joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4077a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47ec38
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x49e128]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.0045fda9
mov dword [esp + 0x28], 0
mov edi, dword [0x49f62c]
mov ecx, 0x49fc1c
mov dword [esp + 0xc], edi
call fcn.00404190
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x40781b
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x40781f
cmp byte [eax + 0x14], 0
je 0x40781f
call fcn.0045fe37
cmp esi, dword [eax + 0xc]
jae 0x407825
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x407821
xor ecx, ecx
jmp 0x407803
mov esi, ecx
test esi, esi
jne 0x407876
test edi, edi
je 0x40782d
mov esi, edi
jmp 0x407876
lea eax, [esp + 0xc]
push eax
call fcn.00407560
add esp, 4
cmp eax, 0xffffffff
jne 0x40785c
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.00460a0a
push 0x490fbc
lea ecx, [esp + 0x18]
push ecx
call fcn.00460622
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x49f62c], esi
call fcn.00404210
push esi
call fcn.0045ff05
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0045fdca
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x408ab0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47ec38
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x49e128]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.0045fda9
mov dword [esp + 0x28], 0
mov edi, dword [0x49f630]
mov ecx, 0x49f644
mov dword [esp + 0xc], edi
call fcn.00404190
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x408b2b
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x408b2f
cmp byte [eax + 0x14], 0
je 0x408b2f
call fcn.0045fe37
cmp esi, dword [eax + 0xc]
jae 0x408b35
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x408b31
xor ecx, ecx
jmp 0x408b13
mov esi, ecx
test esi, esi
jne 0x408b86
test edi, edi
je 0x408b3d
mov esi, edi
jmp 0x408b86
lea eax, [esp + 0xc]
push eax
call fcn.004087d0
add esp, 4
cmp eax, 0xffffffff
jne 0x408b6c
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.00460a0a
push 0x490fbc
lea ecx, [esp + 0x18]
push ecx
call fcn.00460622
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x49f630], esi
call fcn.00404210
push esi
call fcn.0045ff05
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0045fdca
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x408bb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47ec38
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x49e128]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.0045fda9
mov dword [esp + 0x28], 0
mov edi, dword [0x49f634]
mov ecx, 0x49f640
mov dword [esp + 0xc], edi
call fcn.00404190
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x408c2b
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x408c2f
cmp byte [eax + 0x14], 0
je 0x408c2f
call fcn.0045fe37
cmp esi, dword [eax + 0xc]
jae 0x408c35
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x408c31
xor ecx, ecx
jmp 0x408c13
mov esi, ecx
test esi, esi
jne 0x408c86
test edi, edi
je 0x408c3d
mov esi, edi
jmp 0x408c86
lea eax, [esp + 0xc]
push eax
call fcn.00408850
add esp, 4
cmp eax, 0xffffffff
jne 0x408c6c
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.00460a0a
push 0x490fbc
lea ecx, [esp + 0x18]
push ecx
call fcn.00460622
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x49f634], esi
call fcn.00404210
push esi
call fcn.0045ff05
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0045fdca
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x40db60
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
add eax, eax
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push esi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40dbd6
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x40dba5
cmp eax, 2
jne 0x40dbc1
test esi, esi
mov eax, dword [esp + 0x14]
je 0x40dbd0
test eax, eax
je 0x40dbcb
test al, 1
jne 0x40dbc1
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x40dbd0
pop edi
mov eax, 0xd
pop esi
ret 0xc
mov word [esi], 0
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 0xc
Function at 0x40de10
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x47f20b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x49e128]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49e128]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x240]
xor esi, esi
mov ebp, ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x238], esi
mov eax, dword [ebp]
lea ecx, [esp + 0x1c]
push ecx
push 0x2001f
push esi
push ebx
push eax
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x40df42
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, esi
je 0x40de9e
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
cmp eax, esi
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov dword [esp + 0x14], ecx
jne 0x40df42
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x24]
push edx
push esi
push esi
push esi
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x40]
push edx
push esi
push ecx
mov dword [esp + 0x38], 0x100
call edi
test eax, eax
jne 0x40df22
jmp 0x40dee0
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
call fcn.0040de10
mov ebx, eax
cmp ebx, esi
jne 0x40df8c
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
push esi
push esi
push esi
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x40]
push eax
push esi
push ecx
mov dword [esp + 0x38], 0x100
call edi
test eax, eax
je 0x40dee0
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40df35
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
mov edx, dword [ebp]
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
mov dword [esp + 0x238], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40df60
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
mov eax, edi
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00460e4b
add esp, 0x228
ret 4
mov dword [esp + 0x238], 0xffffffff
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40dfaa
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], esi
mov eax, ebx
jmp 0x40df62
Function at 0x40e270
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
push esi
push edi
mov esi, ecx
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0x24]
call fcn.0040e110
mov edi, dword [esp + 0x18]
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffec
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
or ecx, 0x10000
cmp eax, ecx
je 0x40e2b0
push ecx
push 0xffffffffffffffec
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [esi + 4]
push eax
mov dword [esp + 0xc], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov ecx, dword [esi + 4]
push ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0xfffffdcf
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 8]
push edx
push ecx
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x28]
pop edi
sub eax, 1
pop esi
add esp, 0xc
ret 4

Function at 0x40e610
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x24
test ecx, ecx
push esi
push edi
je 0x40e622
lea edi, [ecx - 0x20]
mov dword [esp + 8], edi
jmp 0x40e62e
mov dword [esp + 8], 0
mov edi, dword [esp + 8]
cmp dword [esp + 0x3c], 0
je 0x40e6b0
mov eax, dword [esp + 0x30]
mov ecx, dword [edi + 4]
push ebx
push ebp
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [esp + 0x3c]
mov edi, eax
push edi
mov ecx, esi
or ebp, 0xffffffff
call fcn.0040cdb0
test eax, eax
je 0x40e6a2
mov edx, dword [esi]
mov dword [edx - 8], edi
mov eax, dword [esi]
mov word [eax + edi*2], 0
mov eax, dword [esi]
test eax, eax
je 0x40e6a2
lea ecx, [edi + 1]
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, esi
mov ebp, eax
call fcn.0040ceb0
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esi]
mov dword [ecx - 8], eax
mov edx, dword [esi]
mov word [edx + eax*2], 0
cmp ebp, edi
pop ebp
pop ebx
jge 0x40e702
mov edi, dword [esp + 8]
xor esi, esi
jmp 0x40e6cc
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
mov ecx, dword [esp + 0x30]
mov edx, dword [edi + 4]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov esi, eax
test esi, esi
jne 0x40e6f8
push 0xffffffffffffffff
add edi, 0x20
call dword [sym.imp.USER32.dll_MessageBeep]
test edi, edi
je 0x40e6e0
lea eax, [edi - 0x20]
jmp 0x40e6e2
xor eax, eax
mov ecx, dword [esp + 0x30]
mov edx, dword [eax + 4]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
mov eax, esi
pop esi
add esp, 0x24
ret 0x18
cmp dword [esp + 0x40], 0
je 0x40e739
mov eax, dword [esi]
mov ecx, dword [eax - 8]
cmp ecx, dword [esp + 0x44]
jle 0x40e739
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0xc]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x14]
add ecx, 0x20
call fcn.0040e060
pop edi
xor eax, eax
pop esi
add esp, 0x24
ret 0x18
pop edi
mov eax, 1
pop esi
add esp, 0x24
ret 0x18
Function at 0x40f8b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x54]
mov ecx, eax
and ecx, 0xc
cmp cl, 0xc
push edi
mov bl, 1
jne 0x40f90d
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [esp + 0x10], eax
call edi
mov edx, dword [esi + 4]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 0xfffffffe
call edi
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [esp + 0xc]
push ecx
push edi
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0xc
ret
shr eax, 2
test al, 1
je 0x40f947
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esi + 4]
push ecx
movzx edx, di
push edx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0xc
ret
mov eax, dword [esi + 0x28]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
test bl, bl
je 0x40f97a
mov ecx, dword [esi + 4]
or byte [esi + 0x58], 2
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0xc
ret
Function at 0x413df0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, ecx
lea eax, [ebx + 8]
push eax
push 0
push ebx
push 0x413de0
push 0
push 0
call fcn.00462c48
add esp, 0x18
test eax, eax
mov dword [ebx + 4], eax
jne 0x413e16
xor al, al
pop ebx
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
cmp dword [ebx + 0xc], 0
jne 0x413e32
push 0x19
call edi
add esi, 1
cmp esi, 0x64
jl 0x413e20
pop edi
pop esi
mov al, 1
pop ebx
ret

Function at 0x415a90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47fbeb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x49e128]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00401740
mov dword [esp + 0x14], 2
mov dword [esi], vtable.CPropertyDlg.0
mov eax, dword [0x49c024]
mov dword [esi + 0x24], eax
mov byte [esp + 0x14], 3
mov ecx, dword [0x49c024]
mov dword [esi + 0x28], ecx
mov byte [esp + 0x14], 4
mov edx, dword [0x49c024]
mov dword [esi + 0x2c], edx
mov byte [esp + 0x14], 5
mov eax, dword [0x49c024]
mov dword [esi + 0x30], eax
mov byte [esp + 0x14], 6
mov ecx, dword [0x49c024]
mov dword [esi + 0x34], ecx
mov byte [esp + 0x14], 7
mov edx, dword [0x49c024]
mov dword [esi + 0x38], edx
mov byte [esp + 0x14], 8
mov eax, dword [0x49c024]
mov dword [esi + 0x3c], eax
mov byte [esp + 0x14], 9
mov ecx, dword [0x49c024]
mov dword [esi + 0x40], ecx
mov byte [esp + 0x14], 0xa
mov edx, dword [0x49c024]
mov dword [esi + 0x44], edx
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x417340
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x47fe60
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49e128]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x24]
test edi, edi
jl 0x4174af
mov ecx, dword [esi + 0x68]
test ecx, ecx
je 0x4174af
mov eax, dword [esi + 0x6c]
sub eax, ecx
sar eax, 2
cmp edi, eax
jae 0x4174af
mov byte [esi + 0x61], 1
mov ecx, dword [esi + 0x68]
test ecx, ecx
je 0x4173a4
mov eax, dword [esi + 0x6c]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x4173a9
call fcn.00460856
mov eax, dword [esi + 0x68]
mov ebp, dword [eax + edi*4]
cmp byte [ebp + 0x58], 0
je 0x4173d5
cmp byte [esp + 0x28], 0
je 0x41742a
lea ecx, [ebp + 4]
push ecx
push ebp
lea edx, [esp + 0x30]
push edx
call fcn.004167b0
mov dword [esp + 0x1c], 0
jmp 0x41740e
mov ecx, ebp
call fcn.0041c090
test al, al
je 0x4173e9
push 1
mov ecx, ebp
call fcn.0041c0c0
lea ecx, [ebp + 4]
push ecx
push ebp
lea edx, [esp + 0x30]
push edx
call fcn.004167b0
mov dword [esp + 0x1c], 1
push str..pr_
lea ecx, [esp + 0x2c]
call fcn.00404d50
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.00401540
mov ebx, dword [esi + 0x68]
cmp ebx, dword [esi + 0x6c]
jbe 0x417437
call fcn.00460856
lea edi, [ebx + edi*4]
cmp edi, dword [esi + 0x6c]
ja 0x417444
cmp edi, dword [esi + 0x68]
jae 0x417449
call fcn.00460856
mov eax, dword [esi + 0x6c]
lea ecx, [edi + 4]
sub eax, ecx
sar eax, 2
test eax, eax
jle 0x417468
add eax, eax
add eax, eax
push eax
push ecx
push eax
push edi
call fcn.00461176
add esp, 0x10
add dword [esi + 0x6c], 0xfffffffc
mov ecx, dword [esi + 0x68]
test ecx, ecx
jne 0x417477
xor eax, eax
jmp 0x41747f
mov eax, dword [esi + 0x6c]
sub eax, ecx
sar eax, 2
mov ecx, dword [esi + 4]
push 0
push eax
push 0x102f
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, ebp
call fcn.0041fb80
push ebp
call fcn.0046058f
mov edx, dword [esi + 4]
add esp, 4
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x41cb00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4806d0
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x49e128]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov eax, ecx
mov dword [esp + 4], eax
mov ecx, dword [0x49c024]
mov dword [eax], ecx
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov edx, dword [0x49c024]
mov dword [eax + 4], edx
mov byte [esp + 0x10], 1
mov edx, dword [0x49c024]
mov dword [eax + 8], edx
mov byte [esp + 0x10], 2
mov edx, dword [0x49c024]
mov dword [eax + 0xc], edx
mov byte [esp + 0x10], 3
mov edx, dword [0x49c024]
mov dword [eax + 0x10], edx
mov byte [esp + 0x10], 4
mov dword [eax + 0x2c], 0xf
mov dword [eax + 0x28], ecx
mov byte [eax + 0x18], cl
mov byte [esp + 0x10], 5
mov edx, dword [0x49c024]
mov dword [eax + 0x30], edx
mov byte [esp + 0x10], 6
mov edx, dword [0x49c024]
mov dword [eax + 0x34], edx
mov byte [esp + 0x10], 7
mov edx, dword [0x49c024]
mov dword [eax + 0x38], edx
mov byte [esp + 0x10], 8
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov byte [eax + 0x44], cl
mov byte [eax + 0x45], cl
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x41db20
Capabilities:
Check for time delay via gettickcount
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x480858
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push esi
push edi
mov eax, dword [0x49e128]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x68]
cmp byte [eax + 3], 0
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
je 0x41dbb8
mov byte [eax + 3], 0
mov eax, dword [esi + 4]
mov ecx, dword [esi]
lea edi, [esi + 4]
push str..pr_
push eax
push ecx
lea eax, [esp + 0x24]
push eax
call fcn.00439730
add esp, 0x10
mov dword [esp + 0x2c], 0
push eax
mov ecx, edi
call fcn.00402640
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x18]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x49c020]
je 0x41dbb8
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x41dbb8
mov eax, dword [esp + 0x18]
add eax, 0xfffffff4
push eax
call fcn.00460edd
add esp, 4
mov eax, dword [esi + 0x68]
cmp byte [eax + 0x18], 0
push esi
je 0x41dbcd
mov byte [eax + 0x18], 0
push 0x38008
jmp 0x41dbd2
push 0x48008
push 0x111
call fcn.0042d600
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [esi + 0x68]
mov eax, dword [edx + 0x14]
mov edi, dword [eax]
lea ecx, [esi + 4]
push ecx
push esi
lea edx, [esp + 0x1c]
push edx
call fcn.004167b0
mov dword [esp + 0x2c], 1
push str..pr_
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00405e10
mov byte [esp + 0x2c], 2
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
push eax
push edi
call fcn.0041bf40
add esp, 0x18
test al, al
je 0x41dc55
mov ecx, dword [esi + 8]
cmp ecx, dword [esp + 0x1c]
jne 0x41dc4a
mov edx, dword [esi + 0xc]
cmp edx, dword [esp + 0x20]
je 0x41dc55
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [edi + 8]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
mov edx, dword [edx + 0x24]
push eax
push 0x29
call edx
mov ecx, dword [edi + 8]
mov edx, dword [esp + 0x14]
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
push edx
push 0x2a
call eax
mov eax, dword [esi + 0x68]
test eax, eax
je 0x41dc85
mov dword [eax + 0x1c], 3
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [esi + 0x68]
mov dword [ecx + 0x58], eax
call edi
mov edx, dword [esi + 0x68]
mov dword [edx + 0x50], eax
mov eax, dword [esi + 0x68]
mov ecx, dword [eax + 0x14]
call fcn.00413a80
mov byte [esp + 0x2c], 1
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x49c020]
je 0x41dcd4
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x41dcd4
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.00460edd
add esp, 4
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x14]
lea edx, [eax - 0xc]
cmp edx, dword [0x49c020]
je 0x41dd05
add eax, 0xfffffff4
push eax
call ebp
test eax, eax
jg 0x41dd05
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.00460edd
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x20
ret
Function at 0x423200
Capabilities:
Resolve dns

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x1c], ecx
je 0x4232a4
cmp word [ecx + 8], 2
push ebx
push ebp
push edi
jne 0x423275
cmp word [ecx + 0xa], 4
jne 0x423275
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x423275
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebx
push ebp
call fcn.00423190
test eax, eax
mov dword [esi], eax
je 0x423298
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x423250
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x24]
push 0x400
push ecx
push 0x401
push edx
call fcn.004634f8
add esp, 0x10
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret 0x18
pop edi
pop ebp
pop ebx
mov eax, 8
pop esi
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x4232b4.11001
jmp dword [eax*4 + 0x4232d8]
mov eax, 0x2af9
pop esi
ret 0x18
mov eax, 0x2afa
pop esi
ret 0x18
mov eax, 0x2afb
pop esi
ret 0x18
Function at 0x423b10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
mov eax, dword [0x49e128]
xor eax, esp
mov dword [esp + 0x22c], eax
cmp dword [0x49f654], 0
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x423560
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x423850
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.00423510
je 0x423b82
movzx eax, word [esp + 0x234]
mov eax, dword [eax*8 + 0x49d430]
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.00460e4b
add esp, 0x230
ret 4
push 0x104
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x423c7f
push ebx
push ebp
push esi
push edi
lea edx, [esp + 0x134]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.00463336
push str.ws2_32
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call fcn.00463829
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x423bfd
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x423c44
push esi
call ebp
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x2c]
push 0x10c
push ecx
call fcn.00463336
push str.wship6
lea edx, [esp + 0x38]
push 0x10c
push edx
call fcn.00463829
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call edi
mov esi, eax
test esi, esi
je 0x423c7b
push str.getaddrinfo
push esi
call ebx
test eax, eax
je 0x423caf
xor edi, edi
mov ecx, dword [esp + edi*8 + 0x10]
push ecx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x423caf
add edi, 1
cmp edi, 3
jl 0x423c46
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov dword [0x49d430], edx
mov dword [0x49d438], eax
mov dword [fcn.00423510], ecx
pop edi
pop esi
pop ebp
pop ebx
movzx edx, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
mov eax, dword [edx*8 + 0x49d430]
xor ecx, esp
mov dword [0x49f654], 1
call fcn.00460e4b
add esp, 0x230
ret 4
push esi
call ebp
jmp 0x423c7b