joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429508
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x429760
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x42be91], 0
lea edx, [ebp - 4]
mov eax, 0x41b078
call fcn.00403ff8
mov eax, dword [ebp - 4]
call fcn.00403464
push eax
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov ebx, eax
test ebx, ebx
je 0x42970a
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
je 0x42970a
push 0xf
call sub.user32.dll_GetSysColor
mov dword [0x42c0ac], eax
push 0
push 0
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x412f80]
call fcn.00414294
mov dword [0x42c0b0], eax
mov eax, dword [0x42c0b0]
mov dword [eax + 0x48], 0x10001
push 1
push 1
or ecx, 0xffffffff
or edx, 0xffffffff
mov eax, dword [0x42c0b0]
call fcn.00416020
mov dl, 1
mov eax, dword [0x42c0b0]
call fcn.00414820
mov edx, 0x14
mov eax, dword [0x42c0b0]
call fcn.00416534
mov eax, dword [0x42c0b0]
mov eax, dword [eax + 0xc]
mov dword [0x42bdec], eax
mov eax, dword [0x42bdec]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x412618]
call fcn.00414250
mov dword [0x42c0b4], eax
mov eax, dword [0x42c0b4]
mov dword [eax + 0x48], 0x10002
mov eax, dword [0x42c0b4]
mov eax, dword [eax + 0xc]
mov dword [0x42bdf0], eax
mov dl, 1
mov eax, dword [0x42c0b4]
call fcn.004173d4
mov edx, 0x100000
mov eax, dword [0x42c0b4]
call fcn.004162b8
mov cl, 1
xor edx, edx
mov eax, dword [0x42bdf0]
call fcn.0041baac
mov dword [0x42c044], eax
mov cl, 1
xor edx, edx
mov eax, dword [0x42bdf0]
call fcn.0041baac
mov dword [0x42c048], eax
mov eax, dword [0x42bdec]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x41af98]
call fcn.00418078
cmp byte [0x42be96], 0
jne 0x4296fe
cmp byte [0x42c069], 0
je 0x4296cd
mov edx, dword [0x42aba8]
mov eax, dword [0x42c0b0]
call fcn.00415ffc
mov eax, dword [0x42c0b0]
mov edx, dword [0x42bdcc]
mov dword [eax + 0x308], edx
mov dword [eax + 0x304], 0x4294cc
push 0
push 0x210000
push 0
mov ecx, 0x429774
mov edx, 0x429784
mov eax, dword [0x42c044]
call fcn.0041eb14
push 0
push 0x210000
push 0
mov edx, 0x429784
mov ecx, 0x429798
mov eax, dword [0x42c048]
call fcn.0041eb14
mov eax, dword [0x42bdcc]
call fcn.00426d84
mov eax, dword [0x42bdcc]
mov edx, dword [0x42bdcc]
mov dword [eax + 0x290], edx
mov dword [eax + 0x28c], 0x4294f4
mov dl, 1
mov eax, dword [0x42bdcc]
call fcn.00414820
mov eax, dword [0x42bdec]
call fcn.00413fa8
jmp 0x42973f
push 0x30
lea edx, [ebp - 4]
mov eax, 0x41b080
call fcn.00403ff8
mov eax, dword [ebp - 4]
call fcn.00403464
push eax
lea edx, [ebp - 8]
mov eax, 0x41b088
call fcn.00403ff8
mov eax, dword [ebp - 8]
call fcn.00403464
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x429767
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040306c
ret
Function at 0x401dd0
Capabilities:
Create process on windows
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4370e8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x448458]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x54], eax
mov edi, ecx
mov dword [ebp - 0x44], edi
mov ecx, dword [ebp + 0x20]
mov esi, 0x43ed3d
test eax, eax
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp + 0x24]
mov edx, esi
cmovne edx, eax
mov dword [ebp - 0x4c], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0xf
movdqu xmmword [ebp - 0x64], xmm0
mov dword [ebp - 0x30], 0
cmp byte [edx], 0
mov byte [ebp - 0x40], 0
jne 0x401e3f
xor ecx, ecx
jmp 0x401e51
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x48], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401e47
sub ecx, dword [ebp - 0x48]
push ecx
push edx
lea ecx, [ebp - 0x40]
call fcn.004018e0
test edi, edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0xf
cmovne esi, edi
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp byte [esi], 0
jne 0x401e82
xor ecx, ecx
jmp 0x401e90
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401e87
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.004018e0
xor eax, eax
cmp dword [ebp - 0x18], eax
setne al
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 0x48], eax
jb 0x401eb6
push dword [ebp - 0x28]
call fcn.004238d6
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x2c], 0x10
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jb 0x401ee0
push dword [ebp - 0x40]
call fcn.004238d6
add esp, 4
mov edi, dword [ebp - 0x48]
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
test edi, edi
je 0x401f08
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x50]
push 0
push 0
push 4
jmp 0x401f14
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x54]
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
test esi, esi
jne 0x401f32
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
je 0x401f5b
test esi, esi
je 0x401f5b
movdqu xmm0, xmmword [ebp - 0x64]
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x44]
movd ecx, xmm0
movdqu xmmword [eax], xmm0
call fcn.00401d50
push dword [ebp - 0x60]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422f38
mov esp, ebp
pop ebp
ret 0x20
Function at 0x410c40
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0xc], ecx
xor eax, eax
xor ecx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
push edi
test esi, esi
je 0x410da2
mov edi, dword [ebp + 8]
xor edx, edx
cmp eax, esi
jae 0x410c7e
lea esp, [esp]
cmp byte [eax + edi], 0x20
jne 0x410c7c
inc eax
inc edx
cmp eax, esi
jb 0x410c70
cmp eax, esi
je 0x410cf2
mov ecx, esi
sub ecx, eax
cmp ecx, 2
jb 0x410c96
cmp byte [eax + edi], 0xd
jne 0x410c96
cmp byte [eax + edi + 1], 0xa
je 0x410ce6
mov cl, byte [eax + edi]
cmp cl, 0xa
je 0x410ce6
test edx, edx
jne 0x410dab
cmp cl, 0x3d
jne 0x410cb5
inc ebx
cmp ebx, 2
ja 0x410dab
cmp cl, 0x7f
ja 0x410dab
movzx ecx, cl
mov cl, byte [ecx + 0x443470]
cmp cl, 0x7f
je 0x410dab
cmp cl, 0x40
jae 0x410cdd
test ebx, ebx
jne 0x410dab
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebp - 4], ecx
jmp 0x410ce9
mov ecx, dword [ebp - 4]
inc eax
cmp eax, esi
jb 0x410c66
test ecx, ecx
je 0x410da2
mov esi, dword [ebp - 0xc]
lea ecx, [ecx + ecx*2]
lea ecx, [ecx*2 + 7]
shr ecx, 3
sub ecx, ebx
test esi, esi
je 0x410db7
mov edx, dword [ebp - 8]
cmp dword [edx], ecx
jb 0x410db7
xor ecx, ecx
mov dword [ebp - 4], 3
xor ebx, ebx
mov dword [ebp + 0xc], ecx
test eax, eax
je 0x410d9a
mov cl, byte [edi]
cmp cl, 0xd
je 0x410d96
cmp cl, 0xa
je 0x410d96
cmp cl, 0x20
je 0x410d96
movzx ecx, cl
mov dl, byte [ecx + 0x443470]
xor ecx, ecx
cmp dl, 0x40
sete cl
shl ebx, 6
sub dword [ebp - 4], ecx
movzx ecx, dl
mov edx, dword [ebp + 0xc]
and ecx, 0x3f
inc edx
or ebx, ecx
mov dword [ebp + 0xc], edx
cmp edx, 4
jne 0x410d96
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [ebp + 0xc], ecx
test edx, edx
je 0x410d81
mov ecx, ebx
shr ecx, 0x10
mov byte [esi], cl
inc esi
cmp edx, 1
jbe 0x410d8e
mov ecx, ebx
shr ecx, 8
mov byte [esi], cl
inc esi
cmp edx, 2
jbe 0x410d96
mov byte [esi], bl
inc esi
inc edi
dec eax
jne 0x410d31
mov eax, dword [ebp - 8]
sub esi, dword [ebp - 0xc]
mov dword [eax], esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffd4
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov eax, 0xffffffd6
mov esp, ebp
pop ebp
ret
Function at 0x410dd0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x448458]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x103
lea eax, [ebp - 0x20f]
mov byte [ebp - 0x210], 0
push 0
push eax
mov edi, edx
mov esi, ecx
call fcn.0042d5f0
push 0x104
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.0042d5f0
push 0x103
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00424cf0
push 0x103
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.00424cf0
add esp, 0x30
push 0x4438d8
push 0x208
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x410e7a
push 0x208
push 0
push 0
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x410e97
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x46f148], 0
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422f38
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.00426df0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [0x46f148], edi
xor ecx, ebp
mov dword [0x46f044], esi
xor eax, eax
pop edi
pop esi
call fcn.00422f38
mov esp, ebp
pop ebp
ret
Function at 0x410f30
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43711b
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x448458]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x160], ebx
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x11b]
push 0x103
push 0
push eax
mov dword [ebp - 0x164], esi
mov dword [ebp - 0x158], 0xffffffff
mov byte [ebp - 0x11c], 0
call fcn.0042d5f0
add esp, 0xc
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 0
test edi, edi
je 0x411063
test ebx, ebx
je 0x411063
test esi, esi
je 0x411063
push 0x103
lea eax, [ebp - 0x11c]
push edi
push eax
call fcn.00424cf0
lea eax, [ebp - 0x11c]
push eax
call fcn.00424fa7
add esp, 0x10
lea eax, [ebp - 0x11c]
lea ecx, [ebp - 0x134]
push eax
call fcn.00401690
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.00411470
cmp dword [ebp - 0x120], 0x10
jb 0x411021
push dword [ebp - 0x134]
call fcn.004238d6
add esp, 4
mov eax, dword [ebp - 0x150]
cmp eax, dword [0x46f1a4]
je 0x41103d
mov ecx, dword [eax + 0x28]
mov dword [ebx], ecx
mov eax, dword [eax + 0x2c]
mov dword [esi], eax
xor eax, eax
jmp 0x411066
push 0
push 0
push 3
push 0
push 7
push 1
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x411082
call dword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00422f38
mov esp, ebp
pop ebp
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
mov edi, eax
push edi
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
test ebx, ebx
jne 0x4110b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x411165
push edi
push 0
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x150], eax
test eax, eax
je 0x41115c
push 1
push edi
call fcn.00423734
add esp, 8
mov dword [ebp - 0x15c], eax
test eax, eax
je 0x411150
push edi
push dword [ebp - 0x150]
push eax
call fcn.00426df0
add esp, 0xc
lea eax, [ebp - 0x11c]
lea ecx, [ebp - 0x14c]
push eax
call fcn.00401690
lea eax, [ebp - 0x14c]
mov dword [ebp - 4], 0
push eax
call fcn.004113c0
mov ecx, dword [ebp - 0x15c]
mov dword [eax], ecx
lea ecx, [ebp - 0x14c]
mov dword [eax + 4], edi
call fcn.004016f0
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x158], 0
mov dword [eax], ecx
mov eax, dword [ebp - 0x164]
mov dword [eax], edi
push dword [ebp - 0x150]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call edi
test esi, esi
je 0x41116c
push esi
call edi
mov eax, dword [ebp - 0x158]
jmp 0x411066
Function at 0x411200
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
push esi
test ecx, ecx
je 0x411302
mov esi, dword [ecx + 0x114]
test esi, esi
je 0x411302
cmp dword [ecx + 0x118], 0
je 0x411302
mov eax, 0x5a4d
cmp word [esi], ax
je 0x41123f
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x3c]
add ecx, esi
cmp dword [ecx], 0x4550
jne 0x411237
mov eax, 0x8664
cmp word [ecx + 4], ax
mov eax, dword [ecx + 0x54]
push edi
mov edi, dword [ecx + 0x28]
mov dword [ebp - 0xc], eax
jne 0x41127f
mov dword [ebx + 4], 1
lea esi, [ecx + 0x108]
mov eax, dword [ecx + 0x90]
mov dword [ebx + 0x14], eax
mov eax, dword [ecx + 0x94]
jmp 0x41129b
mov dword [ebx + 4], 0
lea esi, [ecx + 0xf8]
mov eax, dword [ecx + 0x80]
mov dword [ebx + 0x14], eax
mov eax, dword [ecx + 0x84]
mov dword [ebx + 0x18], eax
xor edx, edx
movzx eax, word [ecx + 6]
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
test eax, eax
je 0x4112f1
lea ecx, [esi + 0xc]
mov esi, dword [ecx]
cmp edi, esi
jbe 0x4112c3
mov eax, dword [ecx - 4]
add eax, esi
cmp edi, eax
jb 0x4112dc
mov eax, dword [ebp - 4]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x4112b1
mov eax, dword [ebp - 0xc]
mov dword [ebx + 8], edi
pop edi
mov dword [ebx], eax
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
lea eax, [edx + edx*4]
lea ecx, [ecx + eax*8]
mov eax, dword [ecx + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 8], edi
pop edi
mov dword [ebx], eax
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412440
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x448458]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebx + 8]
lea eax, [ebp - 0x3cc]
push edi
push 0x3bc
mov edi, ecx
mov dword [ebp - 0x3e4], edx
push 0
push eax
mov dword [ebp - 0x3e8], edi
mov dword [ebp - 0x3d0], 0
call fcn.0042d5f0
add esi, edi
mov byte [ebp - 0x3dc], 0
xor edi, edi
mov dword [ebp - 0x3d8], esi
add esp, 0xc
mov dword [ebp - 0x3e0], edi
cmp dword [ebp - 0x3e4], 2
jae 0x4124ce
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422f38
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xor edx, edx
lea ecx, [ebp - 0x3d0]
cmp dword [ebx + 0xc], edx
setne dl
lea edx, [edx*2 + 1]
call fcn.00401fb0
test eax, eax
je 0x4124b9
mov dword [ebp - 0x3ec], 1
jmp 0x412500
cmp edi, dword [ebp - 0x3e4]
jae 0x412601
push ecx
push 0
push esi
mov edx, esi
lea ecx, [ebp - 0x3d0]
call fcn.00402040
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x412601
mov edx, dword [ecx + 0x11c]
cmp edx, 0x105
je 0x412540
cmp edx, 0x80007
jne 0x41254a
mov al, 1
mov dword [ebp - 0x3dc], eax
jmp 0x412550
mov eax, dword [ebp - 0x3dc]
mov dl, byte [ecx + 0x140]
mov byte [ebp - 0x3d1], dl
cmp dl, 0xcc
mov edx, dword [ecx + 0x11c]
je 0x41257c
cmp byte [ebp - 0x3d1], 0x90
je 0x41257c
mov dword [ebp - 0x3e0], 0
jmp 0x412599
inc dword [ebp - 0x3e0]
cmp dword [ebp - 0x3e0], 2
movzx eax, al
cmovae eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x3dc], eax
cmp edx, 0x103
jne 0x4125ef
cmp dword [ecx + 0x2a0], 1
jne 0x4125ef
mov edx, dword [ecx + 0x158]
cmp edx, dword [ebp - 0x3e8]
jb 0x4125e7
mov edx, dword [ebp - 0x3d8]
mov eax, dword [ebp - 0x3e4]
add eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x3d8], edx
mov edx, dword [ecx + 0x158]
cmp edx, eax
mov eax, dword [ebp - 0x3d8]
cmovb eax, edx
mov dword [ebp - 0x3d8], eax
mov al, 1
mov dword [ebp - 0x3dc], eax
mov ecx, dword [ecx + 0x128]
add edi, ecx
add esi, ecx
test al, al
je 0x412500
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x3d8]
xor ecx, ebp
pop edi
pop esi
call fcn.00422f38
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x416350
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x416383
mov eax, dword [esi + 0x14]
test eax, eax
je 0x416383
cmp dword [esi], 0
jne 0x4163bb
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x416388
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [esi], eax
test eax, eax
jne 0x41638b
mov dword [esi + 0x24], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
or eax, 0xffffffff
pop esi
ret
push eax
jmp 0x41636b
cmp dword [esi + 0x18], 0
mov eax, 2
mov word [esi + 4], ax
je 0x4163a0
movzx eax, word [esi + 0x22]
jmp 0x4163a4
movzx eax, word [esi + 0x20]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esi + 6], ax
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi + 8], eax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, eax
mov dword [esi + 0x1c], ecx
test ecx, ecx
jns 0x4163e6
mov dword [esi + 0x24], 1
call fcn.004259b3
mov eax, dword [eax]
mov dword [esi + 0x28], eax
or eax, 0xffffffff
pop esi
ret
push 0x10
lea eax, [esi + 4]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x4163d0
xor eax, eax
pop esi
ret

Function at 0x416490
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x40], 0
jne 0x4164a6
mov eax, dword [esi + 0x44]
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], 0
mov edx, dword [esi + 0x34]
mov eax, edx
sub eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x40]
cmp eax, ecx
jge 0x4164cd
lea eax, [edx + ecx]
push eax
push dword [esi + 0x30]
call fcn.004258d4
mov ecx, dword [esi + 0x40]
add esp, 8
add dword [esi + 0x34], ecx
mov dword [esi + 0x30], eax
cmp ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x30]
cmovg ecx, dword [esi + 0x44]
add eax, dword [esi + 0x38]
push 0
push ecx
push eax
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, eax
mov dword [esi + 0x48], ecx
test ecx, ecx
jns 0x416516
call fcn.004259b3
cmp dword [eax], 4
jne 0x416511
xor ecx, ecx
sub dword [esi + 0x40], ecx
mov eax, dword [esi + 0x40]
add dword [esi + 0x3c], ecx
add dword [esi + 0x38], ecx
neg eax
pop esi
sbb eax, eax
add eax, 2
ret
or eax, 0xffffffff
pop esi
ret
jne 0x4164fc
mov eax, 2
pop esi
ret
Function at 0x416950
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x46f15c], 9
push ebx
mov ebx, dword [0x46f160]
push esi
push edi
mov dword [ebp - 4], 0
jne 0x4169e0
cmp ebx, 0xa
jb 0x4169e0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push 0x2011f
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerMAIN
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 1
call esi
test eax, eax
je 0x4169a6
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 8]
push 4
push eax
push 4
push 0
push str.TabProcGrowth
push dword [ebp - 4]
call edi
push 4
push str.PMIL
push 1
push 0
push str.Isolation
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x416a22
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push 0x2021f
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerMAIN
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x41699c
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 8]
push 4
push eax
push 4
push 0
push str.TabProcGrowth
push dword [ebp - 4]
call edi
cmp ebx, 8
jb 0x416a61
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push closesocket
call esi
test eax, eax
jne 0x41699c
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push str.1609
push dword [ebp - 4]
call edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416dd0
Capabilities:
Delete file
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4373eb
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x448458]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 0x43ed3d
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x11c], 0xf
or esi, 0xffffffff
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
call fcn.004018e0
push 0x103
lea eax, [ebp - 0x117]
mov dword [ebp - 4], 0
push 0
push eax
mov byte [ebp - 0x118], 0
call fcn.0042d5f0
add esp, 0xc
mov dword [ebp - 0x134], 0
lea eax, [ebp - 0x134]
mov dword [ebp - 0x138], 0
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x416ea7
push 4
lea eax, [ebp - 0x138]
push eax
push 4
push 0
push str.1609
push dword [ebp - 0x134]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [ebp - 0x130]
mov ecx, 0x68
call fcn.00421240
cmp eax, 0xffffffff
je 0x416f08
cmp dword [ebp - 0x11c], 0x10
lea ecx, [ebp - 0x130]
mov edx, dword [ebp - 0x120]
lea eax, [ebp - 0x118]
cmovae ecx, dword [ebp - 0x130]
push ecx
push eax
call fcn.00421150
add esp, 8
cmp eax, 0xffffffff
je 0x416f08
lea eax, [ebp - 0x118]
mov edx, edi
push 0x43ed3d
push eax
call fcn.0041b440
mov esi, eax
add esp, 8
cmp esi, 0xffffffff
jne 0x416f29
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x416f11
sub ecx, edx
je 0x416f29
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x11c], 0x10
jb 0x416f40
push dword [ebp - 0x130]
call fcn.004238d6
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00422f38
mov esp, ebp
pop ebp
ret

Function at 0x417090
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
test ecx, ecx
jne 0x4170a5
xor eax, eax
mov esp, ebp
pop ebp
ret
push edi
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x4170bc
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor esi, esi
nop
lea eax, [ebp - 4]
push eax
push edi
call ebx
cmp dword [ebp - 4], 0
je 0x4170eb
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x64
jb 0x4170d0
lea eax, [ebp - 4]
push eax
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 4], eax
pop esi
pop ebx
sete al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x417110
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x448458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x138], edx
xor edi, edi
mov dword [ebp - 0x134], eax
test ebx, ebx
je 0x4171cd
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
test esi, esi
je 0x4171cd
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0x128
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4171c6
lea esp, [esp]
cmp ebx, dword [ebp - 0x128]
je 0x41718d
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x417170
jmp 0x4171c6
mov ecx, dword [ebp - 0x138]
test ecx, ecx
je 0x4171af
mov eax, dword [ebp + 8]
test eax, eax
je 0x4171af
lea edx, [ebp - 0x10c]
push edx
push eax
push ecx
call fcn.00425d51
add esp, 0xc
mov ecx, dword [ebp - 0x134]
test ecx, ecx
je 0x4171c1
mov eax, dword [ebp - 0x118]
mov dword [ecx], eax
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00422f38
mov esp, ebp
pop ebp
ret