joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aabc8
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, edx
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00402d24
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x4ab7a4
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, ebx
xor ecx, ecx
mov edx, 0x118
call fcn.00402d24
cmp esi, 0x40
jbe 0x4ab811
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004aabc8
push esi
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov ecx, edi
call fcn.004aabf8
lea ecx, [ebp - 0x5c]
lea edx, [ebp - 0x6c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004aac98
lea edx, [ebx + 0x58]
lea eax, [ebp - 0x6c]
mov ecx, 0x10
call fcn.004028e8
mov esi, 0x10
jmp 0x4ab81d
lea edx, [ebx + 0x58]
mov eax, edi
mov ecx, esi
call fcn.004028e8
lea eax, [ebx + 0x98]
xor ecx, ecx
mov edx, 0x40
call fcn.00402d24
lea eax, [ebx + 0xd8]
xor ecx, ecx
mov edx, 0x40
call fcn.00402d24
mov edx, esi
dec edx
test edx, edx
jb 0x4ab85d
inc edx
lea eax, [ebx + 0x58]
mov cl, byte [eax]
mov byte [eax + 0x40], cl
mov cl, byte [eax]
mov byte [eax + 0x80], cl
inc eax
dec edx
jne 0x4ab84c
mov edx, 0x40
lea eax, [ebx + 0x98]
xor byte [eax], 0x36
xor byte [eax + 0x40], 0x5c
inc eax
dec edx
jne 0x4ab868
mov edx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004aabc8
push 0x40
lea ecx, [ebx + 0x98]
mov edx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004aabf8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4b93c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b945b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b943b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
add al, 0xbf
sub al, 0x1a
jb 0x4b9409
add al, 0xfa
sub al, 0x1a
jb 0x4b9409
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b9445
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004042a8
lea eax, [ebp - 8]
mov edx, 0x4b9474
call fcn.00404388
mov eax, dword [ebp - 8]
call fcn.00404580
push eax
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b9445
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9462
lea eax, [ebp - 8]
call fcn.004040c0
ret
Function at 0x4bb53c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x4bb556
add esp, 0xfffffff0
call fcn.00403678
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x4bb5a8
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, ecx
mov dword [ebx + 0x38], esi
lea eax, [ebp - 8]
mov edx, dword [esi + 0x14]
call fcn.004048f4
mov ecx, dword [ebp - 8]
mov eax, dword [esi + 0xc]
mov dl, 1
call dword [eax + 0x30]
mov edi, eax
mov dword [ebx + 4], edi
mov eax, edi
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb5af
lea eax, [ebp - 8]
call fcn.004047a0
ret
Function at 0x467118
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x294], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4671f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4671dc
xor edx, edx
push ebp
push 0x4671d5
push dword fs:[edx]
mov dword fs:[edx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x290]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x4671c2
lea eax, [ebp - 0x290]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4671c2
mov esi, dword [eax + 0xc]
test esi, esi
je 0x4671c2
jmp 0x4671bc
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x294]
call fcn.004045d0
mov edx, dword [ebp - 0x294]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x38]
add esi, 4
mov edi, dword [esi]
test edi, edi
jne 0x467198
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4671dc
call sub.wsock32.dll_WSACleanup
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4671fc
lea eax, [ebp - 0x294]
call fcn.004043e0
ret
Function at 0x409110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x409119
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
shl edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40915c
mov eax, dword [ebp - 8]
jmp 0x4091c2
cmp dword [ebp - 0xc], 1
je 0x40916f
cmp dword [ebp - 0xc], 2
je 0x40916f
mov eax, 0xd
jmp 0x4091c2
cmp dword [ebp + 0xc], 0
je 0x4091b6
cmp dword [ebp - 4], 0
je 0x4091a5
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x40919c
mov edx, dword [ebp - 4]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x4091a3
mov eax, 0xd
jmp 0x4091c2
jmp 0x4091b6
mov edx, 2
imul eax, edx, 0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax], cx
mov eax, dword [ebp - 4]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x409370
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x4093d5
push 0x5aadd8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40939c
mov eax, 1
jmp 0x4093f3
push str.RegDeleteKeyTransactedW
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4093d3
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
push 0
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x10]
jmp 0x4093f3
jmp 0x4093ee
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
je 0x4093ee
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x4093f3
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x40a230
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
xor eax, eax
jne 0x40a239
cmp dword [ebp + 0xc], 0
je 0x40a24c
mov dword [ebp - 0xc], 1
jmp 0x40a253
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x40a266
mov eax, 0xd
jmp 0x40a2bb
xor edx, edx
jne 0x40a23d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
mov ax, word [edx]
mov word [ebp - 2], ax
add dword [ebp - 8], 2
cmp word [ebp - 2], 0
jne 0x40a279
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
sar ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
lea eax, [edx + edx + 2]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40aa60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40aa84
xor eax, eax
jmp 0x40ab04
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40aa9b
xor eax, eax
jmp 0x40ab04
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x40aae7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x40aae7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x40aabe
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x40aaf3
xor eax, eax
jmp 0x40ab04
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x40ab01
xor eax, eax
jmp 0x40ab04
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40bd30
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x597fc8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x6031c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00425520
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.00402220
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00402220
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.00402220
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.00402220
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.00402220
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.00402220
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.00402220
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.00402220
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.00402220
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.00402220
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.00402220
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call fcn.00402220
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.00402220
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.0040c330
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x10]
add ecx, 0x78
call fcn.004106b0
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x10]
add ecx, 0x98
call fcn.004107d0
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x1c]
push eax
call fcn.0040f1f0
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.004025b0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1c]
call fcn.004023e0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x60], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x5c], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x58], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x18], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
push str._n_ignoreFailure_:__false__n_uiDisabled__:_false__n_uiHidden__:_false__n_uiUnSelected__:_false_n
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.00402590
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4154d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59885d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6031c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x10]
call fcn.00402220
mov dword [ebp - 4], 0
push 0x104
push 0x104
lea ecx, [ebp - 0x10]
call fcn.00405e30
push eax
push 0x5ac940
call fcn.0056b86c
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004094e0
cmp dword [ebp - 0x14], 0
je 0x41557b
push 0x11e
push 0x5ac948
lea ecx, [ebp - 0x24]
call fcn.00402040
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
call fcn.00402790
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00433d50
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004023e0
lea ecx, [ebp - 0x10]
call fcn.00402790
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea ecx, [ebp - 0x10]
call fcn.00402790
push eax
call fcn.0056bd68
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4155e3
push 0x123
push str.D:_apreltechSibSiblSiblEnvTools.cpp
lea ecx, [ebp - 0x30]
call fcn.00402040
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2c]
call fcn.00402790
push eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.00433d50
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004023e0
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401fd0
mov edx, dword [ebp - 0x18]
or edx, 1
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004023e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x417220
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x6031c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0xffffffff
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x38], 6
mov edx, dword [ebp + 0xc]
push edx
push 0x5acc48
push 0x10
lea eax, [ebp - 0x14]
push eax
call fcn.00417d90
add esp, 0x10
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4172af
call fcn.0057d1fe
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x18], edx
jmp 0x4172c0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
je 0x417331
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x4172f6
call fcn.00572982
mov edx, dword [eax]
mov dword [ebp - 0x20], edx
jmp 0x417331
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x417314
jmp 0x417331
call fcn.00572982
mov edx, dword [eax]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebp - 0x1c], 0xffffffff
jmp 0x4172b7
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x417346
call fcn.0057d1fe
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056a45e
mov esp, ebp
pop ebp
ret
Function at 0x4176b0
Capabilities:
Initialize winsock library
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x598a18
mov eax, dword fs:[0]
push eax
sub esp, 0x1ac
mov eax, dword [0x6031c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1b8], 0
lea ecx, [ebp - 0x1a4]
call fcn.00402220
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1a0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x417734
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1a4]
call fcn.004023e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004023e0
jmp 0x41780d
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1b0], ecx
lea ecx, [ebp + 8]
call fcn.00405f50
mov dword [ebp - 0x1b4], eax
mov edx, dword [ebp - 0x1b0]
push edx
mov eax, dword [ebp - 0x1b4]
push eax
push str.POST__collect_HTTP_1.1_r_nContent_Type:_application_x_www_form_urlencoded_r_nHost:_www.google_analytics.com_r_nContent_Length:__d_r_n_r_n_s
lea ecx, [ebp - 0x1a4]
push ecx
call fcn.0040e9c0
add esp, 0x10
lea ecx, [ebp - 0x1a4]
call fcn.00405f50
mov dword [ebp - 0x1ac], eax
push 0x50
push str.www.google_analytics.com
call fcn.00417220
add esp, 8
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xffffffff
je 0x4177c6
push 0
mov edx, dword [ebp - 0x1ac]
push edx
lea ecx, [ebp - 0x1a4]
call fcn.004175e0
push eax
mov eax, dword [ebp - 0x1a8]
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, dword [ebp - 0x1ac]
je 0x4177d2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x1b8], eax
mov ecx, dword [ebp - 0x1a8]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebp - 0x1a8], 0xffffffff
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1a4]
call fcn.004023e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004023e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056a45e
mov esp, ebp
pop ebp
ret

Function at 0x417830
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x598a5d
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x6031c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00405f50
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 1
push eax
call fcn.004373ac
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + 8]
call fcn.00405f50
push eax
lea ecx, [ebp + 8]
call fcn.004175e0
push eax
mov edx, dword [ebp - 0x10]
push edx
call fcn.0056ef10
add esp, 0xc
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x14]
mov byte [eax], 0
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push 0x4178e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004023e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x417df0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret
Function at 0x432480
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x599e25
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x6031c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x24]
call fcn.00414960
mov dword [ebp - 4], 0
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0042fa40
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.00426210
xor edx, edx
mov byte [ebp - 0xd], dl
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0xd]
call fcn.00430730
push eax
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004303a0
mov edx, dword [ebp - 0x14]
or edx, 1
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00425ef0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x432c10
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x599f0d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x6031c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00432590
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x432c76
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004023e0
mov eax, dword [ebp - 0x28]
jmp 0x432de8
lea ecx, [ebp + 0xc]
call fcn.00407980
movzx ecx, al
test ecx, ecx
je 0x432cc8
push 0xffffffffffffffff
push 0
push 0xb1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x303
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004023e0
mov eax, dword [ebp - 0x2c]
jmp 0x432de8
lea ecx, [ebp + 0xc]
call fcn.00405f50
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0xd], 0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x432dae
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov edx, dword [ebp - 0x1c]
lea eax, [edx + edx + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x432d5b
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x1c]
shl edx, 1
push edx
lea ecx, [ebp + 0xc]
call fcn.00405df0
push eax
mov eax, dword [ebp - 0x20]
push eax
call fcn.0056ef10
add esp, 0xc
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov word [eax + edx*2], cx
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0x18]
push edx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x432d5b
mov byte [ebp - 0xd], 1
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0xffffffffffffffff
push 0
push 0xb1
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x303
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x302
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
movzx eax, byte [ebp - 0xd]
test eax, eax
jne 0x432dd0
lea ecx, [ebp + 0xc]
call fcn.00405df0
push eax
push 0x103
push 0xc
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x30], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.004023e0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret