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x30]
xor al, al
mov ecx, dword [esi + 0x2c]
mov edi, edx
rep stosb byte es:[edi], al
push edx
call fcn.0050c82a
add esp, 4
mov dword [ebp - 4], 0
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4750ff
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x475110
push 0x44
push esi
call fcn.004e460c
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x47ce10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5341c9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e1390]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
cmp dword [0x5e9884], 0
jne 0x47ce5d
call fcn.0046eac0
mov dword [0x5e9884], 0x464210
mov esi, dword [ebp + 8]
mov ecx, 2
mov dword [esi], vtable.CryptoPP::Integer.0
mov dword [esi + 8], 2
call fcn.00473e30
mov ecx, 8
call fcn.0047ed50
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 0
mov dword [eax + 4], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
push 1
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov ecx, edi
push dword [ebp + 0xc]
mov edx, dword [edi]
push esi
mov dword [ebp - 0x10], 1
call dword [edx + 0x30]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc