joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d449c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5d453e
cmp dword [ebx + 0xac], 0
jne 0x5d4538
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5d43dc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5d4538
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5d44fe
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5d4538
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.00462dcc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5d450d
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5d47e4
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x6f8828]
cmp dword [eax + 0x188], 0
je 0x5d494d
test bl, bl
jne 0x5d48a0
cmp dword [esi + 0xb4], 0
jne 0x5d4895
mov eax, esi
call fcn.005d7764
push eax
push 0x5d46e4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5d4866
mov eax, dword [0x6f8828]
cmp byte [eax + 0xeb], 0
je 0x5d4866
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5d4847
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5d4866
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d484f
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d4895
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.00462dcc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d4875
inc dword [esi + 0xb4]
jmp 0x5d494d
cmp dword [esi + 0xb4], 0
jle 0x5d494d
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5d494d
cmp dword [esi + 0x58], 0
je 0x5d4902
mov eax, dword [0x6f8828]
cmp byte [eax + 0xeb], 0
je 0x5d4902
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5d48e3
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5d4902
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5d48eb
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5d4931
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.00462dcc
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5d4911
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5c5734]
call fcn.0040d09c
pop edi
pop esi
pop ebx
ret
Function at 0x5d56d0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5d572d
cmp byte [ebx + 0xeb], 0
jne 0x5d572d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a34c
mov eax, dword [esi]
test eax, eax
je 0x5d571a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5d573a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a5a4
jmp 0x5d573a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a5a4
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5d6e7c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5d6eed
mov eax, esi
call fcn.00513998
test al, al
je 0x5d6eed
mov eax, dword [ebx + 0x98]
call fcn.005135c4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5d6eed
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x5d6ede
push 0
mov eax, dword [ebx + 0x98]
call fcn.005135c4
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00509d30
jmp 0x5d6eed
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005d6c88
pop esi
pop ebx
ret
Function at 0x5dfa7c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x90], 0
jne 0x5dfb02
mov eax, dword [ebx + 8]
call fcn.005135c4
mov ecx, eax
mov dl, 1
mov eax, dword [0x524b80]
call fcn.0050d384
mov dword [ebx + 0x90], eax
mov esi, dword [ebx + 0x90]
xor edx, edx
mov eax, esi
call fcn.005314d0
mov dword [esi + 0x2d4], ebx
mov dword [esi + 0x2d0], 0x5df34c
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xdc]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x90]
call fcn.005135c4
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x90]
call fcn.005135c4
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0xa0], 0
jne 0x5dfb84
mov eax, dword [ebx + 8]
call fcn.005135c4
mov ecx, eax
mov dl, 1
mov eax, dword [0x524b80]
call fcn.0050d384
mov dword [ebx + 0xa0], eax
mov esi, dword [ebx + 0xa0]
mov dl, 1
mov eax, esi
call fcn.005314d0
mov dword [esi + 0x2d4], ebx
mov dword [esi + 0x2d0], 0x5df398
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xdc]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa0]
call fcn.005135c4
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0xa0]
call fcn.005135c4
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x98], 0
jne 0x5dfc02
mov eax, dword [ebx + 8]
call fcn.005135c4
mov ecx, eax
mov dl, 1
mov eax, dword [0x525664]
call fcn.0050d384
mov dword [ebx + 0x98], eax
mov esi, dword [ebx + 0x98]
mov byte [esi + 0x2a8], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xdc]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xdc]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x98]
call fcn.005135c4
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x98]
call fcn.005135c4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x617c80
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.0040a1c4
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x617cb1
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.0040a34c
add esp, 0x24
pop ebx
ret

Function at 0x61dba4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, dword [0x61bed4]
call fcn.004086a8
test al, al
je 0x61dcbd
mov edx, dword [ebx + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [ebx + 0x54]
mov eax, dword [esi + 0x54]
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [esi + 8]
mov edx, dword [ebx + 8]
call fcn.0040a5a4
lea eax, [esi + 0x10]
mov edx, dword [ebx + 0x10]
call fcn.0040a5a4
lea eax, [esi + 0x14]
mov edx, dword [ebx + 0x14]
call fcn.0040a5a4
lea eax, [esi + 0x18]
mov edx, dword [ebx + 0x18]
call fcn.0040a5a4
lea eax, [esi + 0x1c]
mov edx, dword [ebx + 0x1c]
call fcn.0040a5a4
lea eax, [esi + 0x20]
mov edx, dword [ebx + 0x20]
call fcn.0040a5a4
lea eax, [esi + 0x4c]
mov edx, dword [ebx + 0x4c]
call fcn.0040a5a4
lea eax, [esi + 0x50]
mov edx, dword [ebx + 0x50]
call fcn.0040a5a4
mov eax, dword [ebx + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [ebx + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [ebx + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [ebx + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [ebx + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [ebx + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [ebx + 0x44]
mov dword [esi + 0x44], eax
lea eax, [esi + 0x48]
mov edx, dword [ebx + 0x48]
call fcn.0040a5a4
mov eax, dword [ebx + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [ebx + 0x5c]
mov dword [esi + 0x5c], eax
lea eax, [esi + 0x68]
mov edx, dword [ebx + 0x68]
call fcn.0040a5a4
mov eax, dword [ebx + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [ebx + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [ebx + 0x70]
mov dword [esi + 0x70], eax
mov eax, dword [ebx + 0x74]
mov dword [esi + 0x74], eax
lea eax, [esi + 0x78]
mov edx, dword [ebx + 0x78]
call fcn.0040a5a4
movzx eax, byte [ebx + 0x7c]
mov byte [esi + 0x7c], al
lea eax, [esi + 0x80]
mov edx, dword [ebx + 0x80]
call fcn.0040a5a4
pop esi
pop ebx
ret
mov edx, esi
mov eax, ebx
call fcn.0046438c
pop esi
pop ebx
ret
Function at 0x63e594
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x63e59c
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x63e751
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x63e76c
call fcn.0040b120
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0x1c]
xor edx, edx
call fcn.0063c7a8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x63e780
call fcn.005ea164
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x63e617
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x63e658
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.0063c7a8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x63e7e8
call fcn.005ea164
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040b0c8
mov eax, esi
mov edx, 0x63e814
call fcn.0040b0c8
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x63e670
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x63e6de
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x63e828
call fcn.005ea164
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040b0c8
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x63e6a7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x63e6d2
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x63e858
call fcn.005ea164
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040b0c8
mov eax, esi
mov edx, 0x63e814
call fcn.0040b0c8
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x63e6ea
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x63e715
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x63e884
call fcn.005ea164
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040b0c8
mov eax, esi
mov edx, 0x63e814
call fcn.0040b0c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63e758
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.0040a224
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040a224
lea eax, [ebp - 4]
call fcn.0040a1c4
ret
Function at 0x669860
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd40
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x2a0], ecx
mov dword [ebp - 0x29c], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a2a8
xor eax, eax
push ebp
push 0x669a3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040a5a4
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x669a03
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040a5ec
lea eax, [ebp - 0x29c]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040b290
mov eax, dword [ebp - 0x29c]
mov edx, 0x669a54
call fcn.0040b258
jne 0x669908
lea eax, [ebp - 8]
mov ecx, 7
mov edx, 1
call fcn.0040b2d8
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x669a70
call fcn.0040b4a0
test eax, eax
jle 0x669944
lea eax, [ebp - 8]
push eax
mov ecx, 1
mov edx, dword [ebp - 8]
mov eax, 0x669a70
call fcn.0040b4a0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040b290
lea eax, [ebp - 0x298]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00407a68
lea eax, [ebp - 0x2a0]
mov edx, dword [ebp - 8]
mov ecx, 0
call fcn.0040ac98
mov edx, dword [ebp - 0x2a0]
lea eax, [ebp - 0x298]
call fcn.00425218
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x6699f0
mov edx, dword [eax + 0xc]
test edx, edx
je 0x6699f0
mov esi, dword [edx]
test esi, esi
je 0x6699f0
push ebx
movzx eax, byte [esi]
mov dword [ebp - 0x2c0], eax
mov byte [ebp - 0x2bc], 0
movzx eax, byte [esi + 1]
mov dword [ebp - 0x2b8], eax
mov byte [ebp - 0x2b4], 0
movzx eax, byte [esi + 2]
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 0x2ac], 0
movzx eax, byte [esi + 3]
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 0x2a4], 0
lea edx, [ebp - 0x2c0]
mov ecx, 3
mov eax, 0x669a80
call fcn.00425654
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x669a0a
call sub.wsock32.dll_WSACleanup
ret

Function at 0x669b38
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a2a8
xor eax, eax
push ebp
push 0x669b86
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040aeb8
push eax
push 0x669b90
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x669b8d
lea eax, [ebp - 4]
call fcn.0040a1c4
ret
Function at 0x669bfc
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x64
push 0
push 0
dec ecx
jne 0x669c04
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a2a8
lea ebx, [ebp - 0x2e4]
xor eax, eax
push ebp
push 0x669eed
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2ec]
xor eax, eax
call fcn.00407340
mov eax, dword [ebp - 0x2ec]
lea edx, [ebp - 0x2e8]
call fcn.00424d18
mov edx, dword [ebp - 0x2e8]
lea eax, [ebp - 8]
mov ecx, 0x669f08
call fcn.0040b120
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00407908
call fcn.00407080
mov eax, ebx
call fcn.004075c8
call fcn.00407080
mov edx, 0x669f3c
mov eax, ebx
call fcn.00407fbc
call fcn.004080bc
call fcn.00407080
mov edx, 0x669f5c
mov eax, ebx
call fcn.00407fbc
call fcn.004080bc
call fcn.00407080
push 0x669f74
lea edx, [ebp - 0x2f4]
xor eax, eax
call fcn.00407340
push dword [ebp - 0x2f4]
push 0x669f8c
lea eax, [ebp - 0x2f0]
mov edx, 3
call fcn.0040b1a8
mov edx, dword [ebp - 0x2f0]
mov eax, ebx
call fcn.00407fbc
call fcn.004080bc
call fcn.00407080
push 0x669f9c
lea edx, [ebp - 0x2fc]
xor eax, eax
call fcn.00407340
push dword [ebp - 0x2fc]
push 0x669f8c
push 0x669fc0
lea eax, [ebp - 0x2f8]
mov edx, 4
call fcn.0040b1a8
mov edx, dword [ebp - 0x2f8]
mov eax, ebx
call fcn.00407fbc
call fcn.004080bc
call fcn.00407080
mov edx, 0x669fe0
mov eax, ebx
call fcn.00407fbc
call fcn.004080bc
call fcn.00407080
push 0x669ff8
push dword [ebp - 4]
push 0x66a014
lea edx, [ebp - 0x304]
xor eax, eax
call fcn.00407340
push dword [ebp - 0x304]
push 0x669f8c
lea eax, [ebp - 0x300]
mov edx, 5
call fcn.0040b1a8
mov edx, dword [ebp - 0x300]
mov eax, ebx
call fcn.00407fbc
call fcn.004080bc
call fcn.00407080
push 0x66a028
lea edx, [ebp - 0x30c]
xor eax, eax
call fcn.00407340
push dword [ebp - 0x30c]
push 0x669f8c
push 0x66a054
lea eax, [ebp - 0x308]
mov edx, 4
call fcn.0040b1a8
mov edx, dword [ebp - 0x308]
mov eax, ebx
call fcn.00407fbc
call fcn.004080bc
call fcn.00407080
push 0x66a078
lea edx, [ebp - 0x314]
xor eax, eax
call fcn.00407340
push dword [ebp - 0x314]
push 0x669f8c
lea eax, [ebp - 0x310]
mov edx, 3
call fcn.0040b1a8
mov edx, dword [ebp - 0x310]
mov eax, ebx
call fcn.00407fbc
call fcn.004080bc
call fcn.00407080
mov edx, 0x66a09c
mov eax, ebx
call fcn.00407fbc
call fcn.004080bc
call fcn.00407080
mov edx, 0x66a0b8
mov eax, ebx
call fcn.00407fbc
call fcn.004080bc
call fcn.00407080
mov eax, ebx
call fcn.00407a10
call fcn.00407080
push 0
lea eax, [ebp - 0x31c]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x324], eax
mov byte [ebp - 0x320], 0x11
lea edx, [ebp - 0x324]
xor ecx, ecx
mov eax, 0x66a0d0
call fcn.00425654
mov edx, dword [ebp - 0x31c]
lea eax, [ebp - 0x318]
mov ecx, 0
call fcn.0040ac98
mov eax, dword [ebp - 0x318]
call fcn.0040ac0c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x669ef4
lea eax, [ebp - 0x31c]
call fcn.0040a1c4
lea eax, [ebp - 0x318]
call fcn.0040a1e8
lea eax, [ebp - 0x314]
mov edx, 0xc
call fcn.0040a224
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a224
ret
Function at 0x66a35c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a2a8
mov eax, dword [ebp - 8]
call fcn.0040a2a8
xor eax, eax
push ebp
push 0x66a436
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
jne 0x66a3c8
push 5
push 0
mov eax, dword [ebp - 8]
call fcn.0040aeb8
push eax
mov eax, dword [ebp - 4]
call fcn.0040aeb8
push eax
push 0x66a444
mov eax, dword [0x6f10bc]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
jmp 0x66a41b
lea ecx, [ebp - 0xc]
mov edx, 0x66a45c
mov eax, dword [ebp - 4]
call fcn.00424c44
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x66a474
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0066a184
push 5
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0040aeb8
push eax
push 0x66a444
mov eax, dword [0x6f10bc]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x66a43d
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a224
ret

Function at 0x66a47c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov edi, dword [0x6f10bc]
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x66a4a2
mov eax, dword [edi]
call fcn.005d5ca0
mov eax, dword [edi]
cmp byte [eax + 0xbc], 0
jne 0x66a4ad
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp esi, eax
ja 0x66a490
pop edi
pop esi
pop ebx
ret

Function at 0x66a950
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
push ebx
push esi
add esp, 0xfffffe6c
mov ebx, eax
cmp byte [ebx + 4], 0
je 0x66a964
mov al, 1
jmp 0x66a9c2
lea eax, [esp + 4]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
dec eax
jne 0x66a97a
xor eax, eax
jmp 0x66a9c2
push 0
push 2
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 8], esi
cmp esi, 0xffffffff
jne 0x66a99e
push esi
call sub.wsock32.dll_closesocket
call sub.wsock32.dll_WSACleanup
xor eax, eax
jmp 0x66a9c2
push 4
lea eax, [esp + 4]
push eax
push 0x20
push 0xffff
mov eax, dword [ebx + 8]
push eax
call sub.wsock32.dll_setsockopt
inc eax
jne 0x66a9bc
xor eax, eax
jmp 0x66a9c2
mov al, 1
mov byte [ebx + 4], 1
add esp, 0x194
pop esi
pop ebx
ret
Function at 0x66aaa0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x10
lea edx, [ebp - 0x10]
push edx
push 0
push esi
push ecx
mov eax, dword [eax + 8]
push eax
call sub.wsock32.dll_sendto
mov edi, eax
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
je 0x66aae1
call sub.wsock32.dll_WSAGetLastError
test eax, eax
jne 0x66aaec
cmp edi, 0xffffffff
je 0x66aaec
cmp esi, edi
jne 0x66aaec
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x66afd8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + 0x6e93f8]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + 0x6e93f8]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x6e93f8]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x6e93f8]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x6e8f7c]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x66affd
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x66b0c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov ecx, dword [eax + 0xc]
mov dword [edx + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov eax, dword [eax + 0x14]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + 0x6e93f8]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + 0x6e93f8]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x6e93f8]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + 0x6e93f8]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x6e8f7c]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x66b0f1
add esp, 0xc
pop edi
pop esi
pop ebx
ret