joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103ae56
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x728
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x103b030
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push 0x80
xor esi, esi
push eax
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], esi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
push esi
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push esi
push 0x20019
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
call dword [sym.imp.SHLWAPI.dll_SHRegOpenUSKeyW]
test eax, eax
jne 0x103afc8
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHRegQueryUSValueW]
push esi
push esi
push esi
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push esi
push 0x103b010
push dword [ebp - 0x724]
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 0x208
mov word [ebp - 0x20c], si
call ebx
test eax, eax
je 0x103af9a
push edi
push esi
push esi
push esi
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push esi
push 0x103aff8
push dword [ebp - 0x724]
mov edi, 0x104
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], edi
call ebx
test eax, eax
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], edi
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
jne 0x103af48
push eax
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push esi
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push 2
push 0x40
call dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
jmp 0x103af99
push esi
push esi
push esi
push eax
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push esi
push 0x103afdc
push dword [ebp - 0x724]
call ebx
test eax, eax
jne 0x103af99
push edi
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
call dword [sym.imp.SHLWAPI.dll_SHUnicodeToUnicode]
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_SHRunIndirectRegClientCommand]
mov word [ebp - 0x20c], si
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 1
pop edi
cmp word [ebp - 0x20c], si
pop ebx
je 0x103afbc
push 9
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
call fcn.010149a9
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 1
push dword [ebp - 0x724]
call dword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
pop esi
call fcn.01001b01
leave
ret 4
Function at 0x103b791
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
and dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
mov eax, dword [ebp + 0x14]
push 0x10
pop ecx
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
xor eax, eax
push ebx
lea edi, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
rep stosd dword es:[edi], eax
push 0x102
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 0x44
call fcn.01004cfc
test eax, eax
jl 0x103b867
push esi
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push 0x103b87c
mov esi, 0x208
push esi
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
call fcn.01008c55
xor edi, edi
cmp eax, edi
jl 0x103b866
push dword [ebp - 0x420]
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push esi
push eax
call fcn.01008c55
cmp eax, edi
jl 0x103b866
push dword [ebp - 0x41c]
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push dword [ebp - 0x424]
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push edi
push edi
push edi
push edi
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
pop edi
pop ebx
call fcn.01001b01
leave
ret 0x10
Function at 0x103caa2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp + 0xc]
push eax
push 1
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x103cb03
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], 4
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x103cafa
cmp dword [ebp - 0xc], 4
je 0x103cafa
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xc]
push eax
push 1
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x103cb46
push 4
pop esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x14]
mov dword [ebp - 8], esi
push dword [ebp + 0xc]
call ebx
test eax, eax
jne 0x103cb3d
cmp dword [ebp - 0xc], esi
je 0x103cb3d
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x103cb55
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
lea edx, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push edx
push 1
xor esi, esi
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x103cbcb
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push esi
push edi
push dword [ebp - 0x10c]
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10c]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
call fcn.01001b01
leave
ret 0xc

Function at 0x103cd8f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x100bbe8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103cde1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x101d488
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret
Function at 0x103cdeb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
cmp eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
jne 0x103ce6f
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x103ce80
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x103ce5e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x103ce74
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x103ce55
cmp dword [ebp - 0xc], 4
jne 0x103ce55
cmp dword [ebp - 0x10], eax
je 0x103ce55
mov dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
cmp eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
jne 0x103ce6f
xor eax, eax
mov dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
leave
ret
Function at 0x401080
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0x4026a0
mov eax, dword [ebp + 8]
push eax
push 0x71
mov ecx, dword [0x41ffe8]
push ecx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov edx, dword [ebp - 4]
mov dword [edx + 0x24], eax
push 0x14
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
sub edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 8]
sub edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
push 0xfffffffffffffffe
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x401120
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x41f100]
mov dword [ebp - 8], eax
mov dword [ebp - 0x11c], ecx
push 0x3f4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 0x118], eax
push 0
push 0
push 0x146
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x40119d
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x144
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x401174
cmp dword [ebp - 0x118], 0
je 0x401253
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
cmp dword [ecx + edx*4], 0
je 0x401253
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + edx*4]
movzx ecx, byte [eax + 3]
push ecx
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
movzx eax, byte [edx + 2]
push eax
mov ecx, dword [ebp - 0x118]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
movzx edx, byte [ecx + 1]
push edx
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + edx*4]
movzx ecx, byte [eax]
push ecx
push 0x41c25c
lea edx, [ebp - 0x110]
push edx
call fcn.0041062c
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
push 0
push 0x143
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x4011b1
push 0
push 0
push 0x14e
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x110]
push ecx
push 0
push 0x148
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 8]
call fcn.004106b5
mov esp, ebp
pop ebp
ret 8
Function at 0x401530
Capabilities:
Create tcp socket
Create udp socket
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x41f100]
mov dword [ebp - 4], eax
mov dword [ebp - 0x23c], ecx
mov eax, dword [ebp - 0x23c]
cmp dword [eax + 4], 0
je 0x401561
mov ecx, dword [ebp - 0x23c]
mov eax, dword [ecx + 4]
jmp 0x4016f4
push 0x3f4
mov edx, dword [ebp - 0x23c]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x238], eax
push 0x3f5
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ecx + 0x24]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x230]
push eax
push 0
push 0
push 0x147
mov ecx, dword [ebp - 0x238]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 0x148
mov edx, dword [ebp - 0x238]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x104
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [ebp - 0x128]
push edx
call fcn.0041074b
add esp, 4
mov word [ebp - 0x1c], ax
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov ecx, dword [ebp - 0x23c]
mov dword [ecx + 0x1c], eax
mov edx, dword [ebp - 0x23c]
cmp dword [edx + 0x1c], 0xffffffff
jne 0x40161b
mov eax, dword [ebp - 0x23c]
mov eax, dword [eax + 4]
jmp 0x4016f4
mov word [ebp - 0x14], 2
mov cx, word [ebp - 0x1c]
push ecx
call sub.WS2_32.dll_htons
mov word [ebp - 0x12], ax
lea edx, [ebp - 0x230]
push edx
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ecx + 0x1c]
push edx
call sub.WS2_32.dll_bind
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x401670
mov eax, dword [ebp - 0x23c]
mov eax, dword [eax + 4]
jmp 0x4016f4
push 5
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ecx + 0x1c]
push edx
call sub.WS2_32.dll_listen
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x40169b
mov eax, dword [ebp - 0x23c]
mov eax, dword [eax + 4]
jmp 0x4016f4
push 8
push 0x700
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ecx + 0x24]
push edx
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax + 0x1c]
push ecx
call sub.WS2_32.dll_WSAAsyncSelect
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x4016d5
mov edx, dword [ebp - 0x23c]
mov eax, dword [edx + 4]
jmp 0x4016f4
push 1
mov ecx, dword [ebp - 0x23c]
call fcn.00401470
mov eax, dword [ebp - 0x23c]
mov dword [eax + 4], 1
mov eax, 1
mov ecx, dword [ebp - 4]
call fcn.004106b5
mov esp, ebp
pop ebp
ret
Function at 0x401750
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x41f100]
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], 0x10
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x1c]
push eax
call sub.WS2_32.dll_accept
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.WS2_32.dll_inet_ntoa
mov dword [ebp - 4], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x40179c
mov edx, dword [ebp - 0x1c]
push edx
call sub.WS2_32.dll_closesocket
jmp 0x40180f
push 0x23
push 0x700
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x24]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call sub.WS2_32.dll_WSAAsyncSelect
cmp eax, 0xffffffff
jne 0x4017c3
mov eax, dword [ebp - 0x1c]
push eax
call sub.WS2_32.dll_closesocket
jmp 0x40180f
mov dword [ebp - 0x28], 0x80000
mov dword [ebp - 0x20], 0x20000
push 4
lea ecx, [ebp - 0x28]
push ecx
push 0x1001
push 0xffff
mov edx, dword [ebp - 0x1c]
push edx
call sub.WS2_32.dll_setsockopt
push 4
lea eax, [ebp - 0x20]
push eax
push 0x1002
push 0xffff
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.WS2_32.dll_setsockopt
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x2c]
call fcn.00401d30
mov ecx, dword [ebp - 8]
call fcn.004106b5
mov esp, ebp
pop ebp
ret
Function at 0x402090
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x41f100]
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
call fcn.00401c70
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x2c]
call fcn.0040d5a0
test eax, eax
je 0x4020be
cmp dword [ebp - 4], 0
jne 0x4020c2
xor eax, eax
jmp 0x402135
push 0x1f
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.00410a90
add esp, 0xc
mov word [ebp - 0x26], 0x300
mov word [ebp - 0x28], 0x1f
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.00410c20
add esp, 8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x13], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xf], ecx
mov dl, byte [ebp + 0x14]
mov byte [ebp - 0xb], dl
mov al, byte [ebp + 0x18]
mov byte [ebp - 0xa], al
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
add edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], edx
push 0
movzx ecx, word [ebp - 0x28]
push ecx
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call sub.WS2_32.dll_send
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov eax, edx
mov ecx, dword [ebp - 8]
call fcn.004106b5
mov esp, ebp
pop ebp
ret 0x14
Function at 0x402150
Capabilities:
Check for time delay via gettickcount
Print debug messages
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
mov eax, dword [0x41f100]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xec], ecx
mov ecx, dword [ebp - 0xec]
call fcn.00401c70
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xec]
call fcn.0040d5a0
test eax, eax
je 0x40218a
cmp dword [ebp - 4], 0
jne 0x40218f
jmp 0x4022c9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xc]
cmp eax, 0x64
jae 0x4022c9
mov ecx, dword [ebp + 8]
call fcn.0040b5f0
test eax, eax
jbe 0x4022c9
push 0x52
push 0
lea eax, [ebp - 0x68]
push eax
call fcn.00410a90
add esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.00402820
mov dword [ebp - 8], eax
mov word [ebp - 0x66], 0x200
mov word [ebp - 0x68], 0x52
mov ecx, dword [ebp - 8]
add ecx, 8
push ecx
lea edx, [ebp - 0x64]
push edx
call fcn.00410c20
add esp, 8
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x2c]
mov dword [ebp - 0x53], ecx
mov edx, dword [ebp - 8]
add edx, 0x30
push edx
lea eax, [ebp - 0x4f]
push eax
call fcn.00410c20
add esp, 8
mov ecx, dword [ebp - 8]
add ecx, 0x44
push ecx
lea edx, [ebp - 0x3b]
push edx
call fcn.00410c20
add esp, 8
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x58]
mov dword [ebp - 0x27], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0x23], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x64]
mov dword [ebp - 0x1f], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x68]
mov dword [ebp - 0x1b], ecx
mov edx, dword [ebp - 8]
mov al, byte [edx + 0x6c]
mov byte [ebp - 0x17], al
xor ecx, ecx
je 0x402285
lea edx, [ebp - 0x3b]
push edx
lea eax, [ebp - 0x4f]
push eax
mov ecx, dword [ebp - 0x53]
push ecx
lea edx, [ebp - 0x64]
push edx
push str.userId_s_ipId_d_serviceIp_s_realIp_s_n
lea eax, [ebp - 0xe8]
push eax
call fcn.0041062c
add esp, 0x18
lea ecx, [ebp - 0xe8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
add eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
push 0
movzx edx, word [ebp - 0x68]
push edx
lea eax, [ebp - 0x68]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
jne 0x4022bc
push str.access_log_error_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4022c9
mov ecx, dword [ebp + 8]
call fcn.00402840
jmp 0x402198
mov ecx, dword [ebp - 0x10]
call fcn.004106b5
mov esp, ebp
pop ebp
ret 4
Function at 0x402410
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x41f100]
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], ecx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [ebp - 0x228]
call fcn.00401af0
cmp dword [0x41ffd0], 0
je 0x4024e2
push 0x3f4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x224], eax
lea edx, [ebp - 0x110]
push edx
push 0
push 0
push 0x147
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 0x148
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x104
lea edx, [ebp - 0x220]
push edx
push 0x3f5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [ebp - 0x220]
push ecx
call fcn.0041074b
add esp, 4
mov word [ebp - 0x114], ax
mov dx, word [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [0x41ffd0]
call fcn.004027e0
mov ecx, dword [ebp - 0x228]
cmp dword [ecx + 0x1c], 0xffffffff
je 0x40250a
mov edx, dword [ebp - 0x228]
mov eax, dword [edx + 0x1c]
push eax
call sub.WS2_32.dll_closesocket
mov ecx, dword [ebp - 0x228]
mov dword [ecx + 0x1c], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.004106b5
mov esp, ebp
pop ebp
ret 0xc

Function at 0x403ed0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0x404370
mov eax, dword [ebp + 8]
push eax
push 0x69
mov ecx, dword [0x41ffe8]
push ecx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
push 0x14
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
sub edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 8]
sub edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
push 0xfffffffffffffffe
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov esp, ebp
pop ebp
ret 0xc