joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402d74
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.0040dff0
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp dword [0x432b78], 0x594
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], eax
jne 0x402dc4
push 0x4026c8
push 0x4026d8
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push 0x4026f4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov eax, dword [0x4284a8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4284ac]
mov dword [ebp - 0x30], eax
push edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.00402d6d
mov eax, dword [0x4284b0]
add dword [ebp - 0x10], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4284b4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
jmp 0x402e03
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, esi
shl eax, 4
cmp dword [0x432b78], 0xc
mov dword [ebp - 4], eax
jne 0x402e65
push ebx
lea eax, [ebp - 0x84c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x104c]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
lea eax, [ebp - 0x38]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x432b78]
cmp eax, 0xfa9
jne 0x402e81
mov dword [0x432114], 0xedeb2e40
cmp eax, 0x3eb
jne 0x402e8e
mov dword [0x431ac0], ebx
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov edx, esi
shr edx, cl
lea eax, [edi + esi]
mov dword [ebp - 0x18], eax
mov dword [0x432110], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
cmp dword [0x432b78], 0x213
mov dword [ebp - 0x18], edx
jne 0x402ece
push 0x402710
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov eax, dword [ebp - 0x18]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
call fcn.00402d67
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add dword [ebp - 0x10], 0x61c88647
mov eax, edx
shr eax, cl
lea esi, [edi + edx]
add eax, dword [ebp - 0x30]
xor eax, esi
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
dec dword [ebp - 0x20]
jne 0x402e00
cmp dword [0x432b78], 0xa6d
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
mov dword [esi], eax
pop edi
jne 0x402f38
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 8]
mov dword [esi + 4], edx
pop esi
pop ebx
leave
ret 4
Function at 0x402f41
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x432b78]
mov ecx, dword [0x431ac8]
sub esp, 0x544
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x402fb4
mov edi, ecx
mov ebx, eax
cmp dword [0x432b78], 0x959
jne 0x402fa8
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x402750
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
lea eax, [ebp - 0x540]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
call fcn.00402d74
add edi, 8
dec ebx
jne 0x402f65
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4032ef
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
push ebx
push esi
xor esi, esi
cmp dword [0x432b78], 0x400
push edi
jne 0x403341
push esi
push esi
call fcn.004036e6
push esi
push esi
call fcn.004036e6
push esi
push esi
push esi
call fcn.00403f80
add esp, 0x14
mov dword [esp + 4], esi
mov dword [esp], esi
call fcn.00402ce2
fstp st(0)
push esi
call fcn.00404005
pop ecx
push esi
call fcn.00403d97
pop ecx
mov eax, dword [0x428b34]
mov dword [0x432b78], eax
mov eax, dword [0x428b0c]
mov dword [0x432b7c], eax
call fcn.00402fd3
mov dword [esp + 0x10], esi
mov ebx, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [esp + 0x1c], esi
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push esi
lea eax, [esp + 0x3c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [esp + 0x10], ebx
jle 0x4033a8
cmp dword [esp + 0x18], 0x785074d5
jne 0x4033b6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1c1b
jl 0x403363
xor edi, edi
push esi
lea eax, [esp + 0x34]
push eax
push esi
push 0x402b6c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x402ba8
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, ebx
jle 0x4033e5
cmp dword [esp + 0x18], 0x785074d5
jne 0x4033ee
inc edi
cmp edi, 0x11915
jl 0x4033b8
mov eax, dword [0x431ac8]
mov dword [0x43210c], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x404970
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4270d8]
jne 0x40497a
repz ret
jmp fcn.00408d4a
Function at 0x408a05
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405bcc
and dword [ebp - 4], 0
cmp dword [0x4293b8], 0
mov ebx, eax
jne 0x408ab6
push 0x401b18
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408b67
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401b0c
push edi
call esi
test eax, eax
je 0x408b67
push eax
call fcn.00405b5a
mov dword [esp], 0x401afc
push edi
mov dword [0x4293b8], eax
call esi
push eax
call fcn.00405b5a
mov dword [esp], 0x401ae8
push edi
mov dword [0x4293bc], eax
call esi
push eax
call fcn.00405b5a
mov dword [esp], 0x401acc
push edi
mov dword [0x4293c0], eax
call esi
push eax
call fcn.00405b5a
pop ecx
mov dword [0x4293c8], eax
test eax, eax
je 0x408ab6
push 0x401ab4
push edi
call esi
push eax
call fcn.00405b5a
pop ecx
mov dword [0x4293c4], eax
mov eax, dword [0x4293c4]
cmp eax, ebx
je 0x408b0e
cmp dword [0x4293c8], ebx
je 0x408b0e
push eax
call fcn.00405bd5
push dword [0x4293c8]
mov esi, eax
call fcn.00405bd5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408b0e
test edi, edi
je 0x408b0e
call esi
test eax, eax
je 0x408b05
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408b05
test byte [ebp - 0xc], 1
jne 0x408b0e
or dword [ebp + 0x10], 0x200000
jmp 0x408b47
mov eax, dword [0x4293bc]
cmp eax, ebx
je 0x408b47
push eax
call fcn.00405bd5
pop ecx
test eax, eax
je 0x408b47
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408b47
mov eax, dword [0x4293c0]
cmp eax, ebx
je 0x408b47
push eax
call fcn.00405bd5
pop ecx
test eax, eax
je 0x408b47
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4293b8]
call fcn.00405bd5
pop ecx
test eax, eax
je 0x408b67
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408b69
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00407290
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00407290
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00407290
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00407290
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00407290
mov dword [0x41203c], eax
call fcn.00407290
test eax, eax
jge 0x402550
push 8
call fcn.00407290
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00407290
pop ecx
push 1
call fcn.00407290
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00407290
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00407290
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00407290
jmp 0x402495

Function at 0x407290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40729f
pop dword [ebp - 0x50]
mov eax, 0x40729f
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3a8b4
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x4d0c
mov edx, eax
mov ebx, 0xa04a9edc
add ebx, 0x5ff69ce8
add ebx, dword [ebp - 0x50]
mov esi, 0x9398a597
sub esi, 0xa4d61c6
mov edi, dword [ebx]
sub dword [ebp - 0x24], 0x1b36c19a
add edi, esi
add dword [ebp - 0x34], esi
mov dword [edx], edi
xor dword [ebp - 0x40], eax
add edx, 0x6fb28be9
add edx, 0x904d741b
add ebx, 4
loop 0x4072ee
add eax, 0x9b5f041f
add eax, 0x64a222e4
mov ebx, eax
add eax, 0x848badac
add eax, 0x7b745259
mov ecx, 0x4c9c2157
sub ecx, 0x4c5c2157
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x404d39
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x404d48
pop dword [ebp - 0x28]
mov eax, 0x404d48
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x4fe8e
push 0
mov eax, 0x1cf285cc
add eax, 0xe3522cf0
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x47d6
mov edi, eax
mov esi, 0x8c050807
add esi, 0x744375f9
add esi, dword [ebp - 0x28]
mov ebx, 0xb03037c3
sub ebx, 0x975aaf17
add dword [ebp - 0x24], ecx
mov edx, dword [esi]
sub edx, ebx
mov dword [ebp - 0x1c], 0x2b5e0e5b
mov dword [edi], edx
xor dword [ebp - 4], 0x79127afa
add edi, 4
add esi, 0xb4f4681a
add esi, 0x4b0b97ea
loop 0x404d9c
add eax, 0x9b4afe74
add eax, 0x64b613b7
xor ebx, ebx
add ebx, eax
add eax, 0x453fb813
add eax, 0xbac047f2
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x4010d4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov eax, str._ccav_
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.00401224
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401108
push ebx
call fcn.0040fae3
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [0x41bef1]
test ebx, ebx
je 0x40111f
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [0x41bef1], eax
push 0x41b216
push dword [0x41bef1]
call fcn.00401037
add esp, 8
cmp eax, 0
jne 0x401165
mov dword [ebp - 8], esp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401448
call fcn.00403124
call main
call fcn.004033f7
call fcn.0040d441
mov eax, str._7c490cfe7f13a6b0_
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401194
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x40119d
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4011ad
push ebx
call fcn.0040fae3
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4023a5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.004109b0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4023ea
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x402415
push 6
call fcn.0040fae9
add esp, 4
push 0x80000301
push 0
push 1
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x402434
mov eax, 0x41b216
push eax
push 2
mov ebx, 0x138
call fcn.00410bc0
add esp, 0x1c
mov dword [ebp - 8], eax
push 0x41b2a5
push dword [ebp - 8]
call fcn.00401037
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x402478
push ebx
call fcn.0040fae3
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x4024b2
push 0x41b2a5
push dword [ebp - 4]
mov ecx, 2
call fcn.004013b5
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4024ae
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4024ce
push eax
mov ebx, eax
call fcn.004011b9
inc eax
push eax
call fcn.0040fadd
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4024d3
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4024e4
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x403124
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, 0x41b316
test eax, eax
je 0x403157
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0040fadd
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x403168
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000301
push 0
push 2
push 0x80000004
push 0
push 0x41b2a0
push 0x80000005
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x403197
mov eax, 0x41b265
push eax
push 3
mov ebx, 0x10
mov eax, 0x414a00
call fcn.0040fdf0
add esp, 0x28
mov dword [ebp - 0xc], eax
push 0x80000005
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4031c5
mov eax, 0x41b265
push eax
push 1
mov ebx, 0x168
call fcn.00410150
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4031eb
push ebx
call fcn.0040fae3
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4031ff
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40322f
push 6
call fcn.0040fae9
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x403265
mov dword [ebp - 0xc], esp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x403296
push 6
call fcn.0040fae9
add esp, 4
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4032a6
push ebx
call fcn.0040fae3
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4032b6
push ebx
call fcn.0040fae3
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x4032ba
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
jne 0x403347
mov dword [ebp - 0xc], esp
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x403303
push 6
call fcn.0040fae9
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x403315
jmp 0x403347
push 0
mov ebx, 0x350
call fcn.00410d00
add esp, 4
push 0x80000301
push 0
push 1
push 1
mov ebx, 0x67c
call fcn.00410d70
add esp, 0x10
jmp 0x4032d1
mov esp, ebp
pop ebp
ret
Function at 0x4052d0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000301
push 0
push 0x104
push 1
mov ebx, 0x184
call fcn.004109b0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40531c
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
mov eax, 0x104
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40534e
push 6
call fcn.0040fae9
add esp, 4
push 0x80000002
push 0
push 1
mov ebx, 6
call fcn.004011b1
push 0x80000004
push 0
push 0x41b216
push 0x80000004
push 0
push 0x41b294
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40538f
mov eax, 0x41b216
push eax
push 6
mov ebx, 0x180
call fcn.0040fe90
add esp, 0x4c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4053b9
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0x41b216
push dword [ebp - 8]
call fcn.00401037
add esp, 8
cmp eax, 0
jne 0x4053f0
mov eax, 0x41b3df
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4053ec
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x40540c
push eax
mov ebx, eax
call fcn.004011b9
inc eax
push eax
call fcn.0040fadd
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x405411
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x405422
push ebx
call fcn.0040fae3
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x405432
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40a505
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000301
push 0
push 0x2000
push 1
mov ebx, 0x1bc
call fcn.00411470
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40a551
push ebx
call fcn.0040fae3
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000005
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40a568
mov eax, 0x41b265
push eax
push 1
mov ebx, 0x194
call fcn.00411680
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0
push dword [ebp - 0xc]
mov eax, dword [ebp - 4]
test eax, eax
je 0x40a593
add eax, 8
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x40a5b3
push 6
call fcn.0040fae9
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x40a67b
lea eax, [ebp - 4]
push eax
call fcn.0040a775
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
push 0
push dword [ebp - 0x30]
mov dword [ebp - 0x34], 0
push 0
push dword [ebp - 0x34]
mov dword [ebp - 0x38], 0
push 0
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0
push 0
push dword [ebp - 0x3c]
push 1
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push 1
push dword [ebp + 8]
push dword [0x41bf11]
call fcn.0040a4cc
jmp 0x40a680
jmp 0x40a685
jmp 0x40a51c
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40a6a7
push 6
call fcn.0040fae9
add esp, 4
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
push 0
push dword [ebp - 0x30]
mov dword [ebp - 0x34], 0
push 0
push dword [ebp - 0x34]
mov dword [ebp - 0x38], 0
push 0
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0
push 0
push dword [ebp - 0x3c]
mov dword [ebp - 0x40], 0
push 0
push dword [ebp - 0x40]
push 1
push dword [ebp + 8]
push dword [0x41bf15]
call fcn.0040a4cc
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40a76f
push ebx
call fcn.0040fae3
add esp, 4
mov esp, ebp
pop ebp
ret 4