joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x457e5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov al, byte [0x46c31c]
mov dx, word [0x45f660]
add al, 0x30
push ebx
mov dword [esp + 0xc], ecx
push ebp
mov cx, word [0x45f65c]
mov byte [esp + 8], al
mov al, byte [0x45f662]
push esi
xor ebx, ebx
push edi
mov byte [esp + 0x11], bl
mov word [esp + 0x12], cx
mov word [esp + 0x14], dx
mov byte [esp + 0x16], al
xor edi, edi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
push 0x45f64c
call fcn.004167c0
mov ebp, eax
add esp, 0xc
cmp byte [ebp], bl
je 0x405f9d
push 0x1f8
call fcn.0043d2eb
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
cmp esi, ebx
mov dword [esp + 0x28], ebx
je 0x405f43
mov dword [esi + 0x18], ebx
lea ecx, [esi + 0x20]
mov dword [esi + 0x1c], ebx
call fcn.004029f0
lea ecx, [esi + 0x28]
call fcn.004029f0
lea ecx, [esi + 0x30]
call fcn.004029f0
mov dword [esi + 0x1ec], ebx
mov dword [esi + 0x1f4], ebx
mov dword [esi], 0x45a49c
jmp 0x405f45
xor esi, esi
push ebp
lea ecx, [esi + 0x68]
mov dword [esp + 0x2c], 0xffffffff
call fcn.00403090
mov ebp, dword [esi]
lea eax, [esp + 0x12]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x45f64c
call fcn.00416b40
add esp, 0xc
mov ecx, esi
push eax
call dword [ebp]
mov ecx, dword [esp + 0x18]
push esi
call fcn.00406c50
mov dl, byte [esp + 0x14]
mov cl, byte [esp + 0x12]
inc edi
inc dl
inc cl
cmp edi, 0xa
mov byte [esp + 0x14], dl
mov byte [esp + 0x12], cl
jl 0x405ed4
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4150b0
Capabilities:
Create process on windows
Hide graphical window
Schedule task via at

Disassembly:
mov eax, dword [0x46c664]
sub esp, 0x10
push esi
push 2
push eax
call dword [sym.imp.user32.dll_ShowWindow]
mov ecx, dword [esp + 0x18]
push 1
push 0
push 0
push ecx
push 0x46049c
push 0
call dword [sym.imp.shell32.dll_ShellExecuteA]
cmp eax, 0x20
sbb esi, esi
neg esi
je 0x415266
mov edx, dword [0x46c608]
mov eax, dword [edx + 4]
mov ecx, dword [eax + 0x46c60c]
cmp dword [ecx + 0x30], 0xffffffff
jne 0x415200
lea edx, [esp + 4]
push edx
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov eax, dword [0x45afe0]
mov ecx, 0x46c608
push eax
push 0xa
push 0x460490
call fcn.0042e296
push 0x460478
push 0x46046c
push 0x460464
push 0x460458
push 0x460430
mov ecx, 0x46c614
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xe]
mov eax, dword [esp + 0xc]
push 0x460478
push ecx
mov ecx, dword [esp + 0xc]
push 0x46042c
push edx
mov edx, dword [esp + 0x16]
push 0x46042c
push eax
mov eax, dword [esp + 0x22]
push 0x460464
push ecx
push 0x46042c
push edx
push 0x46042c
push eax
push 0x46040c
mov ecx, 0x46c614
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
push 0x460408
push esi
push 0x460404
push 0x4603c0
push 0x4603b8
push 0x24
push 0x4603b0
push 0x460388
mov ecx, 0x46c614
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e93e
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e93e
mov ecx, eax
call fcn.0042e6e2
mov ecx, 0x46c614
call fcn.0042e70b
pop esi
add esp, 0x10
ret
Function at 0x417430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x459268
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov eax, dword [0x45afe0]
mov ecx, dword [esp + 0x58]
push esi
push edi
push 1
push eax
push 0xa1
push ecx
lea ecx, [esp + 0x18]
call fcn.0042e1ba
mov edx, dword [esp + 8]
or edi, 0xffffffff
mov dword [esp + 0x58], 0
mov eax, dword [edx + 4]
mov eax, dword [esp + eax + 0xc]
mov ecx, dword [eax + 0x30]
cmp ecx, edi
lea ecx, [esp + 8]
jne 0x4174b4
call fcn.0042e2dd
lea ecx, [esp + 0x1c]
mov dword [esp + 0x58], edi
call fcn.0042e283
lea ecx, [esp + 0x1c]
call fcn.0042e0a1
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
call fcn.0042e027
push 2
push 0
lea ecx, [esp + 0x10]
call fcn.0042dff3
lea ecx, [esp + 8]
call fcn.0042e027
mov esi, eax
lea ecx, [esp + 8]
test esi, esi
jg 0x41750a
call fcn.0042e2dd
lea ecx, [esp + 0x1c]
mov dword [esp + 0x58], edi
call fcn.0042e283
lea ecx, [esp + 0x1c]
call fcn.0042e0a1
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
call fcn.0042e2dd
lea ecx, [esp + 0x1c]
mov dword [esp + 0x58], edi
call fcn.0042e283
lea ecx, [esp + 0x1c]
call fcn.0042e0a1
mov ecx, dword [esp + 0x50]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x54
ret
Function at 0x421c80
Capabilities:
Create thread

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x30]
push 0
push 0x46cf90
push 0
mov dword [0x46cf8c], eax
mov dword [esp + 0x3c], 0
call sub.dsound.dll_DirectSoundCreate
test eax, eax
jne 0x421d24
mov eax, dword [0x46cf90]
mov edx, dword [0x46cf8c]
push 2
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
test eax, eax
jne 0x421d24
mov dword [esp + 0x18], eax
lea edx, [esp + 0x30]
mov dword [esp + 0x1c], eax
push 0
mov dword [esp + 0x24], eax
push edx
mov dword [esp + 0x2c], eax
lea edx, [esp + 0x20]
mov dword [esp + 0x30], eax
mov eax, dword [0x46cf90]
mov dword [esp + 0x20], 0x14
mov dword [esp + 0x24], 1
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x421d24
push 2
lea eax, [esp + 8]
push 0x5622
push eax
call fcn.00421bf0
mov eax, dword [esp + 0x3c]
add esp, 0xc
lea edx, [esp + 4]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x38]
test eax, eax
je 0x421d3b
mov eax, dword [esp + 0x30]
test eax, eax
je 0x421d32
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.00421dd0
add esp, 0x2c
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x421d49
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [0x46cfa4]
test eax, eax
jne 0x421d6f
lea eax, [esp]
push eax
push 0
push 0
push 0x421d80
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [0x46cfa4], eax
add esp, 0x2c
ret
Function at 0x421dd0
Capabilities:
Terminate thread

Disassembly:
sub esp, 0x10
push edi
call fcn.00417150
mov eax, dword [0x46cfa4]
xor edi, edi
cmp eax, edi
je 0x421df9
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateThread]
mov eax, dword [0x46cfa4]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [0x46cf84]
push esi
mov dword [0x46cfa4], edi
lea esi, [ecx - 1]
cmp esi, edi
jl 0x421e26
mov edx, dword [0x46cf80]
mov eax, dword [edx + esi*4]
cmp eax, edi
je 0x421e23
push eax
call fcn.00424a70
add esp, 4
dec esi
jns 0x421e0d
cmp dword [0x46cf94], edi
je 0x421fcc
push edi
push edi
push edi
push 0x461c90
call dword [sym.imp.winmm.dll_mciSendStringA]
mov esi, eax
cmp esi, edi
je 0x421fcc
mov eax, dword [0x46c608]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x46c60c]
cmp dword [edx + 0x30], 0xffffffff
jne 0x421f63
lea eax, [esp + 8]
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov ecx, dword [0x45afe0]
push ecx
push 0xa
push 0x460490
mov ecx, 0x46c608
call fcn.0042e296
push 0x460478
push 0x46046c
push 0x460464
push 0x460458
push 0x460430
mov ecx, 0x46c614
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x12]
mov ecx, dword [esp + 0x10]
push 0x460478
push edx
mov edx, dword [esp + 0x10]
push 0x46042c
push eax
mov eax, dword [esp + 0x1a]
push 0x46042c
push ecx
mov ecx, dword [esp + 0x26]
push 0x460464
push edx
push 0x46042c
push eax
push 0x46042c
push ecx
push 0x46040c
mov ecx, 0x46c614
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
push 0x460408
push esi
push 0x460404
push 0x461c64
push 0x4603b8
push 0x192
push 0x4603b0
push 0x461c3c
mov ecx, 0x46c614
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e93e
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e93e
mov ecx, eax
call fcn.0042e6e2
mov ecx, 0x46c614
call fcn.0042e70b
mov eax, dword [0x46cf90]
mov dword [0x46cf94], edi
cmp eax, edi
pop esi
je 0x421ff6
mov ecx, dword [0x46cf8c]
mov edx, dword [eax]
push 1
push ecx
push eax
call dword [edx + 0x18]
mov eax, dword [0x46cf90]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov dword [0x46cf90], edi
pop edi
add esp, 0x10
ret
Function at 0x428790
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x194
lea eax, [esp + 4]
mov dword [0x46d0dc], 0
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x42888c
mov ax, word [esp + 4]
mov dword [0x46d0dc], 1
cmp al, 2
jne 0x42888c
xor ecx, ecx
mov cl, ah
cmp cl, al
jne 0x42888c
lea edx, [esp]
mov dword [esp], 0x20
push edx
push 0x46d0b4
call dword [sym.imp.kernel32.dll_GetComputerNameA]
test eax, eax
jne 0x42880a
push 0x462104
call fcn.004271e0
add esp, 4
add esp, 0x194
ret
push 0x46d0b4
call sub.wsock32.dll_gethostbyname
mov edx, eax
test edx, edx
jne 0x42882e
push 0x4620ec
call fcn.004271e0
add esp, 4
add esp, 0x194
ret
mov eax, 4
cmp word [edx + 0xa], ax
je 0x42884d
push 0x4620dc
call fcn.004271e0
add esp, 4
add esp, 0x194
ret
mov eax, dword [edx + 0xc]
push edi
xor ecx, ecx
mov edi, 0x46d0d4
mov eax, dword [eax]
pop edi
test eax, eax
je 0x428878
mov ecx, dword [eax]
mov dword [0x46d0d8], 1
mov dword [0x46d0d4], ecx
add esp, 0x194
ret
push 0x4620cc
call fcn.004271e0
add esp, 4
add esp, 0x194
ret
push 0x4620bc
call fcn.004271e0
add esp, 4
add esp, 0x194
ret

Function at 0x4288e0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
push 0
push 1
mov esi, ecx
push 2
call sub.wsock32.dll_socket
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x428918
call fcn.004288d0
push eax
push 0x46213c
call fcn.00417150
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
mov edi, dword [esp + 0x24]
mov word [esp + 0xc], 2
push edi
call sub.wsock32.dll_htons
mov ecx, dword [esi]
mov ebx, dword [esp + 0x20]
mov word [esp + 0xe], ax
lea eax, [esp + 0xc]
push 0x10
push eax
push ecx
mov dword [esp + 0x1c], ebx
call sub.wsock32.dll_connect
test eax, eax
jge 0x42896e
mov ecx, esi
call fcn.00428a40
call fcn.004288d0
push eax
push 0x462128
call fcn.00417150
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0xc
mov edx, dword [esp + 0x28]
mov ecx, esi
push edx
mov dword [esi + 4], ebx
mov dword [esi + 8], edi
call fcn.00428e10
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret 0xc

Function at 0x428990
Capabilities:
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push edi
push 0x11
push 2
mov esi, ecx
push 2
call sub.wsock32.dll_socket
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4289c6
call fcn.004288d0
push eax
push 0x462160
call fcn.00417150
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x10
ret 8
mov eax, dword [esp + 0x20]
mov ecx, esi
push eax
call fcn.00428e10
mov ecx, esi
call fcn.00428e50
mov edi, dword [esp + 0x1c]
mov word [esp + 8], 2
push edi
mov dword [esp + 0x10], 0
call sub.wsock32.dll_htons
mov edx, dword [esi]
lea ecx, [esp + 8]
push 0x10
push ecx
push edx
mov word [esp + 0x16], ax
call sub.wsock32.dll_bind
test eax, eax
je 0x428a27
call fcn.004288d0
push eax
push 0x462150
call fcn.00417150
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x10
ret 8
mov eax, dword [0x46d0d4]
mov dword [esi + 8], edi
mov dword [esi + 4], eax
pop edi
mov eax, 1
pop esi
add esp, 0x10
ret 8
Function at 0x428a60
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push edi
push 0
push 1
mov esi, ecx
push 2
call sub.wsock32.dll_socket
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x428a96
call fcn.004288d0
push eax
push 0x462160
call fcn.00417150
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x10
ret 8
mov eax, dword [esp + 0x20]
mov ecx, esi
push eax
call fcn.00428e10
mov edi, dword [esp + 0x1c]
mov word [esp + 8], 2
push edi
mov dword [esp + 0x10], 0
call sub.wsock32.dll_htons
mov edx, dword [esi]
lea ecx, [esp + 8]
push 0x10
push ecx
push edx
mov word [esp + 0x16], ax
call sub.wsock32.dll_bind
test eax, eax
je 0x428af0
call fcn.004288d0
push eax
push 0x462150
call fcn.00417150
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x10
ret 8
mov eax, dword [esi]
push 5
push eax
call sub.wsock32.dll_listen
cmp eax, 0xffffffff
jne 0x428b1c
call fcn.004288d0
push eax
push 0x462170
call fcn.00417150
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x10
ret 8
mov ecx, dword [0x46d0d4]
mov dword [esi + 8], edi
mov dword [esi + 4], ecx
pop edi
mov eax, 1
pop esi
add esp, 0x10
ret 8

Function at 0x428bb0
Capabilities:
Get socket status

Disassembly:
mov eax, dword [ecx]
sub esp, 0x10c
cmp eax, 0xffffffff
jne 0x428bc8
xor eax, eax
add esp, 0x10c
ret 4
mov ecx, dword [esp + 0x110]
mov dword [esp + 0xc], eax
mov eax, 0x10624dd3
mov dword [esp + 8], 1
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [esp + 8]
mov dword [esp + 4], edx
lea edx, [esp]
push edx
push eax
push 0
push 0
push 0
call sub.wsock32.dll_select
cmp eax, 0xffffffff
jne 0x428c36
call fcn.004288d0
push eax
push 0x462190
call fcn.00417150
add esp, 8
xor eax, eax
add esp, 0x10c
ret 4
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add esp, 0x10c
ret 4

Function at 0x428c50
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push 0
mov ecx, dword [esp + 0xc]
push eax
mov edx, dword [esi]
push ecx
push edx
call sub.wsock32.dll_send
cmp eax, 0xffffffff
jne 0x428c99
call fcn.004288d0
cmp eax, 0x2733
jne 0x428c7e
xor eax, eax
pop esi
ret 8
mov ecx, dword [esi + 0xc]
push eax
inc ecx
push 0x4621a0
mov dword [esi + 0xc], ecx
call fcn.00417150
add esp, 8
xor eax, eax
pop esi
ret 8
mov dword [esi + 0xc], 0
pop esi
ret 8

Function at 0x428cb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
push 0
mov ecx, dword [esp + 0xc]
push eax
mov edx, dword [esi]
push ecx
push edx
call sub.wsock32.dll_recv
cmp eax, 0xffffffff
jne 0x428cf9
call fcn.004288d0
cmp eax, 0x2733
jne 0x428cde
xor eax, eax
pop esi
ret 8
mov ecx, dword [esi + 0xc]
push eax
inc ecx
push 0x4621b0
mov dword [esi + 0xc], ecx
call fcn.00417150
add esp, 8
xor eax, eax
pop esi
ret 8
mov dword [esi + 0xc], 0
pop esi
ret 8
Function at 0x428d10
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x1c]
push esi
mov esi, ecx
mov word [esp + 4], 2
mov dword [esp + 8], eax
mov cx, word [esi + 8]
push ecx
call sub.wsock32.dll_htons
mov ecx, dword [esp + 0x18]
lea edx, [esp + 4]
mov word [esp + 6], ax
mov eax, dword [esp + 0x1c]
push 0x10
push edx
mov edx, dword [esi]
push 0
push eax
push ecx
push edx
call sub.wsock32.dll_sendto
cmp eax, 0xffffffff
jne 0x428d87
call fcn.004288d0
cmp eax, 0x2733
jne 0x428d69
xor eax, eax
pop esi
add esp, 0x10
ret 0xc
mov ecx, dword [esi + 0xc]
push eax
inc ecx
push 0x4621c0
mov dword [esi + 0xc], ecx
call fcn.00417150
add esp, 8
xor eax, eax
pop esi
add esp, 0x10
ret 0xc
mov dword [esi + 0xc], 0
pop esi
add esp, 0x10
ret 0xc

Function at 0x428da0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
mov edx, dword [esp + 0x10]
push esi
mov esi, ecx
lea eax, [esp + 4]
mov ecx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esi]
push eax
push ecx
push edx
mov dword [esp + 0x1c], 0x10
call sub.wsock32.dll_recvfrom
cmp eax, 0xffffffff
jne 0x428e01
call fcn.004288d0
cmp eax, 0x2733
jne 0x428de5
xor eax, eax
pop esi
pop ecx
ret 0x10
mov ecx, dword [esi + 0xc]
push eax
inc ecx
push 0x4621d0
mov dword [esi + 0xc], ecx
call fcn.00417150
add esp, 8
xor eax, eax
pop esi
pop ecx
ret 0x10
mov dword [esi + 0xc], 0
pop esi
pop ecx
ret 0x10

Function at 0x428e10
Capabilities:
Set socket configuration

Disassembly:
mov ecx, dword [ecx]
lea eax, [esp + 4]
push eax
push 0x8004667e
push ecx
call sub.wsock32.dll_ioctlsocket
test eax, eax
je 0x428e3e
call fcn.004288d0
push eax
push 0x4621e4
call fcn.00417150
add esp, 8
xor eax, eax
ret 4
mov eax, 1
ret 4

Function at 0x428e50
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [ecx]
lea eax, [esp]
push 4
push eax
push 0x20
push 0xffff
push ecx
mov dword [esp + 0x14], 1
call sub.wsock32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x428e87
call fcn.004288d0
push eax
push 0x4621f8
call fcn.00417150
add esp, 8
pop ecx
ret
Function at 0x42cb90
Capabilities:
Create process on windows
Schedule task via at

Disassembly:
mov eax, dword [0x46eaf0]
sub esp, 0x10
push esi
push eax
call fcn.0042ca80
add esp, 4
call fcn.0042dd40
test eax, eax
jne 0x42cd6d
push eax
push 0x4623b4
call fcn.0043e580
add esp, 8
test eax, eax
jl 0x42cd6d
push 3
push 0
push 0
push 0x4623b4
push 0x46049c
push 0
call dword [sym.imp.shell32.dll_ShellExecuteA]
cmp eax, 0x20
sbb esi, esi
neg esi
je 0x42cd6d
mov ecx, dword [0x46c608]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0x46c60c]
cmp dword [eax + 0x30], 0xffffffff
jne 0x42cd04
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.kernel32.dll_GetLocalTime]
mov edx, dword [0x45afe0]
mov ecx, 0x46c608
push edx
push 0xa
push 0x460490
call fcn.0042e296
push 0x460478
push 0x46232c
push 0x460464
push 0x460458
push 0x460430
mov ecx, 0x46c614
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xe]
mov edx, dword [esp + 0xc]
push 0x460478
push eax
mov eax, dword [esp + 0xc]
push 0x46042c
push ecx
mov ecx, dword [esp + 0x16]
push 0x46042c
push edx
mov edx, dword [esp + 0x22]
push 0x460464
push eax
push 0x46042c
push ecx
push 0x46042c
push edx
push 0x46040c
mov ecx, 0x46c614
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e9ef
mov ecx, eax
call fcn.0042e6e2
push 0x460408
push esi
push 0x460404
push 0x462360
push 0x4603b8
push 0x9e
push 0x4603b0
push 0x46227c
mov ecx, 0x46c614
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e93e
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e6e2
mov ecx, eax
call fcn.0042e93e
mov ecx, eax
call fcn.0042e6e2
mov ecx, 0x46c614
call fcn.0042e70b
pop esi
add esp, 0x10
ret

Function at 0x42ce50
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x4623c4
push 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
mov eax, dword [esp]
test eax, eax
je 0x42ce9f
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 3
push 0
push ecx
push eax
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov eax, dword [esp]
test eax, eax
je 0x42ce9f
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop ecx
ret
Function at 0x42ceb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
push edi
push eax
push 0x4623c4
push 0x80000002
mov dword [esp + 0x14], 0
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x10], eax
jne 0x42cf42
mov eax, dword [esp + 8]
test eax, eax
je 0x42cf51
mov esi, dword [esp + 0x20]
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push 0
push edx
push 0
push esi
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call edi
test eax, eax
jne 0x42cf42
cmp dword [esp + 0x10], 3
jne 0x42cf42
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jg 0x42cf42
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push esi
push ecx
call edi
mov eax, dword [esp + 8]
test eax, eax
je 0x42cf51
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
add esp, 0xc
ret

Function at 0x42dc20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push ebx
push ebp
push eax
push 0x4623c4
push 0x80000002
xor ebx, ebx
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
test eax, eax
mov byte [ebp], bl
je 0x42dce3
lea ecx, [esp + 8]
push esi
mov esi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push 0x462520
push eax
call esi
test eax, eax
jne 0x42dcc6
mov eax, dword [esp + 0xc]
push eax
call fcn.0043d2eb
add esp, 4
lea ecx, [esp + 0xc]
mov ebx, eax
mov eax, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push 0
push 0x462520
push eax
call esi
test eax, eax
jne 0x42dcc6
mov eax, dword [esp + 0xc]
cmp eax, 0x16
jbe 0x42dcac
mov eax, 0x16
mov dword [esp + 0xc], eax
mov ecx, eax
push edi
mov edx, ecx
mov esi, ebx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [eax + ebp], 0
pop edi
mov eax, dword [esp + 0x10]
pop esi
test eax, eax
je 0x42dcd6
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
test ebx, ebx
je 0x42dce3
push ebx
call fcn.0043d377
add esp, 4
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x42dcf0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x42dd3c
lea eax, [esp + 8]
push edi
push eax
push 0x4623c4
push 0x80000002
call dword [sym.imp.advapi32.dll_RegCreateKeyA]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x10]
push esi
push 1
push eax
push 0x462520
push ecx
call dword [sym.imp.advapi32.dll_RegSetValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
pop edi
pop esi
ret
Function at 0x431330
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x431360
push esi
call fcn.00432d80
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x431359
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4313d6
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x4313cb
mov eax, dword [esi + 8]
test eax, eax
je 0x431384
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4313fe
cmp eax, 2
je 0x4313cb
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x431377
cmp eax, 3
je 0x4313aa
cmp eax, 1
jne 0x431377
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x431377
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x431377
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x4313f6
cmp eax, 0xcc
je 0x4313f6
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
mov edx, dword [esi + 0x18]
cmp dword [edx], 0
jne 0x431402
xor al, al
pop esi
ret
push esi
call fcn.00431410
add esp, 4
pop esi
ret