joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4016ea
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10030
call fcn.0040c214
push ebx
push esi
push edi
mov ebx, 0x126916ca
xor ebx, 0x47d6
mov eax, dword [0x42c0bc]
cmp dword [ebp + 0xc], eax
je 0x401891
mov eax, dword [ebp + 0xc]
mov dword [0x42c0bc], eax
mov eax, ebx
sub eax, ebx
mov ebx, eax
cmp dword [0x42c0c0], 0
je 0x401742
mov eax, dword [0x42c0c0]
push eax
mov esi, dword [eax]
call dword [esi + 8]
and dword [0x42c0c0], 0
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 0xffff
lea eax, [ebp - 0x1001f]
push eax
push dword [ebp + 0xc]
call fcn.0040c554
push 1
push str.Microsoft_Internet_Explorer
lea eax, [ebp - 0x1001f]
push eax
call fcn.0040129c
add esp, 0xc
cmp eax, 0xffff
jne 0x40177f
and dword [0x42c0c0], 0
jmp 0x401891
mov eax, ebx
xor eax, ebx
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
mov edi, dword [eax]
call dword [edi + 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
je 0x401891
cmp dword [ebp - 4], 0
jne 0x401891
and dword [ebp - 8], 0
xor ebx, 0x23b6
push 0
call fcn.0040c710
pop ecx
mov eax, ebx
sub eax, ebx
mov ebx, eax
mov word [ebp - 0x20], 2
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
lea esi, [ebp - 0x20]
sub esp, 0x10
mov edi, esp
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
mov edi, dword [edi + 4]
push edi
mov edi, dword [edi]
call dword [edi + 0x20]
mov dword [ebp - 4], eax
mov eax, ebx
mul ebx
mov dword [ebp - 0x10028], eax
mov ebx, eax
cmp dword [ebp - 4], 0
jne 0x401855
push 0x42c0c0
push 0x42f304
mov eax, dword [ebp - 0x10]
push eax
mov edi, dword [eax]
call dword [edi]
mov dword [ebp - 4], eax
or eax, eax
jne 0x401855
mov eax, ebx
mul ebx
mov dword [ebp - 0x1002c], eax
mov ebx, eax
lea eax, [ebp - 0x10024]
push eax
mov eax, dword [0x42c0c0]
push eax
mov edi, dword [eax]
call dword [edi + 0x94]
mov dword [ebp - 4], eax
or eax, eax
jne 0x401855
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x10024], eax
je 0x401891
mov eax, ebx
add eax, ebx
mov ebx, eax
cmp dword [0x42c0c0], 0
je 0x40186f
mov eax, dword [0x42c0c0]
push eax
mov esi, dword [eax]
call dword [esi + 8]
inc dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 8], eax
jb 0x4017b6
and dword [0x42c0c0], 0
mov eax, ebx
mul ebx
mov dword [ebp - 0x10030], eax
mov ebx, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401896
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push ebx
push esi
push edi
mov edi, 0x7b780b62
xor edi, 0x5a51
mov eax, edi
mul edi
mov dword [ebp - 8], eax
mov edi, eax
push 0
push 0
push 4
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERN_CreateFileA
mov esi, eax
push 2
push 0
push 0
push esi
call sub.KERN_SetFilePointer
mov eax, dword [ebp + 0xc]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x4018df
mov ebx, eax
push 0
lea edx, [ebp - 4]
push edx
push ebx
push dword [ebp + 0xc]
push esi
call sub.KERN_WriteFile
sub edi, 0xe6b
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x42f234
push esi
call sub.KERN_WriteFile
push esi
call sub.KERN_CloseHandle
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4021a6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push esi
push edi
mov edi, 0x57f23d12
mov eax, edi
mul edi
mov dword [ebp - 4], eax
mov edi, eax
push dword [ebp + 8]
push 0x42a2d0
call fcn.0040c788
push dword [ebp + 0xc]
push 0x418fa0
call fcn.0040c788
add esp, 0x10
push 0x42c0c4
push 0
push 0
push 0x4020ee
push 0
push 0
call sub.KERN_CreateThread
mov esi, eax
mov eax, edi
mul edi
mov dword [ebp - 8], eax
mov edi, eax
push esi
call sub.KERN_CloseHandle
pop edi
pop esi
leave
ret
Function at 0x402d1a
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov word [ebp + 0x14], ax
mov ebx, 0x260666eb
mov eax, 0x51ba
mul ebx
mov dword [ebp - 0x1c], eax
mov ebx, eax
inc dword [0x42c094]
push 0
push 0
push 4
push 0
push 0
push 0xc0000000
push dword [ebp + 8]
call sub.KERN_CreateFileA
mov dword [ebp - 0x10], eax
mov eax, ebx
xor eax, ebx
mov ebx, eax
push 0
push dword [ebp - 0x10]
call sub.KERN_GetFileSize
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x10]
lea eax, [eax + edx + 0xff]
push eax
push 0
call sub.KERN_LocalAlloc
mov esi, eax
and dword [ebp - 4], 0
mov eax, ebx
xor eax, ebx
mov ebx, eax
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push esi
push dword [ebp - 0x10]
call sub.KERN_ReadFile
inc dword [0x42c094]
add ebx, 0x4c7e
and dword [ebp - 0xc], 0
jmp 0x402ebc
mov eax, dword [ebp + 0xc]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x402dbb
mov edx, eax
mov word [ebp - 0x22], dx
inc dword [0x42c094]
mov eax, ebx
mul ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ebx, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
jmp 0x402e41
mov eax, dword [ebp - 0x20]
cmp byte [esi + eax], 0xd
jne 0x402e3e
mov eax, dword [ebp - 0x20]
mov byte [esi + eax], 0
xor ebx, 0x2c8d
movzx eax, word [ebp - 0x22]
push eax
push 0
mov eax, dword [ebp - 0x28]
add eax, esi
push eax
push dword [ebp + 0xc]
call fcn.004014dc
add esp, 0x10
or eax, eax
jne 0x402e2b
mov eax, ebx
add eax, ebx
mov ebx, eax
mov eax, dword [ebp - 0x20]
mov byte [esi + eax], 0xd
jmp 0x402e98
mov eax, dword [ebp - 0x20]
mov byte [esi + eax], 0xd
add eax, 2
mov dword [ebp - 0x28], eax
mov eax, ebx
sub eax, ebx
mov ebx, eax
inc dword [ebp - 0x20]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
cmp dword [ebp - 0x20], eax
jb 0x402dea
inc dword [0x42c094]
mov eax, ebx
sub eax, ebx
mov ebx, eax
movzx eax, word [ebp - 0x22]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
add eax, esi
push eax
call fcn.0040c74c
add esp, 0xc
movzx eax, word [ebp - 0x22]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov byte [esi + eax], 0xd
inc dword [ebp - 4]
mov eax, ebx
sub eax, ebx
mov ebx, eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov byte [esi + eax], 0xa
inc dword [ebp - 4]
xor edi, edi
jmp 0x402eae
mov eax, dword [ebp + 0xc]
movzx edx, word [ebp - 0x22]
lea edx, [edi + edx + 1]
mov dl, byte [eax + edx]
mov byte [eax + edi], dl
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x402e9c
mov eax, ebx
xor eax, ebx
mov ebx, eax
inc dword [ebp - 0xc]
movzx eax, word [ebp + 0x14]
cmp dword [ebp - 0xc], eax
jb 0x402db3
inc dword [0x42c094]
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
mov eax, dword [ebp - 8]
add eax, esi
push eax
push dword [ebp - 0x10]
call sub.KERN_WriteFile
push esi
call sub.KERN_LocalFree
xor ebx, 0x44a
push dword [ebp - 0x10]
call sub.KERN_CloseHandle
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402eff
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push edi
mov edi, 0x37190a55
add edi, 0x6da8
inc dword [0x42c094]
mov eax, edi
xor eax, edi
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040c6b0
push 0xff
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call fcn.0040c6c8
push dword [ebp - 4]
call fcn.0040c6a4
mov eax, 0x735a
mul edi
mov dword [ebp - 8], eax
mov edi, eax
pop edi
leave
ret

Function at 0x4033a6
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [ebp + 0x14]
mov word [ebp + 0x14], ax
mov edi, 0x5b6518d3
mov eax, edi
xor eax, edi
mov edi, eax
inc dword [0x42c104]
push 4
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 6]
push eax
call fcn.0040c74c
add esp, 0xc
add edi, 0x42ea
inc dword [0x42c104]
mov byte [ebp - 0xa], 5
add edi, 0x7c05
movzx eax, byte [ebp + 0xc]
sub eax, 0x5a
mov byte [ebp - 9], al
mov byte [ebp - 8], 0
add edi, 0x453e
mov byte [ebp - 7], 1
movzx esi, word [ebp + 0x14]
and esi, 0xff00
sar esi, 8
mov ebx, esi
mov byte [ebp - 2], bl
movzx eax, word [ebp + 0x14]
and eax, 0xff
mov byte [ebp - 1], al
add edi, 0x343c
inc dword [0x42c104]
push 0
push 0xa
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.wsock32.dll_send
xor edi, 0x471c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4037a2
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x420c3a3c
sub edi, 0x7860
inc dword [0x42c104]
cmp byte [esi + 0x40], 4
jne 0x4037fe
cmp byte [ebp + 0xc], 0
jne 0x4037dd
push 0
push 8
push 0x42f0d8
push dword [esi + 4]
call sub.wsock32.dll_send
jmp 0x4037ee
push 0
push 8
push 0x42f0cf
push dword [esi + 4]
call sub.wsock32.dll_send
mov eax, 0x667c
mul edi
mov dword [ebp - 0x10], eax
mov edi, eax
xor eax, eax
jmp 0x403872
inc dword [0x42c104]
mov eax, 0x3b1b
mul edi
mov dword [ebp - 0x10], eax
mov edi, eax
inc dword [0x42c104]
mov byte [ebp - 0xa], 5
xor edi, 0x25e6
mov al, byte [ebp + 0xc]
mov byte [ebp - 9], al
mov byte [ebp - 8], 0
mov byte [ebp - 7], 1
mov eax, 0x4a9
mul edi
mov dword [ebp - 0x14], eax
mov edi, eax
push 4
mov eax, esi
add eax, 0x78
push eax
lea eax, [ebp - 6]
push eax
call fcn.0040c74c
add esp, 0xc
mov al, byte [esi + 0x76]
mov byte [ebp - 2], al
mov al, byte [esi + 0x77]
mov byte [ebp - 1], al
push 0
push 0xa
lea eax, [ebp - 0xa]
push eax
push dword [esi + 4]
call sub.wsock32.dll_send
sub edi, 0x4065
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x4038ae
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0xa6551db
xor edi, 0x1a66
inc dword [0x42c104]
cmp byte [esi + 0x43], 3
jne 0x403918
mov eax, esi
add eax, 0x45
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 4], eax
inc dword [0x42c104]
or eax, eax
jne 0x403909
inc dword [0x42c104]
mov eax, edi
sub eax, edi
mov edi, eax
push 1
push esi
call fcn.00403876
add esp, 8
add edi, 0x206a
xor eax, eax
inc eax
jmp 0x40396b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi + 0x78], eax
jmp 0x40394c
movzx ebx, byte [esi + 0x44]
movzx edx, byte [esi + 0x45]
movzx edx, dx
shl edx, 8
or ebx, edx
movzx ebx, bx
movzx edx, byte [esi + 0x46]
movzx ecx, byte [esi + 0x47]
movzx ecx, cx
shl ecx, 8
or edx, ecx
movzx edx, dx
shl edx, 0x10
or ebx, edx
mov dword [esi + 0x78], ebx
add edi, 0x41d
inc dword [0x42c104]
movzx ebx, byte [esi + 0x77]
movzx edx, byte [esi + 0x76]
movzx edx, dx
shl edx, 8
or ebx, edx
mov word [esi + 0x7c], bx
add edi, 0x6a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403970
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x556264a3
add edi, 0x40ce
inc dword [0x42c104]
push esi
call fcn.004038ae
pop ecx
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [esi + 0x80], eax
mov word [esi + 0x84], 2
sub edi, 0x1f6f
movzx eax, word [esi + 0x7c]
push eax
call sub.wsock32.dll_htons
mov ebx, eax
mov word [esi + 0x86], bx
mov eax, dword [esi + 0x78]
mov dword [esi + 0x88], eax
inc dword [0x42c104]
add edi, 0x5012
push 0x10
mov eax, esi
add eax, 0x84
push eax
push dword [esi + 0x80]
call sub.wsock32.dll_connect
or eax, eax
je 0x403a18
inc dword [0x42c104]
mov eax, edi
mul edi
mov dword [ebp - 4], eax
mov edi, eax
push 1
push esi
call fcn.00403876
add esp, 8
mov eax, edi
sub eax, edi
mov edi, eax
xor eax, eax
inc eax
jmp 0x403a31
inc dword [0x42c104]
add edi, 0x2bdd
push 0
push esi
call fcn.004037a2
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403a36
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x5568042d
xor edi, 0x38e3
mov byte [ebp - 0x10d], 0
mov eax, edi
mul edi
mov dword [ebp - 0x114], eax
mov edi, eax
inc dword [0x42c104]
and dword [ebp - 0x104], 0
add edi, 0x7d7e
cmp dword [ebp - 0x104], 0x40
jae 0x403a95
mov ebx, dword [ebp - 0x104]
inc dword [ebp - 0x104]
mov edx, dword [esi + 4]
mov dword [ebp + ebx*4 - 0x100], edx
mov dword [ebp - 0x10c], 5
and dword [ebp - 0x108], 0
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push 1
call sub.wsock32.dll_select
inc dword [0x42c104]
add edi, 0x7616
lea eax, [ebp - 0x104]
push eax
push dword [esi + 4]
call sub.wsock32.dll___WSAFDIsSet
or eax, eax
je 0x403af9
push 0
push 1
lea eax, [ebp - 0x10d]
push eax
push dword [esi + 4]
call sub.wsock32.dll_recv
sub edi, 0x37e9
jmp 0x403b13
inc dword [0x42c104]
mov eax, edi
xor eax, edi
mov edi, eax
mov dword [esi + 0x38], 1
mov dword [esi + 0x3c], 1
movzx eax, byte [ebp - 0x10d]
jmp 0x403b2b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403b30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.0040c214
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], 0xdf31b93
add dword [ebp - 8], 0x1ec5
cmp byte [ebx + 0x40], 4
jne 0x403bc9
inc dword [0x42c104]
push ebx
call fcn.00403a36
mov edx, eax
mov byte [ebx + 0x76], dl
mov eax, dword [ebp - 8]
mov edx, eax
sub edx, eax
mov dword [ebp - 8], edx
push ebx
call fcn.00403a36
add esp, 8
mov edx, eax
mov byte [ebx + 0x77], dl
mov byte [ebx + 0x43], 1
and dword [ebp - 0x24], 0
push ebx
call fcn.00403a36
pop ecx
mov edi, dword [ebp - 0x24]
mov edx, eax
mov byte [edi + ebx + 0x44], dl
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x403b88
mov eax, dword [ebp - 8]
mov edx, eax
sub edx, eax
mov dword [ebp - 8], edx
push 0
push 0xfff
lea eax, [ebp - 0x1023]
push eax
push dword [ebx + 4]
call sub.wsock32.dll_recv
xor eax, eax
inc eax
jmp 0x403d18
lea edi, [ebp - 0x20]
lea esi, [0x42c10c]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
inc dword [0x42c104]
mov eax, 0xdfd
mul dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], eax
push ebx
call fcn.00403a36
push ebx
call fcn.00403a36
mov edx, eax
mov byte [ebx + 0x41], dl
push ebx
call fcn.00403a36
mov edx, eax
mov byte [ebx + 0x42], dl
add dword [ebp - 8], 0x1cb2
push ebx
call fcn.00403a36
add esp, 0x10
mov edx, eax
mov byte [ebx + 0x43], dl
cmp byte [ebx + 0x41], 1
je 0x403c3f
cmp dword [ebx + 0x80], 2
je 0x403c3f
push 7
push ebx
call fcn.00403876
add esp, 8
xor eax, eax
jmp 0x403d18
inc dword [0x42c104]
mov eax, dword [ebp - 8]
mov edx, eax
xor edx, eax
mov dword [ebp - 8], edx
mov al, byte [ebx + 0x43]
cmp al, 4
jae 0x403c5a
cmp al, 0
ja 0x403c76
push 8
push ebx
call fcn.00403876
add esp, 8
xor eax, eax
jmp 0x403d18
movzx edi, byte [ebx + 0x43]
shl edi, 2
mov edi, dword [ebp + edi - 0x20]
mov dword [ebp - 0xc], edi
sub dword [ebp - 8], 0x1e1f
push ebx
call fcn.00403a36
pop ecx
mov edx, eax
mov byte [ebx + 0x44], dl
cmp byte [ebx + 0x43], 3
jne 0x403ca5
movzx eax, byte [ebx + 0x44]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2d
jle 0x403cb2
mov dword [ebp - 0xc], 0x2d
mov dword [ebp - 4], 1
jmp 0x403cce
push ebx
call fcn.00403a36
pop ecx
mov edi, dword [ebp - 4]
mov edx, eax
mov byte [edi + ebx + 0x44], dl
inc dword [ebp - 4]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 4], eax
jl 0x403cbb
mov byte [eax + ebx + 0x44], 0
xor dword [ebp - 8], 0x109d
push ebx
call fcn.00403a36
mov edx, eax
mov byte [ebx + 0x76], dl
push ebx
call fcn.00403a36
add esp, 8
mov edx, eax
mov byte [ebx + 0x77], dl
inc dword [0x42c104]
cmp dword [ebx + 0x38], 0
je 0x403d14
cmp dword [0x40d03c], 1
jne 0x403d14
xor eax, eax
jmp 0x403d18
movzx eax, byte [ebx + 0x41]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4041a3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov eax, dword [ebp + 8]
mov word [ebp + 8], ax
mov edi, 0x5bf35a2c
mov eax, 0x6f96
mul edi
mov dword [ebp - 8], eax
mov edi, eax
inc dword [0x42c104]
xor edi, 0x2838
mov ax, word [ebp + 8]
mov word [0x42c0ac], ax
mov byte [0x42c108], 0
push 0
push 0xa400
push section..bss
call fcn.0040c758
add esp, 0xc
inc dword [0x42c104]
sub edi, 0x212e
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x40400c
push 0
push 0
call sub.KERN_CreateThread
mov esi, eax
mov eax, edi
sub eax, edi
mov edi, eax
push esi
call sub.KERN_CloseHandle
inc dword [0x42c104]
mov eax, edi
sub eax, edi
mov edi, eax
push 0
call fcn.0040c710
pop ecx
cmp byte [0x42c108], 0
je 0x40422a
inc dword [0x42c104]
mov eax, edi
mul edi
mov dword [ebp - 0xc], eax
mov edi, eax
movzx eax, byte [0x42c108]
pop edi
pop esi
leave
ret

Function at 0x4046b5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, 0x7a4726a7
add edi, 0x5da9
inc dword [0x42c094]
push 0x42c699
call sub.KERN_GetModuleHandleA
mov esi, eax
push str.RtlInitUnicodeString
push esi
call sub.KERN_GetProcAddress
mov dword [0x42a0bc], eax
sub edi, 0x1096
push str.NtUnmapViewOfSection
push esi
call sub.KERN_GetProcAddress
mov dword [0x418f90], eax
push str.NtOpenSection
push esi
call sub.KERN_GetProcAddress
mov dword [0x418d80], eax
push str.NtMapViewOfSection
push esi
call sub.KERN_GetProcAddress
mov dword [0x419fa0], eax
mov eax, edi
mul edi
mov dword [ebp - 4], eax
mov edi, eax
push str.RtlNtStatusToDosError
push esi
call sub.KERN_GetProcAddress
mov dword [0x42a0b8], eax
pop edi
pop esi
leave
ret
Function at 0x40538a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov eax, dword [ebp + 8]
mov word [ebp + 8], ax
mov edi, 0x268e0353
mov eax, edi
mul edi
mov dword [ebp - 8], eax
mov edi, eax
inc dword [0x42c094]
cmp dword [0x42ca04], 0
je 0x4053bc
mov eax, 2
jmp 0x405432
mov eax, edi
add eax, edi
mov edi, eax
mov ax, word [ebp + 8]
mov word [0x4185ec], ax
mov byte [0x42a0c0], 0
mov eax, edi
add eax, edi
mov edi, eax
push 0x7d0
push 0
push 0x417610
call fcn.0040c758
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x405536
push 0
push 0
call sub.KERN_CreateThread
mov dword [0x42b818], eax
mov eax, 0x4d8d
mul edi
mov dword [ebp - 0xc], eax
mov edi, eax
push 0
call fcn.0040c710
pop ecx
cmp byte [0x42a0c0], 0
je 0x405408
inc dword [0x42c094]
movzx eax, byte [0x42a0c0]
pop edi
leave
ret

Function at 0x405435
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov esi, 0x43585c70
add esi, 0x234f
inc dword [0x42c094]
xor edi, edi
jmp 0x4054d9
mov eax, 0x14
mul edi
mov dword [ebp - 4], eax
cmp dword [eax + 0x417610], 0
jne 0x405473
cmp dword [eax + 0x417614], 0
je 0x4054d8
inc dword [0x42c094]
mov eax, esi
mul esi
mov dword [ebp - 8], eax
mov esi, eax
mov eax, 0x14
mul edi
mov dword [ebp - 0xc], eax
push dword [eax + 0x417610]
call sub.wsock32.dll_closesocket
mov eax, 0x14
mul edi
mov dword [ebp - 0x10], eax
push dword [eax + 0x417614]
call sub.wsock32.dll_closesocket
mov eax, 0x14
mul edi
mov dword [ebp - 0x14], eax
and dword [eax + 0x417614], 0
mov eax, esi
xor eax, esi
mov esi, eax
mov eax, 0x14
mul edi
mov dword [ebp - 0x18], eax
and dword [eax + 0x417610], 0
inc edi
cmp edi, 0x64
jb 0x405455
push 0x7d0
push 0
push 0x417610
call fcn.0040c758
add esp, 0xc
xor esi, 0x4e7b
push dword [0x42ca04]
call sub.wsock32.dll_closesocket
and dword [0x42ca04], 0
xor esi, 0x37d4
push 0
push dword [0x42b818]
call sub.KERN_TerminateThread
push dword [0x42b818]
call sub.KERN_CloseHandle
inc dword [0x42c094]
pop edi
pop esi
leave
ret
Function at 0x4056c7
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov edi, 0x5d6f2cff
add edi, 0x23bd
inc dword [0x42c094]
push 0xe
push dword [ebp + 0xc]
lea eax, [ebp - 0x66]
push eax
call fcn.0040c74c
add esp, 0xc
mov eax, 0x16d3
mul edi
mov dword [ebp - 0x6c], eax
mov edi, eax
mov byte [ebp - 0x58], 0
inc dword [0x42c094]
lea ecx, [ebp - 0x66]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x405711
push eax
lea edx, [ebp - 0x66]
push edx
call fcn.0040c62c
mov eax, edi
sub eax, edi
mov edi, eax
push 1
push 0x42f2a2
lea eax, [ebp - 0x66]
push eax
call fcn.0040129c
add esp, 0xc
mov ebx, eax
cmp eax, 0xffff
jne 0x40574e
mov eax, 0xffffffff
jmp 0x4058d5
cmp dword [ebp + 0x18], 0
jne 0x4057c6
push 1
push str._HTTP:__
lea eax, [ebp - 0x66]
push eax
call fcn.0040129c
add esp, 0xc
cmp eax, ebx
jne 0x405770
cmp ebx, 0xa
jbe 0x405778
or eax, 0xffffffff
jmp 0x4058d5
mov eax, edi
mul edi
mov dword [ebp - 0x70], eax
mov edi, eax
inc ebx
mov word [ebp - 2], 0
jmp 0x40579f
movzx eax, word [ebp - 2]
lea edx, [eax + ebx + 7]
mov ecx, dword [ebp + 0xc]
mov dl, byte [ecx + edx]
mov byte [esi + eax], dl
inc word [ebp - 2]
movzx eax, word [ebp - 2]
cmp eax, 0x5f
jl 0x40578a
add edi, 0x52b4
push 1
push 0x42f0c1
push esi
call fcn.0040129c
add esp, 0xc
mov edx, eax
mov word [ebp - 2], dx
jmp 0x405816
mov word [ebp - 2], 0
jmp 0x4057e3
movzx eax, word [ebp - 2]
lea edx, [eax + ebx + 1]
mov ecx, dword [ebp + 0xc]
mov dl, byte [ecx + edx]
mov byte [esi + eax], dl
inc word [ebp - 2]
movzx eax, word [ebp - 2]
cmp eax, 0x5f
jl 0x4057ce
mov eax, edi
sub eax, edi
mov edi, eax
push 1
push 0x42f2a2
push esi
call fcn.0040129c
add esp, 0xc
mov edx, eax
mov word [ebp - 2], dx
movzx eax, word [ebp - 2]
cmp byte [esi + eax], 0x2f
jne 0x405816
dec word [ebp - 2]
inc dword [0x42c094]
push 1
push 0x42f1dd
push esi
call fcn.0040129c
add esp, 0xc
mov edx, eax
mov word [ebp - 0x68], dx
movzx eax, word [ebp - 2]
cmp eax, 0xffff
je 0x405842
cmp eax, 2
jge 0x40584a
or eax, 0xffffffff
jmp 0x4058d5
sub edi, 0x473b
movzx eax, word [ebp - 2]
mov byte [esi + eax], 0
movzx eax, word [ebp - 0x68]
cmp eax, 0xffff
je 0x4058a3
movzx eax, word [ebp - 0x68]
lea eax, [eax + esi + 1]
push eax
call fcn.0040c734
pop ecx
mov dword [ebp - 0x70], eax
mov eax, edi
mul edi
mov dword [ebp - 0x74], eax
mov edi, eax
cmp dword [ebp - 0x70], 0
je 0x4058a3
push 4
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0x14]
call fcn.0040c74c
add esp, 0xc
movzx eax, word [ebp - 0x68]
mov byte [esi + eax], 0
mov eax, edi
sub eax, edi
mov edi, eax
inc dword [0x42c094]
push esi
call sub.wsock32.dll_gethostbyname
mov ebx, eax
mov eax, edi
add eax, edi
mov edi, eax
or ebx, ebx
jne 0x4058c8
mov eax, 0xfffffffe
jmp 0x4058d5
inc dword [0x42c094]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4069d7
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov word [ebp + 0x10], ax
mov edi, 0x5cd06427
add edi, 0x7e94
inc dword [0x42c094]
cmp word [ebp + 0x10], 0x194
jne 0x406a0e
push str.HTTP_1.0_404_Host_Not_Found_r_nPragma:_no_cache_r_nContent_type:_text_html_r_n_r_n_HTML__HEAD__TITLE_Error404__TITLE___HEAD__BODY__h1_Error404:_Hostname_DNS_lookup_failed
push esi
call fcn.0040c788
add esp, 8
mov eax, edi
xor eax, edi
mov edi, eax
cmp word [ebp + 0x10], 0x190
jne 0x406a2a
push str.HTTP_1.0_400_Malformed_Request_r_nPragma:_no_cache_r_nContent_type:_text_html_r_n_r_n_HTML__HEAD__TITLE_Error400__TITLE___HEAD__BODY__h1_Error300:_Browser_sent_malformed_request
push esi
call fcn.0040c788
add esp, 8
mov ecx, esi
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x406a2f
push 0
push eax
push esi
mov ebx, dword [ebp + 8]
push dword [ebx]
call sub.wsock32.dll_send
add edi, 0x79b0
pop edi
pop esi
pop ebx
pop ebp
ret