joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406be0
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40ea19
push eax
mov dword fs:[0], esp
sub esp, 0x63c
xor eax, eax
push ebx
mov ebx, ecx
push ebp
push esi
lea ebp, [ebx + 0x298]
push edi
mov ecx, 0x20
mov edi, ebp
mov dword [ebx + 0x290], 0
mov dword [ebx + 0x294], 0x20c
rep stosd dword es:[edi], eax
lea edi, [ebx + 0x318]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x660]
cmp edi, 2
jl 0x406cfc
mov esi, dword [esp + 0x65c]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
cmp eax, 0x209
mov dword [ebx + 0x294], eax
je 0x406cc4
cmp eax, 0x20e
je 0x406cc4
cmp eax, 0x20b
jne 0x406c77
mov edi, dword [esi + 8]
jmp 0x406cdf
cmp eax, 0x20a
jne 0x406cfc
mov edi, dword [esi + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
lea edi, [ebx + 0x318]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll___p___argv]
mov ecx, dword [eax]
lea eax, [ebx + 0x520]
mov edx, dword [ecx + 0xc]
push edx
push 0x417668
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
jmp 0x406cfc
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
cmp edi, 4
mov dword [ebx + 0x290], eax
jl 0x406cfc
mov edi, dword [esi + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x294]
pop edi
pop esi
pop ebp
cmp eax, 0x20c
pop ebx
jne 0x406e31
push 0
push str.LicenseOK.dat
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
je 0x406e31
push 0
lea ecx, [esp + 4]
call fcn.00403fd0
lea ecx, [esp]
mov dword [esp + 0x644], 0
call sub.MFC42.DLL_CDialog::DoModal
cmp eax, 1
je 0x406db9
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0x5f8]
mov dword [esp + 0x644], 5
call sub.MFC42.DLL_CWnd::CWnd
lea ecx, [esp + 0x44c]
mov byte [esp + 0x644], 4
call fcn.00405560
lea ecx, [esp + 0x2a0]
mov byte [esp + 0x644], 3
call fcn.00405560
lea ecx, [esp + 0xf4]
mov byte [esp + 0x644], 2
call fcn.00405560
mov byte [esp + 0x644], 1
jmp 0x406e14
lea ecx, [esp + 0x5f8]
mov dword [esp + 0x644], 0xa
call sub.MFC42.DLL_CWnd::CWnd
lea ecx, [esp + 0x44c]
mov byte [esp + 0x644], 9
call fcn.00405560
lea ecx, [esp + 0x2a0]
mov byte [esp + 0x644], 8
call fcn.00405560
lea ecx, [esp + 0xf4]
mov byte [esp + 0x644], 7
call fcn.00405560
mov byte [esp + 0x644], 6
lea ecx, [esp + 0x60]
call fcn.004086f0
lea ecx, [esp]
mov dword [esp + 0x644], 0xffffffff
call fcn.0040dd7a
mov ecx, dword [esp + 0x63c]
mov dword fs:[0], ecx
add esp, 0x648
ret 8
Function at 0x406e90
Capabilities:
Terminate process

Disassembly:
mov al, byte [esp + 8]
push esi
mov esi, ecx
cmp al, 1
mov eax, dword [esi + 0x290]
jne 0x406ed4
test eax, eax
je 0x406eb5
push 0
push 0
push 0x471
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esi + 0x294]
cmp eax, 0x20b
je 0x406ec9
cmp eax, 0x20d
jne 0x406f1c
push 0
push 0
push 0x4176a4
jmp 0x406f17
test eax, eax
je 0x406efa
mov ecx, dword [esi + 0x294]
push 0
cmp ecx, 0x20e
jne 0x406eec
push 2
jmp 0x406eee
push 1
push 0x471
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esi + 0x294]
cmp eax, 0x20b
je 0x406f0e
cmp eax, 0x20d
jne 0x406f1c
push 0
push 0
push 0x417680
call sub.MFC42.DLL_AfxMessageBox_1
mov eax, dword [esi + 0x294]
cmp eax, 0x20c
je 0x406f30
cmp eax, 0x20d
jne 0x406f37
mov ecx, esi
call fcn.00406f50
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret 8

Function at 0x406f50
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
xor esi, esi
push 0xfffffffffffffff6
mov dword [esp + 0x1c], 0x44
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x48], 0x100
mov word [esp + 0x4c], si
mov dword [esp + 0x50], esi
mov word [esp + 0x4e], si
call edi
push 0xfffffffffffffff5
mov dword [esp + 0x54], eax
call edi
push 0xfffffffffffffff4
mov dword [esp + 0x58], eax
call edi
mov dword [esp + 0x58], eax
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.Lobby.run
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x406fe3
push esi
push esi
push 0x4176f0
call sub.MFC42.DLL_AfxMessageBox_1
pop edi
pop esi
add esp, 0x54
ret

Function at 0x4071a0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 8]
push eax
push 0
push esi
push 0x4071c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
pop esi
ret
Function at 0x407c00
Capabilities:
Terminate process

Disassembly:
sub esp, 0x6c
mov eax, dword [str.prog]
mov cl, byte [0x417900]
mov dword [esp], eax
mov eax, dword [esp + 0x74]
test eax, eax
mov byte [esp + 4], cl
jne 0x407c22
lea eax, [esp]
test byte [0x417878], 2
je 0x407cd9
test byte [0x417880], 1
je 0x407c85
push 0x4178f8
push eax
lea edx, [esp + 0x10]
push str._s._s
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esp + 0x18]
push 0x4178ec
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 0x18
mov dword [0x4178b8], eax
test eax, eax
jne 0x407cd9
lea ecx, [esp + 8]
push ecx
push str.cant_create_log_file__file_name:_s_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
push 0xffffffffffffffff
call dword [sym.imp.MSVCRT.dll_exit]
push esi
mov esi, dword [esp + 0x74]
push 0x4178f8
mov edx, dword [esi]
push edx
push eax
lea eax, [esp + 0x18]
push str._s_d._s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0x20]
push 0x4178ec
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 0x1c
mov dword [esi + 4], eax
test eax, eax
pop esi
jne 0x407cd9
lea edx, [esp + 8]
push edx
push str.cant_create_log_file__file_name:_s_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
push 0xffffffffffffffff
call dword [sym.imp.MSVCRT.dll_exit]
add esp, 0x6c
ret
Function at 0x408610
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x40ea9a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call sub.MFC42.DLL_CDC::CDC
xor edi, edi
mov eax, 0x40fb48
mov dword [esp + 0x18], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], eax
lea ecx, [esi + 0x34]
mov byte [esp + 0x18], 3
call sub.MFC42.DLL_CDC::CDC
lea ecx, [esi + 0x44]
mov byte [esp + 0x18], 4
call sub.MFC42.DLL_CDC::CDC
lea ebx, [esi + 0x74]
mov byte [esp + 0x18], 5
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_2
push edi
mov byte [esp + 0x1c], 6
mov dword [esi], 0x40fb90
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, esi
call sub.MFC42.DLL_CDC::Attach
mov ecx, ebx
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
call sub.MFC42.DLL_CString::Empty
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x78], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40a600
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x10
or eax, 0xffffffff
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
test edi, edi
je 0x40a7b2
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x40a7b2
mov ecx, dword [esp + 0x28]
mov eax, 0x55555556
imul ecx
mov eax, edx
mov esi, 3
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov ebx, edx
cdq
idiv esi
lea eax, [ebx*4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
lea esi, [eax + edx]
cmp dword [esp + 0x30], esi
jl 0x40a7af
test ebx, ebx
jle 0x40a703
lea esi, [ebp + 2]
add edi, 2
mov dword [esp + 0x14], ebx
mov dl, byte [edi - 2]
mov al, byte [edi - 1]
mov cl, dl
mov bl, al
and cl, 3
and al, 0xf
shl cl, 4
shr bl, 4
or cl, bl
mov bl, byte [edi]
mov byte [esp + 0x2c], bl
add edi, 3
shl al, 2
shr bl, 6
shr dl, 2
or al, bl
mov bl, byte [esp + 0x2c]
movsx edx, dl
mov byte [esp + 0x13], al
mov eax, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and bl, 0x3f
add esi, 4
mov dl, byte [edx + eax]
movsx eax, cl
mov byte [esi - 6], dl
mov ecx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov dl, byte [eax + ecx]
movsx eax, byte [esp + 0x13]
mov byte [esi - 5], dl
mov ecx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov dl, byte [eax + ecx]
movsx eax, bl
mov byte [esi - 4], dl
mov ecx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov dl, byte [eax + ecx]
mov eax, dword [esp + 0x14]
mov byte [esi - 3], dl
dec eax
mov dword [esp + 0x14], eax
jne 0x40a66e
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
cmp edx, 1
jne 0x40a73d
mov cl, byte [ecx + edi - 1]
mov esi, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov dl, cl
shr cl, 2
movsx ecx, cl
and dl, 3
mov cl, byte [ecx + esi]
shl dl, 4
movsx edx, dl
mov byte [eax + ebp], cl
mov ecx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc eax
mov dl, byte [edx + ecx]
mov byte [eax + ebp], dl
inc eax
mov byte [eax + ebp], 0x3d
jmp 0x40a797
cmp edx, 2
jne 0x40a79d
mov bl, byte [ecx + edi - 2]
mov cl, byte [ecx + edi - 1]
mov byte [esp + 0x24], bl
mov dl, cl
and bl, 3
mov edi, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr dl, 4
shl bl, 4
or dl, bl
mov bl, byte [esp + 0x24]
shr bl, 2
movsx esi, bl
movsx edx, dl
mov bl, byte [esi + edi]
and cl, 0xf
mov byte [eax + ebp], bl
mov esi, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shl cl, 2
mov dl, byte [edx + esi]
inc eax
movsx ecx, cl
mov byte [eax + ebp], dl
mov edx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc eax
mov cl, byte [ecx + edx]
mov byte [eax + ebp], cl
inc eax
mov byte [eax + ebp], 0x3d
inc eax
cmp dword [esp + 0x30], eax
jle 0x40a7b2
pop edi
mov byte [eax + ebp], 0
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x406810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
dec ecx
jne 0x40681f
std
loopne 0x406880
inc eax
add byte [esi - 0x56], dl
push es
push eax
call 0xfff65640
push esi
call fcn.004066e0
sub ecx, 2
pop esi
pop ebp
push 0xd5904604
nop
nop
imul edx, dword [eax - 0x6f6f6f70], 0x55909090
mov ebp, esp
sub esp, 0x28a
push ebx
mov esp, dword [eax + 8]
push ds
out 0x8b, eax
inc ebx
add al, 0x83
clc
dec dword [edi]
test byte [esp + 0x208b0000], dl
adc byte [ebp - 0x767bff37], al
add dword [eax], eax
add byte [eax + ecx*2], ch
or al, 0xc3
dec esi
adc al, 0x8d
push esi
mov ss, word [ecx + 0x52]
cmp edi, edi
sbb dword [ecx + eax*8 - 0x77c9dc0], esp
dec dword [edi]
test dword [ebp - 0xaffffff], esp
ret
add ch, dh
xor eax, sym.imp.WSOCK32.dll_WSAGetLastError
call esi
test eax, eax
je 0x40698a
jp 0x406869
into
xor byte [edx], 0xa
add byte [0x7b0b23b3], bh
jne 0x96daf4
test dword [ecx + 0x72], edx
push esi
invalid
mov edi, dword [ebx + 0x20]
mov edi, dword [eax]

Function at 0x406e60
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x406e62
ret

Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov eax, dword [ecx - 0x74f7ba75]
add byte [eax*4 - 0x74cc3d40], dl
dec ebp
or al, 0x51
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
sbb eax, 0x358b561e
enter 0x4064, 0xffffffffffffffda
aam 0xd6
test dword [edx + 0x75], edx
add eax, 0x23c25d5e
add byte [ebx - 0x2a], bl
add eax, 0xafcff
dec esp
pop ebp
xor al, 8
push es
xor eax, eax
pop ebp
cmp byte [eax], cl
add byte [eax + 0x944e3b], bh
pop ebp
ret 8

Function at 0x40a4e7
Capabilities:
Check os version

Disassembly:
or al, 0x8b
dec ebp
adc al, 0x85
sal byte [edx + eax + 9], 0xab
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x40a503
push ecx
call int.0040a424
add esp, 0xe
mov dword [edx], eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [esi + 0x14], 0
jae 0x40a58b
adc dword [ecx], eax
add byte [esi + 0x5d], bl
push ecx
adc byte [eax], al
cmp eax, 0x102
inc esi
or bh, byte [eax + 0x11176]
adc byte [ebp - 0x3e], bl
adc byte [eax], al
dec esp
xor eax, 0x1c406b98
call esi
add eax, 0x75
add eax, 0x10c25d5e
add bh, bh
push edi
retf 0xf17d
Function at 0x402800
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x40282f
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403574
jmp 0x40284d
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402728
mov edi, eax
test ebx, ebx
je 0x40284d
cmp dword [esi], 0
je 0x40284d
dec ebx
jmp 0x402836
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4029b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402a48
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402a28
xor eax, eax
push ebp
push 0x402a21
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402a64
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402a28
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x403440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.004025d0
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x425041], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403408
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x404778
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404934
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4047d9
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404950
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40484b
xor eax, eax
push ebp
push 0x404844
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.004045d0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40482d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404970
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40484b
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40492c
cmp byte [ebp - 0xd], 0
jne 0x40488d
cmp byte [ebp - 0x12], 0
je 0x40492c
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4048a6
dec ebx
cmp byte [ebx], 0x2e
je 0x4048b5
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4048a5
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40492c
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4048e2
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40492c
cmp byte [ebp - 0xd], 0
je 0x40492c
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40492c
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408ab4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408aed
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403574
jmp 0x408af6
mov eax, ebx
mov edx, esi
call fcn.004034e0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x408b00
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x408b21
mov al, byte [esp]
jmp 0x408b23
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40e4a0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x40e4b5
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x40ecd8
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov esi, edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x40ee01
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov bl, byte [ebp - 1]
cmp dword [ebx*4 + 0x42434c], 0xffffffff
je 0x40ede6
call fcn.00407e58
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 0xc]
mov eax, 0x40ee18
call fcn.00408a54
push dword [ebp - 0xc]
push esi
push 0x40ee38
lea eax, [ebp - 8]
mov edx, 3
call fcn.004037cc
lea eax, [ebx + ebx*2]
lea eax, [eax*8 + 0x425668]
push eax
call sub.kernel32.dll_EnterCriticalSection_1
xor edx, edx
push ebp
push 0x40eddf
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx*4 + 0x42434c]
mov ecx, 1
xor edx, edx
call fcn.0040701c
cmp eax, 0xffffffff
je 0x40ed97
cmp eax, 0x1e8480
jle 0x40ed97
xor ebx, ebx
mov bl, byte [ebp - 1]
mov eax, dword [ebx*4 + 0x42434c]
xor ecx, ecx
xor edx, edx
call fcn.0040701c
mov eax, dword [ebx*4 + 0x42434c]
push eax
call sub.kernel32.dll_SetEndOfFile_1
mov eax, dword [ebp - 8]
call fcn.0040370c
push eax
lea eax, [ebp - 8]
call fcn.004038dc
mov edx, eax
xor eax, eax
mov al, byte [ebp - 1]
mov eax, dword [eax*4 + 0x42434c]
pop ecx
call fcn.00406ff0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ede6
xor eax, eax
mov al, byte [ebp - 1]
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x425668]
push eax
call sub.kernel32.dll_LeaveCriticalSection_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40ee08
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004034b0
ret

Function at 0x40fd38
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
cmp byte [0x4256e8], 0
jne 0x40fd73
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x40fd6c
mov ecx, 0x40fd84
mov dl, 1
mov eax, dword [0x4060f0]
call fcn.00409230
call fcn.00402ed8
mov byte [0x4256e8], 1
add esp, 0x190
ret

Function at 0x4100a0
Capabilities:
Get hostname

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, 0x4100f0
call fcn.004034e0
cmp dword [ebx + 0x78], 0xffffffff
je 0x4100df
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x4100df
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.004036bc
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x4100f8
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.0040348c
cmp dword [ebx + 0x78], 0xffffffff
je 0x41013a
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x78]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x41013a
push dword [esp + 8]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, esi
call fcn.00403644
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x410a68
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebp, ecx
mov edi, edx
mov ebx, eax
xor esi, esi
cmp byte [ebx + 8], 1
jne 0x410ac3
mov eax, esp
xor ecx, ecx
mov edx, 0x10
call fcn.00402880
mov word [esp], 2
mov ax, word [ebx + 0x9c]
push eax
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x94]
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push 0
push ebp
push edi
mov eax, dword [ebx + 0x78]
push eax
call sub.wsock32.dll_sendto
jmp 0x410ad2
push ebp
push 0
mov ecx, edi
mov edx, dword [ebx + 0x78]
mov eax, ebx
call fcn.0040fd08
test eax, eax
jle 0x410adf
mov esi, eax
xor eax, eax
mov dword [ebx + 0x48], eax
jmp 0x410af0
inc eax
jne 0x410af0
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov eax, ebx
call fcn.00410d24
mov eax, esi
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret