joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466de0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40fcf4]
call fcn.00405f14
xor eax, eax
push ebp
push 0x466f81
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4b8858], 0
jne 0x466e3b
mov ecx, dword [0x4b971c]
mov dl, 1
mov eax, dword [0x408960]
call fcn.0040dab4
call fcn.00404cb0
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403a64
mov eax, ebx
call fcn.00405cac
mov dword [ebp - 0x24], eax
mov esi, 0x466f90
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00407080
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405cbc
test eax, eax
jle 0x466f24
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x466f10
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004055ac
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x466eb6
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.004055c4
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x466ecc
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.004055c4
mov eax, dword [ebp - 0x54]
call fcn.004057cc
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.004055ac
mov eax, dword [ebp - 0x58]
call fcn.004057cc
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x466f12
xor eax, eax
test al, al
je 0x466f1d
mov ebx, 0x15
jmp 0x466f29
mov ebx, 0x10
jmp 0x466f29
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4b8858]
call fcn.00466c04
mov eax, dword [ebp - 4]
call fcn.00466c04
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00407098
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466f88
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00405360
lea eax, [ebp - 0xc]
mov edx, dword [0x40fcf4]
call fcn.00405fe4
ret
Function at 0x469390
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004057bc
xor eax, eax
push ebp
push 0x4694da
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x4694b2
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.0040a794
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x46949b
mov edx, dword [eax + 0xc]
test edx, edx
je 0x469495
mov ebx, dword [edx]
test ebx, ebx
je 0x46948f
lea eax, [ebp - 0x29c]
push eax
movzx eax, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
movzx eax, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
movzx eax, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
movzx eax, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x4694f4
call fcn.0040ae04
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.00405390
mov byte [ebp - 5], 1
jmp 0x46949f
mov byte [ebp - 5], 0
jmp 0x46949f
mov byte [ebp - 5], 0
jmp 0x46949f
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4694b9
call sub.wsock32.dll_WSACleanup
ret

Function at 0x469500
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 2
call sub.wsock32.dll_WSAStartup
add esp, 0x190
ret
Function at 0x46b880
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.0046b2e0
test byte [ebx + 0x285], 4
jne 0x46b915
mov edx, esp
mov eax, ebx
call fcn.00445210
push esp
mov eax, ebx
call fcn.0044d748
push eax
push 0
mov eax, ebx
test eax, eax
je 0x46b8b5
sub eax, 0xfffffd34
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x260]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x274], 0
jne 0x46b8e6
mov ecx, dword [0x4b992c]
mov dl, 1
mov eax, dword [0x466630]
call fcn.0040dab4
call fcn.00404cb0
mov eax, ebx
call fcn.0046be58
cmp byte [ebx + 0x57], 0
jne 0x46b91c
mov eax, ebx
call fcn.0044d958
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46b91c
push 0
mov eax, ebx
call fcn.0044d958
push eax
call sub.user32.dll_ShowWindow
jmp 0x46b91c
mov eax, ebx
call fcn.00449b44
add esp, 0x10
pop ebx
ret

Function at 0x470834
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
xor edx, edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x470917
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040533c
lea eax, [ebp - 8]
push eax
push 0x23
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x4708be
lea eax, [ebp - 0x10d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4708be
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x10d]
call fcn.0040a914
push dword [ebp - 0x114]
push 0x47092c
push 0x470938
push 0x47092c
lea eax, [ebp - 4]
mov edx, 4
call fcn.004056d0
mov eax, dword [ebp - 4]
call fcn.0040a304
test al, al
jne 0x4708e7
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 4]
call fcn.0040a554
mov eax, dword [ebp - 0x118]
call fcn.0040a328
test al, al
je 0x4708f1
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00405390
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47091e
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.00405360
lea eax, [ebp - 4]
call fcn.0040533c
ret

Function at 0x470940
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffbfc
mov ebx, eax
push esp
push 0x400
call sub.kernel32.dll_GetTempPathA
test eax, eax
jbe 0x470966
mov eax, ebx
mov edx, esp
mov ecx, 0x401
call fcn.004055ac
add esp, 0x404
pop ebx
ret

Function at 0x4712b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x108], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x471328
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040533c
push 0
push esi
lea eax, [ebp - 0x104]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x47130f
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x104]
call fcn.0040a914
mov eax, dword [ebp - 0x108]
mov edx, ebx
call fcn.0040e740
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47132f
lea eax, [ebp - 0x108]
call fcn.0040533c
ret
Function at 0x471338
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x471340
push ebx
push esi
push edi
mov byte [ebp - 0x11], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x4714ef
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4714b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x424250]
call fcn.004243bc
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x47149f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 0x11], 0
je 0x47139d
mov edx, 0x80000002
mov eax, dword [ebp - 0x18]
call fcn.0042445c
jmp 0x4713aa
mov edx, 0x80000001
mov eax, dword [ebp - 0x18]
call fcn.0042445c
mov cl, 1
mov edx, 0x471508
mov eax, dword [ebp - 0x18]
call fcn.004245a0
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.004033dc
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0040a588
mov edi, dword [ebp - 0x1c]
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.004033dc
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x24]
call fcn.0040a5c0
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x10]
push eax
xor ecx, ecx
mov dword [ebp - 0x2c], esi
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
call fcn.004333c4
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.004053d4
push 0x471540
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.004033dc
push dword [ebp - 0x34]
push 0x47154c
lea eax, [ebp - 0x38]
mov edx, dword [0x4b9ac0]
mov ecx, 2
call fcn.004055ac
push dword [ebp - 0x38]
lea eax, [ebp - 4]
mov edx, 4
call fcn.004056d0
test bl, bl
je 0x471476
lea ecx, [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.00424b3c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004098e0
test al, al
jne 0x471481
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.00424b0c
jmp 0x471481
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.00424a0c
mov eax, dword [ebp - 0x18]
call fcn.0042442c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4714a6
mov eax, dword [ebp - 0x18]
call fcn.00404378
ret
Function at 0x471550
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x471558
push ebx
push esi
push edi
xor edx, edx
push ebp
push 0x471656
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0x47157b
mov ebx, 0x80000002
jmp 0x471580
mov ebx, 0x80000001
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004033dc
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040a588
mov esi, dword [ebp - 0x10]
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.004033dc
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.0040a5c0
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push eax
xor ecx, ecx
mov dword [ebp - 0x20], edi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x24]
call fcn.004333c4
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004053d4
push 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
mov edx, 0x471670
mov eax, ebx
call fcn.00471ed4
push 0x4716a8
lea edx, [ebp - 0x2c]
xor eax, eax
call fcn.004033dc
push dword [ebp - 0x2c]
push 0x4716b4
lea eax, [ebp - 0x30]
mov edx, dword [0x4b9ac0]
mov ecx, 2
call fcn.004055ac
push dword [ebp - 0x30]
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.004056d0
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.004098e0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47165d
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00405360
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00405360
ret
Function at 0x471730
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x31]
xor eax, eax
push ebp
push 0x4719dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
push ebp
push 0x47193d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, dword [0x46fa74]
call fcn.0046fcf8
xor eax, eax
push ebp
push 0x471925
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4b97b8]
push eax
mov eax, dword [0x4b97b8]
push eax
mov eax, dword [0x4b97b8]
push eax
mov eax, dword [0x4b97b8]
push eax
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0xc]
call fcn.00405c9c
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
call fcn.00407190
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0x14], eax
push 1
call sub.kernel32.dll_Sleep_2
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 0x14]
cmp eax, 0x4e20
ja 0x47188c
jmp 0x47184f
mov esi, dword [edi]
test esi, esi
je 0x4717f5
push esi
call sub.user32.dll_IsWindowUnicode
test eax, eax
jne 0x4717f5
xor ebx, ebx
jmp 0x4717f7
mov bl, 1
test bl, bl
je 0x471814
push 1
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
jmp 0x47182b
push 1
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x47184f
cmp dword [edi + 4], 0x12
je 0x471861
push edi
call sub.user32.dll_TranslateMessage
test bl, bl
je 0x471849
push edi
call sub.user32.dll_DispatchMessageW
jmp 0x47184f
push edi
call sub.user32.dll_DispatchMessageA
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4717e1
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xe0]
call fcn.00407190
mov ebx, dword [ebp - 0x3c]
mov eax, 0x4719f8
call fcn.00472660
cmp ebx, 3
jl 0x4717c5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47192f
cmp dword [ebp - 4], 0
je 0x471924
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x94]
call fcn.00407190
cmp dword [ebp - 0x3c], 0
je 0x471924
push 0xfffffffffffffff0
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x94]
call fcn.00407190
mov eax, dword [ebp - 0x3c]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x1000000
push eax
push 0xfffffffffffffff0
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x94]
call fcn.00407190
mov eax, dword [ebp - 0x3c]
push eax
call sub.user32.dll_SetWindowLongA
push 6
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x94]
call fcn.00407190
mov eax, dword [ebp - 0x3c]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x471be8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
call fcn.004057bc
mov eax, dword [ebp + 0x14]
call fcn.004057bc
mov eax, dword [ebp + 8]
call fcn.004057bc
xor eax, eax
push ebp
push 0x471ccf
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 8], 0
jne 0x471c31
lea edx, [ebp + 8]
mov eax, edi
call fcn.0040a554
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403a64
mov dword [ebp - 0x40], 0x40
mov dword [ebp - 0x44], 0x3c
mov eax, dword [ebp + 0x14]
call fcn.004057cc
mov dword [ebp - 0x38], eax
mov eax, edi
call fcn.004057cc
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
call fcn.004057cc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
call fcn.004057cc
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
test esi, esi
je 0x471c9a
mov eax, dword [ebp - 0xc]
mov dword [esi], eax
test bl, bl
je 0x471ca9
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471cd6
lea eax, [ebp - 4]
call fcn.0040533c
lea eax, [ebp + 8]
call fcn.0040533c
lea eax, [ebp + 0x14]
call fcn.0040533c
ret
Function at 0x472a64
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x472c80
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.0040533c
lea eax, [ebp - 4]
call fcn.0040533c
cmp dword [ebp - 8], 0
jne 0x472abc
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004053d4
lea eax, [ebp - 0x10]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405834
mov eax, dword [ebp - 0x10]
mov edx, 0x472c98
call fcn.004098e0
test al, al
je 0x472b4f
push 1
push 0
lea eax, [ebp - 0x28]
mov edx, dword [0x4b99a0]
mov ecx, 0x10
call fcn.00403cf4
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x3c]
call fcn.00403948
mov edx, 0x472ca0
lea eax, [ebp - 0x3c]
mov cl, 0x11
call fcn.00403918
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x14]
call fcn.004055a0
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00405608
mov eax, dword [ebp - 0x14]
call fcn.004057cc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004057cc
push eax
push 0x472ca4
mov eax, dword [ebp + 8]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x472c4b
mov edi, esi
mov ebx, edi
test ebx, ebx
je 0x472b5c
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebx + 1]
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405834
mov eax, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x44]
mov ecx, 0x472cb4
mov edx, esi
call fcn.00405654
mov edx, dword [ebp - 0x44]
pop eax
call fcn.004098e0
test al, al
je 0x472bdc
mov eax, edi
test eax, eax
je 0x472b9b
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 8]
mov ecx, eax
mov eax, 1
xchg edx, eax
call fcn.00405874
push 1
push 0
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 8]
call fcn.0046fe40
mov eax, dword [ebp - 0x48]
call fcn.004057cc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004057cc
push eax
push 0x472ca4
mov eax, dword [ebp + 8]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x472c4b
mov ebx, edi
test ebx, ebx
je 0x472be7
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 0x4c]
push eax
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405834
mov eax, dword [ebp - 0x4c]
mov edx, esi
call fcn.004098e0
test al, al
je 0x472c2e
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.004057cc
push eax
mov eax, dword [ebp - 0xc]
call fcn.004057cc
push eax
push 0x472ca4
mov eax, dword [ebp + 8]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x472c4b
push 1
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004057cc
push eax
push 0x472ca4
mov eax, dword [ebp + 8]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472c87
lea eax, [ebp - 0x4c]
mov edx, 4
call fcn.00405360
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00405360
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405360
ret
Function at 0x475c5c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x475c8a
mov eax, ebx
call fcn.00476710
cmp dword [ebx + 0x40], 0
je 0x475c83
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x475cfb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x475ced
cmp dword [ebx + 8], 0
je 0x475cac
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x475cbe
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x475ced
cmp dword [ebx + 8], 0
je 0x475c9f
cmp eax, 3
je 0x475cd1
dec eax
jne 0x475c9f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x475c9f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x475c9f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x475d19
cmp dword [ebx + 0x14], 0xcc
je 0x475d19
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00475d24
pop ebx
ret

Function at 0x48df14
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x48df6c
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x64]
cmp eax, 0x3e8
jae 0x48df4d
mov eax, dword [ebx + 0x50]
mov edx, dword [ebx + 0x54]
cmp edx, dword [ebx + 0x5c]
jne 0x48df4b
cmp eax, dword [ebx + 0x58]
jb 0x48df62
jmp 0x48df4d
jl 0x48df62
push ebx
push 0x48de80
mov eax, ebx
call fcn.004209f4
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x64], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48df76
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x48f5b4
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
test dl, dl
je 0x48f5cd
add esp, 0xfffffff0
call fcn.0040469c
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x48f68b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00404348
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 8], 0xffffffff
mov byte [ebx + 0xc], 0
cmp dword [ebx + 4], 0xffffffff
jne 0x48f60f
push ebx
push 0x48f81c
call fcn.00421cdc
mov dword [ebx + 4], eax
mov byte [ebx + 0xc], 0
push 0
push 2
push 2
call sub.ws2_32.dll_socket
mov esi, eax
mov dword [ebx + 8], esi
cmp esi, 0xffffffff
jne 0x48f63e
mov ecx, 0x48f6bc
mov dl, 1
mov eax, dword [0x408960]
call fcn.0040d9f8
call fcn.00404cb0
push 1
push 0x1a5a
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebx + 8]
push eax
call sub.ws2_32.dll_WSAAsyncSelect
test eax, eax
je 0x48f675
cmp word [ebx + 0x1a], 0
je 0x48f675
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 8]
call fcn.0040d1d8
mov ecx, dword [ebp - 8]
mov edx, ebx
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f692
lea eax, [ebp - 8]
call fcn.0040533c
ret

Function at 0x48f700
Capabilities:
Print debug messages
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9a0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x660], edx
mov dword [ebp - 0x65c], edx
mov dword [ebp - 0x658], edx
mov esi, eax
xor eax, eax
push ebp
push 0x48f80f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x640
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x654]
push eax
push 0
push ebx
lea eax, [ebp - 0x644]
push eax
mov eax, dword [esi + 8]
push eax
call sub.ws2_32.dll_recvfrom
mov ebx, eax
test ebx, ebx
jl 0x48f7a7
cmp word [esi + 0x12], 0
je 0x48f7f1
push dword [ebp - 0x650]
call sub.ws2_32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x658]
call fcn.00405534
mov eax, dword [ebp - 0x658]
push eax
movzx eax, word [ebp - 0x652]
push eax
call sub.ws2_32.dll_ntohs
push eax
lea edx, [ebp - 0x644]
mov ecx, ebx
mov eax, dword [esi + 0x14]
call dword [esi + 0x10]
jmp 0x48f7f1
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x65c]
call fcn.00409e68
mov eax, dword [ebp - 0x65c]
call fcn.004057cc
push eax
call sub.kernel32.dll_OutputDebugStringA
cmp word [esi + 0x1a], 0
je 0x48f7f1
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x660]
call fcn.0040d1d8
mov ecx, dword [ebp - 0x660]
mov edx, esi
mov eax, dword [esi + 0x1c]
call dword [esi + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f816
lea eax, [ebp - 0x660]
mov edx, 3
call fcn.00405360
ret