joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404c95
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push dword [esp + 0x18]
call fcn.004167ec
lea ecx, [esi + 0x24]
call fcn.004162ef
lea ecx, [esi + 0x30]
call fcn.004162ef
lea ecx, [esi + 0x3c]
call fcn.004162ef
lea ecx, [esi + 0x48]
call fcn.004162ef
lea ecx, [esi + 0x54]
call fcn.004162ef
lea edi, [esi + 0x60]
mov ecx, edi
call fcn.0040b596
push 1
mov dword [esi], 0x41b4a4
pop eax
mov dword [edi], eax
push 0x9c8
mov dword [esi + 0x64], eax
call fcn.00416ff4
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x404d0c
mov edx, dword [esp + 0x14]
mov ecx, eax
push edx
mov dword [esi + 0xa0], edx
push dword [esp + 0x14]
call fcn.004019bf
jmp 0x404d0e
xor eax, eax
push 0x8c
mov dword [esi + 0x98], eax
call fcn.00416ff4
cmp eax, ebx
pop ecx
je 0x404d3c
push dword [esi + 0x98]
mov ecx, eax
push dword [esi + 0xa0]
push dword [esp + 0x18]
call fcn.0040c522
jmp 0x404d3e
xor eax, eax
mov dword [esi + 0x8c], eax
cmp dword [eax + 8], ebx
jne 0x404d56
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esi + 0x98]
call fcn.00401a40
push 0x38
call fcn.00416ff4
cmp eax, ebx
pop ecx
je 0x404d7e
push ebx
push edi
push dword [esi + 0x98]
mov ecx, eax
call fcn.00413360
jmp 0x404d80
xor eax, eax
push 0x30
mov dword [esi + 0x7c], eax
call fcn.00416ff4
cmp eax, ebx
pop ecx
je 0x404d99
push ebx
mov ecx, eax
call fcn.00409b6b
jmp 0x404d9b
xor eax, eax
push 0x40
mov dword [esi + 0x80], eax
call fcn.00416ff4
cmp eax, ebx
pop ecx
je 0x404dbd
push esi
mov ecx, eax
push dword [esi + 0x98]
call fcn.0040a08d
jmp 0x404dbf
xor eax, eax
push 4
mov dword [esi + 0x88], eax
call fcn.00416ff4
cmp eax, ebx
pop ecx
je 0x404de0
push dword [esi + 0x98]
mov ecx, eax
call fcn.004048bf
jmp 0x404de2
xor eax, eax
push 0x1c
mov dword [esi + 0x90], eax
call fcn.00416ff4
cmp eax, ebx
pop ecx
je 0x404e01
push 0x10
push 0x64
mov ecx, eax
call fcn.00416364
jmp 0x404e03
xor eax, eax
push 0x14
mov dword [esi + 0x9c], eax
call fcn.00416ff4
cmp eax, ebx
pop ecx
je 0x404e24
push dword [esi + 0x98]
mov ecx, eax
call fcn.004139c9
jmp 0x404e26
xor eax, eax
lea edi, [esi + 0x94]
push 0x168
mov dword [edi], eax
call fcn.00416ff4
cmp eax, ebx
pop ecx
je 0x404e4f
push ebx
mov ecx, eax
push dword [esi + 0x98]
push dword [edi]
call fcn.0041486b
jmp 0x404e51
xor eax, eax
mov dword [esi + 0x84], eax
push 0xc0
lea eax, [esi + 0xc8]
push ebx
push eax
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
call fcn.00417010
add esp, 0xc
mov ecx, esi
mov dword [esi + 0x188], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], 1
call fcn.004087e4
push 0x7c
push dword [0x4222ac]
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov dword [esi + 0x14], eax
mov eax, esi
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x406191
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 3
push bind
mov edi, ecx
push dword [ebp + 8]
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, dword [ebp + 0xc]
cmp eax, 0xffffffff
mov dword [esi + 0x34], eax
je 0x406282
lea ecx, [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp + 8]
xor ecx, ecx
xor ebx, ebx
or ecx, eax
or edx, ebx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
mov ecx, dword [esi + 0x20]
or ecx, edx
jne 0x4061f3
push 1
pop eax
jmp 0x40628a
push 0
push eax
push dword [ebp + 8]
push 2
push 0
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 0x38], eax
mov ecx, dword [edi + 0x98]
mov edi, dword [esi + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x314]
cdq
cmp dword [esi + 0x24], edx
jl 0x40622c
jg 0x406227
cmp edi, eax
jbe 0x40622c
mov dword [ebp + 0xc], eax
jmp 0x40622f
mov dword [ebp + 0xc], edi
mov edi, dword [esi + 0x2c]
mov eax, edi
mov dword [ebp + 8], edi
mov ebx, dword [ecx + 0x314]
sar eax, 0x1f
mov eax, ebx
cdq
push edx
push eax
push edi
push dword [esi + 0x28]
call fcn.00417880
imul eax, ebx
push dword [ebp + 0xc]
push eax
push edi
push 4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0x30], eax
je 0x406282
push 1
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x406282
mov ecx, dword [ebp - 8]
push esi
call fcn.00406291
xor eax, eax
jmp 0x40628a
xor eax, eax
cmp dword [esi + 0x30], eax
setne al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x406966
Capabilities:
Check for time delay via gettickcount
Read and send data from client to server
Read file via mapping
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
mov dword [ebp - 4], edi
je 0x406aca
cmp dword [esi + 0x34], 0xffffffff
je 0x406aca
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x20]
and dword [ebp + 8], 0
mov edx, dword [esi + 0x2c]
mov ebx, dword [esi + 0x24]
sub eax, ecx
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x98]
sbb ebx, edx
mov edi, dword [eax + 0x318]
mov eax, edi
cdq
push edx
push eax
push dword [esi + 0x2c]
push ecx
call fcn.00417930
sub edi, eax
test ebx, ebx
jl 0x406a1c
jg 0x4069c8
cmp dword [ebp - 0xc], 0
jbe 0x406a1c
mov eax, edi
cdq
cmp ebx, edx
jl 0x4069db
jg 0x4069d6
cmp dword [ebp - 0xc], eax
jbe 0x4069db
mov dword [ebp - 8], edx
jmp 0x4069e1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], ebx
push 0
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x98]
mov eax, dword [eax + 0x314]
cdq
push edx
push eax
push dword [esi + 0x2c]
push dword [esi + 0x28]
call fcn.00417930
add eax, dword [esi + 0x30]
push eax
mov eax, dword [esi + 8]
push dword [eax + 8]
call dword [sym.imp.WSOCK32.dll_send]
test eax, eax
mov dword [ebp + 8], eax
jl 0x406aca
mov eax, dword [ebp + 8]
cdq
add dword [esi + 0x28], eax
adc dword [esi + 0x2c], edx
mov ecx, dword [esi + 0x28]
cmp ecx, dword [esi + 0x20]
mov edi, dword [esi + 0x2c]
jne 0x406a47
cmp edi, dword [esi + 0x24]
jne 0x406a47
xor eax, eax
cmp dword [esi + 0x18], 0x62
setne al
add eax, 7
mov dword [esi + 0x48], eax
jmp 0x406ab9
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x98]
mov eax, dword [eax + 0x314]
cdq
push edx
push eax
push edi
push ecx
call fcn.00417930
or eax, edx
jne 0x406ab9
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esi + 0x28]
mov edi, dword [esi + 0x20]
mov edx, dword [esi + 0x2c]
mov ecx, dword [esi + 0x24]
sub edi, eax
mov eax, dword [ebx + 0x98]
sbb ecx, edx
mov eax, dword [eax + 0x314]
cdq
cmp ecx, edx
jl 0x406a99
jg 0x406a94
cmp edi, eax
jbe 0x406a99
mov dword [ebp - 8], edx
jmp 0x406a9e
mov eax, edi
mov dword [ebp - 8], ecx
push eax
mov eax, dword [esi + 0x2c]
push dword [esi + 0x28]
mov ecx, eax
sar ecx, 0x1f
push eax
push 4
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 8]
push 1
mov dword [ecx + 0x20], eax
pop eax
jmp 0x406acc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x407477
Capabilities:
Set socket configuration

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
mov esi, ecx
je 0x4074d2
mov eax, dword [esi + 0x24]
lea ebx, [esi + 0x24]
mov ecx, ebx
call dword [eax + 4]
mov edi, eax
add eax, 0xffffffd0
neg edi
sbb edi, edi
and edi, eax
je 0x4074d2
mov eax, dword [esp + 0x10]
cmp dword [edi + 0x44], eax
jne 0x4074b0
mov ecx, edi
call fcn.004129a2
cmp eax, 1
jne 0x407512
mov eax, dword [ebx]
mov ecx, edi
add edi, 0x30
neg ecx
sbb ecx, ecx
and ecx, edi
push ecx
mov ecx, ebx
call dword [eax + 8]
mov ecx, eax
add eax, 0xffffffd0
neg ecx
sbb ecx, ecx
and ecx, eax
mov edi, ecx
jne 0x40749b
push 0x8304
call fcn.00416ff4
xor ebx, ebx
pop ecx
cmp eax, ebx
je 0x40751e
push dword [esp + 0x14]
lea ecx, [esi + 0x60]
push dword [esp + 0x14]
push dword [esi + 0x90]
push dword [esi + 0x98]
push ecx
mov ecx, eax
push dword [esi + 0x94]
push dword [esi + 0x8c]
call fcn.0040fbc2
mov edi, eax
jmp 0x407520
push 1
push edi
mov ecx, esi
call fcn.004088fa
jmp 0x40758c
xor edi, edi
cmp edi, ebx
jne 0x407528
xor eax, eax
jmp 0x40758f
mov eax, dword [esi + 0x24]
lea ecx, [esi + 0x24]
lea edx, [edi + 0x30]
push edx
call dword [eax]
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 0xe4]
mov eax, dword [edi]
push 0xa
mov ecx, edi
call dword [eax + 4]
push 1
push edi
mov ecx, esi
call fcn.0040980a
cmp dword [esi + 0x6c], ebx
jne 0x40758c
mov eax, dword [esi + 0x98]
cmp dword [eax + 0x390], ebx
jne 0x40758c
mov ax, word [esi + 0xa0]
push 1
push eax
call dword [sym.imp.WSOCK32.dll_htons]
movzx eax, ax
push eax
push 0x420c40
call dword [sym.imp.WSOCK32.dll_inet_addr]
push eax
mov ecx, esi
call fcn.0040827d
push 1
pop eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x4084ee
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [ebp + 8]
add eax, 0x84
push 7
mov ebx, ecx
push eax
call fcn.0040c46a
xor edi, edi
add esp, 0xc
cmp eax, edi
je 0x4086fd
push eax
call fcn.004176b7
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
push 7
push edi
call fcn.0040c46a
add esp, 0x10
cmp eax, edi
je 0x4086fd
push eax
call fcn.004176b7
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
xor esi, esi
push 7
push edi
mov dword [ebp - 8], esi
call fcn.0040c46a
add esp, 0x10
cmp eax, edi
je 0x408690
jmp 0x408567
mov esi, dword [ebp - 8]
push 0x32
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0040b2aa
lea eax, [ebp - 4]
push eax
push 7
push edi
call fcn.0040c46a
add esp, 0x18
cmp eax, edi
je 0x408690
push 0x32
push eax
lea eax, [ebp - 0x52]
push eax
call fcn.0040b2aa
lea eax, [ebp - 4]
push eax
push 7
push edi
call fcn.0040c46a
add esp, 0x18
cmp eax, edi
je 0x408690
push eax
call fcn.0041762c
mov esi, eax
lea eax, [ebp - 4]
push eax
push 7
push edi
and esi, 0xffffff00
call fcn.0040c46a
add esp, 0x10
cmp eax, edi
je 0x40868d
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 4]
push eax
push 7
push edi
call fcn.0040c46a
add esp, 0xc
cmp eax, edi
je 0x40868d
push eax
call fcn.004176b7
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
push eax
push 7
push edi
call fcn.0040c46a
add esp, 0x10
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x40868d
push 0x420ca0
push eax
call fcn.004173b0
pop ecx
test eax, eax
pop ecx
jne 0x40862d
mov dword [ebp - 0xc], 0x422120
lea eax, [ebp - 4]
push eax
push 7
push edi
call fcn.0040c46a
add esp, 0xc
cmp eax, edi
mov dword [ebp - 0x18], eax
je 0x40868d
push 0x420ca0
push eax
call fcn.004173b0
pop ecx
test eax, eax
pop ecx
jne 0x40865b
mov dword [ebp - 0x18], 0x422120
push dword [ebp - 0x18]
or esi, 1
lea eax, [ebp - 0x84]
mov ecx, ebx
push dword [ebp - 0xc]
push esi
push eax
call fcn.00407a5d
inc dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 7
push edi
call fcn.0040c46a
add esp, 0xc
cmp eax, edi
jne 0x408564
mov esi, dword [ebp - 8]
cmp dword [ebp - 0x14], edi
jne 0x4086b9
cmp esi, dword [ebp - 0x10]
jl 0x4086b9
mov eax, dword [ebx + 0x98]
mov dword [ebx + 0xac], edi
cmp dword [eax + 0x390], edi
je 0x4086fd
push 1
mov ecx, ebx
call fcn.004080e3
jmp 0x4086fd
sub esi, dword [ebp - 0x10]
add esi, dword [ebp - 0x14]
push esi
call fcn.00417c77
pop ecx
mov ecx, dword [ebx + 0x8c]
push eax
push 0x12
push dword [ebp + 8]
call fcn.0040c8b8
mov eax, dword [ebx + 0x98]
push edi
mov esi, 0x105
push dword [eax + 0x394]
push esi
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
je 0x4086fd
mov dword [ebx + 0xb0], esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x408704
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x3c
lea eax, [ebp - 0x3c]
push 0
mov esi, ecx
push eax
call fcn.00417010
mov eax, dword [esi + 0x98]
and dword [ebp - 0x34], 0
add eax, 0x68
add esp, 0xc
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x408756
cmp dword [ebp - 0x1c], 0x1f
jg 0x408788
cmp dword [ebp - 0x1c], 0x1b
je 0x408772
cmp dword [ebp - 0x1c], 0x1f
je 0x408772
mov eax, dword [esi]
push 0
push 0x42085c
push 0x420cd0
jmp 0x408780
mov eax, dword [esi]
push 0
push 0x42085c
push 0x420cb0
mov ecx, esi
call dword [eax + 0x90]
pop esi
leave
ret
Function at 0x4089a3
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [ebx + 0x98]
push esi
xor esi, esi
push edi
mov dword [eax + 0x294], esi
mov eax, dword [ebx + 0x98]
push 0x420e78
mov dword [eax + 0x2ac], esi
call ebp
mov edi, eax
cmp edi, esi
jne 0x4089e8
push esi
push 0x420e6c
call fcn.0040bdfb
pop ecx
pop ecx
jmp 0x408bff
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420e54
push edi
call esi
push 0x420e44
push edi
mov dword [0x422148], eax
call esi
push 0x420e30
push edi
mov dword [0x42213c], eax
call esi
push 0x420e1c
push edi
mov dword [0x422218], eax
call esi
push 0x420e0c
push edi
mov dword [0x422228], eax
call esi
push 0x420dfc
push edi
mov dword [0x422128], eax
call esi
push 0x420dec
push edi
mov dword [0x42212c], eax
call esi
push 0x420de0
push edi
mov dword [0x42221c], eax
call esi
push 0x420dd0
push edi
mov dword [0x422124], eax
call esi
push 0x420dc0
push edi
mov dword [0x42222c], eax
call esi
push 0x420db0
push edi
mov dword [0x422130], eax
call esi
push 0x420da0
push edi
mov dword [0x422224], eax
call esi
push 0x420d90
push edi
mov dword [0x422220], eax
call esi
push 0x420d80
push edi
mov dword [0x422144], eax
call esi
push 0x420d68
push edi
mov dword [0x422138], eax
call esi
push 0x420d54
push edi
mov dword [0x422134], eax
call esi
push 0x420d48
mov dword [0x422140], eax
call ebp
mov edi, eax
xor ebp, ebp
cmp edi, ebp
je 0x408ae7
push 0x420d34
push edi
call esi
push 0x420d20
push edi
mov dword [0x422214], eax
call esi
mov dword [0x422230], eax
cmp dword [0x422214], ebp
push 3
pop edi
jne 0x408b04
mov eax, dword [ebx + 0x98]
add eax, 0x2c8
cmp dword [eax], 2
jne 0x408b04
mov dword [eax], edi
cmp dword [0x422148], ebp
push ebp
jne 0x408b17
push 0x420d0c
jmp 0x4089dc
mov ecx, ebx
call fcn.00408c0b
xor esi, esi
mov eax, dword [ebx + 0x98]
mov ecx, dword [eax + 0x2ac]
cmp ecx, ebp
je 0x408b38
cmp dword [eax + 0x2b0], ebp
je 0x408b48
cmp dword [eax + 0x294], ebp
je 0x408bac
cmp dword [eax + 0x298], ebp
jne 0x408bac
inc esi
cmp esi, edi
jg 0x408bc6
cmp ecx, ebp
je 0x408b65
push ebp
push ecx
call dword [0x422140]
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x2ac], ebp
mov eax, dword [ebx + 0x98]
mov eax, dword [eax + 0x294]
cmp eax, ebp
je 0x408b89
push ebp
push eax
call dword [0x422140]
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x294], ebp
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, edi
jne 0x408b9d
push 2
pop eax
jmp 0x408b9f
xor eax, eax
push eax
mov ecx, ebx
call fcn.00408c0b
jmp 0x408b20
cmp esi, edi
jg 0x408bc6
mov eax, dword [ebx + 0x98]
cmp dword [eax + 0x2b0], ebp
jne 0x408be9
cmp dword [eax + 0x298], ebp
jne 0x408be9
mov eax, dword [ebx]
push 1
push 0x42085c
push 0x420cec
mov ecx, ebx
call dword [eax + 0x90]
cmp eax, 1
jne 0x408be9
push edi
mov ecx, ebx
call fcn.00408c0b
mov ebx, dword [ebx + 0x98]
cmp dword [ebx + 0x2b0], ebp
jne 0x408c03
cmp dword [ebx + 0x298], ebp
jne 0x408c03
xor eax, eax
jmp 0x408c06
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40bb90
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x954
mov dl, byte [0x422120]
push ebx
push esi
mov esi, ecx
mov ebx, 0xff
push edi
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x553]
mov byte [ebp - 0x554], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x953]
mov byte [ebp - 0x954], dl
rep stosd dword es:[edi], eax
and dword [ebp - 4], 0
add ebx, 5
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x40bc14
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x554]
push ecx
push 0x400
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x40bc14
mov eax, dword [ebp - 4]
test eax, eax
je 0x40bc14
and byte [eax - 1], 0
push ebx
push dword [ebp - 4]
lea eax, [ebp - 0x954]
jmp 0x40bc24
cmp dword [ebp + 0x14], 0
je 0x40bc2d
push ebx
lea eax, [ebp - 0x554]
push dword [ebp + 0x14]
push eax
call fcn.0040b2aa
add esp, 0xc
push 0x4c
lea eax, [ebp - 0x50]
pop edi
push edi
push 0
push eax
call fcn.00417010
mov eax, dword [esi]
add esp, 0xc
test eax, eax
mov dword [ebp - 0x50], edi
je 0x40bc50
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x4c], eax
jmp 0x40bc54
and dword [ebp - 0x4c], 0
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov dword [ebp - 0x44], eax
mov edi, 0x400
test eax, eax
lea eax, [ebp - 0x954]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x554]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 4]
setne cl
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x38], ecx
neg eax
sbb eax, eax
and eax, 0x20
or eax, 0x80004
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x40bcb5
cmp eax, 1
je 0x40bcb5
cmp eax, 3
jne 0x40bcb1
mov eax, 0x100000
jmp 0x40bcc6
xor eax, eax
jmp 0x40bcc6
dec eax
neg eax
sbb eax, eax
and ax, 0xfe00
add eax, 0x200
or ah, 0x10
or dword [ebp - 0x1c], eax
lea eax, [ebp - 0x154]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [esi + 8]
test eax, eax
je 0x40bcee
cmp eax, 1
je 0x40bcee
lea eax, [ebp - 0x50]
push eax
call sub.comdlg32.dll_GetSaveFileNameA
jmp 0x40bcf7
lea eax, [ebp - 0x50]
push eax
call sub.comdlg32.dll_GetOpenFileNameA
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp dword [ebp + 0x10], 0
je 0x40bd4d
cmp dword [esi + 8], 1
jne 0x40bd25
lea eax, [ebp - 0x954]
push edi
push eax
push dword [ebp + 8]
call fcn.00417070
jmp 0x40bd31
push ebx
push dword [ebp - 0x34]
push dword [ebp + 8]
call fcn.0040b2aa
add esp, 0xc
cmp dword [ebp + 0x14], 0
je 0x40bd4d
movzx eax, word [ebp - 0x18]
push eax
push dword [ebp - 0x34]
push dword [ebp + 0x14]
call fcn.0040b2aa
add esp, 0xc
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40c4c3
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40c4ec
push esi
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x40c4ee
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x40c4ec
mov eax, dword [eax + 0xc]
pop esi
mov eax, dword [eax]
mov eax, dword [eax]
ret
xor eax, eax
pop esi
ret

Function at 0x40c522
Capabilities:
Get hostname
Get session user name
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
mov esi, ecx
push edi
and dword [esi + 8], 0
call fcn.0040c0b5
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
or dword [esi + 4], 0xffffffff
or dword [esi], 0xffffffff
and dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov dword [esi + 0x84], edi
call dword [sym.imp.WSOCK32.dll_htons]
movzx eax, ax
mov dword [esi + 0x88], eax
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov dword [esi + 0x10], eax
test eax, eax
setne cl
push ecx
mov ecx, esi
call fcn.0040c62b
test eax, eax
je 0x40c61d
push 0x32
lea ecx, [ebp - 4]
pop ebx
lea eax, [esi + 0x52]
push ecx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x40c5a6
push eax
push 0x421238
call fcn.0040bdfb
pop ecx
pop ecx
jmp 0x40c61d
test edi, edi
jne 0x40c5f1
lea eax, [ebp - 0x404]
push 0x400
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x40c5d3
lea eax, [esi + 0x52]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.00417440
pop ecx
pop ecx
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x40c5f1
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esi + 0x84], eax
lea eax, [ebp - 4]
lea edi, [esi + 0x20]
push eax
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp eax, 1
je 0x40c616
push ebx
push 0x42122c
push edi
call fcn.0040b2aa
add esp, 0xc
mov dword [esi + 8], 1
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40c62b
Capabilities:
Initialize winsock library
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
push ebx
push esi
lea eax, [ebp - 0x1ac]
push edi
push eax
mov esi, ecx
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
test eax, eax
push 0
je 0x40c662
push 0x421358
call fcn.0040be54
pop ecx
pop ecx
jmp 0x40c858
mov edi, dword [sym.imp.WSOCK32.dll_socket]
push 2
pop ebx
push ebx
push ebx
call edi
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x40c67f
push 0
push 0x421330
jmp 0x40c656
push 1
pop eax
cmp dword [ebp + 8], eax
jne 0x40c85f
push 0
push eax
push ebx
call edi
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x40c6a2
push 0
push 0x421304
jmp 0x40c656
push 0x10
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00417010
mov eax, dword [esi + 0x84]
mov edi, dword [sym.imp.WSOCK32.dll_bind]
mov dword [ebp - 0x18], eax
mov ax, word [esi + 0x88]
add esp, 0xc
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x1c]
mov word [ebp - 0x1c], bx
push 0x10
push eax
push dword [esi]
call edi
test eax, eax
je 0x40c6ea
push 0
push 0x4212fc
jmp 0x40c656
lea eax, [ebp - 0x1c]
push 0x10
push eax
push dword [esi + 4]
call edi
test eax, eax
je 0x40c714
push dword [esi + 4]
call dword [sym.imp.WSOCK32.dll_closesocket]
or dword [esi + 4], 0xffffffff
push 0
push 0x4212dc
call fcn.0040be54
pop ecx
pop ecx
mov edi, dword [sym.imp.WSOCK32.dll_ioctlsocket]
lea eax, [ebp - 4]
mov ebx, 0x8004667e
push eax
push ebx
mov dword [ebp - 4], 1
push dword [esi]
call edi
test eax, eax
je 0x40c73f
push 0
push 0x4212c4
jmp 0x40c656
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x40c75f
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
call edi
test eax, eax
je 0x40c75f
push 0
push 0x4212a8
jmp 0x40c656
mov edi, dword [sym.imp.WSOCK32.dll_setsockopt]
lea eax, [ebp - 4]
push 4
push eax
mov ebx, 0xffff
push 0x20
push ebx
mov dword [ebp - 4], 1
push dword [esi]
call edi
test eax, eax
je 0x40c78e
push 0
push 0x421290
jmp 0x40c656
lea eax, [ebp - 0xc]
push 4
push eax
push 0x1001
push ebx
mov dword [ebp - 0xc], 0x10000
push dword [esi]
mov dword [ebp - 8], 0x8000
call edi
test eax, eax
je 0x40c7d2
lea eax, [ebp - 8]
push 4
push eax
push 0x1001
push ebx
push dword [esi]
call edi
test eax, eax
je 0x40c7d2
push 0
push 0x42127c
call fcn.0040be54
pop ecx
pop ecx
lea eax, [ebp - 0xc]
push 4
push eax
push 0x1002
push ebx
mov dword [ebp - 0xc], 0x10000
push dword [esi]
mov dword [ebp - 8], 0x8000
call edi
test eax, eax
je 0x40c816
lea eax, [ebp - 8]
push 4
push eax
push 0x1002
push ebx
push dword [esi]
call edi
test eax, eax
je 0x40c816
push 0
push 0x421268
call fcn.0040be54
pop ecx
pop ecx
mov eax, dword [esi + 4]
mov dword [ebp - 4], 1
cmp eax, 0xffffffff
je 0x40c843
lea ecx, [ebp - 4]
push 4
push ecx
push 4
push ebx
push eax
call edi
test eax, eax
je 0x40c843
push 0
push 0x42124c
call fcn.0040be54
pop ecx
pop ecx
mov esi, dword [esi + 4]
cmp esi, 0xffffffff
je 0x40c85c
push 5
push esi
call dword [sym.imp.WSOCK32.dll_listen]
test eax, eax
je 0x40c85c
xor eax, eax
jmp 0x40c85f
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4