joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404720
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0x81c
push ebx
push esi
push edi
push 0x410394
call fcn.004055b0
add esp, 4
test eax, eax
jne 0x404749
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x81c
ret 0x10
call dword [0x40e178]
cmp al, 4
jbe 0x4047ce
lea eax, [esp + 0x10]
push eax
push str.SystemCurrentControlSetControlProductOptions
push 0x80000002
call dword [section..rdata]
test eax, eax
jne 0x4047ce
lea ecx, [esp + 0x1c]
mov word [esp + 0x28], ax
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push edx
push eax
push 0
push str.ProductType
push ecx
mov dword [esp + 0x34], 0x800
call dword [0x40e054]
lea edx, [esp + 0x28]
push str.LanmanNT
push edx
call fcn.004061f3
add esp, 8
test eax, eax
jne 0x4047c3
push 0x10
push 0x410394
push str.SID_changing_is_not_supported_on_Domain_Controllers.
push eax
call dword [0x40e2ec]
mov eax, dword [esp + 0x10]
push eax
call dword [0x40e070]
lea ecx, [esp + 0x14]
push ecx
push 0x20
call dword [0x40e1a4]
push eax
call dword [0x40e030]
test eax, eax
jne 0x404804
push str.NewSID_was_unable_to_obtain_necessary_privilege_to_change_the_computer_SID
call fcn.00402840
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x81c
ret 0x10
mov ebx, dword [0x40e02c]
mov dword [esp + 0x28], 0
mov edi, 0x41021c
lea esi, [esp + 0x34]
mov ecx, dword [esp + 0x28]
mov eax, dword [edi]
lea edx, [esi - 8]
inc ecx
push edx
push eax
push 0
mov dword [esp + 0x34], ecx
call ebx
test eax, eax
je 0x404881
mov dword [esi], 2
add edi, 4
add esi, 0xc
cmp edi, 0x410234
jb 0x40481b
mov edx, dword [esp + 0x14]
push 0
push 0
lea ecx, [esp + 0x30]
push 0
push ecx
push 0
push edx
call dword [0x40e034]
test eax, eax
jne 0x40489c
push str.NewSID_was_unable_to_obtain_necessary_privilege_to_change_the_computer_SID
call fcn.00402840
add esp, 4
mov eax, 2
pop edi
pop esi
pop ebx
add esp, 0x81c
ret 0x10
push str.NewSID_was_unable_to_obtain_necessary_privilege_to_change_the_computer_SID
call fcn.00402840
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x81c
ret 0x10
call dword [0x40e0b4]
mov eax, dword [esp + 0x82c]
lea ecx, [esp + 0x20]
push ecx
mov dword [0x42c4e0], eax
call dword [0x40e17c]
push eax
call dword [0x40e234]
lea edx, [esp + 0x18]
lea ecx, [esp + 0xe]
push edx
lea edx, [esp + 0x13]
push ecx
push edx
push eax
mov eax, dword [esp + 0x30]
push eax
call fcn.004045b0
add esp, 0x14
test al, al
jne 0x4048f2
pop edi
pop esi
mov eax, 3
pop ebx
add esp, 0x81c
ret 0x10
mov al, byte [esp + 0xf]
test al, al
je 0x40495c
call fcn.004031e0
test eax, eax
mov dword [0x42c4dc], eax
jne 0x404919
pop edi
pop esi
mov eax, 4
pop ebx
add esp, 0x81c
ret 0x10
push 0
call fcn.004036c0
push 0
call fcn.004034a0
mov al, byte [esp + 0x16]
add esp, 8
test al, al
jne 0x404961
mov eax, dword [esp + 0x18]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
shl ecx, 3
push ecx
call dword [0x40e1bc]
call fcn.00402ca0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x81c
ret 0x10
call fcn.00404470
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x81c
ret 0x10
Function at 0x105aebf0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x105aed52
cmp edi, esi
je 0x105aed52
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x105aed42
add edi, 4
jmp 0x105aeca3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x105aecb8
mov dword [ebp - 4], 2
jmp 0x105aecd9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x105aeccf
mov dword [ebp - 4], 1
jmp 0x105aecd9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x105aed52
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x105aed10
mov byte [ecx + 2], 0x3d
jmp 0x105aed1d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x105aed2c
mov byte [ecx], 0x3d
jmp 0x105aed32
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x105aeca0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10648129
Capabilities:
Packed with generic packer

Disassembly:
cmp esi, ebx
js 0x107a61c4
mov eax, dword [esi]
mov cl, byte [esi + 4]
btc edx, 0xfd
mov edx, 0x7fd051bc
clc
sub esi, 2
adc edx, ebp
shr eax, cl
mov dword [esi + 4], eax
cwd
mov dl, bh
movzx dx, al
pushfd
pop dword [esi]
rol dh, 0x37
sub edi, 4
mov dx, 0x7686
cmovnp edx, edx
sar dx, cl
mov edx, dword [edi]
cmc
jmp 0x107f1929
neg edx
clc
test bx, sp
sub edx, 0x40eb4a02
bswap edx
ror edx, 1
stc
cmp si, 0x5f00
sub edx, 0x3f0263ca
neg edx
cmp dx, 0x51ae
stc
xor ebx, edx
cmp esp, eax
cmc
add ebp, edx
jmp 0x1068e7db
jmp fcn.107a9643
lea edx, [edx - 0x24222238]
jmp 0x106574a5
cmp esi, 0x79864a68
mov esi, dword [esp + 0xc]
call fcn.1075d699
call fcn.1081dec4
syscall
inc ecx
push esp
call fcn.106de633
xor edx, ebx
jmp 0x1075d6ea
Function at 0x106cb961
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push dword [ebp - 0x18]
jmp 0x108def4f
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
jmp 0x10703649
jmp 0x107f0c12
rep stosd dword es:[edi], eax
and al, 0x1d
bt eax, 0x98
mov eax, dword [0x1055789c]
xor eax, ebp
clc
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x576570
test cx, bp
mov dword [ebp - 0x18], 0x22b69a0
stc
test bh, bl
pushal
rol al, cl
shr bl, 0xb4
adc ah, 0x4c
push dword [ebp + 8]
bswap ax
push 0xff000000
cmc
and bx, si
mov ax, dx
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
mov eax, dword [ebp + 0x10]
lea eax, [eax + 1]
push eax
btc bx, 0xb
and bh, al
rcr bh, cl
mov ebx, dword [ebp + 0xc]
clc
add ebx, 1
jmp 0x1064c742
push dword [ebp + 0xc]
jmp 0x108eb663
push dword [ebp + 0x14]
jmp 0x107f2301
push ebp
not cl
mov ebp, esp
btc eax, 0xb5
ror cl, 0xcb
stc
sub esp, 0xdc
cmovs ax, si
push ebx
mov ax, 0x77da
xchg cl, al
push esi
setne ch
cbw
push edi
not ah
lea edi, [ebp - 0x1c]
lahf
mov ecx, 7
movsx eax, cx
mov eax, 0xcccccccc
jmp 0x106e80cd
push dword [ebp + 0x18]
jmp 0x106c2143
call dword [ebp - 0xc]
push dword [ebp + 8]
jmp 0x10739ff8
push dword [ebp - 0x18]
jmp 0x108fa532

Function at 0x10855ee8
Capabilities:
Packed with generic packer

Disassembly:
rep stosd dword es:[edi], eax
bts eax, edi
mov eax, dword [0x1055789c]
cmp dx, 0x477
xor eax, ebp
jmp 0x108a398c
push eax
jmp 0x109053ef
jmp 0x108e865e
mov dword [ebp - 4], eax
seto ah
mov byte [ebp - 0x108], 1
mov byte [ebp - 0x107], 0x11
push 0xfd
setg ah
push 0
movzx eax, bp
cmovne ax, sp
lea eax, [ebp - 0x106]
jmp 0x1071faa0
mov byte [ebp + ebx - 0x105], al
inc ebx
jmp loc.100143ba
push ebp
sub cl, 0x8d
neg al
mov ebp, esp
or ax, si
and eax, eax
adc cx, bp
sub esp, 0x1d8
movsx eax, sp
push ebx
xchg cl, ah
push esi
cbw
push edi
movsx eax, bx
lea edi, [ebp - 0x118]
mov ecx, 0x46
mov eax, 0xcccccccc
jmp 0x105b88ae
call fcn.10071ced
add esp, 0xc
jmp 0x10911a3a
mov dword [ebp - 0x114], 0x5ea9f0
pushal
not bl
mov ebx, 0
mov cl, 0
not dh
mov edx, dword [ebp + 0xc]
xchg al, al
mov al, byte [edx + ebx]
jmp 0x108a8a89

Function at 0x10893047
Capabilities:
Execute anti-debugging instructions

Disassembly:
not eax
jmp 0x107a8252
inc eax
xor ebx, eax
cmp esi, 0x69f123b1
add esi, eax
jmp 0x10853472
jmp esi
push eax
movsx eax, si
xchg ah, al
cmova ax, bx
push edx
push ebx
cwd
push ecx
movsx eax, dx
mov dh, 0x94
cmovl ebx, ecx
push ebp
setp bl
not edx
push esi
cwd
pushfd
push edi
cbw
mov ecx, 0
cdq
push ecx
cwde
not dh
lahf
mov ebp, dword [esp + 0x28]
rdtsc
cmovge dx, bp
not ebp
rdtsc
jmp 0x108a4e02
inc ebp
movsx edi, di
sbb dh, 0x17
clc
xor ebp, 0x597d29b8
rcr di, 0x83
lea ebp, [ebp + 0x19442e89]
lea ebp, [ebp + ecx]
btc di, bp
mov edi, esp
bt esi, 0x99
movsx eax, si
sub esp, 0xc0
cmp ecx, esi
rcl al, 0xdc
mov ebx, ebp
shld si, bp, 0x48
mov edx, 0
cmc
shr eax, cl
stc
sub ebx, edx
lea esi, [0x108a4e48]
mov eax, dword [ebp]
cmp ebx, 0x29a47890
cmc
add ebp, 4
clc
cmp dh, bh
cmc
xor eax, ebx
test cl, al
test si, 0x53a9
sub eax, 0x56347934
rol eax, 1
jmp 0x106eb65b
Function at 0x10b77af5
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp esi
not eax
jmp 0x10b6c8c9
inc eax
xor ebx, eax
cmp esi, 0x69f123b1
add esi, eax
jmp 0x1093c305
push eax
movsx eax, si
xchg ah, al
cmova ax, bx
push edx
push ebx
cwd
push ecx
movsx eax, dx
mov dh, 0x94
cmovl ebx, ecx
push ebp
setp bl
not edx
push esi
cwd
pushfd
push edi
cbw
mov ecx, 0
cdq
push ecx
cwde
not dh
lahf
mov ebp, dword [esp + 0x28]
rdtsc
cmovge dx, bp
not ebp
rdtsc
jmp 0x10bbf329
inc ebp
movsx edi, di
sbb dh, 0x17
clc
xor ebp, 0x597d29b8
rcr di, 0x83
lea ebp, [ebp + 0x19442e89]
lea ebp, [ebp + ecx]
btc di, bp
mov edi, esp
bt esi, 0x99
movsx eax, si
sub esp, 0xc0
cmp ecx, esi
rcl al, 0xdc
mov ebx, ebp
shld si, bp, 0x48
mov edx, 0
cmc
shr eax, cl
stc
sub ebx, edx
lea esi, [0x10bbf36f]
mov eax, dword [ebp]
cmp ebx, 0x29a47890
cmc
add ebp, 4
clc
cmp dh, bh
cmc
xor eax, ebx
test cl, al
test si, 0x53a9
sub eax, 0x56347934
rol eax, 1
jmp 0x10a38a8a
Function at 0x401fdf
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x404ad4]
push ebx
push esi
push edi
push 0x28
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x404920
mov edi, 0x4048e0
push 0x64
push eax
call esi
push 0x28
mov eax, dword [0x404ad4]
push edi
mov ebx, 0x404950
push 0x3ef
push eax
call esi
push 0xd
mov eax, dword [0x404ad4]
push ebx
push 0x3e9
push eax
call esi
push 0x16
mov eax, dword [0x404ad4]
push 0x404900
push 0x3ea
push eax
call esi
push 0xd
mov eax, dword [0x404ad4]
push 0x4048c0
push 0x3f1
push eax
call esi
push 0xff
mov eax, dword [0x404ad4]
push 0x404960
push 0x3f0
push eax
call esi
push ebx
push 1
push str.Clear_Screen
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x404888], eax
test eax, eax
je 0x40208a
mov dword [0x404888], 1
mov esi, 0x4047c0
mov edi, 0x4048e0
mov word [ebp - 2], 0
movzx eax, word [ebp - 2]
inc eax
push eax
mov dword [ebp - 8], eax
push 0x401040
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
movzx edx, word [ebp - 2]
shl edx, 2
add esp, 0xc
mov dword [ebp - 0xc], edx
lea ebx, [edx + 0x4043d8]
push 0x404950
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebx], eax
test eax, eax
je 0x4020dd
mov dword [ebx], 1
push dword [ebp - 8]
push 0x401030
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ebx, dword [ebp - 0xc]
add ebx, 0x4047a8
push 0x404950
push 1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebx], eax
test eax, eax
je 0x402113
mov dword [ebx], 1
push dword [ebp - 8]
push 0x401028
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
movzx eax, word [ebp - 2]
add esp, 0xc
lea ebx, [eax*2 + 0x4048ac]
push 0x404950
push 5
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov word [ebx], ax
cmp ax, 1
jae 0x40214d
mov word [ebx], 1
cmp word [ebx], 0xf
jbe 0x402158
mov word [ebx], 0xf
push dword [ebp - 8]
push 0x401018
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push esi
push edi
call fcn.00402485
push dword [ebp - 8]
push section..text
mov ecx, dword [ebp - 0xc]
push esi
mov dword [ecx + 0x404898], eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0xffffff
push esi
push edi
call fcn.00402485
inc word [ebp - 2]
mov ecx, dword [ebp - 0xc]
cmp word [ebp - 2], 2
mov dword [ecx + 0x404890], eax
jb 0x40209a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4021b9
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push ebp
push dword [esp + 0x18]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
movzx ecx, word [esp + 0x20]
mov edi, eax
push 0
movzx eax, word [esp + 0x20]
imul eax, eax, 0xf
lea ebx, [eax + ecx]
xor bp, bp
mov eax, ebx
shl eax, 5
push dword [eax + 0x4043e4]
push dword [eax + 0x4043e0]
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
movzx eax, bp
inc bp
inc eax
cdq
xor eax, edx
sub eax, edx
and eax, 3
xor eax, edx
sub eax, edx
lea eax, [eax + ebx*4]
shl eax, 3
push dword [eax + 0x4043e4]
push dword [eax + 0x4043e0]
push esi
call dword [sym.imp.GDI32.dll_LineTo]
cmp bp, 4
jb 0x4021fb
test edi, edi
je 0x402238
push edi
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
pop ebp
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x40223f
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
xor bx, bx
push edi
push ebp
xor edi, edi
lea ecx, [ebx*8]
mov esi, dword [esp + 0x14]
inc bx
mov eax, dword [esp + 0x18]
shr esi, cl
and esi, 0xff
mov ebp, 0xa
shr eax, cl
and eax, 0xff
sub eax, esi
imul eax, eax, 0xa
cdq
idiv dword [esp + 0x1c]
imul eax, dword [esp + 0x20]
cdq
idiv ebp
add eax, esi
shl eax, cl
add edi, eax
cmp bx, 3
jb 0x402248
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x402485
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
lea eax, [ebp - 0x54]
push esi
push 0x404950
push 0x50
push eax
push 0x401054
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x54], 0
je 0x402524
lea esi, [ebp - 0x54]
push esi
call fcn.0040252f
cmp byte [ebp - 0x54], 0
mov word [ebp - 2], ax
je 0x4024cd
cmp byte [esi], 0x20
je 0x4024cd
inc esi
cmp byte [esi], 0
jne 0x4024c2
cmp byte [esi], 0
je 0x4024dd
cmp byte [esi], 0x20
jne 0x4024dd
inc esi
cmp byte [esi], 0
jne 0x4024d2
push esi
call fcn.0040252f
mov bx, ax
cmp byte [esi], 0
je 0x402506
cmp byte [esi], 0x20
je 0x4024f6
inc esi
cmp byte [esi], 0
jne 0x4024eb
cmp byte [esi], 0
je 0x402506
cmp byte [esi], 0x20
jne 0x402506
inc esi
cmp byte [esi], 0
jne 0x4024fb
push esi
call fcn.0040252f
movzx ecx, bl
movzx eax, al
movzx edx, byte [ebp - 2]
shl ecx, 8
shl eax, 0x10
or ecx, eax
or ecx, edx
mov eax, ecx
jmp 0x402527
mov eax, dword [ebp + 0x10]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4027a3
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
sub esp, 8
cmp dword [0x404adc], ecx
jne 0x402953
cmp dword [0x404ae0], ecx
jne 0x402953
mov eax, dword [ebp + 0xc]
cmp eax, 0x10
je 0x40291e
cmp eax, 0x8000
je 0x40293c
cmp dword [0x404ae4], ecx
jne 0x402953
cmp eax, 0x1c
ja 0x4027fb
je 0x402877
cmp eax, 0x18
je 0x402860
jmp 0x402953
cmp eax, 0x48
ja 0x402814
je 0x4028a7
cmp eax, 0x20
je 0x402895
jmp 0x402953
cmp eax, 0x104
ja 0x402829
je 0x402881
cmp eax, 0x100
je 0x402881
jmp 0x402953
cmp eax, 0x200
je 0x4028ad
cmp eax, 0x201
je 0x402881
cmp eax, 0x204
je 0x402881
cmp eax, 0x207
je 0x402881
cmp eax, 0x218
je 0x402901
cmp eax, 0x282
je 0x402914
jmp 0x402953
cmp dword [ebp + 0x10], 0
je 0x402953
push 0
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x402953
cmp dword [ebp + 0x10], 0
jne 0x402953
push 0
push 0
push 0x10
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x402953
push 0
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
jmp 0x402990
cmp dword [ebp + 0x10], 3
jmp 0x40287b
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 8]
sub eax, dword [0x4048d0]
je 0x4028c6
jge 0x4028c6
neg eax
mov ecx, dword [ebp - 4]
sub ecx, dword [0x4048d4]
je 0x4028d5
jge 0x4028d5
neg ecx
add eax, ecx
cmp eax, dword [0x404b04]
jbe 0x402953
push 0
push 0
push 0x10
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [0x4048d0], eax
mov dword [0x4048d4], ecx
jmp 0x402953
mov eax, dword [ebp + 0x10]
cmp eax, 6
jb 0x402953
cmp eax, 8
jbe 0x402881
jmp 0x402953
cmp dword [ebp + 0x10], 2
jne 0x402953
xor eax, eax
jmp 0x402990
push dword [ebp + 8]
call fcn.00402e8c
add esp, 4
test eax, eax
jne 0x402953
push 0x4048d0
call dword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
jmp 0x402990
mov eax, dword [0x404aec]
test eax, eax
je 0x40294c
push dword [ebp + 8]
call eax
jmp 0x402990
mov eax, 1
jmp 0x402990
mov eax, dword [ebp + 0xc]
cmp dword [0x404af4], eax
jne 0x40297e
xor eax, eax
cmp dword [ebp + 0xc], eax
je 0x40297e
push eax
push eax
push 0x10
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [0x404aec], 1
sbb eax, eax
inc eax
jmp 0x402990
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402e8c
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
xor esi, esi
cmp dword [0x404ae4], esi
jne 0x402f73
cmp dword [0x404ae0], esi
jne 0x402f73
cmp dword [0x404aec], esi
je 0x402f62
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov ebx, dword [0x404b08]
cmp ebx, esi
je 0x402ee1
push edi
mov eax, dword [0x404b0c]
push eax
call fcn.00402f7c
add esp, 8
cmp eax, ebx
jb 0x402f62
mov eax, dword [0x404b10]
cmp eax, 0xffffffff
je 0x402efc
push edi
push eax
call fcn.00402f7c
add esp, 8
cmp eax, 0xc8
jb 0x402f6c
push 3
mov esi, 0x113
mov edi, dword [esp + 0x30]
push esi
lea eax, [esp + 0x14]
push esi
mov dword [0x404ae4], 1
push edi
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
lea eax, [esp + 0xc]
push 3
push esi
push esi
push edi
xor esi, esi
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
push esi
push esi
push 0x8000
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x404ae0], eax
mov dword [0x404ae4], esi
test eax, eax
jne 0x402f55
push esi
call dword [sym.imp.USER32.dll_SetCursor]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x404b10], eax
jmp 0x402f6c
mov dword [0x404ae0], 1
mov eax, dword [0x404ae0]
jmp 0x402f75
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x402f89
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [eax]
cmp al, 0x22
jne 0x402fb9
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
mov al, byte [eax]
test al, al
je 0x402fb1
cmp al, 0x22
jne 0x402f9e
cmp byte [esi], 0x22
jne 0x402fcb
inc esi
jmp 0x402fcb
cmp al, 0x20
jbe 0x402fcb
push esi
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], 0x20
mov esi, eax
ja 0x402fbd
cmp byte [esi], 0
je 0x402fe3
cmp byte [esi], 0x20
ja 0x402fe3
push esi
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], 0
mov esi, eax
jne 0x402fd0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
mov eax, 0xa
je 0x403003
movzx eax, word [ebp - 0x14]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4186d0
Capabilities:
Get socket status

Disassembly:
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x340
mov eax, dword [0x8670cc]
test eax, eax
je 0x4186f7
mov dword [esp], 0
call eax
test eax, eax
jne 0x418830
mov eax, dword [0x6a60e4]
mov edx, dword [ebx]
lea eax, [eax + eax*4]
cmp edx, eax
ja 0x418815
cmp edx, 4
jle 0x4187b0
mov dword [esp + 0x338], 1
mov dword [esp + 0x33c], 0
test esi, esi
je 0x4187e4
mov eax, dword [esi + 4]
lea edi, [esp + 0x130]
mov ecx, 0x41
mov dword [esp + 0x2c], 1
lea esi, [esp + 0x2c]
lea edx, [esp + 0x338]
mov dword [esp + 0x30], eax
add eax, 1
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x234]
lea esi, [esp + 0x2c]
mov cl, 0x41
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x10], edx
lea edx, [esp + 0x234]
mov dword [esp + 0xc], edx
lea edx, [esp + 0x130]
mov dword [esp + 8], edx
lea edx, [esp + 0x2c]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_select]
sub esp, 0x14
test eax, eax
mov edx, dword [ebx]
jle 0x4187d0
add edx, 1
mov dword [ebx], edx
add esp, 0x340
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0x338], 0
mov dword [esp + 0x33c], 0x30d40
jmp 0x418728
cmp edx, 4
jle 0x41879e
add edx, 5
mov dword [ebx], edx
add esp, 0x340
pop ebx
pop esi
pop edi
ret
lea eax, [esp + 0x338]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00456290
jmp 0x418798
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 0x8a
mov eax, 0xffffffff
jmp 0x4187a3
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 4
mov eax, 0xffffffff
jmp 0x4187a3

Function at 0x419280
Capabilities:
Create thread

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x3c
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebp
sub esp, 0x10
mov dword [edi], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebp
sub esp, 0x10
mov dword [edi + 4], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebp
sub esp, 0x10
mov dword [edi + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebp
sub esp, 0x10
mov dword [edi + 0xc], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebp
sub esp, 0x10
mov dword [edi + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebp
sub esp, 0x10
mov dword [edi + 0x14], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebp
sub esp, 0x10
mov dword [edi + 0x18], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x20], 1
sub esp, 0x18
mov dword [edi + 0x1c], eax
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42d7c0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, edx
sub esp, 0x18
mov dword [esp + 4], eax
mov eax, dword [0x6a6410]
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll__read_1
test eax, eax
js 0x42d7e8
cmp ebx, eax
jg 0x42d7f5
add esp, 0x18
pop ebx
ret
mov eax, dword [0x8506cc]
mov dword [esp], eax
call fcn.0059a440
mov dword [esp], str.Premature_end_of_file_while_reading_trace_file
call fcn.0059a2d0
jmp fcn.0042d810