joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f30
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x208
push 0x415484
push str.PROCEXP90
call fcn.00401120
add esp, 8
test eax, eax
jne 0x401fde
lea eax, [esp + 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x104]
push str.PROCEXP90.SYS
push ecx
lea edx, [esp + 8]
push str._sDrivers_s
push edx
call fcn.00407778
lea eax, [esp + 0x10]
push eax
push str.RCDRIVERNT
call fcn.004010a0
add esp, 0x18
test al, al
jne 0x401f9e
xor eax, eax
add esp, 0x208
ret
lea ecx, [esp]
push 0x415484
push ecx
push str.PROCEXP90
call fcn.004011c0
add esp, 0xc
test eax, eax
jne 0x401fd3
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
add esp, 0x208
ret
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
add esp, 0x208
ret

Function at 0x401ff0
Capabilities:
Check os version

Disassembly:
mov al, byte [0x414884]
sub esp, 0xc
test al, al
jne 0x40208d
mov byte [0x414884], 1
call fcn.00401490
test al, al
je 0x402087
call fcn.00401f30
test eax, eax
je 0x402087
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
mov dword [0x415480], eax
jae 0x40208d
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [0x415484]
lea ecx, [esp + 0xc]
push 4
push ecx
lea edx, [esp + 0x10]
push 4
push edx
push 0x83350008
push eax
mov dword [esp + 0x20], 0x35d
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x402066
mov ecx, dword [esp + 4]
mov eax, dword [esp]
cmp ecx, eax
jae 0x40208d
push 0x10
push 0x411304
push 0x4112b0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [0x415484]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add esp, 0xc
ret
mov al, 1
add esp, 0xc
ret

Function at 0x4023e0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x414edc]
sub esp, 0x12c
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 2
push 0xffffffffffffffff
push 0x100c
push eax
call esi
cmp eax, 0xffffffff
je 0x40248f
mov edx, dword [0x414edc]
lea ecx, [esp + 4]
push ecx
push 0
push 0x1005
push edx
mov dword [esp + 0x14], 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
call esi
mov eax, dword [esp + 0x24]
mov esi, eax
add eax, 0x14
push eax
lea eax, [esp + 0x30]
push 0x4115d0
push eax
call fcn.00407778
mov edx, dword [esp + 0x140]
add esp, 0xc
lea ecx, [esp + 0x2c]
push 0x34
push 0x411304
push ecx
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x40248f
mov eax, dword [esi + 0x10]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40248f
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x4152b8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
add esp, 0x12c
ret
Function at 0x4024b0
Capabilities:
Set tcp connection state

Disassembly:
mov eax, dword [0x414edc]
sub esp, 0x3c
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 2
push 0xffffffffffffffff
push 0x100c
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x402552
mov edx, dword [0x414edc]
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0x1005
push edx
mov dword [esp + 0x2c], 4
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0
call edi
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0x42c]
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 0x430]
mov dword [esp + 0x10], edx
mov ecx, dword [eax + 0x640]
mov dword [esp + 0x14], ecx
mov edx, dword [eax + 0x644]
lea eax, [esp + 8]
mov dword [esp + 0x18], edx
push eax
mov dword [esp + 0xc], 0xc
call sub.iphlpapi.dll_SetTcpEntry
mov ecx, dword [0x414edc]
push 2
push esi
push 0x100c
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x4024d3
mov edx, dword [0x4152b8]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
add esp, 0x3c
ret
Function at 0x4028e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x44
push ebx
push esi
lea eax, [esp + 0x10]
push edi
push eax
push 0x3c
push 0xd
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [str.MS_Sans_Serif]
mov eax, dword [0x411638]
mov edx, dword [0x411634]
mov dword [esp + 0x30], ecx
mov cx, word [0x41163c]
xor ebx, ebx
mov word [esp + 0x3c], cx
mov dword [esp + 0x38], eax
mov ecx, 0xf
lea esi, [esp + 0x14]
mov edi, 0x41540c
mov dword [esp + 0x24], 0x190
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], ebx
mov dword [esp + 0x34], edx
mov eax, closesocket
rep movsd dword es:[edi], dword [esi]
mov dword [0x4153e8], eax
mov dword [0x4153e4], eax
mov eax, dword [0x414ee4]
mov ecx, 0x64
and eax, 0xff
mov dword [0x4153f4], ecx
mov dword [0x4153f8], ecx
mov dword [0x4153f0], 0x1f4
lea eax, [eax + eax*4]
mov dword [0x4153fc], ecx
mov dword [0x415400], ecx
mov byte [0x415408], bl
lea edx, [eax + eax*4]
mov byte [0x415409], bl
mov dword [0x415450], ebx
mov dword [0x415448], 0x3e8
lea eax, [edx*4 + 0x1c2]
lea edx, [esp + 0xc]
mov dword [0x4153ec], eax
push edx
mov al, 1
push str.SoftwareSysinternalsTCPView
push closesocket
mov byte [0x41544d], al
mov byte [0x41544c], al
mov byte [0x415454], al
mov dword [0x415404], ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0x4153e0
push ebx
push ebx
push str.Settings
push ecx
mov dword [esp + 0x28], 0x78
mov dword [0x4153e0], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x41540c
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
pop edi
pop esi
mov dword [0x4153c8], eax
pop ebx
add esp, 0x44
ret

Function at 0x402a40
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov dword [0x4153e0], 0x78
push ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push esi
call dword [sym.imp.USER32.dll_IsIconic]
mov edi, dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x402aa2
push esi
call edi
test eax, eax
jne 0x402aa2
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [0x4153e4], eax
sub edx, eax
mov eax, dword [esp + 0x18]
sub eax, ecx
mov dword [0x4153e8], ecx
mov dword [0x4153ec], edx
mov dword [0x4153f0], eax
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov byte [0x415408], al
xor edi, edi
mov esi, 0x4153f4
mov ecx, dword [0x414edc]
push 0
push edi
push 0x101d
push ecx
call ebx
mov dword [esi], eax
add esi, 4
inc edi
cmp esi, 0x415408
jl 0x402ab7
lea edx, [esp + 0x20]
push edx
push str.SoftwareSysinternalsTCPView
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov eax, dword [esp + 0x20]
push 0x78
push 0x4153e0
push 3
push 0
push str.Settings
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x403830
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x30
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov ecx, 0x411504
mov eax, 0x4153f4
mov edx, dword [eax]
add eax, 4
mov dword [ecx], edx
add ecx, 8
cmp eax, 0x415408
jb 0x403843
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
lea eax, [esp + 0xc]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
mov ecx, dword [0x415478]
mov eax, dword [esp + 0x18]
xor edi, edi
sub edx, ebp
push edi
push ecx
push 0x6d
sub edx, 0x1c
push esi
push edx
sub eax, dword [esp + 0x24]
push eax
push 0x1c
push edi
push 0x40800401
push 0x414888
push str.SysListView32
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
cmp esi, edi
jne 0x4038b5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x30
ret
mov bl, byte [0x414ee4]
xor eax, eax
test bl, bl
sete al
mov ecx, 5
mov dword [esp + 0x20], 0xf
sub ecx, eax
mov dword [esp + 0x24], edi
je 0x40393b
mov ebx, 0x411504
mov ebp, 0x64
mov ecx, dword [ebx]
add eax, edi
test ecx, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], ecx
je 0x4038f9
cmp ecx, 0x1f4
jle 0x4038fd
mov dword [esp + 0x28], ebp
mov edx, dword [eax*8 + 0x411500]
lea ecx, [esp + 0x20]
push ecx
push eax
push 0x101b
push esi
mov dword [esp + 0x3c], edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x4038ab
mov dl, byte [0x414ee4]
inc edi
add ebx, 8
xor eax, eax
test dl, dl
sete al
mov edx, 5
sub edx, eax
cmp edi, edx
jb 0x4038e1
push 0x20
push 0x20
push 0x1036
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x403470
push 0xfffffffffffffffc
push esi
call ebx
push 0x100
push 0x100
push 1
push 0x10
push 0x10
mov dword [0x4152b4], eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov ebp, dword [sym.imp.USER32.dll_LoadIconA]
mov edi, eax
mov eax, dword [0x415478]
push 0xcb
push eax
call ebp
push eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov ecx, dword [0x415478]
push 0x71
push ecx
call ebp
push eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
or al, 0x40
push eax
push 0xfffffffffffffff0
push esi
call ebx
push edi
push 1
push 0x1003
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 5
push esi
mov dword [0x4152b8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret

Function at 0x403f40
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x160
mov ecx, dword [esp + 0x164]
xor eax, eax
mov dword [esp], eax
cmp byte [ecx], 0
je 0x403f7a
mov eax, dword [esp + 0x168]
lea edx, [esp]
or ah, 1
push eax
push 0x160
push edx
push 0
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [esp]
add esp, 0x160
ret
Function at 0x4040c0
Capabilities:
Identify system language via api

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edi, dword [esp + 0x10]
push eax
push edi
call fcn.00403fd0
add esp, 0xc
test eax, eax
jne 0x4040fd
push esi
push 0x409
push edi
call fcn.00403fd0
add esp, 0xc
test eax, eax
jne 0x4040fd
push esi
push eax
push edi
call fcn.00403fd0
add esp, 0xc
pop edi
pop esi
ret

Function at 0x404a70
Capabilities:
Create thread
Get hostname

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
push edi
call sub.WS2_32.dll_htonl
mov ebx, eax
mov al, byte [esp + 0x10]
test al, al
mov dword [esp + 0x18], ebx
jne 0x404abb
mov eax, ebx
xor ecx, ecx
and eax, 0xff
xor edx, edx
mov dl, byte [esp + 0x1a]
mov cl, bh
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
shr ebx, 0x18
push ebx
push str._d._d._d._d
push eax
call fcn.00407778
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
ret
mov esi, dword [esp + 0x1c]
push esi
push ebx
call fcn.00404640
add esp, 8
test al, al
je 0x404ad3
pop edi
pop esi
mov al, 1
pop ebx
ret
test edi, edi
jne 0x404ae8
mov ecx, dword [esp + 0x20]
push ecx
push esi
call sub.WS2_32.dll_gethostname
pop edi
pop esi
mov al, 1
pop ebx
ret
cmp edi, 0x100007f
jne 0x404b2a
mov eax, dword [esp + 0x14]
test eax, eax
je 0x404b09
mov edx, dword [esp + 0x20]
push edx
push esi
call sub.WS2_32.dll_gethostname
pop edi
pop esi
mov al, 1
pop ebx
ret
mov eax, dword [str.localhost]
pop edi
mov dword [esi], eax
mov ecx, dword [0x4117c4]
mov dword [esi + 4], ecx
mov dx, word [0x4117c8]
mov word [esi + 8], dx
pop esi
mov al, 1
pop ebx
ret
mov eax, ebx
xor ecx, ecx
and eax, 0xff
xor edx, edx
mov dl, byte [esp + 0x1a]
push eax
mov cl, bh
mov eax, ebx
push ecx
push edx
shr eax, 0x18
push eax
push str._d._d._d._d
push esi
call fcn.00407778
add esp, 0x18
push 0x415280
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x414eec]
test eax, eax
je 0x404b7e
cmp dword [eax + 0x104], ebx
je 0x404b7a
mov eax, dword [eax + 0x108]
test eax, eax
jne 0x404b66
jmp 0x404b7e
test eax, eax
jne 0x404baf
push 0x10c
call fcn.004079b7
mov dword [eax + 0x104], ebx
mov ecx, dword [0x414eec]
push edi
push 0
mov dword [eax + 0x108], ecx
push 0x404910
mov dword [0x414eec], eax
call fcn.00407e0c
add esp, 0x10
push 0x415280
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x406dd0
Capabilities:
Acquire debug privileges
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x1c]
push esi
push edi
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x406e06
push 0x4119bc
call fcn.00407f7f
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
add esp, 0x1ac
ret 0x10
push str.SeDebugPrivilege
call fcn.00401000
add esp, 4
call fcn.00406b60
test al, al
mov byte [0x414ee4], al
jne 0x406e2b
call fcn.00401ff0
mov byte [0x414ee4], al
mov esi, dword [esp + 0x1b8]
push esi
call fcn.00406c40
add esp, 4
test eax, eax
jne 0x406e4a
pop edi
pop esi
add esp, 0x1ac
ret 0x10
mov ecx, dword [esp + 0x1c4]
push ecx
push esi
call fcn.00406cf0
mov edi, eax
add esp, 8
test edi, edi
jne 0x406e6c
pop edi
pop esi
add esp, 0x1ac
ret 0x10
push ebp
push str.TCPVIEW
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov ebp, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
lea edx, [esp + 0x14]
push 0
push edx
mov esi, eax
call ebp
test eax, eax
je 0x406ece
push ebx
mov ebx, dword [sym.imp.USER32.dll_TranslateAcceleratorA]
lea eax, [esp + 0x10]
push eax
push esi
push edi
call ebx
test eax, eax
jne 0x406ebc
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
lea eax, [esp + 0x18]
push 0
push eax
call ebp
test eax, eax
jne 0x406e99
pop ebx
pop ebp
pop edi
xor eax, eax
pop esi
add esp, 0x1ac
ret 0x10
Function at 0x406ee0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
mov eax, 0x1014
call fcn.00407b00
push esi
mov esi, dword [esp + 0x101c]
push edi
push esi
push str.Connecting_to__s..._n
call fcn.00407f7f
add esp, 8
push esi
call sub.WS2_32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x406f1b
call sub.WS2_32.dll_WSAGetLastError
pop edi
pop esi
add esp, 0x1014
ret
push 0x2b
mov word [esp + 0x10], 2
call sub.WS2_32.dll_htons
mov word [esp + 0xe], ax
mov eax, dword [esi + 0xc]
push 0
push 1
mov ecx, dword [eax]
push 2
mov edx, dword [ecx]
mov dword [esp + 0x1c], edx
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 8], esi
jne 0x406f5d
call sub.WS2_32.dll_WSAGetLastError
pop edi
pop esi
add esp, 0x1014
ret
lea eax, [esp + 0xc]
push 0x10
push eax
push esi
call sub.WS2_32.dll_connect
test eax, eax
je 0x406f7c
call sub.WS2_32.dll_WSAGetLastError
pop edi
pop esi
add esp, 0x1014
ret
mov ecx, dword [esp + 0x1024]
lea edx, [esp + 0x1c]
push ecx
push 0x411abc
push edx
call fcn.00407778
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0
lea eax, [esp + 0x20]
push ecx
push eax
push esi
call sub.WS2_32.dll_send
test eax, eax
jne 0x406fc4
call sub.WS2_32.dll_WSAGetLastError
pop edi
pop esi
add esp, 0x1014
ret
mov edi, dword [esp + 0x1028]
push ebx
push ebp
xor ebp, ebp
push ebp
lea ecx, [esp + 0x28]
push 0x1000
push ecx
push esi
mov dword [edi], 0
call sub.WS2_32.dll_recv
mov ebx, eax
cmp ebx, 0xffffffff
je 0x407066
jmp 0x406ff6
mov edi, dword [esp + 0x1030]
test ebx, ebx
je 0x407066
mov eax, dword [edi]
test eax, eax
jne 0x40700e
lea edx, [ebx + 1]
push edx
call fcn.004079b7
add esp, 4
jmp 0x40701c
lea ecx, [ebx + ebp + 1]
push ecx
push eax
call fcn.00407fc0
add esp, 8
mov ecx, ebx
mov dword [edi], eax
mov edi, eax
mov edx, ecx
lea esi, [esp + 0x24]
add edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1030]
mov ecx, edx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x28]
add ebp, ebx
push 0x1000
push edx
push eax
mov byte [ecx + ebp], 0
call sub.WS2_32.dll_recv
mov esi, dword [esp + 0x10]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x406fef
push esi
call sub.WS2_32.dll_closesocket
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x1014
ret

Function at 0x40d58e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
pushal
jmp 0x40d69f
call 0x40d6a4
pop ebx
sub ebx, 0x4012fe
mov edi, ebx
add edi, 0x4012fe
add edi, 0x14
jmp fcn.0040d6e0
Function at 0x40d59a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12
mov edx, dword ss:[ebp + 8]
push ebx
push esi
push edi
mov eax, dword ds:[edx + 0x3c]
mov eax, dword ds:[eax + edx + 0x78]
add eax, edx
mov ebx, dword ds:[eax + 0x18]
mov ecx, dword ds:[eax + 0x1c]
mov esi, dword ds:[eax + 0x20]
mov eax, dword ds:[eax + 0x24]
add ecx, edx
add eax, edx
mov dword ss:[ebp - 0x14], ecx
add esi, edx
mov dword ss:[ebp - 0x18], eax
Function at 0x4075c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x4075cf
pop dword [ebp - 0x44]
mov eax, 0xe4c1ac1d
add eax, 0x1b7ec9b2
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xa7f1c61f
sub dword [ebp - 0x54], 0x599f80d4
mov dword [ebp - 0x50], 0x73599419
add dword [ebp - 0x50], 0xbed9b82c
mov dword [ebp - 0x4c], 0x62354b41
add dword [ebp - 0x4c], 0xea16f8ed
mov dword [ebp - 0x48], 0x524abd03
add dword [ebp - 0x48], 0xadb542fd
lea eax, [ebp - 0x54]
push eax
mov eax, 0xed5a15f2
add eax, 0x12e74aa6
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xecf1b62a
add dword [ebp - 0x54], 0x8780b32c
mov dword [ebp - 0x50], 0xd8ec7eec
add dword [ebp - 0x50], 0x687fe289
mov dword [ebp - 0x4c], 0x4b78e7af
add dword [ebp - 0x4c], 0x17f684bd
mov dword [ebp - 0x48], 0x83c7c6c8
add dword [ebp - 0x48], 0x7c383938
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xeb27e400
add eax, 0x15197c74
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3a1ee
push 0
call eax
mov ecx, 0x4458
xor ebx, ebx
add ebx, eax
mov edi, 0xa554e54b
add edi, 0x5aedc0b5
add edi, dword [ebp - 0x44]
mov edx, 0xb8e51429
add edx, 0x843346a
sub dword [ebp - 4], ebx
mov esi, dword [edi]
xor dword [ebp - 0x28], edi
sub esi, edx
add dword [ebp - 8], ecx
mov dword [ebx], esi
add dword [ebp - 0x1c], edi
add ebx, 0x414c904
sub ebx, 0x414c900
add edi, 4
loop 0x4076ed
add eax, 0xc6f64c47
sub eax, 0xc6f54814
xor ebx, ebx
add ebx, eax
add eax, 0x84a93ff3
add eax, 0x7b56c012
mov ecx, 0xaf9cf211
sub ecx, 0xaf5cf211
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x401f50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
mov dword [esp + 4], 0xc8
push eax
push 0xf003f
push 0
push str.SoftWarePIAS2000
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 8]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0xc
ret
Function at 0x405df0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 0x10]
lea esi, [edi + edi*4]
push eax
shl esi, 6
add esi, edi
push 0
shl esi, 5
push edi
push 0x407ff0
add esi, edi
push 0
push 0
shl esi, 2
call ebx
lea ecx, [esp + 0x10]
mov dword [esi + 0x461740], eax
push ecx
push 0
push edi
push 0x4089e0
push 0
push 0
call ebx
mov dword [esi + 0x461744], eax
pop edi
pop esi
pop ebx
test eax, eax
jne 0x405e4d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret

Function at 0x405e50
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [esp + 4]
push edi
push eax
push 0
push 0
push 0x408190
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x461700], eax
test eax, eax
jne 0x405e80
push 0
call edi
mov eax, dword [0x4616c4]
test eax, eax
jbe 0x405ea9
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x408590
push 0
push 0
call esi
test eax, eax
mov dword [0x4616fc], eax
jne 0x405ea9
push eax
call edi
mov eax, dword [0x4616b8]
test eax, eax
jbe 0x405ed2
lea edx, [esp + 8]
push edx
push 0
push 0
push 0x408600
push 0
push 0
call esi
test eax, eax
mov dword [0x4616f0], eax
jne 0x405ed2
push eax
call edi
mov eax, dword [0x4616c0]
test eax, eax
jbe 0x405efb
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x408650
push 0
push 0
call esi
test eax, eax
mov dword [0x4616f8], eax
jne 0x405efb
push eax
call edi
mov eax, dword [0x4616bc]
test eax, eax
jbe 0x405f24
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x408860
push 0
push 0
call esi
test eax, eax
mov dword [0x4616f4], eax
jne 0x405f24
push eax
call edi
lea edx, [esp + 8]
push edx
push 0
push 0
push 0x4089b0
push 0
push 0
call esi
test eax, eax
mov dword [0x46170c], eax
jne 0x405f44
push eax
call edi
pop edi
pop esi
pop ecx
ret
Function at 0x405f60
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x224
lea eax, [esp + 0x94]
push esi
push eax
push 0x101
mov dword [esp + 0xc], 1
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x405fbc
call sub.WSOCK32.dll_WSAGetLastError
push eax
lea ecx, [esp + 0x1c]
push str.InitBroadcastUDP.WSAStartup__error._d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x18]
push 0
push str.InitBroadcastUDP
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
add esp, 0x224
ret
push 0x11
push 2
push 2
call sub.WSOCK32.dll_socket
lea ecx, [esp + 4]
push 4
push ecx
push 0x20
push 0xffff
push eax
mov dword [0x410cc0], eax
call sub.WSOCK32.dll_setsockopt
test eax, eax
jge 0x405ffc
push str.IEC103UDPSock_setsockopt_SO_BROADCAST__Fail_
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
xor eax, eax
pop esi
add esp, 0x224
ret
mov eax, dword [0x410cc0]
lea edx, [esp + 4]
push edx
push 0x8004667e
push eax
call sub.WSOCK32.dll_ioctlsocket
mov esi, dword [sym.imp.MSVCRT.dll_printf]
test eax, eax
jge 0x406025
push str.IEC103UDPSock_set_socket_to_nonblock_fail__n
call esi
add esp, 4
push 0x408
call sub.WSOCK32.dll_htons
push 0
mov word [esp + 0xe], ax
mov word [esp + 0xc], 2
call sub.WSOCK32.dll_htonl
mov edx, dword [0x410cc0]
lea ecx, [esp + 8]
push 0x10
push ecx
push edx
mov dword [esp + 0x18], eax
call sub.WSOCK32.dll_bind
test eax, eax
jge 0x406071
push str.IEC103UDPSock_bind___Fail_
call esi
add esp, 4
xor eax, eax
pop esi
add esp, 0x224
ret
mov eax, 1
pop esi
add esp, 0x224
ret