joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420a70
Capabilities:
Create thread

Disassembly:
sub esp, 0x11c
push ebx
mov ebx, ecx
push ebp
push esi
lea ebp, [ebx + 0xf80]
push edi
push ebp
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0xf68]
mov esi, dword [eax]
cmp esi, eax
je 0x420c22
mov edi, dword [esi + 8]
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 0xc]
test eax, eax
je 0x420ac9
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 4]
test eax, eax
je 0x420ac9
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x7c]
test eax, eax
jne 0x420ada
mov esi, dword [esi]
mov eax, dword [ebx + 0xf68]
cmp esi, eax
jne 0x420aa5
jmp 0x420c22
mov ecx, edi
call fcn.0040e840
mov ecx, edi
call fcn.0040e600
mov ecx, dword [esp + 0x130]
push 0
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
cmp ax, 0xffff
jne 0x420b1f
mov ecx, edi
call fcn.0040e790
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x11c
ret 4
test ax, ax
jbe 0x420be9
and eax, 0xffff
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x130]
lea edx, [esp + 0x24]
push 0x106
push edx
push eax
push ecx
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
test eax, eax
jbe 0x420bcd
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.0043052b
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x420bcd
lea eax, [esp + 0x24]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [edi + 0x563c]
push 0xc
mov ebx, dword [esi + 4]
call fcn.0043052b
add esp, 4
mov ecx, esi
test esi, esi
jne 0x420b9c
mov ecx, eax
test ebx, ebx
mov dword [eax], ecx
jne 0x420ba4
mov ebx, eax
mov dword [eax + 4], ebx
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
add eax, 8
test eax, eax
je 0x420bb8
mov dword [eax], ebp
mov eax, dword [edi + 0x5640]
mov dword [esp + 0x10], 1
inc eax
mov dword [edi + 0x5640], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
inc ecx
dec eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
jne 0x420b39
mov ebp, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push 0
push edi
push 0x424810
push 0
push 0
call fcn.00430fbe
add esp, 0x18
test eax, eax
jne 0x420c0c
mov dword [esp + 0x10], eax
jmp 0x420c1b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x420c22
mov ecx, edi
call fcn.0040e790
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret 4
Function at 0x4223c0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x110
lea eax, [esp + 0x10]
push ebx
push ebp
push esi
push edi
push 0x80
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
jne 0x422405
mov edx, dword [esp + 0x124]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x422405
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov ebp, eax
test ebp, ebp
je 0x422481
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x422481
xor ebx, ebx
movsx ecx, word [ebp + 0xa]
mov esi, dword [ebx + eax]
mov edx, ecx
lea edi, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
lea ecx, [esp + 0xa4]
push 0x450fec
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x130]
add esp, 0xc
lea edx, [esp + 0xa0]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4223f5
mov eax, dword [ebp + 0xc]
add ebx, 4
cmp dword [ebx + eax], 0
jne 0x422420
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret

Function at 0x423bb0
Capabilities:
Create thread

Disassembly:
push ecx
call fcn.00423940
test eax, eax
je 0x423be1
lea eax, [esp]
push eax
push 0
push 0
push 0x4222d0
push 0
push 0
call fcn.00430fbe
add esp, 0x18
test eax, eax
jne 0x423bda
pop ecx
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ecx
ret

Function at 0x423cb0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x45bb80]
sub esp, 0x10
dec eax
mov dword [0x45bcac], 1
push esi
push edi
je 0x423d15
dec eax
jne 0x423d3a
lea eax, [esp + 8]
mov dword [esp + 8], 0x44f548
push eax
mov dword [esp + 0x10], 0x423d70
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
test eax, eax
jne 0x423d3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x451d68
call fcn.00424580
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x10
ret
push 0x451d58
call fcn.00427f30
mov edi, eax
add esp, 4
test edi, edi
je 0x423d3a
push 0x451d40
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x423d42
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret
push 1
push 0
call esi
push 0
call fcn.0041a000
add esp, 4
push 0
push 0
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x423e50
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
push 0
push 0
push 0x423ed0
push 0
push 0
call fcn.00430fbe
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x423e8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x451dd0
call fcn.00424580
add esp, 8
xor eax, eax
pop esi
pop ecx
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
push 0x45bb88
call edi
push eax
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
pop edi
test eax, eax
push esi
jne 0x423ebb
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
pop ecx
ret
Function at 0x424230
Capabilities:
Delete registry value
Delete service
Persist via run registry key
Query service status
Stop service

Disassembly:
mov eax, dword [0x45bb80]
sub esp, 0x20
dec eax
push ebp
push esi
je 0x4243b4
dec eax
jne 0x424456
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebp, eax
test ebp, ebp
je 0x424391
push 0xf01ff
push 0x44f548
push ebp
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x424367
lea eax, [esp + 0xc]
push ebx
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x4242e7
lea ecx, [esp + 0x10]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
push ecx
push esi
call edi
test eax, eax
je 0x4242c2
cmp dword [esp + 0x18], 3
jne 0x4242c2
push 0xbb8
call ebx
lea edx, [esp + 0x14]
push edx
push esi
call edi
test eax, eax
jne 0x4242a8
mov eax, dword [esp + 0x18]
pop edi
cmp eax, 1
je 0x4242e7
push 0x2710
push 0x30
push 0x44f3c0
push 0x452110
push 0
call fcn.00429240
add esp, 0x14
push 0x3e8
call ebx
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
pop ebx
jne 0x42433c
push 0x2710
push 0x30
push 0x44f3c0
push 0x4520e0
push eax
call fcn.00429240
push 0
push 0
push 0x44f3c0
push 0x66
push 1
call fcn.004246a0
add esp, 0x28
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
push 0
push 0
push 0x44f3c0
push 0x65
push 4
call fcn.004246a0
add esp, 0x14
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
push 0x2710
push 0x30
push 0x44f3c0
push 0x4520b4
push 0
call fcn.00429240
add esp, 0x14
push ebp
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
push 0x2710
push 0x30
push 0x44f3c0
push 0x45200c
push 0
call fcn.00429240
add esp, 0x14
xor eax, eax
pop esi
pop ebp
add esp, 0x20
ret
call fcn.00423c90
test eax, eax
jne 0x4243d7
push 0x2710
push 0x30
push 0x44f3c0
push 0x451fdc
push eax
call fcn.00429240
add esp, 0x14
lea eax, [esp + 8]
push eax
push 0x451e60
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x424413
push 0x2710
push 0x30
push 0x44f3c0
push 0x451f98
push 0
call fcn.00429240
add esp, 0x14
xor eax, eax
pop esi
pop ebp
add esp, 0x20
ret
mov ecx, dword [esp + 8]
push 0x44f548
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x42444f
mov edx, dword [esp + 8]
push edx
call esi
push 0x2710
push 0x30
push 0x44f3c0
push 0x4520e0
push 0
call fcn.00429240
add esp, 0x14
mov eax, dword [esp + 8]
push eax
call esi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x4246a0
Capabilities:
Access the windows event log

Disassembly:
sub esp, 0x10
push esi
push edi
call fcn.00423930
test eax, eax
jne 0x42471f
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4246bb
mov eax, 0x4571f0
mov ecx, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
xor edi, edi
lea eax, [esp + 8]
mov ecx, 3
cmp dword [eax], 0
je 0x4246e0
inc edi
add eax, 4
dec ecx
jne 0x4246da
push 0x44f548
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x42471f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 8]
push 0
push edx
push 0
push edi
push 0
push eax
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop edi
pop esi
add esp, 0x10
ret

Function at 0x424730
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x210
call fcn.00423930
test eax, eax
jne 0x4247fb
lea eax, [esp + 0x10c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4247fb
lea ecx, [esp + 8]
push 0x451e98
push ecx
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 8]
push 0x44f548
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp]
lea ecx, [esp + 8]
push eax
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4247fb
lea edx, [esp + 0x10c]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 4]
inc eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
lea eax, [esp + 0x114]
push eax
push 2
push 0
push 0x4521a8
push ecx
call esi
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push 4
push edx
push 4
push 0
push 0x452198
push eax
mov dword [esp + 0x20], 0x1f
call esi
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 0x210
ret
Function at 0x425721
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], 1
mov eax, dword [esi + 0xa10]
test eax, eax
jl 0x42573d
pop edi
xor eax, eax
pop esi
pop ecx
ret
push 0
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
test eax, eax
mov dword [esi + 0xa10], eax
jge 0x425759
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov edi, dword [sym.imp.WSOCK32.dll_setsockopt]
lea ecx, [esp + 8]
push 4
push ecx
push 4
push 0xffff
push eax
call edi
test eax, eax
je 0x42577a
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 0xa10]
lea edx, [esp + 8]
push 4
push edx
push 1
push 6
push eax
call edi
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
pop ecx
ret

Function at 0x4257e0
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xa10]
test eax, eax
jge 0x4257fb
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 8], eax
push esi
mov dword [esp + 0x10], eax
mov word [esp + 0xc], 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42584a
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x4257f1
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
test eax, eax
jne 0x425844
pop edi
pop esi
add esp, 0x10
ret 8
mov edx, dword [eax]
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov edx, dword [edi + 0xa10]
lea ecx, [esp + 8]
push 0x10
push ecx
push edx
mov word [esp + 0x16], ax
call dword [sym.imp.WSOCK32.dll_connect]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x10
ret 8

Function at 0x425f40
Capabilities:
Initialize winsock library

Disassembly:
push esi
push 0x45bcb0
mov esi, ecx
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
neg eax
sbb eax, eax
inc eax
mov dword [esi], eax
mov eax, esi
pop esi
ret

Function at 0x425fc0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], 1
mov eax, dword [esi + 4]
test eax, eax
jl 0x425fd9
call fcn.00426030
push 0
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
test eax, eax
mov dword [esi + 4], eax
jge 0x425ff2
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov edi, dword [sym.imp.WSOCK32.dll_setsockopt]
lea ecx, [esp + 8]
push 4
push ecx
push 4
push 0xffff
push eax
call edi
test eax, eax
je 0x426013
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 4]
lea edx, [esp + 8]
push 4
push edx
push 1
push 6
push eax
call edi
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
pop ecx
ret
Function at 0x426080
Capabilities:
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x43a10b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x328
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov eax, dword [esi + 4]
test eax, eax
jge 0x4260b2
xor eax, eax
jmp 0x426229
mov ebp, dword [esp + 0x344]
test ebp, ebp
je 0x4261b9
lea ecx, [esp + 0xc]
call fcn.00425f70
lea ecx, [esp + 0xc]
mov dword [esp + 0x33c], 0
call fcn.00425fc0
test eax, eax
je 0x4261a5
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push ebp
push 0x44d008
lea ecx, [esp + 0x14]
inc esi
call fcn.004262b0
test eax, eax
je 0x426122
lea ecx, [esp + 0xc]
inc esi
call fcn.00426030
push 0
call edi
push 0x3e8
call edi
push 0
call edi
cmp esi, 5
jg 0x426127
jmp 0x4260ee
cmp esi, 5
jle 0x4261a1
mov ecx, dword [0x4572fc]
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x230]
push 0x104
push eax
push 0x12
push ecx
call esi
mov eax, dword [0x4572fc]
lea edx, [esp + 0x12c]
push 0x104
push edx
push 0xc
push eax
call esi
push 0x3a98
lea ecx, [esp + 0x130]
push 0x10
lea edx, [esp + 0x238]
push ecx
push edx
push 0
call fcn.00429240
add esp, 0x14
lea ecx, [esp + 0xc]
call fcn.00426030
lea ecx, [esp + 0xc]
mov dword [esp + 0x33c], 0xffffffff
call fcn.00425fa0
xor eax, eax
jmp 0x426229
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0xc]
mov dword [esp + 0x33c], 0xffffffff
call fcn.00425fa0
push ebp
mov word [esp + 0x1c], 2
call dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 0x1a], ax
lea eax, [esp + 0x28]
push 0x104
push eax
mov byte [esp + 0x30], 0
call fcn.00428f70
add esp, 8
test eax, eax
je 0x426203
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x426203
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.WSOCK32.dll_inet_addr]
jmp 0x42620b
push 0
call dword [sym.imp.WSOCK32.dll_htonl]
mov ecx, dword [esi + 4]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push 0x10
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_bind]
xor edx, edx
test eax, eax
setge dl
mov eax, edx
mov ecx, dword [esp + 0x334]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x334
ret 4
Function at 0x4262b0
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
jge 0x4262c8
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 8], eax
push esi
mov dword [esp + 0x10], eax
mov word [esp + 0xc], 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x426317
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x4262be
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
test eax, eax
jne 0x426311
pop edi
pop esi
add esp, 0x10
ret 8
mov edx, dword [eax]
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov edx, dword [edi + 4]
lea ecx, [esp + 8]
push 0x10
push ecx
push edx
mov word [esp + 0x16], ax
call dword [sym.imp.WSOCK32.dll_connect]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0x10
ret 8

Function at 0x426370
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov eax, dword [ecx + 4]
push edi
test eax, eax
mov dword [esp + 4], 1
jge 0x426386
xor eax, eax
pop edi
pop ecx
ret
push 0
push 0
push eax
call dword [sym.imp.WSOCK32.dll_accept]
mov edi, eax
test edi, edi
jge 0x42639c
xor eax, eax
pop edi
pop ecx
ret
push esi
push 8
call fcn.0043052b
add esp, 4
test eax, eax
je 0x4263bd
mov ecx, eax
call fcn.00425f70
mov esi, eax
test esi, esi
je 0x4263bf
mov dword [esi + 4], edi
jmp 0x4263cf
xor esi, esi
push 2
push edi
call dword [sym.imp.WSOCK32.dll_shutdown]
push edi
call dword [sym.imp.WSOCK32.dll_closesocket]
mov ecx, dword [esi + 4]
lea eax, [esp + 8]
push 4
push eax
push 1
push 6
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov eax, esi
pop esi
pop edi
pop ecx
ret

Function at 0x426480
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
lea eax, [esp]
lea edx, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push edx
push eax
mov dword [esp + 0xc], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
test eax, eax
jne 0x4264b3
mov eax, 0x452300
add esp, 0x14
ret

Function at 0x4264c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
lea eax, [esp]
lea edx, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push edx
push eax
mov dword [esp + 0xc], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
push 2
lea ecx, [esp + 0xc]
push 4
push ecx
call dword [sym.imp.WSOCK32.dll_gethostbyaddr]
test eax, eax
je 0x4264f6
mov eax, dword [eax]
jmp 0x4264fa
mov eax, dword [esp]
test eax, eax
jne 0x426503
mov eax, 0x452300
add esp, 0x14
ret
Function at 0x426610
Capabilities:
Set socket configuration

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
je 0x426676
cmp eax, 0xffffffff
je 0x426676
cmp byte [0x45bcb0], 2
jb 0x426676
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.WSOCK32.dll_setsockopt]
lea edx, [esp + 0xc]
push 4
push edx
push 0x1006
push 0xffff
push eax
mov dword [esp + 0x20], ecx
call esi
cmp eax, 0xffffffff
je 0x426676
mov ecx, dword [edi + 4]
lea eax, [esp + 0xc]
push 4
push eax
push 0x1005
push 0xffff
push ecx
call esi
xor edx, edx
cmp eax, 0xffffffff
setne dl
pop edi
mov eax, edx
pop esi
ret 4
pop edi
xor eax, eax
pop esi
ret 4

Function at 0x426ef0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x1d0
mov al, byte [0x4571f0]
push esi
push edi
mov byte [esp + 0x5c], al
mov ecx, 0x1d
xor eax, eax
lea edi, [esp + 0x5d]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xd8]
xor esi, esi
push ecx
stosb byte es:[edi], al
call fcn.00427eb0
add esp, 8
lea edx, [esp + 0xd4]
push 0x44c9d4
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0xd4]
push eax
call fcn.00427ef0
add esp, 4
test eax, eax
jne 0x426f5f
lea ecx, [esp + 0xd4]
push ecx
call fcn.004270a0
add esp, 4
mov edx, dword [0x450e4c]
lea eax, [esp + 0x5c]
push edx
push 0x452404
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
push 0x8001
mov dword [esp + 0x1c], 0x44
mov word [esp + 0x4c], 0xa
mov dword [esp + 0x48], 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [esp + 0x1dc]
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push 0
push 0x30
push 0
push 0
test eax, eax
push 0
jne 0x42702d
lea eax, [esp + 0x7c]
lea ecx, [esp + 0xf4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x426fff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4523ec
call fcn.00424580
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x1d0
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x42708d
cmp eax, 0xffffffff
je 0x42708d
mov edx, dword [esp + 0x10]
mov dword [0x45b750], eax
pop edi
mov dword [0x45b754], edx
mov eax, 1
pop esi
add esp, 0x1d0
ret
lea ecx, [esp + 0x7c]
lea edx, [esp + 0xf4]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
jne 0x427064
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4523d4
call fcn.00424580
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x1d0
ret
mov eax, dword [esp + 8]
test eax, eax
je 0x42708d
cmp eax, 0xffffffff
je 0x42708d
mov dword [0x45b750], eax
mov eax, dword [esp + 0x10]
mov dword [0x45b754], eax
pop edi
mov eax, 1
pop esi
add esp, 0x1d0
ret
mov eax, esi
pop edi
pop esi
add esp, 0x1d0
ret
Function at 0x4270a0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
mov eax, dword [0x4572fc]
push ebx
push esi
push edi
push 0x452408
push 0x83
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x427133
mov ecx, dword [0x4572fc]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [0x4572fc]
push esi
push edx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x427133
mov eax, dword [esp + 0x14]
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x427133
cmp edi, 0xffffffff
je 0x427133
lea ecx, [esp + 0xc]
push 0
push ecx
push ebx
push esi
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42713a
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x427c00
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push edi
push 0x104
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 8]
push 0x450e78
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x118]
mov esi, dword [esp + 0x114]
mov ecx, dword [esp + 0x110]
lea edx, [esp + 8]
push edx
push eax
push esi
push 0x452424
push ecx
push 0x450e50
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x427c6c
cmp byte [esi], 0x2a
je 0x427c6c
mov edi, 1
push 0x452424
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x427c8b
mov edx, dword [esp + 0x11c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, edi
pop edi
pop esi
add esp, 0x104
ret