joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a490
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x23c
xor eax, eax
push ebx
mov dword [esp + 9], eax
push esi
mov dword [esp + 0x11], eax
push edi
mov dword [esp + 0x19], eax
mov ecx, 4
mov word [esp + 0x1d], ax
lea edi, [esp + 0x10]
mov esi, 0x428478
xor edx, edx
mov byte [esp + 0x10], 0
mov byte [esp + 0x1f], al
repe cmpsd dword [esi], dword es:[edi]
jne 0x40a4eb
push 1
push edx
push 0x6b
call fcn.004047d0
add esp, 4
push eax
call fcn.00409af0
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
add esp, 0x23c
ret
mov edi, 0x428508
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40a508
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x23c
ret
xor eax, eax
mov ecx, 0x49
lea edi, [esp + 0x24]
mov dword [esp + 0x20], 0
push eax
push 2
rep stosd dword es:[edi], eax
mov byte [esp + 0x17], 0
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40a53d
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x23c
ret
lea eax, [esp + 0x20]
push ebp
push eax
push ebx
mov dword [esp + 0x2c], pe_nt_image_headers32
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x40a5d2
mov edi, dword [sym.imp.MSVCRT.dll_strncpy]
mov esi, dword [sym.imp.MSVCRT.dll__strlwr]
mov ebp, dword [sym.imp.MSVCRT.dll_strstr]
lea ecx, [esp + 0x48]
push 0xff
lea edx, [esp + 0x150]
push ecx
push edx
call edi
push 0x428508
call esi
lea eax, [esp + 0x15c]
push eax
call esi
lea ecx, [esp + 0x160]
push ecx
push 0x428508
call ebp
add esp, 0x1c
test eax, eax
je 0x40a5bc
test byte [0x42868c], 8
je 0x40a5cd
mov edx, dword [esp + 0x2c]
push edx
call fcn.0040a470
add esp, 4
test al, al
jne 0x40a5cd
lea eax, [esp + 0x24]
push eax
push ebx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
je 0x40a5d2
jmp 0x40a567
mov byte [esp + 0x13], 1
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov bl, byte [esp + 0x13]
pop ebp
test bl, bl
jne 0x40a603
mov edi, 0x428588
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40a603
push 1
push eax
push 0x428588
call fcn.00409af0
add esp, 0xc
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0x23c
ret
Function at 0x40a6c0
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
push str.Ndisrd
call fcn.00404f10
mov edi, dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
add esp, 4
test eax, eax
je 0x40a6e9
push str.shareguard.exe_proxy_service_Ndisrd_n
call edi
mov esi, dword [esp + 0xc]
or esi, 1
jmp 0x40a6ed
mov esi, dword [esp + 0xc]
push str.shareguard
call fcn.00404f10
add esp, 4
test eax, eax
je 0x40a708
push str.shareguard.exe_proxy_service_shareguard_n
call edi
or esi, 1
push str.SharedAccess
call fcn.00404f10
add esp, 4
test eax, eax
jne 0x40a748
push 0x41eb64
call fcn.00404f10
add esp, 4
test eax, eax
jne 0x40a748
push 0x41eb60
call fcn.00404f10
add esp, 4
test eax, eax
jne 0x40a748
push str.Ipnat
call fcn.00404f10
add esp, 4
push str.Ndisrd
call fcn.0040a610
add esp, 4
cmp eax, 0xffffffff
je 0x40a764
push str.shareguard.exe_proxy_driver_n
call edi
or esi, 1
push str.Wsdrv
call fcn.0040a610
add esp, 4
cmp eax, 0xffffffff
jne 0x40a7e2
push str.wg1n
call fcn.0040a610
add esp, 4
cmp eax, 0xffffffff
jne 0x40a7e2
push str.wg2n
call fcn.0040a610
add esp, 4
cmp eax, 0xffffffff
jne 0x40a7e2
push str.wg3n
call fcn.0040a610
add esp, 4
cmp eax, 0xffffffff
jne 0x40a7e2
push str.wg4n
call fcn.0040a610
add esp, 4
cmp eax, 0xffffffff
jne 0x40a7e2
push str.wg5n
call fcn.0040a610
add esp, 4
cmp eax, 0xffffffff
jne 0x40a7e2
push str.wg6n
call fcn.0040a610
add esp, 4
cmp eax, 0xffffffff
je 0x40a7ec
push str.sygate_proxy_driver_Ndisrd_n
call edi
or esi, 1
push str.passthru
call fcn.0040a610
add esp, 4
cmp eax, 0xffffffff
je 0x40a823
push str.inetdrv.sys
push str.inetshare
push str.passthru
call fcn.00404fd0
add esp, 0xc
test eax, eax
je 0x40a823
push str.homeshare_proxy_driver_inetdrv_n
call edi
or esi, 1
push str.inetshare
call fcn.0040a610
add esp, 4
cmp eax, 0xffffffff
je 0x40a83f
push str.homeshare_proxy_driver_inetdrv_n
call edi
or esi, 1
push str.IPFilter
call fcn.0040a610
add esp, 4
cmp eax, 0xffffffff
je 0x40a85b
push str.Sinfor_proxy_driver_IPFilter_n
call edi
or esi, 1
push str.IPFilter
call fcn.00404f10
add esp, 4
test eax, eax
je 0x40a876
push str.Sinfor_proxy_service_shareguard_n
call edi
or esi, 1
push str.AutodialSvr
call fcn.00404f10
add esp, 4
test eax, eax
je 0x40a8a2
push str.IPFilter
call fcn.00404f10
add esp, 4
test eax, eax
je 0x40a8a2
push str.Sinfor_proxy_service_shareguard_n
call edi
or esi, 1
mov eax, esi
pop edi
pop esi
ret
Function at 0x40a8b0
Capabilities:
Enumerate processes
Print debug messages

Disassembly:
sub esp, 0x128
push ebp
push esi
push edi
xor esi, esi
mov ecx, 0x49
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], esi
push esi
push 2
rep stosd dword es:[edi], eax
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov edi, dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40a9ee
lea eax, [esp + 0xc]
mov dword [esp + 0xc], pe_nt_image_headers32
push eax
push ebp
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x40a9d8
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__stricmp]
lea ecx, [esp + 0x34]
push str.sgserv.exe
push ecx
call ebx
add esp, 8
test eax, eax
jne 0x40a924
push str.sgserv.exe_proxy_n
call edi
or esi, 1
lea edx, [esp + 0x34]
push str.shareguard.exe
push edx
call ebx
add esp, 8
test eax, eax
jne 0x40a941
push str.shareguard.exe_proxy_n
call edi
or esi, 1
lea eax, [esp + 0x34]
push str.homeshare.exe
push eax
call ebx
add esp, 8
test eax, eax
jne 0x40a95e
push str.homeshare.exe_proxy_n
call edi
or esi, 1
lea ecx, [esp + 0x34]
push str.NGNat.exe
push ecx
call ebx
add esp, 8
test eax, eax
jne 0x40a991
mov edx, dword [esp + 0x18]
push str.logc.dll
push edx
call fcn.0040a3a0
add esp, 8
test al, al
je 0x40a991
push str.Sinfor_proxy_n
call edi
or esi, 1
lea eax, [esp + 0x34]
push str.NatCtrl.exe
push eax
call ebx
add esp, 8
test eax, eax
jne 0x40a9c4
mov ecx, dword [esp + 0x18]
push str.logc.dll_nguilib.dll_packet.dll
push ecx
call fcn.0040a3a0
add esp, 8
test al, al
je 0x40a9c4
push str.Sinfor_proxy_n
call edi
or esi, 1
lea edx, [esp + 0x10]
push edx
push ebp
call sub.KERNEL32.DLL_Process32Next
test eax, eax
jne 0x40a907
pop ebx
push esi
call fcn.0040a6c0
add esp, 4
or esi, eax
push ebp
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
jne 0x40aa01
push str.sygatemark0
call edi
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x128
ret
push str.sygatemark_0
call edi
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x128
ret
Function at 0x40ae40
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x84
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
lea eax, [esp + 0xc]
push 0x7e
xor bl, bl
push eax
push str.USERDNSDOMAIN
mov byte [0x422f4c], 0
mov byte [esp + 0x14], bl
call esi
test eax, eax
jbe 0x40ae73
mov bl, 1
mov byte [esp + 8], bl
push edi
lea ecx, [esp + 0x10]
push 0x7e
push ecx
push str.USERNAME
call esi
test eax, eax
jbe 0x40aeda
lea edx, [esp + 0x10]
push 0x1a
push edx
push 0x422f4c
call dword [sym.imp.MSVCRT.dll_strncpy]
mov edi, 0x422f4c
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x40aeda
mov al, byte [edx + 0x422f4c]
cmp al, 0x41
jl 0x40aec6
cmp al, 0x5a
jg 0x40aec6
or al, 0x20
mov byte [edx + 0x422f4c], al
mov edi, 0x422f4c
or ecx, 0xffffffff
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jl 0x40aeb0
mov eax, dword [esp + 0x94]
pop edi
cmp eax, 1
jne 0x40af17
mov eax, dword [esp + 8]
push 0x422f4c
and eax, 0xff
lea ecx, [esp + 0x10]
push eax
push str.dnsdomainmark_lu__USERNAME_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
push 1
lea edx, [esp + 0x20]
push 0
push edx
call fcn.00409af0
add esp, 0x1c
test bl, bl
pop esi
pop ebx
setne al
add esp, 0x84
ret

Function at 0x40af50
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
test eax, eax
jge 0x40af5b
xor eax, eax
ret
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0x10
push 0x4244e8
push 0
push eax
mov eax, dword [0x424508]
push edx
push eax
mov dword [0x4244ec], ecx
call dword [sym.imp.WS2_32.dll_sendto]
mov ecx, eax
inc eax
neg eax
sbb eax, eax
mov dword [0x4244d8], ecx
and eax, ecx
ret

Function at 0x40b260
Capabilities:
Create process on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x154
cmp edx, 1
push ebx
push esi
push edi
lea ebx, [esp + 0xc]
mov edi, str.startfile
je 0x40b280
mov edi, str.exefile
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4288d0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jb 0x40b31b
mov edi, 0x4288d0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [esp + 0x60]
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
cmp edx, 1
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x11
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], 0x44
jne 0x40b2f8
mov dword [esp + 0x38], edx
mov word [esp + 0x3c], ax
lea ecx, [esp + 0x50]
lea edx, [esp + 0xc]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x7c]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
pop edi
pop esi
pop ebx
add esp, 0x154
ret
Function at 0x40b330
Capabilities:
Hide graphical window

Disassembly:
push 1
push 1
push 0x11
call fcn.004047d0
add esp, 4
push eax
call fcn.00409af0
mov eax, dword [0x428cc8]
add esp, 0xc
push 0
push 0x12f
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0x4a
call fcn.004047d0
push eax
call fcn.0040a1e0
mov ecx, dword [0x428cd4]
add esp, 8
push ecx
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 0
mov dword [0x42946c], 1
call dword [sym.imp.USER32.dll_MessageBeep]
test byte [0x429498], 4
je 0x40b3a1
mov edx, dword [0x428cd4]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.0040b260
pop ecx
ret

Function at 0x40b3b0
Capabilities:
Create process on windows

Disassembly:
push edi
xor eax, eax
push 0x422958
push 0x422910
push eax
push eax
mov ecx, 0x11
mov edi, 0x422910
push eax
push eax
rep stosd dword es:[edi], eax
push eax
mov word [0x422940], ax
push eax
mov eax, dword [esp + 0x28]
push eax
push 0
mov dword [0x422910], 0x44
mov dword [0x42293c], 1
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
pop edi
je 0x40b417
push 0
push str.wcapsetupmark1
mov dword [0x42955c], 1
call fcn.00409d30
add esp, 8
mov al, 1
ret
xor al, al
ret
Function at 0x40bb90
Capabilities:
Create thread
Terminate thread

Disassembly:
push ecx
mov eax, dword [0x429528]
push ebx
xor ebx, ebx
mov dword [0x42953c], 0x5a
cmp eax, ebx
mov dword [0x429540], ebx
mov dword [0x429440], ebx
mov dword [0x41e16c], 3
mov dword [0x42943c], ebx
je 0x40bbd2
push 1
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov dword [0x429528], ebx
push ebx
push ebx
call fcn.0040cef0
add esp, 8
test al, al
je 0x40bbfa
lea eax, [esp + 4]
push eax
push ebx
push 1
push 0x40b450
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x429528], eax
mov eax, dword [0x429528]
mov byte [0x41e1c6], 1
cmp eax, ebx
mov byte [0x429499], 0xff
mov dword [0x42842c], 0xa
mov byte [0x42949a], 1
mov byte [0x4294f9], bl
mov dword [0x428cc0], ebx
mov dword [0x4283c0], ebx
jne 0x40bc39
call fcn.0040b330
call fcn.004107d0
xor ecx, ecx
push ebx
mov dword [0x424a9c], ecx
mov dword [0x424aa0], ecx
mov dword [0x424aa4], ecx
mov dword [0x424aa8], ecx
mov dword [0x424aac], ecx
call fcn.004089e0
add esp, 4
pop ebx
pop ecx
ret
Function at 0x40d770
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x4294a0]
sub esp, 8
test eax, eax
je 0x40d808
lea eax, [esp + 4]
lea ecx, [esp]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREDRCOMCLIENT
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40d7c8
push 1
push 0
push 0x41f080
call fcn.00409af0
add esp, 0xc
add esp, 8
ret
mov edx, dword [0x4294a0]
mov eax, dword [esp]
push 0x3f0
push edx
push 3
push 0
push str.DogInfo
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40d7fd
push 1
push 0
push 0x41f080
call fcn.00409af0
add esp, 0xc
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret

Function at 0x40dcc0
Capabilities:
Create process on windows

Disassembly:
push edi
xor eax, eax
push 0x4229b0
push 0x422968
push eax
push eax
mov ecx, 0x11
mov edi, 0x422968
push eax
push eax
rep stosd dword es:[edi], eax
push eax
push eax
mov edi, 1
push str.ipconfig.exe__renew
push eax
mov dword [0x422968], 0x44
mov dword [0x422994], edi
mov word [0x422998], ax
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x40dd3a
mov eax, dword [0x428cc0]
push edi
push 0
push 3
mov dword [0x4229c0], eax
mov dword [0x428cc0], 0
mov dword [0x429558], edi
call fcn.004047d0
add esp, 4
push eax
call fcn.00409af0
add esp, 0xc
pop edi
ret

Function at 0x40dd60
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
push 0x2b4
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esi], 0x2b4
push esi
mov dword [esp + 0x20], 0x2b4
call sub.RASAPI32.dll_RasEnumConnectionsA
test eax, eax
je 0x40ddc5
push eax
lea edx, [esp + 0x1c]
push str.RasEnumConnections_failed:_Error___d
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [esp + 0x18]
push str.The_following_RAS_connections_are_currently_active_n_n
push ecx
call ebx
mov ebp, dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
add esp, 8
lea edx, [esp + 0x18]
push edx
call ebp
mov eax, dword [esp + 0x10]
xor edi, edi
test eax, eax
jbe 0x40de25
add esi, 4
lea eax, [esi + 4]
lea ecx, [esp + 0x18]
push eax
push str.Entry_name:__s_n
push ecx
call ebx
add esp, 0xc
lea edx, [esp + 0x18]
push edx
call ebp
mov eax, dword [esi]
push eax
call sub.RASAPI32.dll_RasHangUpA
mov eax, dword [esp + 0x10]
add esi, 0x2b4
inc edi
cmp edi, eax
jb 0x40ddf4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x40e9c0
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, 0x4229d7
or ecx, 0xffffffff
test byte [eax - 1], 1
jne 0x40e9e0
cmp byte [eax], 6
jne 0x40e9e0
cmp dword [eax + 5], ecx
je 0x40e9e0
mov edx, dword [eax + 1]
test edx, edx
jne 0x40e9ec
add eax, 0x10
cmp eax, 0x422a17
jl 0x40e9c9
jmp 0x40ea28
mov eax, dword [0x41e160]
mov dword [0x4229c8], 0
test eax, eax
jne 0x40ea23
push 0x30
push 0x2d
call fcn.004047d0
add esp, 4
push eax
push 0x1b
call fcn.004047d0
add esp, 4
push eax
mov eax, dword [0x428cd4]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.0040de30
lea ecx, [esp]
mov dword [0x4229c8], 0
push ecx
push 0
push 1
push 0x40e8e0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x429524], eax
pop ecx
ret
Function at 0x40ef00
Capabilities:
Get local ipv4 addresses

Disassembly:
mov eax, dword [0x42868c]
sub esp, 0xc
test ah, 0x80
jne 0x40f019
mov eax, dword [0x4294a0]
test eax, eax
je 0x40f019
mov ecx, dword [0x41e3b8]
dec ecx
mov dword [0x41e3b8], ecx
jne 0x40f019
add eax, 0xc
push ebx
push ebp
mov dword [esp + 0xc], eax
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0
mov dword [0x41e3b8], 2
mov dword [esp + 0x18], 0
call sub.iphlpapi.dll_GetAdaptersInfo
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
lea edx, [esp + 0x10]
mov esi, eax
push edx
push esi
mov dword [esp + 0x20], esi
call sub.iphlpapi.dll_GetAdaptersInfo
test esi, esi
je 0x40eff9
lea eax, [esi + 8]
push 0
push eax
call fcn.00409d30
lea ecx, [esi + 0x10c]
push 0
push ecx
call fcn.00409d30
lea edi, [esi + 0x1b0]
push 0
push edi
call fcn.00409d30
lea ebp, [esi + 0x1c0]
push 0
push ebp
call fcn.00409d30
lea ebx, [esi + 0x1d8]
push 0
push ebx
call fcn.00409d30
push edi
call fcn.0040af30
mov edi, eax
add esp, 0x2c
test edi, edi
je 0x40eff3
cmp dword [esi + 0x1a0], 0x17
jne 0x40eff3
push ebx
call fcn.0040af30
add esp, 4
cmp eax, edi
jne 0x40eff3
push ebp
call fcn.0040af30
add esp, 4
cmp eax, 0xffffffff
je 0x40f01d
mov esi, dword [esi]
test esi, esi
jne 0x40ef7d
mov eax, dword [0x4294a0]
mov cl, byte [eax + 0xb]
and cl, 0xfb
mov byte [eax + 0xb], cl
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x14]
mov dword [edx], edi
mov eax, dword [0x4294a0]
mov cl, byte [eax + 0xb]
or cl, 4
jmp 0x40f004

Function at 0x40f030
Capabilities:
Get local ipv4 addresses

Disassembly:
push ecx
push ebx
lea eax, [esp + 4]
push esi
push eax
push 0
mov dword [esp + 0x10], 0
call sub.iphlpapi.dll_GetAdaptersInfo
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
lea edx, [esp + 8]
mov esi, eax
push edx
push esi
mov ebx, esi
call sub.iphlpapi.dll_GetAdaptersInfo
test esi, esi
je 0x40f09a
push edi
mov edi, dword [esp + 0x14]
lea eax, [esi + 0x1b0]
push eax
call fcn.0040af30
add esp, 4
test eax, eax
je 0x40f093
and eax, 0xff
cmp eax, 0xa9
je 0x40f093
cmp eax, 0x7f
je 0x40f093
inc dword [edi]
mov esi, dword [esi]
test esi, esi
jne 0x40f06d
pop edi
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
pop esi
pop ebx
pop ecx
ret
Function at 0x40f6d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x80
push 0x6d
call fcn.004047d0
add esp, 4
lea ecx, [esp]
push eax
mov eax, dword [0x428430]
push eax
push str._s:_s
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
push 0
lea edx, [esp + 0x14]
push 1
push edx
call fcn.00409d70
mov eax, dword [0x428684]
add esp, 0x1c
test eax, 0x10000
je 0x40f72f
call fcn.00418330
mov eax, dword [0x428684]
shr eax, 0x12
and eax, 1
push eax
push 1
call fcn.00418060
add esp, 8
mov eax, dword [0x42874c]
test ah, 2
je 0x40f76d
push str.wtype.exit
call fcn.00415f80
add esp, 4
test eax, eax
je 0x40f75e
mov ecx, dword [0x428cc8]
push 0
push 0x131
push ecx
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov edx, dword [0x428cd4]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push str.logineddrcom.exe
mov dword [0x42842c], 0xa
mov dword [0x42943c], 0
mov dword [0x428cc0], 0
call fcn.00415fd0
add esp, 0x8c
ret

Function at 0x40f8e0
Capabilities:
Hide graphical window
Terminate thread

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
mov dword [0x42946c], 0
mov dword [0x41e194], eax
call dword [sym.imp.MSVCRT.dll_clock]
mov ecx, dword [0x4294f4]
mov dword [0x4290d0], eax
mov eax, dword [0x4294f0]
cmp eax, ecx
jge 0x40f915
cmp eax, 0xa
jl 0x40f91f
mov dword [0x4294f0], 0
lea ecx, [esp]
push esi
push ecx
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
mov dx, word [esp + 0x12]
mov word [0x4294b8], dx
mov dl, byte [0x41e1c8]
inc dl
mov byte [0x41e1c8], dl
call fcn.0040f8b0
mov eax, dword [0x4294a4]
mov esi, 4
test eax, eax
mov dword [0x42842c], 1
mov dword [0x428cc0], esi
je 0x40f97b
push 1
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
mov dword [0x4294a4], 0
test dword [0x42874c], 0x80000
je 0x40f98d
mov dword [0x42943c], esi
push 0
call fcn.0040faf0
mov eax, dword [0x428cc8]
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
add esp, 4
push 1
push 0x131
push eax
call esi
mov ecx, dword [0x428cc8]
push 1
push 0x143
push ecx
call esi
mov edx, dword [0x428cc8]
push 1
push 0x130
push edx
call esi
mov eax, dword [0x428cc8]
push 1
push 0x12f
push eax
call esi
mov ecx, dword [0x428cc8]
push 1
push 0x13e
push ecx
call esi
push str.wtype.exit
call fcn.00415f80
add esp, 4
test eax, eax
je 0x40fa0c
mov edx, dword [0x428cc8]
push 0
push 0x131
push edx
call esi
mov eax, dword [0x428cd4]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov eax, dword [0x429458]
pop esi
test eax, eax
jne 0x40fa2b
mov eax, dword [0x429418]
test eax, eax
je 0x40fa3a
mov ecx, dword [0x428cd4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
add esp, 0x10
ret
Function at 0x40fa40
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x428cc8]
push esi
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
push 1
push 0x13e
push eax
call esi
mov ecx, dword [0x428cc8]
push 1
push 0x131
push ecx
call esi
mov edx, dword [0x428cc8]
push 1
push 0x143
push edx
call esi
mov eax, dword [0x428cc8]
push 1
push 0x130
push eax
call esi
mov ecx, dword [0x428cc8]
push 1
push 0x12f
push ecx
call esi
push str.wtype.exit
call fcn.00415f80
add esp, 4
test eax, eax
je 0x40fab6
mov edx, dword [0x428cc8]
push 0
push 0x131
push edx
call esi
mov eax, dword [0x428cd4]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov eax, dword [0x429458]
pop esi
test eax, eax
jne 0x40fad5
mov eax, dword [0x429418]
test eax, eax
je 0x40fae4
mov ecx, dword [0x428cd4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4107d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x118
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x24]
push eax
call fcn.00412430
mov edi, str.login2.dat
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x20]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push eax
push 4
mov ecx, ebx
push eax
push eax
and ecx, 3
lea eax, [esp + 0x34]
push 0xc0000000
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x428ca8], eax
jne 0x410860
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
pop edi
pop esi
pop ebx
add esp, 0x118
ret
mov edi, dword [0x428434]
mov ecx, 0xa
mov eax, 0xcccccccc
mov ebx, dword [sym.imp.KERNEL32.DLL_WriteFile]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x428434]
mov edx, dword [0x428ca8]
push 0
push 0x428ca4
push 0x2a
push ecx
push edx
mov dword [0x428ca4], 0x2a
call ebx
mov eax, dword [0x428ca8]
push 0
push 0x428ca4
push 1
push 0x429498
push eax
mov dword [0x428ca4], 1
call ebx
push 0x429490
mov dword [0x428ca4], 0x14
call fcn.0040a1d0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x428ca8]
and ecx, 3
push 0x428ca4
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x428ca4]
lea edx, [esp + 0x14]
push ecx
push edx
push eax
call ebx
mov ecx, dword [0x428ca8]
push 0
push 0x428ca4
push 0x20
push 0x428330
push ecx
mov dword [0x428ca4], 0x20
call ebx
mov edx, dword [0x428ca8]
push 0
push 0x428ca4
push 4
push 0x429448
push edx
mov dword [0x428ca4], 4
call ebx
mov eax, dword [0x428ca8]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x118
ret

Function at 0x410970
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x18
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
lea edx, [esp + 4]
lea eax, [esp + 8]
push edx
mov edx, dword [esp + 4]
push eax
lea ecx, [esp + 0x10]
push 0x10
push ecx
push 0
push edx
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x18
ret