joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005e64
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a028]
jne 0x1005e6d
ret
jmp 0x1005e72
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x100a028]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x101b0cc]
test eax, eax
je 0x1005e96
call eax
cmp dword [0x101b0d0], 0
je 0x1005edd
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x101b0d0]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.01005e64
add ebp, 0x2a8
leave
ret

Function at 0x10070fe
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x1007139
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1007116
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1007155
dec esi
je 0x100714e
dec esi
jne 0x100715a
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc

Function at 0x6d3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.006d378f
jae 0x6d370e
xor ecx, ecx
call fcn.006d378f
jae 0x6d373d
xor eax, eax
call fcn.006d378f
jae 0x6d374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.006d378f
adc al, al
jae 0x6d372f
jne 0x6d3779
stosb byte es:[edi], al
jmp 0x6d3711
call fcn.006d379b
sub ecx, ebx
jne 0x6d3756
call fcn.006d3799
jmp 0x6d3775
lodsb al, byte [esi]
shr eax, 1
je 0x6d3783
adc ecx, ecx
jmp 0x6d3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.006d3799
cmp eax, 0x7d00
jae 0x6d3772
cmp ah, 5
jae 0x6d3773
cmp eax, 0x7f
ja 0x6d3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x6d3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x4026a0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x48ae5c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
push eax
mov esi, ecx
push 0x202
mov dword [ebp - 0x224], esi
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor eax, eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x240], eax
mov eax, dword [0x4901b8]
mov dword [ebp - 0x23c], 1
test eax, eax
jne 0x402726
push eax
call fcn.00404160
mov dword [0x4901b8], eax
lea edx, [ebp - 0x21c]
push edx
lea edx, [ebp - 0x244]
push edx
lea ecx, [esi + 0x110]
push 0
push ecx
mov dword [ebp - 0x220], ecx
call eax
mov esi, eax
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
test esi, esi
je 0x40278c
mov eax, dword [0x4901c0]
mov esi, dword [ebp - 0x21c]
test eax, eax
jne 0x40276d
push 2
call fcn.00404160
mov dword [0x4901c0], eax
push esi
call eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ca30
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x21c]
test ebx, ebx
je 0x402858
lea ebx, [ebx]
cmp dword [ebx + 4], 0x17
jne 0x4027f2
mov eax, dword [0x4901bc]
mov esi, dword [ebx + 0x10]
mov edi, dword [ebx + 0x18]
test eax, eax
jne 0x4027c1
push 1
call fcn.00404160
mov dword [0x4901bc], eax
push 2
push 0
push 0
push 0x80
lea ecx, [ebp - 0x88]
push ecx
push esi
push edi
call eax
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
lea eax, [ebp - 0x88]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4027e7
sub eax, edx
jne 0x4027fb
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
jne 0x4027a0
jmp 0x402858
mov esi, dword [ebp - 0x224]
push str.udp6:_
add esi, 0x90
push 0x80
push esi
call fcn.0044d0da
add esp, 0xc
lea edx, [ebp - 0x88]
push edx
push 0x80
push esi
call fcn.0044d236
add esp, 0xc
push 0x47f8dc
push 0x80
push esi
call fcn.0044d236
mov eax, dword [ebp - 0x220]
add esp, 0xc
push 0x80
push 0
push eax
call fcn.0044e830
add esp, 0xc
mov eax, dword [0x4901c0]
mov esi, dword [ebp - 0x21c]
test eax, eax
jne 0x402873
push 2
call fcn.00404160
mov dword [0x4901c0], eax
push esi
call eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0044ca30
mov esp, ebp
pop ebp
ret
Function at 0x4037d0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 0x14]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x40385c
cmp word [ebx + 8], 2
push edi
jne 0x40382e
cmp word [ebx + 0xa], 4
jne 0x40382e
mov edi, dword [ebx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x40382e
mov edx, dword [eax]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
call fcn.00403ad0
mov dword [esi], eax
test eax, eax
je 0x403850
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x403808
mov eax, dword [ebx]
mov ecx, dword [ebp + 0x14]
push 0x400
push eax
push 0x401
push ecx
call fcn.0044d025
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x10
pop edi
pop esi
mov eax, 8
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x40386c.11001
jmp dword [eax*4 + 0x403894]
pop esi
mov eax, 0x2af9
pop ebx
pop ebp
ret 0x10
pop esi
mov eax, 0x2afa
pop ebx
pop ebp
ret 0x10
pop esi
mov eax, 0x2afb
pop ebx
pop ebp
ret 0x10
Function at 0x404160
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x48ae5c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4901b4], 0
push ebx
push esi
push edi
mov dword [ebp - 0x238], str.getaddrinfo
mov dword [ebp - 0x234], 0x403be0
mov dword [ebp - 0x230], str.getnameinfo
mov dword [ebp - 0x22c], 0x403e90
mov dword [ebp - 0x228], str.freeaddrinfo
mov dword [ebp - 0x224], fcn.00404110
je 0x4041d9
movzx eax, word [ebp + 8]
mov eax, dword [eax*8 + 0x48bfe8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ca30
mov esp, ebp
pop ebp
ret 4
push 0x104
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4042ef
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x118]
push 0x10c
push eax
call fcn.0044d0da
push str.ws2_32
lea ecx, [ebp - 0x118]
push 0x10c
push ecx
call fcn.0044d236
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [ebp - 0x118]
push edx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x404252
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x4042a7
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x118]
push 0x10c
push ecx
call fcn.0044d0da
push str.wship6
lea edx, [ebp - 0x118]
push 0x10c
push edx
call fcn.0044d236
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call edi
mov esi, eax
test esi, esi
je 0x4042ef
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x4042a7
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4042ef
xor edi, edi
lea esp, [esp]
mov ecx, dword [ebp + edi*8 - 0x238]
push ecx
push esi
call ebx
mov dword [ebp + edi*8 - 0x234], eax
test eax, eax
je 0x40429e
inc edi
cmp edi, 3
jl 0x4042b0
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x224]
mov dword [0x48bfe8], edx
mov dword [0x48bff0], eax
mov dword [fcn.00404110], ecx
movzx edx, word [ebp + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [edx*8 + 0x48bfe8]
pop edi
pop esi
xor ecx, ebp
mov dword [0x4901b4], 1
pop ebx
call fcn.0044ca30
mov esp, ebp
pop ebp
ret 4
Function at 0x4046e0
Capabilities:
Get session user name
Hide graphical window
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x48ae5c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
push edi
push eax
push 0
push 0
push 0xc8
push 0x190
push bind
push bind
push 0xcf0000
mov dword [edi + 4], eax
lea eax, [edi + 0xc]
push eax
lea ecx, [edi + 0x19c]
push ecx
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [edi + 8], eax
test eax, eax
jne 0x404749
pop edi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044ca30
mov esp, ebp
pop ebp
ret 4
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [edi + 8]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
lea eax, [ebp - 0x428]
push eax
lea ecx, [edi + 0x2ce4]
push ecx
mov dword [ebp - 0x428], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea edx, [edi + 0x2eec]
push edx
call fcn.0044daeb
add esp, 4
lea eax, [edi + 0x330]
push eax
push str.SoftwareKyocera_MitaStatusMonitor_s
lea ecx, [ebp - 0x41c]
push 0x208
push ecx
call fcn.0044dacd
add esp, 0x10
lea edx, [ebp - 0x420]
push edx
push 1
push 0
lea eax, [ebp - 0x41c]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
js 0x404831
lea ecx, [ebp - 0x430]
push ecx
mov ecx, dword [ebp - 0x420]
lea edx, [ebp - 0x42c]
push edx
lea eax, [ebp - 0x424]
push eax
push 0
push str.LastID
push ecx
mov dword [ebp - 0x424], 4
mov dword [ebp - 0x430], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404824
cmp dword [ebp - 0x424], 4
jne 0x404824
mov eax, dword [ebp - 0x42c]
test eax, eax
je 0x404824
mov dword [edi + 0x2ee8], eax
mov edx, dword [ebp - 0x420]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
lea eax, [edi + 0x890]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0xa98], eax
call fcn.004049d0
mov ecx, dword [ebp - 8]
xor ecx, ebp
mov eax, 1
pop edi
call fcn.0044ca30
mov esp, ebp
pop ebp
ret 4

Function at 0x404bf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x100
push 1
mov dword [edi + 0x86c], 0x80000010
mov dword [edi + 0xaa0], 0x1869f
call fcn.0044d510
add esp, 8
mov esi, eax
push 0
lea eax, [ebp - 4]
push eax
push 0x10
mov dword [esi], 3
mov dword [esi + 4], 0x48f
mov dword [esi + 8], 0
mov ecx, dword [edi + 0xa98]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404c4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call fcn.0044ca3f
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4050e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x80
push 1
mov edi, eax
mov ebx, ecx
call fcn.0044d510
mov esi, eax
add esp, 8
mov dword [esi], 3
lea eax, [esi + 0xc]
test edi, edi
jne 0x40512e
push ebx
push str._PJL_USTATUS_DEVICE_r_nCODE_05d_r_n_f
push 0x5e
push eax
mov dword [esi + 8], 0x22
call fcn.0044d4f2
add esp, 0x10
cmp eax, 0xffffffff
je 0x405154
mov eax, dword [esi + 8]
add eax, 0x10
jmp 0x405157
push edi
push ebx
push str._PJL_USTATUS_DEVICE_r_nCODE_05d_r_nCODE2_05d_r_n_f
push 0x51
push eax
mov dword [esi + 8], 0x2f
call fcn.0044d4f2
add esp, 0x14
cmp eax, 0xffffffff
je 0x405154
mov eax, dword [esi + 8]
add eax, 0x10
jmp 0x405157
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0xa98]
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test edi, edi
jne 0x40519d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call fcn.0044ca3f
mov eax, dword [ebx + 8]
add esp, 4
push edi
push edi
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
call fcn.0044ca3f
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4051c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4051d0
push ebx
push esi
push edi
sub eax, edx
lea edi, [eax + 0x10]
push edi
push 1
call fcn.0044d510
mov esi, eax
mov eax, dword [ebp + 0xc]
add esp, 8
mov dword [esi], 3
mov dword [esi + 4], 0
lea ebx, [esi + 0xc]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x405202
sub eax, ecx
add eax, 3
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
push eax
add edi, 0xfffffff4
push edi
push ebx
call fcn.0044d0da
push 0x47fd54
push edi
push ebx
call fcn.0044d236
mov eax, dword [esi + 8]
mov edx, dword [ebp + 8]
add esp, 0x18
push 0
lea ecx, [ebp - 4]
push ecx
add eax, 0xc
push eax
mov eax, dword [edx + 0xa98]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call fcn.0044ca3f
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x408f90
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x48ae5c]
xor eax, esp
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x409016
cmp eax, 0x276c
jne 0x408fe9
push str.Unable_to_init._socket_lib__does_not_support_1.1
push 0x48c610
call fcn.0044d46e
add esp, 8
mov eax, 0x48c610
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0044ca30
add esp, 0x194
ret
push eax
push str.Socket_Startup_error__d
push 0x48c610
call fcn.0044d46e
add esp, 0xc
mov eax, 0x48c610
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.0044ca30
add esp, 0x194
ret
mov ecx, dword [esp + 0x190]
xor ecx, esp
xor eax, eax
call fcn.0044ca30
add esp, 0x194
ret
Function at 0x4159d0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov edx, dword [ebp + 0x14]
push ebx
xor eax, eax
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x30]
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x14]
push edi
push esi
xor ebx, ebx
mov dword [esp + 0x30], ecx
mov dword [esi + 0x2c], edx
mov dword [esi + 0x30], eax
call fcn.00415310
add esp, 8
cmp eax, ebx
mov dword [esp + 0x1c], eax
jne 0x415aaa
push edi
call fcn.0040d1f0
add esp, 4
cmp dword [esp + 0x14], ebx
mov eax, 1
mov dword [esp + 0x18], eax
je 0x415adc
lea ecx, [esp + 0x24]
push ecx
lea edi, [esp + 0x34]
mov edx, edi
push edx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x34], 1
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
call fcn.00413b20
add esp, 0x10
cmp dword [esp + 0x24], 1
jne 0x415a85
xor edi, edi
mov eax, dword [esp + 0x10]
push edi
push ebx
push ebx
lea edx, [esp + 0x44]
push edx
push eax
call sub.WS2_32.dll_select
cmp eax, ebx
jle 0x415ab4
lea ecx, [esp + 0x38]
push ecx
call fcn.00415330
add esp, 4
jmp 0x415ace
mov dword [esp + 0x14], 1
jmp 0x415a46
cmp eax, 0xffffffff
je 0x415ac4
cmp eax, ebx
jne 0x415b1a
call fcn.004152d0
jmp 0x415ace
call fcn.00450983
cmp dword [eax], 4
jne 0x415afa
cmp dword [esp + 0x14], ebx
jne 0x415a46
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x20]
mov dword [ecx], edx
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
pop edi
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [0x48d210], 0xffffffff
call fcn.00450983
mov edx, dword [eax]
push edx
call fcn.0044f4fc
push eax
call fcn.00409580
add esp, 8
mov eax, 1
jmp 0x415adc
Function at 0x415f00
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call fcn.0040d4e0
mov edi, dword [ebp + 0xc]
mov esi, eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
lea edx, [esp + 0x14]
push edi
push ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], ecx
mov dword [esi + 0x2c], 0x415db0
mov dword [esi + 0x30], edx
call fcn.004140d0
add esp, 0xc
test eax, eax
mov dword [esp + 0x18], eax
jne 0x415fea
push edi
call fcn.0040d1f0
add esp, 4
cmp dword [esp + 0x10], 0
mov dword [esp + 0x14], 1
je 0x416047
lea ecx, [ecx]
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x24]
push eax
lea edi, [esp + 0x34]
mov ecx, edi
push ecx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x2c]
push eax
push ebx
mov dword [esp + 0x38], 1
call fcn.0040f0b0
add esp, 0x14
cmp dword [esp + 0x24], 1
jne 0x415fc2
xor edi, edi
mov edx, dword [esp + 0x20]
push edi
push 0
push 0
lea ecx, [esp + 0x44]
push ecx
push edx
call sub.WS2_32.dll_select
test eax, eax
jle 0x415ff4
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.004152c0
add esp, 8
jmp 0x416012
mov dword [esp + 0x10], 1
jmp 0x415f80
cmp eax, 0xffffffff
je 0x416008
test eax, eax
jne 0x41603f
push ebx
call fcn.00413ef0
add esp, 4
jmp 0x416012
call fcn.00450983
cmp dword [eax], 4
jne 0x41601f
cmp dword [esp + 0x10], 0
jne 0x415f80
jmp 0x416047
mov dword [0x48d210], 0xffffffff
call fcn.00450983
mov ecx, dword [eax]
push ecx
call fcn.0044f4fc
push eax
call fcn.00409580
add esp, 8
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
mov edx, dword [ebp + 0x10]
mov ecx, dword [esp + 0x2c]
mov dword [edx], eax
mov edx, dword [esp + 0x28]
pop edi
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], edx
mov eax, dword [esp + 0x10]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c5e0
Capabilities:
Access the windows event log

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
mov esi, 1
call fcn.0041c090
mov ebp, dword [esp + 0x14]
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov ebx, eax
test ebx, ebx
jne 0x41c622
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebp
push str.Could_not_open_event_log_for__s._Last_error:_0x_x_n
call fcn.0044cb85
add eax, 0x40
push eax
call fcn.0044ca79
add esp, 0x10
xor esi, esi
mov eax, dword [0x48d250]
test eax, eax
mov ecx, 4
je 0x41c64d
cmp dword [eax + 0xc], ecx
jne 0x41c642
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x18], esi
mov dword [eax], esi
mov edi, 1
mov eax, dword [eax + 0x20]
test eax, eax
jne 0x41c630
test edi, edi
jne 0x41c672
push 7
push ecx
call fcn.0041c530
mov edi, eax
add esp, 8
test edi, edi
je 0x41c672
push ebp
mov dword [edi + 0x1c], ebx
call fcn.004636a1
add esp, 4
mov dword [edi + 0x10], eax
mov dword [edi + 0x18], esi
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4301f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x4303f2
cmp word [edi], 2
jne 0x4303f2
push esi
push 0x40
call fcn.0044e481
mov esi, eax
add esp, 4
test esi, esi
je 0x430279
push 0x40
push 0
push esi
call fcn.0044e830
push 0x10
call fcn.0044e481
add esp, 0x10
test eax, eax
mov dword [esi + 0x20], eax
je 0x430270
mov dword [esi + 0x24], 0x10
mov ecx, dword [edi]
mov dword [eax], ecx
mov edx, dword [edi + 4]
mov dword [eax + 4], edx
mov ecx, dword [edi + 8]
mov dword [eax + 8], ecx
mov edx, dword [edi + 0xc]
push 0
push 1
mov dword [eax + 0xc], edx
push 2
mov dword [esi], 0x482670
mov dword [esi + 4], 9
call dword [sym.imp.WS2_32.dll_socket]
test eax, eax
mov dword [esi + 0x18], eax
jge 0x43027e
push esi
call fcn.004255f0
add esp, 4
pop esi
xor eax, eax
pop edi
ret
cmp dword [esp + 0x10], 0
push ebx
mov dword [esi + 0x1c], 1
push 6
je 0x43034f
mov dword [esp + 0x14], 1
mov dword [esi + 0x1c], 3
call fcn.0044e481
add esp, 4
test eax, eax
mov dword [esi + 8], eax
je 0x43033a
mov ecx, dword [edi + 4]
mov ebx, dword [sym.imp.WS2_32.dll_htons]
mov dword [eax], ecx
movzx edx, word [edi + 2]
push edx
call ebx
mov ecx, dword [esi + 8]
mov byte [ecx + 4], ah
movzx edx, word [edi + 2]
push edx
call ebx
mov ecx, dword [esi + 8]
push 4
lea edx, [esp + 0x14]
push edx
push 4
mov byte [ecx + 5], al
mov eax, dword [esi + 0x18]
push 0xffff
push eax
mov dword [esi + 0xc], 6
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [esi + 0x18]
push 0x10
push edi
push ecx
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x43033a
mov eax, dword [esi + 0x18]
lea edx, [esp + 0x10]
push edx
push 0x8004667e
push eax
mov dword [esp + 0x1c], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov ecx, dword [esi + 0x18]
push 5
push ecx
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x4303c2
push esi
call fcn.0042ff20
push esi
call fcn.004255f0
add esp, 8
pop ebx
pop esi
xor eax, eax
pop edi
ret
call fcn.0044e481
add esp, 4
test eax, eax
mov dword [esi + 0x10], eax
je 0x43033a
mov edx, dword [edi + 4]
mov ebx, dword [sym.imp.WS2_32.dll_htons]
mov dword [eax], edx
movzx eax, word [edi + 2]
push eax
call ebx
mov ecx, dword [esi + 0x10]
mov byte [ecx + 4], ah
movzx edx, word [edi + 2]
push edx
call ebx
mov ecx, dword [esi + 0x10]
push 0x10
mov byte [ecx + 5], al
mov edx, dword [esi + 0x18]
push edi
push edx
mov dword [esi + 0x14], 6
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jl 0x43033a
mov eax, dword [esi + 0x18]
push 0
push 0
push 0x1001
push eax
call fcn.00430d10
mov ecx, dword [esi + 0x18]
push 0
push 0
push 0x1002
push ecx
call fcn.00430d10
add esp, 0x20
pop ebx
mov dword [esi + 0x28], bind
mov dword [esi + 0x2c], 0x42fd70
mov dword [esi + 0x30], 0x42e480
mov dword [esi + 0x34], fcn.0042ff20
mov dword [esi + 0x38], 0x42ffb0
mov dword [esi + 0x3c], fcn.0042fcc0
mov eax, esi
pop esi
pop edi
ret
xor eax, eax
pop edi
ret