joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4017b7
Capabilities:
Query or enumerate registry key

Disassembly:
xor eax, eax
mov word [esp + 8], 0
mov ecx, 0x41a056
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x419b90]
test eax, eax
jne 0x40181a
push 0x419ae0
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0x419a4f
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 8]
push edx
push 0x419dc1
push 0x41a1b2
push 0x419c59
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402949
Capabilities:
Delete directory
Parse url

Disassembly:
push 0x419cf0
mov dword [ebp - 4], 2
call fcn.0040c15e
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_DebugBreak]
add esp, 8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x402869
xor eax, eax
pop esi
add esp, 0xc
ret
push eax
call dword [sym.imp.urlmon.dll_FindMimeFromData]
add esp, 4
pop esi
mov dword [esi], 0x10006554
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0
call fcn.0040b9a7
mov ecx, dword [esi + 0x14]
test ecx, ecx
mov byte [esp + 0x14], 1
je 0x40295d
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x14], 0
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.0040aacc
lea ecx, [esi + 0x18]
int3
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, dword [0x419861]
test edi, edi
je 0x4028dd
mov edx, dword [ebp]
mov eax, dword [edi]
mov esi, edx
lea esp, [esp]
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x402977
test cl, cl
je 0x4028f8
mov bl, byte [eax + 1]
jne 0x40291f
xor eax, eax
add esp, 0x10
ret

Function at 0x4046a0
Capabilities:
Send data

Disassembly:
mov ecx, esi
call dword [sym.imp.WININET.dll_InternetWriteFile]
add esi, 4
cmp esi, edi
jne 0x404656
push eax
push 0x64
push 0x401a68
push 0x4038b8
call 0x4046d1
call dword [sym.imp.USER32.dll_LoadIconA]
lea edx, [esp + 8]
push edx
push 0x4190bf
lea esp, [esp + 0x10]
mov eax, dword [esp + 8]
push dword [esp + 0xa]
push 0xffffffffffffffcd
call 0x4046ea
setl cl
dec ecx
and eax, ecx
lea esp, [esp + 0xc]
add dword [esp + 4], eax
push 0x402990
push 0x404408
call 0x404711
mov ecx, dword [esp + 4]
call fcn.0040e50d
push eax
call dword [sym.imp.WININET.dll_InternetSetOptionA]
lea esp, [esp + 0xc]
pop eax
ret 8
Function at 0x404773
Capabilities:
Get token membership

Disassembly:
mov dword [esp + 0x110], eax
push edi
xor eax, eax
add esp, 4
pop esi
mov ebx, dword [esp]
add esp, 4
push 0x4002d0
push dword [esp + 4]
push 0xffffffffffffffc9
push 0x405d7b
call fcn.0040432b
mov dword [esp + 0x400], eax
mov eax, dword [esi]
push edi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4047a6
sub eax, edi
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x404734
mov edx, dword [esp + 0x10]
and ebx, dword [esp]
or ebx, dword [esp]
add esp, 4
leave
push 0xfffffffffffffffc
push dword [esp + 4]
push ebx
push fcn.00408596
call fcn.00403db1
push 0x4195c8
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
pop edi
pop esi
xor eax, eax

Function at 0x404853
Capabilities:
Allocate thread local storage
Get graphical window text

Disassembly:
mov eax, dword [ecx + 0x14]
test eax, eax
jne 0x4048a8
push 0x64
push dword [ebp - 4]
call dword [edx]
push eax
lea eax, [ebx + edx + 0x7e]
mov eax, 0x92924fc2
push 0x32
push dword [esp + 0xc]
push ebx
push 0x40d98e
call fcn.00403db1
call dword [sym.imp.USER32.dll_GetWindowTextA]
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
test ebx, ebx
jne 0x4048bb
push 0x419009

Function at 0x4048ca
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push ecx
push 0x4193e7
call dword [sym.imp.USER32.dll_RegisterClassW]
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea ecx, [esp + 0x20]
mov dword [esp + 0x54], 0xffffffff
push ebx
push edx
call 0x4048ca
push ebx
mul ecx
mov ebx, eax
mov eax, dword [esp + 8]
mul dword [esp + 0x14]
add ebx, eax
lea esp, [esp + 8]
mov ebx, dword [esp + 8]
push dword [esp - 0x12]
push 0x4031f0
push dword [esp - 0x53]
push 0x4031b0
push ebp
call 0x404906
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, dword [0x419bfa]
and eax, 0xff3fffff
push eax
lea esp, [esp + 0x18]
add dword [esp + 4], ebx
push 0x401a58
push dword [esp - 0x5e]
push dword [esp + 0x2e]
push dword [esp - 0xb]
push dword [esp - 0x7b]
call 0x404938
push eax
call dword [sym.imp.KERNEL32.dll_GetStringTypeA]
sub esp, 0xc
mov edx, dword [esp + 0x14]
xor eax, eax
lea esp, [esp + 0x18]
pop ebx
ret 0xc

Function at 0x40495d
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push eax
push ecx
push 0xffffffffffffffdf
push 0x2c
push ebp
push 0x40ec4d
call fcn.0040432b
lea ecx, [ebp - 0x844]
lea ecx, [ebp - 0x840]
mov eax, 0x4197e7
mov ecx, dword [ebp - 0x10]
mov eax, 0x41966b
lea ecx, [ebp + 4]
mov eax, 0x4196e2
mov eax, dword [0x419b41]
mov ecx, dword [0x419113]
cmp esi, 1
je 0x4049c6
mov esi, 0x4197ff
xor esi, esi
lea ecx, [esp + 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea ecx, [esp + 0x18]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
push esi
push dword [esp + 0x70]
push esp
push edx
push dword [esp + 0x34]
push 0x403458
call fcn.00404a04
push esi
push edi
mov dword [esp + 0xc], 0
mov esi, dword [esp + 0x28]
test esi, esi
mov edi, dword [0x4194f2]
mov byte [esp + 0x1c], 1
je 0x40498a
push 0
Function at 0x404f72
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push esi
lea eax, [esp + 8]
push eax
shl eax, 4
mov eax, 1
pop edx
push dword [esp + 0xc]
push 0xffffffffffffffaf
push 0xffffffffffffffbc
push 0x40479a
call fcn.00403ef1
lea ecx, [esp + 0x14]
mov byte [esp + 0x458], 6
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [esp + 0x14]
mov byte [esp + 0x454], bl
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0x419fc7
lea eax, [esp + 0x18]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
ret

Function at 0x405692
Capabilities:
Get graphical window text

Disassembly:
mov bl, al
call dword [sym.imp.USER32.dll_SetCursor]
test eax, eax
je 0x405715
xor eax, eax
pop ebx
mov eax, dword [esp + 0xc]
push eax
call dword [ebp - 0x48]
test eax, eax
je 0x404618
lea eax, [eax + 0x76]
mov eax, 0x58
pop edx
push 0xffffffffffffff81
push dword [esp + 8]
push eax
push 0x40d8fc
call fcn.00403db1
call dword [sym.imp.GDI32.dll_SelectObject]
test eax, eax
je 0x4056fc
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push 1
push eax
mov eax, dword [0x419982]
call fcn.0040a116

Function at 0x4056ea
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
sub esp, 0x419e8b
mov eax, dword [0x4191c9]
mov dword [esp + 0x800], eax
mov al, byte [0x100406e4]
test al, al
pop ecx
push 0x14
push eax
push 0xffffffffffffffbd
push 0x408711
call fcn.0040396f
push 0
call fcn.0040b6cf
sub esp, 0xc
mov edx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp + 8]
push eax

Function at 0x40572f
Capabilities:
Create process on windows

Disassembly:
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push eax
push 0x41938e
call fcn.0040758d
mov eax, dword [esp + 8]
movzx ecx, word [esp + 0xc]
push eax
mov ebp, esp
add esp, 0xfffffff8
push 0xcd1bab2
mov dword [esp], eax
push 0x400980
push dword [esp + 0xc]
push ebx
push 0x4045df
call fcn.00403c49
mov dword [esi], eax
mov eax, esi
pop esi
mov eax, dword [ecx]
test eax, eax
je 0x405770
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp dword [sym.imp.USER32.dll_GetWindowTextW]

Function at 0x405a33
Capabilities:
Encrypt or decrypt via wincrypt
Get token membership

Disassembly:
push 0x419119
push 0x419b89
mov esi, ecx
mov dword [esp + 0x18], 0
test edi, edi
jl 0x405a9e
push 8
push 0
lea edx, [esp + 0x10]
push edx
mov dword [ebp - 0x44], esp
push 0
push ecx
sub ecx, edx
mov ecx, 0xd6cf25a7
xor ecx, 0x81aa48c6
push 0x4f
push dword [esp + 4]
push 0x4009dc
push fcn.00408af6
call fcn.0040396f
mov eax, dword [ecx + 0x14]
sub esp, 0x10
test eax, eax
je 0x4059f9
mov eax, dword [ecx + 0x1c]
test eax, eax
jne 0x405adf
xor eax, eax
pop ecx
mov eax, dword [ecx + 0x14]
push 0
call dword [edx]
jmp dword [0xffffffff]
call edi
test eax, eax
je 0x405a72
pop edi
jmp dword [sym.imp.KERNEL32.dll_InterlockedExchange]
Function at 0x405aa5
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
je 0x402644
push 0x419005
lea eax, [esp + 0x22c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea ecx, [esp + 0x228]
push ecx
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
add esp, 0x10
test eax, eax
je 0x40265b
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push 1
push eax
mov eax, dword [0x41a0bd]
call fcn.0040bd9f
add esp, 8
cmp eax, 0xffffffff
je 0x402632
mov ecx, dword [esp + 8]
test eax, eax
jl 0x40260f
mov esi, dword [esi + 0x14]
mov eax, dword [esi]
push esi
call dword [eax + 0x38]
xor ecx, ecx
test eax, eax
setge cl
pop esi
mov eax, ecx
ret
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x405afe
mov eax, dword [0x419c8a]
add esp, 0xffffffe4
push ebx
push ebp
push dword [esp + 4]
push 0x40aa86
call fcn.00403675
jmp dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 0x10
cmp eax, 0x50
ja 0x4129cb
and eax, ecx
mov eax, 3
push edx
push edx
push 0x74
push 0x40ce18
call fcn.00403ef1
mov eax, dword fs:[0]
push eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], ebp
lea ebp, [esp + 0x10]
sub esp, eax
push ebx
push esi
push edi
push 0x419736
push 0x146c
push eax
push 0x4197a8
push 0x74c
push 0xf98
push sym.imp.KERNEL32.dll_FreeEnvironmentStringsW
call fcn.0040f632
push 0x419a40
push 0x37
push ebp
push edx
push 0x348
push sym.imp.USER32.dll_GetTopWindow
call fcn.0040cea6
push 0xffffffffffffffc2
push esi
push edx
push 0x3fbd8a
call fcn.00403c49
mov dword fs:[0], ecx
push esi
mov esi, ecx
mov ecx, dword [esi]
mov edx, dword [ecx - 0xc]
test edx, edx
lea eax, [ecx - 0x10]
call fcn.0040a3a6
push dword [esp + 8]
push 9
push 0x40060e
push 0x3fe0e8
call fcn.0040432b
push 0x41a176
call fcn.0040bcce
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call dword [sym.imp.WININET.dll_InternetQueryOptionA]
xor eax, eax
call fcn.00404f6c
push 0x4007c5
push 0x1a
push 0x40084b
push 0x3fb3c5
call fcn.00403ace
push ebx
push esi
mov eax, dword [esp + 0x18]
push 0x419eed
call fcn.00405f95
push 0x494
push sym.imp.WININET.dll_InternetCloseHandle
push 0x1137
push 0x419f30
push 0xf2c
push sym.imp.KERNEL32.dll_GetFileAttributesExA
call fcn.00408806
push 0x13
call fcn.0040665c
lea ecx, [ebp + 4]
jmp 0x402611

Function at 0x405b84
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
push 0x40093f
push 0x40020c
push dword [esp + 8]
push 0x3ff79e
call fcn.00403ace
pop ecx
sub esp, 0xc
mov edx, dword [esp + 0x14]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 4]
Function at 0x405bf3
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
call dword [sym.imp.USER32.dll_SetClassLongW]
pop esi
add dword [esp], ebx
push dword [esp + 8]
push dword [esp + 4]
push dword [esp + 4]
push 0x402e2c
call fcn.00403db1
test eax, eax
je 0x405bae
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push ecx
push ecx
push 0x419bed
push edx
jne 0x405c16
mov ecx, dword [esi + 4]
push esi
call dword [ecx + 0x18]
pop edi
push ebx
push dword [esp - 0x7d]
push 0x5b
push dword [esp + 7]
push dword [esp - 0x15]
push dword [esp + 0x30]
call 0x405bf3
mov eax, dword [0x419412]
mov ecx, dword [esp]
lea edx, [esp + 4]
push 1
push edx
call fcn.0040b91d
cmp eax, 0xffffffff
jne 0x405b7b
lea esp, [esp + 0x18]
mov ebx, dword [esp + 8]
push 0xfffffffffffffff8
push dword [esp + 0x28]
push dword [esp - 0x70]
call 0x405c29
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.0040d293
push eax
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
lea esp, [esp + 0x10]
add dword [esp + 4], ebx
push 0xffffffffffffffd1
push edx
push dword [esp + 0x63]
push 0x401308
push 0x36
call 0x405c55
cmp eax, edi
je fcn.00405c91
mov ecx, dword [esi + 0x18]
cmp ecx, edi
jne fcn.00405c95
mov esi, dword [0x4192d0]
lea esp, [esp + 0x18]
pop ebx
ret 4

Function at 0x405c29
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
call dword [sym.imp.USER32.dll_SetClassLongW]
pop esi
add dword [esp], ebx
push dword [esp + 8]
push dword [esp + 4]
push dword [esp + 4]
push 0x402e2c
call fcn.00403db1
test eax, eax
je 0x405bae
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push ecx
push ecx
push 0x419bed
push edx
jne 0x405c16
mov ecx, dword [esi + 4]
push esi
call dword [ecx + 0x18]
pop edi
push ebx
push dword [esp - 0x7d]
push 0x5b
push dword [esp + 7]
push dword [esp - 0x15]
push dword [esp + 0x30]
call 0x405bf3
mov eax, dword [0x419412]
mov ecx, dword [esp]
lea edx, [esp + 4]
push 1
push edx
call fcn.0040b91d
cmp eax, 0xffffffff
jne 0x405b7b
lea esp, [esp + 0x18]
mov ebx, dword [esp + 8]
push 0xfffffffffffffff8
push dword [esp + 0x28]
push dword [esp - 0x70]
call 0x405c29
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.0040d293
push eax
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
lea esp, [esp + 0x10]
add dword [esp + 4], ebx
push 0xffffffffffffffd1
push edx
push dword [esp + 0x63]
push 0x401308
push 0x36
call 0x405c55
cmp eax, edi
je fcn.00405c91
mov ecx, dword [esi + 0x18]
cmp ecx, edi
jne fcn.00405c95
mov esi, dword [0x4192d0]
lea esp, [esp + 0x18]
pop ebx
ret 4
Function at 0x4064fb
Capabilities:
Delete directory

Disassembly:
lea eax, [esp + 8]
push 1
and esi, dword [esp]
push dword [esp + 4]
push ebp
push 0xffffffffffffff83
push 0x401b63
call fcn.004037fe
sub esp, 0x10
push esi
lea eax, [esp + 8]
push eax
xor byte [ebx], bl
adc ah, cl
push dword [ebp - 8]
call fcn.0040495d
push dword [esp + 0xc]
push dword [esp + 8]
push 0x7e
push 0x40acf0
call fcn.00403c49
mov dword [esi], eax
mov eax, esi
pop esi
mov dword [esi], 0
mov eax, esi

Function at 0x40653e
Capabilities:
Delete directory

Disassembly:
call fcn.00409003
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
pop edi
pop esi
pop ebx
push ecx
push dword [esp + 3]
call 0x406571
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [esp + 8]
test eax, eax
lea esp, [esp + 8]
mov ecx, dword [esp + 8]
push dword [esp + 3]
push 0x402d90
push dword [esp - 0x27]
push 0xfffffffffffffff5
push 0x404190
call 0x40659d
push ebp
mov ebp, ecx
call fcn.00406238
lea esp, [esp + 0x18]
add dword [esp + 4], ecx
push esp
push dword [esp - 0x51]
push eax
call 0x4065c9
push 0x4191cb
push 0x41902a
push str.CCLDVvation_activer
push edi
call dword [sym.imp.USER32.dll_SetCursor]
lea esp, [esp + 0x10]
pop ecx
ret 0xc

Function at 0x40665c
Capabilities:
Check if file exists

Disassembly:
lea edi, [esp + 0x21e]
push ebx
push esp
push edx
call 0x40668d
mov ecx, 0x419f5b
mov ecx, 0x41a2c3
call fcn.0040e77b
push 0x4190b1
call fcn.00409e5f
pop ecx
mov ecx, 0x41a15b
mov ecx, 0x419144
mov eax, dword [0x419065]
lea esp, [esp + 0xc]
mov ebx, dword [esp + 8]
push dword [esp - 0x94]
push dword [esp - 0x4b]
push dword [esp - 0x3c]
push ebp
call 0x4066cb
mov byte [esp + 0x28], 2
call dword [edx]
test eax, eax
jl 0x413077
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x40564b
lea esp, [esp + 0x14]
add dword [esp + 4], ebx
push edx
push 0x18
push 0x405648
push dword [esp - 0xf5]
call 0x406700
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x41a214
lea esp, [esp + 0x14]
pop ebx
ret 4
push edx
push edx
push 0x1950
push 0xcc4
push edx
push 0x1274
call fcn.00409678
push 0xffffffffffffffcf
push 0x40035c
push 0x400665
push 0x3f344f
call fcn.00404199
mov ecx, dword [esp + 0x10]
lea eax, [esp]
Function at 0x40668d
Capabilities:
Check if file exists

Disassembly:
lea edi, [esp + 0x21e]
push ebx
push esp
push edx
call 0x40668d
mov ecx, 0x419f5b
mov ecx, 0x41a2c3
call fcn.0040e77b
push 0x4190b1
call fcn.00409e5f
pop ecx
mov ecx, 0x41a15b
mov ecx, 0x419144
mov eax, dword [0x419065]
lea esp, [esp + 0xc]
mov ebx, dword [esp + 8]
push dword [esp - 0x94]
push dword [esp - 0x4b]
push dword [esp - 0x3c]
push ebp
call 0x4066cb
mov byte [esp + 0x28], 2
call dword [edx]
test eax, eax
jl 0x413077
mov eax, dword [esp + 8]
cmp eax, ebx
je 0x40564b
lea esp, [esp + 0x14]
add dword [esp + 4], ebx
push edx
push 0x18
push 0x405648
push dword [esp - 0xf5]
call 0x406700
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x41a214
lea esp, [esp + 0x14]
pop ebx
ret 4
push edx
push edx
push 0x1950
push 0xcc4
push edx
push 0x1274
call fcn.00409678
push 0xffffffffffffffcf
push 0x40035c
push 0x400665
push 0x3f344f
call fcn.00404199
mov ecx, dword [esp + 0x10]
lea eax, [esp]

Function at 0x406e9d
Capabilities:
Resolve dns

Disassembly:
call fcn.0040de10
mov ecx, dword [ebp + 8]
push ecx
xor ecx, edx
push 0xffffffffffffffd8
push dword [esp + 4]
push 0x31
push 0x40b7bb
call fcn.0040396f
push eax
lea ecx, [esp + 0x24]

Function at 0x406ec5
Capabilities:
Encrypt or decrypt via wincrypt
Resolve dns

Disassembly:
push ebx
push dword [esp + 0xb]
push dword [esp - 0x73]
push dword [esp - 0x35]
call 0x406eeb
push 0x41980c
push 0x419c6a
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0
push 0
lea esp, [esp + 0x10]
mov ebx, dword [esp + 8]
push ebx
push ebp
push 0x403dd0
call 0x406f19
mov ecx, dword [esp + 4]
call fcn.0040eecc
sub esp, 8
and al, 0xff
adc eax, 0x10022340
sub esp, 8
mov ecx, dword [esp + 0x10]
lea esp, [esp + 0x10]
add dword [esp + 4], ebx
push 0x403ff8
push 0xffffffffffffff84
push dword [esp + 0xb]
push 0x4043e0
call 0x406f4b
lea ecx, [esp + 8]
push ecx
push 0x419bc6
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x406f8d
lea esp, [esp + 0x14]
pop ebx
ret 4
mov ecx, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
call fcn.0040a9b3
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]

Function at 0x406eeb
Capabilities:
Resolve dns

Disassembly:
push ebx
push dword [esp + 0xb]
push dword [esp - 0x73]
push dword [esp - 0x35]
call 0x406eeb
push 0x41980c
push 0x419c6a
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0
push 0
lea esp, [esp + 0x10]
mov ebx, dword [esp + 8]
push ebx
push ebp
push 0x403dd0
call 0x406f19
mov ecx, dword [esp + 4]
call fcn.0040eecc
sub esp, 8
and al, 0xff
adc eax, 0x10022340
sub esp, 8
mov ecx, dword [esp + 0x10]
lea esp, [esp + 0x10]
add dword [esp + 4], ebx
push 0x403ff8
push 0xffffffffffffff84
push dword [esp + 0xb]
push 0x4043e0
call 0x406f4b
lea ecx, [esp + 8]
push ecx
push 0x419bc6
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x406f8d
lea esp, [esp + 0x14]
pop ebx
ret 4
mov ecx, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
call fcn.0040a9b3
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
Function at 0x406f19
Capabilities:
Resolve dns

Disassembly:
push ebx
push dword [esp + 0xb]
push dword [esp - 0x73]
push dword [esp - 0x35]
call 0x406eeb
push 0x41980c
push 0x419c6a
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
push 0
push 0
lea esp, [esp + 0x10]
mov ebx, dword [esp + 8]
push ebx
push ebp
push 0x403dd0
call 0x406f19
mov ecx, dword [esp + 4]
call fcn.0040eecc
sub esp, 8
and al, 0xff
adc eax, 0x10022340
sub esp, 8
mov ecx, dword [esp + 0x10]
lea esp, [esp + 0x10]
add dword [esp + 4], ebx
push 0x403ff8
push 0xffffffffffffff84
push dword [esp + 0xb]
push 0x4043e0
call 0x406f4b
lea ecx, [esp + 8]
push ecx
push 0x419bc6
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x406f8d
lea esp, [esp + 0x14]
pop ebx
ret 4
mov ecx, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
call fcn.0040a9b3
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]

Function at 0x406fa2
Capabilities:
Encrypt or decrypt via wincrypt
Resolve dns

Disassembly:
add byte [eax], al
add byte [eax + 0x1000634c], bh
push esi
push 0
mov esi, ecx
call fcn.00404e90
mov dword [esi], 0x100063e0
mov eax, esi
dec dword [ebp + 0xc]
jne 0x4132de
lea edi, [edx - 0x4e]
mov edi, 0xffffffff
push dword [esp + 0xc]
push 0x40098f
push 0x40041c
push 0x409aa5
call fcn.004037fe
mov esi, 0x41901d
cmp ebx, ebp
mov dword [esp + 0x24], 0xffffffff
je 0x406f96
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
pop ebx
call fcn.0040eadb
call fcn.0040aae6
push esi
push dword [esp + 4]
push 0x400543
push 0x3f3a8c
call fcn.00403675
mov dword [esp + 0x84c], 0xffffffff
call fcn.0040df56
mov eax, 0x4193c7
mov ecx, dword [esp + 0x844]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x83c]
call fcn.0040f2a0
pop edi
push 0x41952d
push 0xffffffffffffffc0
call fcn.004054c8
push sym.imp.KERNEL32.dll_HeapSize
push 0xfffffffffffffff9
push 0x419988
push 0x419af8
push ebx
call fcn.004104a4
push eax
push 0xffffffffffffffec
push dword [esp + 4]
push 0x3f4555
call fcn.00403c49

Function at 0x4071cc
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x21c]
call fcn.0040fb24
lea esp, [esp + 0xc]
mov eax, dword [esp + 8]
push 0xffffffffffffff9e
push ebp
push 0x7f
push 0x405f98
call 0x4071f0
mov eax, 0x41914a
lea ecx, [ebp - 0x14]
mov eax, 0x4196d6
lea esp, [esp + 0x14]
add dword [esp + 4], eax
push dword [esp - 0x70]
push esi
call 0x407215
cmp eax, 0xffffffff
je 0x407225
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea esp, [esp + 0xc]
pop eax
ret 0xc
cmp eax, 0xffffffff
jne 0x4071b2
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.0040647b
xchg dword [esp], edx
mov edx, dword [ebp + 8]
push dword [esp + 0xc]
push 0xffffffffffffffaa
push 0xffffffffffffff9b
push 0x40bb3b
call fcn.0040432b
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004078e2
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax