joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012f80
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001f048]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
or edi, 0xffffffff
mov dword [ebp - 0x20], 0x10
mov eax, 0x7ca
push 0x100200c0
push 0x1001a0d4
mov word [0x100200c0], ax
call fcn.1001433a
pop ecx
pop ecx
mov esi, eax
call ebx
cmp esi, 0xffffffff
jne 0x10012ffe
call ebx
cmp eax, 0x2740
jne 0x10012fed
xor eax, eax
push 0x10035288
push eax
mov word [0x10035288], ax
call fcn.1001433a
mov esi, eax
pop ecx
pop ecx
cmp esi, 0xffffffff
jne 0x10012ffe
call ebx
push eax
push str.can_not_create_listening_socket_nError__d
call fcn.100011b4
pop ecx
pop ecx
jmp 0x1001307a
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
push 8
push eax
push esi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
mov eax, dword [0x10020d68]
push 0xffffffffffffffff
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push 0
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
jne 0x10013040
push dword [ebp - 0x1c]
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1001308e
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10013065
call ebx
push eax
push str.accept_error__d
call fcn.100011b4
pop ecx
pop ecx
push dword [ebp - 0x1c]
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
cmp edi, 0xffffffff
jne 0x1001309d
cmp dword [0x10020d60], 0
je 0x100130cb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x10020d60], 0
jne 0x10012fa3
jmp 0x100130cb
push 4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x100130cb
call ebx
push eax
push str.Error__d_during_setsockopt_n
call fcn.100138a5
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10015a21
mov esp, ebp
pop ebp
ret

Function at 0x10013844
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push str.Tftpd32
push 0
mov dword [ebp - 8], 0x10018558
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1001389a
push esi
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp + 0xc]
push 2
push 0
movzx eax, ax
push eax
push 0
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x1001389d
mov esi, dword [ebp + 8]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10013bdb
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x1001f048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
or dword [ebp - 0x448], 0xffffffff
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp + 0x14]
push 0x5c
push ebx
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x458], edi
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x454], esi
call dword [sym.imp.MSVCR120.dll_strrchr]
pop ecx
pop ecx
test eax, eax
lea ecx, [eax + 1]
push 0x40
cmove ecx, ebx
lea eax, [ebp - 0x44]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ecx
push eax
call ebx
push esi
push 0x400
lea eax, [ebp - 0x444]
mov byte [ebp - 5], 0
push eax
push 0
push dword [ebp - 0x44c]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
test esi, esi
jle 0x10013cb4
mov eax, dword [ebp + 0x18]
dec eax
je 0x10013c94
sub eax, 3
jne 0x10013d55
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.MSVCR120.dll_atoi]
pop ecx
mov dword [edi], eax
jmp 0x10013d55
push dword [ebp - 0x450]
lea eax, [ebp - 0x444]
push eax
push edi
call ebx
mov eax, dword [ebp - 0x450]
mov byte [eax + edi - 1], 0
jmp 0x10013d55
push dword [ebp - 0x454]
lea eax, [ebp - 0x444]
push 0x400
push eax
push 0
push 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
lea ecx, [ebp - 0x444]
test esi, esi
jle 0x10013d3d
mov edi, dword [ebp - 0x44c]
cmp byte [ecx], 0
je 0x10013d37
mov edx, edi
mov eax, ecx
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x10013d0f
test bl, bl
je 0x10013d0b
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x10013d0f
add eax, 2
add edx, 2
test bl, bl
jne 0x10013cef
xor eax, eax
jmp 0x10013d14
sbb eax, eax
or eax, 1
test eax, eax
je 0x10013d37
mov edx, ecx
lea ebx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10013d1d
sub edx, ebx
inc edx
add ecx, edx
lea edx, [ebp - 0x444]
mov eax, ecx
sub eax, edx
cmp eax, esi
jl 0x10013ce6
mov edi, dword [ebp - 0x458]
mov eax, ecx
lea edx, [ebp - 0x444]
sub eax, edx
cmp eax, esi
jge 0x10013d68
cmp byte [ecx], 0
je 0x10013d68
mov byte [edi], 0
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10015a21
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x448]
push eax
push 0x20019
push 0
push dword [ebp - 0x45c]
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10013d53
lea eax, [ebp - 0x450]
push eax
push edi
push 0
push 0
push dword [ebp - 0x44c]
push dword [ebp - 0x448]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
cmp dword [ebp - 0x448], 0xffffffff
je 0x10013d55
push dword [ebp - 0x448]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10013d55
Function at 0x10013dc7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x494
mov eax, dword [0x1001f048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push accept
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x488], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x10013e8d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x5c
push dword [ebp - 0x48c]
call dword [sym.imp.MSVCR120.dll_strrchr]
pop ecx
pop ecx
test eax, eax
lea ecx, [eax + 1]
cmove ecx, dword [ebp - 0x48c]
lea eax, [ebp - 0x84]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0x18]
dec eax
je 0x10013e74
sub eax, 3
jne 0x10013ef7
push dword [edi]
lea eax, [ebp - 0x484]
push 0x1001a4a8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x484]
push ebx
push eax
jmp 0x10013e76
push ebx
push edi
push dword [ebp - 0x488]
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov esi, eax
jmp 0x10013ef7
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x490]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push dword [ebp - 0x48c]
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10013ef7
cmp dword [ebp + 0x18], 1
jne 0x10013ec9
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
jmp 0x10013ecc
mov eax, dword [ebp + 0x14]
push eax
push edi
push dword [ebp + 0x18]
push esi
push dword [ebp - 0x488]
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x490]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10015a21
mov esp, ebp
pop ebp
ret

Function at 0x10014138
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
xor edx, edx
and ecx, 0x10
cmp eax, 0xffffffff
cmove ecx, edx
mov eax, ecx
pop ebp
ret
Function at 0x10014155
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x374
mov eax, dword [0x1001f048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
push 0x104
push eax
lea eax, [ebp - 0x11c]
mov byte [ebp - 0x19], bl
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push str..
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x36c]
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10014257
test byte [ebp - 0x36c], 0x10
jne 0x10014241
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x368]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x374]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 9
lea eax, [ebp - 0x10]
push eax
push ebx
lea eax, [ebp - 0x22c]
push eax
push 1
push 0x800
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push dword [ebp - 0x34c]
lea eax, [ebp - 0x10]
mov byte [ebp - 8], bl
push eax
lea eax, [ebp - 0x340]
mov byte [ebp - 0x302], bl
push eax
lea eax, [ebp - 0x21c]
push str._s_t_s_t_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push dword [ebp + 0xc]
lea eax, [ebp - 0x21c]
push eax
call edi
add esp, 0x1c
lea eax, [ebp - 0x36c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100141ba
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10015a21
mov esp, ebp
pop ebp
ret

Function at 0x1001426f
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
call sub.WS2_32.dll_inet_addr
mov esi, eax
mov dword [ebp - 4], esi
cmp esi, 0xffffffff
jne 0x100142ab
push dword [ebp + 8]
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x100142ab
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 4]
push eax
call sub.MSVCR120.dll_memcpy
mov esi, dword [ebp - 4]
add esp, 0xc
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100142b2
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1001f048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test eax, eax
je 0x100142e2
push 0x1001b48c
push eax
call sub.WS2_32.dll_getservbyname
test eax, eax
je 0x100142e2
mov ax, word [eax + 8]
jmp 0x100142ea
push dword [ebp + 0x10]
call sub.WS2_32.dll_htons
push esi
mov word [ebp - 0x12], ax
call fcn.1001426f
or esi, 0xffffffff
mov dword [ebp - 0x10], eax
pop ecx
cmp eax, esi
je 0x10014329
push edi
push 2
pop eax
push 0
push 1
push eax
mov word [ebp - 0x14], ax
call sub.WS2_32.dll_socket
mov edi, eax
cmp edi, esi
je 0x10014328
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call sub.WS2_32.dll_connect
test eax, eax
cmove esi, edi
pop edi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10015a21
mov esp, ebp
pop ebp
ret

Function at 0x1001433a
Capabilities:
Create tcp socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1001f048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test eax, eax
je 0x10014373
push 0x1001b48c
push eax
call sub.WS2_32.dll_getservbyname
test eax, eax
je 0x10014373
mov ax, word [eax + 8]
jmp 0x1001437c
movzx eax, word [esi]
push eax
call sub.WS2_32.dll_htons
push 6
push 1
push 2
mov word [ebp - 0x12], ax
pop eax
push eax
call sub.WS2_32.dll_socket
mov edi, eax
or ebx, 0xffffffff
cmp edi, ebx
jne 0x1001439a
mov eax, ebx
jmp 0x100143f8
and dword [ebp - 0x10], 0
push 2
pop eax
push dword [ebp - 0x18]
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x14]
push eax
push edi
call sub.WS2_32.dll_bind
cmp eax, ebx
jne 0x100143cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call sub.WS2_32.dll_closesocket
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10014396
push 1
push edi
call sub.WS2_32.dll_listen
cmp eax, ebx
je 0x100143b6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x100143f6
push dword [ebp - 0x12]
call sub.WS2_32.dll_htons
mov word [esi], ax
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10015a21
mov esp, ebp
pop ebp
ret
Function at 0x1001448d
Capabilities:
Send data
Send data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0x10]
push esi
call sub.WS2_32.dll_htons
cmp dword [ebp + 8], 0xffffffff
movzx eax, ax
mov dword [ebp - 4], eax
jne 0x100144ad
or eax, 0xffffffff
jmp 0x10014516
cmp esi, 0x7fff
jbe 0x100144ba
push 0xfffffffffffffff7
pop eax
jmp 0x10014516
cmp dword [ebp + 0x14], 0xffffffff
push ebx
mov ebx, dword [ebp + 0xc]
push edi
je 0x100144d6
push 0
lea eax, [ebp - 8]
push eax
push esi
push ebx
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.WS2_32.dll_send
xor eax, eax
xor edi, edi
inc eax
test esi, esi
je 0x1001450c
test eax, eax
jle 0x1001450c
push 0
mov eax, esi
sub eax, edi
push eax
lea eax, [edi + ebx]
push eax
push dword [ebp + 8]
call sub.WS2_32.dll_send
add edi, eax
cmp edi, esi
jb 0x100144ef
cmp edi, esi
pop edi
sbb eax, eax
and eax, 0xfffffffe
inc eax
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001451b
Capabilities:
Download and write a file
Get socket status
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1001f048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x114], eax
cmp edi, 0xffffffff
jne 0x1001454c
or eax, 0xffffffff
jmp 0x100145f6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x104], edi
mov dword [ebp - 0x108], 1
test eax, eax
je 0x10014586
and dword [ebp - 0x10c], 0
cmp eax, 0xffffffff
je 0x10014577
mov dword [ebp - 0x110], eax
jmp 0x1001457e
and dword [ebp - 0x110], 0
lea eax, [ebp - 0x110]
jmp 0x10014588
xor eax, eax
push eax
push 0
push 0
lea eax, [ebp - 0x108]
push eax
lea eax, [edi + 1]
push eax
call sub.WS2_32.dll_select
test eax, eax
js 0x10014544
jne 0x100145a8
push 0xfffffffffffffffe
pop eax
jmp 0x100145f6
test ebx, ebx
je 0x100145f3
cmp dword [ebp + 0x10], 0
je 0x100145f3
push 0
push dword [ebp + 0x10]
push ebx
push edi
call sub.WS2_32.dll_recv
mov edi, eax
cmp edi, 0xffffffff
je 0x100145ec
test edi, edi
je 0x100145e8
mov eax, dword [ebp - 0x114]
cmp eax, 0xffffffff
je 0x100145ef
push 0
lea ecx, [ebp - 0x118]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x100145ef
xor edi, edi
jmp 0x100145ef
or edi, 0xffffffff
mov eax, edi
jmp 0x100145f6
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10015a21
mov esp, ebp
pop ebp
ret
Function at 0x10014606
Capabilities:
Send data
Send data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0xffffffff
jne 0x10014615
or eax, 0xffffffff
jmp 0x10014666
cmp dword [ebp + 0x14], 0xffffffff
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
je 0x10014635
push 0
lea eax, [ebp - 4]
push eax
push esi
push ebx
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
xor edi, edi
inc eax
test esi, esi
je 0x1001465b
test eax, eax
jle 0x1001465b
push 0
mov eax, esi
sub eax, edi
push eax
lea eax, [edi + ebx]
push eax
push dword [ebp + 8]
call sub.WS2_32.dll_send
add edi, eax
cmp edi, esi
jb 0x1001463e
cmp edi, esi
pop edi
sbb eax, eax
and eax, 0xfffffffe
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10014b8d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x1001f048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, str.DELETE
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 2
mov dword [ebp - 0x204], eax
mov eax, str.OTHER
cmovne ecx, eax
mov eax, 0x100185f8
push esi
test edi, edi
push ebx
cmovne eax, ecx
push eax
push edi
push str.TrayMessage_Call_:_msg__d___s___wnd__d__id__d_n
call fcn.100138a5
push 0x1fc
lea eax, [ebp - 0x200]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0x20
mov dword [ebp - 0x200], 0x1fc
mov dword [ebp - 0x1fc], ebx
mov dword [ebp - 0x1f8], esi
cmp edi, 2
je 0x10014c3d
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x1ec], eax
lea eax, [ebp - 0x1e8]
push 0x7f
push eax
push ebx
mov dword [ebp - 0x1f4], 7
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x200]
push eax
push edi
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x10014c6c
call fcn.10013b71
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.error__d_in_Shell_NotifyIcon___s__n
call fcn.100138a5
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10015a21
mov esp, ebp
pop ebp
ret

Function at 0x10014fde
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [ebp + 8]
xor esi, esi
mov ecx, eax
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], esi
jle 0x1001501e
mov eax, esi
mov dword [ebp + 8], esi
cdq
idiv ecx
mov eax, dword [ebp + 8]
add eax, 0xd
mov dword [ebp + 8], eax
mov cl, byte [edx + ebx]
xor byte [esi + edi], cl
inc esi
mov ecx, dword [ebp - 4]
cmp esi, dword [ebp + 0xc]
jl 0x10015003
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10015129
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x10015939
Capabilities:
Create udp socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1001f048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x11
push 2
pop esi
push esi
push esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 1
call sub.WS2_32.dll_socket
mov edi, eax
or eax, 0xffffffff
cmp edi, eax
je 0x10015a10
push 4
lea eax, [ebp - 0x1c]
push eax
push 4
push 0xffff
push edi
call sub.WS2_32.dll_setsockopt
push dword [ebp + 8]
test eax, eax
mov edx, str.setsockopt_error
mov ecx, str.UdpSend:_Port__d_may_be_reused
cmovne ecx, edx
push ecx
call fcn.100138a5
pop ecx
pop ecx
push 0
mov word [ebp - 0x14], si
call sub.WS2_32.dll_htonl
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
call sub.WS2_32.dll_htons
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push edi
call sub.WS2_32.dll_bind
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.UdpSend_bind_returns__d__error__d_
call fcn.100138a5
add esp, 0xc
test esi, esi
jns 0x100159e8
push 0xfffffffffffffff8
pop esi
jmp 0x10015a08
push 0x10
push ebx
push 0
push dword [ebp + 0x14]
push dword [ebp - 0x18]
push edi
call sub.WS2_32.dll_sendto
mov esi, eax
push esi
push str.sendto_returns__d
call fcn.100138a5
pop ecx
pop ecx
push edi
call sub.WS2_32.dll_closesocket
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10015a21
mov esp, ebp
pop ebp
ret
Function at 0x40658a
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x40
push 0x3000
push ebx
xor esi, esi
xor eax, eax
lea edi, [ebp - 4]
push esi
stosd dword es:[edi], eax
call dword [0x459340]
mov edi, eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [eax], edi
call fcn.0043ee90
add esp, 0xc
test ebx, ebx
jle 0x4065e3
lea ecx, [edi + ebx - 4]
mov eax, dword [ebp + 8]
mov edx, dword [esi + eax]
mov eax, dword [ebp - 4]
xor eax, edx
mov dword [ecx], eax
xor eax, dword [0x475eb8]
add esi, 4
mov dword [ecx], eax
sub ecx, 4
cmp esi, ebx
mov dword [ebp - 4], edx
jl 0x4065c1
pop edi
mov eax, ebx
pop esi
leave
ret
Function at 0x408c18
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [edi - 0xa0]
xor eax, eax
test ecx, ecx
jbe 0x408c4f
push 4
pop ecx
mov edi, 0x475ec0
lea esi, [eax + ebx]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x408c4c
mov ecx, dword [ebp + 8]
inc eax
add ecx, 0xffffff60
cmp eax, ecx
jb 0x408c2d
mov edi, dword [ebp + 8]
lea ecx, [edi - 0xa0]
cmp eax, ecx
jae 0x408cbd
mov byte [ebp + 0xb], 0
lea esi, [eax + ebx]
mov dword [ebp - 4], 0x50
cmp byte [ebp + 0xb], 0
jne 0x408c7d
mov eax, 0x1314
cmp word [esi], ax
jne 0x408c85
mov byte [ebp + 0xb], 1
jmp 0x408c85
call fcn.0043d344
mov word [esi], ax
inc esi
inc esi
dec dword [ebp - 4]
jne 0x408c67
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
push ebx
call dword [0x4597a0]
test eax, eax
je 0x408cbd
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x408cbd
mov eax, dword [ebx + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x408cbd
mov ecx, dword [ebp + 8]
mov dword [eax + 0x58], ecx
pop edi
xor al, al
pop esi
leave
ret 4