joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ef40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
test esi, esi
je 0x40f071
cmp dword [edi + 0xc], 0
je 0x40ef7f
mov eax, dword [edi + 0xc]
dec eax
je 0x40ef69
dec eax
je 0x40ef75
jmp 0x40ef7f
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
jmp 0x40ef7f
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
mov byte [ebp - 5], 0
xor edx, edx
mov dword [ebp - 0xc], edx
cmp dword [edi + 0xc], 0
je 0x40efdb
xor ebx, ebx
cmp esi, ebx
jle 0x40eff8
push 0
lea eax, [ebp - 0xc]
push eax
mov edx, esi
sub edx, ebx
cmp edx, 0x4000
jge 0x40efac
mov ecx, esi
sub ecx, ebx
jmp 0x40efb1
mov ecx, 0x4000
push ecx
mov eax, dword [ebp - 4]
add eax, ebx
push eax
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne dl
and edx, 1
mov byte [ebp - 5], dl
test dl, dl
je 0x40eff8
add ebx, 0x4000
cmp esi, ebx
jg 0x40ef94
jmp 0x40eff8
push 0
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 4]
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne cl
and ecx, 1
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
jne 0x40f06d
cmp byte [edi + 0x14], 0
je 0x40f06d
cmp dword [edi + 0xc], 0
jne 0x40f06d
lea edx, [edi + 0x17]
mov eax, 0x41c1a0
call fcn.0040cefc
test al, al
je 0x40f057
mov ecx, dword [ebp - 0xc]
cmp ecx, esi
jae 0x40ef7f
cmp dword [ebp - 0xc], 0
jbe 0x40ef7f
mov eax, edi
call fcn.0040f2a8
push edx
push eax
mov eax, dword [ebp - 0xc]
xor edx, edx
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
xor edx, edx
mov eax, edi
call fcn.0040f1f0
jmp 0x40ef7f
lea ecx, [edi + 0x17]
mov eax, 0x41c1a0
xor edx, edx
call fcn.0040cee4
jmp 0x40f06d
mov byte [edi + 8], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40f16c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push esi
push edi
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x40f196
cmp esi, 0x4e20
jle 0x40f18c
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x40f1e6
mov eax, ebx
call fcn.0040f4b4
test al, al
je 0x40f1cd
cmp esi, 0x4e20
jle 0x40f1cd
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.0040f16c
jmp 0x40f1e9
cmp dword [ebx + 0xc], 1
jne 0x40f1e1
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x40f1e1
xor eax, eax
jmp 0x40f1e9
or eax, 0xffffffff
jmp 0x40f1e9
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x410750
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [0x415788], 0
jne 0x410769
call fcn.00410394
mov dword [0x415784], eax
inc byte [0x415788]
call fcn.00410394
sub eax, dword [0x415784]
cmp eax, 0x64
jle 0x4107a5
cmp dword [0x416194], 0
je 0x4107a0
mov eax, 0x41c1a0
mov edx, 0xff
call fcn.0040d09c
mov eax, 0x41c1a0
mov edx, 0xff
call fcn.0040d094
call fcn.00402c88
ret
Function at 0x4025d8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402607
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00402eb0
jmp 0x402625
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402560
mov edi, eax
test ebx, ebx
je 0x402625
cmp dword [esi], 0
je 0x402625
dec ebx
jmp 0x40260e
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402668
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402700
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4026e0
xor eax, eax
push ebp
push 0x4026d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40271c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4026e0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x40312c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4032e8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x40318d
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x403304
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4031ff
xor eax, eax
push ebp
push 0x4031f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00402f84
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4031e1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x403324
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4031ff
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4032e0
cmp byte [ebp - 0xd], 0
jne 0x403241
cmp byte [ebp - 0x12], 0
je 0x4032e0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40325a
dec ebx
cmp byte [ebx], 0x2e
je 0x403269
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x403259
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4032e0
inc ebx
cmp byte [ebp - 0x12], 0
je 0x403296
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4032e0
cmp byte [ebp - 0xd], 0
je 0x4032e0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4032e0
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403c58
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, 0x403c28
call fcn.00403b1c
xor eax, eax
push ebp
push 0x403cbf
push dword fs:[eax]
mov dword fs:[eax], esp
push 3
push 0x403ccc
push 0x403ccc
lea edx, [ebp - 0x10]
mov eax, 1
call fcn.004025d8
mov eax, dword [ebp - 0x10]
call fcn.00402ee0
push eax
push 0x403cd0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403cc6
lea eax, [ebp - 0x10]
call fcn.00402e68
ret
Function at 0x404df0
Capabilities:
Persist via run registry key

Disassembly:
mov al, byte [0x42fb58]
sub esp, 0x108
test al, al
push ebp
mov ebp, ecx
je 0x404e49
push 0
push 0x42fb58
call fcn.0040ca30
add esp, 8
or eax, eax
je 0x404e33
push 0x42fb58
push str.DeletedSpud___s_
call fcn.00407160
add esp, 8
mov byte [0x42fb58], 0
jmp 0x405018
push 0
push 0x337
mov ecx, ebp
call fcn.004066e0
pop ebp
add esp, 0x108
ret
push 0x200
push 0x42fc5c
call fcn.00406a50
add esp, 8
or eax, eax
jne 0x404e78
push 0x42fc5c
push 0x32c
push ebp
pop ecx
call fcn.004066e0
pop ebp
add esp, 0x108
ret
push 0x200
push 0x42fe5c
call fcn.00406b40
add esp, 8
or eax, eax
jne 0x404ea3
push eax
push 0x32e
mov ecx, ebp
call fcn.004066e0
pop ebp
add esp, 0x108
ret
push 1
mov ecx, ebp
call fcn.00406fb0
test eax, eax
je 0x405036
call fcn.0040a4f0
or eax, eax
push 0
je 0x404ed3
push 0x339
mov ecx, ebp
call fcn.004066e0
pop ebp
add esp, 0x108
ret
push str.Deleting
push str.softwareQwertyuioTrickler
push reloc.WSOCK32.dll_bind
call fcn.0040a070
add esp, 0x10
test eax, eax
je 0x404f1b
push str.App_was_already_in_Deleting_mode
mov dword [ebp + 0x14c], 1
call fcn.00407160
add esp, 4
push ebp
pop ecx
push 0
push 0x32b
call fcn.004066e0
pop ebp
add esp, 0x108
ret
push edi
call fcn.0040a4a0
push eax
call fcn.0040a700
push 0
push 1
call fcn.0040a5c0
push 0
push str.GetGator
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
call fcn.0040a110
push eax
pop edi
add esp, 0x1c
or edi, edi
je 0x40500e
mov al, byte [edi]
push esi
cmp al, 0x22
mov esi, edi
jne 0x404f76
lea esi, [edi + 1]
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov cl, byte [eax + esi - 1]
lea eax, [eax + esi - 1]
cmp cl, 0x22
jne 0x404f76
mov byte [eax], 0
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 0x42fb58
call esi
lea eax, [esp + 0x10]
push 0x42fb58
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea ecx, [esp + 0x10]
push 0x429c84
push ecx
call esi
lea edx, [esp + 0x10]
push str._remove
push edx
call esi
push 0x42fb58
push str.CSpudDelete___s_
call fcn.00407160
lea eax, [esp + 0x14]
push 0
lea ecx, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x20], 0
call fcn.0040d5e0
add esp, 0x14
test eax, eax
pop esi
je 0x404ff0
push 1
push 0x1e
push ebp
pop ecx
call fcn.004064e0
mov eax, 0x429578
jmp 0x404ff5
mov eax, str.Failed
mov edx, dword [esp + 8]
push edx
push eax
push str.CSpudDeleteExecRslt:__s__err_d_
call fcn.00407160
push edi
call fcn.0041b272
add esp, 0x10
mov al, byte [0x42fb58]
pop edi
test al, al
jne 0x405036
push 0x42fe5c
push 0x42fc5c
call fcn.00403cb0
add esp, 8
call fcn.00403cd0
push ebp
pop ecx
call fcn.00406770
pop ebp
add esp, 0x108
ret
Function at 0x40a5c0
Capabilities:
Persist via run registry key

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
sub ebp, ebp
push esi
push edi
or ebx, ebx
jne 0x40a5d5
call fcn.0040a4a0
mov ebx, eax
mov esi, dword [esp + 0x14]
push ebx
push esi
push str.StartWithWindows:__d__s
call fcn.00407160
add esp, 0xc
test esi, esi
push 0
je 0x40a660
push str.DontStartWithWindows
call fcn.00409ff0
add esp, 8
or eax, eax
jne 0x40a64c
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
add eax, 0x32
push eax
call fcn.0041b345
mov esi, eax
add esp, 4
or esi, esi
je 0x40a659
push ebx
push 0x42b2c8
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
push esi
push str.Trickler
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
call fcn.0040b170
push esi
mov edi, eax
call fcn.0041b272
add esp, 0x20
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push str._t__Inhibited_by_test_setting
call fcn.00407160
add esp, 4
pop edi
push ebp
pop eax
pop esi
pop ebp
pop ebx
ret
push str.Trickler
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
call fcn.0040a110
push eax
pop edi
add esp, 0x10
test edi, edi
je 0x40a6f5
mov al, byte [edi]
mov esi, edi
cmp al, 0x22
jne 0x40a688
lea esi, [edi + 1]
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp eax, 1
jle 0x40a6a0
cmp byte [eax + esi - 1], 0x22
jne 0x40a6a0
mov byte [eax + esi - 1], 0
push esi
push ebx
call fcn.0041bfb0
add esp, 8
test eax, eax
jne 0x40a6d7
push str.Trickler
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
call fcn.0040b2f0
add esp, 0xc
push eax
pop ebp
push edi
call fcn.0041b272
add esp, 4
push ebp
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push str.StartWithWindows:_NOT_removing_app_startup:_Different_paths_____s_
call fcn.00407160
add esp, 8
push edi
call fcn.0041b272
add esp, 4
push ebp
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
pushfd
xor eax, eax
inc eax
popfd
pop ebx
ret

Function at 0x40a7e0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x610
push esi
push edi
push 0x7f
pop ecx
nop
nop
xor eax, eax
lea edi, [esp + 9]
mov byte [esp + 8], 0
rep stosd dword es:[edi], eax
mov esi, dword [esp + 0x620]
push 0x200
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [esp + 0x61c]
lea ecx, [esp + 8]
push ecx
push esi
push edx
lea eax, [esp + 0x214]
push str._s_t_lu_t_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x21c]
push ecx
push str.OldTrickler
push str.softwareQwertyuioTrickler
push reloc.WSOCK32.dll_bind
call fcn.0040b170
add esp, 0x24
pop edi
pop esi
add esp, 0x610
ret
Function at 0x40be60
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x6c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x7c]
lea eax, [esp + 0x1c]
push edi
xor edi, edi
push eax
sub ebx, ebx
push 0x20019
push edi
mov dword [esp + 0x24], ebx
mov dword [esi], edi
sub ebp, ebp
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
call fcn.0040be50
push eax
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c040
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x1c]
mov eax, ecx
inc ecx
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push 0
lea ecx, [esp + 0x4c]
push edx
mov edx, dword [esp + 0x34]
push ecx
push eax
push edx
mov dword [esp + 0x3c], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40c021
mov al, byte [esp + 0x84]
test al, al
jne 0x40bf5d
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x28]
push eax
push 0x20019
lea ecx, [esp + 0x44]
push 0
push ecx
push edx
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
or eax, eax
jne 0x40bea7
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x30]
push eax
push ecx
push 0
push 0
push str.RegStatus
push edx
mov dword [esp + 0x44], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
or eax, eax
jne 0x40bf4a
mov eax, dword [esp + 0x30]
cmp eax, 1
je 0x40bf48
cmp eax, 2
jne 0x40bf4a
xor bl, bl
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x40bea7
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
lea edx, [ecx + edi + 1]
cmp edx, eax
jb 0x40bfd5
mov ebx, dword [esi]
or ebx, ebx
je 0x40bfbc
add eax, 0x101
push eax
call fcn.0041b345
push edi
pop ecx
mov dword [esi], eax
push ecx
pop edx
mov esi, ebx
mov edi, eax
mov eax, dword [esp + 0x84]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push edx
pop ecx
mov edx, dword [esp + 0x18]
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x18]
mov ebp, dword [eax]
add esi, 0x100
add ebp, edx
mov dword [esp + 0x18], esi
call fcn.0041b272
add esp, 8
jmp 0x40bfd5
push 0x101
call fcn.0041b345
add esp, 4
mov dword [esi], eax
mov dword [esp + 0x10], 0x100
mov ebp, eax
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ecx
pop edx
push edi
pop esi
push ebp
pop edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push edx
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x80]
lea ebp, [eax + ebp + 1]
lea edx, [ecx + eax + 1]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], edx
inc eax
push edx
pop edi
mov dword [esp + 0x18], eax
jmp 0x40bea7
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or ebp, ebp
je 0x40c034
mov byte [ebp], 0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret
pop edi
pop esi
push ebx
pop eax
pop ebp
pop ebx
add esp, 0x6c
ret
Function at 0x40cdb0
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
sub esi, esi
test ebx, ebx
push edi
je 0x40cdbf
mov dword [ebx], esi
mov eax, dword [esp + 0x10]
or eax, eax
je 0x40ce0a
cmp byte [eax], 0
je 0x40ce0a
push 0
push 0x80
push 3
push 0
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
push eax
pop edi
cmp edi, 0xffffffff
je 0x40ce0a
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push eax
pop esi
cmp esi, 0xffffffff
jne 0x40ce03
xor esi, esi
or ebx, ebx
je 0x40ce03
mov dword [ebx], esi
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push esi
pop eax
pop edi
pop esi
pop ebx
ret
Function at 0x40faf0
Capabilities:
Initialize winsock library

Disassembly:
push 0x4324a4
call dword [sym.imp.KERNEL32.DLL_InterlockedIncrement]
jmp 0x40fb60
mov eax, dword [0x4324a0]
sub esp, 0x1c8
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
jne 0x40fc2e
lea eax, [esp + 0x44]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x40fbec
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, eax
nop
push 0xc
nop
pop ecx
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push str.GatorAsyncWndClass
push esi
call dword [sym.imp.USER32.dll_GetClassInfoExA]
test eax, eax
jne 0x40fbe2
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0x30
push edx
mov dword [esp + 0x20], 0x40fcf0
mov dword [esp + 0x2c], esi
mov dword [esp + 0x40], str.GatorAsyncWndClass
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x40fbec
mov dword [0x4324a0], 1
mov byte [0x4324a8], bl
lea eax, [esp + 0xc]
push ebx
push eax
push str.GetHostByNameTimeout
push str.softwareQwertyuioQwertdyn
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x20], ebx
call fcn.0040afb0
add esp, 0x14
test eax, eax
je 0x40fc24
mov eax, dword [esp + 0xc]
cmp eax, ebx
mov dword [0x42b8d8], eax
jne 0x40fc2e
mov dword [0x42b8d8], 0x14
call fcn.0040fd10
test eax, eax
je 0x40fce0
cmp dword [0x42b8dc], 0xffffffff
jne 0x40fce0
mov edi, dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
push ebp
push 0x108
push pe_nt_image_headers32
mov dword [0x42b8dc], ebx
call edi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
mov esi, eax
push ecx
push edx
push esi
push ebx
mov dword [esi], 0x108
push ebx
mov dword [esp + 0x28], 0x108
mov dword [esp + 0x24], ebx
call dword [0x4324b8]
mov ebp, dword [sym.imp.KERNEL32.DLL_GlobalFree]
cmp eax, 0x25b
jne 0x40fcb9
push esi
call ebp
mov eax, dword [esp + 0x14]
push eax
push pe_nt_image_headers32
call edi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
mov esi, eax
push ecx
push edx
push esi
push ebx
push ebx
mov dword [esi], 0x108
call dword [0x4324b8]
cmp eax, ebx
jne 0x40fccd
cmp dword [esp + 0x10], ebx
je 0x40fccd
mov dword [0x42b8dc], 1
push esi
call ebp
mov eax, dword [0x4324a0]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1c8
ret
mov eax, dword [0x4324a0]
pop edi
pop esi
pop ebx
add esp, 0x1c8
ret
Function at 0x414940
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x4337f0]
sub esp, 0x1c4
test eax, eax
push esi
je 0x41495d
nop
push 1
nop
pop eax
pop esi
add esp, 0x1c4
ret
lea eax, [esp + 0x38]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
or eax, eax
jne 0x414a2c
push edi
push eax
mov dword [0x4337f0], 1
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, eax
nop
push 0xc
nop
pop ecx
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
push str.GatorAsyncWndClass
push esi
call dword [sym.imp.USER32.dll_GetClassInfoExA]
or eax, eax
pop edi
jne 0x4149d7
lea edx, [esp + 8]
mov dword [esp + 8], 0x30
push edx
mov dword [esp + 0x14], 0x40fcf0
mov dword [esp + 0x20], esi
mov dword [esp + 0x34], str.GatorAsyncWndClass
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x414a2c
mov byte [0x4338b0], 0
lea eax, [esp + 4]
push 0
push eax
push str.GetHostByNameTimeout
push str.softwareQwertyuioQwertdyn
push reloc.WSOCK32.dll_bind
mov dword [esp + 0x18], 0
call fcn.0040afb0
add esp, 0x14
or eax, eax
je 0x414a15
mov eax, dword [esp + 4]
test eax, eax
mov dword [0x42d23c], eax
jne 0x414a1f
mov dword [0x42d23c], 0x14
mov eax, dword [0x4337f0]
pop esi
add esp, 0x1c4
ret
xor eax, eax
pop esi
add esp, 0x1c4
ret
Function at 0x414ac0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x424
push ebp
mov ebp, dword [esp + 0x42c]
push esi
mov esi, ebp
cmp byte [ebp], 0
je 0x414af4
movsx eax, byte [esi]
push eax
call fcn.0041bca2
add esp, 4
or eax, eax
jne 0x414aec
cmp byte [esi], 0x2e
jne 0x414b02
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x414ad7
pop esi
pushal
popal
push 1
pop eax
pop ebp
add esp, 0x424
ret
call fcn.00414940
test eax, eax
jne 0x414b14
pop esi
pop ebp
add esp, 0x424
ret
xor esi, esi
push ebx
push esi
push esi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push bind
push str.GatorAsyncWnd
push str.GatorAsyncWndClass
push esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebx, eax
or ebx, ebx
je 0x414c4c
push edi
lea ecx, [esp + 0x34]
push 0x400
push ecx
push ebp
push 0x43e
push ebx
call sub.WSOCK32.dll_WSAAsyncGetHostByName
or eax, eax
mov dword [esp + 0x10], eax
je 0x414c44
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [0x42d23c]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*4]
lea edx, [ecx + ecx*4]
lea eax, [eax + edx*8]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
cmp dword [esp + 0x14], eax
jbe 0x414c36
push 1
push 0
push 0
lea ecx, [esp + 0x24]
push ebx
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x414c09
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [esp + 0x1c], 0x43e
jne 0x414c09
mov ecx, dword [esp + 0x24]
shr ecx, 0x10
test cx, cx
jne 0x414c09
mov edx, dword [esp + 0x40]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call sub.WSOCK32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 1
mov al, byte [0x4338b0]
test al, al
jne 0x414c36
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
test esi, esi
je 0x414b85
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
push esi
pop eax
pop ebx
pop esi
pop ebp
add esp, 0x424
ret
test esi, esi
jne 0x414c44
mov eax, dword [esp + 0x10]
push eax
call sub.WSOCK32.dll_WSACancelAsyncRequest
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
push esi
pop eax
pop ebx
pop esi
pop ebp
add esp, 0x424
ret