joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41be30
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438bb0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x44a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
call fcn.00406c60
mov ecx, eax
test ecx, ecx
jne 0x41be77
push 0x80004005
call fcn.00406fc0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
mov ecx, 1
mov dword [ebp - 0x18], 0x10
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x10
or eax, ecx
jge 0x41beac
push 0x10
lea ecx, [ebp - 0x10]
call fcn.004079c0
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push dword [esi - 8]
push esi
call fcn.0042a1ae
add esp, 8
test eax, eax
js 0x41bfdd
cmp eax, dword [esi - 8]
jg 0x41bfdd
xor ecx, ecx
mov dword [esi - 0xc], eax
push ecx
mov word [esi + eax*2], cx
lea ebx, [esi - 0x10]
mov edi, esp
mov dword [ebp - 0x20], esp
mov ecx, ebx
mov dword [ebp - 0x24], edi
call fcn.00407960
add eax, 0x10
mov dword [edi], eax
push ecx
mov byte [ebp - 4], 2
mov esi, esp
mov dword [ebp - 0x28], esi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov dword [ebp - 0x24], esp
call fcn.00407960
add eax, 0x10
mov dword [esi], eax
mov edi, dword [ebp - 0x1c]
push ecx
push esp
mov byte [ebp - 4], 3
lea ecx, [edi + 0x7c]
call fcn.0040fd20
mov edx, 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00417080
add esp, 8
mov byte [ebp - 4], 4
mov esi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x24], esi
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00407960
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 5
push str.https:__api.prntscr.com_v1.1_
call fcn.004075c0
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.00412e80
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov edx, dword [ebp - 0x14]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41bf90
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x41bfa8
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x41bfc7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00406fc0
int3
Function at 0x41e0e0
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439078
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x44a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor edx, edx
lea ecx, [ebp - 0x14]
call fcn.0040d8f0
mov dword [ebp - 4], 0
or ebx, 0xffffffff
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jne 0x41e12e
xor esi, esi
jmp 0x41e1e3
push str.Lightshot.dll
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.004073f0
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41e1c7
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x64], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esi + 0x64]
test eax, eax
je 0x41e1c7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MakeScreenshot
push eax
call edi
mov dword [esi + 0x70], eax
test eax, eax
je 0x41e1c7
push str.MakeScreenshotByCommand
push dword [esi + 0x64]
call edi
mov dword [esi + 0x74], eax
test eax, eax
je 0x41e1c7
push str.SetTranslations
push dword [esi + 0x64]
call edi
mov dword [esi + 0x78], eax
test eax, eax
je 0x41e1c7
push str.InitLightshot
push dword [esi + 0x64]
call edi
mov dword [esi + 0x68], eax
test eax, eax
je 0x41e1c7
push str.DeinitLightshot
push dword [esi + 0x64]
call edi
mov dword [esi + 0x6c], eax
test eax, eax
je 0x41e1c7
mov esi, 1
jmp 0x41e1c9
xor esi, esi
mov edx, dword [ebp - 0x10]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41e1e3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41e202
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e7c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43918c
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x44a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp byte [0x44c431], 0
jne 0x41e9ab
push ecx
mov ecx, esp
mov byte [0x44c431], 1
push str.Signin_try
call fcn.004075c0
lea ecx, [ebx + 0x1f8]
call fcn.004084e0
lea ecx, [ebp - 0x1a4]
call fcn.0040e040
push str.https:__prntscr.com_
lea ecx, [ebp - 0x1b0]
mov dword [ebp - 4], 0
call fcn.004075c0
push str.app_attach_app.php_id
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1ac]
call fcn.004073f0
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], 2
push ecx
mov edx, eax
lea ecx, [ebp - 0x1a8]
call fcn.004074c0
add esp, 8
mov byte [ebp - 4], 4
or edi, 0xffffffff
mov edx, dword [ebp - 0x1ac]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41e893
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
mov eax, edi
mov edx, dword [ebp - 0x1b0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41e8b4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
push 0
push 0
push dword [ebp - 0x1a8]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ecx
mov ecx, dword [ebp - 0x1a4]
mov esi, esp
mov dword [ebp - 0x1b4], esi
lea ecx, [ecx - 0x10]
call fcn.00407960
add eax, 0x10
lea ecx, [ebp - 0x1a0]
mov dword [esi], eax
call fcn.0041c9b0
mov eax, dword [ebp - 0x18c]
mov esi, dword [ebx + 4]
test eax, eax
jne 0x41e91d
call fcn.00421717
mov dword [ebp - 0x18c], eax
test eax, eax
jne 0x41e91d
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
or esi, 0xffffffff
jmp 0x41e952
push 0
push 0
push eax
call fcn.00421816
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x198]
push eax
call fcn.004135a0
push 0
push 0x41f7e0
push esi
push 0x6e
push dword [0x44b9b8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov esi, eax
lea ecx, [ebp - 0x1a0]
mov byte [0x44c431], 0
call fcn.0041cb80
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x1a8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41e985
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1a4]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x41e9a7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
jmp 0x41e9b0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00420347
mov esp, ebp
pop ebp
ret
Function at 0x41ee00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439298
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x44a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
push 1
push 0
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x43f0f8
mov dword [eax], 1
call fcn.004075c0
push ecx
mov dword [ebp - 4], 0
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x43f0f8
call fcn.004075c0
push ecx
mov ecx, esp
mov byte [ebp - 4], 1
push str.userid
call fcn.004075c0
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.0040c0d0
add esp, 0xc
mov esi, eax
push str.https:__prntscr.com_
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 2
call fcn.004075c0
push str.gallery.htmlid
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
call fcn.004073f0
push esi
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp + 0x14]
call fcn.004074c0
add esp, 8
push dword [eax]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp + 0x14]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41eee6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov eax, esi
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41ef04
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov eax, esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41ef22
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x41ef41
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41f050
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x84], 0
je 0x41f116
mov eax, dword [esi + 0x7c]
push edi
lea edi, [esi + 0x7c]
cmp dword [eax - 0xc], 0
je 0x41f0c3
push edi
mov edx, str._select_
lea ecx, [ebp - 4]
call fcn.00407320
add esp, 4
push 1
push 0
push dword [eax]
push str.explorer
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 4]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41f0b5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push 0x43f0f8
mov ecx, edi
call fcn.00407bc0
mov eax, dword [esi + 0x80]
cmp dword [eax - 0xc], 0
je 0x41f0f5
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0x43f0f8
lea ecx, [esi + 0x80]
call fcn.00407bc0
cmp byte [esi + 0x23c], 0
pop edi
je 0x41f10f
push 0
mov ecx, esi
call fcn.0041f1b0
mov byte [esi + 0x23c], 0
mov byte [esi + 0x84], 0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41f3a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439318
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x44a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x440a6c
lea ecx, [ebp - 0x14]
call fcn.004075c0
push str.help.html
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004073f0
mov dword [ebp - 4], 0xffffffff
or esi, 0xffffffff
mov edx, dword [ebp - 0x14]
add esp, 4
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41f410
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
push 0
push 0
push dword [ebp - 0x10]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x41f43e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404dd8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x404de7
pop dword [ebp - 0x44]
mov eax, 0xf470a8ea
add eax, 0xbcfa4fd
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xfc941f31
sub dword [ebp - 0x54], 0xae41d9e6
mov dword [ebp - 0x50], 0xb0d459d8
sub dword [ebp - 0x50], 0x7ea10d93
mov dword [ebp - 0x4c], 0xc36dc333
sub dword [ebp - 0x4c], 0x77217f05
mov dword [ebp - 0x48], 0x97de5833
sub dword [ebp - 0x48], 0x97de5833
lea eax, [ebp - 0x54]
push eax
mov eax, 0x4a546c2f
sub eax, 0x4a123bbb
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x44f5b62a
add dword [ebp - 0x54], 0x2f7cb32c
mov dword [ebp - 0x50], 0x1f22c847
sub dword [ebp - 0x50], 0xddb666d2
mov dword [ebp - 0x4c], 0xd484a3e6
add dword [ebp - 0x4c], 0x8eeac886
mov dword [ebp - 0x48], 0xfcf59cf
sub dword [ebp - 0x48], 0xfcf59cf
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x2505812c
sub eax, 0x24c35008
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3c7f9
push 0
call eax
mov ecx, 0x4307
mov esi, eax
mov edx, 0x434400
add edx, dword [ebp - 0x44]
mov edi, 0x33783ed7
add edi, 0x8850bebc
xor dword [ebp - 0x40], 0xdcd6e12a
mov ebx, dword [edx]
xor dword [ebp - 0xc], 0x2d6a047
xor ebx, edi
add dword [ebp - 0x20], 0xf6cc7cb4
mov dword [esi], ebx
add esi, 4
add edx, 0xdf1a4c71
add edx, 0x20e5b393
loop 0x404efd
add eax, 0xfeef
xor ebx, ebx
add ebx, eax
add eax, 0x3b1f4c55
sub eax, 0x3b1f4c50
mov ecx, 0x2b580762
sub ecx, 0x2b180762
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x48a35c]
shl eax, 2
mov dword [0x48a360], eax
push edi
push ecx
xor eax, eax
mov edi, 0x49a7fc
mov ecx, 0x49fc4c
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00468f5c
pop edx
call fcn.00468ec0
call fcn.00468f9c
push 0
call fcn.0046a294
pop ecx
push 0x48a324
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x48a364], eax
push 0
jmp fcn.004703e4

Function at 0x40179c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
lea eax, [ebp - 4]
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 0x14]
push eax
push 8
push 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov ebx, eax
test eax, eax
je 0x4017d0
or eax, 0xffffffff
jmp 0x401896
mov dword [ebp - 8], 0x80
lea edx, [ebp - 0x10]
lea ecx, [ebp - 8]
push edx
push 0
push 0
push 0
push ecx
lea eax, [ebp - 0x94]
push eax
push esi
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x401862
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x94]
push eax
push 0x40000
push 0
push edx
mov ecx, dword [ebp - 4]
inc esi
push eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov ebx, eax
test eax, eax
je 0x40182c
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
or eax, 0xffffffff
jmp 0x401896
mov edx, dword [ebp + 0x10]
push edx
push 4
mov ecx, dword [ebp - 0x14]
push ecx
call dword [0x49a89c]
mov ebx, eax
test eax, eax
je 0x401859
mov edx, dword [ebp - 0x14]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
or eax, 0xffffffff
jmp 0x401896
mov edx, dword [ebp - 0x14]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
test ebx, ebx
je 0x4017d0
cmp ebx, 0x103
je 0x401880
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
or eax, 0xffffffff
jmp 0x401896
test edi, edi
jne 0x40188f
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x401894
mov ecx, dword [ebp - 4]
mov dword [edi], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4024c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff70
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0x80
lea eax, [ebp - 0xc]
lea edx, [ebp - 4]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x90]
push ecx
push esi
push edi
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x40255e
inc esi
lea eax, [ebp - 0x10]
push eax
push 1
push 0
lea edx, [ebp - 0x90]
push edx
push edi
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov ebx, eax
test eax, eax
je 0x402521
push edi
call sub.ADVAPI32.DLL_RegCloseKey
or eax, 0xffffffff
jmp 0x40257b
lea edx, [ebp - 0x90]
push edx
call fcn.00408c3c
pop ecx
test eax, eax
je 0x402555
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0040211c
add esp, 0xc
test eax, eax
je 0x402555
mov edx, dword [ebp - 0x10]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
or eax, 0xffffffff
jmp 0x40257b
mov edx, dword [ebp - 0x10]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
test ebx, ebx
je 0x4024d1
cmp ebx, 0x103
je 0x402579
push edi
call sub.ADVAPI32.DLL_RegCloseKey
or eax, 0xffffffff
jmp 0x40257b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403c10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 0xc]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
mov dword [ebx + 0x8384], esi
cmp esi, 0xffffffff
jne 0x403c45
or eax, 0xffffffff
jmp 0x403cd7
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov edx, dword [ebp + 0x10]
push edx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
mov dword [ebx + 0x8388], esi
cmp esi, 0xffffffff
jne 0x403c7e
mov eax, dword [ebx + 0x8384]
push eax
call sub.KERNEL32.DLL_CloseHandle
or eax, 0xffffffff
jmp 0x403cd7
mov word [ebx + 0x8376], 0
mov byte [ebx + 0x8378], 0
mov word [ebx + 0x837a], 0
mov byte [ebx + 0x837c], 0
push 0
mov edx, dword [ebx + 0x8384]
push edx
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebx], eax
xor ecx, ecx
mov dword [ebx + 0x83a4], ecx
push ebx
call fcn.004036e8
pop ecx
mov eax, dword [ebx + 0x8388]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov edx, dword [ebx + 0x8384]
push edx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x403e6c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov eax, 0x48d3ac
push ebx
call fcn.004696b8
mov dword [ebp - 8], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.00474b80
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
mov word [ebp - 0x34], 2
mov dx, word [ebp + 0xc]
push edx
call sub.WSOCK32.DLL_htons
mov word [ebp - 0x32], ax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x403eb8
mov eax, dword [ebp + 8]
jmp 0x403ebd
mov eax, 0x48b5f0
push eax
call sub.WSOCK32.DLL_inet_addr
cmp eax, 0xffffffff
jne 0x403eef
mov edx, dword [ebp + 8]
test edx, edx
je 0x403ed4
mov ecx, dword [ebp + 8]
jmp 0x403ed9
mov ecx, 0x48b5f1
push ecx
call sub.WSOCK32.DLL_gethostbyname
test eax, eax
je 0x403f0e
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov edx, dword [eax]
mov dword [ebp - 0x30], edx
jmp 0x403f0e
mov eax, dword [ebp + 8]
test eax, eax
je 0x403efb
mov edx, dword [ebp + 8]
jmp 0x403f00
mov edx, 0x48b5f2
push edx
call sub.WSOCK32.DLL_inet_addr
cmp eax, 0xffffffff
je 0x403f0e
mov dword [ebp - 0x30], eax
push 0
push 1
push 2
call sub.WSOCK32.DLL_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x403f3f
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x403f8a
push 0x10
lea ecx, [ebp - 0x34]
push ecx
push ebx
call sub.WSOCK32.DLL_connect
inc eax
jne 0x403f6d
xor eax, eax
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x403f8a
mov eax, ebx
mov edx, 2
push eax
lea eax, [ebp + 8]
dec dword [ebp - 8]
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403f90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x48d3d0
call fcn.004696b8
mov dword [ebp - 8], 1
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.00474b80
inc dword [ebp - 8]
lea eax, [ebp + 0xc]
mov word [ebp - 0x14], 8
push 0
call fcn.00474e58
push eax
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x403fd2
mov ecx, dword [ebp + 0xc]
jmp 0x403fd7
mov ecx, 0x48b5f3
push ecx
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.DLL_send
push eax
dec dword [ebp - 8]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.00474d44
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret

Function at 0x4040c8
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0
push 1
push 2
call sub.WSOCK32.DLL_socket
mov esi, eax
test eax, eax
jge 0x4040e9
xor eax, eax
jmp 0x40413e
mov word [ebx], 0x722
jmp 0x404118
mov word [ebp - 0x10], 2
push edi
call sub.WSOCK32.DLL_htons
mov word [ebp - 0xe], ax
xor edx, edx
mov dword [ebp - 0xc], edx
lea ecx, [ebp - 0x10]
push 0x10
push ecx
push esi
call sub.WSOCK32.DLL_bind
test eax, eax
je 0x404122
inc word [ebx]
mov di, word [ebx]
cmp di, 0x7fff
jbe 0x4040f0
test esi, esi
jne 0x40412a
xor eax, eax
jmp 0x40413e
push 1
mov ebx, esi
push ebx
call sub.WSOCK32.DLL_listen
test eax, eax
je 0x40413c
xor eax, eax
jmp 0x40413e
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret