joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425de0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x467cb8]
xor eax, ebp
mov dword [ebp - 0x18], eax
push 0x44f2d4
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x425e12
mov eax, dword [ebp - 4]
jmp 0x425f99
push str.WNCHOME_LS
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x425f5d
push 0x200
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x425e51
xor eax, eax
jmp 0x425f99
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], ecx
jmp 0x425e6e
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
mov eax, dword [ebp - 0x21c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x425e94
mov edx, dword [ebp - 0x21c]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x425e92
mov ecx, dword [ebp - 0x21c]
mov byte [ecx], 0x2f
jmp 0x425e5f
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.0041eaa0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x425eb5
xor eax, eax
jmp 0x425f99
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.0041eaa0
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x425ee5
xor eax, eax
jmp 0x425f99
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
push 0x2f
lea edx, [ebp - 0x218]
push edx
call fcn.0041eaa0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x425f15
xor eax, eax
jmp 0x425f99
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
push 0x44f2e8
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
jne 0x425f50
push 0x44f2ec
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x425f54
xor eax, eax
jmp 0x425f99
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp + 8]
test edx, edx
je 0x425f96
push str.WNCHOME
push 0x469750
call sub.MSVCR100.dll_strcpy
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x469750
call sub.MSVCR100.dll_strcat
add esp, 8
push 0x469750
call dword [sym.imp.MSVCR100.dll__putenv]
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004364d4
mov esp, ebp
pop ebp
ret

Function at 0x426340
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.WNC_WNCFILES_VERBOSE
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x426379
push 0x44f3c0
mov eax, dword [ebp - 4]
push eax
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
je 0x426379
mov eax, 1
jmp 0x42637b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42eae0
Capabilities:
Get token privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x467cb8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
je 0x42eb09
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041d2f0
add esp, 8
lea edx, [ebp - 0x128]
push edx
push 0x118
lea eax, [ebp - 0x120]
push eax
push 3
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
je 0x42eb43
mov dword [ebp - 0x234], 0
jmp 0x42eb4f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x234], eax
mov edx, dword [ebp - 0x234]
mov dword [ebp - 0x124], edx
cmp dword [ebp - 0x130], 0
jne 0x42eb8f
mov eax, dword [ebp - 0x124]
push eax
push str.GetTokenInformation___returned
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041d2f0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov eax, dword [ebp - 0x124]
jmp 0x42ec7f
lea edx, [ebp - 0x120]
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x134], 0
jmp 0x42ebb6
mov eax, dword [ebp - 0x134]
add eax, 1
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x134]
cmp edx, dword [ecx]
jae 0x42ec79
mov dword [ebp - 0x190], 0xa0
lea eax, [ebp - 0x190]
push eax
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x134]
imul edx, edx, 0xc
mov eax, dword [ebp - 0x12c]
lea ecx, [eax + edx + 4]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameW]
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
jne 0x42ec19
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x124], eax
lea edx, [ebp - 0x230]
push edx
push 0x4514bc
push 0x50
lea eax, [ebp - 0x188]
push eax
call dword [sym.imp.MSVCR100.dll__snprintf]
add esp, 0x10
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
push ecx
lea edx, [ebp - 0x188]
push edx
push 0x4514c0
mov eax, dword [ebp - 0x134]
push eax
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
push eax
call fcn.0041d2f0
add esp, 8
push eax
call fcn.0041d2f0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x42eba7
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004364d4
mov esp, ebp
pop ebp
ret
Function at 0x42ee00
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42ee53
mov ecx, dword [ebp + 0x10]
push ecx
push str.PC_user
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR100.dll_strncpy]
add esp, 0xc
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0x10]
mov byte [eax - 1], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x42ee60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x467cb8]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
xor eax, eax
je 0x42ee9b
push 0x4514d4
lea ecx, [ebp - 0xc]
push ecx
call sub.MSVCR100.dll_strcpy
add esp, 8
jmp 0x42ef2b
push 0x4514d8
lea edx, [ebp - 0xc]
push edx
call sub.MSVCR100.dll_strcpy
add esp, 8
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xc], 0x41
jmp 0x42eec2
mov al, byte [ebp - 0xc]
add al, 1
mov byte [ebp - 0xc], al
movsx ecx, byte [ebp - 0xc]
cmp ecx, 0x5a
jg 0x42ef15
movsx edx, byte [ebp - 0xe]
test edx, edx
jne 0x42ef15
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xd4], ecx
cmp dword [ebp - 0xd4], 2
je 0x42ef05
cmp dword [ebp - 0xd4], 3
je 0x42eefd
jmp 0x42ef13
mov dl, byte [ebp - 0xc]
mov byte [ebp - 0xe], dl
jmp 0x42ef13
movsx eax, byte [ebp - 0xd]
test eax, eax
jne 0x42ef13
mov cl, byte [ebp - 0xc]
mov byte [ebp - 0xd], cl
jmp 0x42eeba
movsx edx, byte [ebp - 0xe]
test edx, edx
jne 0x42ef25
mov al, byte [ebp - 0xd]
mov byte [ebp - 0xc], al
jmp 0x42ef2b
mov cl, byte [ebp - 0xe]
mov byte [ebp - 0xc], cl
movsx edx, byte [ebp - 0xc]
test edx, edx
jne 0x42ef43
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0xfffffc19
jmp 0x42ef89
push 0x50
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x7c]
push edx
lea eax, [ebp - 0x74]
push eax
push 0x50
lea ecx, [ebp - 0xd0]
push ecx
lea edx, [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x42ef83
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 1
jmp 0x42ef89
mov eax, dword [ebp - 0x74]
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jne 0x42ef95
cmp dword [ebp - 4], 0
jl 0x42efa1
cmp dword [ebp - 8], 0
je 0x42efa9
cmp dword [ebp - 4], 0
jle 0x42efa9
mov ecx, dword [ebp - 4]
neg ecx
mov dword [ebp - 4], ecx
cmp dword [0x46b920], 0
je 0x42f011
cmp dword [0x467940], 0
jle 0x42f011
cmp dword [0x46b92c], 0
je 0x42efd9
mov edx, dword [ebp - 4]
mov dword [0x46b930], edx
mov dword [0x46b92c], 0
jmp 0x42efee
mov eax, dword [ebp - 4]
cmp eax, dword [0x46b930]
je 0x42efee
mov dword [0x467940], 0
mov ecx, dword [0x467940]
sub ecx, 1
mov dword [0x467940], ecx
jne 0x42f011
lea edx, [ebp - 4]
push edx
push 0x46b928
call dword [0x46b920]
add esp, 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004364d4
mov esp, ebp
pop ebp
ret
Function at 0x435d30
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push eax
push 0xc8
push 0x46bb50
push 1
call fcn.00435900
add esp, 0x10
mov dword [ebp - 8], eax
push str.localhost
push 0x46bb50
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
je 0x435d7d
push str.127.0.0.1
push 0x46bb50
call sub.MSVCR100.dll_strcmp
add esp, 8
test eax, eax
jne 0x435d84
mov byte [0x46bb50], 0
movsx ecx, byte [0x46bb50]
test ecx, ecx
jne 0x435de7
mov dword [ebp - 0x10], 0xc8
lea edx, [ebp - 0x10]
push edx
push 0x46bb50
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x435de7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], 0
je 0x435dd0
mov eax, dword [ebp - 0x14]
push eax
push str.GetComputerName___:_Error__d
mov ecx, dword [ebp + 0xc]
push ecx
call dword [ebp + 8]
add esp, 0xc
mov edx, dword [ebp - 0x14]
push edx
push str.GCN_Error__d
push 0x46bb50
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
mov eax, 0x46bb50
mov esp, ebp
pop ebp
ret

Function at 0x435e30
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [edx + 0x118]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [edx + 0x114]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00435e10
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00435e00
push eax
push 0x10
call fcn.00435f20
add esp, 0x18
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x435e82
mov eax, dword [ebp - 8]
jmp 0x435f1a
cmp dword [ebp + 0x10], 0
je 0x435ece
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x435ece
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
push edx
push str.ImpersonateLoggedOnUser___:_Error__d
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x118]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x114]
call edx
add esp, 0xc
mov eax, dword [ebp - 8]
jmp 0x435f1a
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x435ef4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
jmp 0x435efb
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp + 0x10], 0
je 0x435f17
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x435ff0
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x467cb8]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x820], ecx
cmp dword [ebp + 8], 0
je 0x43601b
cmp dword [ebp + 0xc], 0
je 0x43601b
cmp dword [ebp + 0x10], 0
jne 0x436023
or eax, 0xffffffff
jmp 0x43614f
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
lea edx, [ebp - 0x80c]
push edx
mov eax, dword [ebp - 0x820]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x118]
push edx
mov eax, dword [ebp - 0x820]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x114]
push edx
mov ecx, dword [ebp - 0x820]
call fcn.00435e10
push eax
mov ecx, dword [ebp - 0x820]
call fcn.00435e00
push eax
push 1
call fcn.00435f20
add esp, 0x18
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x436090
mov eax, dword [ebp - 0x814]
jmp 0x43614f
mov eax, dword [ebp + 8]
mov byte [eax], 1
lea ecx, [ebp - 0x808]
mov dword [ebp - 0x810], ecx
lea edx, [ebp - 0x81c]
push edx
push 0x800
mov eax, dword [ebp - 0x810]
push eax
mov ecx, dword [ebp - 0x80c]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x818], 0
jne 0x4360dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x814], eax
mov edx, dword [ebp - 0x80c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x814], 0
je 0x4360fb
mov eax, dword [ebp - 0x814]
jmp 0x43614f
mov eax, dword [ebp - 0x810]
cmp dword [eax + 0xc], 0
jne 0x43610e
mov eax, 0xfffffffd
jmp 0x43614f
mov ecx, dword [ebp - 0x810]
mov edx, dword [ecx + 0xc]
push edx
call sub.MSVCR100.dll_strlen
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jb 0x436132
mov eax, 0xfffffffe
jmp 0x43614f
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x810]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR100.dll_strncpy]
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004364d4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x436160
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x467cb8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x438], ecx
cmp dword [ebp + 8], 0
je 0x436185
cmp dword [ebp + 0xc], 0
jne 0x43618d
or eax, 0xffffffff
jmp 0x436285
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
lea edx, [ebp - 0x424]
push edx
mov eax, dword [ebp - 0x438]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x118]
push edx
mov eax, dword [ebp - 0x438]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x114]
push edx
mov ecx, dword [ebp - 0x438]
call fcn.00435e10
push eax
mov ecx, dword [ebp - 0x438]
call fcn.00435e00
push eax
push 4
call fcn.00435f20
add esp, 0x18
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
je 0x436200
mov eax, dword [ebp - 0x428]
jmp 0x436285
lea eax, [ebp - 0x430]
push eax
push 0x418
lea ecx, [ebp - 0x420]
push ecx
push 0
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jne 0x43623d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x424]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x428], 0
je 0x43625b
mov eax, dword [ebp - 0x428]
jmp 0x436285
lea ecx, [ebp - 0x420]
mov dword [ebp - 0x434], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x434]
mov ecx, dword [eax + 0x1c]
mov dword [edx], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x434]
mov ecx, dword [eax + 4]
mov dword [edx], ecx
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004364d4
mov esp, ebp
pop ebp
ret 8

Function at 0x4364d4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x467cb8]
jne 0x4364de
repz ret
jmp fcn.004369bd
Function at 0x4404c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x404
push 0
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0x400
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_recv
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x400], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx + 0x400], 0xffffffff
jne 0x440523
call fcn.004406d0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x440517
mov eax, dword [ebp - 4]
imul eax, eax, 0xffffffff
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x400], edx
push 0
mov eax, dword [0x46ccf8]
push eax
call dword [0x468084]
add esp, 8
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x400], 0
jg 0x440547
mov eax, 0xfffffe6c
jmp 0x440549
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x440550
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x10
push 0
mov eax, dword [ebp + 0x10]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
jmp 0x44057e
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x4405ac
mov edx, dword [ebp - 8]
movsx eax, byte [edx]
push eax
push str.0123456789.
call dword [sym.imp.MSVCR100.dll_strchr]
add esp, 8
test eax, eax
jne 0x4405aa
mov dword [ebp - 4], 1
jmp 0x4405ac
jmp 0x440575
cmp dword [ebp - 4], 0
je 0x4405ed
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4405cb
mov eax, 0xfffffe0b
jmp 0x44063c
mov edx, dword [ebp - 0xc]
movsx eax, word [edx + 0xa]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x10]
add ecx, 4
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
jmp 0x44061e
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x10], eax
push 4
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
add ecx, 4
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
cmp dword [ebp - 0x10], 0xffff
jne 0x44061e
mov eax, 0xfffffe09
jmp 0x44063c
mov edx, 2
mov eax, dword [ebp + 0x10]
mov word [eax], dx
movzx ecx, word [ebp + 0xc]
push ecx
call sub.WS2_32.dll_htons
mov edx, dword [ebp + 0x10]
mov word [edx + 2], ax
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x440660
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
jge 0x440682
mov eax, 0xfffffe6f
jmp 0x4406a2
push 0x10
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call sub.WS2_32.dll_connect
test eax, eax
je 0x4406a0
mov eax, 0xfffffe6e
jmp 0x4406a2
xor eax, eax
pop ebp
ret
Function at 0x4406f0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x440703
mov eax, dword [ebp + 8]
mov dword [eax], 0x46d5b0
cmp dword [0x46ccf4], 0
je 0x440710
xor eax, eax
jmp 0x44076f
push 0x46d420
push 0x202
call sub.WS2_32.dll_WSAStartup
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x440746
mov ecx, dword [ebp - 4]
push ecx
push str.WSAStartup_error__d
push 0x46d5b0
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
mov eax, 0xfffffb49
jmp 0x44076f
mov dword [0x46ccf4], 1
push 0x46d525
push 0x46d424
push str.DLL_s___STATUS_s
push 0x46d5b0
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x10
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4425b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x468394], 0
jle 0x4425c6
mov eax, dword [0x468394]
jmp 0x4425de
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x10]
mov dword [0x468394], ecx
mov eax, dword [0x468394]
mov esp, ebp
pop ebp
ret

Function at 0x4428d0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x467cb8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
push connect
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44290d
call dword [sym.imp.KERNEL32.dll_GetLastError]
imul eax, eax, 0xffffffff
mov dword [ebp - 8], eax
jmp 0x442968
push 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x442934
call dword [sym.imp.KERNEL32.dll_GetLastError]
imul eax, eax, 0xffffffff
mov dword [ebp - 8], eax
jmp 0x442968
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x442959
call dword [sym.imp.KERNEL32.dll_GetLastError]
imul eax, eax, 0xffffffff
mov dword [ebp - 8], eax
jmp 0x442968
mov ecx, dword [ebp - 0x28]
and ecx, 4
je 0x442968
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004364d4
mov esp, ebp
pop ebp
ret
Function at 0x40e9da
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov al, byte [0x2ff845c6]
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040daca
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040da7f
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0040daba
not byte [edi]
inc ebp
fsubr dword [eax + 4]
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid