joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4094d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and byte [ebp - 4], 0
mov byte [ebp - 0x10], 0x52
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 7], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 9], 0x4d
mov byte [ebp - 6], 0x65
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 8], 0x75
mov byte [ebp - 5], 0x78
call fcn.004072ad
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x409529
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.0040727e
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x409546
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and byte [ebp - 1], 0
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0xf], 0x6f
mov byte [ebp - 0xa], 0x67
mov byte [ebp - 5], 0x6a
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 9], 0x6c
mov byte [ebp - 4], 0x65
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xd], 0x53
mov byte [ebp - 8], 0x65
mov byte [ebp - 3], 0x63
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 7], 0x4f
mov byte [ebp - 2], 0x74
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 6], 0x62
call fcn.004072ad
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4095b5
or eax, 0xffffffff
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0040727e
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x409bde
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [0x41f5fc], 1
push esi
mov byte [ebp - 0x20], 0x4d
mov byte [ebp - 0x1f], 0x75
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x78
mov byte [ebp - 0x1b], 0x4f
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x19], 0x53
mov byte [ebp - 0x18], 0x6f
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 0x13], 0x67
mov byte [ebp - 0x12], 0x50
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xe], bl
jne 0x409cb4
push 0x14
push 0x40
call fcn.00409d2c
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x409ca6
push 1
push esi
call fcn.00409e17
pop ecx
test eax, eax
pop ecx
je 0x409c6c
push ebx
push ebx
push 1
push esi
call fcn.00409f21
add esp, 0x10
test eax, eax
jne 0x409c75
push esi
call fcn.00409cbb
pop ecx
jmp 0x409ca6
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], 0xc
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
call fcn.00409da4
push esi
mov dword [0x41f600], eax
call fcn.00409cbb
add esp, 0x10
cmp dword [0x41f600], ebx
jne 0x409caa
xor eax, eax
jmp 0x409cb7
mov dword [0x41f5fc], 2
push 1
pop eax
pop esi
pop ebx
leave
ret
Function at 0x409cbb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0040727e
and byte [ebp - 0xb], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x4c
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x72
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x6c
call fcn.004072ad
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x409d0f
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0040727e
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x409d2c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0040727e
and byte [ebp - 0xa], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x4c
mov byte [ebp - 0xf], 0x41
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xb], 0x63
call fcn.004072ad
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x409d84
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0040727e
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x409da4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and byte [ebp - 4], 0
mov byte [ebp - 0x10], 0x43
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xa], 0x4d
mov byte [ebp - 7], 0x65
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 9], 0x75
mov byte [ebp - 6], 0x78
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 8], 0x74
mov byte [ebp - 5], 0x41
call fcn.004072ad
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x409df4
leave
ret
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.0040727e
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x409e17
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 4], 0
mov byte [ebp - 0x20], 0x49
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x61
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x69
mov byte [ebp - 0x18], 0x7a
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x53
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x63
mov byte [ebp - 0x13], 0x75
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x69
mov byte [ebp - 0x10], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xe], 0x44
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x69
mov byte [ebp - 8], 0x70
mov byte [ebp - 7], 0x74
mov byte [ebp - 6], 0x6f
mov byte [ebp - 5], 0x72
call fcn.00409ecc
lea eax, [ebp - 0x20]
push eax
push dword [0x41f5e0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x409eac
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1d
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.0040727e
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x409f21
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 7], 0
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x1d], 0x53
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x63
mov byte [ebp - 0x1a], 0x75
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0x18], 0x69
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x79
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x63
mov byte [ebp - 0x11], 0x72
mov byte [ebp - 0x10], 0x69
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x63
mov byte [ebp - 8], 0x6c
call fcn.00409ecc
lea eax, [ebp - 0x20]
push eax
push dword [0x41f5e0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x409faa
leave
ret
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1d
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.0040727e
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x409fd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 1
pop edi
xor ebx, ebx
cmp dword [0x41f5f8], edi
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0xe], 0x53
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x56
mov byte [ebp - 0xa], 0x58
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
jne 0x40a04c
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.004092bd
add esp, 0x1c
cmp eax, 0xffffffff
mov dword [0x41f5f8], eax
jne 0x40a04c
mov eax, 0x7532
jmp 0x40a103
cmp dword [0x41f5e8], ebx
jne 0x40a0a9
xor esi, esi
push dword [ebp + 0x10]
push 0x41f5f8
push dword [ebp + 8]
call fcn.0040a165
add esp, 0xc
cmp eax, ebx
je 0x40a085
cmp eax, 0x6688
jne 0x40a091
push 0x1f4
call fcn.0040a108
inc esi
pop ecx
cmp esi, 3
jl 0x40a056
cmp esi, 3
jne 0x40a0a9
mov esi, 0x4f1a
jmp 0x40a093
mov esi, eax
push dword [0x41f5f8]
call fcn.004093e6
pop ecx
mov dword [0x41f5f8], edi
mov eax, esi
jmp 0x40a103
push dword [ebp + 8]
push dword [ebp + 0x10]
call fcn.00407312
lea eax, [ebp - 4]
push ebx
push eax
push 0x80
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
push 5
push dword [0x41f5f8]
call fcn.00409348
add esp, 0x28
test eax, eax
je 0x40a0ec
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.004095d5
pop ecx
pop ecx
jmp 0x40a103
push dword [0x41f5f8]
call fcn.004093e6
pop ecx
mov dword [0x41f5f8], edi
call fcn.0040945f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40a4d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41f5f8]
push ebx
xor ebx, ebx
cmp eax, 1
mov byte [ebp - 0x14], 0x5c
mov byte [ebp - 0x13], 0x5c
mov byte [ebp - 0x12], 0x2e
mov byte [ebp - 0x11], 0x5c
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xf], 0x44
mov byte [ebp - 0xe], 0x53
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x56
mov byte [ebp - 0xa], 0x58
mov byte [ebp - 9], 0x44
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
jne 0x40a54f
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.004092bd
add esp, 0x1c
cmp eax, 0xffffffff
mov dword [0x41f5f8], eax
jne 0x40a54f
mov eax, 0x7532
jmp 0x40a59d
lea ecx, [ebp - 4]
push ebx
push ecx
push 0x80
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
push 5
push eax
call fcn.00409348
add esp, 0x20
test eax, eax
je 0x40a582
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.004095d5
pop ecx
pop ecx
jmp 0x40a59d
push dword [0x41f5f8]
call fcn.004093e6
pop ecx
mov dword [0x41f5f8], 1
call fcn.0040945f
pop ebx
leave
ret
Function at 0x40b00b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0040727e
and byte [ebp - 0xa], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x65
call fcn.004072ad
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40b063
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0040727e
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x40b080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0040727e
and byte [ebp - 9], 0
add esp, 0xc
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0xf], 0x6c
mov byte [ebp - 0xa], 0x63
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0xe], 0x41
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0x11], 0x62
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0xb], 0x6f
call fcn.004072ad
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40b0dc
leave
ret
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0040727e
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x40b0fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and byte [ebp - 4], 0
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x12], 0x44
mov byte [ebp - 0x1f], 0x65
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x1e], 0x74
mov byte [ebp - 0x10], 0x76
mov byte [ebp - 0x1d], 0x75
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0x1c], 0x70
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0x1b], 0x44
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0x1a], 0x69
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 0x19], 0x44
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 9], 0x6f
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 8], 0x4c
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 7], 0x69
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 6], 0x73
mov byte [ebp - 0x13], 0x79
mov byte [ebp - 5], 0x74
call fcn.0040b1af
test eax, eax
je 0x40b18e
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40b192
xor eax, eax
leave
ret
push esi
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1d
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.0040727e
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x40b1af
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0040727e
and byte [ebp - 8], 0
add esp, 0xc
cmp dword [0x41f5d8], 1
mov byte [ebp - 0x14], 0x73
mov byte [ebp - 0x11], 0x75
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xf], 0x61
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 9], 0x6c
jne 0x40b211
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x41f5d8], eax
push 0x14
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.0040727e
mov eax, dword [0x41f5d8]
add esp, 0xc
leave
ret

Function at 0x40b228
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and byte [ebp - 1], 0
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 4], 0x63
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x13], 0x75
mov byte [ebp - 0xb], 0x49
mov byte [ebp - 3], 0x65
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 2], 0x73
mov byte [ebp - 0x19], 0x75
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x18], 0x70
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x17], 0x44
mov byte [ebp - 0xf], 0x76
mov byte [ebp - 7], 0x72
mov byte [ebp - 0x16], 0x69
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x15], 0x45
mov byte [ebp - 0xd], 0x63
mov byte [ebp - 5], 0x61
call fcn.0040b1af
test eax, eax
je 0x40b2b6
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40b2ba
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x1c
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.0040727e
add esp, 0xc
mov eax, esi
pop esi
leave
ret
Function at 0x40b2e3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and byte [ebp - 4], 0
mov byte [ebp - 0x18], 0x53
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 6], 0x73
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x11], 0x47
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xa], 0x73
mov byte [ebp - 0x15], 0x75
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 9], 0x44
mov byte [ebp - 0x14], 0x70
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 8], 0x65
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 7], 0x76
call fcn.0040b1af
test eax, eax
je 0x40b35a
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, fcn.0040b2e3
test ecx, ecx
jne 0x40b35e
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x15
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.0040727e
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x40b41b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and byte [ebp - 4], 0
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x18], 0x76
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0x23], 0x65
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 0x21], 0x75
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 9], 0x74
mov byte [ebp - 0x20], 0x70
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 8], 0x61
mov byte [ebp - 0x1f], 0x44
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 7], 0x69
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 6], 0x6c
mov byte [ebp - 0x1d], 0x47
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 5], 0x41
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0xe], 0x61
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0xd], 0x63
call fcn.0040b1af
test eax, eax
je 0x40b4bd
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40b4c1
xor eax, eax
leave
ret
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
mov esi, eax
push 0x21
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0040727e
add esp, 0xc
mov eax, esi
pop esi
leave
ret

Function at 0x415e10
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0xffffffff
je 0x415e1e
mov al, 1
pop esi
ret 4
mov eax, dword [esp + 8]
push 0
push eax
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi], eax
setne al
pop esi
ret 4
Function at 0x415f60
Capabilities:
Connect socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x110
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ioctlsocket]
push esi
mov esi, ecx
lea eax, [esp + 8]
push edi
mov ecx, dword [esi]
push eax
mov edi, 1
push 0x8004667e
push ecx
mov dword [esp + 0x18], edi
call ebx
mov edx, dword [esp + 0x120]
mov eax, dword [esi]
push 0x10
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, dword [esi]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ecx
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x20]
mov edx, dword [esp + 0x124]
mov dword [esp + 0x14], eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push 0
push ecx
push 0
push 2
mov dword [esp + 0x24], edx
call dword [sym.imp.WS2_32.dll_select]
lea edx, [esp + 0xc]
mov edi, eax
mov eax, dword [esi]
push edx
push 0x8004667e
push eax
mov dword [esp + 0x18], 0
call ebx
test edi, edi
pop edi
pop esi
setg al
pop ebx
add esp, 0x110
ret 8

Function at 0x416060
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
push esi
mov esi, ecx
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x416102
push edi
mov dword [esp + 0x14], eax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x10], 1
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x120]
lea ecx, [esp + 8]
push ecx
push 0
lea edx, [esp + 0x18]
push 0
push edx
push 2
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
pop edi
jg 0x4160c8
xor eax, eax
pop esi
add esp, 0x10c
ret 0xc
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x114]
mov edx, dword [esi]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jge 0x416100
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
pop esi
neg eax
sbb eax, eax
add esp, 0x10c
ret 0xc
jne 0x416105
or eax, 0xffffffff
pop esi
add esp, 0x10c
ret 0xc

Function at 0x416110
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
push esi
mov esi, ecx
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x41612c
or eax, eax
pop esi
add esp, 0x10c
ret 0xc
push edi
mov dword [esp + 0x14], eax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x10], 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
push 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x128]
push 0
push edx
push 2
mov dword [esp + 0x20], eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
pop edi
jg 0x41617c
xor eax, eax
pop esi
add esp, 0x10c
ret 0xc
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x114]
mov edx, dword [esi]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jge 0x4161b6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
pop esi
neg eax
sbb eax, eax
and al, 0xfe
add esp, 0x10c
ret 0xc
jne 0x4161bd
mov eax, 0xfffffffd
pop esi
add esp, 0x10c
ret 0xc