joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fd954
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4fd95c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4fdb4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4fdb64
mov eax, esi
call fcn.004fb6e4
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404f10
lea ecx, [ebp - 0x10]
mov edx, 0x4fdb78
mov eax, esi
call fcn.004fb6e4
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404f10
lea ecx, [ebp - 0x14]
mov edx, 0x4fdb90
mov eax, esi
call fcn.004fb6e4
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404f10
lea ecx, [ebp - 0x18]
mov edx, 0x4fdbac
mov eax, esi
call fcn.004fb6e4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404f10
lea ecx, [ebp - 0x1c]
mov edx, 0x4fdbc8
mov eax, esi
call fcn.004fb6e4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404f10
lea ecx, [ebp - 0x24]
mov edx, 0x4fdbe0
mov eax, esi
call fcn.004fb6e4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004098e8
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00409eec
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x4fdbf8
mov eax, esi
call fcn.004fb6e4
mov eax, dword [ebp - 0x28]
call fcn.004fa7fc
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x4fdc08
mov eax, esi
call fcn.004fb6e4
mov eax, dword [ebp - 0x2c]
call fcn.004fa7fc
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x4fdc20
mov eax, esi
call fcn.004fb6e4
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00409eec
inc eax
je 0x4fdaf1
lea ecx, [ebp - 0x34]
mov edx, 0x4fdc20
mov eax, esi
call fcn.004fb6e4
mov eax, dword [ebp - 0x34]
call fcn.00409eb0
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040bbb0
fstp qword [ebp - 0x3c]
wait
call fcn.0040bf20
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x4fdb0c
lea ecx, [ebp - 0x40]
mov edx, 0x4fdc20
mov eax, esi
call fcn.004fb6e4
mov eax, dword [ebp - 0x40]
call fcn.004fa7fc
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x4fdc30
mov eax, esi
call fcn.004fb6e4
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404f10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fdb55
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404ee0
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404ee0
ret
Function at 0x509dec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x509e46
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00509ddc
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.004f9468
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.004f9068
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509e4d
lea eax, [ebp - 4]
call fcn.00404ebc
ret
Function at 0x5245e0
Capabilities:
Create service
Persist via windows service
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405388
mov eax, dword [ebp - 8]
call fcn.00405388
mov eax, dword [ebp + 0xc]
call fcn.00405388
xor eax, eax
push ebp
push 0x5246b0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
call fcn.00405398
push eax
push 0
push 2
push 0x110
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.00405398
push eax
mov eax, dword [ebp - 4]
call fcn.00405398
push eax
push ebx
call sub.advapi32.dll_CreateServiceA
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x524675
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
call sub.advapi32.dll_StartServiceA
test ebx, ebx
je 0x52467d
mov bl, 1
jmp 0x52467f
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5246b7
lea eax, [ebp - 0xc]
mov edx, dword [0x5245b8]
call fcn.004065fc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ee0
lea eax, [ebp + 0xc]
call fcn.00404ebc
ret

Function at 0x5262d4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405388
xor eax, eax
push ebp
push 0x5263c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov dl, 1
mov eax, dword [0x43cd68]
call fcn.0043ce68
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x52639c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.0043cf44
xor ecx, ecx
mov edx, 0x5263e0
mov eax, dword [ebp - 0xc]
call fcn.0043cfa8
lea ecx, [ebp - 0x10]
mov edx, 0x526400
mov eax, dword [ebp - 0xc]
call fcn.0043d190
mov eax, dword [ebp - 4]
call fcn.00405398
mov ebx, eax
mov edx, ebx
lea eax, [ebp - 0x14]
call fcn.004050b4
mov eax, dword [ebp - 0x14]
call fcn.0040a604
push 0
push ebx
mov eax, dword [ebp - 0x10]
call fcn.00405398
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x52637e
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5263a3
mov eax, dword [ebp - 0xc]
call fcn.0043cf14
mov eax, dword [ebp - 0xc]
call fcn.00403f6c
ret
Function at 0x529948
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5299cb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403668
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x5299e4
mov edx, ebx
call fcn.004051e4
mov eax, dword [ebp - 0x24]
call fcn.00405398
mov dword [ebp - 0x16], eax
mov eax, 0x5299e8
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5299d2
lea eax, [ebp - 0x24]
call fcn.00404ebc
ret
Function at 0x52a24c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
xor eax, eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
xor eax, eax
push ebp
push 0x52a382
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 9
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x52a364
cmp dword [ebp - 0x84], 2
jne 0x52a364
cmp dword [ebp - 0x90], 5
jne 0x52a364
cmp dword [ebp - 0x8c], 1
jne 0x52a364
lea eax, [ebp - 0x98]
lea edx, [ebp - 0x80]
mov ecx, 0x80
call fcn.0040512c
mov eax, dword [ebp - 0x98]
mov edx, 0x52a398
call fcn.004052e4
jne 0x52a2f2
mov ebx, 1
lea eax, [ebp - 0x9c]
lea edx, [ebp - 0x80]
mov ecx, 0x80
call fcn.0040512c
mov eax, dword [ebp - 0x9c]
mov edx, 0x52a3b0
call fcn.004052e4
jne 0x52a31c
mov ebx, 2
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0x80]
mov ecx, 0x80
call fcn.0040512c
mov eax, dword [ebp - 0xa0]
mov edx, 0x52a3c8
call fcn.004052e4
jne 0x52a346
mov ebx, 3
lea eax, [ebp - 0xa4]
lea edx, [ebp - 0x80]
mov ecx, 0x80
call fcn.0040512c
cmp dword [ebp - 0xa4], 0
jne 0x52a364
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52a389
lea eax, [ebp - 0xa4]
mov edx, 4
call fcn.00404ee0
ret

Function at 0x52a5b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x52a648
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.0040512c
mov eax, dword [ebp - 0x108]
lea edx, [ebp - 0x104]
call fcn.0040a7e4
mov edx, dword [ebp - 0x104]
mov eax, ebx
mov ecx, 0x52a65c
call fcn.004051e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52a64f
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.00404ee0
ret
Function at 0x52a9bc
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov word [ebp - 6], cx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00405388
xor eax, eax
push ebp
push 0x52ab25
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 7], 0
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.004050e4
mov eax, dword [ebp - 0x18]
call fcn.0040a36c
test al, al
je 0x52ab07
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0052a8f8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x52ab07
xor eax, eax
push ebp
push 0x52ab00
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
call fcn.00405398
push eax
call sub.kernel32.dll_BeginUpdateResourceA
mov edi, eax
test edi, edi
jne 0x52aa50
call fcn.004048bc
jmp 0x52ab07
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ebx, eax
sub ebx, 0xe
mov eax, ebx
call fcn.00402b58
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x52aae2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0xe
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x52aabb
cmp ebx, dword [ebp - 0x10]
jne 0x52aabb
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov ax, word [ebp - 6]
push eax
push esi
push 2
push edi
call sub.kernel32.dll_UpdateResourceA
test eax, eax
jne 0x52aabf
xor eax, eax
jmp 0x52aac1
mov al, 1
mov byte [ebp - 7], al
push 0
push edi
call sub.kernel32.dll_EndUpdateResourceA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52aae9
mov eax, dword [ebp - 0xc]
call fcn.00402b88
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52ab2c
lea eax, [ebp - 0x18]
call fcn.00404ebc
lea eax, [ebp - 4]
call fcn.00404ebc
ret

Function at 0x52ab38
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040512c
add esp, 0x100
pop ebx
ret

Function at 0x52b12c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push esp
push 0xff
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040512c
add esp, 0x100
pop ebx
ret
Function at 0x52b338
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405388
mov eax, dword [ebp - 8]
call fcn.00405388
xor eax, eax
push ebp
push 0x52b582
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x21], 0
mov eax, 1
call fcn.00402b58
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x52b543
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0040a1dc
mov ebx, eax
mov ecx, 2
xor edx, edx
mov eax, ebx
call fcn.0040a2b8
mov esi, eax
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0040a2b8
lea eax, [esi + 1]
call fcn.004095dc
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov ecx, esi
mov eax, ebx
call fcn.0040a260
mov eax, ebx
call fcn.0040a2fc
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
call fcn.004050b4
mov eax, dword [ebp - 0x28]
mov edx, 0x52b59c
call fcn.0052a060
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00405198
mov ebx, eax
test ebx, ebx
jl 0x52b4a5
inc ebx
mov edx, dword [ebp - 0x20]
mov eax, 0x52b5ac
call fcn.004054dc
test eax, eax
jle 0x52b49e
lea eax, [ebp - 0x1c]
mov ecx, 0x52b5ac
mov edx, dword [ebp - 8]
call fcn.004051e4
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
call fcn.004054dc
mov esi, eax
test esi, esi
jle 0x52b465
mov eax, dword [ebp - 0x1c]
call fcn.00405198
mov ecx, eax
lea eax, [ebp - 0x20]
mov edx, esi
call fcn.00405438
mov byte [ebp - 0x21], 1
jmp 0x52b49e
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x52b5ac
call fcn.004051e4
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
call fcn.004054dc
mov esi, eax
test esi, esi
jle 0x52b49e
mov eax, dword [ebp - 0x1c]
call fcn.00405198
mov ecx, eax
lea eax, [ebp - 0x20]
mov edx, esi
call fcn.00405438
mov byte [ebp - 0x21], 1
dec ebx
jne 0x52b419
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea eax, [ebp - 0x18]
call fcn.00404ebc
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x52b4f6
inc ebx
xor esi, esi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2c]
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x2c]
push 0x52b59c
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405258
inc esi
dec ebx
jne 0x52b4cd
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040a1dc
mov ebx, eax
mov eax, dword [ebp - 0x18]
call fcn.00405198
push eax
lea eax, [ebp - 0x18]
call fcn.004053f0
mov edx, eax
mov eax, ebx
pop ecx
call fcn.0040a28c
push ebx
call sub.kernel32.dll_SetEndOfFile_1
mov eax, ebx
call fcn.0040a2fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52b54a
mov eax, dword [ebp - 0x10]
call fcn.00402b88
ret
Function at 0x4014f0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov dword [section..data], 1
mov eax, dword [0x404160]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1f4
mov eax, dword [0x403014]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40154c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x102
jne 0x40154c
push 0
mov eax, dword [0x403014]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x403014]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
mov eax, dword [0x403018]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401595
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x102
jne 0x401595
push 0
mov eax, dword [0x403018]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x403018]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x404164]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x403004]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x404160]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x403024]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [section..bss]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x40301c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x403010]
push eax
call sub.WSOCK32.dll_closesocket
mov eax, 0x403010
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
xor eax, eax
jmp 0x401622
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4016d0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, eax
lea eax, [eax + eax*8]
lea eax, [ecx + eax*8]
add eax, eax
add eax, dword [ebp + 8]
add eax, 0x84
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov word [eax + 0xc], 0
mov eax, dword [ebp - 0x10]
mov ecx, eax
lea eax, [eax + eax*8]
lea eax, [ecx + eax*8]
add eax, eax
add eax, dword [ebp + 8]
add eax, 0x92
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x10]
mov ecx, eax
lea eax, [eax + eax*8]
lea eax, [ecx + eax*8]
add eax, eax
add eax, dword [ebp + 8]
add eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
jmp 0x401766
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x32
jge 0x401829
mov eax, dword [ebp - 0xc]
mov ecx, eax
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2]
cmp dword [eax*8 + 0x403084], 1
jne 0x401824
mov eax, dword [ebp - 0xc]
mov ecx, eax
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2]
lea eax, [eax*8 + 0x403030]
add eax, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
add eax, 0xa
push eax
mov eax, dword [ebp - 0x24]
add eax, 4
push eax
call dword [sym.imp.MSVCRT20.dll__stricmp]
add esp, 8
test eax, eax
jne 0x401824
mov eax, dword [ebp - 8]
mov ax, word [eax + 4]
and eax, 0xffff
mov ecx, dword [ebp - 0x24]
mov cx, word [ecx + 0x3e]
and ecx, 0xffff
cmp eax, ecx
jne 0x401824
mov eax, dword [ebp - 0xc]
mov ecx, eax
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2]
lea eax, [eax*8 + 0x403030]
add eax, 0x46
mov ecx, dword [ebp - 8]
add ecx, 0x7c
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov ax, word [eax + 0xc]
mov word [ecx + 0xc], ax
mov eax, dword [ebp - 8]
mov dword [eax], 3
xor eax, eax
jmp 0x401892
jmp 0x401763
mov word [ebp - 4], 0x100
mov word [ebp - 2], 0x7404
mov word [ebp - 0x20], 6
mov dword [ebp - 0x1e], 0
push 6
push str.FFFFFFFFFFFF
lea eax, [ebp - 0x1a]
push eax
call fcn.00401ed0
mov word [ebp - 0x14], 0x5204
push 0xffffffffffffffff
mov eax, dword [0x404164]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xe
lea eax, [ebp - 0x20]
push eax
push 0
push 4
lea eax, [ebp - 4]
push eax
mov eax, dword [0x403010]
push eax
call sub.WSOCK32.dll_sendto
mov eax, dword [0x404164]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x401892
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4023e2
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x402510
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov dword [0x404168], 0xffffffff
mov eax, dword [0x404168]
mov dword [0x40416c], eax
call dword [sym.imp.MSVCRT20.dll___p__fmode]
mov ecx, dword [0x406068]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT20.dll___p__commode]
mov ecx, dword [0x406064]
mov dword [eax], ecx
call fcn.0040250f
call fcn.004024fc
push 0x406080
push 0x40607c
call sub.MSVCRT20.dll__initterm
add esp, 8
mov eax, dword [0x406060]
push eax
mov eax, dword [0x40605c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.MSVCRT20.dll___getmainargs]
add esp, 0x14
push 0x406078
push 0x406074
call sub.MSVCRT20.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT20.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x24]
call fcn.00401000
add esp, 0xc
push eax
call dword [sym.imp.MSVCRT20.dll_exit]
jmp 0x4024d6
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4013b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push str.BINRES
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
test esi, esi
jne 0x4013d1
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ecx, dword [esp + 0x14]
push 0x4130b8
push ecx
mov edi, eax
call fcn.00409292
mov esi, eax
add esp, 8
test esi, esi
jne 0x40140e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00409168
push esi
call fcn.00409112
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x4056c0
Capabilities:
Identify system language via api

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultLangID]
mov edi, dword [esp + 0x10]
push eax
push edi
call fcn.004055d0
add esp, 0xc
test eax, eax
jne 0x4056fd
push esi
push 0x409
push edi
call fcn.004055d0
add esp, 0xc
test eax, eax
jne 0x4056fd
push esi
push eax
push edi
call fcn.004055d0
add esp, 0xc
pop edi
pop esi
ret