joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455894
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x455a3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x455a20
mov dl, 1
mov eax, dword [0x4167ec]
call fcn.004038a0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004046e0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x455a0f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004438ac
test al, al
je 0x455a02
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x455a50
lea eax, [ebp - 0x254]
call fcn.00409d74
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x455a02
xor eax, eax
push ebp
push 0x4559fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x455a88
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4559e4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404950
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4559e4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404950
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455a02
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x455905
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041b298
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455a46
lea eax, [ebp - 0x260]
call fcn.004046e0
ret

Function at 0x456374
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4a4be4]
cmp byte [eax + 0xa5], 0
jne 0x4563e5
cmp dword [0x4a4bfc], 0
jne 0x4563a6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x456330
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4a4bfc], eax
cmp dword [0x4a4bf8], 0
jne 0x4563c1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4a4bf8], eax
cmp dword [0x4a4c00], 0
jne 0x4563e5
push esp
push 0
push 0
push 0x4562d4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4a4c00], eax
pop edx
ret
Function at 0x4564dc
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4564f3
add esp, 0xfffffff0
call fcn.00403bf4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041f6b4
mov eax, dword [0x4a3824]
cmp word [eax + 2], 0
jne 0x45651b
mov eax, dword [0x4a3824]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00457c5c
mov eax, dword [0x4a3928]
cmp word [eax + 2], 0
jne 0x456535
mov eax, dword [0x4a3928]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00457e54
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4160d0]
call fcn.004038a0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4160d0]
call fcn.004038a0
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x422280]
call fcn.00429934
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x4566bc
mov eax, dword [0x4a3704]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00429d04
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4583f4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4a3704]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d5a4
test eax, eax
je 0x45662a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409728
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d5cc
test eax, eax
je 0x45663e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404950
mov eax, dword [0x4a3568]
cmp byte [eax], 0
jne 0x456672
mov eax, ebx
call fcn.004567e4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.004585d0
mov eax, ebx
call fcn.00458f94
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4566b2
call fcn.00403c4c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x456a64
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4a4be4]
cmp dword [eax + 0x30], 0
je 0x456b0e
cmp dword [ebx + 0x94], 0
jne 0x456b08
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4569f4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x456b08
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x456ace
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x456b08
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418968
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x456add
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x457670
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4576a5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004047d0
jmp 0x4576b2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404734
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4587ac
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4587ed
mov eax, esi
call fcn.0043ef6c
test al, al
je 0x4587ed
mov eax, dword [ebx + 0x84]
call fcn.0043ec94
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4587ed
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043ec94
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x459b80
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404b90
xor eax, eax
push ebp
push 0x459bfe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404ba0
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x459bc9
mov eax, dword [ebx + 4]
call fcn.00404ba0
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459c05
lea eax, [ebp - 4]
call fcn.004046e0
ret
Function at 0x45ac00
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45ad9d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402b48
cmp word [ebx + 0xa2], 0
je 0x45ac49
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x45ac5d
lea esi, [ebp - 8]
jmp 0x45ac5f
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x45ac6c
xor edi, edi
jmp 0x45ac79
mov eax, dword [ebx + 0x80]
call fcn.00404ba0
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.00404ba0
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0045a338
mov eax, dword [ebp - 0x14]
call fcn.00404ba0
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.00404ba0
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404ba0
push eax
mov eax, ebx
call fcn.0045a46c
push eax
mov eax, ebx
call fcn.0045a440
push eax
mov eax, ebx
call fcn.0045a3f4
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.0045a204
mov eax, dword [ebp - 0x18]
call fcn.00404ba0
push eax
mov eax, dword [ebx + 8]
call fcn.00404ba0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0xc], 0
jne 0x45ad02
call fcn.0040de30
xor edx, edx
push ebp
push 0x45ad7b
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x45ad40
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x45ad36
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45ad64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ad82
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x45adac
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x45add8
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00404ba0
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45adfd
call fcn.0040de30
xor eax, eax
push ebp
push 0x45ae34
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x45ae1d
call fcn.0040de30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ae3b
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x45cecc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x45cf62
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004046e0
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004079d0
test eax, eax
je 0x45cf4c
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00404d2c
mov eax, dword [ebp - 8]
call fcn.00404ba0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [ebp - 8]
call fcn.00404ba0
call fcn.0045ceb4
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404d2c
mov eax, ebx
mov ecx, 0x45cf78
mov edx, dword [ebp - 8]
call fcn.004049ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cf69
lea eax, [ebp - 8]
call fcn.004046e0
ret

Function at 0x45cfd8
Capabilities:
Execute anti-debugging instructions
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45d110
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x34]
push eax
call sub.kernel32.dll_GetSystemInfo
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_GetPriorityClass
mov esi, eax
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_GetThreadPriority
mov edi, eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push 0xa
call sub.kernel32.dll_Sleep
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x1f4
call sub.kernel32.dll_Sleep
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push edi
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0x20]
call fcn.0045e474
push dword [ebp - 0x38]
push 0x45d128
mov eax, dword [ebp - 4]
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
fild qword [ebp - 0x44]
fdiv dword [0x45d12c]
call fcn.00402bf8
lea edx, [ebp - 0x3c]
call fcn.0045e474
push dword [ebp - 0x3c]
push 0x45d138
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404a60
mov edx, dword [ebp - 0xc]
inc edx
mov eax, ebx
call fcn.00407984
mov eax, dword [ebp - 0x10]
call fcn.004049a0
push eax
lea eax, [ebp - 0x10]
call fcn.00404bf8
mov edx, eax
mov eax, ebx
pop ecx
call fcn.00407968
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d117
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.00404704
lea eax, [ebp - 0x10]
call fcn.004046e0
ret
Function at 0x45d13c
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45d1c2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x1c]
shr eax, 0xa
shr eax, 0xa
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
lea edx, [ebp - 0x2c]
xor ecx, ecx
mov eax, 0x45d1d8
call fcn.0045e730
lea edx, [esi + 1]
mov eax, ebx
call fcn.00407984
mov eax, dword [ebp - 4]
call fcn.004049a0
push eax
lea eax, [ebp - 4]
call fcn.00404bf8
mov edx, eax
mov eax, ebx
pop ecx
call fcn.00407968
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d1c9
lea eax, [ebp - 4]
call fcn.004046e0
ret

Function at 0x45d1e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45d278
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.00404950
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebx]
call fcn.004049a0
mov edx, eax
mov eax, dword [ebx]
mov ecx, 1
call fcn.00404c00
mov eax, dword [ebp - 0x104]
mov edx, 0x45d28c
call fcn.00404aec
je 0x45d25f
mov eax, ebx
mov edx, 0x45d28c
call fcn.004049a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d27f
lea eax, [ebp - 0x104]
call fcn.004046e0
ret

Function at 0x45d290
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45d304
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.00404950
mov edx, dword [ebp - 0x108]
mov eax, ebx
mov ecx, 0x45d318
call fcn.004049ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d30b
lea eax, [ebp - 0x108]
call fcn.004046e0
ret
Function at 0x45d338
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x45d4ba
push dword fs:[edx]
mov dword fs:[edx], esp
cmp eax, 7
ja case.default.0x45d375
jmp dword [eax*4 + 0x45d37c]
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x108]
mov dl, byte [ebp - 0x104]
call fcn.004048c8
mov edx, dword [ebp - 0x108]
mov eax, ebx
mov ecx, 0x45d4d0
call fcn.004049ec
jmp case.default.0x45d375
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
mov dl, byte [ebp - 0x104]
call fcn.004048c8
mov edx, dword [ebp - 0x10c]
mov eax, ebx
mov ecx, 0x45d510
call fcn.004049ec
jmp case.default.0x45d375
mov eax, ebx
call fcn.0045d1e0
jmp case.default.0x45d375
mov eax, ebx
call fcn.0045d290
jmp case.default.0x45d375
mov eax, ebx
mov edx, 0x45d52c
call fcn.00404734
jmp case.default.0x45d375
mov eax, ebx
mov edx, 0x45d538
call fcn.00404734
jmp case.default.0x45d375
mov eax, ebx
mov edx, 0x45d544
call fcn.00404734
jmp case.default.0x45d375
lea eax, [ebp - 0x110]
mov edx, dword [0x4a39d8]
mov edx, dword [edx]
call fcn.004048d8
mov eax, dword [ebp - 0x110]
call fcn.0045e3b8
test al, al
jne 0x45d48d
lea eax, [ebp - 0x114]
mov edx, dword [0x4a39d8]
mov edx, dword [edx]
call fcn.004048d8
mov eax, dword [ebp - 0x114]
call fcn.0045d31c
mov eax, ebx
mov edx, dword [0x4a39d8]
mov edx, dword [edx]
call fcn.004048d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d4c1
lea eax, [ebp - 0x114]
mov edx, 4
call fcn.00404704
ret

Function at 0x45d548
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd68
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404b90
xor eax, eax
push ebp
push 0x45d615
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004046e0
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x45d5f0
push dword fs:[edx]
mov dword fs:[edx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.0045e394
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x45d5e6
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x45d5df
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.004048d8
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x45d5cd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45d5fa
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d61c
lea eax, [ebp - 4]
call fcn.004046e0
ret
Function at 0x45d624
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45d6ba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
mov edx, 0x40
call fcn.00407984
push 0x40
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x44]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x45d6a4
mov esi, dword [eax + 0xc]
mov eax, dword [esi]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 4]
call fcn.004048d8
lea edx, [edi + 1]
mov eax, ebx
call fcn.00407984
mov eax, dword [ebp - 4]
call fcn.004049a0
push eax
lea eax, [ebp - 4]
call fcn.00404bf8
mov edx, eax
mov eax, ebx
pop ecx
call fcn.00407968
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d6c1
lea eax, [ebp - 4]
call fcn.004046e0
ret

Function at 0x45d730
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x45d84e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
inc edx
call fcn.00407984
lea eax, [ebp - 8]
mov edx, 0x45d864
call fcn.00404778
mov eax, dword [ebp - 8]
call fcn.004049a0
push eax
mov eax, dword [ebp - 8]
call fcn.00404ba0
mov edx, eax
mov eax, ebx
pop ecx
call fcn.00407968
lea eax, [ebp - 0x44]
mov edx, 0x38
call fcn.00407984
mov dword [ebp - 4], 0x38
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x44]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 8]
mov edx, 0x4a4c78
mov ecx, 0xf
call fcn.00404950
mov eax, dword [ebp - 8]
call fcn.00404ba0
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0xc], eax
push 2
push 0xf
lea eax, [ebp - 0xc]
push eax
call sub.wsock32.dll_gethostbyaddr
mov esi, eax
test esi, esi
je 0x45d830
lea eax, [ebp - 8]
mov edx, dword [esi]
call fcn.004048d8
push dword [ebp - 8]
push 0x45d874
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x44]
mov ecx, 0x38
call fcn.00404950
push dword [ebp - 0x48]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404a60
mov eax, ebx
mov edx, 0x38
call fcn.00407984
mov eax, dword [ebp - 8]
call fcn.004049a0
push eax
lea eax, [ebp - 8]
call fcn.00404bf8
mov edx, eax
mov eax, ebx
pop ecx
call fcn.00407968
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d855
lea eax, [ebp - 0x48]
call fcn.004046e0
lea eax, [ebp - 8]
call fcn.004046e0
ret