joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
sub esp, 0x58
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
movzx eax, word [esi]
cmp ax, 0x2d
je 0x401044
cmp ax, 0x22
sete al
lea eax, [eax + eax + 0x20]
movsx cx, al
movzx ecx, cx
lea esp, [esp]
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
je 0x401044
cmp ax, cx
jne 0x401030
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push str.AIR.InstallerPackage
push 2
push 0
mov edi, eax
mov dword [esp + 0x24], 0
call ebx
cmp eax, 1
je 0x401080
pop edi
pop esi
mov eax, 0x3e80
pop ebx
add esp, 0x58
ret
mov eax, dword [esp + 0xc]
add eax, edi
lea ecx, [eax + eax + 2]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea edx, [esp + 0xc]
push edx
mov edi, eax
push edi
push 0
push str.AIR.InstallerPackage
push 2
push 0
call ebx
test eax, eax
je 0x4010bf
pop edi
pop esi
mov eax, 0x3e81
pop ebx
add esp, 0x58
ret
mov ecx, 0x10
lea eax, [esp + 0x10]
jmp 0x4010d0
mov byte [eax], 0
add eax, 1
sub ecx, 1
jne 0x4010d0
or eax, 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov ecx, 0x44
lea eax, [esp + 0x20]
nop
mov byte [eax], 0
add eax, 1
sub ecx, 1
jne 0x4010f0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], 0x44
mov word [edi + eax*2 - 2], 0x20
mov ecx, dword [esp + 0xc]
push esi
lea edx, [edi + ecx*2]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40114d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
add esp, 0x58
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x58
ret

Function at 0x401160
Capabilities:
Terminate process

Disassembly:
push esi
call section..text
mov esi, eax
test esi, esi
je 0x401181
mov eax, dword [section..data]
push 0x30
push str.Adobe_AIR
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x452f80
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x453144
pushal
mov esi, section..text
lea edi, [esi - 0x22000]
push edi
or ebp, 0xffffffff
jmp 0x452faa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x452fb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x452fa0
mov eax, 1
add ebx, ebx
jne 0x452fc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x452fb8
jne 0x452fd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x452fb8
xor ecx, ecx
sub eax, 3
jb 0x452fe8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45305a
mov ebp, eax
add ebx, ebx
jne 0x452ff3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x453000
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x453024
inc ecx
add ebx, ebx
jne 0x453010
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x453005
jne 0x453021
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x453005
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x453044
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x453035
jmp 0x452fa6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x453044
add edi, ecx
jmp 0x452fa6
pop esi
mov edi, esi
mov ecx, 0x6e2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x453062
cmp byte [edi], 6
jne 0x453062
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x453067
lea edi, [esi + 0x4f000]
mov eax, dword [edi]
or eax, eax
je 0x4530d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x53218]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x53284]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x453094
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x53288]
or eax, eax
je 0x4530d0
mov dword [ebx], eax
add ebx, 4
jmp 0x4530b1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x453107
cmp al, 0xef
ja 0x4530fa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4530dc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4530e9
mov ebp, dword [esi + 0x5328c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45313b
sub esp, 0xffffff80
jmp 0x41c474
Function at 0x4015d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
mov dword [ebp - 0x2c], 0
mov ecx, 9
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
push str.32770
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetClassInfoA]
mov dword [ebp - 8], 0x42af10
push 0x42af1c
push 0x42af24
call fcn.00402cfd
add esp, 8
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_RegisterClassA]
and eax, 0xffff
test eax, eax
jne 0x40162d
xor eax, eax
jmp 0x40166e
push 0
push 0x401673
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x65
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40166b
push 0x42af30
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x402cfd
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
jne 0x402d11
cmp dword [ebp + 0xc], 0
jne 0x402d11
jmp 0x402d78
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x402d78
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 4]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 8]
push edx
push 0x3e8
push 0
push 0
push 0
push 0x10
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x40359e
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov eax, 1
test eax, eax
je 0x4037a9
mov ecx, dword [ebp + 8]
and ecx, 0xffff
imul ecx, ecx, 0xb8
mov edx, dword [0x4477e4]
mov eax, dword [edx + ecx + 0x54]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4035df
jmp 0x4037a9
mov ecx, dword [ebp - 4]
add ecx, 0xa
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
mov ax, word [edx + 4]
mov word [ebp - 0x14], ax
push 0
mov ecx, dword [ebp - 0x14]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
and eax, 0xffff
imul eax, eax, 0xb8
mov ecx, dword [0x4477e4]
mov edx, dword [ecx + eax + 2]
push edx
call sub.WSOCK32.dll_send
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
and eax, 0xffff
cmp dword [ebp - 0x10], eax
jne 0x403707
mov ecx, dword [ebp + 8]
and ecx, 0xffff
imul ecx, ecx, 0xb8
mov edx, dword [0x4477e4]
mov eax, dword [edx + ecx + 0x54]
mov ecx, dword [ebp + 8]
and ecx, 0xffff
imul ecx, ecx, 0xb8
mov edx, dword [0x4477e4]
mov eax, dword [eax]
mov dword [edx + ecx + 0x54], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00415cd4
add esp, 4
mov edx, dword [ebp + 8]
and edx, 0xffff
imul edx, edx, 0xb8
mov eax, dword [0x4477e4]
xor ecx, ecx
mov cx, word [eax + edx + 0x70]
test ecx, ecx
je 0x4036ca
mov edx, dword [ebp + 8]
and edx, 0xffff
imul edx, edx, 0xb8
mov eax, dword [0x4477e4]
mov cx, word [eax + edx + 0x70]
sub cx, 1
mov edx, dword [ebp + 8]
and edx, 0xffff
imul edx, edx, 0xb8
mov eax, dword [0x4477e4]
mov word [eax + edx + 0x70], cx
mov ecx, dword [ebp + 8]
and ecx, 0xffff
imul ecx, ecx, 0xb8
mov edx, dword [0x4477e4]
cmp dword [edx + ecx + 0x54], 0
jne 0x403702
mov eax, dword [ebp + 8]
and eax, 0xffff
imul eax, eax, 0xb8
mov ecx, dword [0x4477e4]
mov dword [ecx + eax + 0x58], 0
jmp 0x4035ab
cmp dword [ebp - 0x10], 0
jle 0x403744
mov edx, dword [ebp - 0x14]
and edx, 0xffff
sub edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0xa
push ecx
call fcn.0041ad80
add esp, 0xc
mov edx, dword [ebp - 4]
mov ax, word [edx + 4]
sub ax, word [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov word [ecx + 4], ax
jmp 0x4037a9
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
and edx, 0xffff
imul edx, edx, 0xb8
mov eax, dword [0x4477e4]
mov cl, byte [eax + edx + 0x1c]
add cl, 1
mov edx, dword [ebp + 8]
and edx, 0xffff
imul edx, edx, 0xb8
mov eax, dword [0x4477e4]
mov byte [eax + edx + 0x1c], cl
cmp dword [ebp - 8], 0x2733
je 0x403791
cmp dword [ebp - 8], 0x2734
jne 0x403793
jmp 0x4037a9
mov ecx, dword [ebp - 8]
push ecx
push 0x42b400
mov dx, word [ebp + 8]
push edx
call fcn.00404ce9
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x405b8e
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0041b260
add esp, 0xc
mov word [ebp - 0x14], 2
mov ecx, dword [ebp + 8]
mov dx, word [ecx + 0xa]
mov word [ebp - 0x12], dx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 6]
mov dword [ebp - 0x10], ecx
push 0x10
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp + 0x10]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 2]
push eax
call sub.WSOCK32.dll_sendto
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
cmp dword [ebp - 4], ecx
je 0x405ca5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2733
je 0x405c7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2734
je 0x405c7b
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx]
push eax
mov ecx, dword [ebp + 8]
mov dx, word [ecx + 0xa]
push edx
call sub.WSOCK32.dll_ntohs
and eax, 0xffff
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 6]
push ecx
call fcn.00417663
add esp, 4
push eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x17]
xor ecx, ecx
mov cl, byte [eax]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x17]
xor ecx, ecx
mov cx, word [eax + 1]
push ecx
push str.Udp:_Send_fatal_error__MOD__d__POST__d__ip__s__Port__d__index__d_
push 0xc9
push 0x42b900
mov edx, dword [0x437d14]
push edx
call fcn.0040c291
add esp, 0x24
mov eax, dword [ebp + 8]
mov word [eax + 0x7c], 1
jmp 0x405ca5
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x1c]
add dl, 1
mov eax, dword [ebp + 8]
mov byte [eax + 0x1c], dl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x42b91c
mov ecx, dword [ebp + 8]
mov dx, word [ecx]
push edx
call fcn.00404ba1
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x40b3e8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
and eax, 0xffff
imul eax, eax, 0xb8
mov ecx, dword [0x4477e4]
mov byte [ecx + eax + 0x1d], 0
mov edx, dword [ebp + 8]
and edx, 0xffff
imul edx, edx, 0xb8
mov eax, dword [0x4477e4]
mov ecx, dword [eax + edx + 0x4d]
add ecx, 2
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
and edx, 0xffff
imul edx, edx, 0xb8
mov eax, dword [0x4477e4]
mov ecx, dword [eax + edx + 0x4d]
xor edx, edx
mov dx, word [ecx]
mov dword [ebp - 0x10], edx
push 0
mov eax, 0x2030
sub eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
and edx, 0xffff
imul edx, edx, 0xb8
mov eax, dword [0x4477e4]
mov ecx, dword [eax + edx + 2]
push ecx
call sub.WSOCK32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x40b502
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x2746
je 0x40b49c
cmp dword [ebp - 4], 0x2745
jne 0x40b4b4
mov edx, dword [ebp - 4]
push edx
push 0x42d310
mov ax, word [ebp + 8]
push eax
call fcn.00404ce9
add esp, 0xc
jmp 0x40b4fd
mov ecx, dword [ebp - 4]
push ecx
push 0x42d32c
mov dx, word [ebp + 8]
push edx
call fcn.00404ba1
add esp, 0xc
mov eax, dword [ebp + 8]
and eax, 0xffff
imul eax, eax, 0xb8
mov ecx, dword [0x4477e4]
mov dl, byte [ecx + eax + 0x1b]
add dl, 1
mov eax, dword [ebp + 8]
and eax, 0xffff
imul eax, eax, 0xb8
mov ecx, dword [0x4477e4]
mov byte [ecx + eax + 0x1b], dl
jmp 0x40b5a9
cmp dword [ebp - 8], 0
jne 0x40b54f
push 0
push str.Received_0bytes_data_from_tcp
mov dx, word [ebp + 8]
push edx
call fcn.00404ba1
add esp, 0xc
mov eax, dword [ebp + 8]
and eax, 0xffff
imul eax, eax, 0xb8
mov ecx, dword [0x4477e4]
mov dl, byte [ecx + eax + 0x1b]
add dl, 1
mov eax, dword [ebp + 8]
and eax, 0xffff
imul eax, eax, 0xb8
mov ecx, dword [0x4477e4]
mov byte [ecx + eax + 0x1b], dl
mov edx, dword [ebp + 8]
and edx, 0xffff
imul edx, edx, 0xb8
mov eax, dword [0x4477e4]
mov ecx, dword [eax + edx + 0x4d]
mov dx, word [ecx]
add dx, word [ebp - 8]
mov eax, dword [ebp + 8]
and eax, 0xffff
imul eax, eax, 0xb8
mov ecx, dword [0x4477e4]
mov eax, dword [ecx + eax + 0x4d]
mov word [eax], dx
mov ecx, dword [ebp + 8]
and ecx, 0xffff
imul ecx, ecx, 0xb8
mov edx, dword [0x4477e4]
add edx, ecx
push edx
call fcn.0040415c
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4136d8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0x444178
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.FILE:_s_LINE:_d_STOP_SYS__name___s_
push 0xf06
push 0x4378d4
mov edx, dword [0x437d14]
push edx
call fcn.0040c291
add esp, 0x1c
cmp dword [0x447d1c], 0
je 0x413739
xor eax, eax
mov ax, word [0x444232]
cmp eax, 0x64
jge 0x413739
xor ecx, ecx
mov cx, word [0x444232]
imul ecx, ecx, 0x4c7
mov edx, dword [0x447d1c]
mov byte [edx + ecx + 0xbb], 0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x413ed4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 8], eax
push 0x4c7
mov ecx, dword [ebp + 8]
push ecx
push 0x444170
call fcn.0041ad80
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x413f4c
push 0x4461c0
mov edx, dword [ebp + 0xc]
push edx
call fcn.0041bc90
add esp, 8
test eax, eax
je 0x413f4c
push 0x21
push 0
push 0x444178
call fcn.0041b260
add esp, 0xc
push 0x20
mov eax, dword [ebp + 0xc]
push eax
push 0x444178
call fcn.0041baf0
add esp, 0xc
jmp 0x413f8f
mov ecx, 0x444178
test ecx, ecx
je 0x413f6b
push 0x4461c4
push 0x444178
call fcn.0041bc90
add esp, 8
test eax, eax
jne 0x413f8f
push 0x21
push 0
push 0x444178
call fcn.0041b260
add esp, 0xc
push 0x20
push 0x444178
mov edx, dword [ebp - 8]
push edx
call fcn.00413da9
add esp, 0xc
mov eax, 0x444178
test eax, eax
je 0x413fae
push 0x4461c8
push 0x444178
call fcn.0041bc90
add esp, 8
test eax, eax
jne 0x413fb5
xor al, al
jmp 0x4140ef
call fcn.0040c268
test eax, eax
jne 0x413fc5
xor al, al
jmp 0x4140ef
call fcn.00415f00
and eax, 0xff
test eax, eax
jne 0x413ffd
push str.Can_not_init_env_param_list
push 0x1028
push 0x437a18
mov ecx, dword [0x437d14]
push ecx
call fcn.0040c291
add esp, 0x10
call fcn.0040c27f
xor al, al
jmp 0x4140ef
mov dword [0x4446fc], 0x52872134
mov word [0x4446fa], 0
push str.zxcomm
push 0x444640
call fcn.0041b0c0
add esp, 8
push 0x437a3c
push 0x444661
call fcn.0041b0c0
add esp, 8
push 0x437a48
push 0x444682
call fcn.0041b0c0
add esp, 8
push 0x448220
call fcn.00415be7
add esp, 4
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0040e5a6
add esp, 8
and eax, 0xff
test eax, eax
jne 0x414070
xor al, al
jmp 0x4140ef
mov ecx, dword [0x4442c3]
push ecx
call fcn.0040ff67
add esp, 4
xor edx, edx
mov dx, word [0x447b8f]
xor eax, eax
mov ax, word [0x447b83]
lea ecx, [eax + edx*2]
xor edx, edx
mov dx, word [0x447b87]
add ecx, edx
xor eax, eax
mov ax, word [0x447b85]
lea ecx, [ecx + eax + 1]
push ecx
push 0
call fcn.0041773d
add esp, 8
test eax, eax
jne 0x4140db
push str.create_Comm_Hash_Table_fail_
push 0x103f
push 0x437a70
mov edx, dword [0x437d14]
push edx
call fcn.0040c291
add esp, 0x10
xor al, al
jmp 0x4140ef
push 0x3f2
call fcn.00413743
add esp, 4
call fcn.00413ec4
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x415ceb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x415d20
cmp dword [ebp + 0x18], 0
je 0x415d20
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
cmp dword [ebp - 4], 0
jne 0x415d2a
xor al, al
jmp 0x415d2c
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x415d30
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 1
cmp dword [ebp + 8], 0
je 0x415d52
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4189aa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 4
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push 0x4385dc
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4189e6
xor eax, eax
jmp 0x418a65
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push 0x438614
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x418a10
cmp dword [ebp - 0xc], 1
je 0x418a1e
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x418a65
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push str.CtlIpaddress
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x418a50
xor eax, eax
jmp 0x418a65
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call sub.WSOCK32.dll_ntohl
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x418a69
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 4
mov dword [ebp - 8], 4
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push 0
push 0x438630
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x418aac
xor eax, eax
jmp 0x418b25
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push 0x438668
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x418ad6
cmp dword [ebp - 0x14], 1
je 0x418ae4
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x418b25
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push str.CtlPortbase
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
je 0x418b16
xor eax, eax
jmp 0x418b25
mov eax, dword [ebp + 8]
mov cx, word [ebp - 0xc]
mov word [eax], cx
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x418b29
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 4
mov dword [ebp - 8], 4
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push 0
push 0x438680
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x418b6c
xor eax, eax
jmp 0x418be5
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push 0x4386b8
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x418b96
cmp dword [ebp - 0x14], 1
je 0x418ba4
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x418be5
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push str.MediaPortbase
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
je 0x418bd6
xor eax, eax
jmp 0x418be5
mov eax, dword [ebp + 8]
mov cx, word [ebp - 0xc]
mov word [eax], cx
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x418c54
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 4
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesNetUcardParameters
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x418c93
xor eax, eax
jmp 0x418d2e
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push str.IsIPValid
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x418cbd
cmp dword [ebp - 0xc], 1
je 0x418ccb
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x418d2e
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push str.MediaIpaddress
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x418cfd
xor eax, eax
jmp 0x418d2e
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x418d19
mov ecx, dword [ebp + 8]
push ecx
call fcn.004189aa
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x418d2e
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call sub.WSOCK32.dll_ntohl
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, 1
mov esp, ebp
pop ebp
ret