joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100403f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ecx + 0xc]
cmp eax, 0xffffffff
je 0x100407a
push dword [ebp + 8]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.msvcrt.dll__read]
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov dword [ecx], eax
cmp eax, 0xffffffff
je 0x100406e
test eax, eax
je 0x100406e
mov al, 1
jmp 0x100407c
push 0
push 0x1001db8
call fcn.01005394
xor al, al
pop ebp
ret 0xc

Function at 0x100416a
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, ecx
call fcn.01005219
or dword [edi + 0xc], 0xffffffff
lea ebx, [edi + 0x11]
mov ecx, edi
mov dword [edi], fcn.0100522b
mov byte [edi + 8], 0
mov byte [edi + 0x10], 0
mov byte [ebx], 0
call fcn.0100522b
test al, al
jne 0x10042b1
call fcn.01004596
test al, al
jne 0x10041b4
mov ecx, edi
call fcn.01005234
jmp 0x10042b1
movzx eax, byte [ebp + 0xc]
dec eax
push esi
mov esi, 0x100
je 0x10041d5
dec eax
je 0x100422c
push 0
push 0x1001ef0
call fcn.01005394
jmp 0x10042a9
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x10041e9
push eax
push 0x1001ea8
jmp 0x10041cb
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10041ee
sub eax, edx
cmp byte [eax + edi + 0x10], 0x5c
je 0x100422c
lea eax, [edi + 0x11]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004204
sub eax, edx
cmp eax, esi
jb 0x100421a
push 0
push 0x1001e78
jmp 0x10041cb
push 0x1001e74
lea eax, [edi + 0x11]
push esi
push eax
call sub.msvcrt.dll_strcat_s
add esp, 0xc
lea eax, [edi + 0x11]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004232
sub eax, edx
mov edx, eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 1]
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x1004243
sub eax, ecx
add eax, edx
cmp eax, esi
jae 0x1004211
push dword [ebp + 8]
lea eax, [edi + 0x11]
push esi
push eax
call sub.msvcrt.dll_strcat_s
movzx eax, byte [ebp + 0x10]
add esp, 0xc
sub eax, 0
je 0x10042b0
dec eax
je 0x100429e
dec eax
je 0x1004295
dec eax
je 0x100428c
dec eax
je 0x1004283
push 0
push 0x1001e48
jmp 0x10041cb
mov ecx, edi
call fcn.01003fe3
jmp 0x10042a5
mov ecx, edi
call fcn.01003ffa
jmp 0x10042a5
mov ecx, edi
call fcn.01004011
jmp 0x10042a5
mov ecx, edi
call fcn.01004028
test al, al
jne 0x10042b0
mov ecx, edi
call fcn.01005234
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x100438b
Capabilities:
Delete file

Disassembly:
mov edi, edi
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0xffffffff
je 0x100439b
call fcn.010042be
add esi, 0x11
push esi
call dword [sym.imp.msvcrt.dll_remove]
pop ecx
pop esi
cmp eax, 0xffffffff
jne 0x10043bb
push 0
push 0x1001f90
call fcn.01005394
xor al, al
ret
mov al, 1
ret
Function at 0x10063e5
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x10068a8
call fcn.010065d4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x10083c8
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x100619c
cmp eax, esi
jne 0x100618f
xor esi, esi
inc esi
mov ebx, esi
jmp 0x100619f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1006176
xor esi, esi
inc esi
mov eax, dword [0x10083c4]
cmp eax, esi
jne 0x10061b2
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10061e1
mov eax, dword [0x10083c4]
test eax, eax
jne 0x10061db
mov dword [0x10083c4], esi
push 0x1001180
push 0x1001174
call fcn.010060db
pop ecx
pop ecx
test eax, eax
je 0x10061e1
jmp 0x1006309
mov dword [0x100808c], esi
mov eax, dword [0x10083c4]
cmp eax, esi
jne 0x1006205
push 0x1001170
push 0x1001168
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10083c4], 2
test ebx, ebx
jne 0x1006211
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10083cc], 0
je 0x1006235
push 0x10083cc
call fcn.01006549
pop ecx
test eax, eax
je 0x1006235
push 0
push 2
push 0
call dword [0x10083cc]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1006291
test al, al
je 0x100624f
cmp dword [ebp - 0x1c], 0
jne 0x1006291
mov al, byte [esi]
test al, al
je 0x100625f
cmp al, 0x20
ja 0x100625f
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100624f
test byte [ebp - 0x3c], 1
je 0x100626b
movzx eax, word [ebp - 0x38]
jmp 0x100626e
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1008088], eax
cmp dword [0x100807c], 0
jne 0x10062e5
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x10062a0
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x10062b3
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x100623c
cmp dword [0x100808c], 0
jne 0x10062f4
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1008088]
jmp 0x1006315
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01006619
ret
call fcn.01006721
jmp 0x100613c
Function at 0x402a9f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40a010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402b37
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x402b17
xor eax, eax
push ebp
push 0x402b10
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402b53
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402b17
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x40a010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40a010], ax
mov esp, ebp
pop ebp
ret

Function at 0x403207
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40b034], 0
je 0x403268
cmp word [0x40b208], 0xd7b2
jne 0x403230
cmp dword [0x40b210], 0
jbe 0x403230
mov eax, 0x40b204
call dword [fcn.0040b220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40a058
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40328f
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x40a01c], 0
jne 0x403284
push 0
push 0x40a050
push 0x40a058
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret

Function at 0x403c03
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403c69
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040358f
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402993
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403c53
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403c70
lea eax, [ebp - 0x10]
call fcn.00403383
ret
Function at 0x404a93
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x404b64
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403383
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404b4e
push 2
push 0
push 0xfffffffffffffffc
push ebx
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
xor dword [ebp - 8], 0x4d863286
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
cmp eax, dword [ebp - 8]
jb 0x404b4e
push 2
push 0
mov eax, dword [ebp - 8]
neg eax
push eax
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004038f3
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
call fcn.0040381b
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.004033d7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404b6b
lea eax, [ebp - 0xc]
call fcn.00403383
ret

Function at 0x404cb7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004037b3
xor eax, eax
push ebp
push 0x404d4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403383
mov word [ebp - 8], 0x2a
mov eax, dword [ebp - 4]
call fcn.004035c3
mov ebx, eax
test bx, bx
jbe 0x404d2f
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
mov dx, word [ebp - 6]
xor dx, word [ebp - 8]
call fcn.0040354f
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.004035cb
inc edi
dec bx
jne 0x404d00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404d54
lea eax, [ebp - 0xc]
call fcn.00403383
lea eax, [ebp - 4]
call fcn.00403383
ret

Function at 0x404ee7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004037b3
xor eax, eax
push ebp
push 0x404f5a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
mov edx, 0x44
call fcn.00404153
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x4000000
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004037c3
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404f61
lea eax, [ebp - 4]
call fcn.00403383
ret
Function at 0x404f6b
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
push 0
push 4
push 4
push 0
push 1
push 0
mov eax, esi
call fcn.004037c3
push eax
call sub.KERNEL32.DLL_CreateFileA
push 0
push eax
call sub.KERNEL32.DLL_GetFileSize
cmp eax, 0xffffffff
je 0x404f99
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x405243
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004037b3
xor eax, eax
push ebp
push 0x4052d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403383
mov eax, dword [ebp - 4]
call fcn.004035c3
mov ebx, eax
test bx, bx
jbe 0x4052b5
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
mov dx, word [ebp - 6]
xor dx, 0x18
call fcn.0040354f
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.004035cb
inc edi
dec bx
jne 0x405286
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4052da
lea eax, [ebp - 0xc]
call fcn.00403383
lea eax, [ebp - 4]
call fcn.00403383
ret

Function at 0x4052e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004037b3
xor eax, eax
push ebp
push 0x405373
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403383
mov eax, dword [ebp - 4]
call fcn.004035c3
mov ebx, eax
test bx, bx
jbe 0x405355
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
mov dx, word [ebp - 6]
xor dx, 0xc
call fcn.0040354f
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.004035cb
inc edi
dec bx
jne 0x405326
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40537a
lea eax, [ebp - 0xc]
call fcn.00403383
lea eax, [ebp - 4]
call fcn.00403383
ret
Function at 0x4059b3
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbc8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.004037b3
xor eax, eax
push ebp
push 0x405bc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
push 0
push 0
push 0
push 0x405bd3
call sub.WININET.DLL_InternetOpenA
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x405b8c
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0xc], 0
je 0x405b75
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.004058a7
push 0
push 0
push 3
push 0
push 0
push 0x50
mov eax, dword [ebp - 0x20]
call fcn.004037c3
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.WININET.DLL_InternetConnectA
mov dword [ebp - 0x10], eax
mov eax, 0x405bdb
mov dword [ebp - 0x28], eax
push 0
push 0x80000000
lea eax, [ebp - 0x28]
push eax
push 0
push 0x405be7
mov eax, dword [ebp - 0x24]
call fcn.004037c3
push eax
push 0x405bf3
mov eax, dword [ebp - 0x10]
push eax
call sub.WININET.DLL_HttpOpenRequestA
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
call fcn.004035c3
push eax
mov eax, dword [ebp - 4]
call fcn.004037c3
push eax
push 0x2f
push 0x405bfb
mov eax, dword [ebp - 0x14]
push eax
call sub.WININET.DLL_HttpSendRequestA
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x400
mov eax, dword [ebp - 0x2c]
call fcn.004027b3
mov esi, eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
push esi
push 5
mov eax, dword [ebp - 0x14]
push eax
call sub.WININET.DLL_HttpQueryInfoA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x405b75
xor eax, eax
push ebp
push 0x405b6e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x400
lea eax, [ebp - 0x18]
push eax
push 0x400
lea eax, [ebp - 0x432]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.WININET.DLL_InternetReadFile
cmp dword [ebp - 0x18], 0
je 0x405b3e
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x432], 0
lea eax, [ebp - 0x438]
lea edx, [ebp - 0x432]
mov ecx, 0x402
call fcn.0040358f
mov edx, dword [ebp - 0x438]
lea eax, [ebp - 0x1c]
call fcn.004035cb
jmp 0x405ae7
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.004038ab
test eax, eax
setg byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b75
mov eax, dword [ebp - 0x14]
push eax
call sub.WININET.DLL_InternetCloseHandle
mov eax, dword [ebp - 0x10]
push eax
call sub.WININET.DLL_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405b93
mov eax, dword [ebp - 0xc]
push eax
call sub.WININET.DLL_InternetCloseHandle
ret
Function at 0x405e3b
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004037b3
mov eax, dword [ebp - 8]
call fcn.004037b3
xor eax, eax
push ebp
push 0x405f7c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00403383
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.004033d7
push 0
push 0
push 0
push 0
push 0x405f8b
call sub.WININET.DLL_InternetOpenA
mov ebx, eax
test ebx, ebx
jne 0x405eb1
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.004033d7
jmp 0x405f56
push 0
push 0x84000002
push 0
push 0
push dword [ebp - 4]
push 0x405f9f
push dword [ebp - 8]
lea eax, [ebp - 0x418]
mov edx, 3
call fcn.00403683
mov eax, dword [ebp - 0x418]
call fcn.004037c3
push eax
push ebx
call sub.WININET.DLL_InternetOpenUrlA
mov edi, eax
test edi, edi
jne 0x405f01
push ebx
call sub.WININET.DLL_InternetCloseHandle
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.004033d7
jmp 0x405f56
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x411]
xor ecx, ecx
mov edx, 0x401
call fcn.00402973
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x411]
push eax
push edi
call sub.WININET.DLL_InternetReadFile
test eax, eax
je 0x405f46
mov eax, esi
lea edx, [ebp - 0x411]
mov ecx, 0x401
call fcn.0040358f
jmp 0x405f50
mov eax, esi
mov edx, dword [ebp - 0xc]
call fcn.004033d7
push ebx
call sub.WININET.DLL_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f83
lea eax, [ebp - 0x418]
call fcn.00403383
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004033a7
ret
Function at 0x406277
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x4063d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x40a18c]
cmp dword [eax], 0
jne 0x4062a4
mov eax, dword [0x40a198]
cmp dword [eax], 0
je 0x4063be
lea edx, [ebp - 4]
mov eax, dword [0x40a1d0]
mov eax, dword [eax]
call fcn.00405243
lea eax, [ebp - 4]
mov edx, 0x4063ef
call fcn.004035cb
mov eax, dword [ebp - 4]
push eax
push 0x406403
mov eax, dword [0x40a124]
push dword [eax]
push 0x40640f
mov eax, dword [0x40a18c]
push dword [eax]
push 0x40641b
mov eax, dword [0x40a198]
push dword [eax]
push 0x406427
mov eax, dword [0x40a1c8]
push dword [eax]
push 0x406437
mov eax, dword [0x40a138]
push dword [eax]
push 0x406447
mov eax, dword [0x40a120]
push dword [eax]
push 0x406457
mov eax, dword [0x40a1b4]
push dword [eax]
push 0x406467
mov eax, dword [0x40a13c]
push dword [eax]
push 0x406477
mov eax, dword [0x40a14c]
push dword [eax]
push 0x406487
mov eax, dword [0x40a158]
push dword [eax]
push 0x406497
mov eax, dword [0x40a1e8]
push dword [eax]
push 0x4064a7
mov eax, dword [0x40a1c4]
push dword [eax]
push 0x4064b7
mov eax, dword [0x40a1d4]
push dword [eax]
push 0x4064c7
mov eax, dword [0x40a194]
push dword [eax]
push 0x4064d7
mov eax, dword [0x40a1dc]
push dword [eax]
lea eax, [ebp - 8]
mov edx, 0x1e
call fcn.00403683
mov edx, dword [ebp - 8]
mov ecx, 0x4064e7
pop eax
call fcn.004059b3
mov eax, dword [0x40a1dc]
mov eax, dword [eax]
mov edx, 0x4064fb
call fcn.0040370f
jne 0x4063be
mov eax, dword [0x40a130]
push eax
push 0
push 0x44
push 0x4061a3
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4063e0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004033a7
ret
Function at 0x407ce3
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x198], ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x1a0], ecx
mov dword [ebp - 0x1a4], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004037b3
xor eax, eax
push ebp
push 0x407df1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x194]
push eax
push 0x101
call sub.WSOCK32.DLL_WSAStartup
mov eax, dword [ebp - 4]
call fcn.004037c3
push eax
call sub.WSOCK32.DLL_gethostbyname
mov ebx, eax
call sub.WSOCK32.DLL_WSACleanup
lea edx, [ebp - 0x198]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax]
call fcn.00405c63
push dword [ebp - 0x198]
push 0x407e07
lea edx, [ebp - 0x19c]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 1]
call fcn.00405c63
push dword [ebp - 0x19c]
push 0x407e07
lea edx, [ebp - 0x1a0]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 2]
call fcn.00405c63
push dword [ebp - 0x1a0]
push 0x407e07
lea edx, [ebp - 0x1a4]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + 3]
call fcn.00405c63
push dword [ebp - 0x1a4]
mov eax, esi
mov edx, 7
call fcn.00403683
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407df8
lea eax, [ebp - 0x1a4]
mov edx, 4
call fcn.004033a7
lea eax, [ebp - 4]
call fcn.00403383
ret
Function at 0x407e0b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x407e13
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x407f7e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40b9a4
push 0x101
call sub.WSOCK32.DLL_WSAStartup
push 0
push 1
push 2
call sub.WSOCK32.DLL_socket
mov dword [0x40bb34], eax
cmp dword [0x40bb34], 0xffffffff
je 0x407f56
lea eax, [ebp - 8]
mov edx, 0x407f93
call fcn.0040341b
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.0040491f
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00407ce3
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
call fcn.0040341b
lea eax, [ebp - 0xc]
mov edx, 0x407fb3
call fcn.0040341b
mov word [ebp - 0x1c], 2
mov eax, dword [ebp - 0xc]
call fcn.00404fcf
push eax
call sub.WSOCK32.DLL_htons
mov word [ebp - 0x1a], ax
mov eax, dword [ebp - 8]
call fcn.004037c3
push eax
call sub.WSOCK32.DLL_inet_addr
mov ebx, eax
lea eax, [ebp - 8]
call fcn.00403383
lea eax, [ebp - 0xc]
call fcn.00403383
mov dword [ebp - 0x18], ebx
push 0x10
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x40bb34]
push eax
call sub.WSOCK32.DLL_connect
test eax, eax
jne 0x407f56
mov eax, 0x400
call fcn.004027b3
mov ebx, eax
mov edx, 0x400
mov eax, ebx
call fcn.00404153
lea eax, [ebp - 0x28]
mov ecx, 0x407fc3
mov edx, esi
call fcn.0040360f
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 4]
call fcn.0040477f
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040500f
push 0
lea eax, [ebp - 0x2c]
mov edx, ebx
call fcn.0040355f
mov eax, dword [ebp - 0x2c]
call fcn.004035c3
push eax
push ebx
mov eax, dword [0x40bb34]
push eax
call sub.WSOCK32.DLL_send
inc eax
je 0x407f56
mov eax, ebx
call fcn.004027d3
mov eax, dword [0x40bb34]
push eax
call sub.WSOCK32.DLL_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f85
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.004033a7
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004033a7
ret

Function at 0x408b5f
Capabilities:
Set global application hook

Disassembly:
push 0
mov eax, dword [0x40b650]
push eax
mov eax, 0x408b3f
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x40bb54], eax
push 0
mov eax, dword [0x40b650]
push eax
mov eax, 0x408b1f
push eax
push 4
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x40bb58], eax
push 0
mov eax, dword [0x40b650]
push eax
mov eax, 0x408aff
push eax
push 0xc
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x40bb5c], eax
ret