joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c1f0
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
mov eax, dword [0x4de8bc]
xor eax, esp
mov dword [esp + 0x98], eax
push esi
mov esi, dword [esp + 0xa4]
test esi, esi
jne 0x40c21d
mov eax, dword [0x4e9230]
test eax, eax
jne 0x40c3e1
push 0x94
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0042f980
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x40c26a
mov dword [0x4e9230], 0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.0042e636
add esp, 0x9c
ret
mov eax, dword [esp + 0x18]
sub eax, 1
je 0x40c393
sub eax, 1
jne 0x40c248
mov eax, dword [esp + 0xc]
cmp eax, 4
jbe 0x40c248
cmp eax, 5
jne 0x40c2f5
cmp dword [esp + 0x10], 0
jne 0x40c2b6
mov dword [0x4e9230], 4
mov eax, 4
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.0042e636
add esp, 0x9c
ret
test esi, esi
je 0x40c248
lea eax, [esp + 0x1c]
mov edx, esi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x40c2c4
mov dword [0x4e9230], 5
mov eax, 5
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.0042e636
add esp, 0x9c
ret
cmp eax, 6
jne 0x40c248
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40c32b
mov dword [0x4e9230], 6
mov eax, 6
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.0042e636
add esp, 0x9c
ret
cmp eax, 1
jne 0x40c33a
mov eax, 7
jmp 0x40c3dc
cmp eax, 2
jne 0x40c248
push 1
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea edx, [esp + 0xc]
push edx
mov esi, 8
push str.CurrentMajorVersionNumber
mov dword [esp + 0x14], esi
call fcn.0040c150
add esp, 0x10
test eax, eax
je 0x40c375
cmp dword [esp + 4], 0xa
jb 0x40c375
lea eax, [esi + 1]
jmp 0x40c3dc
mov dword [0x4e9230], esi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.0042e636
add esp, 0x9c
ret
mov eax, dword [esp + 0xc]
cmp eax, 4
ja 0x40c3d7
jne 0x40c3b2
mov eax, dword [esp + 0x10]
cmp eax, 0x5a
jae 0x40c3d7
test eax, eax
jbe 0x40c3b2
mov eax, 2
jmp 0x40c3dc
mov dword [0x4e9230], 1
mov eax, 1
pop esi
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.0042e636
add esp, 0x9c
ret
mov eax, 3
mov dword [0x4e9230], eax
mov ecx, dword [esp + 0x9c]
pop esi
xor ecx, esp
call fcn.0042e636
add esp, 0x9c
ret

Function at 0x40c460
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push esi
lea esi, [ecx + 0x10]
mov ecx, dword [esi]
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [esp + 0x18], 0
je 0x40c4a5
mov edx, dword [esi]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, esi
call fcn.004019c0
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [esp + 8]
lea eax, [ecx + 0x15e]
jmp 0x40c4af
mov ecx, dword [esp + 8]
lea eax, [ecx + 0x87]
mov edx, dword [esp + 0xc]
push 2
mov dword [esp + 0x14], eax
sub eax, ecx
push eax
mov eax, dword [esp + 0xc]
sub edx, eax
push edx
push ecx
push eax
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop esi
add esp, 0x10
ret 4
Function at 0x40c4e0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
push 0
push eax
mov dword [esi + 0x44], 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, esi
call fcn.0040c460
pop esi
ret

Function at 0x40c820
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b6048
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push esi
mov eax, dword [0x4de8bc]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
xor edx, edx
mov dword [esp + 8], edx
xor eax, eax
mov dword [esp + 0xe], eax
mov dword [esp + 0x12], eax
mov dword [esp + 0x16], eax
mov word [esp + 0x1a], ax
mov eax, dword [ecx + 0x30]
test eax, eax
mov dword [esp + 0x54], edx
mov word [esp + 0xc], dx
je 0x40c99e
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push eax
mov eax, dword [ecx + 0x48]
call eax
test eax, eax
mov edx, dword [esp + 8]
jl 0x40c99e
test edx, edx
je 0x40c99e
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x40c8fe
push eax
lea ecx, [esp + 0x20]
call fcn.00402b40
mov ecx, dword [esp + 0x68]
push ecx
lea ecx, [esp + 0x30]
mov byte [esp + 0x58], 1
call fcn.00402b40
mov edx, dword [esp + 0x64]
push edx
lea ecx, [esp + 0x40]
mov byte [esp + 0x58], 2
call fcn.00402b40
mov edx, dword [esp + 0x60]
lea eax, [esp + 0xc]
push eax
push 3
lea ecx, [esp + 0x24]
push ecx
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x64], 0
call fcn.00401540
push 0x402b30
push 3
push 0x10
lea eax, [esp + 0x28]
push eax
call fcn.0042f14c
jmp 0x40c952
mov eax, dword [esp + 0x68]
test eax, eax
je 0x40c921
mov edx, dword [esp + 0x64]
lea ecx, [esp + 0xc]
push ecx
push eax
mov eax, dword [esp + 0x68]
push edx
push eax
lea ecx, [esp + 0x18]
call fcn.00403580
jmp 0x40c952
mov eax, dword [esp + 0x64]
test eax, eax
je 0x40c93f
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0xc]
push ecx
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.004014a0
jmp 0x40c952
mov ecx, dword [esp + 0x60]
lea eax, [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x10]
call fcn.004013d0
mov esi, dword [esp + 0x5c]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi], edx
mov edx, dword [esp + 0x18]
mov dword [esi + 4], eax
mov eax, dword [esp + 8]
test eax, eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov dword [esp + 0x54], 0xffffffff
je 0x40c9d1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x50
ret 0x14
test edx, edx
mov esi, dword [esp + 0x5c]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esi], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov dword [esp + 0x54], 0xffffffff
je 0x40c9d1
mov eax, dword [edx]
mov ecx, dword [eax + 8]
push edx
call ecx
mov eax, esi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x50
ret 0x14
Function at 0x40d100
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
xor eax, eax
cmp ebp, eax
mov byte [0x4e9238], al
jle 0x40d267
push ebx
push esi
mov esi, 2
push edi
mov dword [esp + 0x10], esi
mov edx, dword [esp + 0x18]
mov cl, byte [edx + esi - 2]
lea edi, [esi - 1]
cmp edi, ebp
jl 0x40d134
xor dl, dl
jmp 0x40d138
mov dl, byte [esi + edx - 1]
cmp esi, ebp
jl 0x40d143
mov byte [esp + 0x1c], 0
jmp 0x40d152
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov bl, byte [esi + ebx]
mov byte [esp + 0x1c], bl
cmp esi, ebp
movzx ecx, cl
movzx edx, dl
jge 0x40d1b5
mov edi, ecx
shr edi, 2
mov bl, byte [edi + 0x4dd8f0]
and ecx, 3
mov edi, edx
shr edi, 4
shl ecx, 4
movzx ecx, byte [edi + ecx + 0x4dd8f0]
mov byte [eax + 0x4e9238], bl
add eax, 1
mov byte [eax + 0x4e9238], cl
movzx ecx, byte [esp + 0x1c]
mov edi, ecx
shr edi, 6
and edx, 0xf
mov dl, byte [edi + edx*4 + 0x4dd8f0]
add eax, 1
and ecx, 0x3f
movzx ecx, byte [ecx + 0x4dd8f0]
mov byte [eax + 0x4e9238], dl
jmp 0x40d23f
cmp edi, ebp
mov edi, ecx
jge 0x40d20c
shr edi, 2
mov bl, byte [edi + 0x4dd8f0]
and ecx, 3
mov byte [eax + 0x4e9238], bl
mov edi, edx
shl ecx, 4
shr edi, 4
mov cl, byte [edi + ecx + 0x4dd8f0]
mov byte [eax + 0x4e9239], cl
movzx ecx, byte [esp + 0x1c]
add eax, 1
shr ecx, 6
and edx, 0xf
mov dl, byte [ecx + edx*4 + 0x4dd8f0]
add eax, 1
mov byte [eax + 0x4e9238], dl
add eax, 1
mov byte [eax + 0x4e9238], 0x3d
jmp 0x40d248
and ecx, 3
shr edi, 2
mov bl, byte [edi + 0x4dd8f0]
mov byte [eax + 0x4e9238], bl
shl ecx, 4
shr edx, 4
mov cl, byte [edx + ecx + 0x4dd8f0]
add eax, 1
mov byte [eax + 0x4e9238], cl
add eax, 1
mov cl, 0x3d
mov byte [eax + 0x4e9238], cl
add eax, 1
mov byte [eax + 0x4e9238], cl
add esi, 3
lea edx, [esi - 2]
add eax, 1
cmp edx, ebp
mov dword [esp + 0x10], esi
jl 0x40d121
pop edi
pop esi
mov byte [eax + 0x4e9238], 0
pop ebx
mov eax, 0x4e9238
pop ebp
pop ecx
ret

Function at 0x40d520
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x4de8bc]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
push 0x104
lea eax, [esp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.drvins.exe
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 1
push 0
push esi
lea eax, [esp + 0x10]
push eax
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0042e636
add esp, 0x108
ret
Function at 0x40d8e0
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub esp, 0x264
mov eax, dword [0x4de8bc]
xor eax, esp
mov dword [esp + 0x260], eax
push esi
mov esi, dword [esp + 0x274]
xor eax, eax
push edi
mov edi, dword [esp + 0x270]
push 0x44
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
call fcn.0042f980
add esp, 0xc
test esi, esi
mov dword [esp + 0x1c], 0x44
je 0x40d948
push esi
push edi
lea ecx, [esp + 0x68]
push str.__s___s
push ecx
call fcn.0042f6b4
add esp, 0x10
jmp 0x40d954
push edi
lea edx, [esp + 0x64]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 0x27c]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
neg edx
sbb edx, edx
and edx, 0x8000000
push edx
push 0
push 0
push 0
lea eax, [esp + 0x80]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
pop esi
jne 0x40d9aa
mov eax, 0x334
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.0042e636
add esp, 0x264
ret
mov eax, dword [esp + 0x26c]
test eax, eax
je 0x40da0d
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40d9ef
mov edx, dword [esp + 4]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 0x335
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.0042e636
add esp, 0x264
ret
mov ecx, dword [esp + 4]
lea eax, [esp]
push eax
push ecx
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp]
test eax, eax
jne 0x40da0f
xor eax, eax
mov ecx, dword [esp + 0x260]
xor ecx, esp
call fcn.0042e636
add esp, 0x264
ret

Function at 0x40f660
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push 0x64
push eax
call dword [sym.imp.USER32.dll_KillTimer]
cmp dword [esi + 0xf0], 0
je 0x40f6d8
mov eax, dword [esi + 0xe8]
test eax, eax
je 0x40f6d8
cmp dword [eax + 8], 0
jne 0x40f6d8
mov ecx, esi
call fcn.0040efb0
push 0x14
call fcn.0042ed23
add esp, 4
test eax, eax
mov cl, 1
je 0x40f6ba
mov dword [eax + 8], 0
mov byte [eax + 0xc], cl
mov dword [eax], vtable.StateChangeThread.0
mov dword [eax + 0x10], 0xa
mov esi, eax
jmp 0x40f6bc
xor esi, esi
mov byte [esi + 0xc], cl
lea ecx, [esi + 4]
push ecx
push 0
push esi
push 0x402000
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
xor eax, eax
pop esi
ret 0x10
Function at 0x4121e0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x412200
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
mov edi, ecx
jne 0x412216
push 0x80004005
call fcn.00401290
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0xc]
mov edx, dword [edi]
add eax, 1
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 0xc

Function at 0x412240
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
mov dword [esp + 4], ecx
jne 0x412258
push 0x80004005
call fcn.00401290
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
add esi, eax
add edi, eax
cmp eax, 1
jne 0x412265
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8
Function at 0x412c90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x4de8bc]
xor eax, esp
mov dword [esp + 0x118], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x12c]
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push 0
push edi
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0xc]
mov esi, eax
test esi, esi
jne 0x412cfe
test ecx, ecx
je 0x412cf0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x14]
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x412d0c
test ecx, ecx
je 0x412db1
push ecx
jmp 0x412dab
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x38]
push edx
push 0
push ecx
mov dword [esp + 0x30], pe_nt_image_headers32
call esi
test eax, eax
jne 0x412d7e
jmp 0x412d40
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x10]
call fcn.00412c90
mov edi, eax
test edi, edi
jne 0x412dcd
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x10]
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x38]
push eax
push edi
push ecx
mov dword [esp + 0x30], pe_nt_image_headers32
call esi
test eax, eax
je 0x412d40
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x412d95
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
mov edx, dword [ebp]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x412db1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0042e636
add esp, 0x11c
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x412ddc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x412db3
Function at 0x415750
Capabilities:
Create thread

Disassembly:
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push ebx
push str.PDAGATEWIN
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
push ebx
je 0x415783
push ebx
push 0x87f4
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0x10
call fcn.0040c1f0
add esp, 4
cmp eax, 6
jl 0x4157b8
push str.User32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
je 0x4157b8
push str.ChangeWindowMessageFilter
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4157b8
push 1
push 0x87f4
call eax
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov eax, dword [esp + 0x60]
push ebx
push eax
push 0x4e9a38
mov ecx, 0x4e9a5c
call fcn.004118e0
push ebx
push ecx
mov eax, esp
push ebx
push ebx
push str.PDAGATETITLE
push ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], 0xfa
mov dword [esp + 0x44], 0x64
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], 0x1a4
mov dword [esp + 0x54], 0x172
mov dword [eax], ebx
mov eax, esp
lea ecx, [esp + 0x28]
mov dword [eax], ecx
push ebx
mov ecx, 0x4e9a90
call fcn.004156c0
cmp eax, ebx
je 0x415931
mov edx, dword [esp + 0x68]
push 0x4bb30c
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x41585b
mov dword [0x4e9bc0], 1
push ebx
push ecx
mov eax, esp
push ebx
push ebx
push ebx
push ecx
mov dword [eax], ebx
mov eax, esp
lea ecx, [esp + 0x38]
mov dword [eax], ecx
push ebx
mov ecx, 0x4e9d44
call fcn.004155c0
push ebx
push ecx
mov eax, esp
push ebx
push ebx
push ebx
push ecx
mov dword [eax], ebx
mov eax, esp
lea edx, [esp + 0x48]
push ebx
mov ecx, 0x4e9e34
mov dword [eax], edx
call fcn.00415640
push 0x4e9f24
push ebx
push 0x4e9f20
push 0x402000
push ebx
push ebx
mov byte [0x4e9f2c], bl
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
mov dword [0x4e9f28], eax
push ebx
lea eax, [esp + 0x4c]
push eax
xor esi, esi
call edi
test eax, eax
je 0x415931
mov ebp, dword [sym.imp.USER32.dll_IsChild]
mov ecx, dword [0x4e9ce0]
cmp ecx, ebx
je 0x415909
mov eax, dword [esp + 0x40]
cmp eax, ebx
je 0x41594d
push eax
push ecx
call ebp
test eax, eax
je 0x41594d
mov eax, dword [0x4e9d08]
mov ecx, dword [eax]
lea edx, [esp + 0x40]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov esi, eax
neg esi
sbb esi, esi
add esi, 1
cmp esi, ebx
jne 0x415923
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
lea eax, [esp + 0x4c]
push eax
call edi
test eax, eax
jne 0x4158d4
mov ecx, 0x4e9a5c
call fcn.00411b80
call dword [sym.imp.ole32.dll_OleUninitialize]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret 0x10
xor esi, esi
jmp 0x41590d
Function at 0x4159a0
Capabilities:
Write file on windows

Disassembly:
cmp dword [0x4ea040], 0
push ebp
mov ebp, dword [esp + 8]
push edi
mov edi, eax
je 0x415a04
test edi, edi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
jne 0x4159c1
push ebp
call ebx
mov edi, eax
push esi
push 0x4bb350
push str.c:pdanet.log
call fcn.0042fe7e
mov esi, eax
add esp, 8
test esi, esi
je 0x415a02
push esi
push str._n____________________________n
call ebx
push eax
push 1
push str._n____________________________n
call fcn.00430fd4
push esi
push edi
push 1
push ebp
call fcn.00430fd4
push esi
call fcn.0042fa6c
add esp, 0x24
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x417010
Capabilities:
Create thread
Delete registry value
Set registry value

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwarePdaNetAndroid
push connect
mov dword [esp + 0x38], ecx
call edi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x417079
push 0x4b8da8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x10]
push eax
push 0x4b8da8
push 1
push 0
push 0x4bb4e8
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call ebp
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwarePdaNetAndroid
push connect
call edi
test eax, eax
jne 0x4170c5
push 0x4b8da8
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x10]
push eax
push 0x4b8da8
push 1
push 0
push str.registration_code
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call ebp
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwarePdaNetAndroid
push connect
call edi
test eax, eax
jne 0x417100
mov ecx, dword [esp + 0x10]
push str.Activated
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
push edx
call ebp
push 0x4bb4c4
push str.ConnectionWM419
push str.Dialer
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
lea eax, [esp + 0x18]
push eax
call fcn.004302b1
mov ecx, dword [esp + 0x1c]
mov eax, 0xc22e4507
imul ecx
add edx, ecx
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
push 0xa
lea eax, [edx + ecx + 7]
push 0x4ea048
push eax
call fcn.004b36e8
mov esi, eax
add esp, 0x10
cmp byte [esi], 0
je 0x41715b
nop
add byte [eax], 1
add eax, 1
cmp byte [eax], 0
jne 0x417150
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwarePdaNetAndroid
push connect
call edi
test eax, eax
jne 0x4171a2
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [esp + 0x14]
push esi
push 1
xor edi, edi
push edi
push str.data
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call ebp
jmp 0x4171a4
xor edi, edi
cmp dword [esp + 0x28], edi
mov eax, dword [esp + 0x14]
mov dword [eax + 0x48], edi
mov dword [eax + 0x4c], edi
je 0x4171f7
cmp dword [0x4e9b80], edi
je 0x4171f7
push 0x10
call fcn.0042ed23
add esp, 4
cmp eax, edi
je 0x4171db
mov dword [eax + 8], edi
mov byte [eax + 0xc], 1
mov dword [eax], vtable.CDeactivateThread.0
mov esi, eax
jmp 0x4171dd
xor esi, esi
lea edx, [esi + 4]
push edx
push edi
push esi
push 0x402000
push edi
push edi
mov byte [esi + 0xc], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x41d130
Capabilities:
Connect socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x4de8bc]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
xor ebx, ebx
push ebx
push 1
push 2
mov esi, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x38], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
push 0x13ad
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0x100007f
mov word [esp + 0xc], 2
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [esi + 0x38]
mov word [esp + 0xa], ax
push 0x10
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x41d1ac
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0042e636
add esp, 0x14
ret
mov edx, dword [esi + 0x38]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x38], ebx
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.0042e636
add esp, 0x14
ret

Function at 0x41d1d0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x4de8bc]
xor eax, esp
mov dword [esp + 0x10], eax
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
push edi
mov edi, dword [esp + 0x24]
jne 0x41d26f
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x38], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
push 0x13ad
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0x100007f
mov word [esp + 0x10], 2
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [esi + 0x38]
mov word [esp + 0xe], ax
push 0x10
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x41d26f
mov edx, dword [esi + 0x38]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
mov dword [esi + 0x38], 0
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0042e636
add esp, 0x14
ret 0xc
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x41d274
push 0
sub eax, edx
push eax
mov eax, dword [esi + 0x38]
push edi
push eax
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [esi + 0x38]
push 0
push 0x400
push ebp
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp byte [esp + 0x2c], 0
mov edi, eax
jne 0x41d2b9
mov edx, dword [esi + 0x38]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x38], 0
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0042e636
add esp, 0x14
ret 0xc