joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d50
Capabilities:
Hash data using crc32b

Disassembly:
push esi
xor ecx, ecx
xor eax, eax
push ebx
xor ebx, ebx
jmp 0x401d95
mov eax, ecx
mov ebx, ecx
shl eax, 0x19
mov edx, eax
xor edx, 0x4c11db7
test cl, 0x80
cmovne eax, edx
lea edx, [eax + eax]
mov esi, edx
xor esi, 0x4c11db7
test eax, eax
cmovs edx, esi
lea eax, [edx + edx]
mov esi, eax
xor esi, 0x4c11db7
test edx, edx
cmovs eax, esi
lea edx, [eax + eax]
mov esi, edx
xor esi, 0x4c11db7
test eax, eax
cmovs edx, esi
lea eax, [edx + edx]
mov esi, eax
xor esi, 0x4c11db7
test edx, edx
cmovs eax, esi
lea edx, [eax + eax]
mov esi, edx
xor esi, 0x4c11db7
test eax, eax
cmovs edx, esi
lea eax, [edx + edx]
mov esi, eax
xor esi, 0x4c11db7
test edx, edx
cmovs eax, esi
lea edx, [eax + eax]
mov esi, edx
xor esi, 0x4c11db7
test eax, eax
cmovs edx, esi
add ecx, 1
mov dword [ebx*4 + 0x450080], edx
cmp ecx, 0x100
jne 0x401d60
movzx eax, word [0x42c988]
movzx edx, byte [eax + 0x42ce50]
xor dl, byte [eax + 0x42c980]
mov byte [0x450060], dl
movzx edx, byte [eax + 0x42ce51]
lea eax, [edx + eax + 0x4d1]
movzx edx, byte [eax + 0x42c9a1]
xor dl, byte [eax + 0x42c980]
mov byte [0x450061], dl
movzx edx, byte [eax + 0x42c9a2]
lea eax, [edx + eax + 0x22]
movzx edx, byte [eax + 0x42d0aa]
xor dl, byte [eax + 0x42c980]
mov byte [0x450062], dl
movzx edx, byte [eax + 0x42d0ab]
lea eax, [edx + eax + 0x72b]
movzx edx, byte [eax + 0x42cacb]
xor dl, byte [eax + 0x42c980]
mov byte [0x450063], dl
movzx edx, byte [eax + 0x42cacc]
lea eax, [edx + eax + 0x14c]
movzx edx, byte [eax + 0x42ca73]
xor dl, byte [eax + 0x42c980]
mov byte [0x450064], dl
movzx edx, byte [eax + 0x42ca74]
lea eax, [edx + eax + 0xf4]
movzx edx, byte [eax + 0x42ca0a]
xor dl, byte [eax + 0x42c980]
mov byte [0x450065], dl
movzx edx, byte [eax + 0x42ca0b]
lea eax, [edx + eax + 0x8b]
movzx ecx, byte [eax + 0x42c988]
movzx edx, byte [eax + 0x42c987]
xor dl, byte [eax + 0x42c980]
mov byte [0x450066], dl
movzx edx, byte [ecx + eax + 0x42cc46]
xor dl, byte [ecx + eax + 0x42c988]
mov byte [0x450067], dl
pop ebx
pop esi
ret

Function at 0x401f50
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
test eax, eax
jle 0x401fd0
sub eax, 1
shr eax, 2
lea ebx, [edx + eax*4 + 4]
mov eax, dword [esp + 0xc]
lea esi, [esi]
movzx esi, byte [edx + 3]
mov ecx, eax
shr eax, 0x18
add edx, 4
shl ecx, 8
xor eax, esi
movzx esi, byte [edx - 2]
xor ecx, dword [eax*4 + 0x450080]
mov eax, ecx
shr ecx, 0x18
xor ecx, esi
shl eax, 8
movzx esi, byte [edx - 3]
xor eax, dword [ecx*4 + 0x450080]
mov ecx, eax
shr eax, 0x18
xor eax, esi
shl ecx, 8
movzx esi, byte [edx - 4]
xor ecx, dword [eax*4 + 0x450080]
mov eax, ecx
shr ecx, 0x18
xor ecx, esi
shl eax, 8
xor eax, dword [ecx*4 + 0x450080]
cmp edx, ebx
jne 0x401f70
pop ebx
pop esi
ret
mov eax, dword [esp + 0xc]
pop ebx
pop esi
ret
Function at 0x407230
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
movzx eax, word [0x450060]
movzx edx, word [0x450062]
mov byte [0x4506c2], 8
lea edi, [esp + 0x2c]
mov dword [esp + 8], 4
shl eax, 0x10
mov dword [esp + 4], edi
or eax, edx
mov dword [esp], 0xffffffff
add eax, 1
mov dword [esp + 0x2c], eax
movzx eax, word [0x44a000]
mov word [0x4506c0], ax
mov eax, dword [esp + 0x54]
mov byte [0x4506c3], al
call fcn.00401f50
mov dword [esp + 8], 4
mov dword [esp + 4], 0x4506c0
mov dword [esp], eax
call fcn.00401f50
mov dword [0x4506c4], eax
imul eax, dword [esp + 0x50], 0xa48
mov edx, dword [eax + 0x450a00]
lea ebp, [eax + 0x22c]
lea esi, [eax + 0x4509ec]
test edx, edx
jne 0x407350
imul ebx, dword [esp + 0x50], 0xa48
mov dword [ebp + 0x4507c0], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [ebx + 0x4509d4]
mov dword [esp + 0x10], esi
mov dword [ebx + 0x4509fc], eax
movzx eax, byte [0x4506c2]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x4509cc]
add ebx, 0x4507c0
mov dword [esp + 4], 0x4506c0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x4073a0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [eax + 0x4507c0]
mov eax, dword [eax + 0x4509cc]
mov dword [esp + 0xc], 1
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [ebx + 0x214]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x240], 0
sub esp, 4
jmp 0x4072c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40733e
mov dword [ebx + 0x240], 1
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x407720
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
movzx eax, word [0x450060]
movzx edx, word [0x450062]
mov dword [0x4506c0], 0x60c55aa
lea edi, [esp + 0x2c]
mov dword [esp + 8], 4
shl eax, 0x10
mov dword [esp + 4], edi
or eax, edx
mov dword [esp], 0xffffffff
add eax, 1
mov byte [0x4506c5], 0
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x54]
mov byte [0x4506c4], al
xor eax, eax
mov word [0x4506c6], ax
call fcn.00401f50
mov dword [esp + 8], 8
mov dword [esp + 4], 0x4506c0
mov dword [esp], eax
call fcn.00401f50
mov dword [0x4506c8], eax
imul eax, dword [esp + 0x50], 0xa48
mov edx, dword [eax + 0x450a00]
lea ebp, [eax + 0x22c]
lea esi, [eax + 0x4509ec]
test edx, edx
jne 0x407840
imul ebx, dword [esp + 0x50], 0xa48
mov dword [ebp + 0x4507c0], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [ebx + 0x4509d4]
mov dword [esp + 0x10], esi
mov dword [ebx + 0x4509fc], eax
movzx eax, byte [0x4506c2]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x4509cc]
add ebx, 0x4507c0
mov dword [esp + 4], 0x4506c0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x407890
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [eax + 0x4507c0]
mov eax, dword [eax + 0x4509cc]
mov dword [esp + 0xc], 1
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [ebx + 0x214]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x240], 0
sub esp, 4
jmp 0x4077be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x407833
mov dword [ebx + 0x240], 1
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4078b0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
movzx edx, word [0x450060]
movzx eax, word [0x450062]
mov dword [0x4506c0], 0x80c55aa
mov ecx, dword [esp + 0x54]
shl edx, 0x10
or edx, eax
add edx, 1
mov dword [esp + 0x2c], edx
cmp ecx, 0x37
jg 0x407a08
mov eax, 0x92492493
imul ecx
mov eax, ecx
sar eax, 0x1f
add edx, ecx
sar edx, 2
sub edx, eax
lea esi, [edx*8]
mov eax, edx
sub esi, edx
mov ebx, esi
sub ecx, ebx
lea edi, [esp + 0x2c]
mov dword [esp + 8], 4
mov dword [esp + 4], edi
mov dword [esp], 0xffffffff
mov byte [0x4506c4], al
mov eax, dword [esp + 0x58]
mov byte [0x4506c5], cl
mov byte [0x4506c6], 0
mov byte [0x4506c7], al
call fcn.00401f50
mov dword [esp + 8], 8
mov dword [esp + 4], 0x4506c0
mov dword [esp], eax
call fcn.00401f50
mov dword [0x4506c8], eax
imul eax, dword [esp + 0x50], 0xa48
mov edx, dword [eax + 0x450a00]
lea ebp, [eax + 0x22c]
lea esi, [eax + 0x4509ec]
lea ebx, [eax + 0x4507c0]
test edx, edx
jne 0x407a18
imul ebx, dword [esp + 0x50], 0xa48
mov dword [ebp + 0x4507c0], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [ebx + 0x4509d4]
mov dword [esp + 0x10], esi
mov dword [ebx + 0x4509fc], eax
movzx eax, byte [0x4506c2]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x4509cc]
add ebx, 0x4507c0
mov dword [esp + 4], 0x4506c0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x407a60
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ecx - 0x38]
mov ecx, 7
jmp 0x40790a
mov eax, dword [eax + 0x4509cc]
mov dword [esp + 0xc], 1
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [ebx + 0x214]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x240], 0
sub esp, 4
jmp 0x407986
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4079fb
mov dword [ebx + 0x240], 1
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x407d70
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
movzx eax, word [0x450060]
movzx edx, word [0x450062]
mov byte [0x4506c2], 0xc
lea edi, [esp + 0x2c]
mov dword [esp + 8], 4
shl eax, 0x10
mov dword [esp + 4], edi
or eax, edx
mov dword [esp], 0xffffffff
add eax, 1
mov byte [0x4506c7], 0
mov dword [esp + 0x2c], eax
movzx eax, word [0x44a000]
mov word [0x4506c0], ax
mov eax, dword [esp + 0x54]
mov byte [0x4506c3], al
mov eax, dword [esp + 0x58]
mov byte [0x4506c4], al
movzx eax, word [0x44a002]
mov word [0x4506c5], ax
call fcn.00401f50
mov dword [esp + 8], 8
mov dword [esp + 4], 0x4506c0
mov dword [esp], eax
call fcn.00401f50
mov dword [0x4506c8], eax
imul eax, dword [esp + 0x50], 0xa48
mov edx, dword [eax + 0x450a00]
lea ebp, [eax + 0x22c]
lea esi, [eax + 0x4509ec]
test edx, edx
jne 0x407ea0
imul ebx, dword [esp + 0x50], 0xa48
mov dword [ebp + 0x4507c0], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [ebx + 0x4509d4]
mov dword [esp + 0x10], esi
mov dword [ebx + 0x4509fc], eax
movzx eax, byte [0x4506c2]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x4509cc]
add ebx, 0x4507c0
mov dword [esp + 4], 0x4506c0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x407ef0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [eax + 0x4507c0]
mov eax, dword [eax + 0x4509cc]
mov dword [esp + 0xc], 1
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [ebx + 0x214]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x240], 0
sub esp, 4
jmp 0x407e22
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x407e97
mov dword [ebx + 0x240], 1
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x407f10
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
movzx eax, word [0x450060]
movzx edx, word [0x450062]
mov dword [0x4506c0], 0xc0c55aa
lea edi, [esp + 0x2c]
mov dword [esp + 8], 4
shl eax, 0x10
mov dword [esp + 4], edi
or eax, edx
mov dword [esp], 0xffffffff
add eax, 1
mov byte [0x4506c5], 0
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x54]
mov byte [0x4506c4], al
mov eax, dword [esp + 0x58]
mov word [0x4506c6], ax
call fcn.00401f50
mov dword [esp + 8], 8
mov dword [esp + 4], 0x4506c0
mov dword [esp], eax
call fcn.00401f50
mov dword [0x4506c8], eax
imul eax, dword [esp + 0x50], 0xa48
mov edx, dword [eax + 0x450a00]
lea ebp, [eax + 0x22c]
lea esi, [eax + 0x4509ec]
test edx, edx
jne 0x408030
imul ebx, dword [esp + 0x50], 0xa48
mov dword [ebp + 0x4507c0], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov eax, dword [ebx + 0x4509d4]
mov dword [esp + 0x10], esi
mov dword [ebx + 0x4509fc], eax
movzx eax, byte [0x4506c2]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x4509cc]
add ebx, 0x4507c0
mov dword [esp + 4], 0x4506c0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x408080
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [eax + 0x4507c0]
mov eax, dword [eax + 0x4509cc]
mov dword [esp + 0xc], 1
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [ebx + 0x214]
sub esp, 0x10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x240], 0
sub esp, 4
jmp 0x407fb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x408025
mov dword [ebx + 0x240], 1
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x409cd0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov eax, dword [0x450480]
mov edx, dword [esp + 0x168]
mov edi, dword [esp + 0x164]
lea ebx, [eax + 0x1af6]
test edx, edx
jne 0x409cfd
lea ebx, [eax + 0x1b19]
mov dword [esp], ebx
lea ebp, [esp + 0x3c]
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], ebp
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x160]
mov dword [esp + 0x10], 0
mov dword [esp + 4], ebx
mov dword [esp], eax
call esi
movzx eax, word [edi]
movzx ecx, word [edi + 2]
sub esp, 0x14
mov word [esp + 0x2e], ax
movzx eax, word [edi + 6]
cmp cx, 2
je 0x409e70
movzx ebx, cx
cmp ax, 0x1e
jbe 0x409d69
cmp cx, 0xb
ja 0x409d69
mov edx, 0xa50
bt edx, ecx
jb 0x409ec0
mov dword [esp + 0x18], eax
mov eax, dword [0x450480]
movzx ecx, word [esp + 0x2e]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
add eax, 0x1430
lea ebx, [esp + 0x40]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], ecx
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x100
call fcn.00409110
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x160]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp], eax
call esi
movzx eax, word [edi]
sub esp, 0x14
mov dword [esp + 0x14], eax
movzx eax, word [edi + 6]
mov dword [esp + 0x10], eax
movzx eax, word [edi + 2]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov eax, dword [0x450480]
mov dword [esp + 4], 0x100
add eax, 0x1454
mov dword [esp + 8], eax
call fcn.00409110
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x160]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp], eax
call esi
mov eax, dword [0x450480]
sub esp, 0x14
lea ebx, [eax + 0x1b3d]
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x160]
mov dword [esp + 4], ebx
mov dword [esp + 0x10], 0
mov dword [esp], eax
call esi
sub esp, 0x14
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ax, 0x1c
jbe 0x409eae
movzx eax, word [esp + 0x2e]
test al, 3
jne 0x409ea0
imul ax, ax, 0x5c29
mov ecx, eax
ror cx, 2
cmp cx, 0x28f
jbe 0x409ed8
mov eax, 0x1d
mov ecx, 0x1d
jmp 0x409eaa
mov eax, 0x1c
mov ecx, 0x1c
mov word [edi + 6], cx
mov ebx, 2
jmp 0x409d69
mov eax, 0x1e
mov word [edi + 6], ax
mov eax, 0x1e
jmp 0x409d69
ror ax, 4
cmp ax, 0xa4
mov ecx, eax
sbb eax, eax
not eax
add eax, 0x1d
cmp cx, 0xa4
sbb ecx, ecx
not ecx
add ecx, 0x1d
jmp 0x409eaa
Function at 0x41a080
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x3c
movzx eax, word [0x450060]
movzx edx, word [0x450062]
mov dword [0x458500], 0xff0c55aa
movzx ecx, byte [0x458480]
mov dword [esp + 8], 4
shl eax, 0x10
mov dword [esp], 0xffffffff
or eax, edx
movzx edx, byte [esp + 0x48]
shl ecx, 0x10
add eax, 1
mov dword [esp + 0x2c], eax
movzx eax, byte [esp + 0x40]
shl edx, 0x18
mov ah, byte [esp + 0x44]
movzx eax, ax
or eax, ecx
or eax, edx
mov dword [0x458504], eax
lea eax, [esp + 0x2c]
mov dword [esp + 4], eax
call fcn.00401f50
mov dword [esp + 8], 8
mov dword [esp + 4], 0x458500
mov dword [esp], eax
call fcn.00401f50
mov dword [esp + 0x14], 0x10
mov dword [0x458508], eax
movzx eax, byte [0x458502]
mov dword [esp + 0x10], 0x458d84
mov dword [esp + 8], eax
mov eax, dword [0x458d94]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x458500
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_sendto]
sub esp, 0x18
add esp, 0x3c
ret

Function at 0x41a150
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
sub esp, 0x38
movzx eax, word [0x450060]
movzx edx, word [0x450062]
mov dword [0x458500], 0xff2055aa
mov dword [esp + 0xc], 0x18
shl eax, 0x10
mov dword [esp + 8], 0x459040
or eax, edx
mov dword [esp + 4], 0x7c
add eax, 1
mov dword [esp], 0x458504
mov dword [esp + 0x2c], eax
call dword [0x42a308]
lea eax, [esp + 0x2c]
mov dword [esp + 8], 4
movzx ebx, byte [0x458502]
mov dword [esp + 4], eax
mov dword [esp], 0xffffffff
sub ebx, 4
call fcn.00401f50
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x458500
mov dword [esp], eax
call fcn.00401f50
mov ebx, dword [sym.imp.WS2_32.dll_sendto]
mov dword [esp + 0x14], 0x10
mov dword [0x45851c], eax
movzx eax, byte [0x458502]
mov dword [esp + 0x10], 0x458d84
mov dword [esp + 8], eax
mov eax, dword [0x458d94]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x458500
mov dword [esp], eax
call ebx
sub esp, 0x18
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], 0x458d84
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov eax, dword [0x458d94]
mov dword [esp], eax
call ebx
sub esp, 0x18
add esp, 0x38
pop ebx
ret
Function at 0x41a5e0
Capabilities:
Create thread
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push esi
push ebx
sub esp, 0x1c4
lea eax, [esp + 0x30]
mov byte [esp + 0x2f], 1
mov dword [esp + 4], eax
mov dword [esp], 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
jne 0x41a622
movzx eax, word [esp + 0x30]
cmp al, 2
jne 0x41a61c
shr ax, 8
cmp ax, 2
je 0x41a630
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
add esp, 0x1c4
pop ebx
pop esi
ret
mov dword [esp + 8], 0x11
mov dword [esp + 4], 2
mov dword [esp], 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x458d94], eax
sub esp, 0xc
cmp eax, 0xffffffff
je 0x41a61c
mov eax, 2
mov word [0x458d84], ax
movzx eax, word [0x456340]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [0x458d86], ax
mov eax, dword [0x456340]
sub esp, 4
test eax, eax
je 0x41a692
cmp eax, 0xffff
jle 0x41a720
mov dword [esp], 0xffffffff
call dword [sym.imp.WS2_32.dll_htonl]
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 4
mov dword [0x458d88], eax
mov eax, dword [0x458d94]
lea esi, [esp + 0x2f]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0xffff
mov dword [esp], eax
call ebx
sub esp, 0x14
cmp eax, 0xffffffff
je 0x41a7a0
mov eax, dword [0x458d94]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], esi
mov dword [esp + 8], 4
mov dword [esp + 4], 0xffff
mov dword [esp], eax
call ebx
sub esp, 0x14
cmp eax, 0xffffffff
je 0x41a7a0
mov eax, 1
jmp 0x41a624
mov dword [esp], 0
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [0x458d88], eax
mov eax, dword [0x458d94]
sub esp, 4
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x458d84
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_bind]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x41a7a0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x41a580
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x458d80], eax
sub esp, 0x18
test eax, eax
jne 0x41a715
mov eax, dword [0x458d94]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x458d94], 0xffffffff
sub esp, 4
jmp 0x41a61c
Function at 0x41b5e0
Capabilities:
Inspect load icon resource

Disassembly:
cmp word [0x458f20], 0
jne 0x41b600
mov dword [0x458df8], 0
mov eax, 1
ret
sub esp, 0x6c
mov eax, dword [0x459294]
mov dword [esp + 0x30], 0x30
mov dword [esp + 0x34], 3
mov dword [esp + 0x38], 0x41b0e0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], eax
mov dword [esp + 4], 0x6b
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadIconW]
sub esp, 8
mov dword [esp + 0x5c], eax
mov dword [esp + 0x48], eax
mov dword [esp + 4], 0x7f88
mov dword [esp], 0
call dword [sym.imp.USER32.dll_LoadCursorW]
sub esp, 8
mov dword [esp + 0x4c], eax
mov dword [esp], 4
call dword [sym.imp.GDI32.dll_GetStockObject]
sub esp, 4
mov dword [esp + 0x50], eax
mov eax, dword [0x450484]
mov dword [esp + 0x54], 0
add eax, 0x14b2
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
sub esp, 4
test ax, ax
jne 0x41b6c0
xor eax, eax
add esp, 0x6c
ret
mov eax, dword [0x459294]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], eax
mov eax, dword [0x458f8c]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov eax, dword [0x458f88]
mov dword [esp + 0xc], 0x80000000
mov dword [esp + 0x18], eax
mov eax, dword [0x458f2c]
mov dword [esp + 8], 0x4505e0
mov dword [esp + 0x14], eax
mov eax, dword [0x458f28]
mov dword [esp], 0x8000008
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 4], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x458df8], eax
sub esp, 0x30
test eax, eax
je 0x41b6b3
mov dword [esp + 4], 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x458df8]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
sub esp, 4
jmp 0x41b6b5
Function at 0x426f00
Capabilities:
Set registry value

Disassembly:
push ebx
sub esp, 0x58
lea eax, [esp + 0x38]
mov dword [esp], 0x20006
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
sub esp, 8
test eax, eax
je 0x426f28
add esp, 0x58
pop ebx
ret
lea eax, [esp + 0x3c]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov eax, dword [0x450484]
mov dword [esp + 0x18], 0
add eax, 0x1550
mov dword [esp + 0x14], 0x20006
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 0x24
test eax, eax
jne 0x426fb3
xor ecx, ecx
mov word [esp + 0x4a], cx
test byte [esp + 0x60], 1
jne 0x426fc8
test byte [esp + 0x60], 2
jne 0x427038
mov eax, dword [esp + 0x3c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call ebx
sub esp, 4
add esp, 0x58
pop ebx
ret
mov dword [esp + 4], 0x400
mov edx, 0x68
mov dword [esp], 0x455340
mov dword [esp + 0x40], 0x700053
mov dword [esp + 0x44], 0x740061
mov word [esp + 0x48], dx
call fcn.00429270
mov dword [esp + 0x10], 0x455340
add eax, eax
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub esp, 0x18
jmp 0x426f96
mov eax, 0x74
mov dword [esp + 0x40], 0x630042
mov word [esp + 0x48], ax
lea eax, [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x44], 0x730061
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0x456340
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub esp, 0x18
jmp 0x426fa1