joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a30
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x518
mov eax, dword [0x418060]
xor eax, esp
mov dword [esp + 0x510], eax
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0x18]
push 0
push eax
mov dword [esp + 0x1c], vtable.CMyIniFile.0
call fcn.00406e90
add esp, 0xc
lea ecx, [esp + 0x418]
push ecx
push 0xff
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
push 0x4200f8
lea edx, [esp + 0x41c]
push edx
push 0x415e6c
lea edx, [esp + 0x324]
call fcn.00404a30
push 0x104
lea eax, [esp + 0x328]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00404c57
push 0x6100
push 0
push 0x419ef8
mov dword [0x420138], 0
call fcn.00406e90
mov edi, dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
add esp, 0x24
lea edx, [esp + 0x14]
push edx
push 0xff
push 0x41fff8
push 0x415d5c
push str.APPTITLE
push str.HEADER
call edi
lea eax, [esp + 0x14]
push eax
push 0
push str.FILENUMBER
push str.HEADER
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntA]
mov ecx, 0x41fff8
mov dword [0x420138], eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x401b13
sub ecx, esi
je 0x401c7f
lea ecx, [eax - 1]
cmp ecx, 0x3e
ja 0x401c7f
xor ecx, ecx
test eax, eax
jbe 0x401c62
mov esi, 0x419f7c
lea edx, [esp + 0x118]
sub esi, edx
lea ebx, [ecx + 1]
push ebx
push str.FILE_d
lea edx, [esp + 0x220]
call fcn.00404a30
add esp, 8
lea eax, [esp + 0x14]
push eax
push 0xff
lea ecx, [esp + 0x120]
push ecx
push 0x415d5c
push str.FILENAME
lea edx, [esp + 0x22c]
push edx
call edi
lea eax, [esp + 0x118]
jmp 0x401b90
mov cl, byte [eax]
mov byte [esi + eax - 0x80], cl
inc eax
test cl, cl
jne 0x401b90
lea eax, [esp + 0x14]
push eax
push 0xff
lea ecx, [esp + 0x120]
push ecx
push 0x415d5c
push str.VERSION
lea edx, [esp + 0x22c]
push edx
call edi
lea eax, [esp + 0x118]
mov cl, byte [eax]
mov byte [esi + eax], cl
inc eax
test cl, cl
jne 0x401bc8
lea eax, [esp + 0x14]
push eax
push 0xff
lea ecx, [esp + 0x120]
push ecx
push 0x415d5c
push str.BUILDDATE
lea edx, [esp + 0x22c]
push edx
call edi
lea eax, [esp + 0x118]
nop
mov cl, byte [eax]
mov byte [esi + eax + 0x40], cl
inc eax
test cl, cl
jne 0x401c00
lea eax, [esp + 0x14]
push eax
push 0xff
lea ecx, [esp + 0x120]
push ecx
push 0x415d5c
push str.LOCALSUBDIR
lea edx, [esp + 0x22c]
push edx
call edi
lea eax, [esp + 0x118]
jmp 0x401c40
mov cl, byte [eax]
mov byte [esi + eax + 0x80], cl
inc eax
test cl, cl
jne 0x401c40
mov ecx, ebx
add esi, 0x184
cmp ecx, dword [0x420138]
jb 0x401b46
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.00404aa2
add esp, 0x518
ret
mov ecx, dword [esp + 0x51c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00404aa2
add esp, 0x518
ret
Function at 0x401ca0
Capabilities:
Create directory

Disassembly:
sub esp, 0x184
mov eax, dword [0x418060]
xor eax, esp
mov dword [esp + 0x180], eax
mov eax, dword [esp + 0x188]
lea edx, [esp]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401cc0
lea eax, [esp]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401cd0
sub eax, edx
push esi
mov esi, eax
xor eax, eax
cmp esi, 1
jl 0x401dd0
push ebx
push ebp
mov bl, 0x5c
test esi, esi
jle 0x401d00
nop
cmp byte [esp + eax + 0xc], 0x2f
jne 0x401cfb
mov byte [esp + eax + 0xc], bl
inc eax
cmp eax, esi
jl 0x401cf0
cmp byte [esp + esi + 0xb], bl
jne 0x401d0b
mov byte [esp + esi + 0xb], 0
cmp byte [esp + esi + 0xb], 0x2f
jne 0x401d17
mov byte [esp + esi + 0xb], 0
mov ebp, dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
xor eax, eax
test esi, esi
jle 0x401dac
cmp byte [esp + eax + 0xc], bl
je 0x401d34
inc eax
cmp eax, esi
jl 0x401d27
jmp 0x401dac
push edi
mov edi, eax
test eax, eax
jle 0x401dab
jmp 0x401d40
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x118]
push ecx
call fcn.00404f20
lea edx, [esp + 0x11c]
push 0
push edx
call fcn.00413cb5
add esp, 0x14
cmp eax, 0xffffffff
jne 0x401d8d
lea eax, [esp + 0x110]
push 0
push eax
call fcn.00413cb5
add esp, 8
cmp eax, 0xffffffff
jne 0x401d8d
push 0
lea ecx, [esp + 0x114]
push ecx
call ebp
lea eax, [edi + 1]
xor ecx, ecx
cmp eax, esi
jge 0x401da5
cmp byte [esp + eax + 0x10], bl
je 0x401da3
inc eax
cmp eax, esi
jl 0x401d96
jmp 0x401da5
mov ecx, eax
mov edi, ecx
test ecx, ecx
jg 0x401d40
pop edi
lea edx, [esp + 0xc]
push 0
push edx
call fcn.00413cb5
add esp, 8
cmp eax, 0xffffffff
jne 0x401dc9
push 0
lea eax, [esp + 0x10]
push eax
call ebp
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x184]
pop esi
xor ecx, esp
call fcn.00404aa2
add esp, 0x184
ret
Function at 0x401df0
Capabilities:
Download url
Receive data

Disassembly:
sub esp, 0x508
mov eax, dword [0x418060]
xor eax, esp
mov dword [esp + 0x504], eax
mov eax, esi
push ebp
mov ebp, dword [esp + 0x510]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401e11
sub eax, edx
je 0x401e5e
lea edx, [esp + 0x308]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401e27
lea eax, [esp + 0x308]
push eax
call fcn.00401ca0
push edi
lea ecx, [esp + 0x310]
push ecx
lea edx, [esp + 0x414]
push 0x415e6c
push edx
call fcn.00405044
add esp, 0x14
jmp 0x401e7a
lea edx, [esp + 0x408]
mov eax, edi
sub edx, edi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401e70
lea edx, [esp + 0x108]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401e85
lea eax, [esp + 0x108]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401ea0
sub eax, edx
push ebx
mov bl, 0x2f
test eax, eax
jle 0x401ecc
xor ecx, ecx
test eax, eax
jle 0x401ecc
cmp byte [esp + ecx + 0x10c], 0x5c
jne 0x401ec7
mov byte [esp + ecx + 0x10c], bl
inc ecx
cmp ecx, eax
jl 0x401eb6
mov eax, 0x420078
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401ed4
sub eax, edx
cmp byte [eax + 0x420077], bl
jne 0x401efe
lea eax, [esp + 0x10c]
push eax
push 0x420078
push str._s_s
lea ecx, [esp + 0x18]
push ecx
jmp 0x401f15
lea edx, [esp + 0x10c]
push edx
push 0x420078
push str._s__s
lea eax, [esp + 0x18]
push eax
call fcn.00405044
lea eax, [esp + 0x1c]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401f24
sub eax, edx
cmp byte [esp + eax + 0xb], bl
pop ebx
push edi
jne 0x401f49
lea ecx, [esp + 0xc]
push ecx
push str._s_s
lea edx, [esp + 0x214]
push edx
jmp 0x401f5b
lea eax, [esp + 0xc]
push eax
push str._s__s
lea ecx, [esp + 0x214]
push ecx
call fcn.00405044
add esp, 0x10
lea edx, [esp + 0x208]
push edx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push ebp
push 0
lea eax, [esp + 0x410]
push eax
lea ecx, [esp + 0x214]
push ecx
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov ecx, dword [esp + 0x508]
xor edx, edx
test eax, eax
setge dl
pop ebp
xor ecx, esp
mov eax, edx
call fcn.00404aa2
add esp, 0x508
ret
Function at 0x402060
Capabilities:
Acquire debug privileges
Enumerate processes
Print debug messages
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x1c8
mov eax, dword [0x418060]
xor eax, esp
mov dword [esp + 0x1c4], eax
mov eax, dword [esp + 0x1cc]
push ebx
push ebp
push esi
push edi
push 0x124
lea ecx, [esp + 0x30]
push 0
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
call fcn.00406e90
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4020c7
push str.HHHHHHHHHHHHH_KillProgramByExeName___OpenProcessToken_error_
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
jmp 0x402207
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4020f3
push 1
lea esi, [esp + 0x1c]
call fcn.00401fb0
add esp, 4
test eax, eax
jne 0x402103
push str.HHHHHHHHHHHHH_KillProgramByExeName___SetPrivilege_error_
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
jmp 0x402207
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, 0xffffffff
je 0x4021d4
lea ecx, [esp + 0x28]
push ecx
push esi
mov dword [esp + 0x30], 0x128
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4021cd
mov edi, dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov ebx, dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ebp, dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x402150
lea edx, [esp + 0x4c]
push edx
push 0x415e74
lea edx, [esp + 0x158]
call fcn.00404a50
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x158]
push esi
push eax
call fcn.00404f09
add esp, 0x10
test eax, eax
jne 0x4021b6
push esi
call edi
mov ecx, dword [esp + 0x30]
push ecx
push 0
push 1
call ebx
mov esi, eax
call ebp
test esi, esi
je 0x4021af
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x1e
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x4021b6
push str.OpenProcess_error_
call edi
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x28]
push edx
push eax
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x402150
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4021fc
push 0
lea esi, [esp + 0x24]
call fcn.00401fb0
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [esp + 0x1d4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00404aa2
add esp, 0x1c8
ret
Function at 0x402570
Capabilities:
Connect socket
Set socket configuration

Disassembly:
sub esp, 0x174
mov eax, dword [0x418060]
xor eax, esp
mov dword [esp + 0x16c], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push ebx
push 1
push 2
mov edi, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4026bb
push 4
lea eax, [esp + 0x18]
push eax
push 1
push 6
push ebp
mov dword [esp + 0x28], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x4026b4
mov ecx, dword [str.127.0.0.1]
mov edx, dword [0x41606c]
mov ax, word [0x416070]
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x15c], ecx
lea ecx, [esp + 0x15c]
push ecx
mov dword [esp + 0x164], edx
mov word [esp + 0x168], ax
call esi
xor eax, eax
lea edx, [esp + 0x15c]
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call esi
mov dword [esp + 0x1c], eax
mov eax, 2
push 0x1c5e
mov word [esp + 0x1c], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea ecx, [esp + 0x1c]
push ecx
push ebp
mov word [esp + 0x26], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x4026b4
push 0x12c
lea edx, [esp + 0x2c]
push ebx
push edx
call fcn.00406e90
mov eax, edi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402662
sub eax, edx
cmp eax, 0x7f
jbe 0x402673
mov byte [edi + 0x7f], bl
mov byte [esp + 0x28], 0x71
mov dword [esp + 0x150], ebx
xor eax, eax
mov cl, byte [eax + 0x4161bc]
mov byte [esp + eax + 0x2a], cl
inc eax
cmp cl, bl
jne 0x402681
lea edx, [esp + 0x4a]
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x402698
push ebp
mov edi, 0x12c
lea ebx, [esp + 0x2c]
call fcn.004048b0
add esp, 4
push ebp
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x17c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00404aa2
add esp, 0x174
ret
Function at 0x403700
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
sub esp, 0x414
mov eax, dword [0x418060]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push edi
lea eax, [esp + 0xc]
push eax
push 5
push 0
call esi
mov edx, dword [esp + 0xc]
mov edi, dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea ecx, [esp + 0x14]
push ecx
push edx
call edi
push 0x416188
lea eax, [esp + 0x18]
push 0xff
push eax
call fcn.0040583b
add esp, 0xc
push str.seetrol
lea ecx, [esp + 0x18]
push 0xff
push ecx
call fcn.0040583b
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push str._sclient
lea edx, [esp + 0x11c]
call fcn.00404a30
add esp, 8
lea eax, [esp + 0x114]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
lea ecx, [esp + 0x114]
push ecx
call fcn.004033f0
add esp, 4
lea edx, [esp + 0x10]
push edx
push 0x10
push 0
call esi
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x214]
push eax
push ecx
call edi
lea edx, [esp + 0x214]
push edx
push str._sSeetrol_PC
lea edx, [esp + 0x31c]
call fcn.00404a30
add esp, 8
lea eax, [esp + 0x314]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov ecx, dword [esp + 0x418]
pop edi
pop esi
xor ecx, esp
call fcn.00404aa2
add esp, 0x414
ret

Function at 0x403800
Capabilities:
Delete file
Get common file path
Get program files directory
Set current directory

Disassembly:
sub esp, 0x414
mov eax, dword [0x418060]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push edi
lea eax, [esp + 0xc]
push eax
push 0x26
push 0
call esi
mov edx, dword [esp + 0xc]
mov edi, dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea ecx, [esp + 0x14]
push ecx
push edx
call edi
push 0x416188
lea eax, [esp + 0x18]
push 0xff
push eax
call fcn.0040583b
add esp, 0xc
push str.seetrol
lea ecx, [esp + 0x18]
push 0xff
push ecx
call fcn.0040583b
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push str._sclient
lea edx, [esp + 0x11c]
call fcn.00404a30
add esp, 8
lea eax, [esp + 0x114]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
lea ecx, [esp + 0x114]
push ecx
call fcn.004033f0
add esp, 4
lea edx, [esp + 0x10]
push edx
push 0x10
push 0
call esi
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x214]
push eax
push ecx
call edi
lea edx, [esp + 0x214]
push edx
push str._sSeetrol_PC
lea edx, [esp + 0x31c]
call fcn.00404a30
add esp, 8
lea eax, [esp + 0x314]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov ecx, dword [esp + 0x418]
pop edi
pop esi
xor ecx, esp
call fcn.00404aa2
add esp, 0x414
ret
Function at 0x4048b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
push esi
push edi
push ebx
push ebp
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x4048e8
test eax, eax
je 0x4048e8
add esi, eax
cmp esi, edi
jge 0x4048ed
push 0
mov eax, edi
sub eax, esi
push eax
lea ecx, [esi + ebx]
push ecx
push ebp
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x4048c7
pop esi
xor eax, eax
pop ebp
ret
pop esi
mov eax, 1
pop ebp
ret

Function at 0x404900
Capabilities:
Print debug messages
Receive data
Receive data on socket

Disassembly:
sub esp, 0x44
mov eax, dword [0x418060]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x48]
push ebp
mov ebp, dword [esp + 0x50]
push esi
push edi
xor edi, edi
push edi
push ebp
push ebx
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
push esi
lea ecx, [esp + 0x10]
push str.HHHHHH_recv_bytes___d
push ecx
call fcn.00405044
add esp, 0xc
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
cmp esi, 0xffffffff
je 0x404995
lea ebx, [ebx]
test esi, esi
je 0x404995
add edi, esi
cmp edi, ebp
jge 0x4049a9
mov edx, dword [esp + 0x54]
push 0
mov eax, ebp
sub eax, edi
push eax
lea ecx, [ebx + edi]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
push esi
lea eax, [esp + 0x10]
push str.HHHHHH_recv_bytes___d
push eax
call fcn.00405044
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
cmp esi, 0xffffffff
jne 0x404950
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00404aa2
add esp, 0x44
ret
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.00404aa2
add esp, 0x44
ret

Function at 0x404aa2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x418060]
jne 0x404aac
repz ret
jmp fcn.00405a60
Function at 0x410cf4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406772
and dword [ebp - 4], 0
cmp dword [0x419e10], 0
mov ebx, eax
jne 0x410da5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x410e56
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x415c88
push edi
call esi
test eax, eax
je 0x410e56
push eax
call fcn.00406700
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x419e10], eax
call esi
push eax
call fcn.00406700
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x419e14], eax
call esi
push eax
call fcn.00406700
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x419e18], eax
call esi
push eax
call fcn.00406700
pop ecx
mov dword [0x419e20], eax
test eax, eax
je 0x410da5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406700
pop ecx
mov dword [0x419e1c], eax
mov eax, dword [0x419e1c]
cmp eax, ebx
je 0x410dfd
cmp dword [0x419e20], ebx
je 0x410dfd
push eax
call fcn.0040677b
push dword [0x419e20]
mov esi, eax
call fcn.0040677b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x410dfd
test edi, edi
je 0x410dfd
call esi
test eax, eax
je 0x410df4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x410df4
test byte [ebp - 0xc], 1
jne 0x410dfd
or dword [ebp + 0x10], 0x200000
jmp 0x410e36
mov eax, dword [0x419e14]
cmp eax, ebx
je 0x410e36
push eax
call fcn.0040677b
pop ecx
test eax, eax
je 0x410e36
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x410e36
mov eax, dword [0x419e18]
cmp eax, ebx
je 0x410e36
push eax
call fcn.0040677b
pop ecx
test eax, eax
je 0x410e36
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x419e10]
call fcn.0040677b
pop ecx
test eax, eax
je 0x410e56
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410e58
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x413c2c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x413c5d
call fcn.00406e4f
mov dword [eax], esi
call fcn.00406e3c
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00406dd4
add esp, 0x14
push 0x16
pop eax
jmp 0x413cb2
test dword [ebp + 0xc], 0xfffffff9
jne 0x413c39
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x413c8a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.00406e62
pop ecx
call fcn.00406e3c
mov eax, dword [eax]
jmp 0x413cb2
test al, 0x10
jne 0x413cb0
test al, 1
je 0x413cb0
test byte [ebp + 0xc], 2
je 0x413cb0
call fcn.00406e4f
mov dword [eax], 5
call fcn.00406e3c
mov dword [eax], 0xd
jmp 0x413c81
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10001b84
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000701c]
jne 0x10001b8e
repz ret
jmp fcn.10001bf8
Function at 0x40fb06
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 2
push 0x1400
push 0x40d198
call fcn.0040f01e
add esp, 0xc
push 0x40e908
push 0x401f2e
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40fb5c
push dword [ebp - 8]
push 1
push 0x1400
push 0x40d198
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 0x40e90c
push 0x401e2f
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40fb99
push dword [ebp - 4]
push 1
push 0x1400
push 0x40d198
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push dword [0x40ce70]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x40fbc3
push 0x401f2e
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x40fbc3
push 0x401e2f
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor eax, eax
leave
ret

Function at 0x40fd42
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
leave
ret

Function at 0x40fe23
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
push 0
push 0
push 0
push 0
push 0x40e920
call dword [0x401534]
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 0
je 0x40ff01
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 0x82c]
call dword [0x401200]
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x830], 0
je 0x40ff01
push 0x40e924
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_fopen]
pop ecx
pop ecx
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
je 0x40ff01
lea eax, [ebp - 0x824]
push eax
push 0x800
lea eax, [ebp - 0x800]
push eax
push dword [ebp - 0x830]
call dword [0x401208]
test eax, eax
jne 0x40fec0
jmp 0x40feef
push dword [ebp - 0x834]
push 1
push dword [ebp - 0x824]
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x824], 0
ja 0x40fe9b
push dword [ebp - 0x834]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 1
pop eax
jmp 0x40ff03
xor eax, eax
leave
ret
Function at 0x40ffdf
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x51fc
call fcn.00410680
push 0x40e930
call fcn.0040efdc
pop ecx
mov dword [ebp - 0x51e8], eax
push 0x40e960
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__strdup]
pop ecx
add eax, 7
push eax
call dword [sym.imp.MSVCRT.dll_strtok]
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x50e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x40e964
mov eax, dword [ebp + 8]
add eax, 7
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x51e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x190]
push eax
push 1
call sub.WS2_32.dll_WSAStartup
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [ebp - 0x50e4], eax
cmp dword [ebp - 0x50e4], 0
je 0x41015d
mov word [ebp - 0x51f8], 2
lea eax, [ebp - 0x50e0]
push eax
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 0x51fc], eax
cmp dword [ebp - 0x51fc], 0
je 0x41015d
mov eax, dword [ebp - 0x51fc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x51f4], eax
push 0x50
call sub.WS2_32.dll_htons
mov word [ebp - 0x51f6], ax
push 0x10
lea eax, [ebp - 0x51f8]
push eax
push dword [ebp - 0x50e4]
call sub.WS2_32.dll_connect
cmp eax, 0xffffffff
je 0x41015d
push dword [ebp + 0xc]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x50e0]
push eax
lea eax, [ebp - 0x51e4]
push eax
push 0x40e968
lea eax, [ebp - 0x4fe0]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [ebp - 0x4fe0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x4fe0]
push eax
push dword [ebp - 0x50e4]
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x41015d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x50e4]
call sub.WS2_32.dll_closesocket
call sub.WS2_32.dll_WSACleanup
push 1
pop eax
jmp 0x41016f
push dword [ebp - 0x50e4]
call sub.WS2_32.dll_closesocket
call sub.WS2_32.dll_WSACleanup
xor eax, eax
leave
ret