joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402420
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x714
push esi
lea eax, [esp + 0x588]
push edi
push eax
push 2
call sub.WS2_32.dll_WSAStartup
or ecx, 0xffffffff
mov edi, str.admin
xor eax, eax
lea edx, [esp + 8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x108]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x410818
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x188]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x410818
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x288]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x410818
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x720]
lea ecx, [esp + 8]
push edi
push ecx
mov dword [esp + 0x590], 4
call fcn.00402180
mov esi, eax
add esp, 8
test esi, esi
jne 0x402511
push edi
push str.ServerIP
push str.Settings
call fcn.004020f0
add esp, 0xc
mov eax, esi
pop edi
pop esi
add esp, 0x714
ret

Function at 0x402520
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x154
push ebx
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xor ecx, ecx
mov edi, dword [esp + 0x164]
mov dword [esp + 0xc], ecx
xor eax, eax
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x60]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x48], 1
mov dword [esp + 0x18], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov word [esp + 0x4c], 0
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x60]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.__install
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x64]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4025fb
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop edi
pop esi
pop ebx
add esp, 0x154
ret
Function at 0x402900
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
push ebx
push esi
lea eax, [esp + 0x14]
push edi
push eax
push 0x20019
push 0
push ecx
push connect
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40293f
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push 0
push eax
push 0
push esi
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call sub.MFC42.DLL_operatornew
mov edx, dword [esp + 0x1c]
add esp, 4
mov ebx, eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ebx
push ecx
push 0
push esi
push edx
call edi
test eax, eax
je 0x4029a4
push ebx
call sub.MFC42.DLL_operatordelete
mov eax, dword [esp + 0x1c]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x20]
mov ecx, eax
mov esi, ebx
mov edx, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x4029f0
Capabilities:
Set registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
lea eax, [esp]
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edx
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x402a20
xor eax, eax
pop ecx
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
push 7
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402a51
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret
Function at 0x402cf0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push ebp
push esi
mov esi, dword [esp + 0x138]
movsx eax, byte [esi]
push eax
call dword [sym.imp.MSVCRT.dll_isdigit]
add esp, 4
test eax, eax
je 0x402d23
push 0
push 0
push esi
call dword [sym.imp.MSVCRT.dll_strtoul]
add esp, 0xc
mov ebx, eax
jmp 0x402d26
or ebx, 0xffffffff
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x402d42
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x128
ret
lea ecx, [esp + 0xc]
push edi
push ecx
push ebp
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x402df2
mov edi, dword [sym.imp.MSVCRT.dll__strlwr]
jmp 0x402d6d
mov esi, dword [esp + 0x13c]
push esi
call edi
lea edx, [esp + 0x38]
mov esi, eax
push edx
call edi
add esp, 8
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x402da0
test cl, cl
je 0x402d9c
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x402da0
add eax, 2
add esi, 2
test cl, cl
jne 0x402d7c
xor eax, eax
jmp 0x402da5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov eax, dword [esp + 0x18]
je 0x402dca
cmp eax, ebx
je 0x402dca
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push eax
push ebp
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402d66
jmp 0x402df2
mov ebx, eax
lea edi, [esp + 0x34]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x140]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
pop edi
jne 0x402e01
xor ebx, ebx
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x128
ret

Function at 0x402e10
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push esi
push eax
push 0x28
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402e8c
lea ecx, [esp + 8]
push ecx
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x402e81
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push esi
push esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0xc]
push 0x10
push ecx
push esi
push edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x402e81
mov esi, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x1c
ret
Function at 0x402ea0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
call fcn.00402e10
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
lea edi, [esi + 8]
push edi
push eax
call fcn.00402cf0
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x402efa
cmp byte [edi], 0
je 0x402efa
mov ecx, dword [esp + 0x18]
push eax
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [esi + 4], eax
je 0x402ee7
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x402f00
Capabilities:
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x88
push ebx
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xor ecx, ecx
mov edi, dword [esp + 0x9c]
mov dword [esp + 0xc], ecx
xor eax, eax
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x60]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x48], 1
mov dword [esp + 0x18], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov word [esp + 0x4c], 0
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x60]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.__uninstall
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
mov eax, dword [esp + 0x9c]
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x7c]
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402fee
mov ecx, dword [esp + 0xc]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
pop edi
pop esi
pop ebx
add esp, 0x88
ret
Function at 0x403000
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push esi
push 0
push 0x2000000
push 3
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40308e
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
mov eax, 8
push ecx
push edx
mov word [esp + 0x14], 0x7d4
mov word [esp + 0x16], ax
mov word [esp + 0x1a], 0x10
mov word [esp + 0x1c], ax
mov word [esp + 0x1e], 0x27
mov word [esp + 0x20], 0
mov word [esp + 0x22], 0
mov word [esp + 0x18], 2
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [esp + 4]
lea ecx, [esp + 4]
push eax
lea edx, [esp + 8]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 0x18
ret
Function at 0x403c30
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push esi
push edi
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x403c54
pop edi
xor eax, eax
pop esi
add esp, 0x128
ret
lea eax, [esp + 8]
mov dword [esp + 8], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x403c7d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x128
ret
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__stricmp]
lea ecx, [esp + 0x30]
push str.winlogon.exe
push ecx
call ebx
add esp, 8
test eax, eax
jne 0x403c9b
mov edi, dword [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403c84
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 0x128
ret

Function at 0x403cc0
Capabilities:
Enumerate processes on remote desktop session host

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 8]
push edi
lea ecx, [esp + 8]
push eax
xor esi, esi
push ecx
push 1
or edi, 0xffffffff
push esi
push esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
call sub.WTSAPI32.dll_WTSEnumerateProcessesA
test eax, eax
je 0x403d78
mov eax, dword [esp + 0xc]
xor edi, edi
push ebx
cmp eax, esi
push ebp
jbe 0x403d62
mov ebp, dword [esp + 0x20]
mov ebx, dword [sym.imp.MSVCRT.dll__stricmp]
mov eax, dword [esp + 0x10]
mov edx, dword [esi + eax + 8]
push str.winlogon.exe
push edx
call ebx
add esp, 8
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x403d27
cmp ebp, dword [esi + eax]
je 0x403d45
mov ecx, dword [esp + 0x14]
inc edi
add esi, 0x10
cmp edi, ecx
jb 0x403d0b
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [esp + 0x18]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0xc
ret
shl edi, 4
push eax
mov ecx, dword [edi + eax + 4]
mov dword [esp + 0x1c], ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [esp + 0x18]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, dword [esp + 0x18]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0xc
ret
mov eax, edi
pop edi
pop esi
add esp, 0xc
ret
Function at 0x403e70
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x4c
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x10]
xor esi, esi
rep stosd dword es:[edi], eax
mov dword [0x410828], eax
mov dword [esp + 0xc], esi
mov dword [0x41082c], eax
mov word [esp + 0x40], 5
mov dword [0x410830], eax
mov dword [esp + 0x18], str.Winsta0Default
mov dword [0x410834], eax
mov dword [esp + 0x10], 0x44
call fcn.00403b60
lea ecx, [esp + 8]
push ecx
call fcn.00403e40
add esp, 4
test eax, eax
je 0x403f7f
mov edx, dword [esp + 8]
push esi
lea eax, [esp + 0x10]
push edx
push eax
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
push esi
je 0x403f3d
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push 0x410828
mov eax, dword [esp + 0xc]
push ecx
push esi
push edx
push 0x408
push esi
push esi
push esi
push 0x4101c0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x403f1b
mov esi, 1
mov eax, dword [esp + 0xc]
test eax, eax
je 0x403f74
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
add esp, 0x4c
ret
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esp + 0x10]
push 0x410828
mov edx, dword [esp + 0xc]
push ecx
push 0
push 0
push 8
push 0
push 0
push 0
push 0x4101c0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
test eax, eax
je 0x403f74
mov esi, 1
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
add esp, 0x4c
ret

Function at 0x403f90
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
mov byte [0x412e14], 0
sub eax, 2
jne 0x403fcf
cmp dword [esp + 4], 5
jne 0x403fcf
mov eax, dword [esp + 8]
test eax, eax
jne 0x403fcf
mov byte [0x412e14], 1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.kernel32.dll
call esi
push str.Wtsapi32.dll
mov edi, eax
call esi
push str.WTSGetActiveConsoleSessionId
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
call edi
push str.WTSQueryUserToken
push esi
mov dword [0x412e0c], eax
call edi
mov dword [0x412e10], eax
call fcn.00403e70
mov ecx, dword [0x410828]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov esi, eax
call edi
mov edx, dword [0x41082c]
push edx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x94
ret
Function at 0x404160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x3004
call fcn.0040ac50
push ebp
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x7ff
xor eax, eax
lea edi, [esp + 0x100d]
mov byte [esp + 0x100c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [esp + 8], 0x1000
call sub.MFC42.DLL_AfxGetModuleState
mov edi, dword [eax + 8]
mov eax, dword [esp + 0x3010]
push 0x410260
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
test ebp, ebp
jne 0x4041cf
pop edi
pop ebp
add esp, 0x3004
ret
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebp
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
lea edi, [esp + 0x10]
mov ecx, ebp
mov eax, dword [0x412e18]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test eax, eax
pop esi
jne 0x404222
push str.Crypt32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x404222
push str.CryptStringToBinaryA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x412e18], eax
mov edx, dword [esp + 0x3014]
push 0
lea eax, [esp + 0xc]
push 0
lea ecx, [esp + 0x1014]
push eax
push ecx
push edx
lea eax, [esp + 0x20]
push ebp
push eax
call dword [0x412e18]
mov ecx, dword [esp + 8]
lea edx, [esp + 0x100c]
push ecx
push edx
call fcn.00404090
add esp, 8
pop edi
pop ebp
add esp, 0x3004
ret

Function at 0x404270
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x114]
push esi
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jg 0x40429a
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10c
ret
push edi
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
test esi, esi
jne 0x4042b3
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
push esi
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x4042cb
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
lea eax, [esp + 0x10]
push eax
push 0x410820
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x4042ee
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
mov eax, dword [0x410820]
xor ecx, ecx
xor edx, edx
xor edi, edi
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
push edx
push str.StringFileInfo_04x_04xFileVersion
lea eax, [esp + 0x24]
push 0x100
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
push ecx
push edx
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x404343
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_atol]
add esp, 4
mov edi, eax
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
Function at 0x405670
Capabilities:
Query service status

Disassembly:
mov eax, dword [ecx + 8]
sub esp, 0x1c
test eax, eax
je 0x4056a5
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4056a5
mov eax, dword [esp + 4]
cmp eax, 1
jne 0x405697
add esp, 0x1c
ret
cmp eax, 4
jne 0x4056a5
mov eax, 2
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret
Function at 0x405a60
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], 1
mov eax, dword [esi + 4]
test eax, eax
jl 0x405a78
call fcn.00405ab0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi + 4], eax
pop esi
test eax, eax
jge 0x405a8f
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 1
push 6
push eax
call sub.WS2_32.dll_setsockopt
neg eax
sbb eax, eax
neg eax
dec eax
pop ecx
ret

Function at 0x405ae0
Capabilities:
Connect socket
Resolve dns

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
jge 0x405af8
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 8], eax
push esi
mov dword [esp + 0x10], eax
mov word [esp + 0xc], 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x405b45
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x405aee
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
test eax, eax
jne 0x405b3f
pop edi
pop esi
add esp, 0x10
ret 8
mov edx, dword [eax]
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x20]
push eax
call sub.WS2_32.dll_htons
mov edx, dword [edi + 4]
lea ecx, [esp + 8]
push 0x10
push ecx
push edx
mov word [esp + 0x16], ax
call sub.WS2_32.dll_connect
neg eax
sbb eax, eax
pop edi
neg eax
dec eax
pop esi
add esp, 0x10
ret 8

Function at 0x405b80
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push 4
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], eax
mov edx, dword [esi + 4]
push ecx
push 0x1006
push 0xffff
push edx
call sub.WS2_32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x405bb0
xor eax, eax
pop esi
ret 4
mov ecx, dword [esi + 4]
lea eax, [esp + 8]
push 4
push eax
push 0x1005
push 0xffff
push ecx
call sub.WS2_32.dll_setsockopt
inc eax
pop esi
neg eax
sbb eax, eax
ret 4
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x424207]
shl eax, 2
mov dword [0x42420b], eax
push edx
push 0
call fcn.00423b76
add al, dl
call fcn.0040e14c
pop edx
call fcn.0040e0b0
call fcn.0040e18c
push 0
call fcn.00417d1c
pop ecx
push 0x4241b0
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x42420f], eax
push 0
jmp fcn.0041f4ec
Function at 0x402f64
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push esi
push edi
mov eax, 0x424a04
call fcn.00417108
mov dword [ebp - 8], 1
mov word [ebp - 0x14], 8
mov esi, 0x4247ac
lea edi, [ebp - 0x150]
mov ecx, 0x4a
rep movsd dword es:[edi], dword [esi]
push 0
push 0xf
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x28]
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x40300c
lea edx, [ebp + 8]
push edx
call fcn.00402374
pop ecx
push eax
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00416dc4
add esp, 8
test eax, eax
jne 0x402ff9
mov eax, 1
push eax
dec dword [ebp - 8]
push 2
lea edx, [ebp + 8]
push edx
call fcn.0040232c
add esp, 8
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x40302b
lea ecx, [ebp - 0x150]
push ecx
push dword [ebp - 0x28]
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x402fb7
xor eax, eax
push eax
dec dword [ebp - 8]
push 2
lea edx, [ebp + 8]
push edx
call fcn.0040232c
add esp, 8
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403034
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
mov eax, 0x424a28
call fcn.00417108
mov dword [ebp - 8], 1
mov word [ebp - 0x14], 8
mov dword [ebp - 0x28], 0x1e
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x48]
push ecx
call sub.ADVAPI32.DLL_GetUserNameA
lea eax, [ebp + 8]
push eax
call fcn.00402374
pop ecx
push eax
lea edx, [ebp - 0x48]
push edx
call fcn.00416dc4
add esp, 8
test eax, eax
jne 0x4030a4
mov eax, 1
push eax
dec dword [ebp - 8]
push 2
lea edx, [ebp + 8]
push edx
call fcn.0040232c
add esp, 8
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x4030c3
xor eax, eax
push eax
dec dword [ebp - 8]
push 2
lea edx, [ebp + 8]
push edx
call fcn.0040232c
add esp, 8
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret