joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a755
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0040a755
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0
mov edx, 0x41e914
call fcn.0041c9a4
lea ebx, [esp]
call fcn.0041bf40
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041a349
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x40a7a9
jmp 0x40a98b
push 0
mov edx, 0x41e980
call fcn.0041c9a4
lea ebx, [esp]
call fcn.0041bf40
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041a349
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x41e844], eax
push 0
mov edx, 0x41e990
call fcn.0041c9a4
lea ebx, [esp]
call fcn.0041bf40
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041a349
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x41e848], eax
push 0
mov edx, 0x41e9a8
call fcn.0041c9a4
lea ebx, [esp]
call fcn.0041bf40
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041a349
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x41e84c], eax
push 0
mov edx, 0x41e9b8
call fcn.0041c9a4
lea ebx, [esp]
call fcn.0041bf40
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041a349
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x41e850], eax
push 0
mov edx, str.C:SYS.DAT
call fcn.0041c9a4
lea ebx, [esp]
call fcn.0041bf40
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041a349
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x41e854], eax
push 0
mov edx, str.SYS.DAT
call fcn.0041c9a4
lea ebx, [esp]
call fcn.0041bf40
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041a349
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x41e858], eax
push 0
mov edx, str.Please_contact_Autologic_Diagnostics_Ltd_before_updating_your_system.
call fcn.0041c9a4
lea ebx, [esp]
call fcn.0041bf40
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041a349
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [0x41e85c], eax
cmp dword [0x41e844], 0
jne 0x40a931
jmp 0x40a98b
cmp dword [0x41e848], 0
jne 0x40a93f
jmp 0x40a98b
cmp dword [0x41e84c], 0
jne 0x40a94d
jmp 0x40a98b
cmp dword [0x41e850], 0
jne 0x40a95b
jmp 0x40a98b
cmp dword [0x41e854], 0
jne 0x40a969
jmp 0x40a98b
cmp dword [0x41e858], 0
jne 0x40a977
jmp 0x40a98b
cmp dword [0x41e85c], 0
jne 0x40a985
jmp 0x40a98b
mov dword [ebp - 0x98], esi
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40ad99
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0040ad99
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov byte [0x41e838], 0
mov esi, 0
mov eax, dword [0x41e840]
test eax, eax
je 0x40ae6e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 1
mov ebx, dword [ebp + 0xc]
movsx ecx, word [ebx]
add eax, ecx
push eax
call dword [0x41e85c]
mov byte [ebp - 0xa0], al
mov eax, pe_nt_image_headers32
movzx ecx, byte [ebp - 0xa0]
xor eax, ecx
mov byte [ebp - 0xa0], al
movzx eax, byte [ebp - 0xa0]
mov byte [ebp - 0x9c], al
mov ecx, 7
mov eax, 1
lea ebx, [ebp - 0x9c]
call fcn.0041c06d
inc esi
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
movzx ecx, byte [ebp - 0x9c]
cmp ecx, eax
je 0x40ae4b
cmp esi, 0x186a0
jle 0x40ade0
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
movzx ecx, byte [ebp - 0x9c]
cmp ecx, eax
je 0x40ae63
mov byte [0x41e838], 1
movzx eax, byte [0x41e838]
test eax, eax
je 0x40ae6e
movzx eax, byte [ebp - 0xa0]
mov byte [ebp - 0x98], al
movzx eax, byte [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40bbe6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0040bbe6
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
fild dword [0x420720]
mov eax, dword [ebp + 8]
call fcn.0041be50
fcompp
fnstsw ax
sahf
jne 0x40bc29
fild qword [0x4203bc]
call fcn.0041be77
mov dword [ebp + 8], eax
mov edi, dword [ebp + 0x14]
push 0
push 0
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
push 0x20019
push 0
mov edx, dword [ebp + 0xc]
call fcn.0041c98d
mov edx, 0x41ea18
call fcn.0041c9a4
call fcn.0041a780
mov edx, 0x41ea18
call fcn.0041c9a4
call fcn.0041a7ee
lea ebx, [esp + 0xc]
call fcn.0041bf40
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041a349
pop eax
add esp, 4
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x40bd0a
mov dword [ebp - 0xa4], 4
mov eax, 4
mov dword [ebp - 0xa8], eax
push 0
lea ebx, [ebp - 0xa8]
push ebx
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
lea ebx, [ebp - 0xa4]
push ebx
push 0
mov edx, dword [ebp + 0x10]
call fcn.0041c98d
lea ebx, [esp + 0x10]
call fcn.0041bf40
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.0041a349
pop eax
add esp, 4
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
mov eax, esi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x98], edi
call fcn.0041c87e
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x412880
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00412880
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov dword [0x41e8a4], 0
call dword [sym.imp.KERNEL32.DLL_GetSystemDefaultLCID]
fldcw word [ebp - 0x10]
movzx eax, al
mov byte [0x41e8a8], al
xor eax, eax
call fcn.0041a444
call fcn.0041a6fe
call fcn.0041a755
lea ebx, [ebp - 0xa0]
call fcn.0041be7e
mov edx, dword [ebp - 0xa0]
call fcn.0041c98d
mov eax, 1
mov edx, 0x41f360
call fcn.0041c9a4
call fcn.00414246
mov esi, eax
cmp esi, 0
jle 0x4129a8
mov dword [0x41e8a4], 1
cmp esi, 1
jne 0x412940
mov edx, dword [ebp - 0xa0]
call fcn.0041c98d
mov eax, 2
add eax, esi
mov ecx, eax
mov eax, 0x7fffffff
call fcn.0041667a
lea ebx, [ebp - 0xa0]
call fcn.0041be7e
jmp 0x412988
mov edx, dword [ebp - 0xa0]
call fcn.0041c98d
mov ecx, 1
mov eax, esi
sub eax, 1
call fcn.0041667a
mov edx, dword [ebp - 0xa0]
call fcn.0041c98d
mov eax, 2
add eax, esi
mov ecx, eax
mov eax, 0x7fffffff
call fcn.0041667a
call fcn.0041c142
lea ebx, [ebp - 0xa0]
call fcn.0041be7e
mov edx, dword [ebp - 0xa0]
call fcn.0041c98d
call fcn.0041a6fe
call fcn.0041a755
lea ebx, [ebp - 0xa0]
call fcn.0041be7e
mov edx, dword [ebp - 0xa0]
call fcn.0041c98d
mov edx, 0x41ea4c
call fcn.0041c9a4
call fcn.0041c1d7
je 0x412a8a
mov edx, dword [ebp - 0xa0]
call fcn.0041c98d
lea ebx, [ebp - 0x9c]
call fcn.0041be7e
fild dword [0x420760]
mov edx, dword [ebp - 0x9c]
call fcn.0041c98d
call fcn.0041ab93
fcompp
fnstsw ax
sahf
jb 0x412a1c
fild dword [0x420784]
mov edx, dword [ebp - 0x9c]
call fcn.0041c98d
call fcn.0041ab93
fcompp
fnstsw ax
sahf
jbe 0x412a31
call fcn.0040fb87
call fcn.0041c9bb
lea ebx, [ebp - 0x9c]
call fcn.0041be7e
fild dword [0x420760]
mov edx, dword [ebp - 0x9c]
call fcn.0041c98d
call fcn.0041ab93
fcompp
fnstsw ax
sahf
jb 0x412a6f
fild dword [0x420784]
mov edx, dword [ebp - 0x9c]
call fcn.0041c98d
call fcn.0041ab93
fcompp
fnstsw ax
sahf
jbe 0x412a74
jmp 0x412ad9
mov edx, dword [ebp - 0x9c]
call fcn.0041c98d
call fcn.0041ab93
fistp dword [0x41e878]
call dword [sym.imp.COMCTL32.DLL_InitCommonControls]
fldcw word [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [0x41e870], eax
mov ebx, 0x41e874
push ebx
push 0
push 0
mov eax, 0x411de5
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
fldcw word [ebp - 0x10]
mov eax, 0x40fc5d
push eax
push 0
push 0x64
push dword [0x41e870]
call fcn.00401d34
mov ebx, 0x41e8d0
push ebx
call sym.download.exe_CLOSECOM
call fcn.0041c87e
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x413058
Capabilities:
Accept command line arguments
Allocate thread local storage
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, section..data
test word [0x41303a], 4
jne 0x413073
jmp 0x4134a2
jmp fcn.004132a5
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.004131a1
mov dword [ebx + 0x3f0], 1
lea eax, [ebx + 0x5c4]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
sub esp, 0x44
mov dword [esp], 0x44
mov dword [esp + 0x2c], 0
push esp
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, 0xa
test dword [esp + 0x2c], 1
je 0x4134f3
movzx eax, word [esp + 0x30]
add esp, 0x44
mov dword [ebx + 0x3e4], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.00413247
mov dword [ebx + 0x3e0], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebx + 0x3ec], eax
call fcn.00413078
push 0xff
jb 0x413572
pop eax
movzx ecx, word [0x413038]
jecxz 0x41353d
push ecx
push 8
push esp
call dword [sym.imp.COMCTL32.DLL_InitCommonControlsEx]
pop eax
pop eax
call fcn.004130ed
push eax
mov ebx, section..data
mov ecx, dword [ebx + 0xd8]
call fcn.0041357e
mov ecx, dword [ebx + 0xb4]
jecxz 0x413562
push ecx
call dword [0x43b000]
mov edi, dword [ebx + 0x428]
call fcn.004130f2
call fcn.004130d9
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x413078
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
stc
je 0x4130d8
mov dword [ebx + 0x3d0], eax
mov dword [ebx + 0x3d8], 0
mov dword [ebx + 0x3d4], 0
call fcn.00413384
jb 0x4130d8
mov dword [ebx + 0x3d4], eax
mov word [eax + 0xac], 8
call fcn.004130c7
dec ebp
push ebx
and byte [ebx + 0x61], dl
outsb dx, byte [esi]
jae 0x4130e1
push ebx
jb 0x41312e
add byte [esi - 4], bl
mov bl, 0xd0
add eax, dword [eax]
add bh, bh
adc eax, sym.imp.KERNEL32.DLL_TlsFree
ret

Function at 0x413588
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
lea esi, [esp + 0x18]
mov ecx, dword [esi - 4]
push ecx
call fcn.00419b03
jb 0x4135d8
lea esi, [esi + ecx*4 - 4]
push eax
xor ebx, ebx
mov eax, dword [esi]
mov byte [edi], al
sub esi, 4
inc ebx
cmp eax, 0xffffffff
je 0x4135b1
dec ebx
inc edi
loop 0x4135a2
pop eax
test ebx, ebx
je 0x4135c5
pop ecx
push ecx
sub ecx, ebx
mov esi, edx
call fcn.00419b85
jb 0x4135d8
call fcn.0041c9d7
pop edx
pop edi
pop esi
pop ecx
pop ebx
shl edx, 2
pop dword [esp + edx]
add esp, edx
ret
call fcn.0041c9d5
pop edx
pop edi
pop esi
pop ecx
pop ebx
shl edx, 2
pop dword [esp + edx]
add esp, edx
jmp fcn.004132bc
Function at 0x4139c2
Capabilities:
Terminate process

Disassembly:
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], edi
pop dword [ebp - 0x6c]
pop edx
pop ax
test byte [ebx + 4], 4
je 0x4139e4
pop cx
movzx ecx, ch
add esp, 4
add esp, 8
loop 0x4139dc
jmp dword [ebp - 0x6c]
mov byte [ebx + 5], 2
mov byte [ebx + 4], al
mov dword [ebx], edx
pop word [ebx + 6]
pop dword [ebx + 0x14]
movzx ecx, byte [ebx + 7]
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
pop dword [ebx + esi + 0x10]
pop dword [ebx + esi + 0xc]
sub esi, 0xc
jne 0x413a01
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x413a76
inc eax
dec ecx
je 0x413a39
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
jl 0x413a76
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x413a1c
je 0x413a39
jb 0x413a76
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x413a76
test byte [ebx + 4], 1
je 0x413a4c
mov dword [ebx + 0xc], eax
jmp 0x413a69
push eax
call fcn.0041326d
pop ecx
jb 0x413a78
mov dword [ebx], eax
mov dword [ebx + 0xc], ecx
mov edi, eax
cld
xor eax, eax
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
or byte [ebx + 4], 4
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp dword [ebp - 0x6c]
mov al, 9
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
push dword [ebp - 0x6c]
jmp fcn.004132bc
Function at 0x413aec
Capabilities:
Terminate process

Disassembly:
test byte [ebx + 4], 4
jne 0x413af7
jmp fcn.004139c2
mov dword ds:[ebp - 0x68], esi
mov dword ds:[ebp - 0x64], edi
pop dword ds:[ebp - 0x6c]
pop eax
pop ax
xor ah, ah
pop cx
cmp cl, byte [ebx + 6]
call fcn.00413c13
pop edx
cmp edx, dword [ebx + 0x14]
call fcn.00413c13
movzx ecx, ch
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
lea edi, [ebx + esi + 0x10]
pop dword ds:[ebp - 0x60]
push dword [edi]
pop edx
cmp edx, dword [ebx + esi + 0x10]
call fcn.00413c13
pop edx
cmp edx, dword [ebx + esi + 0xc]
call fcn.00413c13
sub esi, 0xc
jne 0x413b31
or ah, ah
jne 0x413c00
cmp cl, byte [ebx + 7]
jne 0x413c00
mov edx, dword ds:[ebp - 0x60]
cmp edx, dword [edi - 4]
jl 0x413c00
mov byte [ebx + 4], al
mov ecx, dword [edi]
sub ecx, edx
jle 0x413b96
cmp byte [ebx + 7], 1
je 0x413b7b
imul ecx, dword [edi - 8]
push edi
mov al, byte [ebx + 6]
mov esi, ecx
mov edi, dword [ebx]
push dword [ebx + 8]
sub dword [esp], ecx
pop ecx
imul ecx, dword [ebx + 0x14]
add edi, ecx
call fcn.00413d04
pop edi
push dword [ebx + 8]
push dword [ebx + 0xc]
movzx ecx, byte [ebx + 7]
xor esi, esi
mov dword [edi], edx
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
inc eax
dec ecx
je 0x413bc9
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x413bb0
jb 0x413bf6
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x413bf6
mov ecx, eax
xchg dword [ebx + 0xc], eax
mov edx, eax
mov eax, dword [ebx]
call fcn.00413c18
jb 0x413bf8
add esp, 8
mov dword [ebx], eax
or byte [ebx + 4], 4
mov esi, dword ds:[ebp - 0x68]
mov edi, dword ds:[ebp - 0x64]
notrack jmp dword ds:[ebp - 0x6c]
mov al, 9
pop dword [ebx + 0xc]
pop dword [ebx + 8]
mov dx, 0x9b0
mov al, 9
mov esi, dword ds:[ebp - 0x68]
mov edi, dword ds:[ebp - 0x64]
push dword ds:[ebp - 0x6c]
jmp fcn.004132bc
Function at 0x414670
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00419b5f
or ecx, ecx
je 0x414746
mov ebx, esi
mov edx, 3
mov al, byte [ebx]
cmp al, 0x22
jne 0x4146a7
inc ebx
dec ecx
je 0x4146c4
cmp byte [ebx], 0x22
jne 0x414699
inc ebx
loop 0x414693
jmp 0x4146c4
cmp al, 0x5c
jne 0x4146b4
inc ebx
dec ecx
je 0x4146c4
inc ebx
loop 0x414693
jmp 0x4146c4
cmp al, 0x3b
je 0x4146bd
inc ebx
loop 0x414693
jmp 0x4146c4
push ebx
dec edx
je 0x4146c8
inc ebx
loop 0x414693
push ebx
dec edx
jne 0x4146c4
pop edx
pop ecx
pop ebx
ftst
wait
fnstsw ax
sahf
jb 0x4146e8
jne 0x4146e4
cmp ecx, edx
je 0x4146e4
inc ecx
cmp ecx, edx
je 0x4146e4
mov eax, edx
mov esi, ecx
jmp 0x4146f7
mov eax, ebx
jmp 0x4146f7
cmp ebx, ecx
je 0x4146e4
inc ebx
cmp ebx, edx
je 0x4146e4
mov eax, ecx
mov esi, ebx
fchs
cmp eax, esi
jbe 0x414746
mov ecx, 0x10
sub esp, 0x1000
mov dword [esp], eax
loop 0x414700
push esp
push esi
push esi
push eax
mov ecx, eax
sub ecx, esi
call fcn.0041476e
call fcn.0041cf1b
pop ecx
mov esi, esp
push ecx
call fcn.0041ca1e
jb 0x414734
add esp, 0x10000
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
mov edx, eax
add esp, 0x10000
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.004132b1
mov ecx, 0x10
sub esp, 0x1000
mov dword [esp], eax
loop 0x41474b
mov esi, esp
call fcn.0041cc07
call fcn.0041cf1b
dec edx
cmp byte [esi], 0x20
jne 0x41476a
dec edx
inc esi
mov ecx, edx
jmp 0x414721

Function at 0x4154c9
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.00419b5f
jecxz 0x41550b
call fcn.00419b03
jb 0x415557
cld
test eax, eax
je 0x4154f6
lodsb al, byte [esi]
call fcn.00415622
stosb byte es:[edi], al
loop 0x4154e9
mov esi, edx
jmp 0x415503
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharLowerBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.00419b37
pop ebp
pop edi
pop esi
pop ecx
ret
mov edx, eax
pop ebp
pop edi
pop esi
pop ecx
jmp fcn.004132b1

Function at 0x415510
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.00419b5f
jecxz 0x415552
call fcn.00419b03
jb 0x415557
cld
test eax, eax
je 0x41553d
lodsb al, byte [esi]
call fcn.0041565e
stosb byte es:[edi], al
loop 0x415530
mov esi, edx
jmp 0x41554a
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharUpperBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.00419b37
pop ebp
pop edi
pop esi
pop ecx
ret
Function at 0x415939
Capabilities:
Get socket status
Send data
Send data on socket
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x104
mov ax, word [ebp - 0x46]
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00419b5f
call fcn.00419c15
jb 0x4159e5
test byte [edi + 0xc], 0x40
je 0x4159e9
add esp, 0x104
mov ebx, ecx
mov eax, dword [edi + 6]
mov ecx, 0x40
push eax
loop 0x415979
push 0x40
mov edx, esp
mov eax, dword [edi + 0x38]
mov ecx, eax
and eax, 0x3ff
shl eax, 0xa
shr ecx, 0xa
push eax
push ecx
push esp
push 0
push edx
push 0
push 0
call dword [sym.imp.WSOCK32.DLL_select]
pop edx
pop edx
cmp eax, 0xffffffff
je 0x4159d6
test eax, eax
je 0x4159f5
push 0
push ebx
push esi
push dword [edi + 6]
call dword [sym.imp.WSOCK32.DLL_send]
cmp eax, 0xffffffff
je 0x4159d6
add esi, eax
sub ebx, eax
jg 0x41597e
and word [edi + 0x2c], 0xfffd
call fcn.0041cf1b
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x4159ed
jmp 0x4159f1
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
call fcn.0041cf1b
add esp, 0x104
pop edi
pop esi
jmp fcn.004132bc
Function at 0x415a09
Capabilities:
Get socket status
Receive data
Receive data on socket
Terminate process

Disassembly:
push esi
push edi
mov dword [ebp - 0x6c], 0
sub esp, 0x104
mov ecx, eax
call fcn.00419b03
mov ebx, ecx
jb 0x415b7a
mov dword [ebp - 0x6c], edi
mov ax, word [ebp - 0x46]
call fcn.00419bd7
jb 0x415b60
test byte [esi + 0xc], 0x40
je 0x415b64
and word [esi + 0x2c], 0xfff5
add esp, 0x104
mov eax, dword [esi + 6]
mov ecx, 0x40
push eax
loop 0x415a56
push 0x40
mov ecx, dword [esi + 0x28]
jecxz 0x415aaf
cmp ebx, ecx
ja 0x415a66
mov ecx, ebx
sub dword [esi + 0x28], ecx
sub ebx, ecx
push esi
push dword [esi + 0x28]
cld
lea edx, [esi + 0x44]
mov esi, edx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop ecx
xchg edi, edx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
pop esi
test dword [esi + 0x28], 0xffffffff
jne 0x415b25
test word [esi + 0x2c], 8
je 0x415aaf
or word [esi + 0x2c], 2
jmp 0x415b25
test ebx, ebx
je 0x415b3c
mov edx, esp
mov eax, dword [esi + 0x38]
mov ecx, eax
and eax, 0x3ff
shl eax, 0xa
shr ecx, 0xa
push eax
push ecx
push esp
push 0
push 0
push edx
push 0
call dword [sym.imp.WSOCK32.DLL_select]
pop edx
pop edx
cmp eax, 0xffffffff
je 0x415b4d
test eax, eax
jne 0x415af0
mov ecx, edi
sub ecx, dword [ebp - 0x6c]
jne 0x415b09
jmp 0x415b70
lea edx, [esi + 0x44]
push 0
push 0x10000
push edx
push dword [esi + 6]
call dword [sym.imp.WSOCK32.DLL_recv]
cmp eax, 0xffffffff
je 0x415b4d
mov dword [esi + 0x28], eax
cmp eax, 0x10000
je 0x415b18
or word [esi + 0x2c], 8
test eax, eax
jne 0x415a5b
or word [esi + 0x2c], 2
test ebx, ebx
je 0x415b3c
push esi
mov ecx, edi
mov esi, dword [ebp - 0x6c]
sub ecx, esi
call fcn.00419b85
pop esi
jb 0x415b7f
mov dword [ebp - 0x6c], edx
mov edx, dword [ebp - 0x6c]
call fcn.0041c9d7
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x415b68
jmp 0x415b6c
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
mov esi, dword [ebp - 0x6c]
call fcn.00419b37
call fcn.0041c9d5
add esp, 0x104
pop edi
pop esi
jmp fcn.004132bc
Function at 0x415fb3
Capabilities:
Create udp socket
Get hostname
Initialize winsock library
Set socket configuration
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x228
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x64], 0
xchg ch, cl
mov ebx, ecx
sub esp, 0x190
push esp
push 2
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
mov cl, byte [esp]
add esp, 0x190
test eax, eax
jne 0x416141
cmp cl, 2
jne 0x416141
mov ax, word [ebp - 0x46]
test ax, ax
js 0x41613d
call fcn.00419c15
jae 0x416139
mov ecx, 0x10044
call fcn.00419b03
jb 0x416143
mov dword [ebp - 0x64], edx
call fcn.00419c53
jb 0x416143
cld
xor eax, eax
mov ecx, 0x20
push edi
add edi, 4
rep stosw word es:[edi], ax
pop edi
mov ax, word [ebp - 0x46]
mov ecx, dword [ebp - 0x6c]
mov word [edi + 4], ax
mov word [edi + 0xa], 2
mov word [edi + 0xc], pe_nt_image_headers32
mov word [edi + 0xe], 0xc0
mov dword [edi + 0x1c], 0x10000
mov dword [edi + 0x30], ebx
mov dword [edi + 0x38], ecx
push 0
push 2
push 2
call dword [sym.imp.WSOCK32.DLL_socket]
cmp eax, 0xffffffff
je 0x41611d
mov dword [edi + 6], eax
push 0x100
lea eax, [esp + 8]
push eax
call dword [sym.imp.WSOCK32.DLL_gethostname]
test eax, eax
jne 0x41611d
lea eax, [esp + 3]
lea edx, [eax + 1]
inc eax
test byte [eax], 0xff
jne 0x416099
sub eax, edx
cmp eax, 0x100
jb 0x4160ad
mov eax, 0x100
mov dword [esp], eax
cmp dword [edi + 0x30], 0xffffffff
je 0x4160d8
push 0
push 0
push 0
push word [edi + 0x30]
push 2
mov eax, esp
push 0x10
push eax
push dword [edi + 6]
call dword [sym.imp.WSOCK32.DLL_bind]
add esp, 0x10
test eax, eax
jne 0x41611d
mov ebx, edi
mov ecx, dword [esp]
call fcn.00419b03
jb 0x416143
mov dword [ebx + 0x10], edx
cld
lea esi, [esp + 4]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 1
mov edx, esp
push 4
push edx
push 0x20
push 0xffff
push dword [ebx + 6]
call dword [sym.imp.WSOCK32.DLL_setsockopt]
pop edx
test eax, eax
jne 0x41611d
add esp, 0x228
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
jne 0x41612e
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
push eax
call fcn.00415b8c
pop eax
mov dx, 0x37b0
mov al, 0x37
mov dx, 0x34b0
mov al, 0x34
mov dx, 0x44b0
mov al, 0x44
mov edx, dword [ebp - 0x64]
test edx, edx
je 0x416158
push eax
mov esi, edx
call fcn.00419c9e
call fcn.00419b37
pop eax
add esp, 0x228
pop edi
pop esi
jmp fcn.004132bc