joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4052c7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
mov ebx, eax
push edi
mov esi, ecx
mov edi, edx
test ebx, ebx
jne 0x4052dd
or ebx, 0xffffffff
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.0044d3d0
and dword [ebp - 0x34], 0
add esp, 0xc
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x3c], 0x3c
jb 0x40530d
mov eax, dword [esi + 4]
mov dword [ebp - 0x28], eax
jmp 0x405313
add esi, 4
mov dword [ebp - 0x28], esi
cmp dword [edi + 0x18], 8
jb 0x405321
mov eax, dword [edi + 4]
mov dword [ebp - 0x2c], eax
jmp 0x405327
add edi, 4
mov dword [ebp - 0x2c], edi
movzx eax, byte [ebp + 8]
neg eax
sbb eax, eax
and eax, 5
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x405347
xor al, al
jmp 0x405365
push 1
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x34]
call esi
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40536a
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x5c
lea ebp, [esp - 4]
mov eax, dword [0x49cff4]
xor eax, ebp
mov dword [ebp + 0x5c], eax
push 0x44
mov eax, 0x48078b
call fcn.00455cee
mov eax, dword [ebp + 0x68]
push 0x10
mov dword [ebp + 0x38], eax
xor ebx, ebx
lea eax, [ebp]
push ebx
push eax
mov edi, ecx
call fcn.0044d3d0
push 0x44
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.0044d3d0
add esp, 0x18
lea esi, [ebp + 0x10]
call fcn.00401eca
mov eax, dword [ebp + 0x70]
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x4053c4
mov dword [ebp + 0x34], eax
jmp 0x4053c8
or dword [ebp + 0x34], 0xffffffff
push dword [ebp + 0x38]
lea esi, [ebp + 0x40]
call fcn.00402d78
mov eax, dword [ebp + 0x38]
push 0xffffffffffffffff
push ebx
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004017fd
cmp dword [edi + 0x14], ebx
je 0x405402
push 0x48ae74
mov eax, esi
push eax
call fcn.00401627
push 0xffffffffffffffff
push ebx
mov eax, edi
mov ecx, esi
call fcn.004016bb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
jne 0x405423
push ebx
push 1
jmp 0x405524
push esi
lea eax, [ebp + 0x10]
call fcn.00401f5f
lea eax, [ebp + 0x30]
push eax
mov edi, 0xf01ff
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40541b
push dword [ebp + 0x30]
lea eax, [ebp + 0x10]
call fcn.00401f5f
lea eax, [ebp + 0x3c]
push eax
xor esi, esi
inc esi
push esi
push 2
push ebx
push edi
push dword [ebp + 0x30]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x405522
push dword [ebp + 0x3c]
lea eax, [ebp + 0x10]
call fcn.00401f5f
push dword [ebp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x405522
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x48], str.winsta0default
cmp byte [ebp + 0x6c], bl
jne 0x4054a1
xor eax, eax
mov dword [ebp - 0x24], esi
mov word [ebp - 0x20], ax
mov ecx, dword [ebp + 0x44]
xor edx, edx
cmp byte [ebp + 0x6c], bl
sete dl
dec edx
and edx, 0xf8000030
add edx, 0x8000000
cmp dword [ebp + 0x58], 8
jae 0x4054c2
lea ecx, [ebp + 0x44]
mov eax, dword [ebp + 0x38]
cmp dword [eax + 0x18], 8
jb 0x4054d0
mov eax, dword [eax + 4]
jmp 0x4054d3
add eax, 4
lea edi, [ebp]
push edi
lea edi, [ebp - 0x50]
push edi
push ebx
push ebx
push edx
push ebx
push ebx
push ebx
push ecx
push eax
push dword [ebp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x405522
push esi
push dword [ebp + 0x34]
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push ebx
push esi
lea esi, [ebp + 0x40]
call fcn.00401999
lea ecx, [ebp + 0x10]
call fcn.00401f3b
mov al, 1
jmp 0x405536
push ebx
push esi
lea esi, [ebp + 0x40]
call fcn.00401999
lea ecx, [ebp + 0x10]
call fcn.00401f3b
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x5c]
xor ecx, ebp
call fcn.0044ce01
add ebp, 0x60
leave
ret
Function at 0x407240
Capabilities:
Write file on windows

Disassembly:
push 0x4c
mov eax, 0x480060
call fcn.00455d57
xor edi, edi
cmp dword [esi + 0x3c], edi
je 0x40734c
cmp byte [esi + 0x41], 0
je 0x40734c
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x407276
xor al, al
jmp 0x40734e
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.00406802
mov dword [ebp - 4], edi
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x30]
call fcn.00406912
mov ecx, eax
call fcn.004079d9
mov edi, dword [ebp - 0x1c]
mov ebx, eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x30]
call fcn.00406912
mov ecx, eax
call fcn.004079d9
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push eax
add edi, ebx
push edi
push dword [ebp - 0x38]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x4072e6
dec eax
je 0x4072ea
dec eax
dec eax
je 0x407348
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.004021e1
mov al, bl
jmp 0x40734e
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x30]
call fcn.00406912
mov ecx, eax
call fcn.004079d9
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x40732a
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
call fcn.00406912
mov ecx, eax
call fcn.004079d9
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0044f468
add esp, 0x10
cmp edi, eax
jne 0x4072d4
cmp byte [esi + 0x41], 0
je 0x407348
test edi, edi
jne 0x407284
push edi
push 8
lea ecx, [ebp - 0x30]
call fcn.004068c4
jmp 0x407284
mov bl, 1
jmp 0x4072d6
mov al, 1
call fcn.00455dda
ret
Function at 0x408592
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x64
mov eax, 0x481194
call fcn.00455d57
mov dword [ebp - 0x70], SysReAllocString
mov byte [ebp - 0x6c], 0
and dword [ebp - 4], 0
push str.SOFTWARENorton170fa89a_6886_4c9e_b17b_12bccdd80788
lea esi, [ebp - 0x68]
call fcn.00402d59
push str.INSTALLDIR
lea esi, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.00402d59
mov edi, str.hsplayer.exe
push edi
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.00402d59
lea esi, [ebp - 0x70]
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.0041329a
test al, al
je 0x4086a2
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x4c]
push eax
mov eax, esi
push eax
call fcn.00412d8a
test al, al
je 0x4086c9
push 0x48ae6c
lea eax, [ebp - 0x30]
push eax
call fcn.00401627
push edi
lea eax, [ebp - 0x30]
push eax
call fcn.00401627
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x408630
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x2c]
je 0x40868a
cmp dword [ebp - 0x18], 8
jae 0x408648
lea eax, [ebp - 0x2c]
push eax
push str.Helpware_install_file_found____s_.
call fcn.004083b8
pop ecx
pop ecx
mov bl, 1
xor edi, edi
push edi
push 1
lea esi, [ebp - 0x30]
call fcn.00401999
push edi
push 1
lea esi, [ebp - 0x4c]
call fcn.00401999
push edi
push 1
lea esi, [ebp - 0x68]
call fcn.00401999
lea esi, [ebp - 0x70]
call fcn.00413363
mov al, bl
call fcn.00455dda
ret
cmp dword [ebp - 0x18], 8
jae 0x408693
lea eax, [ebp - 0x2c]
push eax
push str.Helpware_install_check_file_not_found___s_.
call fcn.004083b8
pop ecx
pop ecx
jmp 0x4086c9
cmp dword [ebp - 0x34], 8
mov ecx, dword [ebp - 0x48]
jae 0x4086ae
lea ecx, [ebp - 0x48]
cmp dword [ebp - 0x50], 8
mov eax, dword [ebp - 0x64]
jae 0x4086ba
lea eax, [ebp - 0x64]
push ecx
push eax
push str.Couldnt_open_key___s_s_.
call fcn.004083b8
add esp, 0xc
xor bl, bl
jmp 0x408657
Function at 0x4086cd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x50
mov eax, 0x480c3e
call fcn.00455d57
xor ebx, ebx
push str.SOFTWARESymantecNorton_Security_Scan_
lea esi, [ebp - 0x48]
mov byte [ebp - 0x49], bl
mov dword [ebp - 0x58], 4
call fcn.00402d59
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
mov esi, 0x49f830
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x2c]
call fcn.004017fd
push dword [esi]
lea eax, [ebp - 0x2c]
push eax
call fcn.00401627
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x408733
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x50]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40878a
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push str.LayoutType
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40877c
cmp dword [ebp - 0x54], 4
jne 0x40877c
cmp dword [ebp - 0x5c], 1
jne 0x40877c
mov byte [ebp - 0x49], 1
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x49], bl
jne 0x408799
add esi, 4
cmp esi, 0x49f864
jl 0x40870e
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.00401999
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.00401999
mov al, byte [ebp - 0x49]
call fcn.00455dda
ret

Function at 0x4088b9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
cmp dword [eax + 8], 4
push esi
push edi
mov esi, ecx
mov edi, edx
jl 0x4088d7
push esi
push edi
call fcn.004094b8
jmp 0x40897c
push 0x38
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.0044d3d0
and dword [ebp - 0x38], 0
and dword [ebp - 0x24], 0
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x408920
push str.ShellaExecute_Failed__0x_x_:__s
call fcn.004083e6
pop ecx
xor al, al
jmp 0x40897c
push str.Process_Created_n
call fcn.004083b8
pop ecx
push 1
push 0x2bf20
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov edi, eax
cmp edi, 0x102
jne 0x40895d
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 4], esp
push dword [0x49f8e0]
call fcn.00402d59
call fcn.0040a64f
push edi
push str.Done_waiting__0x_x_
call fcn.004083b8
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
pop ecx
push dword [ebp - 8]
call esi
push dword [ebp - 0x38]
call esi
mov al, 1
pop edi
pop esi
leave
ret
Function at 0x408980
Capabilities:
Enumerate processes

Disassembly:
push 0x26c
mov eax, 0x48114c
call fcn.00455d8d
mov esi, ecx
cmp byte [esi + 0xc], 0
mov dword [ebp - 0x24c], esi
je 0x4089a7
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov byte [esi + 0xc], 0
and dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0x248]
push ecx
push eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x248], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x408b54
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x254]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x408b6d
mov eax, dword [ebp - 0x250]
cmp eax, dword [ebp - 0x240]
jne 0x4089eb
push str.Found_command_prompt_window_that_initialized_our_app
call fcn.004083b8
pop ecx
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x408b44
push 0xfffffffffffffff5
call ebx
push 0x4000
push eax
call fcn.00450961
push 0x48d6ac
push eax
call fcn.00450ac8
add esp, 0x10
push 8
pop ecx
mov esi, eax
lea edi, [ebp - 0x278]
rep movsd dword es:[edi], dword [esi]
call fcn.004503cd
push 8
pop ecx
push 0
mov edi, eax
push 4
add edi, 0x20
lea esi, [ebp - 0x278]
push 0
rep movsd dword es:[edi], dword [esi]
call fcn.004503cd
add eax, 0x20
push eax
call fcn.0044e8a0
add esp, 0x10
push 0xfffffffffffffff6
call ebx
push 0x4000
push eax
call fcn.00450961
push 0x48d6b0
push eax
call fcn.00450ac8
add esp, 0x10
push 8
pop ecx
mov esi, eax
lea edi, [ebp - 0x278]
rep movsd dword es:[edi], dword [esi]
call fcn.004503cd
push 8
pop ecx
push 0
mov edi, eax
push 4
lea esi, [ebp - 0x278]
push 0
rep movsd dword es:[edi], dword [esi]
call fcn.004503cd
push eax
call fcn.0044e8a0
add esp, 0x10
push 0xfffffffffffffff4
call ebx
push 0x4000
push eax
call fcn.00450961
push 0x48d6ac
push eax
call fcn.00450ac8
add esp, 0x10
push 8
pop ecx
mov esi, eax
lea edi, [ebp - 0x278]
rep movsd dword es:[edi], dword [esi]
call fcn.004503cd
push 8
pop ecx
push 0
mov edi, eax
add edi, 0x40
push 4
lea esi, [ebp - 0x278]
push 0
rep movsd dword es:[edi], dword [esi]
call fcn.004503cd
add eax, 0x40
push eax
call fcn.0044e8a0
add esp, 0x10
call fcn.004080c5
mov eax, dword [ebp - 0x24c]
mov byte [eax + 0xc], 1
mov esi, eax
jmp 0x4089eb
push str.Unable_to_attach_to_calling_console_window__make_sure_you_launch_this_exe_from_a_command_prompt_window
call fcn.004083cf
pop ecx
jmp 0x4089eb
push str.Unable_to_get_list_of_windows_processes
call fcn.004083cf
pop ecx
jmp 0x408b6d
mov al, byte [esi + 0xc]
call fcn.00455de9
ret
Function at 0x4094b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
xor esi, esi
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
cmp ebx, esi
je 0x4095fa
lea eax, [ebp - 8]
push eax
mov edi, 0xf01ff
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x409501
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4095fa
lea eax, [ebp - 4]
push eax
push 1
push 2
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x409536
push str.runFile___duplicate_token__0x_x_:__s
call fcn.004083e6
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
push dword [ebp - 8]
call esi
push ebx
call esi
jmp 0x4095fa
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x40955b
push str.runFile___impersonate__0x_x_:__s
call fcn.004083e6
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
push dword [ebp - 4]
call esi
jmp 0x409529
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push 0x8000000
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 0x60], 0x44
push dword [ebp + 8]
mov dword [ebp - 0x58], str.winsta0default
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4095dc
push 1
push 0x2bf20
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov dword [ebp + 0xc], eax
cmp eax, 0x102
jne 0x4095c6
sub esp, 0x1c
mov esi, esp
mov dword [ebp + 8], esp
push dword [0x49f8e0]
call fcn.00402d59
call fcn.0040a64f
push dword [ebp + 0xc]
push str.Done_waiting__0x_x_
call fcn.004083b8
pop ecx
pop ecx
push dword [ebp - 0x18]
call edi
jmp 0x4095e7
push str.InternetReadFile_Failed:_0x_08x____s
call fcn.004083e6
pop ecx
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 4]
call edi
push dword [ebp - 8]
call edi
push ebx
call edi
pop edi
pop esi
mov al, 1
pop ebx
leave
ret 8
Function at 0x40baf0
Capabilities:
Copy file
Create directory
Get common file path

Disassembly:
push ebp
sub esp, 0x858
lea ebp, [esp - 4]
mov eax, dword [0x49cff4]
xor eax, ebp
mov dword [ebp + 0x858], eax
push 8
mov eax, 0x480b4d
call fcn.00455cee
mov eax, dword [ebp + 0x864]
mov dword [ebp - 0x14], eax
mov esi, 0x104
push esi
lea eax, [ebp + 0x448]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + 0x448]
push eax
push dword [ebp - 0x14]
call fcn.00401642
push esi
lea eax, [ebp + 0x240]
push eax
push esi
lea eax, [ebp + 0x650]
push eax
push edi
push edi
push edi
lea eax, [ebp + 0x448]
push edi
push eax
call fcn.0044e09b
add esp, 0x24
push 7
pop eax
xor ecx, ecx
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x30], edi
mov word [ebp + 0x20], cx
mov dword [ebp - 4], edi
mov dword [ebp + 0x18], eax
xor eax, eax
mov dword [ebp + 0x14], edi
mov word [ebp + 4], ax
lea eax, [ebp + 0x38]
push eax
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp + 0x38]
push eax
call fcn.0044d1f0
pop ecx
lea ecx, [ebp + 0x38]
lea edx, [ebp + 0x1c]
call fcn.00401888
push str.PCCUStubInstaller
lea eax, [ebp + 0x1c]
push eax
call fcn.00401627
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x40bbc1
lea eax, [ebp + 0x20]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x48ae6c
lea eax, [ebp + 0x1c]
push eax
call fcn.00401627
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x1c]
lea ecx, [ebp]
call fcn.004017fd
lea eax, [ebp + 0x650]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.00401627
lea eax, [ebp + 0x240]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.00401627
cmp dword [ebx + 0x18], 8
lea eax, [ebx + 4]
mov dword [ebp - 0x10], eax
jb 0x40bc13
mov eax, dword [eax]
push esi
lea ecx, [ebp + 0x240]
push ecx
push esi
lea ecx, [ebp + 0x650]
push ecx
push edi
push edi
push edi
push edi
push eax
call fcn.0044e09b
add esp, 0x24
lea eax, [ebp + 0x650]
push eax
lea eax, [ebp]
push eax
call fcn.00401627
lea eax, [ebp + 0x240]
push eax
lea eax, [ebp]
push eax
call fcn.00401627
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x40bc5c
lea eax, [ebp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
push eax
lea eax, [ebp + 0x448]
push eax
call esi
test eax, eax
je 0x40bc9b
cmp dword [ebp + 0x18], 8
mov ecx, dword [ebp + 4]
jae 0x40bc7d
lea ecx, [ebp + 4]
cmp dword [ebx + 0x18], 8
mov eax, dword [ebp - 0x10]
jb 0x40bc88
mov eax, dword [eax]
push edi
push ecx
push eax
call esi
mov ecx, dword [ebp - 0x14]
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x1c]
call fcn.004017fd
push edi
push 1
lea esi, [ebp]
call fcn.00401999
push edi
push 1
lea esi, [ebp + 0x1c]
call fcn.00401999
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x858]
xor ecx, ebp
call fcn.0044ce01
add ebp, 0x85c
leave
ret
Function at 0x40be82
Capabilities:
Print debug messages

Disassembly:
push ebp
lea ebp, [esp - 0x203c]
mov eax, 0x203c
call fcn.00456b90
push 0xffffffffffffffff
push 0x480e64
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x49cff4]
xor eax, ebp
mov dword [ebp + 0x2038], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
xor eax, eax
push 0x1ffe
mov word [ebp + 0x38], ax
xor ebx, ebx
lea eax, [ebp + 0x3a]
push ebx
push eax
call fcn.0044d3d0
lea eax, [ebp + 0x2048]
push eax
push dword [ebp + 0x2044]
lea eax, [ebp + 0x38]
push 0xffffffffffffffff
push 0x1000
push eax
call fcn.00451129
add esp, 0x20
test eax, eax
jle 0x40bf78
push 7
pop esi
xor eax, eax
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x14], ebx
mov word [ebp + 4], ax
lea eax, [ebp]
push eax
lea eax, [ebp + 0x38]
push eax
mov dword [ebp - 4], ebx
call fcn.0040bfc0
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
pop ecx
pop ecx
jae 0x40bf2e
lea eax, [ebp + 4]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push eax
call edi
xor eax, eax
mov dword [ebp + 0x34], esi
mov dword [ebp + 0x30], ebx
mov word [ebp + 0x20], ax
push dword [ebp - 0x10]
lea esi, [ebp + 0x1c]
mov byte [ebp - 4], 1
call fcn.0040bfe6
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
pop ecx
jae 0x40bf5f
lea eax, [ebp + 0x20]
push eax
call edi
push ebx
push 1
lea esi, [ebp + 0x1c]
call fcn.00401999
push ebx
push 1
lea esi, [ebp]
call fcn.00401999
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2038]
xor ecx, ebp
call fcn.0044ce01
add ebp, 0x203c
leave
ret

Function at 0x40c6b4
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Reference google public dns server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x49cff4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x11
push 2
push 2
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, 0xffffffff
jne 0x40c6db
xor al, al
jmp 0x40c74f
push 0x10
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0044d3d0
add esp, 0xc
push 2
pop eax
push str.8.8.8.8
mov word [ebp - 0x14], ax
call sub.WS2_32.dll_inet_addr
push 0x35
mov dword [ebp - 0x10], eax
call sub.WS2_32.dll_htons
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call sub.WS2_32.dll_connect
call sub.WS2_32.dll_WSAGetLastError
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
mov dword [ebp - 0x28], 0x10
call sub.WS2_32.dll_getsockname
push dword [ebp - 0x20]
call sub.WS2_32.dll_inet_ntoa
push eax
push 0x104
push ebx
call fcn.004513bd
add esp, 0xc
push edi
call sub.WS2_32.dll_closesocket
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0044ce01
leave
ret
Function at 0x40e667
Capabilities:
Get geographical location

Disassembly:
push 0x54
mov eax, 0x481b7d
call fcn.00455d8d
push 0x10
mov edi, ecx
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
cmp eax, 0xffffffff
jne 0x40e699
push 9
lea eax, [ebp - 0x20]
push eax
push 0x5a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x40e6aa
push 0
push 9
lea ecx, [ebp - 0x20]
push ecx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_GetGeoInfoA]
sub esp, 0x1c
lea eax, [ebp - 0x20]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.00401fee
lea eax, [ebp - 0x44]
push eax
call fcn.00402c22
add esp, 0x20
and dword [ebp - 4], 0
cmp dword [eax + 0x18], 8
jb 0x40e6d6
mov eax, dword [eax + 4]
jmp 0x40e6d9
add eax, 4
push eax
push str.Country:__s
call fcn.0040e25c
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x44]
call fcn.00401999
push str.Experience
push ebx
mov dword [ebp - 4], 1
call fcn.0040e220
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0040e1e4
test eax, eax
je 0x40e747
lea esi, [edi + 0x54]
push esi
mov ecx, eax
call fcn.0041a140
test al, al
je 0x40e803
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
call fcn.00402010
lea eax, [ebp - 0x44]
push eax
call fcn.00402c22
add esp, 0x20
mov byte [ebp - 4], 2
jmp 0x40e787
push str.DEFAULT
push esi
call fcn.0040e1e4
test eax, eax
je 0x40e7ae
lea esi, [edi + 0x54]
push esi
mov ecx, eax
call fcn.0041a140
test al, al
je 0x40e803
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x24], esp
push esi
call fcn.00402010
lea eax, [ebp - 0x44]
push eax
call fcn.00402c22
add esp, 0x20
mov byte [ebp - 4], 3
cmp dword [eax + 0x18], 8
jb 0x40e792
mov eax, dword [eax + 4]
jmp 0x40e795
add eax, 4
push eax
push str.Experience:__s
call fcn.0040e25c
pop ecx
pop ecx
push 0
push 1
lea esi, [ebp - 0x44]
call fcn.00401999
mov al, 1
jmp 0x40e805
xor al, al
call fcn.00455de9
ret