joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4112f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
xor edx, edx
mov ecx, esp
xor edi, edi
mov eax, ecx
lea ebx, [esi + edx*4]
movzx ebx, byte [ebx + edi + 0x117]
mov byte [eax], bl
inc edi
inc eax
cmp edi, 4
jne 0x411308
inc edx
add ecx, 4
cmp edx, 4
jne 0x411304
xor edi, edi
mov ebx, esp
movzx edx, byte [ebx]
mov eax, esi
call fcn.00411438
push eax
movzx edx, byte [ebx + 4]
mov eax, esi
call fcn.0041144c
pop edx
xor dl, al
push edx
movzx edx, byte [ebx + 8]
mov eax, esi
call fcn.00411434
pop edx
xor dl, al
push edx
movzx edx, byte [ebx + 0xc]
mov eax, esi
call fcn.00411434
pop edx
xor dl, al
mov byte [esi + edi + 0x117], dl
movzx edx, byte [ebx]
mov eax, esi
call fcn.00411434
push eax
movzx edx, byte [ebx + 4]
mov eax, esi
call fcn.00411438
pop edx
xor dl, al
push edx
movzx edx, byte [ebx + 8]
mov eax, esi
call fcn.0041144c
pop edx
xor dl, al
push edx
movzx edx, byte [ebx + 0xc]
mov eax, esi
call fcn.00411434
pop edx
xor dl, al
mov byte [esi + edi + 0x11b], dl
movzx edx, byte [ebx]
mov eax, esi
call fcn.00411434
push eax
movzx edx, byte [ebx + 4]
mov eax, esi
call fcn.00411434
pop edx
xor dl, al
push edx
movzx edx, byte [ebx + 8]
mov eax, esi
call fcn.00411438
pop edx
xor dl, al
push edx
movzx edx, byte [ebx + 0xc]
mov eax, esi
call fcn.0041144c
pop edx
xor dl, al
mov byte [esi + edi + 0x11f], dl
movzx edx, byte [ebx]
mov eax, esi
call fcn.0041144c
push eax
movzx edx, byte [ebx + 4]
mov eax, esi
call fcn.00411434
pop edx
xor dl, al
push edx
movzx edx, byte [ebx + 8]
mov eax, esi
call fcn.00411434
pop edx
xor dl, al
push edx
movzx edx, byte [ebx + 0xc]
mov eax, esi
call fcn.00411438
pop edx
xor dl, al
mov byte [esi + edi + 0x123], dl
inc edi
inc ebx
cmp edi, 4
jne 0x411329
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x411460
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx ebx, byte [esi]
and bl, 0xf
movzx ebx, bl
movzx edi, byte [esi]
shr edi, 4
add edi, edi
lea edi, [edi*8 + 0x441cb8]
movzx ebx, byte [edi + ebx]
mov byte [esi], bl
movzx ebx, byte [eax]
and bl, 0xf
movzx ebx, bl
movzx esi, byte [eax]
shr esi, 4
add esi, esi
lea esi, [esi*8 + 0x441cb8]
movzx ebx, byte [esi + ebx]
mov byte [eax], bl
movzx eax, byte [ecx]
and al, 0xf
movzx eax, al
movzx ebx, byte [ecx]
shr ebx, 4
add ebx, ebx
lea ebx, [ebx*8 + 0x441cb8]
movzx eax, byte [ebx + eax]
mov byte [ecx], al
movzx eax, byte [edx]
and al, 0xf
movzx eax, al
movzx ecx, byte [edx]
shr ecx, 4
add ecx, ecx
lea ecx, [ecx*8 + 0x441cb8]
movzx eax, byte [ecx + eax]
mov byte [edx], al
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4119fc
Capabilities:
Create http request

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, eax
cmp dword [ebx + 4], 0
jne 0x411b25
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x411a1a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x411a3c
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x18]
call fcn.00404a00
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebx + 4], eax
jmp 0x411abf
push 0
push 0
mov eax, dword [ebx + 0x20]
call fcn.00404a00
push eax
push 3
mov eax, dword [ebx + 0x18]
call fcn.00404a00
push eax
call sub.wininet.dll_InternetOpenA
mov edi, eax
mov dword [ebx + 4], edi
mov edx, dword [ebx + 0x24]
mov eax, edx
test eax, eax
je 0x411a6c
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x411a8d
mov esi, edx
test esi, esi
je 0x411a7b
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebx + 0x24]
call fcn.00404a00
push eax
push 0x2b
push edi
call sub.wininet.dll_InternetSetOptionA
mov edx, dword [ebx + 0x28]
mov eax, edx
test eax, eax
je 0x411a9b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x411abf
mov esi, edx
test esi, esi
je 0x411aaa
sub esi, 4
mov esi, dword [esi]
push esi
mov eax, dword [ebx + 0x28]
call fcn.00404a00
push eax
push 0x2c
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_InternetSetOptionA
mov dword [esp + 4], 0x7530
push 4
lea eax, [esp + 8]
push eax
push 2
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_InternetSetOptionA
push 4
lea eax, [esp + 8]
push eax
push 6
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_InternetSetOptionA
push 4
lea eax, [esp + 8]
push eax
push 5
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp byte [ebx + 0x1c], 0
je 0x411b25
mov dword [esp], 0xffffffff
push 4
lea eax, [esp + 4]
push eax
push 0x41
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebx + 0x1d], al
cmp dword [ebx + 4], 0
setne al
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x411eb8
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov byte [ebp - 9], 0
xor esi, esi
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x411f2e
cmp dword [ebp - 0x10], 0
jbe 0x411f24
lea edx, [ebp - 0x1010]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov edi, dword [eax]
call dword [edi + 0x10]
add esi, dword [ebp - 0x10]
mov ecx, esi
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00411b34
cmp byte [ebx + 8], 0
jne 0x411f2e
cmp dword [ebp - 0x10], 0
jne 0x411edb
mov byte [ebp - 9], 1
movzx eax, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x411f3c
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
push ecx
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, ecx
mov ebx, eax
lea eax, [ebp - 0x18]
mov edx, dword [0x41166c]
call fcn.004052a8
xor eax, eax
push ebp
push 0x4120ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x19], 0
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x41208a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00404a00
push eax
mov eax, dword [ebp - 8]
call fcn.00404a00
push eax
mov edx, 0x15
mov eax, dword [ebp - 0x10]
call fcn.00406fa4
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404a00
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x411fd9
cmp byte [ebx + 8], 0
je 0x411fe3
call fcn.00403fdc
jmp 0x412091
push 0
push 0x10
lea eax, [ebp - 0x164]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404a00
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.wininet.dll_FtpFindFirstFileA
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x41201a
mov eax, dword [ebp - 0x24]
push eax
call sub.wininet.dll_InternetCloseHandle
mov edi, dword [ebp - 0x144]
jmp 0x41201d
or edi, 0xffffffff
push 0
push 2
push 0x80000000
mov eax, dword [ebp - 0xc]
call fcn.00404a00
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.wininet.dll_FtpOpenFileA
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x412047
cmp byte [ebx + 8], 0
je 0x41204e
call fcn.00403fdc
jmp 0x412091
push esi
mov ecx, edi
mov edx, dword [ebp - 0x24]
mov eax, ebx
call fcn.00411eb8
mov byte [ebp - 0x19], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412091
cmp dword [ebp - 0x24], 0
je 0x41207a
mov eax, dword [ebp - 0x24]
push eax
call sub.wininet.dll_InternetCloseHandle
cmp dword [ebp - 0x20], 0
je 0x412089
mov eax, dword [ebp - 0x20]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4120b4
lea eax, [ebp - 0x18]
mov edx, dword [0x41166c]
call fcn.00405164
ret
Function at 0x412dbc
Capabilities:
Acquire debug privileges

Disassembly:
mov dl, 1
mov eax, 0x412f0c
call fcn.00412cd0
mov dl, 1
mov eax, 0x412f2c
call fcn.00412cd0
mov dl, 1
mov eax, 0x412f44
call fcn.00412cd0
mov dl, 1
mov eax, 0x412f68
call fcn.00412cd0
mov dl, 1
mov eax, 0x412f90
call fcn.00412cd0
mov dl, 1
mov eax, 0x412fb8
call fcn.00412cd0
mov dl, 1
mov eax, 0x412fdc
call fcn.00412cd0
mov dl, 1
mov eax, 0x413000
call fcn.00412cd0
mov dl, 1
mov eax, 0x41301c
call fcn.00412cd0
mov dl, 1
mov eax, 0x413038
call fcn.00412cd0
mov dl, 1
mov eax, 0x413058
call fcn.00412cd0
mov dl, 1
mov eax, 0x413078
call fcn.00412cd0
mov dl, 1
mov eax, 0x413098
call fcn.00412cd0
mov dl, 1
mov eax, 0x4130c0
call fcn.00412cd0
mov dl, 1
mov eax, 0x4130dc
call fcn.00412cd0
mov dl, 1
mov eax, 0x413104
call fcn.00412cd0
mov dl, 1
mov eax, 0x41312c
call fcn.00412cd0
mov dl, 1
mov eax, 0x413150
call fcn.00412cd0
mov dl, 1
mov eax, 0x41316c
call fcn.00412cd0
mov dl, 1
mov eax, 0x413190
call fcn.00412cd0
mov dl, 1
mov eax, 0x4131b0
call fcn.00412cd0
mov dl, 1
mov eax, 0x4131d0
call fcn.00412cd0
mov dl, 1
mov eax, 0x4131ec
call fcn.00412cd0
mov dl, 1
mov eax, 0x413208
call fcn.00412cd0
mov dl, 1
mov eax, 0x413224
call fcn.00412cd0
mov dl, 1
mov eax, 0x41324c
call fcn.00412cd0
mov dl, 1
mov eax, 0x413268
call fcn.00412cd0
ret

Function at 0x413338
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov byte [esp], 0
xor eax, eax
mov dword [esp + 4], eax
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 1
lea eax, [esp + 0x18]
push eax
push 0x9800000c
push ebx
call sub.ws2_32.dll_WSAIoctl
mov esi, eax
mov byte [esp], 1
push 1
lea eax, [esp + 4]
push eax
push 4
push 0xffff
push ebx
call sub.ws2_32.dll_setsockopt_1
test eax, eax
jne 0x41339e
mov edx, 0x3a98
mov eax, ebx
call fcn.004132f0
mov edx, 0xbb8
mov eax, ebx
call fcn.00413314
mov eax, esi
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x4133a8
Capabilities:
Create udp socket
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049f0
xor eax, eax
push ebp
push 0x4134f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0x11
push 2
push 2
call sub.ws2_32.dll_socket_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x4134e3
xor eax, eax
push ebp
push 0x4134d0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00413338
mov eax, dword [ebp - 4]
call fcn.00404a00
push eax
call sub.ws2_32.dll_gethostbyname_1
mov esi, eax
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403308
mov dword [ebp - 0x10], 0x10
mov word [ebp - 0x20], 2
push edi
call sub.ws2_32.dll_htons_1
mov word [ebp - 0x1e], ax
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
mov eax, dword [ebx]
call fcn.00405660
push eax
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.ws2_32.dll_sendto_1
mov esi, eax
inc esi
jne 0x41346d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4134e3
push 0x8000
mov eax, ebx
mov ecx, 1
mov edx, dword [0x4132c0]
call fcn.0040581c
add esp, 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push 0x8000
mov eax, dword [ebx]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.ws2_32.dll_recvfrom_1
mov esi, eax
test esi, esi
setg byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x4134c6
push esi
mov eax, ebx
mov ecx, 1
mov edx, dword [0x4132c0]
call fcn.0040581c
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4134da
mov eax, dword [ebp - 0xc]
push eax
call sub.ws2_32.dll_closesocket_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413500
lea eax, [ebp - 4]
call fcn.00404570
ret

Function at 0x413558
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049f0
xor eax, eax
push ebp
push 0x413606
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, 0x41361c
call fcn.004045c4
mov eax, dword [ebp - 4]
test eax, eax
je 0x413592
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x4135f0
xor eax, eax
push ebp
push 0x4135e6
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.dnsapi.dll_DnsFlushResolverCache_1
mov eax, dword [ebp - 4]
call fcn.00404a00
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
jne 0x4135c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4135f0
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, esi
call fcn.00404768
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4135f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41360d
lea eax, [ebp - 4]
call fcn.00404570
ret
Function at 0x41362c
Capabilities:
Get networking parameters

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00404570
mov dword [ebp - 8], 0x248
mov eax, 0x248
call fcn.00402da8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4136cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.iphlpapi.dll_GetNetworkParams
cmp eax, 0x6f
jne 0x413698
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00402ddc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.iphlpapi.dll_GetNetworkParams
test eax, eax
je 0x413698
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4136df
mov eax, dword [ebp - 4]
cmp byte [eax + 0x110], 0
jne 0x4136ae
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4136df
mov eax, ebx
mov edx, dword [ebp - 4]
add edx, 0x110
mov ecx, 0x10
call fcn.004047e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4136d7
mov eax, dword [ebp - 4]
call fcn.00402dc4
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4136e8
Capabilities:
Get networking parameters

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.00404570
mov dword [ebp - 8], 0x248
mov eax, 0x248
call fcn.00402da8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x413790
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.iphlpapi.dll_GetNetworkParams
cmp eax, 0x6f
jne 0x413754
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00402ddc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.iphlpapi.dll_GetNetworkParams
test eax, eax
je 0x413754
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4137a2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x110], 0
jne 0x41376a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4137a2
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x10c]
test ebx, ebx
je 0x413786
mov eax, esi
lea edx, [ebx + 4]
mov ecx, 0x10
call fcn.004047e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41379a
mov eax, dword [ebp - 4]
call fcn.00402dc4
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4137ac
Capabilities:
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffa54
mov ebx, edx
mov edi, eax
lea eax, [esp + 0xc]
push eax
push 0x202
call sub.wsock32.dll_WSAStartup
mov eax, esp
xor ecx, ecx
mov edx, 4
call fcn.00403308
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov dword [esp + 4], eax
cmp dword [esp + 4], 0xffffffff
je 0x4139cb
mov edx, 0x3e8
mov eax, dword [esp + 4]
call fcn.0041350c
mov word [esp + 0x59c], 2
push 0x35
call sub.wsock32.dll_htons
mov word [esp + 0x59e], ax
push ebx
call sub.wsock32.dll_inet_addr
mov esi, eax
mov dword [esp + 0x5a0], esi
inc esi
je 0x4139bc
lea eax, [esp + 0x19c]
xor ecx, ecx
mov edx, 0x400
call fcn.00403308
call fcn.004031c0
lea ebp, [esp + 0x19c]
mov eax, 0xfffe
call fcn.004031e8
mov word [ebp], ax
push pe_nt_image_headers32
call sub.wsock32.dll_htons
mov word [ebp + 2], ax
push 1
call sub.wsock32.dll_htons
mov word [ebp + 4], ax
mov word [ebp + 6], 0
push edi
lea eax, [esp + 0x1ad]
push eax
call sub.kernel32.dll_lstrcpyA
mov dword [esp + 8], 0xd
xor ebx, ebx
jmp 0x4138c3
mov esi, dword [esp + 8]
add esi, ebx
cmp byte [esp + esi + 0x19c], 0
je 0x4138d0
cmp byte [esp + esi + 0x19c], 0x2e
jne 0x4138c2
mov eax, dword [esp + 8]
mov byte [esp + eax + 0x19b], bl
inc ebx
add dword [esp + 8], ebx
xor ebx, ebx
jmp 0x4138c3
inc ebx
push edi
call sub.kernel32.dll_lstrlenA_1
sub eax, 2
cmp ebx, eax
jl 0x413894
mov eax, dword [esp + 8]
mov byte [esp + eax + 0x19b], bl
push edi
call sub.kernel32.dll_lstrlenA_1
add eax, 0xf
lea ebx, [esp + eax + 0x19b]
push 1
call sub.wsock32.dll_htons
mov word [ebx], ax
push 1
call sub.wsock32.dll_htons
mov word [ebx + 2], ax
push 0x10
lea eax, [esp + 0x5a0]
push eax
push 0
push edi
call sub.kernel32.dll_lstrlenA_1
add eax, 0x10
add eax, 2
push eax
lea eax, [esp + 0x1ac]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.wsock32.dll_sendto
mov dword [esp + 8], 0x10
lea eax, [esp + 0x19c]
xor ecx, ecx
mov edx, 0x400
call fcn.00403308
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x5a0]
push eax
push 0
push 0x400
lea eax, [esp + 0x1ac]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.wsock32.dll_recvfrom
cmp word [ebp + 6], 0
jne 0x413988
mov byte [esp], 0
mov byte [esp + 1], 0
mov byte [esp + 2], 0
mov byte [esp + 3], 0
jmp 0x4139bc
mov ebx, eax
sub ebx, 4
movzx eax, byte [esp + ebx + 0x19c]
mov byte [esp], al
movzx eax, byte [esp + ebx + 0x19d]
mov byte [esp + 1], al
movzx eax, byte [esp + ebx + 0x19e]
mov byte [esp + 2], al
movzx eax, byte [esp + ebx + 0x19f]
mov byte [esp + 3], al
mov eax, dword [esp + 4]
push eax
call sub.wsock32.dll_closesocket
call sub.wsock32.dll_WSACleanup
mov eax, dword [esp]
add esp, 0x5ac
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x419e4c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x419e85
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404660
jmp 0x419e8e
mov eax, ebx
mov edx, esi
call fcn.004045c4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x419e98
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x419eba
movzx eax, byte [esp]
jmp 0x419ebc
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x41a54c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x41a3c4
mov eax, dword [0x4422dc]
cmp byte [eax], 0
je 0x41a5c8
mov eax, dword [0x4421d4]
call fcn.00403298
call fcn.00402ed0
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00417788
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x41a610
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x41a5fe
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4421a4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4457f0]
call fcn.00405908
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x420094
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004049f0
mov eax, dword [ebp - 8]
call fcn.004049f0
xor eax, eax
push ebp
push 0x4201fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404570
xor eax, eax
push ebp
push 0x4201d6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.00404a00
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
cmp dword [ebp - 0xc], 0
jne 0x420108
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4201e0
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp + 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404a00
mov esi, eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00404c90
cmp dword [ebp + 0xc], 4
jne 0x420177
mov eax, ebx
mov edx, 0x420214
call fcn.004045c4
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4201ba
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.00417404
jmp 0x4201ba
lea eax, [ebp - 0x10]
push eax
mov eax, ebx
call fcn.00404a60
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4201ba
cmp dword [ebp + 0xc], 7
jne 0x4201aa
mov edx, dword [ebp - 0x10]
dec edx
mov eax, ebx
call fcn.00404c90
jmp 0x4201ba
mov eax, dword [ebx]
call fcn.00404a00
mov edx, eax
mov eax, ebx
call fcn.00404768
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegFlushKey
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4201e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420202
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404594
ret