joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52a93c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9b0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x64c], ecx
mov dword [ebp - 0x650], ecx
mov dword [ebp - 4], ecx
mov esi, edx
lea edi, [ebp - 0x10d]
mov ecx, 0x42
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, eax
xor eax, eax
push ebp
push 0x52aa62
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x646]
mov eax, ebx
call fcn.00529014
mov byte [ebp - 0x63b], 0x14
mov edx, dword [0x582f38]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x52aa78
call fcn.00405138
mov eax, dword [ebp - 4]
call fcn.0040a37c
test al, al
jne 0x52a9b6
mov eax, dword [ebp - 4]
call fcn.0040a3a0
lea eax, [ebp - 0x650]
lea edx, [ebp - 0x104]
call fcn.00405074
mov eax, dword [ebp - 0x650]
lea edx, [ebp - 0x64c]
call fcn.0040a780
mov edx, dword [ebp - 0x64c]
lea eax, [ebp - 4]
call fcn.004050f4
mov eax, dword [ebp - 4]
call fcn.0040a36c
test al, al
je 0x52aa22
cmp byte [ebp - 0x109], 0
je 0x52aa16
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004052ec
push eax
push 0x52aa84
push 0
call sub.shell32.dll_ShellExecuteA
mov dword [ebp - 0x545], 1
jmp 0x52aa2a
xor eax, eax
mov dword [ebp - 0x545], eax
lea edx, [ebp - 0x646]
mov ecx, 0x539
mov eax, ebx
call fcn.005274b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52aa69
lea eax, [ebp - 0x650]
mov edx, 2
call fcn.00404e34
lea eax, [ebp - 4]
call fcn.00404e10
ret

Function at 0x52aac4
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x52abb0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x38c]
call fcn.0040a36c
test al, al
je 0x52ab9a
mov eax, ebx
call fcn.005239d8
cmp word [ebx + 0x35a], 0
je 0x52ab0c
mov edx, ebx
mov eax, dword [ebx + 0x35c]
call dword [ebx + 0x358]
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0052ad3c
mov edx, 5
mov eax, dword [ebx + 0x15c]
call fcn.0051e568
push 5
mov eax, dword [ebx + 0x15c]
call fcn.0051e528
push eax
call sub.user32.dll_ShowWindow
push 5
mov eax, dword [ebx + 0x15c]
call fcn.0051e544
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
call fcn.0052cd60
mov eax, ebx
call fcn.0052aa8c
push 5
push 0
lea eax, [ebp - 4]
mov ecx, dword [ebx + 0x154]
mov edx, 0x52abc4
call fcn.00405138
mov eax, dword [ebp - 4]
call fcn.004052ec
push eax
mov eax, dword [ebx + 0x38c]
call fcn.004052ec
push eax
push 0x52abd0
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52abb7
lea eax, [ebp - 4]
call fcn.00404e10
ret
Function at 0x52abd8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004052dc
xor eax, eax
push ebp
push 0x52ac60
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040374c
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.0040374c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x220
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004052ec
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52ac67
lea eax, [ebp - 4]
call fcn.00404e10
ret

Function at 0x52af5c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, edx
mov esi, eax
mov eax, dword [esi + 0x398]
call fcn.0040a36c
test al, al
je 0x52af8a
push 0x80
mov eax, dword [esi + 0x398]
call fcn.004052ec
push eax
call sub.kernel32.dll_SetFileAttributesA
mov edx, dword [esi + 0x398]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, esi
call fcn.0052af38
test eax, eax
jbe 0x52afb1
push 0
push 5
push 0x609
push eax
call sub.user32.dll_PostMessageA
pop edi
pop esi
pop ebp
ret
Function at 0x52b20c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x119]
mov ecx, 0x44
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004052dc
xor eax, eax
push ebp
push 0x52b45f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x130], 1
jne 0x52b449
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005236fc
test al, al
je 0x52b389
xor edx, edx
push ebp
push 0x52b2c2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
lea edi, [eax + 0x230]
lea esi, [ebp - 0x119]
mov ecx, 0x44
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
cmp word [eax + 0x22a], 0
je 0x52b2b8
lea eax, [ebp - 0x119]
push eax
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x22c]
call dword [ebx + 0x228]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52b2fb
xor edx, edx
push ebp
push 0x52b34b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x128]
xor edx, edx
call fcn.0049f64c
imul edx, dword [ebp - 0x10], 0x3e8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x128]
call fcn.0049f65c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x128]
mov dl, 1
call fcn.0049f64c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52b449
xor edx, edx
push ebp
push 0x52b410
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
push ebp
push 0x52b3c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040a36c
test al, al
je 0x52b3bf
mov eax, dword [ebp - 8]
call fcn.004052ec
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52b3d3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x128]
xor edx, edx
call fcn.0049f64c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x128]
mov edx, 0x2710
call fcn.0049f65c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x128]
mov dl, 1
call fcn.0049f64c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52b449
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52b466
lea eax, [ebp - 8]
call fcn.00404e10
ret
Function at 0x52bda4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 1], 0
mov dl, 1
mov eax, dword [0x4a15fc]
call fcn.004a16fc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x52bed6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.004a179c
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 1
xor ecx, ecx
mov edx, 0x52beec
mov eax, dword [ebp - 8]
call fcn.004a1804
test al, al
je 0x52be44
xor eax, eax
push ebp
push 0x52be3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x52bf24
mov eax, dword [ebp - 8]
call fcn.004a1f3c
test al, al
je 0x52be27
mov byte [ebp - 1], 1
call fcn.00404810
call fcn.00404810
jmp 0x52bedd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52be44
mov eax, dword [ebp - 8]
call fcn.004a176c
ret
cmp byte [ebp - 1], 0
jne 0x52bec0
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.004a179c
mov eax, dword [ebp - 8]
mov dword [eax + 0x18], 1
mov edx, 0x52beec
xor ecx, ecx
mov eax, dword [ebp - 8]
call fcn.004a1804
test al, al
je 0x52bec0
xor eax, eax
push ebp
push 0x52beb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x52bf24
mov eax, dword [ebp - 8]
call fcn.004a1f3c
test al, al
je 0x52bea3
mov byte [ebp - 1], 1
call fcn.00404810
call fcn.00404810
jmp 0x52bedd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52bec0
mov eax, dword [ebp - 8]
call fcn.004a176c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52bedd
mov eax, dword [ebp - 8]
call fcn.00403ec0
ret
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x52c944
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 6], 0
mov dl, 1
mov eax, dword [0x4a15fc]
call fcn.004a16fc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x52cae3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x52c9cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.004a179c
xor ecx, ecx
mov edx, 0x52cc4c
mov eax, dword [ebp - 0x10]
call fcn.004a1804
test al, al
je 0x52c9c1
mov edx, 0x52cc84
mov eax, dword [ebp - 0x10]
call fcn.004a1f3c
test al, al
je 0x52c9c1
mov edx, 0x52cc84
mov eax, dword [ebp - 0x10]
call fcn.004a1aa0
mov byte [ebp - 6], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52c9d5
mov eax, dword [ebp - 0x10]
call fcn.004a176c
xor eax, eax
push ebp
push 0x52ca37
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.004a179c
mov edx, 0x52cc4c
xor ecx, ecx
mov eax, dword [ebp - 0x10]
call fcn.004a1804
test al, al
je 0x52ca2d
mov edx, 0x52cc84
mov eax, dword [ebp - 0x10]
call fcn.004a1f3c
test al, al
je 0x52ca2d
mov edx, 0x52cc84
mov eax, dword [ebp - 0x10]
call fcn.004a1aa0
mov byte [ebp - 6], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52ca41
mov eax, dword [ebp - 0x10]
call fcn.004a176c
xor eax, eax
push ebp
push 0x52cab5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x15c]
cmp byte [eax + 0x50], 0
jne 0x52caab
mov cl, 1
mov edx, 0x52cc98
mov eax, dword [ebp - 0x10]
call fcn.004a1804
test al, al
je 0x52caa7
mov edx, 0x52cc84
mov eax, dword [ebp - 0x10]
call fcn.004a1f3c
test al, al
je 0x52caa1
mov edx, 0x52cc84
mov eax, dword [ebp - 0x10]
call fcn.004a1aa0
mov eax, dword [ebp - 0x10]
call fcn.004a176c
jmp 0x52caab
mov byte [ebp - 6], 0
jmp 0x52caab
mov byte [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52cabf
mov eax, dword [ebp - 0x10]
call fcn.004a176c
mov al, byte [ebp - 6]
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52caea
mov eax, dword [ebp - 0x10]
call fcn.00403ec0
ret
Function at 0x52d154
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 1], cl
mov ebx, edx
xor eax, eax
push ebp
push 0x52d34e
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x52d32e
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp - 1], 0
jne 0x52d1a0
test bl, bl
jne 0x52d1a0
cmp byte [ebp + 0xc], 0
jne 0x52d1a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x52d338
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
xor edx, edx
push ebp
push 0x52d31d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
call fcn.00402be4
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x52d2ff
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0x10], 0
jbe 0x52d1e7
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x52d2e6
test bl, bl
je 0x52d219
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
and eax, 0x100000
cmp eax, 0x100000
je 0x52d245
cmp byte [ebp + 0xc], 0
je 0x52d231
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
and eax, 0x200000
cmp eax, 0x200000
je 0x52d245
cmp byte [ebp - 1], 0
je 0x52d295
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
and eax, 1
cmp eax, 1
jne 0x52d295
cmp byte [ebp + 8], 0
je 0x52d259
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.wininet.dll_DeleteUrlCacheEntry
jmp 0x52d295
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 4]
call fcn.00405008
mov edx, dword [ebp - 0x14]
mov eax, 0x52d368
call fcn.00405430
test eax, eax
jne 0x52d285
mov edx, dword [ebp - 0x14]
mov eax, 0x52d378
call fcn.00405430
test eax, eax
jne 0x52d295
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.wininet.dll_DeleteUrlCacheEntry
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00402c14
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_FindNextUrlCacheEntryA
mov eax, dword [ebp - 0x10]
call fcn.00402be4
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], 0
jbe 0x52d2cd
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_FindNextUrlCacheEntryA
test eax, eax
jne 0x52d203
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52d306
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00402c14
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52d355
lea eax, [ebp - 0x14]
call fcn.00404e10
ret
Function at 0x52fb30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, edx
mov eax, ebx
call fcn.00404e10
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
lea eax, [ebp - 0x105]
call fcn.0050827c
mov eax, dword [ebx]
call fcn.004050ec
test eax, eax
jle 0x52fb8a
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
jne 0x52fb8a
mov eax, dword [ebx]
call fcn.004050ec
mov edx, eax
mov eax, ebx
mov ecx, 1
call fcn.0040538c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x53f9fc
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov esi, dword [eax]
mov edi, dword [ecx]
mov eax, ebx
mov ecx, 3
xor edx, edx
div ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
lea ecx, [0x581c04]
xor eax, eax
xor ebx, ebx
xor edx, edx
cmp dword [ebp - 4], 0
je 0x53fa63
lodsw ax, word [esi]
mov bl, al
shr bl, 2
mov dl, byte [ebx + ecx]
mov bh, ah
and bh, 0xf
rol ax, 4
and ax, 0x3f
mov dh, byte [eax + ecx]
mov ax, dx
stosw word es:[edi], ax
lodsb al, byte [esi]
mov bl, al
shr bx, 6
mov dl, byte [ebx + ecx]
and al, 0x3f
xor ah, ah
mov dh, byte [eax + ecx]
mov ax, dx
stosw word es:[edi], ax
dec dword [ebp - 4]
jne 0x53fa29
cmp dword [ebp - 8], 0
je 0x53fab3
xor eax, eax
xor ebx, ebx
xor edx, edx
lodsb al, byte [esi]
shl ax, 6
mov bl, ah
mov dl, byte [ebx + ecx]
dec dword [ebp - 8]
je 0x53fa9e
shl ax, 2
and ah, 3
lodsb al, byte [esi]
shl ax, 4
mov bl, ah
mov dh, byte [ebx + ecx]
shl edx, 0x10
shr al, 2
mov bl, al
mov dl, byte [ebx + ecx]
mov dh, 0x3d
jmp 0x53faad
shr al, 2
mov bl, al
mov dh, byte [ebx + ecx]
shl edx, 0x10
mov dh, 0x3d
mov dl, 0x3d
mov eax, edx
ror eax, 0x10
stosd dword es:[edi], eax
pop ecx
pop ecx
pop ebp
ret

Function at 0x540fcc
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x540fd5
mov eax, dword [ebp - 4]
add esp, 4
push ebx
push esi
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
call fcn.00404e10
cmp esi, 0xffffffff
je 0x541026
push 0
push 0x10000
lea eax, [ebp - 0x10000]
push eax
push esi
call sub.ws2_32.dll_recv_1
mov esi, eax
mov eax, ebx
mov edx, esi
call fcn.00405478
lea edx, [ebp - 0x10000]
mov eax, dword [ebx]
mov ecx, esi
call fcn.004083f4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x541194
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004052dc
xor eax, eax
push ebp
push 0x541292
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, 0x5412a8
call fcn.00404e64
xor ebx, ebx
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004099e0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00404ea8
cmp dword [ebp - 4], 0
je 0x541274
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00541030
test al, al
jne 0x54126a
inc ebx
mov eax, dword [ebp - 4]
call fcn.004052ec
push eax
call sub.ws2_32.dll_gethostbyname_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x541218
cmp ebx, 3
jl 0x5411fb
cmp dword [ebp - 8], 0
je 0x541274
mov ebx, dword [ebp - 8]
push edi
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
xor eax, eax
mov al, byte [esi]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
xor eax, eax
mov al, byte [esi + 1]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
xor eax, eax
mov al, byte [esi + 2]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
xor eax, eax
mov al, byte [esi + 3]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x2c]
mov ecx, 3
mov eax, 0x5412b8
call fcn.0040b314
jmp 0x541274
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404e64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x541299
lea eax, [ebp - 0xc]
call fcn.00404e10
lea eax, [ebp - 4]
call fcn.00404e10
ret
Function at 0x5412c4
Capabilities:
Check for time delay via gettickcount
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x5412cd
mov eax, dword [ebp - 4]
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004052dc
xor eax, eax
push ebp
push 0x5414a3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 4]
call fcn.004050ec
mov ebx, eax
mov dword [ebp - 0x14], 0x4e20
mov dl, 1
mov eax, dword [0x41c958]
call fcn.00403e90
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x541486
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x541367
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov ecx, ebx
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x10]
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00421704
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x541371
call sub.kernel32.dll_GetTickCount_1
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x8017]
xor ecx, ecx
mov edx, 0x7fff
call fcn.0040374c
lea edx, [ebp - 0x8017]
mov ecx, 0x7fff
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov esi, eax
test esi, esi
jle 0x541470
push 0
push esi
lea eax, [ebp - 0x8017]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ws2_32.dll_send_1
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x54140f
call sub.ws2_32.dll_WSAGetLastError_1
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0x2733
jne 0x541400
push 0xa
call sub.kernel32.dll_Sleep
mov eax, dword [ebp - 0x10]
call fcn.004216e4
push edx
push eax
mov eax, esi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.00421704
jmp 0x541439
cmp dword [ebp - 0xc], 0
jne 0x541470
mov dword [ebp - 0xc], 0xffffffff
jmp 0x541470
test ebx, ebx
je 0x541470
cmp esi, ebx
jle 0x541439
mov eax, dword [ebp - 0x10]
call fcn.004216e4
push edx
push eax
mov eax, esi
sub eax, ebx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.00421704
cmp ebx, 0xffffffff
jle 0x541441
add dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.004216e4
cmp edx, dword [esp + 4]
jne 0x54145b
cmp eax, dword [esp]
pop edx
pop eax
je 0x541470
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
jbe 0x541379
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54148d
mov eax, dword [ebp - 0x10]
call fcn.00403ec0
ret
Function at 0x541f64
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x204]
mov edx, dword [0x53fc28]
call fcn.00405834
xor eax, eax
push ebp
push 0x5420b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x204]
mov edx, dword [ebp - 4]
add edx, 0x48
mov ecx, dword [0x53fc28]
call fcn.00405b68
mov ebx, dword [ebp - 0x200]
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x204]
call fcn.00404ea8
cmp byte [ebp - 0x20], 0
je 0x541fe6
cmp byte [ebp - 0x1f0], 0
je 0x541fe6
cmp dword [ebp - 0x24], 0
jle 0x541fe6
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x1f0]
call fcn.00405074
push 0x5420bc
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
push 6
push 1
push 2
call sub.ws2_32.dll_socket_1
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x542082
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00541c74
test al, al
je 0x54204a
mov eax, dword [ebp - 4]
cmp byte [eax + 0xd], 0
jne 0x54205f
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x240]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005416f4
jmp 0x54205f
push 0
push 0
push 0x5c7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
push eax
call sub.user32.dll_PostMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x542089
mov eax, dword [ebp - 8]
push eax
call sub.ws2_32.dll_closesocket_1
xor ecx, ecx
mov dl, 7
mov eax, dword [ebp - 4]
call fcn.005414b8
ret