joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48e6a0
Capabilities:
Terminate process

Disassembly:
push 0x74
mov eax, 0x50ef7e
call fcn.004f41e2
mov esi, ecx
mov dword [ebp - 0x70], esi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x78], ebx
test esi, esi
je 0x48ea4e
test ebx, ebx
je 0x48ea4e
xor eax, eax
cmp word [ebx], ax
je 0x48ea4e
push eax
call fcn.00487113
test eax, eax
je 0x48ea4e
mov eax, dword [esi + 0x4294]
cmp dword [eax], 1
jne 0x48ea4e
mov edi, ebx
xor edx, edx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, dx
jne 0x48e6f6
mov al, byte [ebp + 8]
sub edi, ecx
sar edi, 1
test al, al
je 0x48e7bc
push 1
mov ecx, esi
call fcn.00487c63
test eax, eax
je 0x48e7b7
lea edi, [edi*2 + 0x80]
lea eax, [edi + edi]
push eax
call fcn.004e1c0a
mov esi, eax
pop ecx
test esi, esi
je 0x48ea4e
push 0x5555d4
push edi
push esi
call fcn.00401a0b
mov ecx, esi
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x48e74f
movzx eax, word [ebx]
sub ecx, edx
sar ecx, 1
lea edx, [esi + ecx*2]
test ax, ax
je 0x48e792
push 0x5c
mov ecx, eax
pop edi
movzx eax, cx
cmp cx, di
jne 0x48e77f
mov word [edx], di
add edx, 2
movzx eax, word [ebx]
add ebx, 2
mov word [edx], ax
add edx, 2
movzx eax, word [ebx]
mov ecx, eax
test ax, ax
jne 0x48e76e
push 0x22
pop eax
mov word [edx], ax
push 0x29
pop eax
mov word [edx + 2], ax
xor eax, eax
mov word [edx + 4], ax
mov eax, dword [ebp - 0x70]
mov ecx, eax
push 1
push esi
call fcn.0048db88
jmp 0x48ea47
mov al, byte [ebp + 8]
xor edx, edx
add edi, 0x20
mov ebx, edx
test al, al
je 0x48e856
mov eax, dword [esi + 4]
mov ebx, dword [eax + 0x3e68]
test ebx, ebx
je 0x48e7de
mov ebx, dword [ebx + 0x21c]
jmp 0x48e7e0
mov ebx, edx
test ebx, ebx
je 0x48e7e9
cmp word [ebx], dx
jne fcn.0048e83e
mov eax, dword [ebp - 0x70]
add esi, 0x47a4
xor ecx, ecx
cmp dword [eax + 0x478c], edx
cmove esi, ecx
test esi, esi
je 0x48e839
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.powershell.exe
push esi
call ebx
test eax, eax
jne 0x48e81a
mov ebx, 0x5555fc
jmp fcn.0048e83e
push str.bash.exe
push esi
call ebx
test eax, eax
je 0x48e832
push 0x555610
push esi
call ebx
test eax, eax
jne 0x48e839
mov ebx, 0x555620
jmp fcn.0048e83e
mov ebx, 0x555638
fcom dword [ecx - 0x77]
pop esp
and al, 0x18
push esi
call fcn.004e1bea
pop ecx
xor al, al
call fcn.004f418c
ret 8
Function at 0x48e83e
Capabilities:
Terminate process

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
push 0
call esi
mov ecx, dword [str.kernel32.dll]
mov ebx, eax
push ecx
mov dword [esp + 0x18], ebx
call esi
mov ecx, dword [0x582ec4]
mov ebp, eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x104
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
xor esi, esi
movzx ecx, word [edi + edx*2]
mov eax, edx
cmp ecx, 0x5c
cmovne eax, esi
mov esi, eax
test cx, cx
je 0x48e899
inc edx
jmp 0x48e883
lea edi, [edi + esi*2]
mov esi, dword [0x582e98]
add edi, 2
cmp dword [esi], 0
je 0x48e8f1
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp al, byte [esi]
je 0x48e8be
cmp al, byte [esi + 1]
jne 0x48e9a3
movzx eax, word [edi]
xor edx, edx
xor ecx, ecx
mov ebx, eax
test ax, ax
je 0x48e8df
nop
movzx eax, ax
lea ecx, [ecx + 1]
add edx, eax
movzx eax, word [edi + ecx*2]
test ax, ax
jne 0x48e8ce
cmp edx, dword [esi + 4]
je 0x48e8ed
cmp edx, dword [esi + 8]
jne 0x48e9a3
mov ebx, dword [esp + 0x14]
mov eax, dword [0x582ec4]
push eax
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edx, edx
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
mov dword [edx + eax], ecx
add edx, 4
cmp edx, 0x20
jl 0x48e910
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
test ebp, ebp
je 0x48e9a3
mov edi, dword [0x582ec8]
lea eax, [esp + 0x10]
mov ecx, dword [0x582eb4]
push eax
push ecx
push 0x6000
push edi
call ebp
mov esi, dword [0x582ebc]
lea ecx, [edi + 8]
add esi, ebx
mov edx, 0x17fe
mov ebx, dword [esi + 4]
sub esi, edi
mov eax, dword [esi + ecx]
lea ecx, [ecx + 4]
add eax, ebx
mov dword [ecx - 4], eax
sub edx, 1
jne 0x48e961
mov eax, dword [0x582ea0]
mov dword [edi + 8], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 0x6000
push edi
call ebp
mov eax, dword [0x582eac]
mov ecx, dword [edi + 0xc]
add ecx, eax
mov eax, dword [0x582eac]
add ecx, edi
add edi, eax
push edi
call ecx
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x49398b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push esi
mov esi, ecx
je 0x4939d1
cmp dword [esi + 0x18], 0
je 0x4939d1
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4939d1
push 1
push 5
push dword [esi + 0x18]
mov ecx, esi
mov byte [esi + 0x49], 0
call fcn.00493a33
mov ecx, dword [esi]
add ecx, 0xc
call fcn.004cfc3f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x493a13
mov ecx, dword [esi]
add ecx, 0xc
mov byte [esi + 0x49], 1
call fcn.004cfc3f
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [esi + 0x18], 0
je 0x493a09
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x493a09
push 1
push 0
push dword [esi + 0x18]
mov ecx, esi
call fcn.00493a33
mov ecx, dword [esi]
add ecx, 0xc
call fcn.004cfd94
pop esi
pop ebp
ret 4

Function at 0x493b3f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
test edi, edi
je 0x493bd7
push esi
xor eax, eax
push eax
push 0x8002
push eax
push eax
jmp 0x493bb6
push 0xff
lea eax, [ebp - 0x204]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x493bac
push 0x22
pop eax
cmp word [ebp - 0x204], ax
jne 0x493bac
cmp word [ebp - 0x1f6], ax
jne 0x493bac
push 6
lea eax, [ebp - 0x202]
push 0x5242d0
push eax
call fcn.00456c5c
add esp, 0xc
test eax, eax
je 0x493be4
push 0
push 0x8002
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
jne 0x493b66
push eax
push 0xfff7
push 0x112
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004f4166
leave
ret
push esi
call fcn.004ea440
pop ecx
jmp 0x493bd6

Function at 0x494000
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov dword [ebp - 0xa8], ecx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0xa8]
mov edi, eax
push 5
push 0x556010
call fcn.00491e14
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax]
call fcn.004dc00f
mov ecx, dword [ebp - 0xa8]
push eax
push 0x556040
lea eax, [ecx + 0x39ac]
push eax
push ecx
push 0x48a0ba
call fcn.004e6611
mov ecx, dword [ebp - 0xa8]
add esp, 0x14
push 5
push 0x55605c
mov dword [ecx + 0x39a8], eax
call fcn.00491e14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x9c4
jbe 0x4940b3
push eax
lea eax, [ebp - 0xa4]
push 0x556090
push eax
call fcn.004031fd
mov ecx, dword [ebp - 0xa8]
lea eax, [ebp - 0xa4]
add esp, 0xc
push eax
call fcn.0048a02d
mov eax, dword [ebp - 0xa8]
cmp dword [eax + 0x39a8], ebx
jne 0x4940d4
push ebx
push ebx
push ebx
push ebx
push 0x5560f8
call fcn.00420ad9
add esp, 0x14
jmp 0x4940d6
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret
Function at 0x4adb11
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push 0x1fffe
call fcn.004e1c0a
mov esi, eax
pop ecx
test esi, esi
je 0x4adc7b
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1fffa
push eax
push esi
xor ebx, ebx
push ebx
push ebx
push str.AutoRun
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4adc65
mov eax, dword [ebp - 4]
xor ecx, ecx
shr eax, 1
push edi
mov word [esi + eax*2], cx
cmp byte [ebp + 0xc], cl
je 0x4adc43
cmp word [esi], bx
je 0x4adc43
push str.ConEmuCmd_Autorun.cmd
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov ebx, eax
test ebx, ebx
je 0x4adc41
mov edi, ebx
push 0x26
pop ecx
cmp ebx, esi
jbe 0x4adba0
cmp word [edi - 2], cx
je 0x4adba0
add edi, 0xfffffffe
cmp edi, esi
ja 0x4adb93
push ecx
push ebx
call fcn.004f5617
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x4adbcc
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x4adbb4
sub ecx, edx
sar ecx, 1
push 0x26
pop edx
lea ecx, [ebx + ecx*2]
jmp 0x4adbd9
push 0x26
pop edx
jmp 0x4adbd4
add ecx, 2
cmp word [ecx], dx
je 0x4adbd1
movzx eax, word [ecx]
cmp edi, esi
ja 0x4adbec
test ax, ax
jne 0x4adc0d
xor eax, eax
mov word [esi], ax
jmp 0x4adc41
test ax, ax
jne 0x4adc0d
movzx ecx, word [edi - 2]
cmp cx, dx
je 0x4adbff
cmp ecx, 0x20
jne 0x4adc06
add edi, 0xfffffffe
cmp edi, esi
ja 0x4adbf1
xor eax, eax
mov word [edi], ax
jmp 0x4adc41
cmp edi, esi
jne 0x4adc1a
push ecx
call fcn.004e5a9d
pop ecx
mov ecx, eax
mov edx, ecx
lea ebx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 8]
jne 0x4adc1f
sub edx, ebx
sar edx, 1
lea eax, [edx*2 + 2]
push eax
push ecx
push edi
call fcn.004f5d30
add esp, 0xc
xor ebx, ebx
push esi
call fcn.004e5a9d
pop ecx
pop edi
test eax, eax
je 0x4adc59
cmp word [eax], bx
je 0x4adc59
movzx eax, word [esi]
jmp 0x4adc60
xor eax, eax
mov word [esi], ax
mov eax, ebx
movzx eax, ax
jmp 0x4adc6a
xor eax, eax
mov word [esi], ax
test ax, ax
jne 0x4adc78
push esi
call fcn.004e1bea
pop ecx
mov esi, ebx
mov eax, esi
pop ebx
pop esi
leave
ret 8
Function at 0x4add75
Capabilities:
Persist via command processor registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push 0x96b
push dword [esi + 4]
call fcn.0043936b
pop ecx
pop ecx
movzx eax, al
xor ebx, ebx
mov dword [ebp - 0x314], eax
lea eax, [ebp - 0x310]
push eax
push 0x2001f
push ebx
push str.SoftwareMicrosoftCommand_Processor
push SysReAllocString
mov dword [ebp - 0x318], ebx
mov dword [ebp - 0x310], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4adf84
push edi
mov edi, ebx
cmp byte [ebp + 8], bl
je 0x4adef8
push 1
push dword [ebp - 0x310]
mov ecx, esi
call fcn.004adb11
mov esi, eax
mov eax, dword [0x5a22a0]
add eax, 0xea4
mov ebx, esi
push eax
lea eax, [ebp - 0x30c]
push str.__sCmd_Autorun.cmd
push eax
call fcn.004adab2
xor eax, eax
push eax
lea eax, [ebp - 0x30a]
push eax
call fcn.004e2e74
add esp, 0x14
test al, al
je 0x4aded8
cmp dword [ebp - 0x314], edi
mov ecx, 0x524d9c
mov eax, str.____GHWNDNEW_
cmove eax, ecx
push eax
push 0x184
lea eax, [ebp - 0x30c]
push eax
call fcn.004019cd
test esi, esi
jne 0x4ade60
lea ebx, [ebp - 0x30c]
jmp 0x4adf1c
lea ecx, [ebp - 0x30c]
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4ade6b
sub ecx, edx
mov edx, esi
sar ecx, 1
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, word [ebp - 0x318]
jne 0x4ade7f
sub edx, edi
sar edx, 1
lea eax, [edx + 5]
add eax, ecx
mov dword [ebp - 0x314], eax
add eax, eax
push eax
call fcn.004e1c0a
mov edi, eax
pop ecx
test edi, edi
je 0x4adf1c
mov ebx, dword [ebp - 0x314]
lea eax, [ebp - 0x30c]
push eax
push ebx
push edi
call fcn.00401a0b
push 0x55dcd0
push ebx
push edi
call fcn.004019cd
push esi
push ebx
push edi
call fcn.004019cd
mov ebx, edi
jmp 0x4adf1c
push 1
push dword [0x5a2c8c]
lea eax, [ebp - 0x30c]
push str.File_not_found
push 0x10
push eax
call fcn.00421ef1
add esp, 0x14
jmp 0x4adf12
cmp byte [ebp + 0xc], bl
je 0x4adf01
mov esi, ebx
jmp 0x4adf12
push 1
push dword [ebp - 0x310]
mov ecx, esi
call fcn.004adb11
mov esi, eax
test esi, esi
mov ebx, 0x514870
cmovne ebx, esi
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x318]
jne 0x4adf21
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
xor eax, eax
push eax
push str.AutoRun
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x310]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4adf78
cmp edi, esi
je 0x4adf78
lea eax, [ebp - 0x30c]
cmp edi, eax
je 0x4adf78
push edi
call fcn.004e1bea
pop ecx
pop edi
test esi, esi
je 0x4adf84
push esi
call fcn.004e1bea
pop ecx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret 8
Function at 0x4ef06b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x84
mov eax, 0x513226
call fcn.004f41e2
mov eax, dword [ebp + 8]
or esi, 0xffffffff
and dword [ebp - 0x78], 0
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x90], eax
mov byte [ebp - 0x6d], 1
call fcn.004e3cd3
mov cl, al
xor ebx, ebx
xor edi, edi
mov byte [ebp - 0x6e], cl
test cl, cl
setne bl
inc ebx
cmp byte [ebp - 0x6d], 0
je 0x4ef1ba
mov eax, 0x20019
test cl, cl
je 0x4ef0d6
test edi, edi
mov eax, 0x20119
mov ecx, 0x20219
cmove eax, ecx
lea ecx, [ebp - 0x78]
push ecx
push eax
push 0
push dword [ebp - 0x88]
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ef1ae
lea ecx, [ebp - 0x6c]
call fcn.004e25a1
and dword [ebp - 4], 0
lea ecx, [ebp - 0x6c]
push 0x4000
call fcn.004e2851
xor edx, edx
mov dword [ebp - 0x84], eax
push edx
push edx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x80], edx
push ecx
push edx
lea ecx, [ebp - 0x74]
push ecx
push eax
push edx
jmp 0x4ef17a
inc dword [ebp - 0x80]
mov eax, 0x3fff
inc esi
mov ecx, eax
cmp dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x84]
cmovb ecx, dword [ebp - 0x74]
xor edx, edx
mov word [eax + ecx*2], dx
mov ecx, dword [ebp - 0x90]
test ecx, ecx
je 0x4ef168
push dword [ebp + 0x14]
push dword [ebp - 0x7c]
push eax
push dword [ebp - 0x78]
call ecx
test al, al
je 0x4ef195
mov eax, dword [ebp - 0x84]
xor edx, edx
lea ecx, [ebp - 0x7c]
push edx
push edx
push ecx
push edx
lea ecx, [ebp - 0x74]
push ecx
mov ecx, dword [ebp - 0x80]
push eax
push ecx
push dword [ebp - 0x78]
mov dword [ebp - 0x74], 0x3fff
mov dword [ebp - 0x7c], edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test esi, esi
je 0x4ef12a
jmp 0x4ef199
mov byte [ebp - 0x6d], 0
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.004e25e0
mov cl, byte [ebp - 0x6e]
inc edi
cmp edi, ebx
jl 0x4ef0b4
mov eax, esi
call fcn.004f418c
ret
Function at 0x4f3cbb
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test eax, eax
je 0x4f3cf0
push eax
push 0x522fc8
lea eax, [ebp - 0x24]
push 0x10
push eax
call fcn.004e1e5a
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
jmp 0x4f3cf2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004f4166
leave
ret

Function at 0x4f3d06
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
push str.ConEmuHWND
call fcn.004f3cbb
pop ecx
pop ecx
test esi, esi
je 0x4f3d56
and dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
push 0x521bcc
push 0x10
push eax
call fcn.004e1e5a
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
jmp 0x4f3d58
push 0
push str.ConEmuPID
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004f4166
leave
ret
Function at 0x4017f0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x41d054]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x120], 0x3e8
cmp byte [0x420571], bl
jne 0x40189d
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
mov ecx, dword [0x420ea4]
lea edx, [ebp - 0x124]
push edx
push ebx
push ebx
lea eax, [ebp - 0x114]
push eax
push ebx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x114], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x40187b
cmp eax, ebx
jne 0x40186c
push 0x64
call esi
jmp 0x401871
cmp eax, 1
je 0x4018b2
cmp byte [0x420571], bl
je 0x401830
jmp 0x40189d
mov ecx, dword [0x420ea4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [0x420ea4]
push 1
push edx
call dword [sym.imp.WS2_32.dll_shutdown]
mov byte [0x41f7d8], bl
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040a942
mov esp, ebp
pop ebp
ret 4
xor edi, edi
mov dword [ebp - 0x118], 4
xor esi, esi
cmp byte [0x420571], bl
jne 0x40198b
lea esp, [esp]
mov eax, dword [0x420ea4]
lea ecx, [ebp - 0x12c]
push ecx
push ebx
push ebx
lea edx, [ebp - 0x114]
mov dword [ebp - 0x110], eax
mov eax, 1
push edx
push ebx
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, ebx
jne 0x401924
inc edi
cmp edi, 5
jg 0x4019a0
cmp byte [0x420571], bl
je 0x4018d0
jmp 0x40189d
cmp byte [0x420571], bl
jne 0x40189d
mov ecx, dword [0x420ea4]
lea eax, [ebp - 0x114]
push eax
push ecx
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x40197f
mov eax, dword [ebp - 0x11c]
mov ecx, dword [0x420ea4]
push ebx
mov edx, 0x2b0
sub edx, esi
push edx
add eax, esi
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, ebx
jle 0x401975
add esi, eax
sub dword [ebp - 0x118], eax
jmp 0x40197f
jl 0x40187b
cmp eax, ebx
je 0x4019ba
cmp dword [ebp - 0x118], ebx
jg 0x4018c0
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0040a942
mov esp, ebp
pop ebp
ret 4
mov edx, dword [0x420ea4]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [0x420ea4]
push 1
push eax
jmp 0x401891
mov eax, dword [0x420ea4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [0x420ea4]
push 1
push ecx
jmp 0x401891
Function at 0x4019e0
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x41d054]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_select]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x118], eax
xor esi, esi
lea esp, [esp]
mov eax, dword [0x420ea4]
lea ecx, [ebp - 0x120]
push ecx
push 0
lea edx, [ebp - 0x114]
push edx
mov dword [ebp - 0x110], eax
push 0
inc eax
push eax
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0x96
call ebx
test eax, eax
jne 0x401a70
cmp byte [0x420571], al
je 0x401a10
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040a942
mov esp, ebp
pop ebp
ret 4
cmp byte [0x420571], 0
jne 0x401a5b
test eax, eax
js 0x401a5b
cmp eax, 1
jg 0x401a5b
mov ecx, dword [0x420ea4]
lea eax, [ebp - 0x114]
push eax
push ecx
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x401abc
mov eax, dword [ebp - 0x118]
mov ecx, dword [0x420ea4]
push 0
mov edx, 0x2b0
sub edx, esi
push edx
add eax, esi
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
je 0x401a5b
cmp edi, 0xffffffff
je 0x401a5b
add esi, edi
cmp esi, 0x2b0
jb 0x401a10
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0040a942
mov esp, ebp
pop ebp
ret 4

Function at 0x401af0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x420ea4], eax
cmp eax, 0xffffffff
je 0x401b79
xor eax, eax
mov dword [0x420e90], eax
mov dword [0x420e94], eax
mov dword [0x420e98], eax
mov dword [0x420e9c], eax
mov eax, 2
push 0x7f000001
mov word [0x420e90], ax
call dword [sym.imp.WS2_32.dll_htonl]
push 0x176b
mov dword [0x420e94], eax
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [0x420ea4]
push 0x10
push 0x420e90
push ecx
mov word [0x420e92], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x401b7c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x420ea4]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
xor al, al
ret
mov al, 1
ret
Function at 0x401e10
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
mov eax, dword [0x41d054]
xor eax, esp
mov dword [esp + 0x258], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x104
lea ecx, [esp + 0x15c]
push ecx
push 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x401f46
lea edx, [esp + 0x158]
push 0x5c
push edx
call fcn.0040ac30
add esp, 8
test eax, eax
je 0x401f46
mov byte [eax], 0
lea eax, [esp + 0x158]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401e80
sub eax, edx
cmp byte [esp + eax + 0x157], 0x5c
je 0x401eb1
lea edi, [esp + 0x158]
dec edi
jmp 0x401ea0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401ea0
mov ax, word [0x41a3c8]
mov word [edi], ax
lea eax, [esp + 0x158]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x401ec0
mov ecx, dword [str..dsm]
mov dx, word [0x41a3d0]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x15c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401f46
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x44]
push edx
push 0
push 0x143
push eax
call edi
inc dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push esi
call ebx
test eax, eax
jne 0x401f01
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x258]
xor ecx, esp
call fcn.0040a942
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esp + 0x264]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040a942
mov esp, ebp
pop ebp
ret 4
Function at 0x4021f0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esi + 0x2e4]
test eax, eax
je 0x402206
push eax
mov eax, dword [esi + 0x2d0]
call eax
add esp, 4
mov eax, dword [esi + 0x2e8]
test eax, eax
je 0x40221c
mov ecx, dword [esi + 0x2d0]
push eax
call ecx
add esp, 4
mov edx, dword [esi + 0x2b8]
mov dword [esi + 0x2e4], 0
mov dword [esi + 0x2e8], 0
mov byte [esi + 8], 0
call edx
test eax, eax
je 0x402269
mov eax, dword [esi + 0x1ac]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
lea eax, [esi + 0x1b0]
setne bl
cmp byte [eax], 0
je 0x402265
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, bl
pop ebx
ret
xor al, al
ret
Function at 0x403000
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x41d054]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x4030b2
push ebx
push esi
push 0xf01ff
push str.ssdpsrv
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x4030ad
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4030aa
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, 6
ja case.default.0x40305e
jmp dword [eax*4 + 0x4030c4]
push str.UPnP_service:_Start_pending
jmp 0x4030a2
push str.UPnP_service:Stop_pending
jmp 0x4030a2
push str.UPnP_service:Pause_pending
jmp 0x4030a2
push str.UPnP_service:Continue_pending
jmp 0x4030a2
mov byte [0x4204e0], 1
push str.UPnP_service:Running
jmp 0x4030a2
push str.UPnP_service:Stopped
jmp 0x4030a2
push str.UPnP_service:Paused
jmp 0x4030a2
push str.UPnP_service:_Fatal_Error
call fcn.00403500
add esp, 4
push esi
call ebx
push edi
call ebx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0040a942
mov esp, ebp
pop ebp
ret