joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10171eb5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x101417e5
wait
push ds
outsb dx, byte [esi]
ljmp 0xe524
idiv bh
jmp [eax - 0x76]
mov word [ebp], dx
push 0xc238cf2e
push 0x2389fd14
call fcn.101419f6
loopne 0x101417a0
jecxz 0x10141860
pop ss
call 0x135658f
jae 0x101417c0
and eax, 0x90093163
dec esi
dec eax
test ecx, esi
test ebp, edx
dec esp
stosb byte es:[edi], al
out dx, al
mov dl, byte [ebx]
or dword [edx], edx
or dword [eax], edx
or bl, byte [ecx]
xchg edx, eax
xchg esi, eax
jg 0x1014186a
inc eax
mov al, 0xa0
mov byte [0x5325b0c2], al
scasd eax, dword es:[edi]
push ecx
pop ecx
wait
inc esp
add ch, cl
mov cl, 0x18
pop esp
push esp
mov dh, 0xf9
wait
test ecx, eax
in al, 0x3a
invalid
sub dword [ecx + esi*4 - 0x285c5c4c], 0x13
out 0x3a, al
add dword [ecx - 0x1f2fd7cf], ecx
xor dword [0xac8a2488], 0x56ac7dab
aas
mov ch, byte [ebx + ebp*4 + 0x3f56ac7d]
loopne 0x10141820
lahf
pop ss
pop esi
lodsb al, byte [esi]
imul ecx, dword [esi], 0x45
sbb eax, 0xa014e818
test byte [ecx], cl
nop
stosd dword es:[edi], eax
adc byte [edx - 0x64], al
lodsb al, byte [esi]
xchg ebp, eax
push 0x52
pop eax
push eax
inc esi
or eax, 0x14900984
cli
add bl, al
mov cl, 0x30
push 0xffffffffffffffb6
mov dh, 0xc5
mov bh, 0x42
sub byte [ecx - 0x2a70641f], cl
loop 0x1014181c
aad 0xe2
or dword [0xd54e28f7], 0x214e4e95
arpl bp, bp
or eax, 0xd54e28f7
xchg ebp, eax
dec esi
dec esi
and dword [ebx - 0x13], esp
stosd dword es:[edi], eax
sbb byte [edx + 0x22], bh
fstp xword [edi + 0x7066e0cd]
js 0x1014184c
add byte [ecx + ecx - 0x4fc77cf0], 0xc6
add dl, byte [eax - 0x62]
test byte [ecx], cl
nop
js 0x101418a7
push ebx
loopne 0x10141898
bnd jns 0x101418e6
sbb eax, 0xf67b3550
out dx, eax
dec edx
push eax
xor eax, 0x4aeff67b
dec esp
stc
std
or byte [esi], ah
push ebp
daa
scasb al, byte es:[edi]
in al, dx
cmp byte [edx], ch
mov byte [0xda4f25d0], al
xchg ebp, eax
imul ebx
test eax, 0x1ce414a1
in al, 0x1c
sbb al, 0x73
adc eax, 0xf1dce8e
wait
fst dword [edi + 0x11]
xchg esi, eax
dec ebx
adc ebp, edx
mov ds, ebp
push ebx
clc
mov ch, 0xf5
adc ebp, 0x28
push edx
fst qword [ebp - 0x711192dd]
in eax, dx
pop ss
lodsd eax, dword [esi]
int1
add edx, dword [edi]
ja 0x101418ba
or edi, eax
fnstcw word [ebx - 0xa]
out dx, eax
pop ecx
and al, 0x6e
push ds
inc edx
mov cl, 0xd5
push edx
inc eax
mov byte [ecx], bl
jbe 0x1014192c
cld
jnp 0x10141950
push eax
push ebp
jge 0x101418c8
imul eax, eax, 0xffffff88
xor byte [eax - 0xa], 0x84
xchg ebp, eax
ret
lahf
jmp 0x10138de5
Function at 0x10001016
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 8], 1
jne 0x10001036
xor eax, eax
push eax
push eax
push eax
push 0x10001004
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
ret 0xc
Function at 0x10001a14
Capabilities:
Enumerate processes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x10001a69
mov edi, esp
mov esi, eax
mov dword [edi], 0x22c
push edi
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10001a62
mov ebx, dword [esp + 0x244]
mov ebp, dword [esp + 0x240]
push edi
push ebx
call ebp
test al, al
je 0x10001a62
push edi
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10001a4f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x22c
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x10001a76
Capabilities:
Query service status

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
xor edi, edi
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
je 0x10001ad3
mov esi, eax
push 4
push dword [esp + 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x10001aca
mov ebx, eax
mov eax, esp
xor edi, edi
lea ecx, [esp + 4]
push eax
push 0x24
push ecx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
cmp eax, 1
jne 0x10001ac1
mov edi, dword [esp + 0x20]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10001acc
xor edi, edi
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4

Function at 0x10001c51
Capabilities:
Get hostname

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xec
mov edi, dword [esp + 0x100]
mov eax, esp
mov esi, 0x40
lea ebx, [esp + 0x6c]
mov dword [eax], esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x1010940a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ebp, [esp + 4]
push ebp
call sub.ADVAPI32.dll_MD5Init
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push ebx
push ebp
call sub.ADVAPI32.dll_MD5Update
push ebp
call sub.ADVAPI32.dll_MD5Final
lea eax, [esp + 0x5c]
push esi
push ebx
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov esi, eax
lea eax, [esp + 0x6e]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov word [edi + esi*2 - 6], 0
lea eax, [esi - 3]
add esp, 0xec
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10001d78
Capabilities:
Read file via mapping

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x288
xor ebp, ebp
mov esi, ecx
lea eax, [esp + 0x80]
mov dword [ecx], ebp
mov dword [ecx + 4], ebp
push 0x104
push eax
call fcn.10001cd2
add esp, 8
cmp word [esp + eax*2 + 0x7e], 0x5c
je 0x10001db3
mov dword [esp + eax*2 + 0x80], 0x5c
sub esp, 4
lea ebx, [esp + 4]
push ebx
call fcn.10001c51
add esp, 8
push ebx
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
lea ebx, [esp + 0x84]
push ebx
call edi
push str..tmp
push ebx
call edi
push ebp
push 0x80
push 2
push ebp
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x10001e50
push str..tmp
lea edi, [esp + 4]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor ebx, ebx
push edi
push 0x1000
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
je 0x10001e50
push 0x1000
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 4], eax
je 0x10001e50
mov word [eax], 0x7fe
mov eax, dword [esi + 4]
mov word [eax + 2], 0
mov eax, esi
add esp, 0x288
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10001e6e
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x84
mov ebx, dword [esp + 0x94]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea edi, [esp + 4]
push ebx
push eax
push str._g0W
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ecx, dword [esi]
cmp ecx, 0xffffffff
je 0x10001ed3
test eax, eax
je 0x10001eb3
mov edx, eax
xor word [edi], 0xaaaa
add edi, 2
dec edx
jne 0x10001ea8
add eax, eax
mov edx, esp
lea esi, [esp + 4]
push 0
push edx
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x84
pop esi
pop edi
pop ebx
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10001ec7
movzx edx, word [ecx + 2]
movzx ebx, word [ecx]
lea edi, [eax + edx]
cmp edi, ebx
ja 0x10001ec7
test eax, eax
je 0x10001f0f
xor edi, edi
movzx ebx, word [esp + edi*2 + 4]
movzx edx, dx
add edx, edi
inc edi
xor ebx, 0xaaaa
cmp eax, edi
mov word [ecx + edx*2 + 4], bx
mov ecx, dword [esi + 4]
movzx edx, word [ecx + 2]
jne 0x10001eee
add edx, eax
mov word [ecx + 2], dx
jmp 0x10001ec7
Function at 0x1000c3a4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001b2a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000693c
and dword [ebp - 0x14], 0
cmp dword [0x1001d190], 0
mov dword [ebp - 0x18], eax
jne 0x1000c457
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000c4ff
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000c4ff
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1001d190], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1001d194], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1001d198], eax
call edi
push eax
call esi
mov dword [0x1001d1a0], eax
test eax, eax
je 0x1000c457
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1001d19c], eax
mov eax, dword [0x1001d19c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000c4b0
cmp dword [0x1001d1a0], ecx
je 0x1000c4b0
push eax
call esi
push dword [0x1001d1a0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000c4b0
test ebx, ebx
je 0x1000c4b0
call edi
test eax, eax
je 0x1000c4a7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000c4a7
test byte [ebp - 8], 1
jne 0x1000c4b0
or dword [ebp + 0x10], 0x200000
jmp 0x1000c4e3
mov eax, dword [0x1001d194]
cmp eax, dword [ebp - 0x18]
je 0x1000c4e3
push eax
call esi
test eax, eax
je 0x1000c4e3
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000c4e3
mov eax, dword [0x1001d198]
cmp eax, dword [ebp - 0x18]
je 0x1000c4e3
push eax
call esi
test eax, eax
je 0x1000c4e3
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1001d190]
call esi
test eax, eax
je 0x1000c4ff
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000c501
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004388
leave
ret
Function at 0x401012
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x4ba3eb]
shl eax, 2
mov dword [0x4ba3ef], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00496378
pop edx
call fcn.004962dc
call fcn.004963b8
push 0
call fcn.004977f8
pop ecx
push 0x4ba394
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4ba3f3], eax
push 0
jmp fcn.004a0268

Function at 0x40170c
Capabilities:
Acquire debug privileges
Check os version
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff3c
push dword [ebp + 8]
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401887
call sub.KERNEL32.DLL_GetLastError
cmp eax, 5
je 0x40173f
xor eax, eax
jmp 0x4018be
mov dword [ebp - 0xa4], 0x94
lea edx, [ebp - 0xa4]
push edx
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x94], 2
je 0x40176c
push 5
call sub.KERNEL32.DLL_SetLastError
xor eax, eax
jmp 0x4018be
mov dword [ebp - 0xc], 0x10
lea edx, [ebp - 0x10]
push edx
push 0
push 0x28
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.ADVAPI32.DLL_OpenThreadToken
test eax, eax
jne 0x4017b9
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x3f0
je 0x40179d
xor eax, eax
jmp 0x4018be
lea edx, [ebp - 0x10]
push edx
push 0x28
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
test eax, eax
jne 0x4017b9
xor eax, eax
jmp 0x4018be
mov dword [ebp - 0xb4], 1
mov dword [ebp - 0xa8], 2
lea edx, [ebp - 0xb0]
push edx
push str.SeDebugPrivilege
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0xc4]
push eax
push 0x10
lea edx, [ebp - 0xb4]
push edx
push 0
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
test eax, eax
jne 0x401821
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 8], eax
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 8]
call sub.KERNEL32.DLL_SetLastError
xor eax, eax
jmp 0x4018be
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x514
jne 0x401840
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_CloseHandle
push 5
call sub.KERNEL32.DLL_SetLastError
xor eax, eax
jmp 0x4018be
push dword [ebp + 8]
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 8], eax
push 0
push 0
push 0x10
lea edx, [ebp - 0xc4]
push edx
push 0
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 4], 0
jne 0x401887
push 0
call sub.KERNEL32.DLL_SetLastError
xor eax, eax
jmp 0x4018be
push 0xffffffffffffffff
push dword [ebp - 4]
call sub.KERNEL32.DLL_TerminateProcess
test eax, eax
jne 0x4018b1
call sub.KERNEL32.DLL_GetLastError
mov dword [ebp - 8], eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 8]
call sub.KERNEL32.DLL_SetLastError
xor eax, eax
jmp 0x4018be
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4018c4
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
mov eax, 0x5c5520
call fcn.00496be4
mov word [ebp - 0x24], 8
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x38], eax
mov word [ebp - 0x24], 0
jmp 0x4018ff
cmp dword [ebp - 0x38], 0xffffffff
jne 0x401916
xor eax, eax
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
jmp 0x401aef
mov word [ebp - 0x24], 0x14
mov dword [ebp - 0x164], 0x128
mov word [ebp - 0x24], 0
jmp 0x401939
mov word [ebp - 0x24], 0x20
lea ecx, [ebp - 0x164]
push ecx
push dword [ebp - 0x38]
call sub.KERNEL32.DLL_Process32First
mov dword [ebp - 0x3c], eax
mov word [ebp - 0x24], 0
jmp 0x401964
cmp dword [ebp - 0x3c], 0
je 0x401ac2
mov word [ebp - 0x24], 0x2c
mov word [ebp - 0x24], 0x38
lea eax, [ebp - 8]
call fcn.00401af8
push eax
inc dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
call fcn.004a44ec
inc dword [ebp - 0x18]
mov eax, dword [eax]
pop edx
call fcn.0048b7f8
lea eax, [ebp - 8]
call fcn.00401b28
push eax
call sub.USER32.DLL_CharLowerA
push eax
lea eax, [ebp - 0x10]
call fcn.00401af8
push eax
inc dword [ebp - 0x18]
lea edx, [ebp - 0x140]
lea eax, [ebp - 0xc]
call fcn.004a44ec
inc dword [ebp - 0x18]
mov eax, dword [eax]
pop edx
call fcn.0048b7f8
lea eax, [ebp - 0x10]
call fcn.00401b28
push eax
call sub.USER32.DLL_CharLowerA
push eax
call sub.KERNEL32.DLL_lstrcmpA
test eax, eax
sete dl
and edx, 1
push edx
dec dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004a4690
dec dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004a4690
dec dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004a4690
dec dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a4690
pop ecx
test cl, cl
je 0x401a57
mov word [ebp - 0x24], 0x44
push dword [ebp - 0x15c]
call fcn.0040170c
pop ecx
mov word [ebp - 0x24], 0x2c
jmp 0x401a57
mov word [ebp - 0x24], 0
jmp 0x401a6a
mov word [ebp - 0x24], 0x50
mov dword [ebp - 0x164], 0x128
mov word [ebp - 0x24], 0
jmp 0x401a8d
mov word [ebp - 0x24], 0x5c
lea eax, [ebp - 0x164]
push eax
push dword [ebp - 0x38]
call sub.KERNEL32.DLL_Process32Next
mov dword [ebp - 0x3c], eax
mov word [ebp - 0x24], 0
jmp 0x401ab8
cmp dword [ebp - 0x3c], 0
jne 0x40196e
mov word [ebp - 0x24], 0x68
push dword [ebp - 0x38]
call sub.KERNEL32.DLL_CloseHandle
mov word [ebp - 0x24], 0
jmp 0x401ae3
xor eax, eax
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401b48
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
mov eax, 0x5c56e8
call fcn.00496be4
mov word [ebp - 0x24], 8
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x38], eax
mov word [ebp - 0x24], 0
jmp 0x401b83
cmp dword [ebp - 0x38], 0xffffffff
jne 0x401b9a
xor eax, eax
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
jmp 0x401da5
mov word [ebp - 0x24], 0x14
mov dword [ebp - 0x168], 0x128
mov word [ebp - 0x24], 0
jmp 0x401bbd
mov word [ebp - 0x24], 0x20
lea ecx, [ebp - 0x168]
push ecx
push dword [ebp - 0x38]
call sub.KERNEL32.DLL_Process32First
mov dword [ebp - 0x40], eax
mov word [ebp - 0x24], 0
jmp 0x401be8
cmp dword [ebp - 0x40], 0
je 0x401d78
mov word [ebp - 0x24], 0x2c
mov word [ebp - 0x24], 0x38
lea eax, [ebp - 8]
call fcn.00401af8
push eax
inc dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
call fcn.004a44ec
inc dword [ebp - 0x18]
mov eax, dword [eax]
pop edx
call fcn.0048b7f8
lea eax, [ebp - 8]
call fcn.00401b28
push eax
call sub.USER32.DLL_CharLowerA
push eax
lea eax, [ebp - 0x10]
call fcn.00401af8
push eax
inc dword [ebp - 0x18]
lea edx, [ebp - 0x144]
lea eax, [ebp - 0xc]
call fcn.004a44ec
inc dword [ebp - 0x18]
mov eax, dword [eax]
pop edx
call fcn.0048b7f8
lea eax, [ebp - 0x10]
call fcn.00401b28
push eax
call sub.USER32.DLL_CharLowerA
push eax
call sub.KERNEL32.DLL_lstrcmpA
test eax, eax
sete dl
and edx, 1
push edx
dec dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004a4690
dec dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004a4690
dec dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004a4690
dec dword [ebp - 0x18]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a4690
pop ecx
test cl, cl
je 0x401d0d
mov word [ebp - 0x24], 0x44
push dword [ebp - 0x160]
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x3c], eax
mov word [ebp - 0x24], 0x2c
jmp 0x401ce4
cmp dword [ebp - 0x3c], 0
je 0x401d0d
mov word [ebp - 0x24], 0x50
push 0
push dword [ebp - 0x3c]
call sub.KERNEL32.DLL_TerminateProcess
mov word [ebp - 0x24], 0x2c
jmp 0x401d0d
mov word [ebp - 0x24], 0
jmp 0x401d20
mov word [ebp - 0x24], 0x5c
mov dword [ebp - 0x168], 0x128
mov word [ebp - 0x24], 0
jmp 0x401d43
mov word [ebp - 0x24], 0x68
lea eax, [ebp - 0x168]
push eax
push dword [ebp - 0x38]
call sub.KERNEL32.DLL_Process32Next
mov dword [ebp - 0x40], eax
mov word [ebp - 0x24], 0
jmp 0x401d6e
cmp dword [ebp - 0x40], 0
jne 0x401bf2
mov word [ebp - 0x24], 0x74
push dword [ebp - 0x38]
call sub.KERNEL32.DLL_CloseHandle
mov word [ebp - 0x24], 0
jmp 0x401d99
xor eax, eax
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401e08
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe34
push ebx
push esi
push edi
mov eax, 0x5c5798
call fcn.00496be4
mov dword [ebp - 8], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.004a4524
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
mov word [ebp - 0x14], 0x14
lea edx, [ebp - 0x1bc]
push edx
push 0x101
call sub.WSOCK32.DLL_WSAStartup
test eax, eax
je 0x401e77
xor eax, eax
push eax
dec dword [ebp - 8]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004a4690
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x401fa3
lea eax, [ebp + 8]
call fcn.00401b28
push eax
call sub.WSOCK32.DLL_gethostbyname
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x401eb1
xor eax, eax
push eax
dec dword [ebp - 8]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004a4690
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x401fa3
push 0
push 1
push 2
call sub.WSOCK32.DLL_socket
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x401ee8
xor eax, eax
push eax
dec dword [ebp - 8]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004a4690
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x401fa3
mov word [ebp - 0x1cc], 2
push 0x35
call sub.WSOCK32.DLL_htons
mov word [ebp - 0x1ca], ax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx]
mov dword [ebp - 0x1c8], ecx
push 0x10
lea eax, [ebp - 0x1cc]
push eax
push dword [ebp - 0x2c]
call sub.WSOCK32.DLL_connect
test eax, eax
je 0x401f44
xor eax, eax
push eax
dec dword [ebp - 8]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004a4690
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x401fa3
push dword [ebp - 0x2c]
call sub.WSOCK32.DLL_closesocket
call sub.WSOCK32.DLL_WSACleanup
mov al, 1
push eax
dec dword [ebp - 8]
lea eax, [ebp + 8]
mov edx, 2
call fcn.004a4690
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x401fa3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402578
Capabilities:
Create udp socket
Initialize winsock library
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
lea eax, [ebp - 0x194]
push eax
push 0x202
call sub.WSOCK32.DLL_WSAStartup
cmp dword [ebp + 8], 0
jne 0x4025a2
mov eax, 7
jmp 0x40265c
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx + 0x1c], ecx
push 0x11
push 2
push 2
call sub.WSOCK32.DLL_socket
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], eax
test eax, eax
jge 0x4025d3
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 3
mov eax, 3
jmp 0x40265c
push dword [ebp + 0xc]
call sub.WSOCK32.DLL_inet_addr
test eax, eax
je 0x4025ec
push dword [ebp + 0xc]
call sub.WSOCK32.DLL_inet_addr
cmp eax, 0xffffffff
jne 0x40262a
push dword [ebp + 0xc]
call sub.WSOCK32.DLL_gethostbyname
mov dword [ebp - 4], eax
test eax, eax
jne 0x40260c
mov edx, dword [ebp + 8]
mov dword [edx + 0x18], 1
mov eax, 1
jmp 0x40265c
mov edx, dword [ebp - 4]
movsx ecx, word [edx + 0xa]
push ecx
mov eax, dword [ebp + 8]
add eax, 0x24
push eax
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0xc]
push dword [ecx]
call sub.KERNEL32.DLL_lstrcpynA
jmp 0x402638
push dword [ebp + 0xc]
call sub.WSOCK32.DLL_inet_addr
mov edx, dword [ebp + 8]
mov dword [edx + 0x24], eax
mov eax, dword [ebp + 8]
mov word [eax + 0x20], 2
mov cx, word [ebp + 0x10]
push ecx
call sub.WSOCK32.DLL_htons
mov edx, dword [ebp + 8]
mov word [edx + 0x22], ax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x18], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402660
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x402672
mov eax, 7
pop ecx
pop ebp
ret
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx + 0x1c], ecx
call fcn.0049f2b4
xor edx, edx
mov dword [eax], edx
push 0x10
mov eax, dword [ebp + 8]
add eax, 0x20
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push dword [ecx + 0x14]
call sub.WSOCK32.DLL_sendto
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], eax
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 0x18], eax
xor eax, eax
pop ecx
pop ebp
ret

Function at 0x4026b8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
cmp dword [ebp + 8], 0
jne 0x4026cb
mov eax, 7
jmp 0x40271e
mov dword [ebp - 8], 0x10
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx + 0x1c], ecx
push 0x30
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.0049665c
add esp, 0xc
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp + 0xc]
add edx, 0x20
push edx
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push dword [ecx + 0x14]
call sub.WSOCK32.DLL_recvfrom
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], eax
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 0x18], eax
xor eax, eax
pop ecx
pop ecx
pop ebp
ret