joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401840
Capabilities:
Create process on windows

Disassembly:
mov edx, dword [0x41929c]
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
lea eax, [edx + edx*4]
or ecx, 0xffffffff
lea eax, [eax + eax*4]
lea ebx, [eax*8 + 0x418d20]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
cmp edx, 7
mov dword [0x41929c], edx
pop ebx
jl 0x40188e
xor edx, edx
mov dword [0x41929c], edx
mov eax, dword [0x4192a0]
cmp edx, eax
jne 0x4018ac
inc eax
cmp eax, 7
mov dword [0x4192a0], eax
jl 0x4018ac
mov dword [0x4192a0], 0
mov eax, dword [0x419298]
test eax, eax
jne 0x4018ba
jmp fcn.004017a0
ret

Function at 0x401ca0
Capabilities:
Create udp socket

Disassembly:
push 0x11
push 2
push 2
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [0x418d10], eax
jne 0x401cb8
xor al, al
ret
mov al, byte [0x41bc92]
push 0xf000
inc al
mov word [0x418d00], 2
mov byte [0x41bc92], al
mov dword [0x418d04], 0
call sub.WSOCK32.dll_htons
mov word [0x418d02], ax
mov eax, dword [0x418d10]
push 0x10
push 0x418d00
push eax
call sub.WSOCK32.dll_bind
test eax, eax
jne 0x401d28
mov dl, byte [0x41bc92]
mov ecx, dword [esp + 4]
inc dl
push 1
mov byte [0x41bc92], dl
mov edx, dword [0x418d10]
push 0x465
push ecx
push edx
call sub.WSOCK32.dll_WSAAsyncSelect
cmp eax, 0xffffffff
jne 0x401d36
mov eax, dword [0x418d10]
push eax
call sub.WSOCK32.dll_closesocket
xor al, al
ret
push 0xf000
mov dword [0x418ce8], 0x10
mov word [0x418cf0], 2
call sub.WSOCK32.dll_htons
mov word [0x418cf2], ax
mov dword [0x418cf4], 0
mov al, 1
ret

Function at 0x401d70
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [0x41bc4c]
test eax, eax
je 0x401d7c
xor eax, eax
ret
mov eax, dword [esp + 0xc]
test eax, eax
jge 0x401d87
xor eax, eax
ret
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0x10
push 0x418cf0
push 0
push eax
mov eax, dword [0x418d10]
push edx
push eax
mov dword [0x418cf4], ecx
call sub.WSOCK32.dll_sendto
mov ecx, eax
inc eax
neg eax
sbb eax, eax
mov dword [0x418ce0], ecx
and eax, ecx
ret
Function at 0x403520
Capabilities:
Get hostname
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x80
mov dword [0x4194b0], 0
mov dword [0x41adcc], 0x94
push esi
push edi
push 0x41adcc
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x41bd14
or ecx, 0xffffffff
xor eax, eax
push 0x80
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x41ad98
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
call sub.WSOCK32.dll_gethostname
test eax, eax
jne 0x40360f
push ebx
lea edx, [esp + 0xc]
push 0x20
push edx
push 0x41ad98
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call sub.WSOCK32.dll_gethostbyname
mov edi, eax
xor ebx, ebx
test edi, edi
je 0x403605
mov esi, 0x4194b4
mov ecx, dword [edi + 0xc]
mov edx, dword [0x4194b0]
mov eax, dword [ecx + edx*4]
test eax, eax
je 0x403605
mov eax, dword [eax]
push eax
call sub.WSOCK32.dll_inet_ntoa
push eax
call sub.WSOCK32.dll_inet_addr
mov ecx, eax
mov dword [esi], eax
and ecx, 0xff
cmp ecx, 0xa9
je 0x4035f5
cmp ecx, 0x7f
je 0x4035f5
cmp ecx, 0xff
je 0x4035f5
test eax, eax
je 0x4035f5
inc ebx
add esi, 4
cmp esi, 0x4194d4
je 0x403605
inc dword [0x4194b0]
jmp 0x4035b0
mov eax, ebx
pop ebx
mov dword [0x4194b0], eax
jmp 0x403614
mov eax, dword [0x4194b0]
test eax, eax
jne 0x403656
push 0x4194b0
call fcn.0040a480
mov edx, dword [0x4194b0]
add esp, 4
test edx, edx
je 0x403654
mov edi, str.drcom
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x41ad98
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, edx
pop edi
pop esi
add esp, 0x80
ret
Function at 0x403700
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x94
push ebx
mov ebx, dword [esp + 0x9c]
test ebx, ebx
jne 0x403724
mov dword [0x41bc28], 0xa
pop ebx
add esp, 0x94
ret
mov eax, dword [0x41bc2c]
push ebp
push esi
push edi
push eax
lea ecx, [esp + 0x24]
push 0x413f70
push ecx
mov dword [0x41bc28], 0
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, str.v3.53
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x403772
mov dl, byte [eax + str.v3.53]
cmp dl, 0x30
jl 0x40376d
cmp dl, 0x39
jle 0x403772
inc eax
cmp eax, ecx
jl 0x40375d
push str.._update.ini
push str.Version
push str.Common
lea edi, [eax + str.v3.53]
call fcn.00405d80
add esp, 0xc
mov esi, eax
mov ecx, edi
mov dl, byte [ecx]
mov al, dl
cmp dl, byte [esi]
jne 0x4037b7
test al, al
je 0x4037b3
mov dl, byte [ecx + 1]
mov al, dl
cmp dl, byte [esi + 1]
jne 0x4037b7
add ecx, 2
add esi, 2
test al, al
jne 0x403793
xor eax, eax
jmp 0x4037bc
sbb eax, eax
sbb eax, 0xffffffff
mov ebp, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
je 0x4037d8
push str.._update.ini
push edi
push str.Version
push str.Common
call ebp
push str.._update.ini
push str.VersionDll
push str.Common
call fcn.00405d80
add esp, 0xc
mov esi, eax
lea ecx, [esp + 0x20]
mov dl, byte [ecx]
mov al, dl
cmp dl, byte [esi]
jne 0x403819
test al, al
je 0x403815
mov dl, byte [ecx + 1]
mov al, dl
cmp dl, byte [esi + 1]
jne 0x403819
add ecx, 2
add esi, 2
test al, al
jne 0x4037f5
xor eax, eax
jmp 0x40381e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x403838
lea eax, [esp + 0x20]
push str.._update.ini
push eax
push str.VersionDll
push str.Common
call ebp
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x60]
lea edx, [esp + 0x60]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x60], 0x44
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
push eax
push str.update.exe
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
test eax, eax
pop ebp
jne 0x403889
cmp ebx, 1
jne 0x403889
push eax
push 0x37
call fcn.004036d0
add esp, 4
push eax
call fcn.004038a0
add esp, 8
pop ebx
add esp, 0x94
ret

Function at 0x403ee0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x41b62c]
push eax
push 0x12f
push 0
push 0x12f
push ecx
call dword [sym.imp.USER32.dll_ModifyMenuA]
mov eax, dword [0x41bc6c]
test eax, eax
jne 0x403f2e
mov eax, dword [0x41bc1c]
test eax, eax
jne 0x403f2e
mov edx, dword [0x41b648]
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
call esi
mov eax, dword [0x41b648]
push 5
push eax
call esi
pop esi
ret
mov ecx, dword [0x41b648]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x403fd0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x404bc0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x42c
or ecx, 0xffffffff
xor eax, eax
push ebx
push ebp
push esi
push edi
mov edi, 0x417b48
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x404be8
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x42c
ret
xor eax, eax
mov ecx, 0x49
lea edi, [esp + 0x118]
mov dword [esp + 0x114], 0
push eax
push 2
rep stosd dword es:[edi], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
jne 0x404c23
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x42c
ret
lea eax, [esp + 0x114]
mov dword [esp + 0x114], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x404d2b
mov ebp, dword [sym.imp.MSVCRT.dll_strncpy]
lea ecx, [esp + 0x138]
push 0xff
lea edx, [esp + 0x18]
push ecx
push edx
call ebp
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edx, edx
test ecx, ecx
jle 0x404c8c
mov al, byte [esp + edx + 0x14]
cmp al, 0x41
jl 0x404c87
cmp al, 0x5a
jg 0x404c87
or al, 0x20
mov byte [esp + edx + 0x14], al
inc edx
cmp edx, ecx
jl 0x404c75
lea esi, [esp + 0x14]
mov eax, 0x417b48
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x404cbd
test cl, cl
je 0x404cb9
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x404cbd
add eax, 2
add esi, 2
test cl, cl
jne 0x404c95
xor eax, eax
jmp 0x404cc2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404ce1
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x114]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x404d23
jmp 0x404c4a
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x23c]
push eax
push str.__s__inuse
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0x248]
push 0
push edx
call fcn.00406100
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x42c
ret
mov esi, dword [esp + 0x10]
xor bl, bl
jmp 0x404d2d
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x417bc8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x404d53
push eax
push 0x417bc8
call fcn.004038a0
add esp, 8
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x42c
ret
Function at 0x404e40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x24
xor eax, eax
mov ecx, 0xb6
push esi
push edi
push eax
push eax
push 3
push eax
mov edi, 0x417ab8
push eax
push bind
push str.ishare_user.dat
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404ea1
lea eax, [esp + 8]
push 0
push eax
push 0x2d8
push 0x417ab8
push esi
mov dword [esp + 0x1c], 0x2d8
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call fcn.00404d60
add esp, 4
mov eax, dword [0x41bc4c]
test eax, eax
jne 0x404eb1
mov byte [esp + 0xc], 0
jmp 0x404ed7
mov edi, str._802.1x_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x417ac8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x404f16
cmp dword [0x41b30c], 0x804
jne 0x404f16
lea ecx, [esp + 0xc]
push ecx
push str.v3.53
push 0x417ac8
push str._s___s__s
push 0x41a4d4
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov edi, 0x417cd0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x404f4a
mov edi, 0x417cd0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x41b8ac
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x24
ret

Function at 0x404f50
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404fba
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404faf
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
cmp edx, eax
jne 0x404faf
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
ret
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
ret
Function at 0x404fc0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x404fee
xor eax, eax
ret
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 8]
push edx
mov edx, dword [esp + 0x1c]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x405021
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
ret
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
ret
Function at 0x4054f0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x24], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40552f
pop edi
pop esi
pop ebp
mov eax, 0xfffffffd
pop ebx
add esp, 0x108
ret
mov edx, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x14]
push 0x104
push ecx
push edi
push edx
call ebx
test eax, eax
jne 0x405582
mov ebp, dword [esp + 0x11c]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push ebp
push eax
push ecx
call fcn.00405040
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x40559a
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
inc edi
push 0x104
push edx
push edi
push eax
call ebx
test eax, eax
je 0x405552
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x4058a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
call fcn.00405820
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4058f6
mov edi, str.TcpIpDog.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push esi
mov esi, edi
mov edx, ecx
mov edi, 0x4179a0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x4179a0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
pop esi
je 0x4058f6
call fcn.004055c0
pop edi
ret

Function at 0x405900
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov ecx, dword [esp + 4]
push esi
test ecx, ecx
je 0x40596a
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40596a
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x405928
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
sete al
pop esi
ret
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40596a
mov eax, dword [esp + 8]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x40595f
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
ret
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop esi
ret

Function at 0x405cf0
Capabilities:
Read .ini file

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x40
lea eax, [esp]
push str.._client.ini
push 0x3e
push eax
push 0x41bd14
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 1
jl 0x405d2b
lea eax, [esp]
push eax
call dword [sym.imp.MSVCRT.dll_atol]
add esp, 4
add esp, 0x40
ret
xor eax, eax
add esp, 0x40
ret

Function at 0x405d40
Capabilities:
Read .ini file

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x40
lea eax, [esp]
push str.._client.ini
push 0x3e
push eax
push 0x41bd14
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 1
jl 0x405d7c
mov al, byte [esp]
mov ecx, dword [esp + 0x4c]
and eax, 1
shl eax, cl
or dword [0x41bc38], eax
add esp, 0x40
ret

Function at 0x405d80
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push 0xfe
push 0x417524
push 0x41bd14
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jg 0x405daf
mov byte [0x417524], 0
mov eax, 0x417524
ret
Function at 0x405dc0
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
xor edi, edi
call fcn.00405c50
test al, al
je 0x4060fb
push edi
push str.debug
push str.Para
mov dword [0x41bc38], edi
call fcn.00405d40
push 1
push str.output_sele
push str.Para
call fcn.00405d40
push 2
push str.dflow
push str.Para
call fcn.00405d40
push 3
push str.close
push str.Para
call fcn.00405d40
push 4
push 0x414234
push str.Para
call fcn.00405d40
push 5
push str.chgpassword
push str.Para
call fcn.00405d40
add esp, 0x48
push 6
push str.card
push str.Para
call fcn.00405d40
push 7
push str.wtype
push str.Para
call fcn.00405d40
push 8
push str.serverip
push str.Para
call fcn.00405d40
push 9
push str.dhcp2
push str.Para
call fcn.00405d40
push 0xa
push str.drvpn
push str.Para
call fcn.00405d40
push 0xb
push str.arptest
push str.Para
call fcn.00405d40
add esp, 0x48
push 0xc
push str.help
push str.Para
call fcn.00405d40
push 0xd
push str.ipseg_sele
push str.Para
call fcn.00405d40
push 0xe
push str.capital
push str.Para
call fcn.00405d40
push 0xf
push str.option1
push str.Para
call fcn.00405d40
push 0x11
push str.option2
push str.Para
call fcn.00405d40
push 0x12
push str.option3
push str.Para
call fcn.00405d40
add esp, 0x48
push 0x13
push str.option4
push str.Para
call fcn.00405d40
push 0x14
push str.test
push str.Para
call fcn.00405d40
push 0x15
push str.option5
push str.Para
call fcn.00405d40
push 0x16
push str.option6
push str.Para
call fcn.00405d40
push 0x17
push str.option7
push str.Para
call fcn.00405d40
push 0x18
push str.option8
push str.Para
call fcn.00405d40
add esp, 0x48
push 0x19
push str.option9
push str.Para
call fcn.00405d40
push 0x1a
push str.option10
push str.Para
call fcn.00405d40
push 0x1b
push str.option11
push str.Para
call fcn.00405d40
push str.again_no
push str.Para
call fcn.00405cf0
add esp, 0x2c
mov byte [0x412024], al
test al, al
ja 0x405fcf
mov byte [0x412024], 3
push 0xff
push str.._client.ini
push str.outtext1
push str.Para
call fcn.00405d80
mov esi, dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
push eax
push 0x41ba88
call esi
add esp, 0xc
push 0xff
push str.._client.ini
push str.outtext2
push str.Para
call fcn.00405d80
add esp, 0xc
push eax
push 0x41b988
call esi
mov al, byte [0x41bc38]
mov esi, dword [sym.imp.USER32.dll_DeleteMenu]
add esp, 0xc
test al, 0x20
je 0x406046
mov eax, dword [0x41b62c]
push 0
push 0x130
push eax
mov edi, 1
call esi
test byte [0x41bc38], 0x40
je 0x406064
mov ecx, dword [0x41b62c]
push 0
push 0x13a
push ecx
mov edi, 1
call esi
mov eax, dword [0x41bc38]
test ah, 0x10
jne 0x406083
mov edx, dword [0x41b62c]
push 0
push 0x140
push edx
mov edi, 1
call esi
test dword [0x41bc38], 0x20000
je 0x4060b2
mov cl, byte [0x41b2e1]
mov eax, dword [0x41b62c]
push 0
and cl, 0xfd
push 0x135
push eax
mov byte [0x41b2e1], cl
mov edi, 1
call esi
test dword [0x41bc38], 0x200000
je 0x4060dc
mov al, byte [0x41b2e1]
mov ecx, dword [0x41b62c]
push 0
or al, 1
push 0x136
push ecx
mov byte [0x41b2e1], al
call esi
jmp 0x4060e0
test edi, edi
je 0x4060fb
mov edx, dword [0x41b648]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
call esi
mov eax, dword [0x41b648]
push 5
push eax
call esi
pop edi
pop esi
ret
Function at 0x406510
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x84
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [esp + 0xc]
push 0x7e
xor bl, bl
push eax
push str.USERDNSDOMAIN
mov byte [0x417504], 0
mov byte [esp + 0x14], bl
call esi
test eax, eax
jbe 0x406543
mov bl, 1
mov byte [esp + 8], bl
push edi
lea ecx, [esp + 0x10]
push 0x7e
push ecx
push str.USERNAME
call esi
test eax, eax
jbe 0x4065aa
lea edx, [esp + 0x10]
push 0x1a
push edx
push 0x417504
call dword [sym.imp.MSVCRT.dll_strncpy]
mov edi, 0x417504
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4065aa
mov al, byte [edx + 0x417504]
cmp al, 0x41
jl 0x406596
cmp al, 0x5a
jg 0x406596
or al, 0x20
mov byte [edx + 0x417504], al
mov edi, 0x417504
or ecx, 0xffffffff
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x406580
mov eax, dword [esp + 0x94]
pop edi
cmp eax, 1
jne 0x4065e5
mov eax, dword [esp + 8]
push 0x417504
and eax, 0xff
lea ecx, [esp + 0x10]
push eax
push str.dnsdomainmark_lu__USERNAME_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0x1c]
push 0
push edx
call fcn.004038a0
add esp, 0x18
test bl, bl
pop esi
pop ebx
setne al
add esp, 0x84
ret

Function at 0x406620
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
test eax, eax
jge 0x40662b
xor eax, eax
ret
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0x10
push 0x418cf0
push 0
push eax
mov eax, dword [0x418d10]
push edx
push eax
mov dword [0x418cf4], ecx
call sub.WSOCK32.dll_sendto
mov ecx, eax
inc eax
neg eax
sbb eax, eax
mov dword [0x418ce0], ecx
and eax, ecx
ret

Function at 0x406960
Capabilities:
Create process on windows
Read .ini file

Disassembly:
sub esp, 0x194
lea edx, [esp + 0x54]
push ebx
mov ebx, dword [esp + 0x19c]
push esi
push edi
cmp ebx, 1
mov edi, str.startfile
je 0x406983
mov edi, str.exefile
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.._client.ini
mov eax, ecx
mov esi, edi
mov edi, edx
push 0xfe
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x68]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xa8]
push ecx
push 0x41bd14
push edx
push str.Para
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 1
jb 0x406a15
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0xc]
cmp ebx, 1
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], 0x44
jne 0x4069ef
mov dword [esp + 0x38], ebx
mov word [esp + 0x3c], ax
lea eax, [esp + 0x50]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xbc]
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebx
add esp, 0x194
ret
Function at 0x406a20
Capabilities:
Hide graphical window

Disassembly:
push 1
push 0x11
call fcn.004036d0
add esp, 4
push eax
call fcn.004038a0
mov eax, dword [0x41b62c]
add esp, 8
push 0
push 0x12f
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0x4a
call fcn.004036d0
push eax
call fcn.00403ee0
add esp, 8
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
test byte [0x41b2e1], 4
je 0x406a78
mov ecx, dword [0x41b648]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.00406960
pop ecx
ret

Function at 0x406a90
Capabilities:
Create process on windows

Disassembly:
push edi
xor eax, eax
push 0x416f10
push 0x416ec8
push eax
push eax
mov ecx, 0x11
mov edi, 0x416ec8
push eax
push eax
rep stosd dword es:[edi], eax
push eax
mov word [0x416ef8], ax
push eax
mov eax, dword [esp + 0x28]
push eax
push 0
mov dword [0x416ec8], 0x44
mov dword [0x416ef4], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x406af7
push 0
push str.wcapsetupmark1
mov dword [0x41bcec], 1
call fcn.00406100
add esp, 8
mov al, 1
ret
xor al, al
ret