joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405bce
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
lea eax, [ebp - 0x424]
push eax
push 0xf6
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0xf5
ja 0x405c88
lea eax, [ebp - 0x21c]
push eax
push ebx
push 0x401660
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x405c88
lea eax, [ebp - 0x21c]
push eax
call fcn.0041c264
test al, al
je 0x405c88
push dword [ebp + 0xc]
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp + 8]
call fcn.0041aede
test al, al
je 0x405c88
lea eax, [ebp - 0x21c]
push eax
push 2
pop eax
lea esi, [ebp - 0x10]
call fcn.0041c11e
test al, al
je 0x405c7c
lea eax, [ebp - 0x21c]
cmp dword [ebp + 8], ebx
je 0x405c61
mov eax, dword [ebp + 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push eax
push 2
call fcn.004059c5
mov bl, al
lea eax, [ebp - 0x10]
call fcn.0041c1c6
lea eax, [ebp - 0x21c]
push eax
call fcn.0041c264
pop esi
mov al, bl
pop ebx
leave
ret 0xc
Function at 0x406b20
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x230
push esi
push edi
push 0x26
lea esi, [esp + 0x24]
pop eax
call fcn.00408c1d
mov eax, esi
mov dword [esp + 8], eax
xor edi, edi
lea eax, [esp + 0x30]
push eax
push edi
push edi
push 0x21
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x406bba
push 0x27
lea esi, [esp + 0x1c]
pop eax
call fcn.00408c1d
push edi
push edi
push edi
lea eax, [esp + 0x18]
push eax
mov esi, 0x406a97
push esi
push 4
push 1
lea edx, [esp + 0x24]
lea ecx, [esp + 0x4c]
call fcn.0041c632
lea eax, [esp + 0x30]
push eax
push eax
lea eax, [esp + 0x20]
call fcn.0041c78e
test al, al
je 0x406bba
push edi
push edi
push edi
lea eax, [esp + 0x18]
push eax
push esi
push 4
push 1
lea edx, [esp + 0x24]
lea ecx, [esp + 0x4c]
call fcn.0041c632
test bl, 2
je 0x406bd1
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x406c80
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
push ebx
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, 0x1000
call fcn.00416ed5
xor esi, esi
mov dword [esp + 0x10], eax
cmp eax, esi
jne 0x406cb5
push esi
call fcn.00416f05
xor al, al
jmp 0x406d91
mov ebx, dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
push 0x406c37
push dword [ebp + 8]
call ebx
push 0x28
pop edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
push edx
mov dword [eax], esi
push esi
lea eax, [esp + 0x20]
push eax
mov dword [edi], esi
mov byte [esp + 0x1b], 1
call fcn.00416fb8
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], edx
mov dword [esp + 0x2c], eax
push esi
push 8
lea eax, [esp + 0x20]
push eax
push dword [ebp + 8]
mov dword [esp + 0x40], 0x1000
call dword [sym.imp.WININET.dll_InternetReadFileExA]
test eax, eax
jne 0x406d25
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x406d5b
lea eax, [ebp + 0xc]
push eax
call fcn.0041a672
jmp 0x406cf0
cmp dword [esp + 0x30], esi
je 0x406d60
mov ecx, dword [edi]
add ecx, dword [esp + 0x30]
mov esi, dword [ebp + 0x10]
call fcn.00416e90
test al, al
je 0x406d5b
push dword [esp + 0x30]
mov eax, esi
mov eax, dword [eax]
push dword [esp + 0x14]
add eax, dword [edi]
push eax
call fcn.00416f41
mov eax, dword [esp + 0x30]
add dword [edi], eax
xor esi, esi
jmp 0x406cf0
mov byte [esp + 0xf], 0
mov eax, dword [esp + 0x14]
inc eax
neg eax
sbb eax, eax
and eax, dword [esp + 0x14]
push eax
push dword [ebp + 8]
call ebx
push dword [esp + 0x10]
call fcn.00416f05
cmp byte [esp + 0xf], 0
jne 0x406d8d
mov eax, dword [ebp + 0x10]
push dword [eax]
call fcn.00416f05
mov al, byte [esp + 0xf]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40777a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
sub eax, 0xa1
push ebx
push edi
je 0x4077d7
push 3
pop ecx
sub eax, ecx
je 0x4077ce
sub eax, ecx
je 0x4077c5
sub eax, 0x15a
je 0x4077bc
sub eax, ecx
je 0x4077b3
sub eax, ecx
jne 0x407850
mov dword [ebp - 4], 0x209
xor bl, bl
jmp 0x4077e0
mov dword [ebp - 4], 0x206
jmp 0x4077af
mov dword [ebp - 4], 0x203
jmp 0x4077af
mov dword [ebp - 4], 0xa9
jmp 0x4077de
mov dword [ebp - 4], 0xa6
jmp 0x4077de
mov dword [ebp - 4], 0xa3
mov bl, 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [ebp + 8]
cmp dword [esi + 0x16c], eax
jne 0x40783b
mov ecx, dword [esi + 0x168]
cmp ecx, dword [ebp + 0xc]
jne 0x40783b
mov ecx, edi
sub ecx, dword [esi + 0x164]
cmp ecx, 0x3e8
ja 0x40783b
test bl, bl
jne 0x40781f
push 0xffffffffffffffe6
push eax
call dword [sym.imp.USER32.dll_GetClassLongW]
test al, 8
je 0x407838
xor eax, eax
mov dword [esi + 0x168], eax
mov dword [esi + 0x164], eax
mov dword [esi + 0x16c], eax
mov eax, dword [ebp - 4]
jmp 0x407853
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x168], ecx
mov dword [esi + 0x164], edi
mov dword [esi + 0x16c], eax
mov eax, dword [ebp + 0xc]
pop edi
pop ebx
leave
ret 8

Function at 0x408be7
Capabilities:
Encode data using xor

Disassembly:
movzx eax, ax
lea eax, [eax*8 + 0x402a80]
xor edx, edx
xor ecx, ecx
cmp dx, word [eax + 2]
jae 0x408c14
push esi
mov edx, dword [eax + 4]
movzx esi, cx
mov dl, byte [edx + esi]
xor dl, byte [eax]
xor dl, cl
inc ecx
mov byte [esi + edi], dl
cmp cx, word [eax + 2]
jb 0x408bfc
pop esi
movzx eax, word [eax + 2]
mov byte [eax + edi], 0
ret

Function at 0x408c1d
Capabilities:
Encode data using xor

Disassembly:
movzx eax, ax
lea eax, [eax*8 + 0x402a80]
xor ecx, ecx
xor edx, edx
cmp cx, word [eax + 2]
jae 0x408c5c
push ebx
push edi
mov edi, dword [eax + 4]
movzx ebx, byte [eax]
movzx ecx, dx
movsx di, byte [edi + ecx]
xor di, bx
xor di, dx
mov ebx, 0xff
and di, bx
inc edx
mov word [esi + ecx*2], di
cmp dx, word [eax + 2]
jb 0x408c33
pop edi
pop ebx
movzx eax, word [eax + 2]
xor ecx, ecx
mov word [esi + eax*2], cx
ret
Function at 0x409704
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
cmp dword [ebp + 0xc], 0xffffffff
je 0x4097b4
test byte [ebp + 0x14], 2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xa8]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x80
je 0x409744
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x40974c
or eax, 0xffffffff
jmp 0x409818
call dword [sym.imp.WS2_32.dll_getsockname]
jmp 0x409738
cmp word [ebp - 0xa8], 2
jne 0x409780
push 4
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp + 0xf], 1
call fcn.00416f41
push 2
lea eax, [ebp - 0xa6]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00416f41
jmp 0x4097d8
cmp word [ebp - 0xa8], 0x17
jne 0x40973c
push 0x10
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp + 0xf], 4
call fcn.00416f41
push 2
lea eax, [ebp - 0xa6]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00416f41
jmp 0x4097cb
push 0x1c
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00416fb8
test byte [ebp + 0x14], 1
je 0x4097d4
mov byte [ebp + 0xf], 4
mov dword [ebp - 4], 0x12
jmp 0x4097df
mov byte [ebp + 0xf], 1
mov dword [ebp - 4], 6
mov al, byte [ebp + 0x10]
mov byte [ebp + 0xd], al
push 4
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp + 0xc], 5
mov byte [ebp + 0xe], 0
call fcn.00416f41
mov eax, dword [ebp - 4]
add eax, 4
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call fcn.00419f2f
xor ecx, ecx
test al, al
setne cl
mov eax, ecx
leave
ret 0x10
Function at 0x40a0ed
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 0xc], 0xffffffff
je 0x40a134
test byte [ebp + 0x14], 2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x10
je 0x40a120
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x40a128
or eax, 0xffffffff
jmp 0x40a15f
call dword [sym.imp.WS2_32.dll_getsockname]
jmp 0x40a117
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov ax, word [ebp - 0x1a]
jmp 0x40a13a
and dword [ebp - 8], 0
xor eax, eax
mov word [ebp - 0xa], ax
mov al, byte [ebp + 0x10]
mov byte [ebp - 0xb], al
push 8
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov byte [ebp - 0xc], 0
call fcn.00419f2f
xor ecx, ecx
test al, al
setne cl
mov eax, ecx
leave
ret 0x10
Function at 0x40b992
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push dword [eax + 8]
xor esi, esi
test byte [eax], 2
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], esi
je 0x40b9b6
mov edx, dword [eax + 4]
mov eax, dword [ecx + 8]
call fcn.0040a40d
jmp 0x40b9be
push dword [ecx + 8]
call fcn.0041bf9b
mov dword [ebp - 0xc], eax
cmp eax, esi
je 0x40b9fe
call fcn.00416160
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push 0x40b75a
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x40b9f6
lea eax, [ebp - 4]
push eax
call fcn.0041a672
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call fcn.00416f05
mov eax, dword [ebp - 8]
pop esi
leave
ret

Function at 0x40bb54
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
push edi
push 0
lea eax, [ebp - 0xd0]
push eax
push 0xff220829
call fcn.00416214
push 3
lea esi, [ebp - 0x68]
pop eax
call fcn.00408c1d
xor bl, bl
mov edi, reloc.WS2_32.dll_accept
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x68]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
jne 0x40bbde
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 4]
push eax
push 1
push 0
lea eax, [ebp - 0x68]
push eax
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bbd1
lea eax, [ebp - 0xd0]
push eax
lea esi, [ebp - 4]
call fcn.0041b25f
jmp 0x40bbd3
xor al, al
test al, al
je 0x40bbe5
inc bl
cmp bl, 5
jb 0x40bb85
xor al, al
pop edi
pop esi
pop ebx
leave
ret
mov al, 1
jmp 0x40bbe0

Function at 0x40bca3
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor bl, bl
jmp 0x40bcce
cmp byte [ebp + 0x10], 0
jne 0x40bcbd
cmp bl, 0xa
je 0x40bce7
movzx eax, bl
add eax, 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
inc bl
push 0x20
push edi
call esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call fcn.0041c0b9
test al, al
je 0x40bcb2
mov al, 1
jmp 0x40bce9
xor al, al
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x40bdab
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
call dword [ebp + 8]
test eax, eax
je 0x40be18
push edi
push dword [ebp + 0xc]
call fcn.0041a5f4
mov edi, eax
test edi, edi
je 0x40be0e
push dword [ebp + 0x10]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x40be08
push esi
push dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 8]
push 0x404888
push eax
call fcn.00417c73
add esp, 0xc
test eax, eax
jle 0x40be07
push dword [ebp + 8]
push esi
call fcn.00418827
push dword [ebp + 8]
call fcn.00416f05
pop esi
push edi
call fcn.00416f05
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
ret 0x10
Function at 0x40c290
Capabilities:
Encode data using xor

Disassembly:
adc al, byte [eax]
mov word [edx - 0x64], ss
cld
cmp eax, 0x3593f121
fdiv qword [eax + 0x7f]
mov cl, byte [edi + 0x5820f427]
dec edi
jg 0x40c27c
fnstenv [eax - 0xa]
invalid
Function at 0x40c82f
Capabilities:
Delete registry key
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xbe8
push esi
push edi
push 1
lea edi, [esp + 0x574]
call fcn.00416570
mov esi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, edi
push eax
call esi
push 2
lea edi, [esp + 0x36c]
call fcn.00416570
mov eax, edi
push eax
call esi
or dword [0x422d68], 2
push 0
call fcn.0040bd75
call fcn.0040bb54
lea ecx, [esp + 0x570]
call fcn.0041c577
mov ecx, edi
call fcn.0041c577
push 3
lea edi, [esp + 0x164]
call fcn.00416570
mov eax, edi
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov esi, dword [sym.imp.USER32.dll_CharToOemW]
lea eax, [esp + 0x160]
push eax
lea eax, [esp + 0x574]
push eax
call esi
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x36c]
push eax
call esi
push 7
lea edi, [esp + 0xc]
pop eax
call fcn.00408be7
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x16c]
push eax
mov eax, edi
push eax
mov edi, 0x474
lea esi, [esp + 0x78c]
call fcn.00417c3c
add esp, 0x14
test eax, eax
jle 0x40c91b
mov eax, esi
push eax
call fcn.004189c5
cmp dword [0x423230], 0xffffffff
jne 0x40c92c
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40cf16
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
push 2
mov dword [ebp - 4], 0x104
call dword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
je 0x40cf67
mov eax, dword [ebp - 4]
test eax, eax
je 0x40cf67
xor ecx, ecx
mov word [esi + eax*2], cx
mov eax, esi
cmp word [esi], cx
je 0x40cf6f
movzx ecx, word [eax]
cmp ecx, 0x2f
je 0x40cf56
cmp ecx, 0x5c
jne 0x40cf5c
push 0x7c
pop ecx
mov word [eax], cx
add eax, 2
cmp word [eax], 0
jne 0x40cf49
jmp 0x40cf6f
push 6
pop eax
call fcn.00408c1d
pop esi
leave
ret

Function at 0x40d797
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x11c
push esi
lea eax, [ebp - 0xa4]
push eax
xor esi, esi
mov dword [ebp - 0xa4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40d865
push 2
pop eax
cmp dword [ebp - 0x94], eax
jne 0x40d865
xor ecx, ecx
inc ecx
cmp byte [ebp + 0x76], cl
jne 0x40d825
cmp dword [ebp - 0xa0], 5
jne 0x40d804
cmp dword [ebp - 0x9c], esi
jne 0x40d7f0
mov esi, ecx
jmp 0x40d865
cmp dword [ebp - 0x9c], ecx
je 0x40d800
cmp dword [ebp - 0x9c], eax
jne 0x40d865
mov esi, eax
jmp 0x40d865
cmp dword [ebp - 0xa0], 6
jne 0x40d865
cmp dword [ebp - 0x9c], esi
jne 0x40d819
push 4
jmp 0x40d864
cmp dword [ebp - 0x9c], ecx
jne 0x40d865
push 6
jmp 0x40d864
cmp byte [ebp + 0x76], al
je 0x40d830
cmp byte [ebp + 0x76], 3
jne 0x40d865
cmp dword [ebp - 0xa0], 5
jne 0x40d845
cmp dword [ebp - 0x9c], eax
jne 0x40d865
push 3
jmp 0x40d864
cmp dword [ebp - 0xa0], 6
jne 0x40d865
cmp dword [ebp - 0x9c], esi
jne 0x40d85a
push 5
jmp 0x40d864
cmp dword [ebp - 0x9c], ecx
jne 0x40d865
push 7
pop esi
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x40dae2
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get program files directory
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8ac
push ebx
push esi
push 0x2a
lea esi, [ebp - 0x8c]
pop eax
call fcn.00408c1d
lea eax, [ebp - 0x49c]
push eax
xor ebx, ebx
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x40dc63
lea eax, [ebp - 0x49c]
push eax
push eax
mov eax, esi
call fcn.0041c78e
test al, al
je 0x40dc63
push 0x2c
lea esi, [ebp - 0x6c]
pop eax
call fcn.00408c1d
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x6a4]
push eax
mov eax, esi
call fcn.0041c78e
test al, al
je 0x40dc63
lea eax, [ebp - 0x6a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40dc63
push 0x2d
lea esi, [ebp - 0x38]
pop eax
call fcn.00408c1d
push 0x2e
lea esi, [ebp - 0x50]
pop eax
call fcn.00408c1d
push 0x2f
lea esi, [ebp - 0x10]
pop eax
call fcn.00408c1d
mov byte [ebp - 1], bl
push edi
movzx eax, byte [ebp - 1]
push eax
lea eax, [ebp - 0x38]
push eax
push 0xa
pop edx
lea edi, [ebp - 0x24]
call fcn.00417bf8
pop ecx
pop ecx
cmp eax, 1
jl 0x40dc62
lea eax, [ebp - 0x6a4]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x50]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40dc62
lea eax, [ebp - 0x6a4]
push eax
push 0x104
lea eax, [ebp - 0x294]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x40dc55
lea eax, [ebp - 0x294]
cmp word [ebp - 0x294], bx
je 0x40dc19
cmp word [eax], 0x2f
jne 0x40dc11
push 0x5c
pop ecx
mov word [eax], cx
add eax, 2
cmp word [eax], bx
jne 0x40dc05
cmp esi, 1
jne 0x40dc43
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x8ac]
push eax
lea eax, [ebp - 0x294]
call fcn.0041c78e
test al, al
je 0x40dc55
lea ecx, [ebp - 0x8ac]
jmp 0x40dc49
lea ecx, [ebp - 0x294]
mov edx, dword [ebp + 8]
call fcn.0040dc69
test al, al
je 0x40dc62
inc byte [ebp - 1]
cmp byte [ebp - 1], 0xfa
jb 0x40db91
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40dc69
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x36c
push esi
push edi
push 0x2b
lea esi, [ebp - 0x1c]
pop eax
mov dword [ebp - 0xc], edx
mov edi, ecx
call fcn.00408c1d
push edi
lea eax, [ebp - 0x36c]
push eax
mov eax, esi
call fcn.0041c78e
test al, al
je 0x40dd4a
xor esi, esi
push esi
push 0x80
push 2
push esi
push 1
push 0x40000000
lea eax, [ebp - 0x36c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x40dd4a
push ebx
push 0x30
lea edi, [ebp - 0x164]
pop eax
xor bl, bl
call fcn.00408be7
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 8]
push eax
mov edi, 0x146
push edi
lea eax, [ebp - 0x164]
push eax
push dword [ebp - 4]
call esi
test eax, eax
je 0x40dd27
cmp dword [ebp - 8], edi
jne 0x40dd27
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x40dd21
call fcn.00417a42
push 0
mov edi, eax
lea eax, [ebp - 8]
push eax
push edi
push ecx
push dword [ebp - 4]
call esi
test eax, eax
je 0x40dd25
cmp dword [ebp - 8], edi
jne 0x40dd25
mov bl, 1
jmp 0x40dd27
xor bl, bl
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
pop ebx
jne 0x40dd4a
lea eax, [ebp - 0x36c]
push eax
call fcn.0041c264
pop edi
mov al, 1
pop esi
leave
ret

Function at 0x40ecfb
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push esi
mov esi, ecx
push edi
mov edi, eax
test si, si
je 0x40ed2f
push 2
mov eax, esi
pop edx
call fcn.0040ec61
test al, al
je 0x40ed2f
mov edi, dword [ebp + 8]
push 0x17
mov eax, esi
pop edx
call fcn.0040ec61
mov ax, si
jmp 0x40ed7d
push 2
xor eax, eax
pop edx
call fcn.0040ec61
test al, al
je 0x40ed7b
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x8c]
push eax
push dword [edi]
mov dword [ebp - 8], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x40ed6b
mov ax, word [ebp - 0x8a]
rol ax, 8
movzx esi, ax
jmp 0x40ed1d
mov esi, dword [edi]
call fcn.0041a2a8
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x41141d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebx + 0x180]
sub esp, 0x2c8
push esi
push edi
test eax, eax
je 0x411446
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4114e5
lea esi, [ebx + 0x17c]
call fcn.00418914
push 1
lea edi, [ebp - 0x2c8]
call fcn.00416570
xor edi, edi
push edi
lea eax, [ebp - 0xc0]
push eax
push 0x2937498d
call fcn.00416214
push 0x44
pop edx
push edx
push edi
lea eax, [ebp - 0x58]
push eax
call fcn.00416fb8
push dword [ebx + 0xc]
lea eax, [ebp - 0xc0]
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x50], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push edi
push 0x404600
lea eax, [ebp - 0x2c8]
push eax
call fcn.004187cc
test eax, eax
jne 0x4114b7
xor al, al
jmp 0x4114e7
push 0x10
lea eax, [ebp - 0x10]
push eax
push esi
call fcn.00416f41
push 0x3e8
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4114e5
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.00418914
jmp 0x4114b3
mov al, 1
pop edi
pop esi
leave
ret
Function at 0x41157f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
push dword [ebp + 8]
mov ebx, eax
call fcn.004119c7
movzx eax, ax
mov dword [ebp - 0xc], eax
test al, 1
jne 0x4116e8
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x4115df
push 2
lea eax, [ebx + 0x50]
push eax
push dword [ebp - 8]
lea eax, [ebx + 0x3c]
push eax
mov eax, dword [ebx + 0x4c]
lea ecx, [ebp - 0x88]
call fcn.0041b562
lea eax, [ebp - 0x88]
push eax
call fcn.0041a6e8
mov byte [ebp - 1], al
jmp 0x4115e3
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
mov esi, dword [sym.imp.KERNEL32.dll_ResetEvent]
je 0x411638
test byte [ebp - 0xc], 0x10
jne 0x411638
push dword [ebx + 0xc]
call esi
movzx eax, word [edi + 0xc]
movzx ecx, word [edi + 8]
shl eax, 0x10
or eax, ecx
movzx ecx, word [edi]
push eax
movzx eax, word [edi + 4]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebx + 8]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageW]
test eax, eax
je 0x411638
push 0x64
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4116e8
call fcn.0041141d
test al, al
je 0x4116a7
mov eax, dword [ebx + 0x10]
push 0x10
push edi
add eax, 0x114
push eax
call fcn.00416f41
push dword [ebx + 0xc]
call esi
push dword [ebp + 8]
push 0xfffffffffffffffc
push dword [ebx + 8]
push dword [ebx + 0x188]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
je 0x4116a7
push 0x3e8
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x411692
mov eax, dword [ebx + 0x10]
cmp byte [eax + 0x124], 1
jne 0x4116a7
mov al, byte [ebp - 1]
jmp 0x4116ea
push 0
lea esi, [ebx + 0x17c]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.00418914
mov eax, dword [ebp + 0xc]
test dword [eax + 0x24], 0x40000000
jne 0x4116e8
push edi
add eax, 4
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
push 6
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 0x154]
call dword [sym.imp.USER32.dll_FillRect]
push 0xf
push 0xa
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 0x154]
call dword [sym.imp.USER32.dll_DrawEdge]
mov al, 1
pop esi
pop ebx
leave
ret 8