joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a027
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
xor ebx, ebx
push 0x40420c
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x40a10b
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
push 0x404218
push eax
call esi
push 0x404230
push dword [ebp - 0x10]
mov edi, eax
call esi
mov dword [ebp - 0x14], eax
cmp edi, ebx
je 0x40a100
cmp eax, ebx
je 0x40a100
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], ebx
call edi
test eax, eax
jne 0x40a08c
mov dword [ebp - 0xc], ebx
push 0x44
pop edx
xor eax, eax
push edx
mov word [ebp - 8], ax
push ebx
lea eax, [ebp - 0x68]
push eax
call fcn.004087d0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x60], ebx
cmp ecx, ebx
jne 0x40a0b0
lea ecx, [ebp - 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0xc]
push ebx
push eax
neg eax
sbb eax, eax
and eax, 0x400
or eax, 0x4000000
push eax
push ebx
push ebx
push ebx
push ecx
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x40a0f5
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x24]
call esi
cmp dword [ebp - 0x1c], ebx
setne byte [ebp - 1]
cmp dword [ebp - 0xc], ebx
je 0x40a100
push dword [ebp - 0xc]
call dword [ebp - 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
movzx eax, byte [ebp - 1]
pop ebx
leave
ret 8

Function at 0x40a13a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40a164
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x10]
jmp 0x40a166
xor eax, eax
pop ebp
ret 0xc
Function at 0x40a1c5
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x56c
lea eax, [ebp - 0x24c]
push eax
push 0x40426c
call fcn.0040dc66
test al, al
je 0x40a2d3
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.USER32.dll_CharToOemW]
lea eax, [ebp - 0x350]
push eax
push dword [ebp + 8]
lea eax, [ebp + 8]
push 0x404274
push eax
call fcn.004094b9
add esp, 0x10
cmp eax, 0xffffffff
je 0x40a2c7
push ebx
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x24c]
push eax
call fcn.0040da9a
push dword [ebp + 8]
mov bl, al
call fcn.0040871d
test bl, bl
pop ebx
je 0x40a2c7
push edi
lea eax, [ebp - 0x24c]
push eax
push 0x404294
mov edx, 0x10e
lea edi, [ebp - 0x56c]
call fcn.0040942b
pop ecx
pop ecx
pop edi
cmp eax, 0xffffffff
jle 0x40a2c7
push 0x104
lea eax, [ebp - 0x24c]
push eax
push 0x4042a4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x102
ja 0x40a2c7
push 0x44
pop edx
push edx
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.004087d0
xor eax, eax
push eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x44]
push eax
push 0
lea eax, [ebp - 0x56c]
push eax
lea eax, [ebp - 0x24c]
push eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x18], 1
call fcn.00409fcc
test eax, eax
setne al
jmp 0x40a2d5
lea eax, [ebp - 0x24c]
push eax
call fcn.0040dc45
xor al, al
leave
ret 4

Function at 0x40a2d9
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x570
lea eax, [ebp - 0x250]
push eax
push 0x40426c
call fcn.0040dc66
test al, al
je 0x40a3f1
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.USER32.dll_CharToOemW]
lea eax, [ebp - 0x354]
push eax
push 0x403ff0
lea eax, [ebp - 4]
push 0x404274
push eax
call fcn.004094b9
add esp, 0x10
cmp eax, 0xffffffff
je 0x40a3e5
push ebx
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x250]
push eax
call fcn.0040da9a
push dword [ebp - 4]
mov bl, al
call fcn.0040871d
test bl, bl
pop ebx
je 0x40a3e5
push edi
lea eax, [ebp - 0x250]
push eax
push 0x404294
mov edx, 0x10e
lea edi, [ebp - 0x570]
call fcn.0040942b
pop ecx
pop ecx
pop edi
cmp eax, 0xffffffff
jle 0x40a3e5
push 0x104
lea eax, [ebp - 0x250]
push eax
push 0x4042a4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x102
ja 0x40a3e5
push 0x44
pop edx
push edx
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.004087d0
push 5
pop eax
mov word [ebp - 0x18], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
push 0
lea eax, [ebp - 0x48]
push eax
push 0
lea eax, [ebp - 0x570]
push eax
lea eax, [ebp - 0x250]
push eax
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x1c], 1
call fcn.00409fcc
test eax, eax
setne al
jmp 0x40a3f3
lea eax, [ebp - 0x250]
push eax
call fcn.0040dc45
xor al, al
leave
ret 4
Function at 0x40a3f7
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebx
push edi
xor edi, edi
cmp ecx, edi
jne 0x40a404
mov ecx, 0x4042b4
push edi
push edi
not eax
push edi
and eax, 1
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
cmp ebx, edi
je 0x40a45c
push esi
xor esi, esi
push 4
lea eax, [esi + 0x4233a4]
push eax
push dword [esi + 0x4233a0]
push ebx
call dword [sym.imp.WININET.dll_InternetSetOptionA]
add esi, 8
cmp esi, 0x18
jb 0x40a41d
push edi
push edi
push 3
push edi
push edi
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebx
call dword [sym.imp.WININET.dll_InternetConnectA]
pop esi
cmp eax, edi
jne 0x40a45e
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor eax, eax
pop edi
pop ebx
ret 8

Function at 0x40a50b
Capabilities:
Check http status code
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x1c]
and edi, 2
mov eax, 0x8404f700
je 0x40a522
mov eax, 0x8444f700
test byte [ebp + 0x1c], 4
je 0x40a52d
or eax, 0x800000
test byte [ebp + 0x1c], 1
mov ecx, 0x401608
jne 0x40a53d
mov ecx, 0x401610
push 0
push eax
push 0x423398
push dword [ebp + 0x10]
push 0x4042ec
push dword [ebp + 0xc]
push ecx
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
je 0x40a5e9
push dword [ebp + 0x20]
or eax, 0xffffffff
call fcn.00408b78
test edi, edi
je 0x40a57a
mov ecx, dword [ebp + 0x20]
mov edi, eax
jmp 0x40a592
mov dword [ebp + 0x1c], eax
push 0x4042f8
or eax, 0xffffffff
lea ecx, [ebp + 0x1c]
call fcn.00408bb1
mov edi, dword [ebp + 0x1c]
mov ecx, edi
call fcn.00409256
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push edi
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x40a5dc
and dword [ebp + 0x1c], 0
push 0
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x1c]
push eax
push 0x20000013
push esi
mov dword [ebp + 0x20], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x40a5dc
cmp dword [ebp + 0x1c], 0xc8
jne 0x40a5dc
mov eax, esi
jmp 0x40a5eb
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call fcn.0040871d
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x1c
Function at 0x40a5f1
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor edi, edi
mov eax, 0xa00000
cmp ebx, edi
je 0x40a60a
cmp ebx, eax
jbe 0x40a60c
mov ebx, eax
mov dword [ebp - 8], edi
cmp dword [ebp + 0x10], 0
je 0x40a627
push 0
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40a668
lea eax, [edi + 0x5000]
lea esi, [ebp - 8]
mov dword [ebp - 4], 0x5000
call fcn.00408698
test al, al
je 0x40a668
mov esi, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [esi + edi]
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40a668
cmp dword [ebp - 4], 0
je 0x40a679
add edi, dword [ebp - 4]
cmp edi, ebx
jbe 0x40a60f
push dword [ebp - 8]
call fcn.0040871d
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0xc
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40a687
mov dword [eax], esi
mov dword [eax + 4], edi
jmp 0x40a68d
push esi
call fcn.0040871d
mov al, 1
jmp 0x40a672

Function at 0x40a691
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 0xc]
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40a75c
mov eax, 0x1000
call fcn.004086ed
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x40a748
mov dword [ebp - 0xc], ebx
cmp dword [ebp + 0x14], ebx
je 0x40a6ec
push ebx
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40a740
lea eax, [ebp - 8]
push eax
push 0x1000
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40a740
cmp dword [ebp - 8], ebx
je 0x40a735
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40a740
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x14]
jne 0x40a740
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jbe 0x40a6d6
jmp 0x40a740
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov byte [ebp - 1], 1
push dword [ebp - 0x10]
call fcn.0040871d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 1], bl
jne 0x40a75c
push dword [ebp + 0xc]
call fcn.0040dc45
mov al, byte [ebp - 1]
pop edi
pop ebx
leave
ret 0x10
Function at 0x40aa91
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [eax]
sub edx, dword [ebp + 8]
xor ecx, ecx
sub esp, 0xc
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], ecx
cmp dword [ebp + 8], ecx
jbe 0x40ab24
mov edx, dword [eax + 0x4c]
mov dword [ebp - 4], edx
mov edx, dword [eax + 0x58]
push ebx
push esi
mov esi, dword [eax + 0x54]
mov dword [ebp - 8], edx
mov edx, dword [eax + 0x5c]
push edi
mov edi, dword [eax + 0x50]
mov dword [ebp - 0xc], edx
mov edx, dword [eax + 0x48]
sub edi, esi
movzx ebx, byte [edx + ecx]
movzx eax, byte [edx + ecx + 1]
shl ebx, 5
xor eax, ebx
movzx ebx, byte [edx + ecx + 2]
dec dword [ebp + 8]
shl eax, 5
xor eax, ebx
mov ebx, dword [ebp - 4]
imul eax, eax, 0x9f5f
shr eax, 5
and eax, 0xffff
mov ebx, dword [ebx + eax*4]
mov dword [edi + esi], ebx
mov ebx, dword [ebp - 4]
mov dword [ebx + eax*4], ecx
mov ebx, dword [ebp - 8]
mov dword [esi], 0x801
inc dword [ebx + eax*4]
movzx eax, word [edx + ecx]
mov ebx, dword [ebp - 0xc]
mov dword [ebx + eax*4], ecx
inc ecx
add esi, 4
cmp dword [ebp + 8], 0
ja 0x40aac9
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40af54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jbe 0x40afd5
push ebx
push esi
mov esi, dword [edi + 0x34]
mov edx, edi
call fcn.0040ad85
mov ecx, dword [edi + 0x30]
mov eax, dword [edi + 0x48]
lea edx, [ecx + eax]
movzx eax, byte [edx]
movzx esi, byte [edx + 1]
shl eax, 5
xor eax, esi
movzx esi, byte [edx + 2]
mov ebx, dword [edi + 0x50]
shl eax, 5
xor eax, esi
mov esi, dword [edi + 0x4c]
imul eax, eax, 0x9f5f
shr eax, 5
and eax, 0xffff
shl eax, 2
add esi, eax
mov dword [ebp - 4], esi
mov esi, dword [esi]
mov dword [ebx + ecx*4], esi
mov esi, dword [ebp - 4]
mov dword [esi], ecx
mov esi, dword [edi + 0x54]
mov dword [esi + ecx*4], 0x801
mov esi, dword [edi + 0x58]
inc dword [eax + esi]
movzx eax, word [edx]
mov edx, dword [edi + 0x5c]
mov dword [edx + eax*4], ecx
mov eax, edi
call fcn.0040aee8
dec dword [ebp + 8]
jne 0x40af60
pop esi
pop ebx
leave
ret 4

Function at 0x40b794
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
cmp ecx, 0xffffffff
je 0x40b7ba
xor edx, edx
mov eax, ecx
mov esi, 0x3e8
div esi
imul edx, edx, 0x3e8
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
inc ecx
neg ecx
sbb ecx, ecx
lea eax, [ebp - 8]
and ecx, eax
push ecx
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x10c]
push eax
push esi
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x108], ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 1
je 0x40b7f1
or eax, 0xffffffff
jmp 0x40b7ff
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [sym.imp.WS2_32.dll_recv]
pop esi
leave
ret 8
Function at 0x40b804
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov ebx, ecx
cmp dword [ebp + 0xc], 0
jbe 0x40b821
mov ecx, dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0040b794
jmp 0x40b82e
push 0
push esi
push dword [ebp + 8]
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x40b848
add dword [ebp + 8], eax
sub esi, eax
test esi, esi
jg 0x40b80d
xor eax, eax
test esi, esi
sete al
pop esi
pop ebx
pop ebp
ret 8
xor al, al
jmp 0x40b842

Function at 0x40b87b
Capabilities:
Send data
Send data on socket

Disassembly:
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, dword [esp + 0xc]
sete al
ret 0xc

Function at 0x40b899
Capabilities:
Connect socket

Disassembly:
movzx eax, word [edi]
push esi
push 6
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x40b8d6
xor eax, eax
cmp word [edi], 2
setne al
dec eax
and eax, 0xfffffff4
add eax, 0x1c
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x40b8d6
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or esi, 0xffffffff
mov eax, esi
pop esi
ret

Function at 0x40b8da
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
rol ax, 8
movzx ebx, ax
xor edi, edi
lea eax, [ebp + 8]
push eax
push edi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x40b90b
or eax, 0xffffffff
jmp 0x40b98d
push esi
mov esi, dword [ebp + 8]
jmp 0x40b93f
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x40b929
push dword [esi + 0x10]
push dword [esi + 0x18]
call fcn.00408770
mov dword [ebp - 4], eax
jmp 0x40b93c
cmp eax, 0x17
jne 0x40b93c
push dword [esi + 0x10]
push dword [esi + 0x18]
call fcn.00408770
mov dword [ebp - 8], eax
mov esi, dword [esi + 0x1c]
cmp esi, edi
jne 0x40b911
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, dword [ebp - 4]
or esi, 0xffffffff
cmp eax, edi
je 0x40b963
mov edi, eax
mov word [eax + 2], bx
call fcn.0040b899
mov esi, eax
mov edi, dword [ebp - 8]
test edi, edi
je 0x40b97a
cmp esi, 0xffffffff
jne 0x40b97a
mov word [edi + 2], bx
call fcn.0040b899
mov esi, eax
push dword [ebp - 4]
call fcn.0040871d
push dword [ebp - 8]
call fcn.0040871d
mov eax, esi
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x40ba4d
Capabilities:
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x510
push esi
push edi
mov edi, dword [sym.imp.WS2_32.dll_select]
xor esi, esi
jmp 0x40bac9
mov dword [ebp + 0x70], esi
cmp dword [ebp - 0x9c], esi
jbe 0x40bac9
mov eax, dword [ebp + 0x70]
mov eax, dword [ebp + eax*4 - 0x98]
cmp eax, ebx
jne 0x40ba85
mov ecx, dword [ebp + 0x7c]
mov dword [ebp + 0x6c], ecx
jmp 0x40ba88
mov dword [ebp + 0x6c], ebx
push esi
push 0x400
lea ecx, [ebp - 0x49c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp + 0x68], eax
cmp eax, 1
jl 0x40baf8
push esi
push eax
lea eax, [ebp - 0x49c]
push eax
push dword [ebp + 0x6c]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, dword [ebp + 0x68]
jne 0x40baf8
inc dword [ebp + 0x70]
mov eax, dword [ebp + 0x70]
cmp eax, dword [ebp - 0x9c]
jb 0x40ba6f
mov eax, dword [ebp + 0x7c]
push esi
push esi
mov dword [ebp - 0x94], eax
push esi
lea eax, [ebp - 0x9c]
push eax
push esi
mov dword [ebp - 0x9c], 2
mov dword [ebp - 0x98], ebx
call edi
cmp eax, 1
jge 0x40ba64
pop edi
pop esi
add ebp, 0x74
leave
ret 4

Function at 0x40bb01
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, eax
mov eax, dword [ebp + 0xc]
lea ecx, [esi + 1]
cmp ecx, 0x40
jae 0x40bb95
test eax, eax
je 0x40bb38
xor edx, edx
mov ebx, 0x3e8
div ebx
mov ebx, dword [ebp + 8]
imul edx, edx, 0x3e8
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 4
push ebx
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x10c], ecx
call fcn.00408759
test esi, esi
je 0x40bb66
mov eax, esi
shl eax, 2
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push eax
call fcn.00408759
xor eax, eax
cmp eax, dword [ebp + 0xc]
lea ecx, [ebp - 8]
sbb eax, eax
and eax, ecx
push eax
push 0
push 0
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x40bb9e
push 0x274c
call dword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
pop esi
pop ebx
leave
ret 0xc
cmp eax, 0xffffffff
je 0x40bb95
xor esi, esi
push dword [ebx + esi*4]
lea eax, [ebp - 0x10c]
call fcn.0040b76e
test al, al
jne 0x40bbbf
inc esi
cmp esi, 1
jb 0x40bba5
jmp 0x40bb95
mov eax, dword [ebx + esi*4]
jmp 0x40bb98

Function at 0x40bc71
Capabilities:
Create udp socket

Disassembly:
movzx eax, word [esi]
push edi
push 0x11
push 2
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x40bcae
xor eax, eax
cmp word [esi], 2
setne al
dec eax
and eax, 0xfffffff4
add eax, 0x1c
push eax
push esi
push edi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x40bcae
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
or edi, 0xffffffff
mov eax, edi
pop edi
ret
Function at 0x40c633
Capabilities:
Get common file path

Disassembly:
push edi
xor edi, edi
call fcn.0040c554
test al, al
je 0x40c724
push esi
mov eax, 0x950
call fcn.004086ed
mov esi, eax
test esi, esi
je 0x40c71e
push dword [esp + 0xc]
lea eax, [esi + 0x53e]
push eax
xor eax, eax
call fcn.0040e174
test al, al
je 0x40c718
lea eax, [esi + 0x746]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
setne al
test al, al
je 0x40c718
mov ecx, 0x7fffffff
mov dword [esi + 0x14], ecx
lea eax, [esi + 0x10]
mov dword [eax], ecx
xor ecx, ecx
inc ecx
push 0xc
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], ecx
push 0x4043dc
lea ecx, [esi + 0x132]
push ecx
call fcn.00408759
push 2
push 0x4043c8
lea ecx, [esi + 0x232]
push ecx
call fcn.00408759
push esi
push eax
push 0x40c442
push 0x40c40a
push 0x40c3be
push fcn.0040c395
push 0x40c34d
push 0x40c315
push fcn.0040c2e0
push fcn.0040c154
push fcn.0040c141
lea eax, [esi + 4]
push 0x40c4bf
push eax
call dword [0x423a7c]
add esp, 0x34
mov dword [esi], eax
test eax, eax
je 0x40c718
mov edi, esi
jmp 0x40c723
push esi
call fcn.0040871d
call fcn.0040c612
pop esi
mov eax, edi
pop edi
ret 4

Function at 0x40c92a
Capabilities:
Create thread

Disassembly:
cmp byte [esi], 0x40
jb 0x40c93e
push 0x9b
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x40c96c
cmp dword [esp + 8], 0
je 0x40c96a
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [esp + 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40c93a
movzx ecx, byte [esi]
mov dword [esi + ecx*4 + 4], eax
inc byte [esi]
mov al, 1
ret 0xc

Function at 0x40c992
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
lea ecx, [ebp - 4]
push ecx
push 1
push 0
push dword [ebp + 8]
mov dword [ebp - 4], eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c9cb
mov eax, dword [ebp + 0x10]
add eax, eax
push eax
push edi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
lea esi, [ebp - 4]
call fcn.0040ca9b
mov ebx, eax
jmp 0x40c9ce
or ebx, 0xffffffff
cmp ebx, 0xffffffff
je 0x40ca3f
test bl, 1
jne 0x40ca3f
cmp dword [ebp + 8], 1
je 0x40c9e4
cmp dword [ebp + 8], 2
jne 0x40ca3f
test ebx, ebx
jne 0x40c9ef
xor eax, eax
mov word [edi], ax
jmp 0x40ca3b
shr ebx, 1
lea eax, [ebx - 1]
cmp word [edi + eax*2], 0
jne 0x40c9fe
dec ebx
jmp 0x40ca0c
inc eax
cmp dword [ebp + 0x10], eax
jbe 0x40ca3f
xor ecx, ecx
mov word [edi + eax*2], cx
mov ebx, eax
cmp eax, 2
jbe 0x40ca3b
cmp dword [ebp + 8], 2
jne 0x40ca3b
push edi
call fcn.00408ad6
mov esi, eax
test esi, esi
je 0x40ca32
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x40ca35
or ebx, 0xffffffff
push esi
call fcn.0040871d
mov eax, ebx
jmp 0x40ca42
or eax, 0xffffffff
pop esi
pop ebx
leave
ret 0xc
Function at 0x40cace
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push ebx
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0x1c]
mov eax, 0x80000001
push 2
push ebx
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40cb1d
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40cb14
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret 0x18

Function at 0x40cb24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x18]
or dword [ebp - 4], 0xffffffff
push edi
xor edi, edi
mov dword [eax], edi
lea eax, [ebp + 8]
push eax
push 1
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40cbb8
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp + 0xc], edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40cbae
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x40cb76
mov dword [ebp - 4], edi
jmp 0x40cbae
push ebx
add eax, 4
call fcn.004086ed
mov ebx, eax
cmp ebx, edi
je 0x40cbad
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x40cba7
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
jmp 0x40cbad
push ebx
call fcn.0040871d
pop ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, dword [ebp - 4]
pop edi
leave
ret 0x14