joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448585
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44869d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44869d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004633be
mov esi, eax
test esi, esi
je 0x44869d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44869d
mov ecx, esi
call fcn.004484f0
cmp edi, eax
jge 0x44869d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x448623
mov dword [esp + 0x34], 1
jmp 0x44867e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44869d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00447a90
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x463d62
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x463d9a
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004669b7
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046698f
jmp 0x463da6
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x465450
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x465492
call fcn.0046cc7c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x465492
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x465489
xor eax, eax
jmp 0x46549a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004654a0
pop edi
pop esi
pop ebx
ret 4
Function at 0x46d33a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46d368
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46d386
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046d2a0
jmp 0x46d386
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46d386
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046d2a0
test edi, edi
mov eax, edi
jne 0x46d370
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x405cf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x405ea3
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseEventLog]
nop dword [eax]
push 0
call esi
add byte [edi + ebp], 0x6c
push 0
call esi
add byte [edi + ebp], 0xf1
push 0
call esi
xor byte [edi + ebp], 0xed
push 0
call esi
add byte [edi + ebp], 0xa4
push 0
call esi
add byte [edi + ebp], 0x9b
push 0
call esi
add byte [edi + ebp], 0xb1
push 0
call esi
add byte [edi + ebp], 0x8a
push 0
call esi
xor byte [edi + ebp], 0x25
push 0
call esi
add byte [edi + ebp], 0x19
push 0
call esi
add byte [edi + ebp], 0xd3
push 0
call esi
xor byte [edi + ebp], 0x90
push 0
call esi
add byte [edi + ebp], 0xfe
push 0
call esi
add byte [edi + ebp], 7
push 0
call esi
add byte [edi + ebp], 0xb2
push 0
call esi
add byte [edi + ebp], 0x7d
push 0
call esi
add byte [edi + ebp], 0xf2
push 0
call esi
xor byte [edi + ebp], 0xa6
push 0
call esi
add byte [edi + ebp], 0xaa
push 0
call esi
add byte [edi + ebp], 0x85
push 0
call esi
add byte [edi + ebp], 0x9c
push 0
call esi
add byte [edi + ebp], 0x8d
push 0
call esi
add byte [edi + ebp], 0x28
push 0
call esi
add byte [edi + ebp], 0xe9
push 0
call esi
add byte [edi + ebp], 0x46
push 0
call esi
add byte [edi + ebp], 0xa6
push 0
call esi
xor byte [edi + ebp], 0x9a
push 0
call esi
add byte [edi + ebp], 0x3c
push 0
call esi
add byte [edi + ebp], 0x4d
push 0
call esi
add byte [edi + ebp], 0x8d
push 0
call esi
add byte [edi + ebp], 0xfc
push 0
call esi
add byte [edi + ebp], 0x5b
push 0
call esi
xor byte [edi + ebp], 0x1b
push 0
call esi
xor byte [edi + ebp], 0x66
push 0
call esi
xor byte [edi + ebp], 0x7e
push 0
call esi
add byte [edi + ebp], 0xd4
push 0
call esi
add byte [edi + ebp], 0x34
push 0
call esi
xor byte [edi + ebp], 0xf2
push 0
call esi
add byte [edi + ebp], 0xfb
push 0
call esi
add byte [edi + ebp], 0x3c
push 0
call esi
xor byte [edi + ebp], 0xcd
push 0
call esi
add byte [edi + ebp], 0xcf
push 0
call esi
xor byte [edi + ebp], 8
push 0
call esi
add byte [edi + ebp], 0x21
push 0
call esi
xor byte [edi + ebp], 0xa6
push 0
call esi
add byte [edi + ebp], 0xf3
push 0
call esi
xor byte [edi + ebp], 0x80
push 0
call esi
add byte [edi + ebp], 0xa7
push 0
call esi
add byte [edi + ebp], 0xd0
push 0
call esi
add byte [edi + ebp], 0x98
inc edi
cmp edi, ebx
jb 0x405d10
pop esi
pop ebp
pop edi
pop ebx
ret
Function at 0x4061b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push esi
push edi
push 0
push str.Armor:__p
call fcn.00406210
add esp, 8
mov eax, 0x1a1
cmp eax, 0x24
ja 0x4061cd
call 0x3dcbc62d
xor byte [eax], al
add byte [eax], al
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x450000], eax
sub eax, eax
je 0x4061ec
call 0xd040ca3a
add al, byte [eax]
push 0x2d000
push section..Pack
call fcn.00405cf0
add esp, 8
call fcn.004059f0
pop edi
xor eax, eax
pop esi
ret

Function at 0x406bb1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406bf0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x406bf0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406bf0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406bf0
cmp dword [ecx + 0x74], 0xe
jbe 0x406bf0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40d7f1
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41beb0
push 0x41bea8
push str.FlsAlloc
push 0x1e
call fcn.0040d6b2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d825
push dword [ebp + 8]
mov ecx, esi
call dword [0x41911c]
call esi
jmp 0x40d82b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d86f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41bec0
push 0x41beb8
push str.FlsGetValue
push 0x20
call fcn.0040d6b2
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d8a6
push dword [ebp + 8]
mov ecx, esi
call dword [0x41911c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x410ba4
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x410c41
push ebx
push esi
call fcn.00410b6d
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00410ab6
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x410bee
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x410c40
push edi
push eax
call fcn.0040dfa4
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x410c0e
call fcn.0040d545
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x410c3f
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00410ab6
add esp, 0x20
test eax, eax
jne 0x410c2d
push edi
call fcn.0040d545
jmp 0x410c35
push ebx
call fcn.0040d545
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4184f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41851d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41851d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4011b0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x58
mov eax, dword [0x426760]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x6c]
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.USER32.dll_BeginPaint]
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [esp + 0x24]
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ecx
mov ebx, eax
call esi
push ebx
mov dword [esp + 0x14], eax
call esi
mov edx, dword [0x42814c]
mov esi, eax
mov eax, dword [0x41c274]
push edx
push eax
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebp, eax
push ebp
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [0x41c274]
mov edx, dword [0x42814c]
xor eax, eax
push eax
mov dword [0x42800c], eax
mov dword [0x428010], eax
mov dword [0x428014], ecx
mov dword [0x428018], edx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
push 0x42800c
push esi
call dword [sym.imp.USER32.dll_FillRect]
mov eax, dword [0x4292a4]
mov edx, dword [0x41c364]
mov ecx, dword [0x41c274]
add edx, eax
push 0
mov dword [0x42800c], 0
mov dword [0x428010], eax
mov dword [0x428014], ecx
mov dword [0x428018], edx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
push 0x42800c
push esi
call dword [sym.imp.USER32.dll_FrameRect]
push 1
push esi
call dword [sym.imp.GDI32.dll_SetBkMode]
push 0xffffff
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [0x429290]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [str._n_n_________RIGHTMOUSEB___EXIT___PAGEDOWN___SCRLDOWN___PAGEUP___SCRLUP_n________________________________________________________________________________n_n]
push 0x100
lea ecx, [esp + 0x18]
push ecx
push 0xffffffffffffffff
xor eax, eax
push edx
push esi
mov dword [esp + 0x28], 0xa
mov dword [esp + 0x2c], 6
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
call dword [sym.imp.USER32.dll_DrawTextA]
push 0xcc0020
mov eax, dword [0x4292a4]
mov ecx, dword [0x41c364]
mov edx, dword [0x41c274]
push eax
push 0
push esi
push ecx
push edx
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push ebp
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x10]
push eax
call esi
push ebx
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
lea ecx, [esp + 0x24]
push ecx
push edi
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [esp + 0x64]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004063b5
add esp, 0x58
ret

Function at 0x401d80
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push 0x44
lea eax, [esp + 0x18]
push 0
push eax
call fcn.00406580
mov eax, dword [esp + 0x68]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
push eax
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov ecx, dword [esp + 4]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
pop esi
add esp, 0x54
ret
Function at 0x402080
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
sub esp, 0x10c
mov eax, dword [0x426760]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push str.BReWErS.dll
lea ecx, [esp + 0xc]
push 0x104
push ecx
call fcn.004066cb
add esp, 0xc
push 0x415c28
push 0x7f
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4020fb
push eax
push str.error
push str.couldnt_findresource
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.004063b5
add esp, 0x10c
ret
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x402132
push eax
push str.error
push str.couldnt_loadresource
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.004063b5
add esp, 0x10c
ret
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x40216b
push eax
push str.error
push str.couldnt_lockresource
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
xor eax, eax
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.004063b5
add esp, 0x10c
ret
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea edx, [esp + 0x28]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
test esi, esi
push 0
jne 0x4021c7
push str.error
push str.couldnt_createfile
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.004063b5
add esp, 0x10c
ret
lea eax, [esp + 0x10]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x40220c
push eax
push str.error
push str.couldnt_writefile
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.004063b5
add esp, 0x10c
ret
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 0x114]
pop edi
pop ebx
pop esi
xor ecx, esp
mov eax, 1
call fcn.004063b5
add esp, 0x10c
ret
Function at 0x402ac8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [0x430cd0]
cdq
idiv dword [0x430ce0]
mov edi, eax
test ebx, ebx
jne 0x402af0
xor eax, eax
jmp 0x402cce
add esp, 0xfffffff4
push ebx
call fcn.00402cd8
movzx eax, byte [ebx + 0x128]
mov dword [ebx + 0x12c], eax
movsx eax, word [ebx + 0x24]
mov dword [ebx + 0x138], eax
mov dword [ebx + 0x140], 0
mov dword [ebx + 0x144], 0
mov dword [ebx + 0x150], 0xffffffff
mov dword [ebx + 0x14c], 0xffffffff
mov dword [ebx + 8], 0
mov dword [ebx + 0x134], 0
mov dword [ebx + 0x148], 0
mov dword [ebx + 0x154], 0
add esp, 0x10
mov eax, dword [ebx + 0x158]
test eax, eax
je 0x402b73
add esp, 0xfffffff4
push ebx
call eax
add esp, 0x10
add esp, 0xfffffff8
movsx eax, word [ebx + 0x26]
push eax
push ebx
call fcn.004028c8
movsx edx, word [ebx + 0x14]
lea eax, [edx + edx*4]
lea eax, [edx + eax*4]
lea eax, [edx + eax*2]
add esp, 0xfffffffc
shl eax, 2
push eax
push 0
push 0x429ee0
call fcn.00406580
add esp, 0x20
xor edx, edx
cmp word [ebx + 0x14], 0
jle 0x402bcc
mov esi, 0x429ee4
mov ecx, 0x42b4c0
nop
mov dword [esi], ecx
add esi, 0xac
add ecx, 0x58
inc edx
movsx eax, word [ebx + 0x14]
cmp edx, eax
jl 0x402bb8
mov dword [0x4266d0], ebx
add esp, 0xfffffff8
push 1
lea eax, [edi + edi*2]
add eax, eax
push eax
call fcn.00405f78
mov dword [0x429ed0], eax
mov ebx, 0x42b480
mov esi, dword [0x430cd0]
shl esi, 2
add esp, 0xfffffff8
push 1
push esi
call fcn.00405f78
mov dword [0x42b4a0], eax
mov dword [ebx + 0x10], 0xc
mov dword [0x42b480], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x14], 0xffffffff
add esp, 0x20
add esp, 0xfffffffc
push 0x20
push ebx
push dword [0x430cf0]
call sub.WINMM.dll_waveOutPrepareHeader
add esp, 0xfffffffc
push 1
mov eax, dword [0x430cd0]
shl eax, 3
add eax, 0x100
push eax
call fcn.00405f78
mov dword [0x42b460], eax
add eax, 0xf
and al, 0xf0
mov dword [0x42b4b0], eax
mov dword [0x4266bc], 0
add esp, 0x10
lea esi, [esi]
call fcn.0040264c
mov eax, dword [0x4266bc]
test eax, eax
jne 0x402c74
add esp, 0xfffffffc
push 0x20
push 0x42b480
push dword [0x430cf0]
call sub.WINMM.dll_waveOutWrite
mov byte [0x4266b4], 0
add esp, 0xfffffffc
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4027f0
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x4266b8], eax
push 0xf
mov eax, dword [0x4266b8]
push eax
call sub.KERNEL32.DLL_SetThreadPriority
mov eax, 1
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x4063b5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426760]
jne 0x4063bf
repz ret
jmp fcn.00407e94

Function at 0x40d250
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040924c
xor ebx, ebx
cmp dword [0x429c58], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40d325
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40d290
xor eax, eax
jmp 0x40d3e9
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x41a630
push edi
call esi
cmp eax, ebx
je 0x40d289
push eax
call fcn.004091e9
mov dword [esp], 0x41a620
push edi
mov dword [0x429c58], eax
call esi
push eax
call fcn.004091e9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x429c5c], eax
call esi
push eax
call fcn.004091e9
mov dword [0x429c60], eax
lea eax, [ebp - 8]
push eax
call fcn.004097c5
test eax, eax
pop ecx
pop ecx
je 0x40d2f3
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004079ab
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40d325
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004091e9
cmp eax, ebx
pop ecx
mov dword [0x429c68], eax
je 0x40d325
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004091e9
pop ecx
mov dword [0x429c64], eax
mov eax, dword [0x429c64]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40d39e
cmp dword [0x429c68], esi
je 0x40d39e
push eax
call fcn.00409255
pop ecx
call eax
cmp eax, ebx
je 0x40d36b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x429c68]
call fcn.00409255
pop ecx
call eax
test eax, eax
je 0x40d36b
test byte [ebp - 0x18], 1
jne 0x40d39e
lea eax, [ebp - 0xc]
push eax
call fcn.004097fc
test eax, eax
pop ecx
je 0x40d386
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004079ab
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40d395
or dword [ebp + 0x10], 0x200000
jmp 0x40d3cf
or dword [ebp + 0x10], 0x40000
jmp 0x40d3cf
mov eax, dword [0x429c5c]
cmp eax, esi
je 0x40d3cf
push eax
call fcn.00409255
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40d3cf
mov eax, dword [0x429c60]
cmp eax, esi
je 0x40d3cf
push dword [ebp - 4]
push eax
call fcn.00409255
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x429c58]
call fcn.00409255
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4012c5
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x4050dd
call fcn.00404aa8
sub esp, 0x19c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
lea ecx, [esi + 4]
call fcn.00401000
xor ebx, ebx
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], ebx
call fcn.00401000
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 1
call fcn.00401000
lea ecx, [esi + 0x7c]
mov byte [ebp - 4], 2
call fcn.00401000
lea eax, [ebp - 0x1a8]
mov dword [esi], 0x4062a0
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
or dword [esi + 0xa8], 0xffffffff
mov dword [esi + 0xac], eax
lea eax, [ebp - 0x14]
push 5
push eax
lea eax, [esi + 0xb0]
push eax
mov byte [esi + 0xb5], bl
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0x13], 0x32
mov byte [ebp - 0x12], 0x30
mov byte [ebp - 0x11], 0x31
mov byte [ebp - 0x10], 0x30
call sub.MSVCRT.dll_memcpy
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
leave
ret

Function at 0x401430
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
call fcn.00401a4c
push dword [esi + 0xac]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor ebx, ebx
mov byte [esi + 0xb5], bl
mov eax, dword [0x4084e0]
cmp eax, ebx
je 0x40146b
cmp eax, 4
je 0x40146b
cmp eax, 5
jne 0x4014ff
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0xa8], eax
je 0x4014ff
cmp dword [0x4084e0], ebx
je 0x401491
push 0x4084e4
jmp 0x401494
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
cmp edi, ebx
je 0x4014ff
cmp dword [0x4084e0], ebx
mov word [ebp - 0x10], 2
je 0x4014b7
mov ax, word [0x408030]
push eax
jmp 0x4014ba
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
mov eax, dword [edi + 0xc]
push 0x10
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0xa8]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x4014ff
cmp dword [0x4084e0], 5
jne 0x401503
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.0040152d
test al, al
jne 0x401503
xor al, al
jmp 0x401526
push 1
push ebx
push ebx
push esi
push 0x4017e4
push ebx
push ebx
mov byte [esi + 0xb5], 1
call fcn.0040497b
mov dword [esi + 0xa4], eax
add esp, 0x1c
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401b89
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
cmp eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.WS2_32.dll_send]
mov ebx, ecx
mov dword [ebp + 8], eax
jb 0x401be9
and dword [ebp - 8], 0
push 0
push dword [ebp + 0x10]
push esi
push dword [ebx + 0xa8]
call edi
test eax, eax
jg 0x401bca
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xf
jl 0x401baf
cmp dword [ebp - 8], 0xf
je 0x401c1f
add dword [ebp - 4], eax
add esi, dword [ebp + 0x10]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x10]
sub dword [ebp + 8], eax
cmp dword [ebp + 8], eax
jae 0x401bab
cmp dword [ebp + 8], 0
jle 0x401c17
and dword [ebp + 0x10], 0
push 0
push dword [ebp + 8]
push esi
push dword [ebx + 0xa8]
call edi
test eax, eax
jg 0x401c0e
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0xf
jl 0x401bf3
cmp dword [ebp + 0x10], 0xf
je 0x401c1f
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x401c22
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 0xc