joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x424af8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x430280]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x7c]
mov ecx, dword [edi + 0x80]
mov edx, dword [edi + 0x84]
lea esi, [edi + 0x7c]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x2c], ecx
mov ecx, dword [edi + 0x34]
mov dword [esp + 0x34], eax
xor eax, eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
test ecx, ecx
je 0x4106bd
push eax
lea eax, [esp + 0x1c]
call fcn.004104a0
jmp 0x4106d4
mov eax, dword [edi + 0x6c]
test eax, eax
je 0x4106d4
mov edx, dword [eax + 0x38]
mov edx, dword [edx + 0x24]
lea ecx, [eax + 0x38]
lea eax, [esp + 0x18]
push eax
call edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.USER32.dll_OffsetRect]
mov ebx, dword [edi + 0x80]
mov eax, dword [ebp + 0xc]
mov edi, dword [esi]
sub ebx, dword [esp + 0x2c]
sub edi, dword [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esi], edx
mov edx, dword [esp + 0x24]
push ebx
mov dword [esi + 4], eax
push edi
mov dword [esi + 8], ecx
push esi
mov dword [esi + 0xc], edx
call dword [sym.imp.USER32.dll_OffsetRect]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x6c]
test ebx, ebx
je 0x41076c
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x41075e
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x41075e
push 1
lea edx, [esp + 0x3c]
push edx
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ebx, dword [ebx + 0x40]
test ebx, ebx
je 0x41076c
push ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 5
mov ebx, 2
lea eax, [esp + 0x4c]
call fcn.00409a70
mov dword [esp + 0x70], 0
mov eax, dword [esp + 0x60]
mov dword [eax], 0
mov ecx, dword [esp + 0x60]
mov dword [ecx + 4], esi
mov eax, dword [esp + 0x58]
mov ebx, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
lea esi, [edi + 0x38]
cmp eax, 0xf
jne 0x4107bb
mov edx, dword [esp + 0x60]
mov eax, dword [edx]
mov edx, dword [esi - 0x38]
lea ecx, [esi - 0x38]
push eax
mov eax, dword [edx + 0x2c]
call eax
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x48]
push ecx
push ebx
push edx
mov ecx, esi
call fcn.004109a0
lea edi, [esp + 0x48]
mov dword [esp + 0x70], 0xffffffff
call fcn.00402cc0
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x411070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
push esi
push edi
mov esi, eax
xor edi, edi
cmp dword [esi + 4], edi
jne 0x41108e
xor eax, eax
pop edi
pop esi
add esp, 0x90
ret 0x24
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
mov ecx, esi
call edx
test eax, eax
je 0x411081
mov eax, dword [esp + 0x9c]
mov eax, dword [eax + 8]
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [esp + 0x14], edi
call sub.gdiplus.dll_GdipCreateFromHDC
fld1
mov ecx, dword [esp + 0xa4]
fst dword [esp + 0x30]
fldz
mov edx, dword [esp + 0xc]
fst dword [esp + 0x34]
mov dword [esp + 0x24], ecx
movzx ecx, byte [esp + 0xbc]
fst dword [esp + 0x38]
fst dword [esp + 0x3c]
mov dword [esp + 0xc], ecx
fst dword [esp + 0x40]
mov dword [esp + 0x18], edx
fst dword [esp + 0x44]
mov edx, dword [esp + 0xa8]
fst dword [esp + 0x4c]
mov dword [esp + 0x1c], eax
fst dword [esp + 0x50]
mov eax, dword [esp + 0xa0]
fst dword [esp + 0x54]
mov dword [esp + 0x28], edx
fst dword [esp + 0x58]
mov dword [esp + 0x20], eax
fst dword [esp + 0x5c]
mov eax, dword [esp + 0xac]
fst dword [esp + 0x64]
lea edx, [esp + 0x10]
fst dword [esp + 0x68]
push edx
fst dword [esp + 0x70]
mov dword [esp + 0x30], eax
fst dword [esp + 0x74]
mov dword [esp + 0x14], edi
fst dword [esp + 0x78]
fxch st(1)
fst dword [esp + 0x4c]
fst dword [esp + 0x64]
fild dword [esp + 0x10]
fdiv qword [0x42aa28]
fstp dword [esp + 0x7c]
fxch st(1)
fst dword [esp + 0x80]
fst dword [esp + 0x84]
fst dword [esp + 0x88]
fst dword [esp + 0x8c]
fstp dword [esp + 0x90]
fstp dword [esp + 0x94]
call sub.gdiplus.dll_GdipCreateImageAttributes
mov ecx, dword [esp + 0x10]
push edi
push edi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x38]
push eax
push 1
push 1
push ecx
call sub.gdiplus.dll_GdipSetImageAttributesColorMatrix
cmp eax, edi
je 0x4111af
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x10]
push edi
push 0xff000000
push 3
push edx
call sub.gdiplus.dll_GdipSetImageAttributesWrapMode
cmp eax, edi
je 0x4111c9
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0xb4]
mov edx, dword [esp + 0xb0]
mov edi, dword [esi + 4]
push eax
push ecx
push edx
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x2c]
lea esi, [esp + 0x24]
call fcn.00410b40
mov esi, eax
mov eax, dword [esp + 0x10]
neg esi
sbb esi, esi
push eax
inc esi
call sub.gdiplus.dll_GdipDisposeImageAttributes
mov ecx, dword [esp + 0x18]
push ecx
call sub.gdiplus.dll_GdipDeleteGraphics
pop edi
mov eax, esi
pop esi
add esp, 0x90
ret 0x24
Function at 0x415283
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430280]
jne 0x41528d
repz ret
jmp fcn.00419247

Function at 0x42008d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041ad0f
and dword [ebp - 4], 0
cmp dword [0x432f04], 0
mov ebx, eax
jne 0x42013e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4201ef
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4201ef
push eax
call fcn.0041ac9d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x432f04], eax
call esi
push eax
call fcn.0041ac9d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x432f08], eax
call esi
push eax
call fcn.0041ac9d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x432f0c], eax
call esi
push eax
call fcn.0041ac9d
pop ecx
mov dword [0x432f14], eax
test eax, eax
je 0x42013e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041ac9d
pop ecx
mov dword [0x432f10], eax
mov eax, dword [0x432f10]
cmp eax, ebx
je 0x420196
cmp dword [0x432f14], ebx
je 0x420196
push eax
call fcn.0041ad18
push dword [0x432f14]
mov esi, eax
call fcn.0041ad18
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x420196
test edi, edi
je 0x420196
call esi
test eax, eax
je 0x42018d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42018d
test byte [ebp - 0xc], 1
jne 0x420196
or dword [ebp + 0x10], 0x200000
jmp 0x4201cf
mov eax, dword [0x432f08]
cmp eax, ebx
je 0x4201cf
push eax
call fcn.0041ad18
pop ecx
test eax, eax
je 0x4201cf
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4201cf
mov eax, dword [0x432f0c]
cmp eax, ebx
je 0x4201cf
push eax
call fcn.0041ad18
pop ecx
test eax, eax
je 0x4201cf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x432f04]
call fcn.0041ad18
pop ecx
test eax, eax
je 0x4201ef
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4201f1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x421081
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x432fd8], 0
push esi
jne 0x420ff4
call fcn.00420f1a
test eax, eax
je 0x421037
mov eax, dword [0x432fd8]
cmp eax, 1
jne 0x421015
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x421037
pop esi
ret
push eax
call dword [0x432fe0]
test eax, eax
jne 0x42107f
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x42103b
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x432fd8]
call dword [0x432fe0]
mov edi, eax
test edi, edi
je 0x421060
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x42107c
mov edi, esi
add esi, 0xff0
push edi
push dword [0x432fd8]
call dword [0x432fdc]
add edi, 0x10
cmp edi, esi
jb 0x421068
mov eax, edi
pop edi
pop esi
ret
jmp 0x420fe1
Function at 0x402950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x47c860]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x54], ecx
mov eax, dword [0x481290]
and eax, 1
jne 0x402998
mov ecx, dword [0x481290]
or ecx, 1
mov dword [0x481290], ecx
push 0x19000
mov ecx, 0x481288
call fcn.00402c70
push 0x461410
call fcn.0042d3bb
add esp, 4
mov ecx, 0x481288
call fcn.004052c0
mov dword [ebp - 0x50], eax
mov edx, dword [ebp + 0xc]
push edx
push 0x46c430
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, 0x481288
call fcn.00402d00
lea ecx, [ebp - 0x50]
push ecx
mov ecx, 0x481288
call fcn.00402d30
push eax
push 0
push 0
lea edx, [ebp - 0x48]
push edx
push reloc.OLEAUT32.dll_SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xea
jne 0x402a0e
mov eax, dword [ebp - 0x50]
add eax, 0x2800
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, 0x481288
call fcn.00402cc0
jmp 0x4029c5
mov edx, dword [ebp + 8]
mov eax, dword [0x481288]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042c98c
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40ecfe
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CInternetSession.0
test eax, eax
jne 0x40ed29
call fcn.00419e51
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esi + 8], eax
test eax, eax
jne 0x40ed4c
push eax
push dword [esi + 4]
call fcn.0040ec84
push esi
push eax
mov ecx, 0x47e480
call fcn.0040e90b
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x40f7b2
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x45d04c
call fcn.00430b67
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0040f772
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.00402020
push dword [esi + 8]
mov edi, dword [edi + 8]
push 0
push 3
push dword [ebp + 0x18]
mov byte [ebp - 4], 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esi + 4], eax
test eax, eax
jne 0x40f818
push eax
push dword [esi + 8]
call fcn.0040ec84
push dword [esi + 0xc]
mov ecx, 0x47e480
push eax
call fcn.0040e90b
mov eax, esi
call fcn.00430c3f
ret 0x18
Function at 0x415622
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x415669
call fcn.00419e51
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x415669
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x415685
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041519a
mov esi, eax
test edi, edi
je 0x415683
test ebx, ebx
je 0x415683
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x415e54
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x45d377
call fcn.00430b67
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x415e79
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x415ebf
lea ecx, [ebp - 0x10]
call fcn.00402020
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040c607
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401fc0
mov eax, esi
call fcn.00430c3f
ret 8

Function at 0x4181a5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4181c9
cmp dword [edi + 0x54], 0
jne 0x4181c9
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00419e51
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00418166
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4182ec
Capabilities:
Connect socket

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ecx + 4]
call dword [sym.imp.WSOCK32.dll_connect]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebp
ret 8
Function at 0x41c02f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x41c077
call fcn.00419e51
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41c077
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x41c0ba
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x41c0a3
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41c0a3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x41c0b7
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x42c98c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47c860]
jne 0x42c996
repz ret
jmp fcn.00434436
Function at 0x43f754
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00433d9a
and dword [ebp - 4], 0
cmp dword [0x480f34], 0
mov ebx, eax
jne 0x43f805
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43f8b6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x43f8b6
push eax
call fcn.00433d28
mov dword [esp], 0x4679e8
push edi
mov dword [0x480f34], eax
call esi
push eax
call fcn.00433d28
mov dword [esp], 0x4679d4
push edi
mov dword [0x480f38], eax
call esi
push eax
call fcn.00433d28
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x480f3c], eax
call esi
push eax
call fcn.00433d28
pop ecx
mov dword [0x480f44], eax
test eax, eax
je 0x43f805
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00433d28
pop ecx
mov dword [0x480f40], eax
mov eax, dword [0x480f40]
cmp eax, ebx
je 0x43f85d
cmp dword [0x480f44], ebx
je 0x43f85d
push eax
call fcn.00433da3
push dword [0x480f44]
mov esi, eax
call fcn.00433da3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43f85d
test edi, edi
je 0x43f85d
call esi
test eax, eax
je 0x43f854
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43f854
test byte [ebp - 0xc], 1
jne 0x43f85d
or dword [ebp + 0x10], 0x200000
jmp 0x43f896
mov eax, dword [0x480f38]
cmp eax, ebx
je 0x43f896
push eax
call fcn.00433da3
pop ecx
test eax, eax
je 0x43f896
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43f896
mov eax, dword [0x480f3c]
cmp eax, ebx
je 0x43f896
push eax
call fcn.00433da3
pop ecx
test eax, eax
je 0x43f896
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x480f34]
call fcn.00433da3
pop ecx
test eax, eax
je 0x43f8b6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43f8b8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x445eb0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45eff2
mov eax, dword fs:[0]
push eax
sub esp, 0x2ec
mov eax, dword [0x47c860]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2f8], ecx
mov dword [ebp - 0x2f4], 0
lea ecx, [ebp - 0x28]
call fcn.00407ed0
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c0], 0
lea eax, [ebp - 0x2bc]
push eax
push 0x102
call dword [sym.imp.WSOCK32.dll_WSAStartup]
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0
je 0x445f57
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00407f40
mov edx, dword [ebp - 0x2f4]
or edx, 1
mov dword [ebp - 0x2f4], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00408040
mov eax, dword [ebp + 8]
jmp 0x4460cb
push 0xff
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
push 0x10
call fcn.0042d421
add esp, 4
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x12c]
push ecx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c4], 0
jmp 0x445fa1
mov edx, dword [ebp - 0x2c4]
add edx, 1
mov dword [ebp - 0x2c4], edx
mov eax, 2
mov word [ebp - 0x2ec], ax
push 0x2537
call dword [sym.imp.WSOCK32.dll_htons]
mov word [ebp - 0x2ea], ax
mov ecx, dword [ebp - 0x10]
movsx edx, word [ecx + 0xa]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x2c4]
mov eax, dword [ecx + edx*4]
push eax
lea ecx, [ebp - 0x2e8]
push ecx
call fcn.0042cba0
add esp, 0xc
push 0x10
mov edx, dword [ebp - 0x2e8]
push edx
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
push eax
push 0x10
lea eax, [ebp - 0x2d8]
push eax
call fcn.00430017
add esp, 0x10
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.0044a050
add esp, 4
mov dword [ebp - 0x2c8], eax
mov edx, dword [ebp - 0x2c8]
push edx
lea ecx, [ebp - 0x2dc]
call fcn.004024c0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x2f0], eax
mov ecx, dword [ebp - 0x2f0]
push ecx
call fcn.0040c184
add esp, 4
lea edx, [ebp - 0x2dc]
push edx
lea ecx, [ebp - 0x28]
call fcn.00408060
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
movsx eax, word [edx + 0xa]
mov edx, dword [ebp - 0x2c4]
add eax, dword [ecx + edx*4]
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ecx]
jb 0x44608a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2dc]
call fcn.00401ec0
jmp 0x44609e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2dc]
call fcn.00401ec0
jmp 0x445f92
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp + 8]
call fcn.00407f40
mov eax, dword [ebp - 0x2f4]
or eax, 1
mov dword [ebp - 0x2f4], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00408040
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.0042c98c
mov esp, ebp
pop ebp
ret 4
Function at 0x448e50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f286
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x47c860]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
call eax
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x60
call fcn.00402f50
push 0
push 0
mov edx, dword [ebp - 0x14]
push edx
push 0x448c00
push 0
push 0
call fcn.0042f0b1
add esp, 0x18
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0xc4], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00403860
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x449060
Capabilities:
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x47c860]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 0x14], eax
mov ecx, 2
mov word [ebp - 0x18], cx
movzx edx, word [ebp + 0x14]
push edx
call dword [sym.imp.WSOCK32.dll_htons]
mov word [ebp - 0x16], ax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x449100
push 0x10
lea ecx, [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WSOCK32.dll_sendto]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x4490f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34], eax
push 0xa
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.004305f3
add esp, 0xc
or eax, 0xffffffff
jmp 0x449103
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 4], edx
jmp 0x44909f
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0042c98c
mov esp, ebp
pop ebp
ret 0x10