joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404fcc
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, edx
mov edx, dword [ebx + 4]
sub edx, 0xd7b1
cmp edx, 2
ja 0x405028
push ecx
push 0
mov eax, esp
push 0
push eax
mov eax, dword [ebx + 8]
mul ecx
push eax
push esi
push dword [ebx]
call sub.KERNEL32.DLL_GetSystemDirectoryA
dec eax
pop eax
pop ecx
jne 0x40501a
xor edx, edx
div dword [ebx + 8]
mov edx, dword [esp + 0xc]
test edx, edx
je 0x40500f
mov dword [edx], eax
pop esi
pop ebx
ret 4
cmp eax, ecx
je 0x40500a
mov eax, 0x64
jmp 0x40501f
call sub.KERNEL32.DLL_LocalAlloc
call fcn.00402684
xor eax, eax
jmp 0x40500a
mov eax, 0x67
jmp 0x40501f

Function at 0x40540d
Capabilities:
Get geographical location

Disassembly:
xor ecx, ecx
mov cl, byte [0x419042]
and cl, 3
cmp cl, 2
jbe 0x40541f
mov cl, 2
jmp 0x40530c

Function at 0x405424
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, edx
mov edi, ecx
mov edx, dword [ebx + 4]
sub edx, 0xd7b0
je 0x405335
cmp edx, 3
ja 0x4053d3
call dword [ebx + 0x24]
test eax, eax
je 0x405335
call fcn.00402684
mov dword [ebx + 4], 0xd7b3
mov dword [ebx + 8], esi
mov dword [ebx + 0x24], 0x40542e
mov dword [ebx + 0x1c], 0x4053b7
cmp byte [ebx + 0x48], 0
je 0x4053ba
mov eax, 0xc0000000
mov dl, byte [0x419042]
and edx, 0x70
shr edx, 2
mov edx, dword [edx + 0x4053ed]
mov ecx, 2
sub edi, 3
je 0x405397
mov ecx, 3
inc edi
je 0x405397
mov eax, 0x40000000
inc edi
mov dword [ebx + 4], 0xd7b2
je 0x405397
mov eax, 0x80000000
mov dword [ebx + 4], 0xd7b1
push 0
push 0x80
push ecx
push 0
push edx
push eax
lea eax, [ebx + 0x48]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
cmp eax, 0xffffffff
je 0x4053da
mov dword [ebx], eax
pop edi
pop esi
pop ebx
ret
mov dword [ebx + 0x24], 0x4053b7
cmp edi, 3
je 0x4053ca
push 0xfffffffffffffff6
jmp 0x4053cc
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetProcAddress
jmp 0x4053ac
mov eax, 0x66
jmp 0x4053e6
mov dword [ebx + 4], 0xd7b0
call sub.KERNEL32.DLL_LocalAlloc
call fcn.00402684
jmp 0x4053b3
mov ecx, 3
jmp 0x40530c

Function at 0x405cd4
Capabilities:
Create thread
Delete file

Disassembly:
push ebx
mov eax, 0xc
test eax, eax
je 0x405d21
cmp dword [0x4194cc], 0
jge 0x405cf1
mov eax, 0xe2
call fcn.00403444
push 0xc
push pe_nt_image_headers32
call sub.KERNEL32.DLL_CreateRemoteThread
mov ebx, eax
test ebx, ebx
jne 0x405d0f
mov eax, 0xe2
call fcn.00403444
jmp 0x405d1b
push ebx
mov eax, dword [0x4194cc]
push eax
call sub.KERNEL32.DLL_DeleteFileA
mov dword [0x4194dc], ebx
pop ebx
ret

Function at 0x405db4
Capabilities:
Create process on windows

Disassembly:
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
mov edx, 0x4170a0
push edx
mov dword [0x4194d4], eax
mov dword [edx + 4], eax
mov dword [edx + 8], 0
mov dword [edx + 0xc], 0
call fcn.00405d68
pop edx
pop eax
call fcn.00403228
ret
Function at 0x40d8e0
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
test eax, eax
je 0x40d90b
cmp byte [ebx + 0xc], 0
je 0x40d8f8
push eax
call sub.advapi32.dll_RegCreateKeyExA
jmp 0x40d8fe
push eax
call sub.advapi32.dll_RegSetValueExA
xor eax, eax
mov dword [ebx + 4], eax
lea eax, [ebx + 0x10]
call fcn.004034cc
pop ebx
ret

Function at 0x40e0b0
Capabilities:
Encode data using xor
Get hostname
Initialize winsock library

Disassembly:
push ebx
add esp, 0xfffffe70
push 0x4196ac
call fcn.00405fe8
push 0
push 0
push 0xffffffffffffffff
push 0
call fcn.00405ea8
mov dword [0x4196c4], eax
push 0x40e128
call fcn.00406000
mov ebx, eax
test ebx, ebx
je 0x40e0f4
mov edx, 0x40e138
mov eax, ebx
call fcn.00413184
mov dword [0x419718], eax
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
push pe_nt_image_headers32
push 0x4196cc
call sub.wsock32.dll_gethostname
mov edx, 0x11
mov eax, 0x4172f0
mov cl, byte [eax]
xor cl, 0xd
mov byte [eax], cl
inc eax
dec edx
jne 0x40e115
add esp, 0x190
pop ebx
ret

Function at 0x40e14c
Capabilities:
Resolve dns

Disassembly:
push ebx
push ecx
mov ebx, eax
mov eax, ebx
call fcn.004038ec
push eax
call sub.wsock32.dll_gethostbyname
mov edx, eax
test edx, edx
jne 0x40e16a
xor eax, eax
mov dword [esp], eax
jmp 0x40e196
mov eax, esp
mov ecx, dword [edx + 0xc]
mov ecx, dword [ecx]
mov cl, byte [ecx]
mov byte [eax], cl
mov ecx, dword [edx + 0xc]
mov ecx, dword [ecx]
mov cl, byte [ecx + 1]
mov byte [eax + 1], cl
mov ecx, dword [edx + 0xc]
mov ecx, dword [ecx]
mov cl, byte [ecx + 2]
mov byte [eax + 2], cl
mov edx, dword [edx + 0xc]
mov edx, dword [edx]
mov dl, byte [edx + 3]
mov byte [eax + 3], dl
mov eax, dword [esp]
pop edx
pop ebx
ret

Function at 0x40e28c
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x40e36b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4196ac
call fcn.00405ee0
xor eax, eax
push ebp
push 0x40e34e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 8]
push eax
call sub.wininet.dll_InternetGetConnectedState
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
cmp al, byte [0x4196a8]
je 0x40e336
cmp byte [ebp - 1], 0
je 0x40e323
lea eax, [ebp - 0xc]
mov edx, 0x4172f0
mov ecx, 0x11
call fcn.004036fc
mov eax, dword [ebp - 0xc]
call fcn.0040e14c
mov dword [0x419710], eax
cmp dword [0x419710], 0
jne 0x40e311
call fcn.00402fc0
jmp 0x40e355
call fcn.0040e19c
mov eax, dword [0x4196c4]
push eax
call fcn.00406050
jmp 0x40e32e
mov eax, dword [0x4196c4]
push eax
call fcn.00406040
mov al, byte [ebp - 1]
mov byte [0x4196a8], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e355
push 0x4196ac
call fcn.00405ff8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e372
lea eax, [ebp - 0xc]
call fcn.004034cc
ret
Function at 0x40ef64
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call fcn.0040821c
fld xword [0x40f0f0]
faddp st(1)
fstp qword [ebp - 0x10]
wait
lea edi, [ebp - 0x219]
lea eax, [ebp - 0x320]
call fcn.0040df64
lea edx, [ebp - 0x320]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0040df54
call fcn.0040821c
fsubr qword [ebp - 0x10]
fmul dword [0x40f0fc]
fmul dword [0x40f100]
call fcn.00402864
mov esi, eax
mov eax, esi
mov ecx, 0x3e8
cdq
idiv ecx
mov dword [ebp - 0x18], eax
mov eax, esi
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
lea eax, [ebp - 0x320]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.wsock32.dll_select
test eax, eax
jg 0x40f005
call fcn.00408a20
push 2
lea eax, [ebp - 0x219]
mov edx, edi
sub edx, eax
mov eax, 0x200
sub eax, edx
push eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.wsock32.dll_recv
mov esi, eax
test esi, esi
jg 0x40f031
call fcn.00408a20
mov byte [edi + esi], 0
mov ebx, edi
mov al, byte [ebx]
test al, al
je 0x40f048
sub al, 0xa
je 0x40f048
sub al, 3
je 0x40f048
inc ebx
jmp 0x40f037
cmp byte [ebx], 0
jne 0x40f06d
push 0
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.wsock32.dll_recv
cmp esi, eax
je 0x40f066
call fcn.00408a20
add edi, esi
jmp 0x40ef8a
mov esi, ebx
sub esi, edi
inc esi
push 0
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.wsock32.dll_recv
cmp esi, eax
je 0x40f08b
call fcn.00408a20
mov byte [ebx], 0
lea eax, [ebp - 0x219]
call fcn.00407838
cmp eax, 4
jbe 0x40f0a7
cmp byte [ebp - 0x216], 0x20
je 0x40f0b8
call fcn.0040821c
fcomp qword [ebp - 0x10]
fnstsw ax
sahf
jb 0x40ef84
mov eax, dword [ebp - 4]
call fcn.00403728
mov edx, eax
test edx, edx
jle 0x40f0e5
mov esi, 1
lea eax, [ebp - 0x219]
mov cl, byte [eax]
mov ebx, dword [ebp - 4]
cmp cl, byte [ebx + esi - 1]
je 0x40f0e0
xor eax, eax
jmp 0x40f0e7
inc esi
inc eax
dec edx
jne 0x40f0d1
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f104
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
add ebx, ebx
inc ebx
test ebx, ebx
js 0x40f121
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x40f11a
mov edx, esp
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004038dc
xor eax, eax
push ebp
push 0x40f1a9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov edx, ebx
mov ecx, esi
mov eax, dword [ebp - 4]
call fcn.00407ee0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00403564
push 0
mov eax, dword [ebp - 4]
call fcn.00403728
push eax
lea eax, [ebp - 4]
call fcn.004038f8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.wsock32.dll_send
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403728
cmp ebx, eax
je 0x40f18e
call fcn.00408a20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f1b0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004034f0
ret
Function at 0x40f1bc
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov ebx, eax
mov byte [ebp - 9], 0
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40f371
xor eax, eax
push ebp
push 0x40f35e
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x1c], 2
push 0x19
call sub.wsock32.dll_htons
mov word [ebp - 0x1a], ax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push 0x10
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_connect
inc eax
jne 0x40f224
call fcn.00408a20
push ebp
mov eax, 0x40f388
call fcn.0040ef64
pop ecx
test al, al
jne 0x40f239
call fcn.00408a20
push ebp
mov eax, dword [0x4184ac]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 6
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x40f394
call fcn.0040f104
pop ecx
push ebp
xor eax, eax
call fcn.0040ef64
pop ecx
test al, al
jne 0x40f268
call fcn.00408a20
push ebp
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x40f3a8
call fcn.0040f104
pop ecx
push ebp
mov eax, 0x40f3c4
call fcn.0040ef64
pop ecx
test al, al
jne 0x40f295
call fcn.00408a20
mov ebx, dword [ebp + 8]
test ebx, ebx
jle 0x40f2d7
mov esi, 1
push ebp
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x40f3d0
call fcn.0040f104
pop ecx
push ebp
mov eax, 0x40f3c4
call fcn.0040ef64
pop ecx
test al, al
jne 0x40f2d3
cmp esi, 1
jne 0x40f2d7
call fcn.00408a20
inc esi
dec ebx
jne 0x40f2a1
push ebp
lea edx, [ebp - 0x24]
or ecx, 0xffffffff
mov eax, 0x40f3e8
call fcn.0040f104
pop ecx
push ebp
mov eax, 0x40f3f8
call fcn.0040ef64
pop ecx
test al, al
jne 0x40f2fe
call fcn.00408a20
push ebp
mov dword [ebp - 0x34], edi
mov byte [ebp - 0x30], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea edx, [ebp - 0x34]
mov ecx, 1
mov eax, 0x40f404
call fcn.0040f104
pop ecx
push ebp
xor eax, eax
call fcn.0040ef64
pop ecx
test al, al
jne 0x40f335
call fcn.00408a20
push ebp
lea edx, [ebp - 0x24]
or ecx, 0xffffffff
mov eax, 0x40f420
call fcn.0040f104
pop ecx
mov byte [ebp - 9], 1
push ebp
xor eax, eax
call fcn.0040ef64
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40f368
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_closesocket
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40f8f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Encode data using xor
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x40fb09
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x40fae1
xor eax, eax
push ebp
push 0x40fada
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x24], 2
push 0x800
call sub.wsock32.dll_htons
mov word [ebp - 0x22], ax
mov eax, dword [0x4184a4]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
push 0x10
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_connect
inc eax
jne 0x40f97b
call fcn.00402fc0
jmp 0x40fae1
lea eax, [ebp - 0x14]
call fcn.0040f858
push 0
mov eax, dword [ebp - 0x14]
call fcn.00403728
push eax
lea eax, [ebp - 0x14]
call fcn.004038f8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_send
mov ebx, eax
mov eax, dword [ebp - 0x14]
call fcn.00403728
cmp ebx, eax
je 0x40f9b8
call fcn.00402fc0
jmp 0x40fae1
lea eax, [ebp - 0xc]
call fcn.004034cc
lea eax, [ebp - 0x10]
mov edx, 0x400
call fcn.00403a5c
push 0
push 0x400
lea eax, [ebp - 0x10]
call fcn.004038f8
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
test ebx, ebx
jl 0x40f9f6
test ebx, ebx
jne 0x40fa00
cmp dword [ebp - 0xc], 0
jne 0x40fa00
call fcn.00402fc0
jmp 0x40fae1
test ebx, ebx
je 0x40fa24
lea eax, [ebp - 0x28]
push eax
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00403930
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0xc]
call fcn.00403730
jmp 0x40f9cd
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_closesocket
mov eax, dword [ebp - 0xc]
call fcn.00403728
mov esi, eax
test esi, esi
jle 0x40fa73
mov ebx, 1
mov eax, dword [ebp - 0x14]
call fcn.00403728
push eax
mov eax, ebx
dec eax
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, dword [ebp - 0x14]
mov al, byte [eax + edx]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
xor al, dl
push eax
lea eax, [ebp - 0xc]
call fcn.004038f8
pop edx
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x40fa40
push 0x41972c
call fcn.00405ee0
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.004072fc
mov edx, dword [ebp - 0x2c]
mov eax, 0x419748
call fcn.00403520
mov ecx, 0x40fb24
mov edx, dword [0x419748]
mov eax, dword [0x412f1c]
call fcn.004138fc
push 0x41972c
call fcn.00405ff8
mov eax, dword [0x419744]
push eax
call fcn.00406050
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fae1
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_closesocket
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fb10
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004034f0
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004034f0
ret
Function at 0x40fb64
Capabilities:
Create udp socket
Encode data using xor
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004038dc
lea esi, [ebp - 0x10]
xor eax, eax
push ebp
push 0x40fd80
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov edi, 0xdeadface
mov eax, dword [ebp - 4]
call fcn.00403728
mov ebx, eax
test ebx, ebx
jle 0x40fbcf
mov dword [esi], 1
lea eax, [ebp - 4]
call fcn.004038f8
mov edx, dword [esi]
lea eax, [eax + edx - 1]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [esi]
movzx eax, byte [eax + edx - 1]
xor eax, edi
pop edx
mov byte [edx], al
sub edi, 0xd
inc dword [esi]
dec ebx
jne 0x40fba9
call fcn.0040e28c
test al, al
jne 0x40fbe7
push 0xffffffffffffffff
mov eax, dword [0x418580]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_UnhandledExceptionFilter
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x40fd6a
xor eax, eax
push ebp
push 0x40fd63
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x30], 2
push 0x800
call sub.wsock32.dll_htons
mov word [ebp - 0x2e], ax
mov eax, dword [0x4184a4]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
push 0x10
lea eax, [ebp - 0x30]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403728
push eax
lea eax, [ebp - 4]
call fcn.004038f8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_sendto
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00403728
cmp ebx, eax
je 0x40fc66
call fcn.00402fc0
jmp 0x40fd6a
call fcn.0040821c
fld xword [0x40fd94]
faddp st(1)
fstp qword [ebp - 0x20]
wait
lea eax, [ebp - 0x134]
call fcn.0040df64
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 0xc]
call fcn.0040df54
call fcn.0040821c
fsubr qword [ebp - 0x20]
fmul dword [0x40fda0]
fmul dword [0x40fda4]
call fcn.00402864
mov ecx, eax
mov eax, ecx
mov ebx, 0x3e8
cdq
idiv ebx
mov dword [ebp - 0x18], eax
mov eax, ecx
mov ecx, 0x3e8
cdq
idiv ecx
imul eax, edx, 0x3e8
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
lea eax, [ebp - 0x134]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
jg 0x40fcec
call fcn.00402fc0
jmp 0x40fd6a
mov dword [esi], 0x10
push esi
lea eax, [ebp - 0x30]
push eax
push 0
push 0x41
lea eax, [ebp - 0x175]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_recvfrom
mov dword [esi], eax
mov eax, dword [ebp - 4]
call fcn.00403728
inc eax
cmp eax, dword [esi]
jne 0x40fc77
lea eax, [ebp - 4]
call fcn.004038f8
mov ecx, dword [esi]
dec ecx
lea edx, [ebp - 0x174]
call fcn.004070b8
test al, al
je 0x40fc77
cmp byte [ebp - 0x175], 1
sete al
add eax, eax
dec eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fd6a
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_closesocket
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fd87
lea eax, [ebp - 4]
call fcn.004034cc
ret
Function at 0x4111d0
Capabilities:
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
add esp, 0xffffffec
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [0x4197d0], eax
mov word [esp + 4], 2
mov word [esp + 6], 0
xor eax, eax
mov dword [esp + 8], eax
push 0x10
lea eax, [esp + 8]
push eax
mov eax, dword [0x4197d0]
push eax
call sub.wsock32.dll_bind
push 5
mov eax, dword [0x4197d0]
push eax
call sub.wsock32.dll_listen
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
mov eax, dword [0x4197d0]
push eax
call sub.wsock32.dll_getsockname
push 0
push 0
lea eax, [esp + 8]
push eax
mov ecx, 0x41117c
xor edx, edx
xor eax, eax
call fcn.00403488
mov ax, word [esp + 6]
add esp, 0x14
ret

Function at 0x4113c4
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
ret

Function at 0x411644
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
pop ebp
ret 0x2c

Function at 0x41170c
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
pop ebp
ret 0x1c

Function at 0x411914
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
pop ebp
ret 0x30

Function at 0x411994
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
pop ebp
ret 0xc

Function at 0x411a10
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
pop ebp
ret 0x14
Function at 0x413eb0
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x413eb9
mov eax, dword [ebp - 4]
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x2018], edx
mov dword [ebp - 0x201c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x414016
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x413ff8
xor edx, edx
push ebp
push 0x413ff1
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0x2000
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2014]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
je 0x413f44
call fcn.00402fc0
jmp 0x413ff8
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x413fda
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2008]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test byte [eax], 2
je 0x413f77
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff4
call fcn.00413eb0
pop ecx
jmp 0x413fd1
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax + 8]
test ebx, ebx
je 0x413fd1
xor eax, eax
push ebp
push 0x413fc7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x201c]
mov edx, ebx
call fcn.00403684
mov eax, dword [ebp - 0x201c]
lea edx, [ebp - 0x2018]
call fcn.004093b0
mov eax, dword [ebp - 0x2018]
call fcn.00413bcc
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x413fd1
add dword [ebp - 0x14], 0x20
dec dword [ebp - 0x10]
jne 0x413f5d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413ff8
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetCloseEnum
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41401d
lea eax, [ebp - 0x201c]
mov edx, 2
call fcn.004034f0
ret

Function at 0x414e9c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
sidt [ebp - 6]
mov eax, dword [ebp - 4]
movzx edx, word [eax + 6]
shl edx, 0x10
movzx eax, word [eax]
add edx, eax
and edx, 0xfffff000
mov eax, edx
jmp 0x414ec4
sub eax, 0x1000
cmp word [eax], 0x5a4d
jne 0x414ebf
mov edx, dword [eax + 0x3c]
add edx, eax
cmp dword [edx], 0x4550
jne 0x414ebf
pop ecx
pop ecx
pop ebp
ret

Function at 0x414edc
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x419a48]
lea edx, [ebp + 8]
int 0x2e
pop ebp
ret 8
Function at 0x4158cc
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov word [ebp - 0x18], 2
mov eax, dword [ebp + 8]
mov ax, word [eax - 2]
mov word [ebp - 0x16], ax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov dword [ebp - 0x14], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push ebx
call sub.wsock32.dll_connect
test eax, eax
jne 0x415949
push 0
push esi
push edi
push ebx
call sub.wsock32.dll_send
cmp esi, eax
jne 0x415949
push 0
push 8
lea eax, [ebp - 8]
push eax
push ebx
call sub.wsock32.dll_recv
test eax, eax
jle 0x415949
push 0
mov eax, dword [0x4183c0]
call fcn.00407838
inc eax
push eax
push 0x4183c0
push ebx
call sub.wsock32.dll_send
push ebx
call sub.wsock32.dll_closesocket
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret