joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e10
Capabilities:
Get mac address on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
lea edx, [esp]
mov dword [esp + 4], 0
mov byte [eax], 0
push edx
mov dword [esp + 4], 0
mov byte [ecx], 0
call fcn.00401d40
add esp, 4
test eax, eax
jne 0x401e46
mov dword [esp], eax
mov eax, dword [esp]
push ebx
push ebp
push esi
push edi
push eax
call sub.WS2_32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x14]
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x28]
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.iphlpapi.dll_GetAdaptersInfo
mov ecx, dword [esp + 0x14]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea edx, [esp + 0x14]
mov ebx, eax
push edx
push ebx
mov dword [esp + 0x30], ebx
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x401ef6
test ebx, ebx
je 0x401ef6
lea esi, [ebx + 0x1ac]
test esi, esi
je 0x401eec
mov cl, byte [esi + 4]
lea eax, [esi + 4]
test cl, cl
je 0x401eec
push eax
call sub.WS2_32.dll_inet_addr
mov edi, eax
lea eax, [esi + 0x14]
push eax
call sub.WS2_32.dll_inet_addr
test edi, edi
mov ebp, eax
je 0x401eec
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401f05
mov ecx, ebp
mov edx, ebp
and ecx, edi
and edx, eax
cmp ecx, edx
je 0x401f05
mov esi, dword [esi]
test esi, esi
jne 0x401eb1
mov ebx, dword [ebx]
test ebx, ebx
jne 0x401ea7
mov ebx, dword [esp + 0x28]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push edi
call sub.WS2_32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.WS2_32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [ebx + 0x199]
mov dl, byte [ebx + 0x197]
xor ecx, ecx
mov esi, dword [esp + 0x24]
mov cl, byte [ebx + 0x198]
push eax
push ecx
xor eax, eax
mov al, byte [ebx + 0x196]
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [ebx + 0x195]
mov dl, byte [ebx + 0x194]
push eax
push ecx
push edx
push str._02x__02x__02x__02x__02x__02x
push esi
call fcn.0040682e
push esi
call fcn.00401dc0
mov eax, dword [esp + 0x4c]
add esp, 0x24
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4023b0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1f0
xor eax, eax
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 0x18
lea edi, [esp + 0x10]
xor ebp, ebp
rep stosd dword es:[edi], eax
mov edi, 0x438600
or ecx, 0xffffffff
mov dword [ebx + 0x44], ebp
mov dword [ebx + 0x40], 1
mov dword [ebx + 0x4c], 5
mov dword [ebx + 0x50], ebp
mov dword [ebx + 0x54], ebp
lea edx, [ebx + 0xd8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebx + 0x15c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x438600
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 0x17c], ebp
call fcn.00406210
lea ecx, [esp + 0x70]
push ecx
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x40245b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f0
ret
call fcn.004021a0
call fcn.004014f0
mov dword [ebx + 0x38], ebp
call fcn.004028c0
call fcn.00404da0
test eax, eax
je 0x40247f
call fcn.00404da0
test eax, eax
jne 0x402476
lea edx, [esp + 0x10]
mov ecx, ebx
push edx
call fcn.004055e0
test eax, eax
je 0x4024c1
push 0xffffffffffffffff
mov ecx, 0x4385f8
call fcn.00405120
lea eax, [esp + 0x10]
mov ecx, ebx
push eax
call fcn.004025a0
mov ecx, 0x4385f8
call fcn.00405140
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.004055e0
test eax, eax
jne 0x40248f
mov ecx, ebx
call fcn.00402500
push 0xffffffffffffffff
mov ecx, 0x4385f8
call fcn.00405120
call fcn.00403a20
call fcn.004038f0
mov ecx, 0x4385f8
call fcn.00405140
push 0x32
call fcn.00404a20
add esp, 4
jmp 0x40246d
Function at 0x403500
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
lea eax, [esp + 0x28]
push edi
push eax
mov ecx, 0x438648
call fcn.004048c0
mov ecx, dword [0x43864c]
mov dword [esp + 0x10], eax
cmp eax, ecx
je 0x403535
mov edx, dword [esp + 0x2c]
mov esi, dword [eax + 0xc]
cmp edx, esi
jb 0x403535
lea eax, [esp + 0x10]
jmp 0x40353d
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x18]
mov eax, dword [eax]
cmp eax, ecx
je 0x403609
mov ebp, dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [esp + 0x34]
lea edx, [ebp + 0xc]
mov dword [ebp + 0x118], eax
mov dword [ebp + 8], 1
mov eax, edx
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x40358a
test cl, cl
je 0x403586
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x40358a
add eax, 2
add esi, 2
test cl, cl
jne 0x403566
xor eax, eax
jmp 0x40358f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4035ec
mov edi, dword [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [ebp + 0x8c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x38]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00403b50
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x38]
test eax, eax
je 0x4036b8
push ebp
call fcn.00403b50
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push 0x11c
call fcn.004072c6
mov edi, dword [esp + 0x38]
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
lea edx, [ebx + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebx + 0x8c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x30]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x2c]
mov dword [ebx + 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x118], eax
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, 0x438648
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0
call fcn.00404350
mov edx, eax
push ebx
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [eax + 0x10], ebx
mov dword [esp + 0x28], ecx
mov dword [ebx + 8], 1
call fcn.00403b50
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4036c0
Capabilities:
Get process image filename

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40e4ab
push eax
mov dword fs:[0], esp
sub esp, 0x634
push ebx
push esi
mov esi, dword [esp + 0x64c]
push edi
test esi, esi
je 0x403891
cmp esi, 4
jne 0x403745
mov edi, str.system
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x658]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x438600
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x654]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x403891
mov ecx, 0x88
xor eax, eax
lea edi, [esp + 0x20]
push esi
rep stosd dword es:[edi], eax
push 0x18
mov dword [esp + 0x24], 0x224
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x4037a0
lea eax, [esp + 0x1c]
push eax
push edi
call sub.KERNEL32.dll_Module32First
mov ecx, dword [esp + 0x658]
mov edx, dword [esp + 0x654]
push ecx
lea eax, [esp + 0x140]
push edx
push eax
call fcn.00401280
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403891
push esi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x403878
lea ecx, [esp + 0x240]
push 0x104
push ecx
push ebx
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
je 0x40386f
lea edx, [esp + 0x240]
lea eax, [esp + 0xc]
push edx
push eax
call fcn.004012e0
add esp, 8
mov edi, dword [esp + 0x10]
mov dword [esp + 0x648], 0
test edi, edi
jne 0x403800
mov edi, 0x40f1fc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x440]
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x654]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x440]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x658]
push ecx
push edx
push eax
call fcn.00401280
mov ecx, dword [esp + 0x1c]
add esp, 0xc
test ecx, ecx
je 0x40386f
mov al, byte [ecx - 1]
test al, al
je 0x403865
cmp al, 0xff
je 0x403865
dec al
push ebx
mov byte [ecx - 1], al
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403891
dec ecx
push ecx
call fcn.00406280
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403891
mov ecx, dword [esp + 0x654]
mov edx, dword [esp + 0x658]
push ecx
push edx
push esi
call fcn.00401610
add esp, 0xc
mov ecx, dword [esp + 0x640]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x640
ret
Function at 0x4038f0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x228
push ebp
push edi
xor eax, eax
mov ecx, 0x49
lea edi, [esp + 0x10c]
push eax
rep stosd dword es:[edi], eax
push 2
mov dword [esp + 0x110], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
je 0x403a09
lea eax, [esp + 0x108]
push eax
push ebp
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x403a02
push ebx
push esi
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x90]
lea edx, [esp + 0x90]
rep stosd dword es:[edi], eax
mov ecx, 0x20
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x118]
lea ecx, [esp + 0x10]
push ecx
push edx
push eax
call fcn.004038b0
add esp, 0xc
test eax, eax
jne 0x4039ea
mov esi, 0x438600
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4039ab
test cl, cl
je 0x4039a7
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4039ab
add eax, 2
add esi, 2
test cl, cl
jne 0x403983
xor eax, eax
jmp 0x4039b0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4039ea
lea eax, [esp + 0x10]
push eax
call fcn.00401260
lea ecx, [esp + 0x94]
push ecx
call fcn.00401260
mov ecx, dword [esp + 0x120]
lea edx, [esp + 0x18]
push 1
lea eax, [esp + 0x9c]
push edx
push eax
push ecx
call fcn.00403500
add esp, 0x18
lea edx, [esp + 0x110]
push edx
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40393e
pop esi
pop ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
add esp, 0x228
ret

Function at 0x404a40
Capabilities:
Create thread
Initialize winsock library

Disassembly:
sub esp, 0x194
lea eax, [esp + 4]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x404b2b
push ebx
push esi
push edi
mov edi, str.bv_server
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4384d0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x1a8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x438510
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x438600
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x404ad9
test cl, cl
je 0x404ad5
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x404ad9
add eax, 2
add esi, 2
test cl, cl
jne 0x404ab1
xor eax, eax
jmp 0x404ade
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x404b05
mov edi, str.3.3.3.3
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x438510
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0x404a30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebx
add esp, 0x194
ret 8
Function at 0x404cf0
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0xc], 1
call sub.WS2_32.dll_ioctlsocket
pop ecx
ret

Function at 0x404d10
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
mov eax, dword [0x41c250]
sub esp, 8
cmp eax, 0xffffffff
je 0x404d2d
push eax
call sub.WS2_32.dll_closesocket
mov dword [0x41c250], 0xffffffff
push esi
push 0
push 2
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x404d47
or eax, eax
pop esi
add esp, 8
ret
mov eax, 0x100000
push 4
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
push 0x1002
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
lea ecx, [esp + 8]
push 4
push ecx
push 0x1001
push 0xffff
push esi
call sub.WS2_32.dll_setsockopt
push esi
call fcn.00404cf0
add esp, 4
mov dword [0x41c250], esi
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x404da0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x74
mov eax, dword [0x41c24c]
mov dword [esp], 0x10
cmp eax, 0xffffffff
je 0x404dce
lea ecx, [esp]
lea edx, [esp + 4]
push ecx
push edx
push 0
push 0x10000
push 0x438664
push eax
jmp 0x404deb
mov edx, dword [0x41c250]
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push ecx
push 0
push 0x10000
push 0x438664
push edx
call sub.WS2_32.dll_recvfrom
mov edx, eax
cmp edx, 0x50
jge 0x404dfd
xor eax, eax
add esp, 0x74
ret
push esi
push edi
mov ecx, 0x18
xor eax, eax
lea edi, [esp + 0x1c]
mov esi, 0x438668
rep stosd dword es:[edi], eax
mov eax, dword [0x4386a8]
mov ecx, 8
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, 8
mov esi, 0x438688
lea edi, [esp + 0x3c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4386ac]
mov dword [esp + 0x5c], eax
mov eax, dword [0x4386b0]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0xe]
mov dword [esp + 0x64], eax
lea eax, [edx - 0x50]
mov edx, dword [esp + 0x10]
and ecx, 0xffff
mov dword [esp + 0x74], eax
test eax, eax
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], edx
mov dword [esp + 0x68], 1
jbe 0x404e97
push eax
call fcn.004072c6
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x7c], eax
mov edi, eax
mov eax, ecx
mov esi, 0x4386b4
add esp, 4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call fcn.00404cc0
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x74
ret
Function at 0x404fa0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov eax, dword [ebx + 0x58]
add eax, 0x50
push eax
call fcn.004072c6
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x404fc4
pop ebp
pop ebx
add esp, 0x10
ret
mov ecx, dword [ebx + 0x58]
push esi
add ecx, 0x50
push edi
mov dword [ebp], ecx
lea edi, [ebp + 4]
mov ecx, 8
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0x20]
lea edi, [ebp + 0x24]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebx + 0x40]
mov dword [ebp + 0x44], edx
mov eax, dword [ebx + 0x44]
mov dword [ebp + 0x48], eax
mov ecx, dword [ebx + 0x48]
mov dword [ebp + 0x4c], ecx
mov esi, dword [ebx + 0x5c]
test esi, esi
je 0x405019
mov ecx, dword [ebx + 0x58]
test ecx, ecx
je 0x405019
mov edx, ecx
lea edi, [ebp + 0x50]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov ecx, dword [ebx + 0x54]
mov dword [esp + 0x10], eax
mov dx, word [ebx + 0x50]
mov dword [esp + 0x14], eax
pop edi
mov dword [esp + 0x14], eax
pop esi
mov dword [esp + 0x14], eax
mov eax, dword [0x41c24c]
cmp eax, 0xffffffff
mov word [esp + 8], 2
mov dword [esp + 0xc], ecx
mov word [esp + 0xa], dx
push 0x10
je 0x405079
mov edx, dword [ebx + 0x58]
lea ecx, [esp + 0xc]
push ecx
add edx, 0x50
push 0
push edx
push ebp
push eax
call sub.WS2_32.dll_sendto
push ebp
call fcn.00406280
add esp, 4
mov eax, 1
pop ebp
pop ebx
add esp, 0x10
ret
mov ecx, dword [ebx + 0x58]
mov edx, dword [0x41c250]
lea eax, [esp + 0xc]
add ecx, 0x50
push eax
push 0
push ecx
push ebp
push edx
call sub.WS2_32.dll_sendto
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
call fcn.00406280
add esp, 4
mov eax, 1
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x4051b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x40e5a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov al, byte [esp + 0x14]
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esp + 8], esi
mov byte [esi], al
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], edi
call fcn.004050e0
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ecx
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x405b00
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x1c
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x405b20
pop edi
pop esi
add esp, 0x1c
ret
mov eax, dword [esp + 0x28]
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x405b46
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
lea ecx, [esp + 8]
push ebx
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x405b80
Capabilities:
Create service
Get common file path
Start service

Disassembly:
sub esp, 0x100
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, dword [esp + 0x118]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0xf003f
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x405be8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
push 0
mov ebx, dword [esp + 0x118]
push 0
push 0
push 0
lea eax, [esp + 0x20]
push 0
push eax
push 1
push 1
push 1
push 0xf01ff
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebp
cmp eax, 0x431
je 0x405c27
test esi, esi
je 0x405c67
push 0xf01ff
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x405c67
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x405c89
call ebp
cmp eax, 0x420
je 0x405c89
lea ecx, [esp + 0x10]
push ecx
call ebp
push eax
push str.start_service_err:_08x__s_n
call fcn.0040772d
add esp, 0xc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
push ebx
call fcn.00405b00
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x100
ret
Function at 0x405cb0
Capabilities:
Stop service

Disassembly:
sub esp, 0x1c
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x405cd0
pop edi
pop esi
add esp, 0x1c
ret
mov eax, dword [esp + 0x28]
push 0xf01ff
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x405cf6
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret
lea ecx, [esp + 8]
push ebx
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x405d20
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x280
mov dword [esp + 0x14], 0x280
call fcn.00407339
add esp, 4
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push ebp
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x405d61
push ebp
call fcn.004072f1
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00407339
add esp, 8
mov ebp, eax
lea edx, [esp + 0x10]
mov esi, ebp
push edx
push ebp
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x405d98
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.WS2_32.dll_inet_addr]
cmp dword [esi + 0x1a0], 6
jne 0x405d92
lea eax, [esi + 0x1b0]
push eax
call ebx
cmp eax, edi
je 0x405da9
mov esi, dword [esi]
test esi, esi
jne 0x405d7c
push ebp
call fcn.004072f1
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
lea ecx, [esi + 0x1b0]
lea edi, [esi + 8]
push ecx
push edi
push str._s_IP:_s__n
call fcn.0040772d
mov edx, dword [esp + 0x24]
add esp, 0xc
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x405dc9
lea edx, [esi + 0x194]
mov eax, dword [esi + 0x194]
mov dword [0x50f1f0], eax
mov cx, word [edx + 4]
lea edx, [esi + 0x1d8]
push edx
mov word [0x50f1f4], cx
call ebx
add esi, 0x1c0
mov dword [0x51301c], eax
push esi
call ebx
push ebp
mov dword [0x513018], eax
call fcn.004072f1
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x405e20
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x84
mov ax, word [0x44edd8]
push edi
mov word [esp + 4], ax
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 4]
push 0x80
push ecx
stosb byte es:[edi], al
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
pop edi
jne 0x405e73
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.gethostname_fail__08x_n
call fcn.0040772d
add esp, 8
add esp, 0x84
ret
lea edx, [esp]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
push 0x513038
mov dword [0x50f1f8], eax
call fcn.00405d20
add esp, 8
add esp, 0x84
ret