joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45dc24
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4a774c]
cmp byte [eax + 0xc], 0
je 0x45dd91
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45dd8a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4acc8c], 0
jne 0x45dc78
push 0x45dd98
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x45dda0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acc8c], eax
cmp dword [0x4a56cc], 0
jne 0x45dd73
push 0x45ddb0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4a56cc], eax
cmp dword [0x4a56cc], 0
je 0x45dd73
push 0x45ddbc
mov eax, dword [0x4a56cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acc90], eax
push 0x45ddcc
mov eax, dword [0x4a56cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acc94], eax
push 0x45dde0
mov eax, dword [0x4a56cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acc98], eax
push 0x45ddf8
mov eax, dword [0x4a56cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acc9c], eax
push 0x45de10
mov eax, dword [0x4a56cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acca0], eax
push 0x45de24
mov eax, dword [0x4a56cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acca4], eax
push 0x45de3c
mov eax, dword [0x4a56cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acca8], eax
push 0x45de54
mov eax, dword [0x4a56cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4accac], eax
push 0x45de70
mov eax, dword [0x4a56cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4accb0], eax
push 0x45de7c
mov eax, dword [0x4a56cc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4accb4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45dd91
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x464654
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405584
xor eax, eax
push ebp
push 0x464789
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x46475c
xor edx, edx
push ebp
push 0x464755
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x4646a1
sub eax, 4
mov eax, dword [eax]
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46472a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x464719
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4646e0
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.00405594
lea ecx, [ebx + 1]
mov edx, esi
call fcn.00403128
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464720
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x4a70e8]
mov dl, 1
mov eax, dword [0x4087b4]
call fcn.0040e790
call fcn.00404a78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464790
lea eax, [ebp - 4]
call fcn.00405104
ret
Function at 0x464798
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464953
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405888
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x46496c
call fcn.0040541c
mov eax, ebx
call fcn.0042263c
mov edi, eax
dec edi
test edi, edi
jl 0x464850
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00422610
mov edx, dword [0x4626ec]
call fcn.00404390
test al, al
je 0x46484c
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.00422610
lea edx, [ebp - 0x14]
call fcn.00450818
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405888
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405498
inc esi
dec edi
jne 0x4647fe
movzx eax, byte [0x464970]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x46497c
mov eax, dword [ebp - 8]
call fcn.0040fe88
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.0040519c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00450818
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x46496c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.00450818
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x46496c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x46496c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x464988
call fcn.0040afec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46495a
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00405128
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405128
lea eax, [ebp - 0x14]
call fcn.00405104
lea eax, [ebp - 0x10]
call fcn.00405104
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405128
ret
Function at 0x4664a4
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405584
xor eax, eax
push ebp
push 0x466522
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405594
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x4664ed
mov eax, dword [ebx + 4]
call fcn.00405594
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
movzx eax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466529
lea eax, [ebp - 4]
call fcn.00405104
ret

Function at 0x4675d8
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46777d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.00403384
cmp word [ebx + 0xa2], 0
je 0x467621
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x467635
lea esi, [ebp - 0xc]
jmp 0x467637
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x467644
xor edi, edi
jmp 0x467651
mov eax, dword [ebx + 0x80]
call fcn.00405594
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.00405594
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00466c88
mov eax, dword [ebp - 0x14]
call fcn.00405594
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.00405594
push eax
mov eax, dword [ebp - 4]
call fcn.00405594
push eax
mov eax, ebx
call fcn.00466dc8
push eax
mov eax, ebx
call fcn.00466d9c
push eax
mov eax, ebx
call fcn.00466d54
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00466b40
mov eax, dword [ebp - 0x18]
call fcn.00405594
push eax
mov eax, dword [ebx + 8]
call fcn.00405594
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0x10], 0
jne 0x4676da
call fcn.00410350
xor edx, edx
push ebp
push 0x467753
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x467718
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x46770e
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46773c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46775a
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x46778c
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x4677b8
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00405594
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4677dd
call fcn.00410350
xor eax, eax
push ebp
push 0x467814
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x4677fd
call fcn.00410350
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46781b
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret

Function at 0x46865c
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff64
xor ebx, ebx
mov dword [esp], 0x9c
push esp
call sub.kernel32.dll_GetVersionExA_1
test eax, eax
je 0x46867e
cmp dword [esp + 4], 6
setae bl
mov eax, ebx
add esp, 0x9c
pop ebx
ret

Function at 0x4687c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405584
xor eax, eax
push ebp
push 0x46889a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4688b0
call fcn.00468688
mov ebx, eax
test ebx, ebx
je 0x468884
lea eax, [ebp - 0xc]
push eax
push 0xf01ff
push ebx
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x468884
lea eax, [ebp - 8]
push eax
push 1
push 1
push 0
push 0xf01ff
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_DuplicateTokenEx
test eax, eax
je 0x468884
lea eax, [ebp - 0x50]
mov edx, 0x44
call fcn.0046832c
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x5c], 0xc
xor eax, eax
mov dword [ebp - 0x58], eax
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x68], 0xc
xor eax, eax
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405594
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CreateProcessAsUserA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4688a1
lea eax, [ebp - 4]
call fcn.00405104
ret
Function at 0x468d70
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
test dl, dl
je 0x468d89
add esp, 0xfffffff0
call fcn.00404528
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x468e47
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.004041d4
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 8], 0xffffffff
mov byte [ebx + 0xc], 0
cmp dword [ebx + 4], 0xffffffff
jne 0x468dcb
push ebx
push 0x468fd8
call fcn.00423798
mov dword [ebx + 4], eax
mov byte [ebx + 0xc], 0
push 0
push 2
push 2
call sub.ws2_32.dll_socket_1
mov esi, eax
mov dword [ebx + 8], esi
cmp esi, 0xffffffff
jne 0x468dfa
mov ecx, 0x468e78
mov dl, 1
mov eax, dword [0x4087b4]
call fcn.0040e6d4
call fcn.00404a78
push 1
push 0x1a5a
mov eax, dword [ebx + 4]
push eax
mov eax, dword [ebx + 8]
push eax
call sub.ws2_32.dll_WSAAsyncSelect
test eax, eax
je 0x468e31
cmp word [ebx + 0x1a], 0
je 0x468e31
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 8]
call fcn.0040dd68
mov ecx, dword [ebp - 8]
mov edx, ebx
mov eax, dword [ebx + 0x1c]
call dword [ebx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468e4e
lea eax, [ebp - 8]
call fcn.00405104
ret

Function at 0x468ebc
Capabilities:
Print debug messages
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9a0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x660], edx
mov dword [ebp - 0x65c], edx
mov dword [ebp - 0x658], edx
mov esi, eax
xor eax, eax
push ebp
push 0x468fcb
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x640
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x654]
push eax
push 0
push ebx
lea eax, [ebp - 0x644]
push eax
mov eax, dword [esi + 8]
push eax
call sub.ws2_32.dll_recvfrom
mov ebx, eax
test ebx, ebx
jl 0x468f63
cmp word [esi + 0x12], 0
je 0x468fad
push dword [ebp - 0x650]
call sub.ws2_32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x658]
call fcn.004052fc
mov eax, dword [ebp - 0x658]
push eax
movzx eax, word [ebp - 0x652]
push eax
call sub.ws2_32.dll_ntohs
push eax
lea edx, [ebp - 0x644]
mov ecx, ebx
mov eax, dword [esi + 0x14]
call dword [esi + 0x10]
jmp 0x468fad
call sub.kernel32.dll_GetLastError_1
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x65c]
call fcn.00409d98
mov eax, dword [ebp - 0x65c]
call fcn.00405594
push eax
call sub.kernel32.dll_OutputDebugStringA
cmp word [esi + 0x1a], 0
je 0x468fad
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x660]
call fcn.0040dd68
mov ecx, dword [ebp - 0x660]
mov edx, esi
mov eax, dword [esi + 0x1c]
call dword [esi + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468fd2
lea eax, [ebp - 0x660]
mov edx, 3
call fcn.00405128
ret
Function at 0x46904c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 0xc]
call fcn.00405584
xor eax, eax
push ebp
push 0x4690bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x10], 2
movzx eax, word [ebp + 8]
push eax
call sub.ws2_32.dll_htons_1
mov word [ebp - 0xe], ax
mov eax, dword [ebp + 0xc]
call fcn.00405594
push eax
call sub.ws2_32.dll_inet_addr_1
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push esi
mov eax, dword [ebx + 8]
push eax
call sub.ws2_32.dll_sendto
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4690c6
lea eax, [ebp + 0xc]
call fcn.00405104
ret

Function at 0x4693e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405584
xor eax, eax
push ebp
push 0x46951a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
call fcn.00405104
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.00405594
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4694ff
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x18], 0x400
mov eax, dword [ebp - 0x18]
call fcn.00402f2c
mov esi, eax
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x18], 0x400
cmp byte [ebp + 8], 0
je 0x46947b
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push esi
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov ebx, eax
jmp 0x469494
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push esi
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
test ebx, ebx
jne 0x4694e7
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x18]
call fcn.00405824
lea eax, [ebp - 8]
call fcn.004055f4
mov edx, eax
mov eax, esi
mov ecx, dword [ebp - 0x18]
call fcn.00403128
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x4694cc
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00405158
jmp 0x4694e6
mov eax, dword [ebp - 0xc]
push dword [eax]
push 0x469538
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.00405498
inc edi
test ebx, ebx
je 0x469453
mov eax, esi
call fcn.00402f48
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469521
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405128
ret
Function at 0x46993c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x29c], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405584
xor eax, eax
push ebp
push 0x469a86
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x469a5e
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.0040a5e0
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x469a47
mov edx, dword [eax + 0xc]
test edx, edx
je 0x469a41
mov ebx, dword [edx]
test ebx, ebx
je 0x469a3b
lea eax, [ebp - 0x29c]
push eax
movzx eax, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
movzx eax, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
movzx eax, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
movzx eax, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x469aa0
call fcn.0040afec
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.00405158
mov byte [ebp - 5], 1
jmp 0x469a4b
mov byte [ebp - 5], 0
jmp 0x469a4b
mov byte [ebp - 5], 0
jmp 0x469a4b
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469a65
call sub.wsock32.dll_WSACleanup
ret

Function at 0x469e24
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 2
call sub.wsock32.dll_WSAStartup
add esp, 0x190
ret

Function at 0x469e44
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x408], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00405584
xor eax, eax
push ebp
push 0x469eef
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x404]
xor ecx, ecx
mov edx, 0x400
call fcn.004039f4
lea eax, [ebp - 0x408]
mov ecx, 0x469f08
mov edx, dword [ebp - 4]
call fcn.0040541c
mov edx, dword [ebp - 0x408]
lea eax, [ebp - 0x404]
call fcn.0040a5e0
lea eax, [ebp - 0x404]
call fcn.0040a4f4
mov esi, eax
push 0
push esi
lea eax, [ebp - 0x404]
push eax
push edi
call sub.wsock32.dll_send
cmp esi, eax
jne 0x469ece
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469ef6
lea eax, [ebp - 0x408]
call fcn.00405104
lea eax, [ebp - 4]
call fcn.00405104
ret

Function at 0x469f0c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x400
call fcn.004039f4
push 0
push 0x400
lea eax, [esp + 8]
push eax
push ebx
call sub.wsock32.dll_recv
mov edx, esi
mov eax, esp
call fcn.0040a760
add esp, 0x400
pop esi
pop ebx
ret
Function at 0x469f4c
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffaf0
mov dword [esp], edx
mov esi, eax
lea eax, [esp + 0xc]
call fcn.00468c40
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00468c30
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 0x7a120
xor ebx, ebx
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0
call sub.wsock32.dll_select
mov edi, eax
jmp 0x46a01d
lea eax, [esp + 0x110]
xor ecx, ecx
mov edx, 0x400
call fcn.004039f4
push 0
push 0x400
lea eax, [esp + 0x118]
push eax
push esi
call sub.wsock32.dll_recv
mov edi, eax
inc edi
jne 0x469fd2
mov eax, dword [esp]
call fcn.00405104
jmp 0x46a039
test bl, bl
jne 0x469fec
mov eax, dword [esp]
lea edx, [esp + 0x110]
mov ecx, 0x400
call fcn.00405374
mov bl, 1
lea eax, [esp + 0xc]
call fcn.00468c40
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00468c30
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x18]
push eax
push 0
call sub.wsock32.dll_select
mov edi, eax
test edi, edi
jne 0x46a01d
xor ebp, ebp
test edi, edi
jle 0x46a039
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00468c18
test al, al
je 0x46a039
cmp ebp, 1
je 0x469f9b
add esp, 0x510
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46a058
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Print debug messages
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405584
xor eax, eax
push ebp
push 0x46a13a
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x18], 2
push ebx
call sub.wsock32.dll_htons
mov word [ebp - 0x16], ax
mov eax, dword [ebp - 4]
call fcn.00405594
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x14], eax
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x46a0b7
xor ebx, ebx
jmp 0x46a11c
mov dword [ebp - 8], 0x1388
push 4
lea eax, [ebp - 8]
push eax
push 0x1005
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
push 4
lea eax, [ebp - 8]
push eax
push 0x1006
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
push 0x10
lea eax, [ebp - 0x18]
push eax
push ebx
call sub.wsock32.dll_connect
mov esi, eax
test esi, esi
je 0x46a11c
invalid
lea edx, [ebp - 0x1c]
mov eax, esi