joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1c4f1f2a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1c4f1f83
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1c4f1f2a
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1c4f1f39
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1c8f7bdc
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1c4f1f8a
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1c4d8e00
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1c4f2029
add edi, 4
add eax, 2
dec ecx
jne 0x1c4f1f6f
call 0x1c4f1fd6
loope 0x1c4f1fcc
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1c4f2026
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1c4f2037
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1c4f1fea
cmp eax, ecx
ja 0x1c4f1fea
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1c4f2074
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1c4f206a
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1c4d92df
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x1c4f1f39
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x1c4f1f83
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x1c4f1f2a
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x1c4f1f39
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1c8f7bdc
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x1c4f1f8a
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1c4d8e00
cmp eax, dword [ebp + 0xc]
pop eax
je 0x1c4f2029
add edi, 4
add eax, 2
dec ecx
jne 0x1c4f1f6f
call 0x1c4f1fd6
loope 0x1c4f1fcc
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x1c4f2026
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x1c4f2037
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x1c4f1fea
cmp eax, ecx
ja 0x1c4f1fea
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x1c4f2074
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1c4f206a
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1c4d92df
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10013a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x10013a81
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x10013adb
inc edi
cmp edi, esi
jl 0x10013a75
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x10013b10
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x10013aca
cmp byte [eax], bl
je 0x10013ae5
cmp byte [eax + 1], bl
je 0x10013aee
cmp byte [eax + 2], bl
je 0x10013af8
cmp byte [eax + 3], bl
je 0x10013b04
add eax, 4
cmp eax, edi
jb 0x10013aa1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x10014a00
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x10014a66
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x10014a66
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x10014a47
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x10014df0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x10014e28
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x10015b10
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x10015b59
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x10015fd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1002c8c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.10015b80
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.10015c00
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.10015c00
lea ecx, [esi + 0xc]
call fcn.100247c3
lea ecx, [esi + 0x10]
call fcn.100247c3
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.100171a0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.100171a0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.100171a0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.10024838
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.10024838
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x100274ec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x1002752e
call fcn.1002b06e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x1002752e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10027525
xor eax, eax
jmp 0x10027536
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.1002753c
pop edi
pop esi
pop ebx
ret 4
Function at 0x401860
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x2c
lea eax, [esp + 8]
push ebx
push esi
push edi
push ebp
push 0x22
push eax
call fcn.004017f0
mov dx, 8
add esp, 8
movzx eax, dx
dec dx
mov ecx, dword [esp + 0x40]
mov ebx, dword [ecx + eax*4 - 4]
lea eax, [ecx + eax*4]
sub dword [eax], ebx
cmp dx, 2
jae 0x40187a
mov si, 8
xor edi, edi
mov word [esp + 0x12], di
mov ebx, accept
mov eax, dword [esp + 0x12]
and eax, 0xffff
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx + eax*4]
mov ecx, eax
and ecx, ebx
cmp ecx, 1
sbb dl, dl
xor cx, cx
inc dl
mov ebp, ebx
and ebp, eax
je 0x4018ca
test dl, dl
je 0x4018dd
test ebp, ebp
jne 0x4018d2
test dl, dl
jne 0x4018dd
shr ebx, 1
inc cx
cmp cx, 0x20
jb 0x4018c0
shr cx, 2
mov bl, 7
sub bl, cl
movzx cx, bl
lea edx, [edx + ebx*2]
lea ecx, [ecx*4 + 4]
mov word [esp + 0x14], cx
mov byte [esp + 0x11], dl
xor dx, dx
mov bl, byte [esp + 0x11]
mov cl, 3
movzx ebp, di
sub cl, dl
shr bl, cl
and bl, 1
lea ecx, [esi - 1]
shl bl, cl
or byte [esp + ebp + 0x18], bl
dec si
jne 0x401922
mov si, 8
inc di
inc dx
cmp dx, 4
jb 0x4018ff
xor dx, dx
cmp word [esp + 0x14], dx
je 0x401962
mov ebx, eax
mov cl, byte [esp + 0x14]
movzx ebp, di
sub cl, dl
dec cl
shr ebx, cl
and bl, 1
lea ecx, [esi - 1]
shl bl, cl
or byte [esp + ebp + 0x18], bl
dec si
jne 0x401959
mov si, 8
inc di
inc dx
cmp dx, word [esp + 0x14]
jb 0x401934
inc word [esp + 0x12]
cmp word [esp + 0x12], 9
jb 0x40189d
cmp si, 8
je 0x40197b
inc di
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0x44]
push 0x28
mov dword [esp + 0x18], eax
push esi
call fcn.004017f0
mov al, byte [esp + 0x1c]
add esp, 8
movzx ecx, di
mov edi, 0x26
mov byte [esi], al
xor eax, eax
sub edi, ecx
mov al, byte [esp + 0x15]
cdq
idiv edi
add dl, 2
mov al, byte [esp + 0x14]
sub al, dl
movzx bx, dl
movzx edx, bx
mov byte [esi + 1], al
lea edi, [ecx + edx]
cmp edi, edx
jle 0x4019d7
movzx eax, bx
inc bx
mov byte [eax + esi], 1
movzx ebp, bx
cmp ebp, edi
jl 0x4019c7
mov bx, 2
movzx eax, bx
lea edi, [eax + esi]
cmp byte [edi], 0
jne 0x4019ec
mov al, byte [esp + 0x16]
mov byte [edi], al
inc bx
cmp bx, 0x28
jb 0x4019db
lea eax, [esp + 0x18]
push ecx
push eax
add edx, esi
push edx
call fcn.00401810
mov cx, 1
add esp, 0xc
movzx eax, cx
inc cx
add eax, esi
mov dl, byte [eax - 1]
xor byte [eax], dl
cmp cx, 0x28
jb 0x401a09
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x4022f0
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x384
mov eax, dword [0x4ecd5c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x37c], ecx
push 0
mov ecx, dword [ebp - 0x37c]
call fcn.00426931
mov ecx, dword [ebp - 0x37c]
call fcn.00404760
push 0
push 0x100
push 0
mov ecx, dword [ebp - 0x37c]
call fcn.00426837
call fcn.0040acc0
mov word [ebp - 0x204], ax
movzx eax, word [ebp - 0x204]
cmp eax, 5
je 0x40236b
movzx ecx, word [ebp - 0x204]
cmp ecx, 0x105
je 0x40236b
movzx edx, word [ebp - 0x204]
cmp edx, 0x5a04
jne 0x4023bf
mov dword [ebp - 0x20c], 0
push 0x4001
push 0x160
lea eax, [ebp - 0x370]
push eax
push 0
push 0x486800
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x37c]
mov edx, dword [ebp - 0x20c]
mov dword [ecx + 0x58], edx
push 0
mov eax, dword [ebp - 0x37c]
add eax, 0x54
push eax
mov ecx, dword [ebp - 0x37c]
call fcn.004047c0
lea ecx, [ebp - 0x200]
push ecx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea edx, [ebp - 0x200]
mov dword [ebp - 0x208], edx
mov eax, dword [ebp - 0x208]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40248b
push 4
mov edx, dword [ebp - 0x208]
push edx
lea eax, [ebp - 0x374]
push eax
call fcn.004036c0
add esp, 0xc
mov byte [ebp - 0x371], 0
movsx ecx, byte [ebp - 0x374]
mov dword [ebp - 0x380], ecx
mov edx, dword [ebp - 0x380]
sub edx, 0x41
mov dword [ebp - 0x380], edx
cmp dword [ebp - 0x380], 0x21
ja case.0x40243f.2
mov eax, dword [ebp - 0x380]
movzx ecx, byte [eax + 0x4024b0]
jmp dword [ecx*4 + 0x4024a8]
jmp 0x402477
mov byte [ebp - 0x372], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x378], esp
lea edx, [ebp - 0x374]
push edx
call fcn.00404990
mov dword [ebp - 0x384], eax
push 0
mov ecx, dword [ebp - 0x37c]
call fcn.004024e0
mov eax, dword [ebp - 0x208]
add eax, 4
mov dword [ebp - 0x208], eax
jmp 0x4023dd
push 5
mov ecx, dword [ebp - 0x37c]
call fcn.00426931
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00440a5c
mov esp, ebp
pop ebp
ret
Function at 0x4065b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov byte [ebp - 5], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4065e3
xor eax, eax
jmp 0x406676
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4065fe
xor eax, eax
jmp 0x406676
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x406668
cmp dword [ebp + 0x14], 0
jne 0x406630
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
mov byte [ebp - 5], 1
jmp 0x40665f
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x18]
cmp dword [edx], eax
jl 0x40665f
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.00441e90
add esp, 0xc
mov byte [ebp - 5], 1
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00407f00
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
movzx eax, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x40acc0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x4ecd5c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x9c
push 0
lea eax, [ebp - 0xa8]
push eax
call fcn.00440a70
add esp, 0xc
mov dword [ebp - 0xa8], 0x9c
lea ecx, [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x40ad26
mov dword [ebp - 0xa8], 0x94
lea edx, [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x40ad26
xor eax, eax
jmp 0x40ade5
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
je 0x40ad95
cmp dword [ebp - 0xac], 2
je 0x40ad49
jmp 0x40ade0
cmp dword [ebp - 0xa4], 4
ja 0x40ad5c
mov eax, 4
jmp 0x40ade5
cmp dword [ebp - 0xa4], 5
jne 0x40ad75
cmp dword [ebp - 0xa0], 0
jne 0x40ad75
mov eax, 5
jmp 0x40ade5
cmp dword [ebp - 0xa4], 5
jne 0x40ad8e
cmp dword [ebp - 0xa0], 1
jne 0x40ad8e
mov eax, 0x105
jmp 0x40ade5
mov eax, 0x105
jmp 0x40ade5
cmp dword [ebp - 0xa4], 4
jne 0x40adae
cmp dword [ebp - 0xa0], 0
jne 0x40adae
mov eax, 4
jmp 0x40ade5
cmp dword [ebp - 0xa4], 4
jne 0x40adc7
cmp dword [ebp - 0xa0], 0xa
jne 0x40adc7
mov eax, 0xa04
jmp 0x40ade5
cmp dword [ebp - 0xa4], 4
jne 0x40ade0
cmp dword [ebp - 0xa0], 0x5a
jne 0x40ade0
mov eax, 0x5a04
jmp 0x40ade5
mov eax, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00440a5c
mov esp, ebp
pop ebp
ret
Function at 0x40aea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0x800
lea eax, [ebp - 8]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40aed7
xor al, al
jmp 0x40af1d
lea eax, [ebp - 0xc]
push eax
push 0x800
mov ecx, dword [ebp + 0x14]
call fcn.00404a90
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x14]
call fcn.00404ad0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 0x10], 0
sete al
mov esp, ebp
pop ebp
ret

Function at 0x40af90
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4ecd5c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x414], 0
lea eax, [ebp - 0x410]
push eax
push 0x20019
push 0
push 0x486f20
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b065
mov ecx, dword [ebp - 0x40c]
mov dword [ebp - 0x418], ecx
push 0x401
lea edx, [ebp - 0x408]
push edx
mov eax, dword [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x410]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edx, dword [ebp - 0x40c]
add edx, 1
mov dword [ebp - 0x40c], edx
test eax, eax
jne 0x40b058
push 1
push 0x486f3c
lea eax, [ebp - 0x408]
push eax
call fcn.00442467
add esp, 0xc
test eax, eax
je 0x40b038
jmp 0x40afdd
lea ecx, [ebp - 0x408]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040c000
mov edx, dword [ebp - 0x414]
add edx, 1
mov dword [ebp - 0x414], edx
jmp 0x40afdd
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00440a5c
mov esp, ebp
pop ebp
ret
Function at 0x40b080
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48277b
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x4ecd5c]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x420]
call fcn.00404950
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push 0x486f40
push 0x486f5c
lea ecx, [ebp - 0x420]
push ecx
call fcn.004055a0
add esp, 0x10
mov dword [ebp - 0x424], 0
lea edx, [ebp - 0x14]
push edx
push 0x20019
push 0
lea ecx, [ebp - 0x420]
call fcn.0040d850
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b18a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x42c], eax
push 0x401
lea ecx, [ebp - 0x41c]
push ecx
mov edx, dword [ebp - 0x42c]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
test eax, eax
jne 0x40b180
push 5
push str.ACAD_
lea edx, [ebp - 0x41c]
push edx
call fcn.0040bfb0
add esp, 0xc
test eax, eax
je 0x40b160
jmp 0x40b111
lea eax, [ebp - 0x41c]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.0040c000
mov ecx, dword [ebp - 0x424]
add ecx, 1
mov dword [ebp - 0x424], ecx
jmp 0x40b111
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x428], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x420]
call fcn.00404a10
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00440a5c
mov esp, ebp
pop ebp
ret
Function at 0x40b560
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x40b583
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40b64a
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x40b5a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40b64a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x28], 2
jne 0x40b62f
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, 0xa
div ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3e8
jae 0x40b5d6
mov dword [ebp - 8], 0x3e8
jmp 0x40b5e6
cmp dword [ebp - 8], 0x2710
jbe 0x40b5e6
mov dword [ebp - 8], 0x2710
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x40b604
jmp 0x40b62f
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 4]
jbe 0x40b61d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
jmp 0x40b62d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jbe 0x40b62d
jmp 0x40b62f
jmp 0x40b5af
cmp dword [ebp - 0x28], 4
jne 0x40b63e
mov dword [ebp - 0xc], 0
jmp 0x40b647
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x40bb10
Capabilities:
Create raw socket
Create tcp socket
Create udp socket
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14ec
call fcn.00443d50
mov eax, dword [0x4ecd5c]
xor eax, ebp
mov dword [ebp - 0xc], eax
call fcn.004053a0
mov dword [ebp - 0x14cc], eax
mov dword [ebp - 0x139c], 0
lea eax, [ebp - 0x1384]
mov dword [ebp - 0x139c], eax
mov ecx, 2
mov word [ebp - 0x14e4], cx
mov edx, dword [ebp + 8]
push edx
call fcn.00410e10
add esp, 4
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 0x14e0], eax
movzx eax, word [ebp + 0xc]
push eax
call dword [sym.imp.WSOCK32.dll_htons]
mov word [ebp - 0x14e2], ax
push 0
push 0
push 0
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [ebp - 0x14b8], eax
cmp dword [ebp - 0x14b8], 0xffffffff
jne 0x40bba7
xor al, al
jmp 0x40bd2b
push 0
push 0
push 0
push 1
push 3
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [ebp - 0x13a0], eax
cmp dword [ebp - 0x13a0], 0xffffffff
jne 0x40bbcf
xor al, al
jmp 0x40bd2b
push 0x10
lea ecx, [ebp - 0x14e4]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x14b8]
push edx
call dword [sym.imp.WSOCK32.dll_sendto]
mov dword [ebp - 0x14b0], 0
mov dword [ebp - 0x14ec], 0
jmp 0x40bc10
mov eax, dword [ebp - 0x14ec]
add eax, 1
mov dword [ebp - 0x14ec], eax
mov ecx, dword [ebp - 0x14ec]
cmp ecx, dword [ebp - 0x14b0]
jae 0x40bc37
mov edx, dword [ebp - 0x14ec]
mov eax, dword [ebp + edx*4 - 0x14ac]
cmp eax, dword [ebp - 0x13a0]
jne 0x40bc35
jmp 0x40bc37
jmp 0x40bc01
mov ecx, dword [ebp - 0x14ec]
cmp ecx, dword [ebp - 0x14b0]
jne 0x40bc70
cmp dword [ebp - 0x14b0], 0x40
jae 0x40bc70
mov edx, dword [ebp - 0x14ec]
mov eax, dword [ebp - 0x13a0]
mov dword [ebp + edx*4 - 0x14ac], eax
mov ecx, dword [ebp - 0x14b0]
add ecx, 1
mov dword [ebp - 0x14b0], ecx
xor edx, edx
jne 0x40bbf5
mov dword [ebp - 0x14d4], 4
mov dword [ebp - 0x14d0], 0
push 0
push 0
push 0
lea eax, [ebp - 0x14b0]
push eax
push 0x40
call dword [sym.imp.WSOCK32.dll_select]
mov dword [ebp - 0x13a4], eax
cmp dword [ebp - 0x13a4], 0xffffffff
jne 0x40bcb0
xor al, al
jmp 0x40bd2b
lea ecx, [ebp - 0x14b0]
push ecx
mov edx, dword [ebp - 0x13a0]
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x40bd27
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14c8]
push ecx
push 0
push 0x1388
lea edx, [ebp - 0x1398]
push edx
mov eax, dword [ebp - 0x13a0]
push eax
call dword [sym.imp.WSOCK32.dll_recvfrom]
mov ecx, dword [ebp - 0x14c4]
cmp ecx, dword [ebp - 0x14e0]
jne 0x40bd23
mov edx, dword [ebp - 0x139c]
movzx eax, byte [edx]
cmp eax, 3
jne 0x40bd23
mov ecx, dword [ebp - 0x139c]
movzx edx, byte [ecx + 1]
cmp edx, 0xc
jg 0x40bd23
xor al, al
jmp 0x40bd2b
mov al, 1
jmp 0x40bd2b
jmp 0x40bcb0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00440a5c
mov esp, ebp
pop ebp
ret