joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411570
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push 1
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x4115e6
mov dword [esp], 0x3c
mov dword [esp + 4], 0x400
call fcn.0042b2a7
test eax, eax
je 0x4115af
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x74]
call eax
jmp 0x4115b1
xor eax, eax
mov ecx, dword [eax + 0x20]
lea edx, [esp]
push edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], str.Open
mov dword [esp + 0x14], str.iexplore.exe
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
add esp, 0x3c
ret
Function at 0x411610
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x45a1b9
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4767b0]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4767b0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x38], ebx
mov esi, ecx
mov edi, edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], ebx
call fcn.0041e932
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x411672
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x38], ebx
mov eax, edi
mov dword [esp + 0x18], 1
mov byte [esp + 0x24], 0x4d
mov byte [esp + 0x25], 0x74
mov byte [esp + 0x26], 0x24
mov byte [esp + 0x27], 0x31
mov byte [esp + 0x28], 0x76
mov byte [esp + 0x29], 0x73
mov byte [esp + 0x2a], 0x64
mov byte [esp + 0x2b], 0
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4116c0
sub eax, ecx
shr eax, 3
mov esi, eax
push esi
call fcn.0041de97
mov edi, eax
lea eax, [esi - 1]
cdq
and edx, 7
add eax, edx
sar eax, 3
lea ebx, [eax*8 + 8]
lea ecx, [ebx + 1]
push ecx
mov dword [esp + 0x1c], ebx
call fcn.0041de97
push ebx
push 0
push edi
mov ebp, eax
call fcn.00444200
push ebx
push 0
push ebp
call fcn.00444200
add esp, 0x20
xor ecx, ecx
test esi, esi
jle 0x41176c
mov eax, dword [esp + 0x20]
add eax, 2
mov dl, 0xd0
lea esp, [esp]
add byte [eax - 2], dl
add byte [eax - 1], dl
add byte [eax], dl
add byte [eax + 1], dl
add byte [eax + 2], dl
add byte [eax + 3], dl
add byte [eax + 4], dl
add byte [eax + 5], dl
mov bl, byte [eax - 2]
add bl, bl
add bl, byte [eax - 1]
inc ecx
add bl, bl
add bl, byte [eax]
add eax, 8
add bl, bl
add bl, byte [eax - 7]
add bl, bl
add bl, byte [eax - 6]
add bl, bl
add bl, byte [eax - 5]
add bl, bl
add bl, byte [eax - 4]
add bl, bl
add bl, byte [eax - 3]
cmp ecx, esi
mov byte [ecx + edi - 1], bl
jl 0x411720
mov ebx, dword [esp + 0x14]
push 1
lea edx, [esp + 0x28]
push edx
push esi
mov ecx, ebp
mov edx, edi
call fcn.00407180
mov esi, dword [esp + 0x28]
push ebp
push 0x465190
push esi
mov byte [ebx + ebp], 0
call fcn.00401e00
push ebp
call fcn.0041dea2
push edi
call fcn.0041dea2
add esp, 0x20
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004422a2
add esp, 0x28
ret
Function at 0x412860
Capabilities:
Connect to http server

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
push edi
test esi, esi
jne 0x41287b
push esi
push esi
push str.CHttpToolW::OpenConnection:_hInternet_can_not_be_NULL.
call fcn.004125b0
test edx, edx
jne 0x41288b
push edx
push edx
push str.CHttpToolW::OpenConnection:_szServerAddr_can_not_be_NULL.
call fcn.004125b0
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412890
sub eax, edi
sar eax, 1
push 0
push 0
jne 0x4128af
push str.CHttpToolW::OpenConnection:_szServerAddr_can_not_be_an_empty_string.
call fcn.004125b0
mov eax, dword [ebp + 8]
push 3
push 0
push 0
push eax
push edx
push esi
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
jne 0x4128d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
xor ecx, ecx
mov ebx, 0x193
call fcn.00412480
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x412c50
Capabilities:
Send data

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
test ebp, ebp
jne 0x412c67
push ebp
push ebp
push str.CHttpToolW::InternetWriteFile:_hRequest_can_not_be_NULL.
call fcn.004125b0
cmp dword [esp + 0x14], 0
jne 0x412c7c
push 0
push 0
push str.CHttpToolW::InternetWriteFile:_pbyBuff_can_not_be_NULL.
call fcn.004125b0
test edi, edi
jne 0x412c8c
push edi
push edi
push str.CHttpToolW::InternetWriteFile:_cbyBuff_can_not_be_zero.
call fcn.004125b0
xor esi, esi
test edi, edi
jbe 0x412cb9
mov ebx, dword [sym.imp.WININET.dll_InternetWriteFile]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
mov ecx, edi
sub ecx, esi
push ecx
lea eax, [esi + edx]
push eax
push ebp
call ebx
test eax, eax
je 0x412cbd
add esi, dword [esp + 0x10]
cmp esi, edi
jb 0x412c98
pop esi
pop ebp
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
xor ecx, ecx
mov ebx, 0x198
call fcn.00412480
int3
Function at 0x412d70
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x104]
sub esp, 0x104
push 0xffffffffffffffff
push 0x459de0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4767b0]
xor eax, ebp
mov dword [ebp + 0x100], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov esi, edx
test esi, esi
jne 0x412dc0
push edx
push edx
push str.CHttpToolW::GetMimeType:_hFile_can_not_be_NULL.
call fcn.004125b0
cmp edi, 0xfde9
je 0x412f10
cmp edi, 0xfde8
je 0x412f10
cmp esi, 0xffffffff
jne 0x412e2f
push 0x19
call fcn.004434a5
add esp, 4
test eax, eax
jne 0x412df3
lea edi, [eax + 0x66]
call fcn.00412390
mov ecx, str.application_octet_stream
mov esi, eax
sub esi, ecx
lea esp, [esp]
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x412e00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x100]
xor ecx, ebp
call fcn.004422a2
add ebp, 0x104
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x18]
push eax
push 0x100
lea ecx, [ebp]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x412e5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
xor ecx, ecx
mov ebx, 0x25a
call fcn.00412480
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x412e81
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
xor ecx, ecx
mov ebx, 0x25c
call fcn.00412480
mov eax, dword [ebp - 0x18]
push 0
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push eax
lea ecx, [ebp]
push ecx
push 0
push 0
mov dword [ebp - 0x14], 0
call sub.urlmon.dll_FindMimeFromData
test eax, eax
je 0x412ed5
push 0x19
call fcn.004434a5
add esp, 4
test eax, eax
jne 0x412ebd
lea edi, [eax + 0x66]
call fcn.00412390
mov ecx, str.application_octet_stream
mov esi, eax
sub esi, ecx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x412ec6
jmp 0x412e0a
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
push edx
mov eax, edi
call fcn.004126f0
mov esi, eax
mov eax, dword [ebp - 0x14]
add esp, 4
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
jmp 0x412e0a
push 0
push 0
push str.CHttpToolW::GetMimeType:_CP_UTF8_and_CP_UTF7_can_not_be_used_for_the_CodePage_parameter.
call fcn.004125b0
int3

Function at 0x413aa0
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [eax + 0x30]
sub esp, 8
push ebx
push esi
test eax, eax
jne 0x413abc
mov esi, str.CHttpResponseT::ReadContent:_m_hRequest_can_not_be_NULL.
call fcn.00412430
test ecx, ecx
jne 0x413aca
mov esi, str.CHttpResponseT::ReadContent:_pbyBuff_can_not_be_NULL.
call fcn.00412430
lea edx, [esp + 0xc]
push edx
push 0x27ff
push ecx
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x413afb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
xor ecx, ecx
mov ebx, 0x191
call fcn.00412480
mov eax, dword [esp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e827
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00428751
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41e860
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.0041e473
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x41f796
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x45812a
call fcn.00444660
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x41f7bb
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41f801
lea ecx, [ebp - 0x10]
call fcn.00401ff0
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00438546
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401fb0
mov eax, esi
call fcn.00444738
ret 8

Function at 0x427d64
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x427dab
call fcn.00428751
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x427dab
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x427dc7
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004278dc
mov esi, eax
test edi, edi
je 0x427dc5
test ebx, ebx
je 0x427dc5
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x42a7fc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x42a844
call fcn.00428751
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42a844
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x42a887
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x42a870
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x42a870
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x42a884
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x42f826
Capabilities:
Contain obfuscated stackstrings

Disassembly:
loopne 0x42f879
call dword [ebp - 0x120]
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp - 0x88]
push edx
mov eax, dword [ebp - 0x8c]
push eax
call fcn.0042fd31
add esp, 8
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jne 0x42f86a
mov dword [ebp - 0x28], 1
jmp 0x42fc61
mov ecx, dword [ebp - 0x90]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0042fd31
add esp, 8
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x158]
push ecx
push 0xb
call dword [ebp - 0xe0]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x42f8b9
add byte [ebx - 0x7a76f73c], al
call 0x8e42f882
test dword [eax - 1], ebp
invalid
mov dword [ebp - 0x28], 1
jmp 0x42fc61
cmp dword [ebp - 0x98], 1
jae 0x42f8d3
mov dword [ebp - 0x28], 1
jmp 0x42fc61
push 0x15f90
mov edx, dword [ebp - 0x78]
push edx
call dword [ebp - 0x118]
cmp eax, 0x102
jne 0x42fc61
mov dword [ebp - 0x24], 0
mov eax, 1
test eax, eax
je 0x42f924
push 0
mov ecx, dword [ebp - 0x78]
push ecx
call dword [ebp - 0x118]
test eax, eax
jne 0x42f90f
jmp 0x42f924
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0xffffffff
jne 0x42f922
jmp 0x42f924
jmp 0x42f8f4
cmp dword [ebp - 0x24], 0x26000
jb 0x42fc61
cmp dword [ebp - 0x28], 0
jne 0x42fc61
mov byte [ebp - 0x6c], 0x6b
mov byte [ebp - 0x6b], 0x65
mov byte [ebp - 0x6a], 0x72
mov byte [ebp - 0x69], 0x6e
mov byte [ebp - 0x68], 0x65
mov byte [ebp - 0x67], 0x6c
mov byte [ebp - 0x66], 0x62
mov byte [ebp - 0x65], 0x61
mov byte [ebp - 0x64], 0x73
mov byte [ebp - 0x63], 0x65
mov byte [ebp - 0x62], 0x2e
mov byte [ebp - 0x61], 0x64
mov byte [ebp - 0x60], 0x6c
mov byte [ebp - 0x5f], 0x6c
mov byte [ebp - 0x5e], 0
mov eax, dword [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042fd31
add esp, 8
invalid
invalid
invalid
Function at 0x42fa0a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add al, 0xc7
inc ebp
add byte [eax], 0
add byte [eax], al
mov ecx, dword [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0x7c]
push edx
call fcn.0042fd31
add esp, 8
mov dword [ebp - 0xe4], eax
push 2
mov eax, dword [ebp - 0x70]
push eax
lea ecx, [ebp - 0x80]
push ecx
call dword [ebp - 0xe4]
add esp, 0xc
lea edx, [ebp - 0x3c]
push edx
call dword [ebp - 0x120]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0xb0]
push eax

Function at 0x42fd01
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
invalid

Function at 0x42fd31
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
add eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff0000
je 0x42fe0d
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
jmp 0x42fdaf
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0x20]
jae 0x42fe04
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0042fcd1
add esp, 8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jne 0x42fe02
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x30]
mov cx, word [eax + edx*2]
mov word [ebp - 4], cx
movzx edx, word [ebp - 4]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
jmp 0x42fe2b
jmp 0x42fda6
mov dword [ebp - 0x10], 0
jmp 0x42fe28
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
sub eax, dword [edx + 0x10]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
Function at 0x4422a2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4767b0]
jne 0x4422ac
repz ret
jmp fcn.004489a1

Function at 0x450ae2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00448305
and dword [ebp - 4], 0
cmp dword [0x47ae40], 0
mov ebx, eax
jne 0x450b93
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x450c44
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x450c44
push eax
call fcn.00448293
mov dword [esp], 0x4625bc
push edi
mov dword [0x47ae40], eax
call esi
push eax
call fcn.00448293
mov dword [esp], 0x4625a8
push edi
mov dword [0x47ae44], eax
call esi
push eax
call fcn.00448293
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x47ae48], eax
call esi
push eax
call fcn.00448293
pop ecx
mov dword [0x47ae50], eax
test eax, eax
je 0x450b93
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00448293
pop ecx
mov dword [0x47ae4c], eax
mov eax, dword [0x47ae4c]
cmp eax, ebx
je 0x450beb
cmp dword [0x47ae50], ebx
je 0x450beb
push eax
call fcn.0044830e
push dword [0x47ae50]
mov esi, eax
call fcn.0044830e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x450beb
test edi, edi
je 0x450beb
call esi
test eax, eax
je 0x450be2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x450be2
test byte [ebp - 0xc], 1
jne 0x450beb
or dword [ebp + 0x10], 0x200000
jmp 0x450c24
mov eax, dword [0x47ae44]
cmp eax, ebx
je 0x450c24
push eax
call fcn.0044830e
pop ecx
test eax, eax
je 0x450c24
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x450c24
mov eax, dword [0x47ae48]
cmp eax, ebx
je 0x450c24
push eax
call fcn.0044830e
pop ecx
test eax, eax
je 0x450c24
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x47ae40]
call fcn.0044830e
pop ecx
test eax, eax
je 0x450c44
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x450c46
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001950
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
mov esi, ecx
push eax
push 0x202
mov dword [esi], 0x1005b668
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10001902
cmp word [esp + 4], 0x202
je 0x10001902
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, esi
pop esi
add esp, 0x190
ret
mov ecx, 0x10068150
jmp 0x100018d0

Function at 0x100019c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100019d5
xor eax, eax
ret 4
and al, 0x10
xor ecx, ecx
cmp al, 0x10
setne cl
mov eax, ecx
ret 4

Function at 0x10001a30
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0x80
push 4
push 0
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x100020f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
sub esp, 0x10
push ebx
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10002110
or eax, eax
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x18]
mov word [esp + 4], 2
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x10002137
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret 8
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
push esi
mov eax, ecx
push edi
mov esi, dword [edx]
lea edi, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 0xc]
push 0x10
push edx
push ebx
mov word [esp + 0x1a], ax
call dword [sym.imp.WS2_32.dll_connect]
pop edi
cmp eax, 0xffffffff
pop esi
jne 0x1000218a
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop ebx
add esp, 0x10
ret 8
mov eax, ebx
pop ebx
add esp, 0x10
ret 8

Function at 0x10003750
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret
Function at 0x10004910
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 8
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
test edi, edi
jl 0x10004a0b
push ebx
lea eax, [esi + 0x1f04]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi + 0x36c0]
mov eax, edi
cdq
mov ebx, dword [esi + 0x2d98]
add ecx, eax
mov dword [esi + 0x36c0], ecx
mov ebp, dword [esi + 0x36c4]
mov ecx, dword [esi + 0x2d8c]
mov dword [esp + 0x14], 0
adc ebp, edx
add ebx, edi
mov dword [esi + 0x36c4], ebp
inc ecx
fild qword [esi + 0x36c0]
mov dword [esp + 0x10], ecx
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x2d98], ebx
fidiv dword [esp + 0x10]
fmul dword [0x1005b694]
fstp dword [esi + 0x2d94]
call ebp
sub eax, dword [esi + 0x36d0]
cmp eax, 0x3e8
jbe 0x100049fa
mov edi, dword [esi + 0x36c0]
mov eax, dword [esi + 0x36c8]
mov ebx, dword [esi + 0x36c4]
mov ecx, dword [esi + 0x36cc]
mov edx, edi
push 0
sub edx, eax
mov eax, ebx
sbb eax, ecx
push 0x400
push eax
push edx
call fcn.1000b2c0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
fild qword [esp + 0x10]
mov dword [esi + 0x36c8], edi
push 1
mov ecx, esi
mov dword [esi + 0x36cc], ebx
fstp dword [esi + 0x2d90]
call fcn.100021a0
call ebp
mov dword [esi + 0x36d0], eax
mov edx, dword [esi + 0x1efc]
lea ecx, [esi + 0x1efc]
call dword [edx + 0x1c]
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret 4