joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x84
push ebx
push ebp
mov ebp, ecx
call fcn.00401ba0
xor ebx, ebx
push 0x208
mov dword [ebp], 0x4153b8
mov dword [ebp + 0x958], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 0x948], ebx
mov dword [ebp + 0x95c], ebx
mov dword [ebp + 0x960], ebx
mov dword [ebp + 0x950], ebx
mov dword [ebp + 0x954], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
cmp eax, ebx
mov dword [ebp + 0x94c], eax
je 0x402fab
push esi
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [esp + 0x18]
push 0x41851c
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x1c], 2
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [ebp + 0x94c]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x20
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.0040d660
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [ebp + 0x94c]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..txt
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [ebp + 0x94c]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x84
ret
mov eax, ebp
pop ebp
pop ebx
add esp, 0x84
ret

Function at 0x404030
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414bc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x10], esp
mov ecx, dword [esi + 0x960]
mov dword [ebp - 0x14], esi
cmp ecx, edi
je 0x404099
mov eax, dword [ecx]
mov dword [ebp - 4], edi
call dword [eax + 0x14]
mov ecx, dword [esi + 0x960]
mov edx, dword [ecx]
call dword [edx + 8]
mov dword [esi + 0x960], edi
jmp 0x40408c
mov eax, dword [esi + 0x94c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404910
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, ecx
test ebx, ebx
mov dword [esp + 8], esi
je 0x404a47
push ebp
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x404940
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x404a00
push 0x2e
push ebx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
je 0x4049d9
push ebx
lea ebp, [ebx + 0x10]
call dword [sym.imp.WSOCK32.dll_inet_addr]
push 2
push 4
push ebp
mov dword [ebp], eax
call dword [sym.imp.WSOCK32.dll_gethostbyaddr]
test eax, eax
je 0x404a00
mov edx, dword [eax]
test edx, edx
je 0x404a00
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x10
jae 0x404a00
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xor edx, edx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dl, byte [ebx + 0x12]
mov al, byte [ebx + 0x11]
xor ecx, ecx
mov cl, byte [ebx + 0x13]
push ecx
xor ecx, ecx
mov cl, byte [ebp]
push edx
push eax
push ecx
push str._d._d._d._d
push ebx
call dword [sym.imp.MSVCRT.dll_sscanf]
mov esi, dword [esp + 0x28]
add esp, 0x18
jmp 0x404a00
push ebx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x404a00
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jne 0x404a00
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
movsx edx, byte [ecx]
mov dword [ebx + 0x10], edx
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [ebx + 0x10], edx
push ebx
mov ecx, esi
call fcn.00404d00
pop edi
pop ebp
test eax, eax
je 0x404a19
pop esi
mov eax, 1
pop ebx
pop ecx
ret 4
mov eax, dword [ebx + 0x10]
push 1
push eax
push ebx
call dword [sym.imp.guidll.dll__SetVirusHost_12]
test eax, eax
je 0x404a47
push 0x14
push ebx
lea ecx, [esi + 4]
call fcn.004013a0
mov ecx, esi
call fcn.00404c10
pop esi
mov eax, 1
pop ebx
pop ecx
ret 4
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x404b40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push 0x418a70
lea eax, [ebx + 0x44]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
xor ecx, ecx
mov esi, eax
mov dword [esp + 0x18], ecx
xor eax, eax
mov dword [esp + 0x1c], ecx
add esp, 8
mov dword [esp + 0x18], ecx
cmp esi, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
je 0x404c04
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x14]
push 8
push edx
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], eax
call edi
add esp, 0x10
test eax, eax
je 0x404bee
push esi
push 0x14
lea eax, [esp + 0x1c]
push 1
push eax
call edi
add esp, 0x10
test eax, eax
je 0x404bee
add ebx, 4
lea ecx, [esp + 0x14]
push 0x14
push ecx
mov ecx, ebx
call fcn.004013a0
xor edx, edx
push esi
mov dword [esp + 0x18], edx
push 0x14
mov dword [esp + 0x20], edx
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], edx
push 1
mov dword [esp + 0x2c], edx
push eax
mov dword [esp + 0x34], edx
call edi
add esp, 0x10
test eax, eax
jne 0x404bb7
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x1c
ret

Function at 0x404c10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
push 0x418a74
lea eax, [edi + 0x44]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebx, eax
xor esi, esi
add esp, 8
cmp ebx, esi
je 0x404cee
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fwrite]
push ebx
push 1
lea ecx, [esp + 0x18]
push 8
push ecx
mov dword [esp + 0x20], 8
mov dword [esp + 0x24], 0x10000001
call ebp
xor edx, edx
xor eax, eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
add esp, 0x10
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], edx
add edi, 4
push 0x14
mov dword [esp + 0x28], eax
push ecx
mov dword [esp + 0x30], esi
push esi
mov ecx, edi
mov dword [esp + 0x34], eax
call fcn.004015e0
test eax, eax
je 0x404cd7
push ebx
push 0x14
lea edx, [esp + 0x20]
push 1
push edx
call ebp
xor eax, eax
add esp, 0x10
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], eax
inc esi
mov dword [esp + 0x20], eax
push 0x14
mov dword [esp + 0x28], eax
push ecx
push esi
mov ecx, edi
mov dword [esp + 0x34], eax
call fcn.004015e0
test eax, eax
jne 0x404c9e
push ebx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x1c
ret
Function at 0x40d2e0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x110
push ebx
xor eax, eax
push esi
lea ecx, [esp + 0xc]
push edi
mov edi, dword [esp + 0x120]
mov dword [esp + 0x10], eax
push ecx
push eax
lea edx, [esp + 0x20]
push eax
push edx
mov dword [esp + 0x24], eax
push eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0xa
call dword [sym.imp.WSOCK32.dll_select]
mov esi, dword [esp + 0x18]
xor ecx, ecx
test esi, esi
jbe 0x40d361
lea edx, [esp + 0x1c]
cmp dword [edx], edi
je 0x40d33d
inc ecx
add edx, 4
cmp ecx, esi
jb 0x40d32f
jmp 0x40d361
lea edx, [esi - 1]
cmp ecx, edx
jae 0x40d35c
lea edx, [esp + ecx*4 + 0x1c]
mov esi, dword [edx + 4]
inc ecx
mov dword [edx], esi
mov esi, dword [esp + 0x18]
add edx, 4
lea ebx, [esi - 1]
cmp ecx, ebx
jb 0x40d348
dec esi
mov dword [esp + 0x18], esi
cmp eax, 0xffffffff
je 0x40d3d4
test eax, eax
je 0x40d3c5
push 0
lea eax, [esp + 0x13]
push 1
push eax
push edi
call dword [sym.imp.WSOCK32.dll_recv]
test eax, eax
jg 0x40d3c5
push 0x423658
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xf3e
push str.C:TEMPRisingAutoLinkProduct2005AppPersonalRavMonRavMonDRavMonCoreRavMonCore.cpp
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x41a174
call fcn.00407b30
add esp, 0x14
push 0x423658
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x110
ret
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x110
ret
Function at 0x40d3f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414dd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x340
mov eax, dword [0x423728]
push ebx
push esi
push edi
test eax, eax
mov dword [ebp - 0x10], esp
jne 0x40d430
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x13b]
mov byte [ebp - 0x13c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x13c]
push eax
call fcn.0040d630
mov ecx, dword [0x423728]
add esp, 4
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x14], 0
push str.SetFilter
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x20], ebx
je 0x40d60b
lea edx, [ebp - 0x13c]
push edx
call fcn.0040d630
mov edi, str.RsRegLib.sys
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x13c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x41a1b4
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x13c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
mov ecx, 0x84
xor eax, eax
lea edi, [ebp - 0x34c]
rep stosd dword es:[edi], eax
add esp, 0xc
mov ecx, 6
lea edi, [ebp - 0x38]
mov dword [ebp - 0x1c], esi
test esi, esi
rep stosd dword es:[edi], eax
je 0x40d60b
xor ecx, ecx
push esi
push 8
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], ecx
push 1
push edx
mov dword [ebp - 0x14], ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
push esi
push 0x210
lea eax, [ebp - 0x34c]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
test eax, eax
je 0x40d601
mov ecx, dword [ebp - 0x34c]
mov edx, dword [ebp - 0x348]
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x344]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x34c]
mov dword [ebp - 0x28], eax
mov al, byte [ebp - 0x140]
push 0x210
lea edx, [ebp - 0x244]
push ecx
mov ecx, 0x41b650
mov dword [ebp - 0x2c], edx
mov byte [ebp - 0x24], al
call fcn.004013a0
lea edx, [ebp - 0x38]
mov dword [ebp - 4], 0
push edx
call ebx
test eax, eax
je 0x40d601
jmp 0x40d5dc
mov ecx, 0x84
xor eax, eax
lea edi, [ebp - 0x34c]
mov dword [ebp - 4], 0xffffffff
rep stosd dword es:[edi], eax
mov ecx, 6
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
jmp 0x40d516
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d730
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esp + 4]
push esi
mov eax, dword [eax]
dec eax
je 0x40d74b
dec eax
jne 0x40d773
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
push edx
push str.RAVMON_NOOP_THREAD
jmp 0x40d757
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push ecx
push str.RAVMON_LIVEPACKET_THREAD
call fcn.00413130
mov esi, eax
add esp, 8
test esi, esi
je 0x40d773
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x10]
test esi, esi
je 0x40d797
push 0xbb8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40d797
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, 1
pop esi
ret
Function at 0x40f010
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
neg eax
sbb eax, eax
inc eax
add esp, 0x190
ret

Function at 0x40f050
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push eax
mov esi, ecx
push 2
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x40f077
mov ecx, esi
call fcn.0040f0f0
xor eax, eax
pop esi
ret 4
push eax
mov ecx, esi
call fcn.0040f090
pop esi
ret 4

Function at 0x40f130
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x20
xor eax, eax
push ebx
push esi
mov dword [esp + 8], eax
mov esi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x30]
push edi
mov dword [esp + 0x14], eax
push ecx
mov dword [esp + 0x1c], eax
mov word [esp + 0x10], 2
call dword [sym.imp.WSOCK32.dll_htons]
mov edi, dword [esp + 0x30]
mov word [esp + 0xe], ax
test edi, edi
jne 0x40f199
lea edx, [esp + 0x1c]
push edi
push edx
mov ecx, esi
call fcn.0040f230
test eax, eax
jne 0x40f18c
mov ecx, esi
call fcn.0040f0f0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret 8
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
jmp 0x40f1f1
mov ebx, dword [sym.imp.WSOCK32.dll_inet_addr]
push edi
call ebx
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x40f1f5
xor ecx, ecx
lea edx, [esp + 0x1c]
mov dword [esp + 0x1d], ecx
push edi
mov dword [esp + 0x25], ecx
push edx
mov dword [esp + 0x2d], ecx
mov byte [esp + 0x24], 0
mov word [esp + 0x31], cx
mov byte [esp + 0x33], cl
mov ecx, esi
call fcn.0040f230
test eax, eax
jne 0x40f1ea
mov ecx, esi
call fcn.0040f0f0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret 8
lea eax, [esp + 0x1c]
push eax
call ebx
mov dword [esp + 0x10], eax
mov edx, dword [esi + 4]
lea ecx, [esp + 0xc]
push 0x10
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_bind]
cmp eax, 0xffffffff
jne 0x40f21d
mov ecx, esi
call fcn.0040f0f0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret 8
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20
ret 8

Function at 0x40f230
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x100
test eax, eax
push edi
jne 0x40f274
mov ecx, 0x3f
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 4]
push 0xff
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
je 0x40f26d
xor eax, eax
pop edi
add esp, 0x100
ret 8
lea ecx, [esp + 4]
push ecx
jmp 0x40f275
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
jne 0x40f289
pop edi
add esp, 0x100
ret 8
push ebx
mov ebx, dword [esp + 0x10c]
push esi
mov dword [ebx], 0
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 1
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop ebx
pop edi
add esp, 0x100
ret 8
Function at 0x40f370
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, ecx
or eax, 0xffffffff
push ebp
mov ecx, dword [ebx + 4]
push esi
cmp ecx, eax
push edi
je 0x40f3bd
mov edi, dword [esp + 0x18]
xor esi, esi
test edi, edi
jle 0x40f3b6
mov ebp, dword [esp + 0x14]
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebx + 4]
mov eax, edi
sub eax, esi
push 0
lea ecx, [esi + ebp]
push eax
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
je 0x40f3c4
add esi, eax
cmp esi, edi
jl 0x40f38e
xor eax, eax
cmp esi, edi
sete al
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ecx, ebx
call fcn.0040f0f0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 8

Function at 0x40f3e0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
mov ecx, ebp
push edi
mov edx, ecx
xor eax, eax
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x40f432
lea eax, [eax + eax*4]
mov edx, dword [esi + 4]
lea ecx, [esp + 0x18]
push 4
lea eax, [eax + eax*4]
push ecx
push 0x1006
push 0xffff
lea eax, [eax + eax*4]
push edx
shl eax, 3
mov dword [esp + 0x2c], eax
jmp 0x40f447
mov ecx, dword [esi + 4]
lea eax, [esp + 0x1c]
push 4
push eax
push 0x1006
push 0xffff
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov edx, dword [esi + 4]
push 0
push ebp
push ebx
push edx
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
jne 0x40f471
mov ecx, esi
call fcn.0040f0f0
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 0xc
pop edi
pop esi
mov byte [eax + ebx], 0
pop ebp
pop ebx
ret 0xc

Function at 0x40f480
Capabilities:
Connect socket
Set socket configuration

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x28]
push ebx
push esi
push edi
mov esi, ecx
push eax
mov word [esp + 0x20], 2
call dword [sym.imp.WSOCK32.dll_htons]
mov edi, dword [esp + 0x30]
mov ebx, dword [sym.imp.WSOCK32.dll_inet_addr]
push edi
mov word [esp + 0x22], ax
call ebx
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
jne 0x40f4ff
xor ecx, ecx
lea edx, [esp + 0xc]
mov dword [esp + 0xd], ecx
push edi
mov dword [esp + 0x15], ecx
push edx
mov dword [esp + 0x1d], ecx
mov byte [esp + 0x14], 0
mov word [esp + 0x21], cx
mov byte [esp + 0x23], cl
mov ecx, esi
call fcn.0040f230
test eax, eax
jne 0x40f4f4
mov ecx, esi
call fcn.0040f0f0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret 8
lea eax, [esp + 0xc]
push eax
call ebx
mov dword [esp + 0x20], eax
mov edx, dword [esi + 4]
lea ecx, [esp + 0x1c]
push 0x10
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
jne 0x40f527
mov ecx, esi
call fcn.0040f0f0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret 8
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20
ret 8
Function at 0x40f980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40f9c3
push 0x418a74
push esi
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
test eax, eax
jne 0x40f9a8
pop esi
ret 4
push eax
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push esi
push 0x41b408
push str.List
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
mov eax, 1
pop esi
ret 4

Function at 0x40f9f0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
xor eax, eax
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov edi, dword [esp + 0x11c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40facd
mov ecx, ebp
call fcn.0040f9d0
mov edx, eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
xor ebx, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
test edx, edx
mov dword [esp + 0x10], edx
stosb byte es:[edi], al
jle 0x40facd
mov esi, dword [esp + 0x120]
push ebx
push str.PROC_d
push esi
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [ebp]
add esp, 0xc
lea ecx, [esp + 0x14]
push eax
push 0x104
push ecx
push 0x41b408
push esi
push str.List
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40fa96
mov eax, dword [esp + 0x124]
test eax, eax
je 0x40fa96
mov dword [eax], 1
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40fac0
mov edx, dword [esp + 0x11c]
lea eax, [esp + 0x14]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x40fadc
mov eax, dword [esp + 0x10]
inc ebx
cmp ebx, eax
jl 0x40fa46
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret 0xc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x108
ret 0xc
Function at 0x40faf0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x134
xor eax, eax
push ebx
mov ebx, dword [esp + 0x13c]
push ebp
push esi
mov ebp, ecx
push edi
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40fb1e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x134
ret 0xc
mov esi, dword [esp + 0x14c]
lea eax, [esp + 0x1c]
push eax
push esi
push ebx
mov ecx, ebp
mov dword [esp + 0x28], 0
call fcn.0040f9f0
cmp eax, 1
je 0x40fc30
mov ecx, ebp
call fcn.0040f9d0
mov dword [esp + 0x10], eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 4
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
jne 0x40fb7b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x134
ret 0xc
mov ecx, dword [esp + 0x150]
mov edx, dword [ecx]
push edx
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
push 0x41a61c
push eax
call ebx
mov eax, dword [esp + 0x2c]
add esp, 0x10
cmp eax, 1
jne 0x40fc73
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x41]
mov byte [esp + 0x40], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
test eax, eax
jle 0x40fc23
mov eax, dword [esp + 0x18]
push eax
push str.PROC_d
push esi
call ebx
mov ecx, dword [ebp]
add esp, 0xc
lea edi, [esp + 0x40]
xor eax, eax
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x44]
push ecx
push edx
push 0x41b408
push esi
push str.List
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40fc42
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x40fbc9
mov edx, dword [esp + 0x14]
push edx
call fcn.00414922
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x134
ret 0xc
mov eax, dword [ebp]
mov edi, dword [esp + 0x14]
push eax
push edi
push esi
push str.List
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
push edi
jne 0x40fc28
call fcn.00414922
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x134
ret 0xc
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x20]
inc ecx
stosw word es:[edi], ax
push ecx
push 0x41851c
push edx
stosb byte es:[edi], al
call ebx
mov eax, dword [ebp]
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 0xc
lea ecx, [esp + 0x20]
push eax
push ecx
push str.Count
push str.List
call edi
test eax, eax
jne 0x40fcd8
mov edx, dword [esp + 0x14]
push edx
call fcn.00414922
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x134
ret 0xc
mov eax, dword [esp + 0x10]
push eax
push str.PROC_d
push esi
call ebx
mov ecx, dword [ebp]
mov ebx, dword [esp + 0x20]
add esp, 0xc
push ecx
push ebx
push esi
push str.List
call edi
test eax, eax
jne 0x40fc23
push ebx
call fcn.00414922
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x134
ret 0xc