joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46de64
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0046d724
xor edx, edx
push ebp
push 0x46dfc4
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x46dfae
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x46deae
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x46deb8
call fcn.0040367c
jmp 0x46dfcb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00410a40
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 4]
mov ebx, eax
test ebx, ebx
jle 0x46dfa3
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
cmp eax, 0xffffffff
jne 0x46df61
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x46df51
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.00403060
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0046de1c
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x46dfd4]
cmp dl, byte [eax + 0x28]
je 0x46dfaa
call fcn.0040a64c
jmp 0x46dfaa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
call fcn.00410a50
jmp 0x46dfaa
cmp eax, ebx
jge 0x46df7a
mov edx, dword [ebp - 0xc]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00410a50
jmp 0x46deb8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00410a40
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00410a5c
cmp ebx, eax
jne 0x46deb8
push ebp
call fcn.0046de1c
pop ecx
jmp 0x46dfaa
push ebp
call fcn.0046de1c
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46dfcb
mov eax, dword [ebp - 4]
call fcn.0046d730
ret
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46dfd8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46e0fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0046d724
xor eax, eax
push ebp
push 0x46e0dd
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x46e028
call fcn.0040367c
jmp 0x46e0e4
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x46e0c7
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x46e0c7
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.00403060
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x46e0c7
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00409e68
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x46e114
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x499108]
mov dl, 1
mov eax, dword [0x46cb2c]
call fcn.0040a7ac
call fcn.004035dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e0e4
mov eax, dword [ebp - 4]
call fcn.0046d730
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e101
lea eax, [ebp - 0x28]
call fcn.00403b90
ret
Function at 0x46e160
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46e2aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0046d724
xor eax, eax
push ebp
push 0x46e28d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x46e1c5
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x46e1c5
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x46e277
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x46e1d8
call fcn.0040367c
jmp 0x46e294
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x46e277
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x46e277
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.00403060
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x46e277
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00409e68
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x46e2c4
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x499108]
mov dl, 1
mov eax, dword [0x46cb2c]
call fcn.0040a7ac
call fcn.004035dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e294
mov eax, dword [ebp - 4]
call fcn.0046d730
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46e2b1
lea eax, [ebp - 0x28]
call fcn.00403b90
ret
Function at 0x46ee7c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
test dl, dl
je 0x46ee9b
add esp, 0xfffffff0
call fcn.00403184
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x46f09e
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.0043f09c
lea eax, [ebx + 0x1f0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov esi, eax
test esi, esi
je 0x46eef2
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00408a34
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x46f0cc
call fcn.00403e5c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0046f57c
push 0x46f0f0
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
mov dword [ebx + 0x380], esi
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.00404fa8
lea eax, [ebp - 0x1c]
mov edx, dword [0x498d3c]
call fcn.0040524c
je 0x46efa9
push 0x46f0fc
push esi
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebx + 0x384], eax
push 0x46f10c
mov eax, dword [ebx + 0x380]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebx + 0x388], eax
push 0x46f11c
mov eax, dword [ebx + 0x380]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebx + 0x38c], eax
cmp dword [ebx + 0x384], 0
je 0x46ef7c
cmp dword [ebx + 0x388], 0
je 0x46ef7c
cmp dword [ebx + 0x38c], 0
jne 0x46ef88
mov edx, 0x46f134
mov eax, ebx
call fcn.0046f57c
call dword [ebx + 0x384]
mov esi, eax
mov dword [ebx + 0x390], esi
cmp esi, 0xffffffff
jne 0x46efb5
mov edx, 0x46f16c
mov eax, ebx
call fcn.0046f57c
jmp 0x46efb5
mov edx, 0x46f1a4
mov eax, ebx
call fcn.0046f57c
lea eax, [ebx + 0x3b0]
xor ecx, ecx
mov edx, 8
call fcn.00402b6c
mov byte [ebx + 0x3b0], 0x40
mov esi, 0x38
mov dword [ebx + 0x3c0], esi
mov eax, esi
call fcn.00402784
mov dword [ebx + 0x3b8], eax
mov eax, dword [ebx + 0x3c0]
add eax, 0x1c
mov dword [ebx + 0x3bc], eax
mov eax, dword [ebx + 0x3c0]
call fcn.00402784
mov dword [ebx + 0x3c4], eax
mov eax, dword [ebx + 0x3bc]
call fcn.00402784
mov dword [ebx + 0x3c8], eax
mov eax, dword [ebx + 0x3c4]
mov ecx, 0xaa
mov edx, dword [ebx + 0x3c0]
call fcn.00402b6c
mov eax, dword [ebx + 0x3c8]
mov edx, dword [ebx + 0x3b8]
mov dword [eax + 0x10], edx
lea eax, [ebx + 0x3a4]
call fcn.00403b90
lea eax, [ebx + 0x3a8]
call fcn.00403b90
mov dword [ebx + 0x3a0], 0xffffffff
mov dword [ebx + 0x39c], 0xbb8
mov byte [ebx + 0x3d0], 0
mov byte [ebx + 0x398], 1
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f0a5
lea eax, [ebp - 0x1c]
call fcn.0040535c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403bb4
ret
Function at 0x46f370
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x46f4ce
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0x3a4], 0
jne 0x46f3a3
cmp dword [esi + 0x3a0], 0
jne 0x46f3a3
xor ebx, ebx
jmp 0x46f4b3
cmp byte [esi + 0x3d0], 0
jne 0x46f3bc
cmp byte [esi + 0x398], 0
jne 0x46f3bc
mov bl, 1
jmp 0x46f4b3
mov eax, dword [esi + 0x3a4]
call fcn.00403fd4
push eax
call sub.wsock32.dll_inet_addr
mov edi, eax
mov dword [esi + 0x3a0], edi
mov bl, 1
cmp edi, 0xffffffff
jne 0x46f450
mov eax, dword [esi + 0x3a4]
call fcn.00403fd4
push eax
call sub.wsock32.dll_gethostbyname
mov edi, eax
mov dword [esi + 0x3ac], edi
test edi, edi
jne 0x46f400
xor ebx, ebx
jmp 0x46f4b3
mov byte [esi + 0x398], 0
mov eax, dword [esi + 0x3ac]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi + 0x3a0], eax
lea eax, [esi + 0x3a4]
mov edx, dword [esi + 0x3ac]
mov edx, dword [edx]
call fcn.00403d48
push dword [esi + 0x3a0]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 4]
call fcn.00409384
mov edx, dword [ebp - 4]
lea eax, [esi + 0x3a8]
call fcn.00403be4
jmp 0x46f4b3
push 2
push 4
lea eax, [esi + 0x3a0]
push eax
call sub.wsock32.dll_gethostbyaddr
mov edi, eax
mov dword [esi + 0x3ac], edi
test edi, edi
jne 0x46f47e
lea eax, [esi + 0x3a4]
mov edx, 0x46f4e8
call fcn.00403be4
jmp 0x46f48b
lea eax, [esi + 0x3a4]
mov edx, dword [edi]
call fcn.00403d48
mov byte [esi + 0x398], 0
push dword [esi + 0x3a0]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 8]
call fcn.00409384
mov edx, dword [ebp - 8]
lea eax, [esi + 0x3a8]
call fcn.00403be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f4d5
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403bb4
ret

Function at 0x46fc9c
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test bl, bl
je 0x46fcb9
test byte [esi + 0x20], 0x10
je 0x46fcb9
mov eax, 0x46fd28
call fcn.004492d4
jmp 0x46fd1a
cmp bl, byte [esi + 0x28]
je 0x46fd1a
test bl, bl
je 0x46fcf2
test byte [esi + 0x20], 0x10
jne 0x46fd17
mov cl, 1
mov dl, 1
mov eax, dword [0x46fa10]
call fcn.00413cc0
mov edi, eax
mov dword [esi + 0x48], edi
mov dword [edi + 0x30], esi
mov byte [edi + 0xe], 1
mov eax, edi
call fcn.00413dfc
mov eax, esi
call fcn.0046fd4c
jmp 0x46fd17
test byte [esi + 0x20], 0x10
jne 0x46fd17
mov eax, dword [esi + 0x24]
push eax
call sub.winmm.dll_timeKillEvent
push 0
mov eax, dword [esi + 0x48]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [esi + 0x48]
call fcn.00402e84
mov byte [esi + 0x28], bl
pop edi
pop esi
pop ebx
ret
Function at 0x4705b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0047014c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403fd4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x47060e
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x498fc8]
mov dl, 1
mov eax, dword [0x470044]
call fcn.0040a7ac
call fcn.004035dc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x470618
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403fd4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x470670
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x499254]
mov dl, 1
mov eax, dword [0x470044]
call fcn.0040a7ac
call fcn.004035dc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0047017c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x472270
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov ebp, edx
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dl, 1
mov eax, dword [0x40d9d8]
call fcn.00402e54
mov esi, eax
push esi
push 0x472258
call sub.user32.dll_EnumWindows
mov edi, dword [esi + 8]
dec edi
test edi, edi
jl 0x4722f0
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, esi
call fcn.0040f0f8
cmp ebp, eax
je 0x4722ec
push 0x50
lea eax, [esp + 0xc]
push eax
mov edx, ebx
mov eax, esi
call fcn.0040f0f8
push eax
call sub.user32.dll_GetClassNameA
test eax, eax
jle 0x4722ec
lea eax, [esp + 8]
mov edx, dword [esp]
call fcn.00409268
test eax, eax
jne 0x4722ec
mov edx, ebx
mov eax, esi
call fcn.0040f0f8
mov dword [esp + 4], eax
jmp 0x4722f0
inc ebx
dec edi
jne 0x4722a6
mov eax, esi
call fcn.00402e84
mov eax, dword [esp + 4]
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x47248c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffff7c
mov ebx, eax
mov dword [esp], 0x21
push esp
lea eax, [esp + 9]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4724c3
lea eax, [esp + 5]
call fcn.0040913c
mov byte [esp + 4], al
mov eax, ebx
lea edx, [esp + 4]
call fcn.00403db4
add esp, 0x84
pop ebx
ret

Function at 0x4724cc
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov dword [esp], 0x1e
push esp
lea eax, [esp + 9]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x472500
lea eax, [esp + 5]
call fcn.0040913c
mov byte [esp + 4], al
mov eax, ebx
lea edx, [esp + 4]
call fcn.00403db4
add esp, 0x24
pop ebx
ret
Function at 0x472660
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x472776
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [esi]
mov eax, 0x47278c
call fcn.004040fc
mov ebx, eax
test ebx, ebx
je 0x472755
cmp ebx, dword [ebp - 8]
je 0x472755
mov dword [ebp - 8], ebx
mov eax, esi
mov ecx, 1
mov edx, ebx
call fcn.00404058
mov edx, dword [esi]
mov eax, 0x47278c
call fcn.004040fc
mov edi, eax
test edi, edi
je 0x472755
lea eax, [ebp - 4]
push eax
mov ecx, edi
sub ecx, ebx
mov eax, dword [esi]
mov edx, ebx
call fcn.00404018
mov ecx, edi
sub ecx, ebx
inc ecx
mov eax, esi
mov edx, ebx
call fcn.00404058
cmp dword [ebp - 4], 0
je 0x47268c
push 0x47278c
push dword [ebp - 4]
push 0x47278c
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403ed0
push 0x104
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 4]
call fcn.00403fe0
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00403dc0
mov eax, dword [ebp - 0x110]
mov edx, esi
mov ecx, ebx
call fcn.004040a0
jmp 0x47268c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47277d
lea eax, [ebp - 0x110]
call fcn.00403b90
lea eax, [ebp - 4]
call fcn.00403b90
ret

Function at 0x472988
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov edi, eax
mov esi, edx
mov ecx, ecx
shr ecx, 2
cld
mov eax, dword [esi]
xor dword [edi], eax
add esi, 4
add edi, 4
loop 0x472994
pop esi
pop edi
ret

Function at 0x474114
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x474165
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x47414c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x47413c
jmp 0x474165
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x47414d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4815e4
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.0040f460
mov esi, eax
xor eax, eax
push ebp
push 0x48165e
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x481642
mov edx, ebx
mov eax, esi
call fcn.0040f0f8
test byte [eax + 0x48], 1
je 0x48163c
push 0
mov edx, ebx
mov eax, esi
call fcn.0040f0f8
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov edx, ebx
mov eax, esi
call fcn.0040efe8
dec ebx
cmp ebx, 0xffffffff
jne 0x481610
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481665
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.0040f4c4
ret

Function at 0x4824e4
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402b6c
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 0x101
mov ax, word [ebp + 8]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
push edi
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x48255f
cmp byte [ebp + 0xc], 0
je 0x48255d
jmp 0x482557
push 0x64
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x48255d
cmp byte [esi + 0xc], 0
je 0x482545
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x483398
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403fc4
mov eax, dword [ebp - 8]
call fcn.00403fc4
xor eax, eax
push ebp
push 0x483488
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00408c30
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x10]
wait
fld qword [ebp - 0x10]
fcomp dword [0x483498]
fnstsw ax
sahf
jne 0x483418
mov eax, dword [0x498ef4]
cmp dword [eax + 4], 0
jne 0x4833fa
cmp dword [eax], 0x2710
jae 0x48346d
jmp 0x4833fc
jge 0x48346d
mov eax, dword [0x498ef8]
mov eax, dword [eax]
call fcn.004494c4
test al, al
jne 0x48346d
mov dword [0x49aaec], 0x6f9
jmp 0x48346d
mov eax, dword [ebp - 8]
call fcn.00408c30
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x18]
wait
fld qword [ebp - 0x10]
fsub qword [ebp - 0x18]
fabs
fcomp dword [0x48349c]
fnstsw ax
sahf
jbe 0x48346b
mov edx, 0x20
mov eax, dword [ebp - 8]
call fcn.00408d00
push 0
lea eax, [ebp - 8]
call fcn.00403fe0
push eax
lea eax, [ebp - 4]
call fcn.00403fe0
push eax
call sub.kernel32.dll_CopyFileA
neg eax
sbb ebx, ebx
neg ebx
jmp 0x48346d
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48348f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403bb4
ret
Function at 0x485218
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [eax + 0x2f4]
test edx, edx
je 0x48522f
mov eax, edx
cmp byte [eax + 0x47], 0
jne 0x48522f
call fcn.0042b9d0
mov eax, dword [0x49904c]
mov eax, dword [eax]
call fcn.0042e548
push 0
mov eax, dword [0x49904c]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x48593c
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
cmp dword [0x498894], 0
je 0x485971
push 1
push 0x485974
push 0x485974
mov eax, dword [0x498894]
call fcn.00403fd4
push eax
push 0x485978
mov eax, ebx
call fcn.004431bc
push eax
call sub.shell32.dll_ShellExecuteA
pop ebx
ret
Function at 0x487030
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebx
add esp, 0xffffffc0
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x48705f
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x48705f
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
cmp ebx, 0x100007f
jne 0x48705f
xor ebx, ebx
mov eax, ebx
add esp, 0x40
pop ebx
ret

Function at 0x487068
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe58
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
mov dword [ebp - 8], 1
call fcn.00487030
mov dword [0x49ae9c], eax
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x487159
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov dword [edi], eax
cmp dword [edi], 0xffffffff
je 0x487159
mov word [ebp - 0x1a8], 2
xor eax, eax
mov dword [ebp - 0x1a4], eax
mov ax, word [ebp - 4]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x1a6], ax
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0xffff
mov eax, dword [edi]
push eax
call sub.wsock32.dll_setsockopt
push 0x10
lea eax, [ebp - 0x1a8]
push eax
mov eax, dword [edi]
push eax
call sub.wsock32.dll_bind
inc eax
jne 0x487112
mov eax, dword [edi]
push eax
call sub.wsock32.dll_closesocket
jmp 0x487159
push 4
lea eax, [ebp - 8]
push eax
push 0x20
push 0xffff
mov eax, dword [edi]
push eax
call sub.wsock32.dll_setsockopt
inc eax
jne 0x487134
mov eax, dword [edi]
push eax
call sub.wsock32.dll_closesocket
jmp 0x487159
push 0x23
mov eax, dword [ebp + 8]
push eax
mov eax, esi
call fcn.004431bc
push eax
mov eax, dword [edi]
push eax
call sub.wsock32.dll_WSAAsyncSelect
inc eax
jne 0x487157
mov eax, dword [edi]
push eax
call sub.wsock32.dll_closesocket
jmp 0x487159
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4