joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4265ce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x426610
call fcn.00437d1e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x426610
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x426607
xor eax, eax
jmp 0x426618
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0042661e
pop edi
pop esi
pop ebx
ret 4

Function at 0x4286ba
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x4286dc
cmp dword [edi + 0x3c], 0
jne 0x4286dc
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.00437d1e
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.00428709
pop edi
pop esi
pop ebx
ret 8

Function at 0x428757
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.00437d1e
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x428788
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.0042879b
pop edi
pop esi
pop ebx
ret 8
Function at 0x43979e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4397cc
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4397ea
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00439704
jmp 0x4397ea
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4397ea
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00439704
test edi, edi
mov eax, edi
jne 0x4397d4
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402808
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403e10
test esi, esi
jne 0x40283e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403f00
jmp 0x40285c
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.0040271c
mov edi, eax
test esi, esi
je 0x40285c
cmp dword [ebx], 0
je 0x40285c
dec esi
jmp 0x402845
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4032e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41b014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40337c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40335c
xor eax, eax
push ebp
push 0x403355
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403398
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40335c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ax, word [0x41b014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41b014], ax
mov esp, ebp
pop ebp
ret

Function at 0x403c18
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x41e038], 0
je 0x403c79
cmp word [0x41e20c], 0xd7b2
jne 0x403c41
cmp dword [0x41e214], 0
jbe 0x403c41
mov eax, 0x41e208
call dword [0x41e224]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41b080
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403ca0
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x41b020], 0
jne 0x403c95
push 0
push 0x41b078
push 0x41b080
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret

Function at 0x403dcc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402548
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x41e039], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403d94
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x404ba4
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404dd4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x404c27
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404dd4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x404c27
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404df0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x404cb0
xor eax, eax
push ebp
push 0x404ca9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004049ec
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x404c8e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404e10
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x404c8e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404cb0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404dca
cmp byte [ebp - 0xd], 0
jne 0x404cf7
cmp byte [ebp - 0x12], 0
je 0x404dca
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404d10
dec ebx
cmp byte [ebx], 0x2e
je 0x404d1f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404d0f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404dca
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404d5c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404dca
cmp byte [ebp - 0xd], 0
je 0x404dca
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404dca
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404f8c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404ff2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403f7c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403058
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404fdc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ff9
lea eax, [ebp - 0x10]
call fcn.00403e10
ret

Function at 0x405dd0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004041a8
xor eax, eax
push ebp
push 0x405e7a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402e0c
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], si
mov eax, 0x405e8c
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004041b8
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test bl, bl
je 0x405e64
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
mov eax, dword [ebp - 0x58]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x54]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405e81
lea eax, [ebp - 4]
call fcn.00403e10
ret

Function at 0x405e9c
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.004041b8
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x405ed8
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp], cl
mov cl, byte [edx + 1]
mov byte [esp + 1], cl
mov cl, byte [edx + 2]
mov byte [esp + 2], cl
mov al, byte [edx + 3]
mov byte [esp + 3], al
push dword [esp]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, esi
call fcn.00403f40
pop edx
pop esi
pop ebx
ret
Function at 0x405ef0
Capabilities:
Act as tcp client
Check internet connectivity via wininet
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe54
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x1ac], eax
xor eax, eax
push ebp
push 0x406003
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 4
mov ecx, 0x40601c
mov edx, 0x406038
mov eax, 1
call fcn.00407f1c
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov word [ebp - 0x1a8], 2
push 0x19
call sub.wsock32.dll_htons
mov word [ebp - 0x1a6], ax
lea edx, [ebp - 0x1ac]
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x41b2c8]
call fcn.00405e9c
mov eax, dword [ebp - 0x1ac]
call fcn.004041b8
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x41b2c8]
call fcn.004041b8
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x405fc3
push 0x10
lea eax, [ebp - 0x1a8]
push eax
push esi
call sub.wsock32.dll_connect
test eax, eax
jne 0x405fc3
mov bl, 1
mov dword [ebp - 8], 7
push 0
lea eax, [ebp - 8]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
jne 0x405fea
inc dword [ebp - 4]
test bl, bl
jne 0x405fea
cmp dword [ebp - 4], 4
jne 0x405f34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40600a
lea eax, [ebp - 0x1ac]
call fcn.00403e10
ret
Function at 0x4061e0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004041a8
mov esi, 0x41f1fc
xor eax, eax
push ebp
push 0x40632d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x154]
mov ecx, 0x406344
mov edx, dword [ebp - 4]
call fcn.00404004
mov eax, dword [ebp - 0x154]
call fcn.004041b8
push eax
call sub.KERNEL32.DLL_FindFirstFileA
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jne 0x40625a
cmp dword [ebp - 0x10], 0xffffffff
je 0x406307
mov eax, esi
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00403f7c
mov eax, dword [esi]
mov edx, 0x406350
call fcn.00404104
je 0x4062e3
mov eax, dword [esi]
mov edx, 0x40635c
call fcn.00404104
je 0x4062e3
test byte [ebp - 0x150], 0x10
je 0x4062be
push dword [ebp - 4]
push 0x406368
push dword [esi]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00404078
mov eax, dword [ebp - 0x158]
call fcn.004061e0
jmp 0x4062e3
push dword [ebp - 4]
push 0x406368
push dword [esi]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.00404078
mov eax, dword [ebp - 0x15c]
call fcn.004079d4
lea eax, [ebp - 0x150]
push eax
mov ebx, dword [ebp - 0x10]
push ebx
call sub.KERNEL32.DLL_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x406260
push ebx
call sub.KERNEL32.DLL_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406334
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.00403e34
lea eax, [ebp - 4]
call fcn.00403e10
ret
Function at 0x40636c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004041a8
mov eax, dword [ebp - 8]
call fcn.004041a8
mov esi, 0x41f1fc
xor eax, eax
push ebp
push 0x406504
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x154]
mov ecx, 0x40651c
mov edx, dword [ebp - 4]
call fcn.00404004
mov eax, dword [ebp - 0x154]
call fcn.004041b8
push eax
call sub.KERNEL32.DLL_FindFirstFileA
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jne 0x4063f7
cmp dword [ebp - 0x10], 0xffffffff
je 0x4064d9
lea eax, [ebp - 0x15c]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.00403f7c
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x158]
call fcn.00407100
mov edx, dword [ebp - 0x158]
mov eax, esi
call fcn.00403e64
mov eax, dword [esi]
mov edx, 0x406528
call fcn.00404104
je 0x4064b5
mov eax, dword [esi]
mov edx, 0x406534
call fcn.00404104
je 0x4064b5
test dword [ebp - 0x150], 0x10
jbe 0x406483
push dword [ebp - 4]
push 0x406540
push dword [esi]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.00404078
mov eax, dword [ebp - 0x160]
mov edx, dword [ebp - 8]
call fcn.0040636c
jmp 0x4064b5
mov edx, dword [esi]
mov eax, dword [ebp - 8]
call fcn.004042a0
test eax, eax
jle 0x4064b5
push dword [0x41f1e0]
push dword [ebp - 4]
push 0x406540
push dword [esi]
push 0x40654c
mov eax, 0x41f1e0
mov edx, 5
call fcn.00404078
lea eax, [ebp - 0x150]
push eax
mov ebx, dword [ebp - 0x10]
push ebx
call sub.KERNEL32.DLL_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4063fd
push ebx
call sub.KERNEL32.DLL_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40650b
lea eax, [ebp - 0x160]
mov edx, 4
call fcn.00403e34
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e34
ret
Function at 0x406550
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea4
push ebx
xor edx, edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004041a8
xor eax, eax
push ebp
push 0x4066e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41f1e0
call fcn.00403e10
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x158]
mov ecx, 0x4066fc
mov edx, dword [ebp - 4]
call fcn.00404004
mov eax, dword [ebp - 0x158]
call fcn.004041b8
push eax
call sub.KERNEL32.DLL_FindFirstFileA
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jne 0x4065cb
cmp dword [ebp - 0x10], 0xffffffff
je 0x406670
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00403f7c
mov ebx, dword [ebp - 0x154]
mov eax, dword [ebp - 0x14]
mov edx, 0x406708
call fcn.00404104
je 0x40664c
mov eax, dword [ebp - 0x14]
mov edx, 0x406714
call fcn.00404104
je 0x40664c
cmp dword [ebp - 0x14], 0
je 0x40664c
test bl, 0x10
je 0x406617
xor ebx, ebx
jmp 0x40661c
mov ebx, 1
push dword [0x41f1e0]
lea edx, [ebp - 0x15c]
mov eax, ebx
call fcn.004061b8
push dword [ebp - 0x15c]
push dword [ebp - 0x14]
push 0x406720
mov eax, 0x41f1e0
mov edx, 4
call fcn.00404078
lea eax, [ebp - 0x154]
push eax
mov ebx, dword [ebp - 0x10]
push ebx
call sub.KERNEL32.DLL_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4065d1
push ebx
call sub.KERNEL32.DLL_FindClose
mov edx, dword [0x41f1c8]
mov eax, 0x41eb10
call fcn.00402b94
mov eax, 0x41eb10
call fcn.00402924
call fcn.0040263c
mov edx, dword [0x41f1e0]
mov eax, 0x41eb10
call fcn.0040434c
call fcn.00403240
call fcn.0040263c
mov eax, 0x41eb10
call fcn.00402d2c
call fcn.0040263c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4066ed
lea eax, [ebp - 0x15c]
mov edx, 2
call fcn.00403e34
lea eax, [ebp - 0x14]
call fcn.00403e10
lea eax, [ebp - 4]
call fcn.00403e10
ret
Function at 0x406724
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaa4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x55c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004041a8
mov edi, 0x41f218
xor eax, eax
push ebp
push 0x406929
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x41d668]
mov byte [eax], 0
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x150]
call fcn.00402b94
mov edx, 1
lea eax, [ebp - 0x150]
call fcn.00402f90
call fcn.004026bc
test eax, eax
je 0x406797
mov dword [edi], 0
mov dword [edi + 4], 0
jmp 0x406908
mov eax, dword [edi]
mov edx, eax
lea eax, [ebp - 0x150]
call fcn.00402fb8
call fcn.0040263c
lea eax, [ebp - 0x150]
call fcn.00402dc0
call fcn.0040263c
mov esi, eax
mov eax, esi
test eax, eax
jns 0x4067c8
add eax, 0x3ff
sar eax, 0xa
shl eax, 0xa
cdq
cmp edx, dword [edi + 4]
jne 0x4067ec
cmp eax, dword [edi]
jne 0x4067ec
mov ebx, esi
and ebx, 0x800003ff
jns 0x4067fe
dec ebx
or ebx, 0xfffffc00
inc ebx
jmp 0x4067fe
mov ebx, 0x400
mov eax, ebx
cdq
add eax, dword [edi]
adc edx, dword [edi + 4]
mov dword [edi], eax
mov dword [edi + 4], edx
cmp byte [0x41f26a], 0
je 0x406810
mov byte [ebp - 0x557], 0x31
jmp 0x406829
cmp byte [0x41f26b], 0
je 0x406822
mov byte [ebp - 0x557], 0x32
jmp 0x406829
mov byte [ebp - 0x557], 0x30
mov byte [ebp - 0x556], 0x30
mov byte [ebp - 0x555], 0x34
lea edx, [ebp - 0x55c]
mov eax, ebx
call fcn.004061b8
mov edx, dword [ebp - 0x55c]
mov eax, 0x41f1b0
call fcn.00403e64
mov eax, dword [0x41f1b0]
mov al, byte [eax]
mov byte [ebp - 0x554], al
mov eax, dword [0x41f1b0]
mov al, byte [eax + 1]
mov byte [ebp - 0x553], al
mov eax, dword [0x41f1b0]
mov al, byte [eax + 2]
mov byte [ebp - 0x552], al
mov eax, dword [0x41f1b0]
mov al, byte [eax + 3]
mov byte [ebp - 0x551], al
push 0
lea edx, [ebp - 0x550]
mov ecx, ebx
lea eax, [ebp - 0x150]
call fcn.00402cec
call fcn.0040263c
mov eax, ebx
cdq
add eax, dword [edi]
adc edx, dword [edi + 4]
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x4068bb
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4068c7
cmp ebx, 0x400
jl 0x4068d3
mov eax, esi
cdq
cmp edx, dword [edi + 4]
jne 0x4068e0
cmp eax, dword [edi]
jne 0x4068e0
mov dword [edi], 0
mov dword [edi + 4], 0
lea eax, [ebp - 0x150]
call fcn.00402d2c
call fcn.0040263c
push 0
add ebx, 7
push ebx
lea eax, [ebp - 0x557]
push eax
mov eax, dword [0x41f36c]
push eax
call sub.wsock32.dll_send
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406930
lea eax, [ebp - 0x55c]
call fcn.00403e10
lea eax, [ebp - 4]
call fcn.00403e10
ret
Function at 0x4069d4
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe54
push ebx
xor eax, eax
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x406c2d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov word [ebp - 0x1a8], 2
push 0x406c3c
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x406bf4
movsx ecx, word [eax + 0xa]
lea edx, [ebp - 0x1a4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
call fcn.004026dc
push 0x50
call sub.wsock32.dll_htons
mov word [ebp - 0x1a6], ax
push 0x10
lea eax, [ebp - 0x1a8]
push eax
push ebx
call sub.wsock32.dll_connect
test eax, eax
jne 0x406bf4
lea eax, [ebp - 4]
mov ecx, dword [0x41f1f8]
mov edx, 0x406c50
call fcn.00404004
push dword [ebp - 4]
push 0x406c7c
push dword [0x41f1f8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404078
push dword [ebp - 4]
push 0x406ca0
push dword [0x41f1f8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404078
push dword [ebp - 4]
push 0x406cd8
push dword [0x41f1f8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404078
push dword [ebp - 4]
push 0x406cf4
push dword [0x41f1f8]
push dword [0x41f1f8]
lea eax, [ebp - 4]
mov edx, 4
call fcn.00404078
mov eax, dword [0x41fb8c]
cmp dword [eax + 0x1c], 0
je 0x406b0f
lea eax, [ebp - 8]
mov ecx, dword [0x41f148]
mov edx, 0x406d08
call fcn.00404004
push dword [ebp - 4]
push 0x406d14
mov eax, dword [0x41fb8c]
push dword [eax + 4]
push 0x406d24
mov eax, dword [0x41fb8c]
push dword [eax + 8]
push 0x406d38
mov eax, dword [0x41fb8c]
push dword [eax + 0xc]
push 0x406d4c
mov eax, dword [0x41fb8c]
push dword [eax + 0x10]
push 0x406d08
lea eax, [ebp - 0x1ac]
mov edx, dword [0x41eb08]
call fcn.00403f40
push dword [ebp - 0x1ac]
push 0x406d5c
mov eax, dword [0x41fb8c]
push dword [eax + 0x14]
push 0x406d08
push dword [0x41f320]
push 0x406d5c
mov eax, dword [0x41fb8c]
push dword [eax + 0x18]
push 0x406d08
push dword [0x41f144]
push 0x406d5c
mov eax, dword [0x41fb8c]
push dword [eax + 0x1c]
push dword [ebp - 8]
push 0x406d68
mov eax, dword [0x41fb8c]
push dword [eax]
push 0x406d78
lea eax, [ebp - 4]
mov edx, 0x19
call fcn.00404078
push 0
mov eax, dword [ebp - 4]
call fcn.00403fb8
push eax
lea eax, [ebp - 4]
call fcn.00404210
push eax
push ebx
call sub.wsock32.dll_send
mov eax, 0x41f324
mov edx, dword [0x41f320]
call fcn.00403e64
mov eax, 0x7d0
call fcn.004082b4
push 2
push ebx
call sub.wsock32.dll_shutdown
push ebx
call sub.wsock32.dll_closesocket
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406c34
lea eax, [ebp - 0x1ac]
call fcn.00403e10
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e34
ret