joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ce1c
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push 8
mov eax, 0x464c3a
call fcn.00435814
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ce4b
test al, 1
je 0x40ce4b
and eax, 0xfffffffe
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x40cf03
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
jne 0x40ce76
mov dword [ebp - 0x10], 1
jmp 0x40cf03
mov ecx, dword [ebp + 8]
call fcn.004093b8
push 0x485444
lea ecx, [ebp - 0x14]
call fcn.004061f3
push 0
mov byte [ebp - 4], 1
call fcn.0043996a
mov edi, eax
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
pop ecx
mov ebx, edx
jle 0x40ceb2
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.0040621b
mov eax, dword [ebp + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
lea eax, [ebp - 0x14]
push edx
push ebx
push edi
push esi
push str._s.bak_I64d_03d
push eax
call fcn.0040cdc8
mov esi, dword [ebp - 0x14]
add esp, 0x18
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
test eax, eax
je 0x40cefb
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov dword [ebp - 0x10], 1
lea ecx, [esi - 0x10]
call fcn.00405c12
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00405c12
mov eax, dword [ebp - 0x10]
call fcn.004358ec
ret

Function at 0x40d660
Capabilities:
Create http request

Disassembly:
push 0x228
mov eax, 0x464d3d
call fcn.0043587d
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 0x21c], esi
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov dword [ebp - 4], ecx
mov dword [esi], vtable.CInternetSession.0
cmp eax, ecx
jne 0x40d6c2
push 0x104
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push dword [ebp + 0x18]
push ebx
push edi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 4], eax
test eax, eax
jne 0x40d6fe
push str.Failed_to_open_an_internet_session
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.0040d57c
add esp, 0xc
push 0x47a1c8
lea eax, [ebp - 0x234]
push eax
call fcn.00437b7b
mov eax, esi
call fcn.00435900
ret 0x14

Function at 0x40d78d
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x40d7d2
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push 0x46d0e0
push dword [esi + 4]
push eax
call fcn.0040d57c
add esp, 0x10
push 0x47a1c8
lea eax, [ebp - 0x18]
push eax
call fcn.00437b7b
mov eax, dword [ebp + 8]
pop esi
leave
ret 8
Function at 0x40dc5d
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push 0xd4
mov eax, 0x464ddc
call fcn.0043587d
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, ecx
test edi, edi
je 0x40dcd7
cmp edi, 0xffffffff
je 0x40dcd7
test esi, esi
je 0x40dcd7
cmp esi, 0xffffffff
je 0x40dcd7
push str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
lea ecx, [ebp - 0xdc]
call fcn.004076dd
and dword [ebp - 4], 0
push edi
lea ecx, [ebp - 0xdc]
call fcn.00408597
lea eax, [ebp - 0xe0]
push eax
push 0x20006
push 0
push dword [ebp - 0xdc]
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40dce1
mov ecx, dword [ebp - 0xdc]
add ecx, 0xfffffff0
call fcn.00405c12
xor eax, eax
call fcn.00435900
ret 8
push 0x62
push esi
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpynW]
lea eax, [ebp - 0xd8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov esi, eax
xor eax, eax
lea edi, [ebx + 8]
push edi
mov word [ebp + esi*2 - 0xd6], ax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
lea eax, [esi + esi + 4]
push eax
lea eax, [ebp - 0xd8]
push eax
push 1
xor ebx, ebx
push ebx
push str.NameServer
push dword [ebp - 0xe0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40dd3b
inc ebx
push dword [ebp - 0xe0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40dd52
test ebx, ebx
je 0x40dd52
xor ebx, ebx
inc ebx
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov ecx, dword [ebp - 0xdc]
add ecx, 0xfffffff0
call fcn.00405c12
mov eax, ebx
jmp 0x40dcd9

Function at 0x40e040
Capabilities:
Check if file exists
Create directory

Disassembly:
push 8
mov eax, 0x464e9d
call fcn.00435814
mov ebx, ecx
push dword [ebp + 8]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
and dword [ebp - 4], 0
call esi
test eax, eax
jne 0x40e107
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x10], esp
mov edi, esp
push eax
call fcn.00405e04
add eax, 0x10
pop ecx
mov dword [edi], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, ebx
call fcn.0040dd6e
push dword [ebp - 0x10]
mov byte [ebp - 4], 1
call esi
test eax, eax
jne 0x40e0d8
mov eax, dword [ebp - 0x10]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x14], esp
mov esi, esp
push eax
call fcn.00405e04
pop ecx
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.0040e040
test eax, eax
jne 0x40e0d8
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00405c12
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00405c12
xor eax, eax
call fcn.004358ec
ret 4
xor esi, esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x40e102
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00405c12
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00405c12
mov eax, esi
jmp 0x40e0d0
xor esi, esi
inc esi
jmp 0x40e0e8
xor esi, esi
jmp 0x40e0f3
Function at 0x40e10b
Capabilities:
Get common file path

Disassembly:
push 0x210
mov eax, 0x464ec0
call fcn.0043587d
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x218]
push ecx
push eax
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
mov ecx, esi
test eax, eax
je 0x40e149
lea eax, [ebp - 0x218]
push eax
jmp 0x40e14e
push 0x46c7fc
call fcn.004076dd
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00405c12
mov eax, esi
call fcn.00435900
ret 8
Function at 0x40e589
Capabilities:
Check http status code

Disassembly:
push 0x430
mov eax, 0x464fb7
call fcn.004358b3
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], ebx
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 4], ebx
push 0x46d258
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 1
call fcn.0040d660
push 0x400000
push 0xffffffffffffffff
push ebx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x434]
mov byte [ebp - 4], 2
call fcn.0040d7da
push ebx
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x43c]
push eax
push 0x20000013
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 3
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x41c], 4
call fcn.0040d847
push 0x485444
lea ecx, [ebp - 0x41c]
call fcn.004061f3
cmp dword [ebp - 0x43c], 0xc8
mov byte [ebp - 4], 4
jne 0x40e67e
mov esi, 0x400
push esi
lea eax, [ebp - 0x417]
push ebx
push eax
mov byte [ebp - 0x418], bl
call fcn.004374f0
add esp, 0xc
push esi
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x42c]
call fcn.0040d78d
cmp eax, ebx
jbe 0x40e67e
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x41c]
call fcn.0040d32a
jmp 0x40e653
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 0x428], ebx
je 0x40e69a
push dword [ebp - 0x428]
call esi
mov dword [ebp - 0x428], ebx
cmp dword [ebp - 0x434], ebx
je 0x40e6b0
push dword [ebp - 0x434]
call esi
mov dword [ebp - 0x434], ebx
mov edi, dword [ebp - 0x41c]
add edi, 0xfffffff0
push edi
call fcn.00405e04
pop ecx
mov ecx, dword [ebp - 0x420]
add eax, 0x10
mov dword [ecx], eax
mov ecx, edi
call fcn.00405c12
mov edi, vtable.CInternetHandle.0
mov dword [ebp - 0x42c], edi
cmp dword [ebp - 0x428], ebx
je 0x40e6f3
push dword [ebp - 0x428]
call esi
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x438], edi
cmp dword [ebp - 0x434], ebx
je 0x40e70f
push dword [ebp - 0x434]
call esi
mov dword [ebp - 0x434], ebx
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00405c12
mov eax, dword [ebp - 0x420]
call fcn.0043590f
ret
Function at 0x40fffd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.00408f00
push 1
push 3
mov ecx, esi
call fcn.0040bf14
push ecx
mov ecx, esp
mov dword [ebp - 4], esp
push 0x46d5dc
call fcn.004076dd
mov ecx, esi
call fcn.0040a9cb
xor eax, eax
push eax
push eax
push esi
push 0x40f781
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0xe0], eax
pop esi
leave
ret
Function at 0x410eb7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.00408ee0
push 1
push 3
mov ecx, esi
call fcn.004100ec
push ecx
mov ecx, esp
mov dword [ebp - 4], esp
push 0x46d5dc
call fcn.004076dd
mov ecx, esi
call fcn.0040a8e7
xor eax, eax
push eax
push eax
push esi
push 0x41063b
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi + 0xdc], eax
pop esi
leave
ret

Function at 0x41276e
Capabilities:
Terminate thread

Disassembly:
push 4
mov eax, 0x465490
call fcn.00435814
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CUICustomSecurityListViewCell.1.0
mov dword [esi + 0x70], vtable.CUICustomSecurityListViewCell.0
mov eax, dword [esi + 0xdc]
mov edi, dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov dword [ebp - 4], 8
test eax, eax
je 0x4127bb
push 0
push eax
call edi
push dword [esi + 0xdc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
and dword [esi + 0xdc], 0
mov eax, dword [esi + 0xe0]
test eax, eax
je 0x4127dd
push 0
push eax
call edi
push dword [esi + 0xe0]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
and dword [esi + 0xe0], 0
mov edi, dword [esi + 0x80]
jmp 0x4127f4
mov ecx, dword [edi]
test ecx, ecx
je 0x4127f1
mov eax, dword [ecx]
push 1
call dword [eax]
add edi, 4
cmp edi, dword [esi + 0x84]
jne 0x4127e5
mov eax, dword [esi + 0x84]
mov ecx, dword [esi + 0x80]
push eax
push ecx
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0x80]
call fcn.00411a68
mov ecx, dword [esi + 0xd8]
push 0x10
pop edi
sub ecx, edi
call fcn.00405c12
mov ecx, dword [esi + 0xd4]
sub ecx, edi
call fcn.00405c12
mov ecx, dword [esi + 0xd0]
sub ecx, edi
call fcn.00405c12
mov ecx, dword [esi + 0xc8]
sub ecx, edi
call fcn.00405c12
mov ecx, dword [esi + 0xc4]
sub ecx, edi
call fcn.00405c12
mov ecx, dword [esi + 0xc0]
sub ecx, edi
call fcn.00405c12
mov ecx, dword [esi + 0xbc]
sub ecx, edi
call fcn.00405c12
lea ecx, [esi + 0x80]
call fcn.0040590a
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00406d51
call fcn.004358ec
ret
Function at 0x412f70
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x483e68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
cmp eax, 0x4c
je 0x412fa0
cmp eax, 0x4d
je 0x412fa0
cmp eax, 0x4e
jne 0x41305c
cmp dword [esi + 0x10fc], 0
push edi
push dword [esi + 0x10f4]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, 0x405
push eax
je 0x412fc3
push 0x404
jmp 0x412fc4
push ebx
push dword [esi + 0x10f8]
call edi
push 0x4f
mov ecx, esi
call fcn.004169bd
test eax, eax
je 0x413004
cmp dword [eax + 0x9c], 0
je 0x413004
cmp dword [esi + 0x10fc], 0
push dword [esi + 0x10f4]
push dword [ebp + 0xc]
je 0x412ff7
push ebx
jmp 0x412ffc
push 0x404
push dword [esi + 0x10f8]
call edi
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x10f8]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
movzx eax, word [ebp - 0x18]
movzx ecx, word [ebp - 0x1c]
shl eax, 0x10
or eax, ecx
push eax
push ebx
push 0x40a
push dword [esi + 0x10f8]
call edi
pop edi
jmp 0x41305e
xor ebx, ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov dword [eax], ebx
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00435805
leave
ret 0x10
Function at 0x41345f
Capabilities:
Reference 114dns dns server
Reference google public dns server
Reference opendns dns server

Disassembly:
push 0xc
mov eax, 0x465545
call fcn.00435814
mov dword [ebp - 0x18], ecx
mov esi, 0x485444
push esi
lea ecx, [ebp - 0x10]
call fcn.004061f3
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x14]
call fcn.004061f3
cmp dword [ebp + 0xc], 0x4c
mov byte [ebp - 4], 1
jne 0x4134b0
mov esi, str.114.114.114.114
push esi
call fcn.0043787e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.00407160
mov esi, str.114.114.115.115
jmp 0x4134f4
cmp dword [ebp + 0xc], 0x4d
jne 0x4134d3
mov esi, str.8.8.8.8
push esi
call fcn.0043787e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.00407160
mov esi, str.8.8.4.4
jmp 0x4134f4
cmp dword [ebp + 0xc], 0x4e
jne 0x413505
mov esi, str.208.67.222.222
push esi
call fcn.0043787e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.00407160
mov esi, 0x46d95c
push esi
call fcn.0043787e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00407160
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.004169bd
mov esi, dword [ebp - 0x10]
mov edi, eax
test edi, edi
je 0x41354b
push 1
push ecx
lea eax, [esi - 0x10]
mov dword [ebp + 0xc], esp
mov ebx, esp
push eax
call fcn.00405e04
pop ecx
add eax, 0x10
mov ecx, edi
mov dword [ebx], eax
call fcn.0040a841
push 1
mov ecx, edi
call fcn.0040ab58
push 0
push 1
mov ecx, edi
call fcn.0040aaba
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov dword [eax], 1
call fcn.00405c12
lea ecx, [esi - 0x10]
call fcn.00405c12
xor eax, eax
call fcn.004358ec
ret 0x10
Function at 0x41357d
Capabilities:
Reference 114dns dns server
Reference google public dns server
Reference opendns dns server

Disassembly:
push 0xc
mov eax, 0x465570
call fcn.00435814
mov dword [ebp - 0x18], ecx
mov esi, 0x485444
push esi
lea ecx, [ebp - 0x14]
call fcn.004061f3
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x10]
call fcn.004061f3
cmp dword [ebp + 0xc], 0x4c
mov byte [ebp - 4], 1
jne 0x4135ce
mov esi, str.114.114.114.114
push esi
call fcn.0043787e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00407160
mov esi, str.114.114.115.115
jmp 0x413612
cmp dword [ebp + 0xc], 0x4d
jne 0x4135f1
mov esi, str.8.8.8.8
push esi
call fcn.0043787e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00407160
mov esi, str.8.8.4.4
jmp 0x413612
cmp dword [ebp + 0xc], 0x4e
jne 0x413623
mov esi, str.208.67.222.222
push esi
call fcn.0043787e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.00407160
mov esi, 0x46d95c
push esi
call fcn.0043787e
pop ecx
push eax
push esi
lea ecx, [ebp - 0x10]
call fcn.00407160
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.004169bd
mov esi, dword [ebp - 0x10]
mov edi, eax
test edi, edi
je 0x413669
push 1
push ecx
lea eax, [esi - 0x10]
mov dword [ebp + 0xc], esp
mov ebx, esp
push eax
call fcn.00405e04
pop ecx
add eax, 0x10
mov ecx, edi
mov dword [ebx], eax
call fcn.00410046
push 1
mov ecx, edi
call fcn.0040ab58
push 0
push 1
mov ecx, edi
call fcn.0040aaba
mov eax, dword [ebp - 0x18]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp + 0x14]
lea ecx, [esi - 0x10]
mov dword [eax], 1
call fcn.00405c12
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00405c12
xor eax, eax
call fcn.004358ec
ret 0x10
Function at 0x413e4d
Capabilities:
Reference 114dns dns server

Disassembly:
push 8
mov eax, 0x465648
call fcn.00435814
push dword [ebp + 8]
call fcn.004169bd
mov ebx, eax
test ebx, ebx
je 0x413f35
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
mov edi, str.114.114.114.114
push edi
call fcn.004076dd
mov ecx, ebx
call fcn.0040a841
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
mov esi, str.114.114.115.115
push esi
call fcn.004076dd
mov ecx, ebx
call fcn.00410046
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push esi
call fcn.004076dd
and dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push edi
call fcn.004076dd
lea eax, [ebp + 8]
push eax
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.0040ace6
mov eax, dword [eax]
mov byte [ebp - 4], 2
push eax
mov ecx, 0x483dfc
mov byte [ebp - 4], 3
call fcn.0040e9c1
mov ecx, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
mov esi, eax
call fcn.00405c12
test esi, esi
jne 0x413f35
push 1
push 4
mov ecx, ebx
call fcn.004100ec
push 1
push 4
mov ecx, ebx
call fcn.0040bf14
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov esi, 0x46dab0
push esi
call fcn.004076dd
mov ecx, ebx
call fcn.0040a8e7
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.004076dd
mov ecx, ebx
call fcn.0040a9cb
call fcn.004358ec
ret 4
Function at 0x415bbd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 0x74]
call dword [sym.imp.USER32.dll_SetFocus]
push 5
push dword [esi + 0x74]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x98]
mov eax, dword [ecx]
call dword [eax + 0xd8]
mov eax, dword [ebp + 0x14]
and dword [eax], 0
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x416161
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00438820
mov eax, dword [0x483e68]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0x14]
xor eax, eax
push 0xffe
push eax
mov word [ebp - 0x1004], ax
lea eax, [ebp - 0x1002]
push eax
mov esi, ecx
call fcn.004374f0
add esp, 0xc
push 0x800
lea eax, [ebp - 0x1004]
push eax
push dword [esi + 0x74]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x1004]
push eax
lea ecx, [esi + 0x28]
call fcn.004073f1
call fcn.00407842
cmp eax, 0x13
jge 0x4161d8
push 1
push 0
push dword [esi + 0x74]
call dword [sym.imp.USER32.dll_InvalidateRect]
and dword [edi], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00435805
leave
ret 0x10
Function at 0x418b1d
Capabilities:
Create thread
Terminate thread

Disassembly:
push 0x20
mov eax, 0x465b92
call fcn.00435814
mov edi, ecx
push dword [ebp + 8]
call fcn.004169bd
mov esi, eax
xor ebx, ebx
mov dword [ebp - 0x18], esi
cmp dword [esi + 0xc8], ebx
jne 0x418cd5
push ebx
push dword [0x483dfc]
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.0040ab77
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00416ac1
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x2c]
mov esi, 0x483dfc
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00415415
mov eax, dword [ebp - 0x10]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x14], esp
push eax
call fcn.00405e04
mov ecx, dword [ebp - 0x14]
add eax, 0x10
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], esp
add eax, 0xfffffff0
mov dword [ebp - 0x14], esp
push eax
mov byte [ebp - 4], 3
call fcn.00405e04
pop ecx
mov ecx, dword [ebp - 0x14]
add eax, 0x10
mov dword [ecx], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00418784
mov esi, dword [edi + 0x30]
jmp 0x418c36
mov eax, dword [esi]
mov ecx, dword [eax + 0xe8]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
je 0x418bfa
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0xe8]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0xd0], ebx
je 0x418c33
push ecx
mov ecx, dword [ebp - 0x18]
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.0040ab77
mov ecx, dword [ebp - 0x14]
call fcn.004174dc
push ecx
mov ecx, dword [ebp - 0x18]
mov eax, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00416ac1
mov ecx, dword [ebp - 0x14]
call fcn.00417523
add esi, 4
cmp esi, dword [edi + 0x34]
jne 0x418bd7
mov ecx, dword [ebp - 0x18]
push ebx
call fcn.00416be1
mov ecx, dword [ebp - 0x18]
push 1
call fcn.00416b78
mov eax, dword [ebp - 0x10]
cmp dword [eax - 4], 1
jle 0x418c62
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040621b
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
jle 0x418c76
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.0040621b
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
push edi
push esi
push 0x40d
push dword [0x485eac]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
lea ecx, [ebp + 8]
call fcn.00409d8a
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00409d8a
push ebx
push ebx
push dword [0x485eac]
push 0x4176bb
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
lea ecx, [ebp - 0x2c]
mov dword [0x483dfc], eax
call fcn.00414faf
lea ecx, [edi - 0x10]
call fcn.00405c12
lea ecx, [esi - 0x10]
call fcn.00405c12
call fcn.004358ec
ret 4

Function at 0x418d45
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, eax
lea eax, [ecx + 1]
neg eax
sbb eax, eax
and eax, ecx
pop ebp
ret 4
Function at 0x418d64
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x483e68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 2
mov dword [ebp - 0x10], eax
pop eax
push dword [ebp + 0x18]
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00435805
leave
ret 0x14

Function at 0x418dbd
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x483e68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 2
mov dword [ebp - 0x10], eax
pop eax
push dword [ebp + 0x18]
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
mov esi, dword [ebp + 8]
and dword [ebp - 0x124], 0
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x124]
push eax
push 0
push 0
lea eax, [ebp - 0x118]
push eax
lea eax, [esi + 1]
push eax
mov dword [ebp - 0x11c], 0x10
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x118], 1
call dword [sym.imp.WS2_32.dll_select]
lea eax, [ebp - 0x118]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x418e6a
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.WS2_32.dll_recvfrom]
jmp 0x418e6d
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00435805
leave
ret 0x18
Function at 0x41927d
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
add ecx, 0x10f4
mov dword [ebp - 8], ecx
call fcn.00416329
test eax, eax
jle 0x4192e3
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_TerminateThread]
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00411878
mov ebx, eax
push 0
push dword [ebx + 0xf0]
call edi
and dword [ebx + 0xf0], 0
push 0
push dword [ebx + 0xec]
call edi
and dword [ebx + 0xec], 0
mov ecx, dword [ebp - 8]
inc dword [ebp - 4]
call fcn.00416329
cmp dword [ebp - 4], eax
jl 0x4192a1
pop edi
pop esi
pop ebx
leave
ret