joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e58
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
xor edx, edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x405f84
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 4]
call fcn.0040553c
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 4]
call fcn.004037c4
xor edx, edx
mov eax, 2
call fcn.0040526c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x134], 0x128
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 0xc]
call fcn.0040528c
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 6], al
jmp 0x405f4f
lea eax, [ebp - 0x140]
lea edx, [ebp - 0x110]
mov ecx, 0x104
call fcn.0040388c
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.0040553c
mov eax, dword [ebp - 0x13c]
mov edx, dword [ebp - 4]
call fcn.004039f0
jne 0x405f38
push 0
mov eax, dword [ebp - 0x12c]
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
lea edx, [ebp - 0x134]
mov eax, dword [ebp - 0xc]
call fcn.004052ac
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 6], al
cmp byte [ebp - 6], 0
jne 0x405ee0
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f8b
lea eax, [ebp - 0x140]
mov edx, 3
call fcn.00403750
lea eax, [ebp - 4]
call fcn.0040372c
ret
Function at 0x406518
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
xor eax, eax
push ebp
push 0x4065ac
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403aa4
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
call sub.KERNEL32.DLL_GetLastError
test eax, eax
jne 0x406589
cmp dword [ebp - 0xc], 0
je 0x406589
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0040385c
jmp 0x406591
mov eax, dword [ebp - 8]
call fcn.0040372c
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4065b3
lea eax, [ebp - 4]
call fcn.0040372c
ret

Function at 0x406788
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.004038a4
test eax, eax
je 0x406829
mov eax, dword [ebp - 4]
call fcn.004038a4
add eax, 1
jno 0x4067b7
call fcn.00402f1c
test eax, eax
jns 0x4067c0
call fcn.00402f14
push eax
push 0x2042
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x406829
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x406829
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.00406830
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x406820
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 0xc]
push eax
push 1
call sub.user32.dll_SetClipboardData
test eax, eax
setne byte [ebp - 5]
call sub.user32.dll_CloseClipboard
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalFree
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x4069e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x406a41
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x19]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x19]
mov ecx, 0x11
call fcn.0040388c
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
call fcn.004054c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a48
lea eax, [ebp - 0x20]
call fcn.0040372c
ret
Function at 0x406a4c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x406acc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.0040388c
lea eax, [ebp - 0x110]
mov edx, 0x406ae0
call fcn.004038ac
mov eax, dword [ebp - 0x110]
mov edx, dword [ebp - 4]
call fcn.0040553c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406ad3
lea eax, [ebp - 0x110]
call fcn.0040372c
ret

Function at 0x406c48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406d00
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x4156c0
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jns 0x406c9e
call fcn.00402f14
mov dword [0x4156c4], eax
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jns 0x406cd5
call fcn.00402f14
mov dword [0x4156c4], eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406d07
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret
Function at 0x406d10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406dee
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4156c0
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jns 0x406d61
call fcn.00402f14
mov dword [0x4156c4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
call fcn.00403bd4
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jns 0x406d9c
call fcn.00402f14
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
jne 0x406dc0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.00403aa4
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.0040385c
jmp 0x406dc8
mov eax, dword [ebp + 8]
call fcn.0040372c
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406df5
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret

Function at 0x406dfc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
mov eax, dword [ebp + 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406f08
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4156c0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jns 0x406e5d
call fcn.00402f14
mov dword [0x4156c4], eax
cmp dword [ebp + 8], 0
jne 0x406e75
lea eax, [ebp + 8]
mov edx, 0x406f20
call fcn.004037c4
mov eax, dword [ebp + 8]
call fcn.004038a4
test eax, eax
jns 0x406e86
call fcn.00402f14
push eax
lea eax, [ebp + 8]
call fcn.00403afc
mov edx, 1
dec edx
test eax, eax
je 0x406e9e
cmp edx, dword [eax - 4]
jb 0x406ea3
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
push 1
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x406eca
call fcn.00402f14
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
sete byte [ebp - 0xd]
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406f0f
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
lea eax, [ebp + 8]
call fcn.0040372c
ret
Function at 0x406f24
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x406fdf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4156c0
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jns 0x406f7d
call fcn.00402f14
mov dword [0x4156c4], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x406fa9
call fcn.00402f14
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
sete byte [ebp - 0xd]
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406fe6
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret

Function at 0x406ff0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x407080
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, 0x407098
call fcn.00405a8c
test al, al
jne 0x40706a
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyA
push 0
push 0x4156c0
push 0
push 6
push 2
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
sete byte [ebp - 9]
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407087
lea eax, [ebp - 8]
call fcn.0040372c
ret

Function at 0x40714c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x40720a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
jne 0x40718c
lea eax, [ebp - 0xc]
mov edx, 0x407220
call fcn.004037c4
mov eax, dword [ebp - 0xc]
call fcn.004038a4
test eax, eax
jns 0x40719d
call fcn.00402f14
push eax
lea eax, [ebp - 0xc]
call fcn.00403afc
mov edx, 1
dec edx
test eax, eax
je 0x4071b5
cmp edx, dword [eax - 4]
jb 0x4071ba
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x4071df
call fcn.00402f14
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407211
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret
Function at 0x407224
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
xor eax, eax
push ebp
push 0x407294
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jns 0x40726e
call fcn.00402f14
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40729b
lea eax, [ebp - 8]
call fcn.0040372c
ret

Function at 0x4072a4
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x407350
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4156c0
push 0xf003f
push 0
mov eax, dword [ebp - 8]
call fcn.00403aa4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jns 0x4072f8
call fcn.00402f14
mov dword [0x4156c4], eax
mov eax, dword [ebp - 0xc]
call fcn.00403aa4
push eax
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
jns 0x40731a
call fcn.00402f14
mov dword [0x4156c4], eax
cmp dword [0x4156c4], 0
sete byte [ebp - 0xd]
mov eax, dword [0x4156c0]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407357
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403750
ret
Function at 0x407628
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x407859
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, 0x40786c
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x407884
mov edx, 0x407898
mov eax, 0x80000002
call fcn.00406dfc
lea eax, [ebp - 8]
mov ecx, 0x40786c
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x407884
mov edx, 0x4078d0
mov eax, 0x80000001
call fcn.00406dfc
lea eax, [ebp - 0xc]
mov ecx, 0x40786c
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x407884
mov edx, 0x407918
mov eax, 0x80000002
call fcn.00406dfc
lea eax, [ebp - 0x10]
mov ecx, 0x407958
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x10]
push eax
mov edx, 0x407898
mov ecx, 0x40796c
mov eax, 0x80000001
call fcn.00406dfc
lea eax, [ebp - 0x14]
mov ecx, 0x40797c
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x14]
push eax
mov edx, 0x4078d0
mov ecx, 0x407994
mov eax, 0x80000002
call fcn.00406dfc
cmp byte [0x415b40], 0
jne 0x40783e
push 0
mov ecx, 0x4079a8
mov edx, 0x4079c0
mov eax, 0x80000002
call fcn.00406dfc
push 0x4079f4
mov edx, 0x4079c0
mov ecx, 0x407a04
mov eax, 0x80000002
call fcn.00406dfc
push 0x407a1c
mov edx, 0x4079c0
mov ecx, 0x407a58
mov eax, 0x80000002
call fcn.00406dfc
push 0x407a6c
mov edx, 0x4079c0
mov ecx, 0x407a88
mov eax, 0x80000002
call fcn.00406dfc
push 0x407a9c
mov edx, 0x4079c0
mov ecx, 0x407ab0
mov eax, 0x80000002
call fcn.00406dfc
push 0x407ac0
mov edx, 0x4079c0
mov ecx, 0x407ad4
mov eax, 0x80000002
call fcn.00406dfc
lea eax, [ebp - 0x18]
mov ecx, 0x40786c
mov edx, dword [0x415adc]
call fcn.004038f0
mov eax, dword [ebp - 0x18]
push eax
mov edx, 0x4079c0
mov ecx, 0x407ae8
mov eax, 0x80000002
call fcn.00406dfc
push 1
mov edx, 0x4079c0
mov ecx, 0x407afc
mov eax, 0x80000002
call fcn.00406f24
push 3
mov edx, 0x4079c0
mov ecx, 0x407b14
mov eax, 0x80000002
call fcn.00406f24
push 2
mov edx, 0x4079c0
mov ecx, 0x407b30
mov eax, 0x80000002
call fcn.00406f24
push 0x120
mov edx, 0x4079c0
mov ecx, 0x407b40
mov eax, 0x80000002
call fcn.00406f24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407860
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00403750
ret
Function at 0x407d2c
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
lea eax, [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_QueryPerformanceFrequency
lea eax, [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_QueryPerformanceCounter
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
adc edx, dword [ebp - 0xc]
jno 0x407d57
call fcn.00402f1c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push ebp
call fcn.00407d24
pop ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
lea eax, [ebp - 0x18]
push eax
call sub.KERNEL32.DLL_QueryPerformanceCounter
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x1c]
jne 0x407d85
cmp eax, dword [ebp - 0x20]
jb 0x407d6a
jmp 0x407d87
jl 0x407d6a
push ebp
call fcn.00407d24
pop ecx
sub eax, dword [ebp - 0x28]
sbb edx, dword [ebp - 0x24]
jno 0x407d9b
call fcn.00402f1c
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40d364
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor ebx, ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a94
mov eax, dword [ebp - 0xc]
call fcn.00403a94
xor eax, eax
push ebp
push 0x40d566
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004038a4
test eax, eax
jle 0x40d408
lea eax, [ebp - 4]
mov edx, 0x40d57c
call fcn.004038ac
push 0
mov eax, dword [ebp - 4]
call fcn.004038a4
push eax
lea eax, [ebp - 4]
call fcn.00403afc
mov edx, 1
dec edx
test eax, eax
je 0x40d3d8
cmp edx, dword [eax - 4]
jb 0x40d3dd
call fcn.00402f14
inc edx
lea eax, [eax + edx - 1]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 0x10], eax
cmp byte [ebp - 5], 0
jne 0x40d408
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
call fcn.00405478
jmp 0x40d53d
lea eax, [ebp - 0x110]
xor ecx, ecx
mov edx, 0xff
call fcn.00402bd8
push 0
push 0xff
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x40d530
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x110]
mov ecx, pe_nt_image_headers32
call fcn.0040388c
mov eax, dword [ebp - 0xc]
call fcn.004038a4
cmp eax, 3
jne 0x40d53d
mov eax, 1
mov edx, dword [ebp - 0xc]
dec eax
test edx, edx
je 0x40d477
cmp eax, dword [edx - 4]
jb 0x40d47c
call fcn.00402f14
inc eax
mov al, byte [edx + eax - 1]
cmp al, byte [ebp - 0x110]
jne 0x40d4d1
mov eax, 2
mov edx, dword [ebp - 0xc]
dec eax
test edx, edx
je 0x40d49b
cmp eax, dword [edx - 4]
jb 0x40d4a0
call fcn.00402f14
inc eax
mov al, byte [edx + eax - 1]
cmp al, byte [ebp - 0x10f]
jne 0x40d4d1
mov eax, 3
mov edx, dword [ebp - 0xc]
dec eax
test edx, edx
je 0x40d4bf
cmp eax, dword [edx - 4]
jb 0x40d4c4
call fcn.00402f14
inc eax
mov al, byte [edx + eax - 1]
cmp al, byte [ebp - 0x10e]
je 0x40d53d
push 0x40d588
push dword [ebp - 4]
push 0x40d59c
push dword [ebp - 0xc]
push 0x40d5b0
push 0x40d57c
mov eax, dword [ebp + 8]
push dword [eax]
push 0x40d57c
push dword [0x495b68]
lea eax, [ebp - 0x114]
mov edx, 9
call fcn.00403964
mov eax, dword [ebp - 0x114]
call fcn.00412fc4
mov eax, dword [ebp + 0xc]
add eax, 0xfffffffc
call fcn.00406650
mov eax, dword [ebp + 8]
mov edx, 0x40d5bc
call fcn.00403780
jmp 0x40d53d
mov eax, dword [ebp + 8]
mov edx, 0x40d5bc
call fcn.00403780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d56d
lea eax, [ebp - 0x114]
call fcn.0040372c
lea eax, [ebp - 0xc]
call fcn.0040372c
lea eax, [ebp - 4]
call fcn.0040372c
ret
Function at 0x40dcac
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0x40dcf0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x40dcfc
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
push 0
push 0
push 0x40dd1c
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
pop ebp
ret

Function at 0x40e53c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40e5d4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xfa
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 8]
lea edx, [ebp - 0x108]
mov ecx, pe_nt_image_headers32
call fcn.0040388c
mov edx, dword [ebp - 8]
mov eax, 0x40e5ec
call fcn.00403b8c
test eax, eax
jne 0x40e5b9
mov edx, dword [ebp - 8]
mov eax, 0x40e5fc
call fcn.00403b8c
test eax, eax
jne 0x40e5b9
mov edx, dword [ebp - 8]
mov eax, 0x40e610
call fcn.00403b8c
test eax, eax
jne 0x40e5b9
xor eax, eax
jmp 0x40e5bb
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e5db
lea eax, [ebp - 8]
call fcn.0040372c
ret

Function at 0x40e620
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 9
push 0
push 0
dec ecx
jne 0x40e628
xor eax, eax
push ebp
push 0x40e940
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
push 1
push 0
push 0
lea eax, [ebp - 0x1c]
mov ecx, dword [0x415af0]
mov edx, 0x40e958
call fcn.004038f0
mov eax, dword [ebp - 0x1c]
call fcn.00403aa4
push eax
push 0x40e960
push 0
call sub.shell32.dll_ShellExecuteA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x20
jae 0x40e69f
mov eax, dword [ebp - 0x18]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00405498
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x40e970
call fcn.004038f0
mov eax, dword [ebp - 0x20]
call fcn.00412fc4
mov byte [ebp - 2], 0
cmp byte [ebp - 2], 0xa
jae 0x40e6cd
call fcn.0040e53c
test al, al
jne 0x40e6cd
add byte [ebp - 2], 1
jae 0x40e6bd
call fcn.00402f1c
push 0x258
call sub.KERNEL32.DLL_Sleep
cmp byte [ebp - 2], 0xa
jb 0x40e6a9
xor eax, eax
mov dword [ebp - 8], eax
cmp byte [ebp - 2], 0xa
jb 0x40e75f
push 0
push 0x40e97c
call sub.user32.dll_FindWindowA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x40e6e6
add byte [ebp + 0xf], dh