joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10052543
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10052653
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jl 0x1005259a
mov dword [ebp - 0xc], 1
jmp 0x1005259e
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xc]
je 0x100525b9
mov dword [ebp - 0x1c], 1
jmp 0x100525bd
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x100525d6
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x100525d6
mov dword [ebp - 0x14], 1
jmp 0x100525da
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jg 0x100525ed
mov dword [ebp - 0x3c], 1
jmp 0x100525f1
and dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jg 0x1005260e
mov dword [ebp - 0x18], 1
jmp 0x10052612
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x18]
jl 0x10052642
mov eax, 0xbdd7
test eax, eax
je 0x10052642
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x10052642
xor eax, eax
je 0x10052642
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0
je 0x10052642
mov dword [ebp - 0x20], 1
jmp 0x10052646
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
jmp 0x10052677
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10052677
push 0
push 0xcb4
push 0
push 0
push 0x1964
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret
Function at 0x10052871
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100528df
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x28]
mov eax, dword [ecx + eax]
mov dword [edx], eax
jmp 0x10052904
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xa4c
push 0x15db
push 0x2f1
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esp, ebp
pop ebp
ret
Function at 0x1008478c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100953ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1007c9e4
mov dword [ebp - 0x14], eax
cmp dword [0x106816f8], esi
jne 0x1008487f
push 0x800
push esi
push 0x1000a8bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1008480c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1008495f
push esi
push esi
push 0x1000a8bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1008495f
push 0x1000a8d4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1008495f
push eax
call ebx
push 0x1000a8e0
push edi
mov dword [0x106816f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000a8f0
push edi
mov dword [0x106816fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000a904
push edi
mov dword [0x10681700], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10681708], eax
test eax, eax
je 0x1008487c
push 0x1000a920
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10681704], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100848a4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10084897
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x100848b9
push 4
pop eax
jmp 0x10084961
cmp dword [ebp - 0x14], esi
je 0x100848b9
push dword [0x106816f8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1008489e
mov eax, dword [0x10681704]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10084917
cmp dword [0x10681708], edi
je 0x10084917
push eax
call ebx
push dword [0x10681708]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10084917
test eax, eax
je 0x10084917
call ecx
test eax, eax
je 0x1008490c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1008490c
test byte [ebp - 8], 1
jne 0x10084917
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10084947
mov eax, dword [0x106816fc]
cmp eax, edi
je 0x10084944
push eax
call ebx
test eax, eax
je 0x10084944
call eax
mov esi, eax
test esi, esi
je 0x10084944
mov eax, dword [0x10681700]
cmp eax, edi
je 0x10084944
push eax
call ebx
test eax, eax
je 0x10084944
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x106816f8]
call ebx
test eax, eax
je 0x1008495f
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10084961
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x407281
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4072bf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407295
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x407290
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4072ec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072cd
not eax
pop ebp
ret 0xc

Function at 0x56b593
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x61dbb0
cmp edx, dword [eax]
je 0x56b5b5
add eax, 8
inc ecx
cmp eax, 0x61dc40
jl 0x56b5a6
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x61dbb0]
jne 0x56b6e3
mov eax, dword [0x628200]
cmp eax, 1
je 0x56b6bd
test eax, eax
jne 0x56b5e6
cmp dword [0x61acd4], 1
je 0x56b6bd
cmp edx, 0xfc
je 0x56b6e3
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x56b61d
lea eax, [ebp - 0x1a4]
push 0x5b1b80
push eax
call fcn.0055d240
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0055dbf0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x56b660
lea eax, [ebp - 0x1a4]
push eax
call fcn.0055dbf0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x5b1a84
push edi
call fcn.0055e820
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x5b21e8
push eax
call fcn.0055d240
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0055d250
lea eax, [ebp - 0xa0]
push 0x5e9634
push eax
call fcn.0055d250
push dword [esi + 0x61dbb4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0055d250
push 0x12010
lea eax, [ebp - 0xa0]
push 0x5b1a88
push eax
call fcn.0056b8f5
add esp, 0x2c
pop edi
jmp 0x56b6e3
lea eax, [ebp + 8]
lea esi, [esi + 0x61dbb4]
push 0
push eax
push dword [esi]
call fcn.0055dbf0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
leave
ret

Function at 0x575a80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x575ac2
call fcn.0057ad75
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x575ac2
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x575ab9
xor eax, eax
jmp 0x575aca
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00575ad0
pop edi
pop esi
pop ebx
ret 4
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x74470caf
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x25a85285
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4013dd
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
lea ebp, [esp - 0xfb4]
mov eax, 0x1034
call fcn.0040ff60
mov eax, dword [0x4525e4]
xor eax, ebp
mov dword [ebp + 0xfb0], eax
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00407592
mov esi, eax
pop ecx
cmp esi, 0xffffffff
jne 0x40141b
push 5
call fcn.00409ee8
pop ecx
jmp 0x401533
push ebx
push edi
call fcn.00408a74
push eax
push 0x5c
call fcn.00408527
push eax
push 0x44c12c
mov edi, 0x400
lea eax, [ebp - 0x58]
push edi
push eax
call fcn.00408ad0
push dword [ebp - 0x7c]
lea eax, [ebp + 0x7a8]
push 0x44c13c
push edi
push eax
call fcn.00408ad0
lea eax, [ebp + 0x7a8]
mov dword [ebp - 0x78], str.JavaWSSplashScreen
mov dword [ebp - 0x70], eax
xor ebx, ebx
mov eax, dword [ebp + 0xfbc]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x74], 0x44c16c
push eax
push ebx
mov dword [ebp - 0x68], ebx
call fcn.0040847e
add esp, 0x34
test eax, eax
jne 0x401523
lea edi, [ebp - 0x68]
mov dword [ebp - 0x80], 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_accept]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4014c0
push esi
call fcn.004083c4
push 6
jmp 0x40152a
push ebx
push 6
lea eax, [ebp + 0xfa8]
push eax
push edi
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 6
je 0x4014e6
push edi
call fcn.004083c4
push esi
call fcn.004083c4
push 7
jmp 0x40150a
lea eax, [ebp + 0xfa8]
push eax
call fcn.0041f1fe
mov dword [0x44c128], eax
pop ecx
push edi
test eax, eax
jg 0x401514
call fcn.004083c4
push esi
call fcn.004083c4
push 8
call fcn.00409ee8
add esp, 0xc
jmp 0x401531
call fcn.004083c4
push esi
call fcn.004083c4
xor eax, eax
jmp 0x40152f
push esi
call fcn.004083c4
push ebx
call fcn.00409ee8
pop ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp + 0xfb0]
xor ecx, ebp
pop esi
call fcn.0040ff49
add ebp, 0xfb4
leave
ret
Function at 0x405ebd
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push esi
push 0x45f328
call fcn.00412010
pop ecx
pop ecx
sub eax, esi
je 0x405edb
sub eax, 1
je 0x405ef4
jmp 0x405eef
mov eax, dword [ebp + 8]
mov dword [0x45f36c], eax
call fcn.00406780
call fcn.0040609c
mov esi, eax
mov eax, esi
pop esi
pop ebp
ret
mov eax, dword [0x45f368]
test eax, eax
je 0x405f0a
push eax
call fcn.00405f37
pop ecx
mov dword [0x45f368], esi
mov eax, dword [0x45f370]
test eax, eax
je 0x405f1a
push eax
call fcn.004205c9
pop ecx
push str.Error_during_parsing_jnlp_file..._n
push 2
call fcn.00420f4e
pop ecx
push eax
call fcn.004069a7
pop ecx
pop ecx
push 0xffffffffffffffff
call fcn.004208b5
int3

Function at 0x407287
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x23c
mov eax, dword [0x4525e4]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
mov ebx, dword [esp + 0x244]
lea eax, [esp + 4]
push ebp
push esi
push edi
xor ebp, ebp
mov dword [esp + 0x14], 0x1fe
push str.FORCED_FX_ROOT
push ebp
push eax
mov edi, ebp
mov dword [esp + 0x1c], ebp
mov esi, ebp
call fcn.0041f5a7
add esp, 0xc
cmp dword [esp + 0x10], esi
je 0x407315
test eax, eax
jne 0x407315
push 0x34
push 1
call fcn.004205be
push str.2.0
mov esi, eax
call fcn.004146d8
mov ecx, eax
lea eax, [esi + 8]
push eax
push ecx
mov dword [esi + 4], ecx
call fcn.00406f86
push dword [esp + 0x24]
call fcn.004146d8
mov dword [esi], eax
push dword [esp + 0x28]
call fcn.004205c9
add esp, 0x1c
jmp 0x4073e3
lea eax, [esp + 0x18]
push eax
push 0x20019
push ebp
push str.SoftwareOracleJavaFX
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40733b
xor eax, eax
jmp 0x4073e5
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x5c]
push eax
push edi
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebp, eax
test ebp, ebp
jne 0x4073c5
test ebx, ebx
je 0x40736d
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.00407092
pop ecx
pop ecx
jmp 0x407370
xor eax, eax
inc eax
test eax, eax
je 0x4073c5
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.00406f86
pop ecx
pop ecx
test esi, esi
je 0x4073ac
lea eax, [esi + 8]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00407037
pop ecx
pop ecx
test eax, eax
je 0x4073c5
lea eax, [esp + 0x48]
push esi
push eax
call fcn.00407428
pop ecx
pop ecx
jmp 0x4073c5
push 0x34
push 1
call fcn.004205be
mov esi, eax
lea eax, [esp + 0x50]
push esi
push eax
call fcn.00407428
add esp, 0x10
inc edi
mov dword [esp + 0x14], 0x1fe
push 0
test ebp, ebp
pop ebp
je 0x40733b
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x248]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040ff49
add esp, 0x23c
ret
Function at 0x407428
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1198]
mov eax, 0x1218
call fcn.0040ff60
mov eax, dword [0x4525e4]
xor eax, ebp
mov dword [ebp + 0x1194], eax
push esi
mov esi, dword [ebp + 0x11a4]
lea eax, [ebp - 0x74]
push edi
mov edi, dword [ebp + 0x11a0]
push edi
push 0x44db94
push 0x44dbc4
push 0xffffffffffffffff
push 0x1000
push eax
call fcn.004046a8
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x74]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4074c4
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0x208
push eax
lea eax, [ebp + 0xf8c]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push str.Path
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x78]
test eax, eax
je 0x4074dd
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp + 0x1194]
pop edi
xor ecx, ebp
pop esi
call fcn.0040ff49
add ebp, 0x1198
leave
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x80], 1
jne 0x4074c4
cmp dword [esi + 4], 0
je 0x4074f8
push dword [esi + 4]
call fcn.004205c9
pop ecx
push edi
call fcn.004146d8
mov ecx, eax
lea eax, [esi + 8]
push eax
push ecx
mov dword [esi + 4], ecx
call fcn.00406f86
add esp, 0xc
cmp dword [esi], 0
je 0x40751d
push dword [esi]
call fcn.004205c9
pop ecx
lea ecx, [ebp + 0xf8c]
push ecx
call fcn.004146d8
mov dword [esi], eax
xor eax, eax
pop ecx
inc eax
jmp 0x4074c6

Function at 0x407592
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4525e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00408324
push 2
pop esi
push 0x44dc38
mov word [ebp - 0x14], si
call dword [sym.imp.WSOCK32.dll_inet_addr]
push 0
push 1
push esi
mov dword [ebp - 0x10], eax
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
or edi, 0xffffffff
cmp esi, edi
je 0x407633
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, edi
je 0x40762c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_getsockname]
cmp eax, edi
je 0x40762c
push accept
push esi
call dword [sym.imp.WSOCK32.dll_listen]
cmp eax, edi
je 0x40762c
push dword [ebp - 0x12]
call dword [sym.imp.WSOCK32.dll_ntohs]
movzx eax, ax
mov dword [ebx], eax
mov eax, esi
jmp 0x407635
push esi
call fcn.004083c4
pop ecx
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ff49
leave
ret
Function at 0x4076d5
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4525e4]
xor eax, ebp
mov dword [ebp - 4], eax
xorps xmm0, xmm0
push esi
movlpd qword [ebp - 0xc], xmm0
call fcn.00408324
push 2
pop esi
push dword [ebp + 8]
mov word [ebp - 0x14], si
call dword [sym.imp.WSOCK32.dll_htons]
push 0x44dc50
mov word [ebp - 0x12], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
push 0
push 1
push esi
mov dword [ebp - 0x10], eax
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40772c
or eax, 0xffffffff
jmp 0x407749
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
jne 0x407747
push esi
call fcn.004083c4
pop ecx
jmp 0x407727
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040ff49
leave
ret

Function at 0x407829
Capabilities:
Send data
Send data on socket

Disassembly:
cmp dword [esp + 8], 0
push ebx
push ebp
push edi
je 0x4078ac
mov ecx, dword [esp + 0x14]
xor ebp, ebp
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bp
jne 0x40783c
sub ecx, edx
sar ecx, 1
lea ebx, [ecx*2 + 6]
lea eax, [ebx + ebx]
push eax
call fcn.004205e4
mov edi, eax
pop ecx
test edi, edi
je 0x4078ac
push dword [esp + 0x14]
push str._s_r_n
push ebx
push edi
call fcn.00408ad0
mov ecx, edi
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bp
jne 0x40787a
sub ecx, edx
sar ecx, 1
push ebp
lea eax, [ecx + ecx]
push eax
push edi
push dword [esp + 0x1c]
call dword [sym.imp.WSOCK32.dll_send]
xor ebx, ebx
cmp eax, 0xffffffff
push edi
setne bl
call fcn.004205c9
pop ecx
mov eax, ebx
jmp 0x4078ae
xor eax, eax
pop edi
pop ebp
pop ebx
ret

Function at 0x4078b2
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
push esi
push edi
xor esi, esi
mov ebp, 0x45f378
xor edi, edi
push edi
push 2
push ebp
jmp 0x4078f4
test eax, eax
je 0x407914
movzx eax, word [esi*2 + 0x45f378]
cmp eax, 0xa
je 0x407914
cmp eax, 0xd
lea esi, [edi + 1]
cmove esi, edi
cmp esi, 0x3ff
jge 0x407909
push 0
push 2
lea eax, [esi*2 + 0x45f378]
mov edi, esi
push eax
push dword [esp + 0x1c]
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
jne 0x4078c4
xor eax, eax
pop edi
pop esi
pop ebp
ret
xor ecx, ecx
mov word [0x45fb76], cx
jmp 0x407927
add esi, esi
cmp esi, 0x800
jae 0x40792b
xor eax, eax
mov word [esi + 0x45f378], ax
mov eax, ebp
jmp 0x407905
call fcn.004100ae
int3
Function at 0x408284
Capabilities:
Terminate process

Disassembly:
push 0x21010
push 0x44f018
push dword [esp + 0xc]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0xb
call fcn.00409ee8
pop ecx
push eax
push 2
call fcn.00420f4e
pop ecx
push eax
call fcn.004099e3
pop ecx
pop ecx
call fcn.00421336
push dword [esp + 4]
cmp dword [eax], 0
je 0x4082c9
call fcn.00422334
pop ecx
jmp 0x4082df
push 0x44f060
push 2
call fcn.00420f4e
pop ecx
push eax
call fcn.004099e3
add esp, 0xc
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 0xc
call fcn.00409ee8
pop ecx
push eax
push str._s__d_n
push 2
call fcn.00420f4e
pop ecx
push eax
call fcn.004099e3
add esp, 0x10
push 0xffffffffffffffff
call fcn.004208b5
int3

Function at 0x408324
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x4525e4]
xor eax, esp
mov dword [esp + 0x190], eax
cmp dword [0x461390], 0
jne 0x4083a0
push esi
push edi
xor edi, edi
push str.ws2_32.dll
inc edi
call fcn.0040c03b
mov esi, eax
pop ecx
test esi, esi
jne 0x40836a
push str.wsock32.dll
call fcn.0040c03b
mov esi, eax
xor edi, edi
pop ecx
test esi, esi
je 0x4083b5
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
je 0x40837f
push 0xe
jmp 0x4083b7
test edi, edi
je 0x408394
push str.WSASendDisconnect
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46138c], eax
pop edi
mov dword [0x461390], 1
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0040ff49
add esp, 0x194
ret
push 0xd
call fcn.00409ee8
pop ecx
push eax
call fcn.00408284
int3

Function at 0x40847e
Capabilities:
Terminate process

Disassembly:
push ebp
push esi
push edi
call fcn.00421336
mov esi, dword [esp + 0x18]
xor ebp, ebp
mov edi, esi
mov dword [eax], ebp
mov eax, dword [esi]
jmp 0x4084a2
push eax
call fcn.00407931
mov dword [edi], eax
lea edi, [edi + 4]
mov eax, dword [edi]
pop ecx
test eax, eax
jne 0x408494
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x408511
test eax, eax
jne 0x4084bc
push esi
push dword [esp + 0x18]
push 1
jmp 0x4084ec
cmp eax, 3
jne 0x4084e6
call fcn.00409429
push esi
push dword [esp + 0x18]
mov edi, eax
push 1
call fcn.0042231a
add esp, 0xc
mov esi, eax
test edi, edi
je 0x4084f6
push edi
call fcn.00409491
pop ecx
jmp 0x4084f6
push esi
push dword [esp + 0x18]
push ebp
call fcn.0042231a
mov esi, eax
add esp, 0xc
test esi, esi
js 0x4084fe
xor eax, eax
jmp 0x40850d
call fcn.00421336
xor ecx, ecx
cmp dword [eax], ebp
setne cl
lea eax, [ecx - 2]
pop edi
pop esi
pop ebp
ret
push esi
push dword [esp + 0x18]
push 1
call fcn.0042231a
add esp, 0xc
push ebp
call fcn.004208b5
int3