joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fdec
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x44fdf5
mov eax, dword [ebp - 4]
add esp, 4
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x44ff6f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [edx + 0xa], 0
jbe 0x44fe28
mov byte [ebx + 0xb4], 0
jmp 0x44fe2f
mov byte [ebx + 0xb4], 1
mov eax, dword [edx]
sub eax, 0x465
je 0x44fe52
dec eax
je 0x44ff29
dec eax
je 0x44ff55
dec eax
je 0x44ff5e
jmp 0x44ff65
movzx eax, word [edx + 8]
cmp eax, 8
jg 0x44fe74
je 0x44ff11
dec eax
je 0x44feff
dec eax
je 0x44ff08
jmp 0x44ff65
sub eax, 0x10
je 0x44fe83
sub eax, 0x10
je 0x44feaf
jmp 0x44ff65
cmp byte [ebx + 0xb4], 0
je 0x44ff65
mov byte [ebx + 0x2a0], 1
cmp word [ebx + 0x3a], 0
je 0x44ff65
mov edx, ebx
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
jmp 0x44ff65
push 0
push 0x3fff
lea eax, [ebp - 0x4000]
push eax
movzx eax, word [ebx + 0x294]
push eax
call sub.wsock32.dll_recv
mov esi, eax
test esi, esi
jle 0x44fee3
lea edx, [ebp - 0x4000]
mov eax, dword [ebx + 0x29c]
mov ecx, esi
call fcn.00412f64
dec esi
jl 0x44feef
cmp byte [ebx + 0x84], 0
je 0x44feaf
mov byte [ebx + 0x2a0], 0
mov eax, ebx
call fcn.00450418
jmp 0x44ff65
mov eax, ebx
call fcn.0044ff80
jmp 0x44ff65
mov eax, ebx
call fcn.004501b4
jmp 0x44ff65
mov byte [ebx + 0x2a0], 1
cmp word [ebx + 0x32], 0
je 0x44ff65
mov edx, ebx
mov eax, dword [ebx + 0x34]
call dword [ebx + 0x30]
jmp 0x44ff65
mov byte [ebx + 0xd4], 1
cmp word [edx + 8], 8
jne 0x44ff65
mov byte [ebx + 0x2a0], 1
test byte [ebx + 0x20], 8
jne 0x44ff65
cmp word [ebx + 0x42], 0
je 0x44ff65
mov edx, ebx
mov eax, dword [ebx + 0x44]
call dword [ebx + 0x40]
jmp 0x44ff65
mov eax, ebx
call fcn.004501b4
jmp 0x44ff65
mov eax, ebx
call fcn.0044ff80
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44ff79
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ff80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x44ff89
mov eax, dword [ebp - 4]
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x4010], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4501a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x84], 0
je 0x450004
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x294]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov eax, dword [ebp - 4]
cmp word [eax + 0x28e], 0
je 0x450004
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x290]
call dword [ebx + 0x28c]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x79], 0
jne 0x450185
xor eax, eax
push ebp
push 0x45017e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x79], 1
lea edx, [ebp - 0x4010]
mov eax, dword [0x48281c]
call fcn.00405da0
mov ecx, dword [ebp - 0x4010]
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.004505d0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x29c]
mov eax, ebx
call fcn.00412eb0
mov edx, eax
mov eax, ebx
call fcn.00412ea4
push 0
push 0x3fff
lea eax, [ebp - 0x4009]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x294]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4500f3
lea edx, [ebp - 0x4009]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x29c]
mov ecx, ebx
call fcn.00412f64
mov eax, dword [ebp - 4]
cmp byte [eax + 0x78], 0
je 0x4500cb
mov eax, dword [ebp - 4]
add dword [eax + 0xc0], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0xc6], 0
je 0x4500cb
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xc8]
call dword [esi + 0xc4]
mov byte [ebp - 9], 1
cmp ebx, 0x3fff
jne 0x45014d
mov eax, dword [ebp - 4]
push eax
push 0
push 0x468
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
push eax
call sub.user32.dll_PostMessageA
jmp 0x45014d
call sub.wsock32.dll_WSAGetLastError
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x88], ebx
lea ecx, [ebp - 8]
mov edx, ebx
cmp edx, 0xffff
jbe 0x450115
call fcn.00402dbc
mov eax, dword [ebp - 4]
call fcn.0044f884
mov eax, dword [ebp - 4]
cmp word [eax + 0x4a], 0
je 0x45014d
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
cmp ecx, 0xffff
jbe 0x450141
call fcn.00402dbc
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x4c]
call dword [ebx + 0x48]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450185
mov eax, dword [ebp - 4]
mov byte [eax + 0x79], 0
cmp byte [ebp - 9], 0
je 0x45017d
mov eax, dword [ebp - 4]
cmp word [eax + 0x2a], 0
je 0x45017d
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2c]
call dword [ebx + 0x28]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4501ad
lea eax, [ebp - 0x4010]
call fcn.00403af4
lea eax, [ebp - 8]
call fcn.00403af4
ret
Function at 0x4501b4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x4501bd
mov eax, dword [ebp - 4]
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x4004], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x450409
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x79], 0
jne 0x4503f0
mov byte [ebx + 0x79], 1
lea edx, [ebp - 0x4004]
mov eax, dword [0x482c80]
call fcn.00405da0
mov ecx, dword [ebp - 0x4004]
mov dl, 8
mov eax, ebx
call fcn.004505d0
cmp byte [ebx + 0x288], 0
je 0x450237
mov eax, dword [ebx + 0xa8]
call fcn.00412e94
mov esi, eax
mov eax, dword [ebx + 0xa8]
call fcn.00412eb0
cmp esi, eax
jl 0x450257
cmp byte [ebx + 0x288], 0
jne 0x4503ec
mov eax, dword [ebx + 0xa8]
call fcn.00412eb0
test eax, eax
je 0x4503ec
cmp byte [ebx + 0x84], 0
jne 0x4503ec
cmp byte [ebx + 0x288], 0
jne 0x45027c
xor edx, edx
mov eax, dword [ebx + 0xa8]
call fcn.00412ea4
jmp 0x45028d
mov edx, dword [ebx + 0x80]
mov eax, dword [ebx + 0xa8]
call fcn.00412ea4
lea edx, [ebp - 0x4000]
mov ecx, 0x3fff
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax]
call dword [esi + 4]
mov edi, eax
push 0
push edi
lea eax, [ebp - 0x4000]
push eax
movzx eax, word [ebx + 0x294]
push eax
call sub.wsock32.dll_send
mov esi, eax
cmp esi, 0xffffffff
jle 0x4503d0
mov eax, dword [ebx + 0xa8]
call fcn.00412e94
sub eax, edi
add eax, esi
push eax
mov eax, dword [ebx + 0xa8]
call fcn.00412eb0
pop edx
cmp edx, eax
jl 0x450307
cmp byte [ebx + 0x288], 0
jne 0x4502fb
mov eax, dword [ebx + 0xa8]
call fcn.004132f4
mov byte [ebx + 0x286], 1
jmp 0x4503aa
cmp byte [ebx + 0x288], 0
jne 0x45037a
mov eax, dword [ebx + 0xac]
call fcn.004132f4
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.00412ea4
mov edi, dword [ebx + 0xa8]
mov eax, edi
call fcn.00412eb0
mov ecx, eax
sub ecx, esi
mov edx, edi
mov eax, dword [ebx + 0xac]
call fcn.00412fe0
mov eax, dword [ebx + 0xa8]
call fcn.004132f4
mov eax, dword [ebx + 0xac]
mov edx, dword [ebx + 0xa8]
mov dword [ebx + 0xac], edx
mov edx, eax
mov dword [ebx + 0xa8], edx
mov eax, edx
xor edx, edx
call fcn.00412ea4
mov byte [ebx + 0x79], 0
jmp 0x450396
mov eax, dword [ebx + 0xa8]
call fcn.00412e94
mov edx, eax
sub edx, edi
add edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.00412ea4
push ebx
push 0
push 0x467
mov eax, dword [ebx + 0x298]
push eax
call sub.user32.dll_PostMessageA
add dword [ebx + 0x80], esi
cmp byte [ebx + 0x78], 0
je 0x4503ec
cmp word [ebx + 0xce], 0
je 0x4503ec
mov edx, ebx
mov eax, dword [ebx + 0xd0]
call dword [ebx + 0xcc]
jmp 0x4503ec
call sub.wsock32.dll_WSAGetLastError
mov dword [ebx + 0x88], eax
xor edx, edx
mov eax, dword [ebx + 0xa8]
call fcn.00412ea4
mov byte [ebx + 0x79], 0
mov byte [ebx + 0x79], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450410
lea eax, [ebp - 0x4004]
call fcn.00403af4
ret
Function at 0x450418
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4504e6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [0x482b1c]
call fcn.00405da0
mov ecx, dword [ebp - 4]
mov dl, 4
mov eax, ebx
call fcn.004505d0
mov byte [ebx + 0x2a0], 0
mov si, word [ebx + 0x294]
cmp si, 0xffff
je 0x4504d0
movzx eax, si
push eax
call sub.wsock32.dll_closesocket
test eax, eax
jne 0x4504c2
test byte [ebx + 0x20], 8
jne 0x45047f
cmp word [ebx + 0x42], 0
je 0x45047f
mov edx, ebx
mov eax, dword [ebx + 0x44]
call dword [ebx + 0x40]
cmp byte [ebx + 0x85], 0
jne 0x4504d0
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x4504a2
call fcn.00402dbc
mov word [ebx + 0x294], si
push 0x3f
push 0x465
mov eax, dword [ebx + 0x298]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x4504d0
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call fcn.004504f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4504ed
lea eax, [ebp - 4]
call fcn.00403af4
ret

Function at 0x461ad8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.004616e1
push eax
push esi
push dword [ebp + 8]
jne 0x461aea
call fcn.00461696
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
fld dword [esi + eax*8 + 0x45]
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x461b6c
Function at 0x461d90
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x461da8
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
add byte [eax - 0x15], ah
push ds
movzx eax, ax
lea eax, [eax + eax*4]
add al, 0x80
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x461e24
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x461e0b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x461e14
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x461e1e
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x461e00
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
push es
jbe 0x461d8a
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x461e71
dec eax
je 0x461e68
sub eax, 3
je 0x461e5f
mov dword [ebp - 4], 0x40
jmp 0x461e8e
mov dword [ebp - 4], 4
jmp 0x461e74
mov dword [ebp - 4], 0x20
jmp 0x461e74
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x461ec0
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x461e40
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004616d1
invalid
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x461dac
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x461da8
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
add byte [eax - 0x15], ah
push ds
movzx eax, ax
lea eax, [eax + eax*4]
add al, 0x80
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x461e24
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x461e0b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x461e14
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x461e1e
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x461e00
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
push es
jbe 0x461d8a
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x461e71
dec eax
je 0x461e68
sub eax, 3
je 0x461e5f
mov dword [ebp - 4], 0x40
jmp 0x461e8e
mov dword [ebp - 4], 4
jmp 0x461e74
mov dword [ebp - 4], 0x20
jmp 0x461e74
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x461ec0
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x461e40
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004616d1
invalid
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4623a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esp, 0x1fffffa
cmp dword [ebp - 0x398], 0
je 0x4623c5
cmp dword [ebp - 0x398], 0
je 0x46258f
cmp dword [ebp + 0xc], 1
je 0x46258f
cmp dword [ebp + 0xc], 8
jne 0x462557
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.004616e1
pop ecx
push eax
push dword [ebp + 0x18]
sbb bh, bh
jne 0x462498
call fcn.004616d1
lahf
dec esp
lea ebx, [ecx - 0x5435a80]
invalid
and byte [ebp - 0x230], 0
push 0x40
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
movsx eax, byte [ebp + eax - 0x655]
cmp eax, 0x5c
jne 0x46279d
mov eax, dword [ebp - 0x550]
dec eax
mov dword [ebp - 0x550], eax
invalid
and dword [ebp - 0x338], 0
and dword [ebp - 0x3d0], 0
jmp 0x4627ba
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0x104
jge 0x462821
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
and eax, 0x80
test eax, eax
je 0x4627ec
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
jmp 0x46281f
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
cmp eax, 0x5c
jne 0x46280b
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x3d0]
movsx eax, byte [ebp + eax - 0x334]
test eax, eax
jne 0x46281f
jmp 0x462821
jmp 0x4627ad
mov eax, dword [ebp - 0x670]
add eax, dword [ebp - 0x384]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
push dword [ebp - 0x338]
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.00461642
add esp, 0xc
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x670]
inc eax
mov dword [ebp - 0x670], eax
and dword [ebp - 4], 0
and dword [ebp - 0x3a0], 0
and dword [ebp - 0x37c], 0
and dword [ebp - 0x388], 0
and dword [ebp - 0x374], 0
mov al, byte [ebp - 8]
add al, byte [ebp - 0x670]
mov byte [ebp - 8], al
mov eax, dword [ebp + 8]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
mov ecx, dword [ebp - 0x548]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x53c], ecx
mov eax, dword [ebp - 0x53c]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x3a8], ecx
mov al, byte [ebp - 0x24]
sub al, byte [ebp - 0x670]
mov byte [ebp - 0x24], al
call fcn.004616af
mov edx, 0x4a580a9
cld
invalid
Function at 0x462598
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004616af
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
invalid
invalid
cdq

Function at 0x4674ab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4824ee
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x467503
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x48250f
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4674f9
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x467507
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x47be80
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.00403f34
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x47bebc
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp], cl
mov cl, byte [edx + 1]
mov byte [esp + 1], cl
mov cl, byte [edx + 2]
mov byte [esp + 2], cl
mov al, byte [edx + 3]
mov byte [esp + 3], al
push dword [esp]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, esi
call fcn.00403ca8
pop edx
pop esi
pop ebx
ret
Function at 0x47bed4
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x38], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47c01d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, dword [0x483928]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, 0x2000
call fcn.00402788
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x47c000
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x34]
xor ecx, ecx
mov edx, 0x20
call fcn.00402aec
mov eax, dword [ebx + 0x304]
call fcn.00403f34
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x34], 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x34]
push eax
push 2
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
je 0x47bf6d
call fcn.00403608
jmp 0x47c007
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], 0x2000
lea eax, [ebp - 0x10]
push eax
mov ebx, dword [ebp - 8]
push ebx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.mpr.dll_WNetEnumResourceA
cmp eax, 0x103
jne 0x47bf9e
call fcn.00403608
jmp 0x47c007
test eax, eax
je 0x47bfa9
call fcn.00403608
jmp 0x47c007
mov esi, ebx
mov ebx, dword [ebp - 0xc]
dec ebx
test ebx, ebx
jl 0x47bf6d
inc ebx
lea eax, [ebp - 0x38]
mov edx, dword [esi + 0x14]
call fcn.00403ca8
mov edx, dword [ebp - 0x38]
mov eax, dword [0x483928]
mov ecx, dword [eax]
call dword [ecx + 0x34]
add esi, 0x20
dec ebx
jne 0x47bfb4
jmp 0x47bf6d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c024
lea eax, [ebp - 0x38]
call fcn.00403af4
ret

Function at 0x47e310
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1d8], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47e3bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, esi
call fcn.00403af4
push 0x40
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x47e3a4
mov edi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x47e399
mov eax, dword [edi + ebx*4]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, esi
call fcn.00408eb8
lea ecx, [ebp - 0x1d8]
mov edx, dword [esi]
mov eax, dword [ebp - 4]
call fcn.0047e3cc
cmp dword [ebp - 0x1d8], 0
jne 0x47e39f
inc ebx
cmp dword [edi + ebx*4], 0
jne 0x47e36e
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e3c4
lea eax, [ebp - 0x1d8]
call fcn.00403af4
ret
Function at 0x47e3cc
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00403f24
xor eax, eax
push ebp
push 0x47e44f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1a4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403f34
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
push 2
push 4
lea eax, [ebp - 0x10]
push eax
call sub.wsock32.dll_gethostbyaddr
mov ebx, eax
test ebx, ebx
je 0x47e432
mov edx, esi
mov eax, dword [ebx]
call fcn.00408eb8
jmp 0x47e439
mov eax, esi
call fcn.00403af4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e456
lea eax, [ebp - 4]
call fcn.00403af4
ret