joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454838
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.004071c8
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.0044f408
test ebx, ebx
jne 0x45488b
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00454774
mov ebx, eax
test ebx, ebx
je 0x454976
cmp esi, ebx
je 0x4548b4
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x4548c9
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x454901
add eax, 0xffffff5f
sub eax, 2
jb 0x454919
dec eax
sub eax, 2
jb 0x45492d
dec eax
sub eax, 2
jb 0x454923
jmp 0x454937
add eax, 0xfffffdff
sub eax, 2
jb 0x454919
dec eax
sub eax, 2
jb 0x45492d
dec eax
sub eax, 2
jb 0x454923
jmp 0x454937
mov byte [esp + 0x120], 0
jmp 0x45493f
mov byte [esp + 0x120], 2
jmp 0x45493f
mov byte [esp + 0x120], 1
jmp 0x45493f
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004354c8
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00450ba4
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x454978
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x45cccc
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x47e720]
cmp byte [eax + 0xc], 0
je 0x45ce39
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45ce32
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x483c8c], 0
jne 0x45cd20
push 0x45ce40
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x45ce48
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483c8c], eax
cmp dword [0x47d6cc], 0
jne 0x45ce1b
push 0x45ce58
call sub.kernel32.dll_LoadLibraryA
mov dword [0x47d6cc], eax
cmp dword [0x47d6cc], 0
je 0x45ce1b
push 0x45ce64
mov eax, dword [0x47d6cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483c90], eax
push 0x45ce74
mov eax, dword [0x47d6cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483c94], eax
push 0x45ce88
mov eax, dword [0x47d6cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483c98], eax
push 0x45cea0
mov eax, dword [0x47d6cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483c9c], eax
push 0x45ceb8
mov eax, dword [0x47d6cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483ca0], eax
push 0x45cecc
mov eax, dword [0x47d6cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483ca4], eax
push 0x45cee4
mov eax, dword [0x47d6cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483ca8], eax
push 0x45cefc
mov eax, dword [0x47d6cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483cac], eax
push 0x45cf18
mov eax, dword [0x47d6cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483cb0], eax
push 0x45cf24
mov eax, dword [0x47d6cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x483cb4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ce39
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x4636fc
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405538
xor eax, eax
push ebp
push 0x463831
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x463804
xor edx, edx
push ebp
push 0x4637fd
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x463749
sub eax, 4
mov eax, dword [eax]
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4637d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x4637c1
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x463788
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.00405548
lea ecx, [ebx + 1]
mov edx, esi
call fcn.004030fc
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4637c8
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x47e2d0]
mov dl, 1
mov eax, dword [0x4085dc]
call fcn.0040dd04
call fcn.00404a4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463838
lea eax, [ebp - 4]
call fcn.004050b8
ret
Function at 0x463840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4639fb
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.0040583c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x463a14
call fcn.004053d0
mov eax, ebx
call fcn.00421714
mov edi, eax
dec edi
test edi, edi
jl 0x4638f8
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004216e8
mov edx, dword [0x461794]
call fcn.00404364
test al, al
je 0x4638f4
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.004216e8
lea edx, [ebp - 0x14]
call fcn.0044f8c0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.0040583c
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040544c
inc esi
dec edi
jne 0x4638a6
movzx eax, byte [0x463a18]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x463a24
mov eax, dword [ebp - 8]
call fcn.0040f3b0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.00405150
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0044f8c0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x463a14
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.0044f8c0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x463a14
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x463a14
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x463a30
call fcn.0040a934
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463a02
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004050dc
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004050dc
lea eax, [ebp - 0x14]
call fcn.004050b8
lea eax, [ebp - 0x10]
call fcn.004050b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004050dc
ret
Function at 0x46554c
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405538
xor eax, eax
push ebp
push 0x4655ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405548
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x465595
mov eax, dword [ebx + 4]
call fcn.00405548
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
movzx eax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4655d1
lea eax, [ebp - 4]
call fcn.004050b8
ret

Function at 0x466680
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x466825
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.00403358
cmp word [ebx + 0xa2], 0
je 0x4666c9
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4666dd
lea esi, [ebp - 0xc]
jmp 0x4666df
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x4666ec
xor edi, edi
jmp 0x4666f9
mov eax, dword [ebx + 0x80]
call fcn.00405548
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.00405548
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00465d30
mov eax, dword [ebp - 0x14]
call fcn.00405548
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.00405548
push eax
mov eax, dword [ebp - 4]
call fcn.00405548
push eax
mov eax, ebx
call fcn.00465e70
push eax
mov eax, ebx
call fcn.00465e44
push eax
mov eax, ebx
call fcn.00465dfc
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00465be8
mov eax, dword [ebp - 0x18]
call fcn.00405548
push eax
mov eax, dword [ebx + 8]
call fcn.00405548
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0x10], 0
jne 0x466782
call fcn.0040f878
xor edx, edx
push ebp
push 0x4667fb
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4667c0
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x4667b6
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4667e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466802
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x466834
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x466860
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00405548
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x466885
call fcn.0040f878
xor eax, eax
push ebp
push 0x4668bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x4668a5
call fcn.0040f878
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4668c3
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x46770c
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff64
xor ebx, ebx
mov dword [esp], 0x9c
push esp
call sub.kernel32.dll_GetVersionExA_1
test eax, eax
je 0x46772e
cmp dword [esp + 4], 6
setae bl
mov eax, ebx
add esp, 0x9c
pop ebx
ret

Function at 0x467870
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405538
xor eax, eax
push ebp
push 0x46794a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x467960
call fcn.00467738
mov ebx, eax
test ebx, ebx
je 0x467934
lea eax, [ebp - 0xc]
push eax
push 0xf01ff
push ebx
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x467934
lea eax, [ebp - 8]
push eax
push 1
push 1
push 0
push 0xf01ff
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_DuplicateTokenEx
test eax, eax
je 0x467934
lea eax, [ebp - 0x50]
mov edx, 0x44
call fcn.004673d4
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x5c], 0xc
xor eax, eax
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x68], 0xc
xor eax, eax
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405548
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateProcessAsUserA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467951
lea eax, [ebp - 4]
call fcn.004050b8
ret
Function at 0x467c6c
Capabilities:
Enumerate processes on remote desktop session host
Print debug messages

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x467d39
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea edx, [ebp - 0x10]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.00405548
push eax
call sub.kernel32.dll_OutputDebugStringA_1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0
call sub.wtsapi32.dll_WTSEnumerateProcessesA
test eax, eax
je 0x467d11
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x467d11
inc esi
lea eax, [ebp - 0x20]
mov edx, dword [ebx + 8]
call fcn.004059ac
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409754
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00405340
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.004093e8
mov edx, dword [ebp - 0x14]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x54]
test eax, eax
jl 0x467d0b
mov byte [ebp - 1], 1
jmp 0x467d11
add ebx, 0x10
dec esi
jne 0x467ccb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467d40
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004058b0
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004050dc
ret

Function at 0x467f00
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
test dl, dl
je 0x467f19
add esp, 0xfffffff0
call fcn.004044fc
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x467fd7
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.004041a8
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 8], 0xffffffff
mov byte [ebx + 0xc], 0
cmp dword [ebx + 4], 0xffffffff
jne 0x467f5b
push ebx
push 0x468168
call fcn.00422870
mov dword [ebx + 4], eax
mov byte [ebx + 0xc], 0
push 0
push 2
push 2
call sub.ws2_32.dll_socket_1
mov esi, eax
mov dword [ebx + 8], esi
cmp esi, 0xffffffff
jne 0x467f8a
mov ecx, 0x468008
mov dl, 1
mov eax, dword [0x4085dc]
call fcn.0040dc48
call fcn.00404a4c
push 1
push 0x1a5a
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebx + 8]
push eax
call sub.ws2_32.dll_WSAAsyncSelect
test eax, eax
je 0x467fc1
cmp word [ebx + 0x1a], 0
je 0x467fc1
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 8]
call fcn.0040d2dc
mov ecx, dword [ebp - 8]
mov edx, ebx
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467fde
lea eax, [ebp - 8]
call fcn.004050b8
ret
Function at 0x46804c
Capabilities:
Print debug messages
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9a0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x660], edx
mov dword [ebp - 0x65c], edx
mov dword [ebp - 0x658], edx
mov esi, eax
xor eax, eax
push ebp
push 0x46815b
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x640
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x654]
push eax
push 0
push ebx
lea eax, [ebp - 0x644]
push eax
mov eax, dword [esi + 8]
push eax
call sub.ws2_32.dll_recvfrom
mov ebx, eax
test ebx, ebx
jl 0x4680f3
cmp word [esi + 0x12], 0
je 0x46813d
push dword [ebp - 0x650]
call sub.ws2_32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x658]
call fcn.004052b0
mov eax, dword [ebp - 0x658]
push eax
movzx eax, word [ebp - 0x652]
push eax
call sub.ws2_32.dll_ntohs
push eax
lea edx, [ebp - 0x644]
mov ecx, ebx
mov eax, dword [esi + 0x14]
call dword [esi + 0x10]
jmp 0x46813d
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x65c]
call fcn.00409ab0
mov eax, dword [ebp - 0x65c]
call fcn.00405548
push eax
call sub.kernel32.dll_OutputDebugStringA
cmp word [esi + 0x1a], 0
je 0x46813d
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x660]
call fcn.0040d2dc
mov ecx, dword [ebp - 0x660]
mov edx, esi
mov eax, dword [esi + 0x1c]
call dword [esi + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468162
lea eax, [ebp - 0x660]
mov edx, 3
call fcn.004050dc
ret

Function at 0x4681dc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 0xc]
call fcn.00405538
xor eax, eax
push ebp
push 0x46824f
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x10], 2
movzx eax, word [ebp + 8]
push eax
call sub.ws2_32.dll_htons_1
mov word [ebp - 0xe], ax
mov eax, dword [ebp + 0xc]
call fcn.00405548
push eax
call sub.ws2_32.dll_inet_addr_1
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push esi
mov eax, dword [ebx + 8]
push eax
call sub.ws2_32.dll_sendto
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468256
lea eax, [ebp + 0xc]
call fcn.004050b8
ret
Function at 0x4684c8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405538
xor eax, eax
push ebp
push 0x468602
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
call fcn.004050b8
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00405548
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4685e7
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x18], 0x400
mov eax, dword [ebp - 0x18]
call fcn.00402f00
mov esi, eax
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x18], 0x400
cmp byte [ebp + 8], 0
je 0x468563
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push esi
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov ebx, eax
jmp 0x46857c
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push esi
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
test ebx, ebx
jne 0x4685cf
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x18]
call fcn.004057d8
lea eax, [ebp - 8]
call fcn.004055a8
mov edx, eax
mov eax, esi
mov ecx, dword [ebp - 0x18]
call fcn.004030fc
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x4685b4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040510c
jmp 0x4685ce
mov eax, dword [ebp - 0xc]
push dword [eax]
push 0x468620
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.0040544c
inc edi
test ebx, ebx
je 0x46853b
mov eax, esi
call fcn.00402f1c
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468609
lea eax, [ebp - 8]
mov edx, 2
call fcn.004050dc
ret
Function at 0x468a24
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405538
xor eax, eax
push ebp
push 0x468b6e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x468b46
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.0040a2c4
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x468b2f
mov edx, dword [eax + 0xc]
test edx, edx
je 0x468b29
mov ebx, dword [edx]
test ebx, ebx
je 0x468b23
lea eax, [ebp - 0x29c]
push eax
movzx eax, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
movzx eax, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
movzx eax, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
movzx eax, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x468b88
call fcn.0040a934
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.0040510c
mov byte [ebp - 5], 1
jmp 0x468b33
mov byte [ebp - 5], 0
jmp 0x468b33
mov byte [ebp - 5], 0
jmp 0x468b33
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468b4d
call sub.wsock32.dll_WSACleanup
ret

Function at 0x468f0c
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 2
call sub.wsock32.dll_WSAStartup
add esp, 0x190
ret

Function at 0x468f2c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x408], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405538
xor eax, eax
push ebp
push 0x468fd7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x404]
xor ecx, ecx
mov edx, 0x400
call fcn.004039c8
lea eax, [ebp - 0x408]
mov ecx, 0x468ff0
mov edx, dword [ebp - 4]
call fcn.004053d0
mov edx, dword [ebp - 0x408]
lea eax, [ebp - 0x404]
call fcn.0040a2c4
lea eax, [ebp - 0x404]
call fcn.0040a1d8
mov esi, eax
push 0
push esi
lea eax, [ebp - 0x404]
push eax
push edi
call sub.wsock32.dll_send
cmp esi, eax
jne 0x468fb6
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468fde
lea eax, [ebp - 0x408]
call fcn.004050b8
lea eax, [ebp - 4]
call fcn.004050b8
ret

Function at 0x468ff4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x400
call fcn.004039c8
push 0
push 0x400
lea eax, [esp + 8]
push eax
push ebx
call sub.wsock32.dll_recv
mov edx, esi
mov eax, esp
call fcn.0040a444
add esp, 0x400
pop esi
pop ebx
ret