joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4013b0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4013c2
mov eax, dword [0x49708b]
shl eax, 2
mov dword [0x49708f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00489168
pop edx
call fcn.004890cc
call fcn.004891a8
push 0
call fcn.0048a63c
pop ecx
push 0x497034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x497093], eax
push 0
jmp fcn.00490adc

Function at 0x402404
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x402427
mov edx, dword [ebp + 8]
push dword [edx + 0xc]
call sub.KERNEL32.DLL_UnmapViewOfFile
mov ecx, dword [ebp + 8]
push dword [ecx + 4]
call sub.KERNEL32.DLL_CloseHandle
push 0
mov eax, dword [ebp + 8]
push dword [eax + 8]
push 0
push 4
push 0
mov edx, dword [ebp + 8]
push dword [edx]
call sub.KERNEL32.DLL_CreateFileMappingA
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.KERNEL32.DLL_MapViewOfFile
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0xc]
mov edx, dword [ebp + 8]
mov dword [edx + 0x60023], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x60023]
mov eax, dword [eax]
mov ecx, 0x2710
cdq
idiv ecx
add eax, 0xfffff830
imul ecx, eax, 0x174
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x60023]
mov eax, dword [edx]
mov ebx, 0x2710
cdq
idiv ebx
mov eax, edx
mov ebx, 0x64
cdq
idiv ebx
mov edx, eax
shl eax, 5
sub eax, edx
add cx, ax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x60023]
mov eax, dword [edx]
mov ebx, 0x64
cdq
idiv ebx
add cx, dx
mov eax, dword [ebp + 8]
mov word [eax + 0x60018], cx
mov edx, dword [ebp + 8]
cmp word [edx + 0x60018], 0
jge 0x4024ee
mov ecx, dword [ebp + 8]
mov word [ecx + 0x60018], 0
pop ebx
pop ebp
ret
Function at 0x402f68
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffe0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + eax*4 + 0x10]
mov eax, dword [ebp - 4]
add ecx, dword [eax + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov cx, word [edx]
mov word [ebp - 0xe], cx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + eax*4 + 0x10]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
add edx, 0xfffff000
cmp ecx, edx
jl 0x402fd1
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + ecx*4 + 0x10]
add edx, 0x100000
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], edx
push dword [ebp - 4]
call fcn.00402404
pop ecx
cmp word [ebp - 0xe], 0x800
jge 0x40311e
movsx eax, word [ebp - 0xe]
push eax
push dword [ebp - 0xc]
lea edx, [ebp - 0x1020]
push edx
call fcn.004895a8
add esp, 0xc
lea ecx, [ebp - 0x1020]
add word [ecx], 0xb00a
movsx eax, word [ebp - 0xe]
mov edx, dword [ebp - 8]
mov dword [ebp + eax - 0x1020], edx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax + ecx*4 + 0x10]
movsx ecx, word [ebp - 0xe]
mov dword [ebp + ecx - 0x101c], edx
movsx eax, word [ebp - 0xe]
mov edx, dword [ebp - 4]
mov cx, word [edx + 0x60018]
mov word [ebp + eax - 0x1018], cx
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor edx, edx
mov dword [ebp - 0x1c], edx
jmp 0x403103
mov ecx, dword [ebp - 0x1c]
shl ecx, 6
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x60014]
mov ecx, dword [edx + ecx + 0x1e]
cmp ecx, dword [ebp - 8]
jne 0x403100
mov eax, dword [ebp - 0x1c]
shl eax, 6
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x60014]
mov edx, dword [ebp - 0x14]
sub edx, dword [ecx + eax + 0x2e]
cmp edx, 0x190
jg 0x403100
mov eax, dword [ebp - 0x1c]
shl eax, 6
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x60014]
xor ecx, ecx
mov dword [edx + eax + 0x1e], ecx
mov eax, dword [ebp - 0x1c]
shl eax, 6
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x60014]
inc dword [ecx + eax + 0x26]
inc dword [ebp - 0x18]
push 0x10
mov eax, dword [ebp - 0x1c]
shl eax, 6
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x60014]
add eax, 6
push eax
push 0
movsx eax, word [ebp - 0xe]
add eax, 0xa
push eax
lea ecx, [ebp - 0x1020]
push ecx
mov eax, dword [ebp - 4]
push dword [eax + 0x60010]
call sub.WSOCK32.DLL_sendto
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jle 0x403100
fild dword [ebp - 0x20]
fadd dword [0x4971a0]
fstp dword [0x4971a0]
inc dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x60014]
movsx eax, word [ecx]
cmp eax, dword [ebp - 0x1c]
jle 0x40311e
cmp dword [ebp - 0x18], 5
jl 0x40304f
mov esp, ebp
pop ebp
ret
Function at 0x403124
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7e8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x60023]
cmp dword [edx], 0
jne 0x40315b
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00403710
xor eax, eax
jmp 0x403296
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6001f]
add edx, 0xfffffffb
cmp ecx, edx
jge 0x403178
xor eax, eax
jmp 0x403296
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x6001f]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x18000
jge 0x403294
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp dword [edx + eax*4 + 0x10], 0
jg 0x403284
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x14]
add eax, 0xffffff9c
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x6001f]
jg 0x4031bf
cmp byte [0x49d420], 0
je 0x4031c6
mov ecx, 0x12c
jmp 0x4031cb
mov ecx, 0x5dc
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp dword [edx + eax*4 + 0x10], 0
je 0x4031f1
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
add eax, dword [ecx + edx*4 + 0x10]
cmp eax, dword [ebp - 0x14]
jl 0x403284
xor eax, eax
sub eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov dword [ecx + edx*4 + 0x10], eax
lea eax, [ebp - 0x816]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
lea ecx, [ebp - 0x812]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6001f]
mov dword [ecx], edx
push 8
mov ecx, dword [ebp - 4]
push dword [ecx + 0x60023]
lea eax, [ebp - 0x80e]
push eax
call fcn.004895a8
add esp, 0xc
lea edx, [ebp - 0x818]
mov word [edx], 0xa012
mov ecx, dword [ebp - 8]
inc dword [ecx + 0x20]
push 0x10
push dword [ebp - 8]
push 0
push 0x12
lea eax, [ebp - 0x818]
push eax
mov edx, dword [ebp - 4]
push dword [edx + 0x60010]
call sub.WSOCK32.DLL_sendto
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x40327d
fild dword [ebp - 0x18]
fadd dword [0x4971a0]
fstp dword [0x4971a0]
mov eax, 1
jmp 0x403296
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x18000
jl 0x403191
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40329c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0x18000
jl 0x4032c5
mov eax, 0xffffffec
jmp 0x403436
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0xc]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
add ecx, dword [edx + eax*4 + 0x10]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp ecx, dword [eax + 0x6001f]
jge 0x4033e2
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 8]
add ecx, 0xfffff000
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp ecx, dword [edx + eax*4 + 0x10]
jg 0x403323
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x60023]
mov edx, dword [eax + 8]
add edx, 0x100000
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], edx
push dword [ebp - 4]
call fcn.00402404
pop ecx
mov eax, dword [ebp - 0x10]
mov dx, word [eax]
mov word [ebp - 0x12], dx
cmp word [ebp - 0x12], 0x800
jg 0x4033d9
movsx ecx, word [ebp - 0x12]
push ecx
push dword [ebp - 0x10]
lea eax, [ebp - 0x101c]
push eax
call fcn.004895a8
add esp, 0xc
lea edx, [ebp - 0x101c]
add word [edx], 0xb00a
movsx ecx, word [ebp - 0x12]
mov eax, dword [ebp - 0xc]
mov dword [ebp + ecx - 0x101c], eax
movsx edx, word [ebp - 0x12]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + ecx*4 + 0x10]
mov dword [ebp + edx - 0x1018], ecx
movsx edx, word [ebp - 0x12]
mov eax, dword [ebp - 4]
mov cx, word [eax + 0x60018]
mov word [ebp + edx - 0x1014], cx
push 0x10
push dword [ebp - 8]
push 0
movsx edx, word [ebp - 0x12]
add edx, 0xa
push edx
lea eax, [ebp - 0x101c]
push eax
mov edx, dword [ebp - 4]
push dword [edx + 0x60010]
call sub.WSOCK32.DLL_sendto
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x4033d0
fild dword [ebp - 0x18]
fadd dword [0x4971a0]
fstp dword [0x4971a0]
mov eax, 1
jmp 0x403436
mov eax, 0xffffffec
jmp 0x403436
lea edx, [ebp - 0x101c]
mov word [edx], 0xb006
lea ecx, [ebp - 0x101a]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6001f]
mov dword [ecx], edx
push 0x10
push dword [ebp - 8]
push 0
push 6
lea ecx, [ebp - 0x101c]
push ecx
mov eax, dword [ebp - 4]
push dword [eax + 0x60010]
call sub.WSOCK32.DLL_sendto
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x403434
fild dword [ebp - 0x1c]
fadd dword [0x4971a0]
fstp dword [0x4971a0]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x403694
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 8
mov eax, dword [ebp - 4]
push dword [eax + 0x60023]
lea edx, [ebp - 0x1e]
push edx
call fcn.004895a8
add esp, 0xc
lea ecx, [ebp - 0x16]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6001f]
mov dword [ecx], edx
lea ecx, [ebp - 0x20]
mov word [ecx], 0xc00e
mov eax, dword [ebp - 8]
inc dword [eax + 0x20]
push 0x10
push dword [ebp - 8]
push 0
push 0xe
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [ebp - 4]
push dword [ecx + 0x60010]
call sub.WSOCK32.DLL_sendto
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x403706
fild dword [ebp - 0xc]
fadd dword [0x4971a0]
fstp dword [0x4971a0]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x403710
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push 8
mov eax, dword [ebp - 4]
push dword [eax + 0x60023]
lea edx, [ebp - 0x1e]
push edx
call fcn.004895a8
add esp, 0xc
lea ecx, [ebp - 0x16]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x6001f]
mov dword [ecx], edx
lea ecx, [ebp - 0x20]
mov word [ecx], 0xd00e
push 0x10
push dword [ebp - 8]
push 0
push 0xe
lea eax, [ebp - 0x20]
push eax
mov edx, dword [ebp - 4]
push dword [edx + 0x60010]
call sub.WSOCK32.DLL_sendto
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x40377c
fild dword [ebp - 0xc]
fadd dword [0x4971a0]
fstp dword [0x4971a0]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x40383c
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov word [ebp - 0x50], 2
push str.118.126.4.29
call sub.WSOCK32.DLL_inet_addr
mov dword [ebp - 0x4c], eax
push 0x71a
call sub.WSOCK32.DLL_htons
mov word [ebp - 0x4e], ax
push 0x30
push 0
lea eax, [ebp - 0x40]
push eax
call fcn.00489618
add esp, 0xc
lea edx, [ebp - 0x40]
mov word [edx], 0x9016
lea ecx, [ebp - 0x3e]
mov eax, dword [ebp - 8]
mov dword [ecx], eax
push dword [ebp - 0xc]
lea edx, [ebp - 0x3a]
push edx
call fcn.004896f8
add esp, 8
push 0x10
lea ecx, [ebp - 0x50]
push ecx
push 0
push 0x16
lea eax, [ebp - 0x40]
push eax
mov edx, dword [ebp - 4]
push dword [edx + 0x60010]
call sub.WSOCK32.DLL_sendto
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x4038cf
fild dword [ebp - 0x10]
fadd dword [0x4971a0]
fstp dword [0x4971a0]
mov esp, ebp
pop ebp
ret
Function at 0x403b74
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x403b96
mov edx, dword [ebp + 8]
push dword [edx + 0xc]
call sub.KERNEL32.DLL_UnmapViewOfFile
mov ecx, dword [ebp + 8]
push dword [ecx + 4]
call sub.KERNEL32.DLL_CloseHandle
push 0
mov eax, dword [ebp + 8]
push dword [eax + 8]
push 0
push 4
push 0
mov edx, dword [ebp + 8]
push dword [edx]
call sub.KERNEL32.DLL_CreateFileMappingA
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.KERNEL32.DLL_MapViewOfFile
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0xc]
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], eax
pop ebp
ret
Function at 0x403d34
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [0x4971b8]
inc dword [0x4971b8]
mov ecx, 6
cdq
idiv ecx
dec edx
jne 0x403d99
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x403d8b
mov edx, dword [ebp - 8]
shl edx, 6
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x14]
cmp word [eax + edx + 0x24], 0xc
jb 0x403d88
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x14]
cmp word [ecx], 0x14
jle 0x403d88
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00404420
dec dword [ebp - 8]
inc dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x14]
movsx edx, word [eax]
cmp edx, dword [ebp - 8]
jg 0x403d5a
cmp dword [0x49d3fc], 5
jge 0x403da6
xor ecx, ecx
jmp 0x403dbb
cmp dword [0x49d3fc], 0xa
jge 0x403db6
mov ecx, 1
jmp 0x403dbb
mov ecx, 3
mov dword [ebp - 0xc], ecx
push 0
call fcn.00491754
pop ecx
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x403ec1
mov edx, dword [ebp - 0x14]
shl edx, 6
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
mov eax, dword [ebp - 0x10]
sub eax, dword [ecx + edx + 0x16]
cmp eax, 0xa
jl 0x403dfc
mov edx, dword [ebp - 0x14]
shl edx, 6
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x14]
inc word [eax + edx + 0x24]
mov edx, dword [ebp - 0x14]
shl edx, 6
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x14]
mov ecx, dword [eax + edx + 0x3e]
add dword [eax + edx + 0x3e], 0xffffffff
test ecx, ecx
jg 0x403ebe
mov edx, dword [ebp - 0x14]
shl edx, 6
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x14]
add edx, 6
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x10]
call fcn.00403694
mov edx, dword [ebp - 0x14]
shl edx, 6
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x14]
xor ecx, ecx
mov dword [eax + edx + 0x32], ecx
mov edx, dword [ebp - 0x14]
shl edx, 6
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
cmp dword [ecx + edx + 0x36], 0
jne 0x403e96
mov edx, dword [ebp - 0x14]
shl edx, 6
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
cmp word [ecx + edx + 0x24], 0
jne 0x403e82
mov edx, dword [ebp - 0x14]
shl edx, 6
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
mov dword [ecx + edx + 0x36], 0xbb8
jmp 0x403e96
mov edx, dword [ebp - 0x14]
shl edx, 6
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x14]
mov dword [ecx + edx + 0x36], 0x1388
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 0x14]
shl edx, 6
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x14]
mov dword [ecx + edx + 0x3a], eax
mov eax, dword [ebp - 0x14]
shl eax, 6
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x14]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax + 0x3e], ecx
inc dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
movsx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jg 0x403dd3
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x14]
cmp word [eax], 0
jle 0x403efc
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x14]
movsx eax, word [ecx]
push eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x14]
add edx, 6
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004040b8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4056e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push dword [0x49f444]
call sub.USER32.DLL_IsWindow
test eax, eax
jne 0x405790
push 0
push 0x40569c
call sub.USER32.DLL_EnumWindows
test eax, eax
jne 0x405754
lea eax, [ebp - 8]
push eax
push dword [0x49f444]
call sub.USER32.DLL_GetWindowThreadProcessId
push dword [ebp - 8]
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
test eax, eax
je 0x405790
push 4
push 0x1000
push 0x10000
push 0
mov edx, dword [ebp - 4]
push dword [edx + 8]
call sub.KERNEL32.DLL_VirtualAllocEx
mov dword [0x49f448], eax
jmp 0x405790
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x405790
push 0x8000
push 0
push dword [0x49f448]
mov eax, dword [ebp - 4]
push dword [eax + 8]
call sub.KERNEL32.DLL_VirtualFreeEx
xor edx, edx
mov dword [0x49f448], edx
mov ecx, dword [ebp - 4]
push dword [ecx + 8]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 8], edx
pop ecx
pop ecx
pop ebp
ret
Function at 0x407b9c
Capabilities:
Create udp socket
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
lea eax, [ebp - 0x194]
push eax
push 0x202
call sub.WSOCK32.DLL_WSAStartup
test eax, eax
je 0x407bc1
xor eax, eax
jmp 0x407d8f
push 0
push 2
push 2
call sub.WSOCK32.DLL_socket
mov edx, dword [ebp + 8]
mov dword [edx + 4], eax
cmp eax, 0xffffffff
jne 0x407bde
xor eax, eax
jmp 0x407d8f
mov word [ebp - 0x1a4], 2
xor edx, edx
mov dword [ebp - 0x1a0], edx
push 0x71a
call sub.WSOCK32.DLL_htons
mov word [ebp - 0x1a2], ax
push 0x10
lea ecx, [ebp - 0x1a4]
push ecx
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.WSOCK32.DLL_bind
inc eax
jne 0x407c29
mov edx, dword [ebp + 8]
push dword [edx + 4]
call sub.WSOCK32.DLL_closesocket
xor eax, eax
jmp 0x407d8f
push 1
push 0x488
mov edx, dword [ebp + 8]
push dword [edx]
mov ecx, dword [ebp + 8]
push dword [ecx + 4]
call sub.WSOCK32.DLL_WSAAsyncSelect
inc eax
jne 0x407c55
mov eax, dword [ebp + 8]
push dword [eax + 4]
call sub.WSOCK32.DLL_closesocket
xor eax, eax
jmp 0x407d8f
push 0x80
lea edx, [ebp - 0x224]
push edx
call sub.WSOCK32.DLL_gethostname
test eax, eax
jne 0x407d8d
lea ecx, [ebp - 0x224]
push ecx
call sub.WSOCK32.DLL_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x407d8d
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
cmp dword [edx + 4], 0
jne 0x407cc9
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0xc]
mov edx, dword [eax]
push dword [edx]
call sub.WSOCK32.DLL_inet_ntoa
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x4136
push ecx
call fcn.004896f8
add esp, 8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx]
mov dword [0x497190], eax
jmp 0x407d8d
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0xc]
mov eax, dword [ecx + 4]
push dword [eax]
call sub.WSOCK32.DLL_htonl
mov dword [0x497190], eax
cmp dword [0x497190], 0xa000000
jl 0x407cf6
cmp dword [0x497190], 0xaffffff
jle 0x407d26
cmp dword [0x497190], 0xac100000
jl 0x407d0e
cmp dword [0x497190], 0xac1fffff
jle 0x407d26
cmp dword [0x497190], 0xc0a80000
jl 0x407d5a
cmp dword [0x497190], 0xc0a8ffff
jg 0x407d5a
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0xc]
mov eax, dword [ecx]
push dword [eax]
call sub.WSOCK32.DLL_inet_ntoa
push eax
mov edx, dword [ebp + 8]
add edx, 0x4136
push edx
call fcn.004896f8
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0xc]
mov edx, dword [eax]
mov ecx, dword [edx]
mov dword [0x497190], ecx
jmp 0x407d8d
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov ecx, dword [edx + 4]
push dword [ecx]
call sub.WSOCK32.DLL_inet_ntoa
push eax
mov eax, dword [ebp + 8]
add eax, 0x4136
push eax
call fcn.004896f8
add esp, 8
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0xc]
mov eax, dword [ecx + 4]
mov edx, dword [eax]
mov dword [0x497190], edx
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x41908c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4ae3b4
cmp dword [edi], 0
jne 0x419108
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x4ae3b0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4988f4
mov ecx, 2
call fcn.0042a8c4
mov edx, 0x419064
lea eax, [esi + 5]
call fcn.00419084
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00419084
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x4190dd
mov dword [0x4ae3b0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41a5d8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0041a23c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0042c6a4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
je 0x41a636
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x49d010]
mov dl, 1
mov eax, dword [0x41a134]
call fcn.0041e474
call fcn.0042be54
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41a640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0042c6a4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x41a698
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x49d00c]
mov dl, 1
mov eax, dword [0x41a134]
call fcn.0041e474
call fcn.0042be54
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0041a26c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41dbd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x41dc09
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0042c2e4
jmp 0x41dc12
mov eax, ebx
mov edx, esi
call fcn.0042c248
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4