joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4167b0
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa1c
mov eax, dword [0x42c6a0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xa1c], ecx
push str._shellopencommand
mov eax, dword [ebp + 8]
push eax
push 0x426f74
lea ecx, [ebp - 0x810]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x810]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x416879
cmp dword [ebp + 0xc], 0
je 0x41681f
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0xa18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x416833
push 0x104
lea eax, [ebp - 0xa18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.__NewDriver___1_
lea ecx, [ebp - 0xa18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0xa18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0xa18]
push ecx
push 1
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], 0
sete al
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041710f
mov esp, ebp
pop ebp
ret 8

Function at 0x4168a0
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x42c6a0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x818], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x818]
call fcn.00416ba0
test eax, eax
jne 0x4168d6
mov eax, 1
jmp 0x4169a7
mov dword [ebp - 0x814], 0x800
xor ecx, ecx
mov word [ebp - 0x810], cx
lea edx, [ebp - 0x814]
push edx
lea eax, [ebp - 0x810]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x818]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41691a
xor eax, eax
jmp 0x4169a7
push str.NoAssociate.MiniWinMount
lea ecx, [ebp - 0x810]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x416943
mov edx, dword [ebp + 8]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor eax, eax
jmp 0x4169a7
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4169a5
lea edx, [ebp - 0x810]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x810]
push ecx
push 1
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], 0
sete al
jmp 0x4169a7
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041710f
mov esp, ebp
pop ebp
ret 4
Function at 0x4169c0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x42c6a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80c], ecx
mov eax, dword [ebp + 8]
push eax
push 0x426fd8
push 0x426ff4
lea ecx, [ebp - 0x808]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x808]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041710f
mov esp, ebp
pop ebp
ret 4

Function at 0x416ba0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.00417f90
mov eax, dword [0x42c6a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1020], ecx
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x416bed
xor eax, eax
jmp 0x416c82
mov dword [ebp - 0x101c], 0x400
lea edx, [ebp - 0x101c]
push edx
lea eax, [ebp - 0x1018]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x416c2e
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x416c82
push str.MiniWinMount
push 0x427068
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 0x1018]
push edx
call fcn.004130f0
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x1018]
cmp eax, ecx
jne 0x416c75
mov dword [ebp - 8], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041710f
mov esp, ebp
pop ebp
ret 4

Function at 0x416e9f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x42d9d4], 0
push esi
jne 0x416e12
call fcn.00416d38
test eax, eax
je 0x416e55
mov eax, dword [0x42d9d4]
cmp eax, 1
jne 0x416e33
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x416e55
pop esi
ret
push eax
call dword [0x42d9dc]
test eax, eax
jne 0x416e9d
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x416e59
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x42d9d4]
call dword [0x42d9dc]
mov edi, eax
test edi, edi
je 0x416e7e
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x416e9a
mov edi, esi
add esi, 0xff0
push edi
push dword [0x42d9d4]
call dword [0x42d9d8]
add edi, 0x10
cmp edi, esi
jb 0x416e86
mov eax, edi
pop edi
pop esi
ret
jmp 0x416dff

Function at 0x41710f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c6a0]
jne 0x417119
repz ret
jmp fcn.00418740
Function at 0x420ba2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041b10f
and dword [ebp - 4], 0
cmp dword [0x42e518], 0
mov ebx, eax
jne 0x420c53
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x420d04
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x420d04
push eax
call fcn.0041b09d
mov dword [esp], 0x428a64
push edi
mov dword [0x42e518], eax
call esi
push eax
call fcn.0041b09d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42e51c], eax
call esi
push eax
call fcn.0041b09d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42e520], eax
call esi
push eax
call fcn.0041b09d
pop ecx
mov dword [0x42e528], eax
test eax, eax
je 0x420c53
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041b09d
pop ecx
mov dword [0x42e524], eax
mov eax, dword [0x42e524]
cmp eax, ebx
je 0x420cab
cmp dword [0x42e528], ebx
je 0x420cab
push eax
call fcn.0041b118
push dword [0x42e528]
mov esi, eax
call fcn.0041b118
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x420cab
test edi, edi
je 0x420cab
call esi
test eax, eax
je 0x420ca2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x420ca2
test byte [ebp - 0xc], 1
jne 0x420cab
or dword [ebp + 0x10], 0x200000
jmp 0x420ce4
mov eax, dword [0x42e51c]
cmp eax, ebx
je 0x420ce4
push eax
call fcn.0041b118
pop ecx
test eax, eax
je 0x420ce4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x420ce4
mov eax, dword [0x42e520]
cmp eax, ebx
je 0x420ce4
push eax
call fcn.0041b118
pop ecx
test eax, eax
je 0x420ce4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42e518]
call fcn.0041b118
pop ecx
test eax, eax
je 0x420d04
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x420d06
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402130
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x415d8c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40c
lea ecx, [esp]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 4]
mov dword [esp + 0x414], 0
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0xc]
push 0x400
push eax
push 0
mov byte [esp + 0x420], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::operator_1
push 0x5c
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::ReverseFind
lea edx, [esp + 8]
push eax
push edx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x418], 2
call fcn.0041529c
lea ecx, [esp + 8]
mov byte [esp + 0x414], 1
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 4]
push 0x421aa0
lea ecx, [esp + 0xc]
push eax
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 4]
mov byte [esp + 0x418], 3
call fcn.0041529c
lea ecx, [esp + 8]
mov byte [esp + 0x414], 1
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 4]
mov byte [esp + 0x414], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp]
mov dword [esp + 0x414], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x40c]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x418
ret
Function at 0x4055f0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x416308
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [0x424e20]
mov ecx, dword [0x424e1c]
push eax
push ecx
lea edx, [esp + 0xc]
push str._s__s
push edx
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x10
push eax
call esi
mov ecx, dword [0x424e18]
mov edx, dword [0x424e14]
push ecx
push edx
lea eax, [esp + 0xc]
push str._s__s
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x14]
add esp, 0x10
push ecx
call esi
mov edx, dword [0x424e28]
mov eax, dword [0x424e14]
push edx
push eax
lea ecx, [esp + 0xc]
push str._s__s
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x14]
add esp, 0x10
push edx
call esi
lea ecx, [esp + 4]
mov dword [esp + 0x10], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x406420
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x416480
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebp
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 0x101
mov word [esp + 0x54], ax
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0xc]
mov dword [esp + 0x70], 0
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [0x424e80]
lea ecx, [esp + 0x10]
push eax
push str.netsh_firewall_add_allowedprogram___sDuriNetpicaop.exe__picaop_ENABLE
push ecx
mov byte [esp + 0x7c], 1
call sub.MFC42.DLL_CString::Format
mov edx, dword [0x424e80]
add esp, 0xc
lea eax, [esp + 0xc]
push edx
push str.netsh_firewall_add_allowedprogram___sDuriNetPremiumLauncher.exe__PremiumLauncher_ENABLE
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x14]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
push edx
mov esi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0
push 0x30
push 1
push 0
push 0
push eax
push 0
call esi
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push ecx
call edi
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push edx
call ebp
lea eax, [esp + 0x14]
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x24]
push eax
push ecx
push 0
push 0
push 0x30
push 1
push 0
push 0
push edx
push 0
call esi
mov eax, dword [esp + 0x14]
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [esp + 0xc]
push 0
push ecx
call ebp
mov byte [esp + 0x70], 0
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x70], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x68]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x68
ret
Function at 0x4065c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4164c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString_1
push 0x422250
lea eax, [esp + 0x10]
push 0x424eb4
push eax
mov dword [esp + 0x38], 0
call sub.MFC42.DLL_operator
push 0x424df0
lea ecx, [esp + 0xc]
push eax
push ecx
mov byte [esp + 0x38], 1
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call fcn.0041529c
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.MSVCRT.dll_time]
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x68]
add esp, 4
mov dword [esi + 0x50c], eax
call fcn.00409660
mov ecx, dword [esi + 0x68]
push 5
call sub.MFC42.DLL_CWnd::ShowWindow
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x424df8
call sub.MFC42.DLL_CString::CString_2
push ecx
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x38], 3
call sub.MFC42.DLL_CString::CString_2
push ecx
mov byte [esp + 0x38], 4
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x424eb8
call sub.MFC42.DLL_CString::CString_2
push ecx
lea eax, [esi + 0x560]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
mov byte [esp + 0x40], 5
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x2e0]
mov byte [esp + 0x3c], 0
call fcn.00414a90
test eax, eax
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 4]
jge 0x4066f7
call sub.MFC42.DLL_CString::CString
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop esi
add esp, 0x2c
ret
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x2c
ret
Function at 0x40a710
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x417058
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor edx, edx
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], edx
push edx
rep stosd dword es:[edi], eax
push 2
mov dword [esp + 0x14c], edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x40a774
lea ecx, [esp + 0x14c]
mov dword [esp + 0x144], eax
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x40a827
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40a804
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
push ecx
lea edx, [esp + 0x150]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x20]
mov ecx, ebp
push eax
call fcn.0040a850
test eax, eax
je 0x40a7c9
mov ecx, dword [esp + 0x1c]
push ecx
push 0
push 0x1f0fff
call ebx
mov esi, eax
test esi, esi
jne 0x40a7da
lea edx, [esp + 0x14]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x40a804
jmp 0x40a791
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x40a7f3
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push str.process_exit_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
push esi
jmp 0x40a805
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14c]
mov dword [esp + 0x144], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x138
ret 4

Function at 0x40a850
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
push 0x417078
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push esi
push edi
mov ecx, 0x88
xor eax, eax
lea edi, [esp + 0xc]
mov dword [esp + 8], 0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x23c]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x40a920
lea ecx, [esp + 8]
mov dword [esp + 8], 0x224
push ecx
push esi
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x40a919
mov eax, dword [esp + 0x240]
mov edi, dword [sym.imp.MSVCRT.dll__mbscmp]
lea edx, [esp + 0x28]
push edx
push eax
call edi
add esp, 8
test eax, eax
je 0x40a8f4
lea ecx, [esp + 8]
push ecx
push esi
call sub.KERNEL32.dll_Module32Next
test eax, eax
je 0x40a919
mov eax, dword [esp + 0x240]
lea edx, [esp + 0x28]
push edx
push eax
call edi
add esp, 8
test eax, eax
jne 0x40a8cf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x240]
mov dword [esp + 0x234], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
jmp 0x40a939
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x240]
mov dword [esp + 0x234], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x230
ret 8
Function at 0x40b0e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x417180
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 2
push eax
call sub.WS2_32.dll_inet_addr
mov ecx, dword [esp + 0x2c]
mov ebp, eax
push ecx
call sub.WS2_32.dll_inet_addr
mov edx, dword [esp + 0x30]
mov ebx, eax
push edx
call sub.WS2_32.dll_inet_addr
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], eax
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esp + 0x24]
mov byte [esp + 0x1c], 3
test eax, eax
jbe 0x40b24d
mov eax, dword [esp + 0x28]
mov esi, dword [sym.imp.MSVCRT.dll__mbscmp]
push 0x424ad0
push eax
call esi
add esp, 8
test eax, eax
je 0x40b24d
mov ecx, dword [esp + 0x2c]
push 0x424ad0
push ecx
call esi
add esp, 8
test eax, eax
je 0x40b24d
mov edx, dword [esp + 0x30]
push 0x424ad0
push edx
call esi
add esp, 8
test eax, eax
je 0x40b24d
push 0x38
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x40b1b0
push eax
push eax
push 0x42340c
call sub.MFC42.DLL_AfxMessageBox_1
jmp 0x40b24d
mov edx, dword [esp + 0x34]
push edi
mov ecx, 0xe
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x10], eax
mov eax, 3
mov dword [esi], ebx
mov dword [esi + 4], ecx
mov dword [esi + 0xc], ebp
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], edx
call sub.iphlpapi.dll_CreateIpForwardEntry
test eax, eax
pop edi
jne 0x40b240
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14
push esi
cmp eax, 0x57
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14
Function at 0x40b560
Capabilities:
Get routing table

Disassembly:
push 0xffffffffffffffff
push 0x4171f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x34]
xor esi, esi
xor ebx, ebx
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
call sub.WS2_32.dll_inet_addr
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x30]
test eax, eax
jbe 0x40b6f0
mov ecx, dword [esp + 0x34]
push 0x424ad0
push ecx
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
je 0x40b6f0
lea edx, [esp + 0x10]
push ebx
push edx
push ebx
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, 0x7a
jne 0x40b5f8
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
je 0x40b6f0
lea ecx, [esp + 0x10]
push ebx
push ecx
push eax
call sub.iphlpapi.dll_GetIpForwardTable
mov esi, dword [esp + 0x14]
test eax, eax
je 0x40b60a
test esi, esi
je 0x40b6f0
push esi
jmp 0x40b6e7
mov eax, dword [esi]
mov dword [esp + 0x18], 0
test eax, eax
jbe 0x40b66d
lea ebp, [esi + 4]
cmp dword [ebp], 0
jne 0x40b657
test ebx, ebx
jne 0x40b649
push 0x38
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40b6f0
mov ecx, 0xe
mov esi, ebp
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x14]
push ebp
call sub.iphlpapi.dll_DeleteIpForwardEntry
test eax, eax
jne 0x40b6f0
mov eax, dword [esp + 0x18]
mov ecx, dword [esi]
inc eax
add ebp, 0x38
cmp eax, ecx
mov dword [esp + 0x18], eax
jb 0x40b61b
test ebx, ebx
jne 0x40b67a
push 0x38
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov ebx, eax
mov edx, dword [esp + 0x30]
mov ecx, 0xe
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x1c]
push ebx
mov dword [ebx + 0xc], eax
mov eax, 3
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x24], 1
call sub.iphlpapi.dll_SetIpForwardEntry
test eax, eax
jne 0x40b6d7
test ebx, ebx
je 0x40b6c2
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x40b704
cmp eax, 0x57
jne 0x40b6e2
test ebx, ebx
je 0x40b6f0
jmp 0x40b6e6
test ebx, ebx
je 0x40b6f0
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
or eax, 0xffffffff
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8