joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fdd70
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x54cc50
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x595c60]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x20], 0
push eax
call fcn.004fde40
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0xffffffffffffffff
push eax
push dword [esp + 0x4c]
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov word [ecx], ax
call fcn.0047c410
sub esp, 0xc
mov byte [esp + 0x44], 1
lea eax, [esp + 0x30]
mov ecx, esp
push eax
call fcn.0048e580
mov ecx, dword [esp + 0x4c]
mov byte [esp + 0x44], 0
call fcn.00490480
mov esi, dword [esp + 0x30]
add esp, 0x24
test esi, esi
je 0x4fde2c
push dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
push ecx
mov ecx, esi
call fcn.004802e0
push esi
call fcn.005074d4
add esp, 0xc
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 8

Function at 0x4fe910
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x54cc50
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x595c60]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x20], 0
push eax
call fcn.004fe7a0
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0xffffffffffffffff
push eax
push dword [esp + 0x4c]
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov word [ecx], ax
call fcn.0047c410
sub esp, 0xc
mov byte [esp + 0x44], 1
lea eax, [esp + 0x30]
mov ecx, esp
push eax
call fcn.0048e580
mov ecx, dword [esp + 0x4c]
mov byte [esp + 0x44], 0
call fcn.00490480
mov esi, dword [esp + 0x30]
add esp, 0x24
test esi, esi
je 0x4fe9cc
push dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
push ecx
mov ecx, esi
call fcn.004802e0
push esi
call fcn.005074d4
add esp, 0xc
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 8
Function at 0x4ff170
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54ceb9
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x595c60]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x595c60]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov dword [esp + 0xc], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov dword [esp + 0x10], esi
mov word [esi], ax
mov dword [esp + 0x38], eax
lea ecx, [esp + 0x14]
mov edx, dword [edi + 4]
mov dword [esp + 0xc], 1
call fcn.004f6ff0
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov dword [esp + 0x44], 1
call fcn.00482640
mov byte [esp + 0x38], 0
cmp dword [esp + 0x28], 8
jb 0x4ff20c
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4ff20c
push eax
call fcn.005074d4
add esp, 4
push 0x7c
push 1
mov ecx, esi
call fcn.00481ab0
movzx edx, byte [edi + 8]
lea ecx, [esp + 0x14]
call fcn.004f6ed0
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov dword [esp + 0x44], 2
call fcn.00482640
mov byte [esp + 0x38], 0
cmp dword [esp + 0x28], 8
jb 0x4ff255
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4ff255
push eax
call fcn.005074d4
add esp, 4
push 0x7c
push 1
mov ecx, esi
call fcn.00481ab0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00506c7d
add esp, 0x30
ret

Function at 0x4ff280
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x54cc50
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x595c60]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x20], 0
push eax
call fcn.004ff000
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [esp + 0x20], esp
push 0xffffffffffffffff
push eax
push dword [esp + 0x4c]
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov word [ecx], ax
call fcn.0047c410
sub esp, 0xc
mov byte [esp + 0x44], 1
lea eax, [esp + 0x30]
mov ecx, esp
push eax
call fcn.0048e580
mov ecx, dword [esp + 0x4c]
mov byte [esp + 0x44], 0
call fcn.00490480
mov esi, dword [esp + 0x30]
add esp, 0x24
test esi, esi
je 0x4ff33c
push dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
push ecx
mov ecx, esi
call fcn.004802e0
push esi
call fcn.005074d4
add esp, 0xc
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 8
Function at 0x504220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x2c]
lea ebx, [ebx]
mov eax, dword [esi + 0x2c]
mov edx, dword [esi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [esi + 0x74]
add eax, edi
sub edx, dword [esi + 0x6c]
mov dword [esp + 0x10], edx
cmp dword [esi + 0x6c], eax
jb 0x5042ad
mov ecx, dword [esi + 0x38]
push edi
lea eax, [ecx + edi]
push eax
push ecx
call fcn.0050b730
mov edx, dword [esi + 0x4c]
add esp, 0xc
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
sub dword [esi + 0x5c], edi
lea ecx, [eax + edx*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, edi
jb 0x50427f
sub eax, edi
jmp 0x504281
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x504270
mov eax, dword [esi + 0x40]
mov edx, edi
lea ecx, [eax + edi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, edi
jb 0x50429f
sub eax, edi
jmp 0x5042a1
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x504290
mov edx, dword [esp + 0x10]
add edx, edi
mov ebx, dword [esi]
cmp dword [ebx + 4], 0
je 0x5043d6
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
add eax, dword [esi + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 4]
mov ebp, eax
cmp ebp, edx
jbe 0x5042d1
mov ebp, edx
test ebp, ebp
je 0x504324
sub eax, ebp
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x5042f2
mov edx, dword [ebx]
mov ecx, dword [ebx + 0x30]
push ebp
call fcn.004e9110
jmp 0x50430a
cmp eax, 2
jne 0x504310
mov edx, dword [ebx]
test edx, edx
jne 0x504301
xor eax, eax
jmp 0x50430d
mov ecx, dword [ebx + 0x30]
push ebp
call fcn.004e97c0
add esp, 4
mov dword [ebx + 0x30], eax
push ebp
push dword [ebx]
push dword [esp + 0x18]
call fcn.0050b730
add dword [ebx], ebp
add esp, 0xc
add dword [ebx + 8], ebp
add dword [esi + 0x74], ebp
mov ebp, dword [esi + 0x74]
cmp ebp, 3
jb 0x50434c
mov eax, dword [esi + 0x38]
add eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x58]
movzx edx, byte [eax]
mov dword [esi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [esi + 0x54]
mov dword [esi + 0x48], edx
cmp ebp, 0x106
jae 0x504360
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x504230
mov ecx, dword [esi + 0x16c0]
mov ebx, dword [esi + 0x3c]
cmp ecx, ebx
jae 0x5043d6
mov edi, dword [esi + 0x6c]
add edi, ebp
cmp ecx, edi
jae 0x5043a5
sub ebx, edi
cmp ebx, 0x102
jbe 0x504385
mov ebx, 0x102
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call fcn.0050be90
add esp, 0xc
lea eax, [ebx + edi]
mov dword [esi + 0x16c0], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
lea eax, [edi + 0x102]
cmp ecx, eax
jae 0x5043d6
sub edi, ecx
sub ebx, ecx
add edi, 0x102
cmp edi, ebx
jbe 0x5043bf
mov edi, ebx
mov eax, dword [esi + 0x38]
push edi
add eax, ecx
push 0
push eax
call fcn.0050be90
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x506900
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x54d568
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x595c60]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push 1
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x25
push eax
call fcn.0047c670
cmp eax, 0xffffffff
je 0x5069a8
cmp dword [esi + 0x14], 8
jb 0x50694d
mov eax, dword [esi]
jmp 0x50694f
mov eax, esi
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test ebx, ebx
je 0x5069a8
push ebx
lea ecx, [esp + 0x18]
call fcn.004969a0
mov dword [esp + 0x28], 0
cmp dword [esi + 0x14], 8
jb 0x50697c
mov eax, dword [esi]
jmp 0x50697e
mov eax, esi
mov edi, dword [esp + 0x14]
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x50699b
cmp eax, ebx
ja 0x50699b
push edi
mov ecx, esi
call fcn.0047c630
test edi, edi
je 0x5069a8
push edi
call fcn.005074d4
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x50f95d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x50f95a
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x50f94b
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0050f706
sbb al, 0x7b
sal esi, 0x8d
inc ebp
test al, 0x50
call fcn.0050f716
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0050f6cb
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x50f9f4
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0050f706
fist dword [ebx + 0x458d058d]
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x50fa71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
call 0xe9ae82c7
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0050f716
push eax
push esi
push dword [ebp + 8]
call fcn.0050f6cb
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0050f716
push eax
push esi
push dword [ebp + 8]
call fcn.0050f6cb
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0050f716
push eax
push esi
push dword [ebp + 8]
call fcn.0050f6cb
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0050f706
jecxz 0x50fbb1
stosd dword es:[edi], eax
sbb ecx, dword [eax - 0x8363]
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.0050f706
fmul qword [esp + edi*8 + 0x7c858dbc]
invalid
Function at 0x52179c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x595c60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0051bbf3
mov dword [ebp - 0x14], eax
cmp dword [0x59e140], esi
jne 0x52188f
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x52181c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x52196f
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x52196f
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x52196f
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x59e140], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x59e144], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x59e148], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x59e150], eax
test eax, eax
je 0x52188c
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x59e14c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x5218b4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5218a7
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x5218c9
push 4
pop eax
jmp 0x521971
cmp dword [ebp - 0x14], esi
je 0x5218c9
push dword [0x59e140]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x5218ae
mov eax, dword [0x59e14c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x521927
cmp dword [0x59e150], edi
je 0x521927
push eax
call ebx
push dword [0x59e150]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x521927
test eax, eax
je 0x521927
call ecx
test eax, eax
je 0x52191c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x52191c
test byte [ebp - 8], 1
jne 0x521927
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x521957
mov eax, dword [0x59e144]
cmp eax, edi
je 0x521954
push eax
call ebx
test eax, eax
je 0x521954
call eax
mov esi, eax
test esi, esi
je 0x521954
mov eax, dword [0x59e148]
cmp eax, edi
je 0x521954
push eax
call ebx
test eax, eax
je 0x521954
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x59e140]
call ebx
test eax, eax
je 0x52196f
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x521971
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00506c7d
mov esp, ebp
pop ebp
ret
Function at 0x407ff0
Capabilities:
Get hostname
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdbc
mov eax, 0x5ddf08
call fcn.0050acb0
xor edx, edx
mov dword [ebp - 0x30], edx
lea ecx, [ebp - 0x244]
push ecx
push 0x202
call sub.WSOCK32.DLL_WSAStartup
push 0x80
lea eax, [ebp - 0xb4]
push eax
call sub.WSOCK32.DLL_gethostname
inc eax
jne 0x40803e
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, edx
jmp 0x4080d2
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 0
lea eax, [ebp - 0xb4]
push eax
call fcn.004080d8
test eax, eax
je 0x408064
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, edx
jmp 0x4080d2
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x974]
add edx, 0x23c
mov dword [ebp - 0x34], edx
mov word [ebp - 0x18], 8
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + 0x18]
push dword [eax + 4]
call sub.WSOCK32.DLL_inet_ntoa
mov edx, eax
lea eax, [ebp - 4]
call fcn.00545d10
inc dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ecx]
mov ecx, dword [eax]
call dword [ecx + 0x38]
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.00545e70
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + 0x1c]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x40806a
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret
Function at 0x4282f8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x5d83cc], 0
je 0x428327
push dword [0x5d83c8]
call sub.WSOCK32.DLL_closesocket
mov dword [0x5d83c8], 0xffffffff
push 0xffffffffffffffff
push dword [0x5d83cc]
call sub.KERNEL32.DLL_WaitForSingleObject
xor eax, eax
mov dword [0x5d83c4], eax
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0x402de0
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x5d83cc], eax
pop ecx
pop ebp
ret
Function at 0x4361bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov esi, 0x5d92d4
lea edi, [ebp - 0x1c]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [ebp - 0x20], eax
xor edx, edx
mov dword [ebp - 0x24], edx
cmp dword [0x5d92b4], 0
je 0x4361fe
movzx ecx, word [ebp + 8]
mov eax, dword [ecx*8 + 0x5d92bc]
jmp 0x43635e
push 0x104
lea edx, [ebp - 0x12c]
push edx
call sub.KERNEL32.DLL_GetSystemDirectoryA
test eax, eax
je 0x4362e1
lea ecx, [ebp - 0x12c]
push ecx
lea eax, [ebp - 0x238]
push eax
call fcn.0050a6fc
add esp, 8
push str.ws2_32
lea edx, [ebp - 0x238]
push edx
call fcn.0050a620
add esp, 8
lea ecx, [ebp - 0x238]
push ecx
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x436279
push 0x5dc8c8
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x436279
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4362e1
lea edx, [ebp - 0x12c]
push edx
lea ecx, [ebp - 0x238]
push ecx
call fcn.0050a6fc
add esp, 8
push str.wship6
lea eax, [ebp - 0x238]
push eax
call fcn.0050a620
add esp, 8
lea edx, [ebp - 0x238]
push edx
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4362e1
push str.getaddrinfo
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4362e1
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x436349
xor eax, eax
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
push dword [ebp + edx*8 - 0x1c]
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetProcAddress
mov ecx, dword [ebp - 0x24]
mov dword [ebp + ecx*8 - 0x18], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*8 - 0x18], 0
jne 0x43631b
push dword [ebp - 4]
call sub.KERNEL32.DLL_FreeLibrary
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x436324
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x4362ec
cmp dword [ebp - 4], 0
je 0x436349
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp + eax*8 - 0x18]
mov ecx, dword [ebp - 0x24]
mov dword [ecx*8 + 0x5d92bc], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x43632f
mov dword [0x5d92b4], 1
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x5d92bc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x437794
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
jmp 0x4377c2
mov edx, dword [ebp - 8]
movsx ecx, byte [edx]
cmp ecx, 0x2e
jne 0x4377bf
inc dword [ebp - 0xc]
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp byte [eax], 0
jne 0x4377b1
cmp dword [ebp - 0xc], 3
je 0x4377d4
xor eax, eax
jmp 0x4377f6
push dword [ebp + 8]
call sub.WSOCK32.DLL_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4377e9
xor eax, eax
jmp 0x4377f6
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x437a8c
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [ecx], eax
mov edx, dword [ebp + 0x18]
mov byte [edx], 0
push dword [ebp + 8]
call sub.WSOCK32.DLL_gethostbyname
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x437b30
mov ecx, dword [ebp - 8]
cmp word [ecx + 8], 2
jne 0x437b1c
mov eax, dword [ebp - 8]
cmp word [eax + 0xa], 4
jne 0x437b1c
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0xc], ecx
jmp 0x437b14
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
push dword [edx]
mov cx, word [ebp + 0x14]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004377fc
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x437b05
mov eax, 8
jmp 0x437b68
mov edx, dword [ebp - 4]
mov ecx, dword [edx]
add ecx, 0x1c
mov dword [ebp - 4], ecx
add dword [ebp - 0xc], 4
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x437ada
mov edx, dword [ebp - 8]
push dword [edx]
push dword [ebp + 0x18]
call fcn.0050a6fc
add esp, 8
xor eax, eax
jmp 0x437b68
call sub.WSOCK32.DLL_WSAGetLastError
sub eax, 0x2af9
je 0x437b47
dec eax
je 0x437b4e
dec eax
je 0x437b55
dec eax
je 0x437b5c
jmp 0x437b63
mov eax, 0x2af9
jmp 0x437b68
mov eax, 0x2afa
jmp 0x437b68
mov eax, 0x2afb
jmp 0x437b68
mov eax, 0x2af9
jmp 0x437b68
mov eax, 0x2af9
mov esp, ebp
pop ebp
ret 0x18