joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401936
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
mov eax, 0x42285b
call fcn.0040e090
sub esp, 0x29c
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0xc]
mov dword [esi], method.CSyncObject.virtual_20
call fcn.00401000
xor edi, edi
lea ecx, [esi + 0x120]
mov dword [ebp - 4], edi
call fcn.00403dfd
lea ecx, [esi + 0x13c]
mov byte [ebp - 4], 1
call fcn.00402454
lea ecx, [esi + 0x9e8]
mov byte [ebp - 4], 2
call fcn.00408a82
lea ebx, [esi + 0xaf4]
push edi
push edi
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.0040cc92
mov edi, 0x105
lea eax, [esi + 0x7dd]
push edi
push 0
push eax
mov byte [ebp - 4], 4
mov dword [esi], fcn.00401b06
mov dword [esi + 8], 0x2710
call fcn.0040e5b0
push edi
lea eax, [esi + 0x8e2]
push 0
push eax
call fcn.0040e5b0
add esp, 0x18
mov ecx, ebx
call fcn.0040cfa6
dec edi
push edi
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0040e975
push edi
lea eax, [ebp - 0x118]
push str.LPLog
push eax
call fcn.0040e8ad
add esp, 0x18
lea eax, [ebp - 0x118]
mov ecx, ebx
push eax
call fcn.0040cf81
lea eax, [ebp - 0x2a8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x401a37
push 0x42c9a4
push esi
call fcn.00402344
pop ecx
pop ecx
push 0
call fcn.0040e7ba
lea eax, [esi + 0x6c8]
mov ecx, esi
push eax
call fcn.004018f3
lea eax, [esi + 0x6d8]
push eax
call fcn.00407503
pop ecx
mov dword [esi + 0x138], esi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], esi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x401baa
Capabilities:
Get common file path
Query environment variable
Set file attributes

Disassembly:
mov eax, 0x4228d4
call fcn.0040e090
sub esp, 0x3c
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp byte [eax], 0
je 0x401bfb
mov esi, 0x43244d
push 0x104
push esi
push eax
mov byte [0x4323cc], 1
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push esi
call fcn.0040e350
cmp byte [eax + 0x43244c], 0x5c
pop ecx
je 0x401c4a
push 0x42ca64
push esi
call fcn.0040e150
pop ecx
pop ecx
jmp 0x401c4a
and byte [0x4323cc], 0
mov esi, 0x43244d
push esi
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x48]
call fcn.0040c873
and dword [ebp - 4], 0
push 1
lea ecx, [ebp - 0x48]
call fcn.0040c8ca
push eax
push esi
call fcn.0040e150
push 0x42ca64
push esi
call fcn.0040e150
or dword [ebp - 4], 0xffffffff
add esp, 0x10
lea ecx, [ebp - 0x48]
call fcn.0040c8a8
mov ax, word [ebp + 0xc]
test ax, ax
jbe 0x401c5f
cmp ax, 8
mov word [0x432552], ax
jb 0x401c68
mov word [0x432552], 7
push ebx
push esi
call fcn.00406442
movzx eax, word [0x432552]
pop ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ebx, [edi + 0x7dd]
push esi
push ebx
call fcn.0040e140
lea esi, [edi + 0x8e2]
push ebx
push esi
call fcn.0040e140
push str.Download_
push esi
call fcn.0040e150
push esi
call fcn.00406442
push esi
push 0x432761
call fcn.0040e140
mov ax, word [edi + 0x6d4]
push 0x48
mov word [0x432866], ax
call fcn.0041b3a8
add esp, 0x28
mov dword [ebp + 0xc], eax
push 1
pop esi
pop ebx
test eax, eax
mov dword [ebp - 4], esi
je 0x401ce9
push esi
push str.LPSYNCG
mov ecx, eax
call fcn.0040d2ef
jmp 0x401ceb
xor eax, eax
or dword [ebp - 4], 0xffffffff
push 0x13c
mov dword [edi + 0x502c], eax
call fcn.0041b3a8
pop ecx
mov dword [ebp + 0xc], eax
test eax, eax
mov dword [ebp - 4], 2
je 0x401d28
push dword [edi + 0x502c]
mov ecx, eax
push esi
push str.LPMAPG
push 0x488
call fcn.0040cfec
jmp 0x401d2a
xor eax, eax
or dword [ebp - 4], 0xffffffff
push 0x4323e0
mov ecx, eax
mov dword [edi + 0x5030], eax
call fcn.0040d0d7
test al, al
jne 0x401d55
push str.CommandObj::StartWork___m_pcMap4G__WriteData_faild_
push edi
call fcn.00402344
pop ecx
xor eax, eax
pop ecx
jmp 0x401d57
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x404ac8
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov dword [esi + 0x94], eax
mov eax, dword [ebp + 0xc]
push 1
push ebx
push ebx
mov dword [esi + 0x98], eax
mov eax, dword [ebp + 0x10]
push ebx
push 1
push 2
mov dword [esi + 0x9c], eax
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
je 0x404c09
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea ecx, [ebp + 8]
push 4
push ecx
push 0x80
push 0xffff
push eax
mov word [ebp + 0xa], bx
mov word [ebp + 8], 1
call edi
lea eax, [ebp + 0xc]
push 4
push eax
push 4
push 0xffff
mov dword [ebp + 0xc], 1
push dword [esi + 8]
call edi
cmp eax, 0xffffffff
je 0x404c09
push 0x30
call fcn.0041b3a8
push 0x30
push ebx
push eax
mov dword [esi + 4], eax
call fcn.0040e5b0
add esp, 0x10
cmp dword [esi + 4], ebx
je 0x404c09
mov edi, 0x2800
push edi
call fcn.0041b3a8
mov ecx, dword [esi + 4]
push edi
push ebx
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 4]
push dword [eax + 0x14]
call fcn.0040e5b0
mov eax, dword [esi + 4]
add esp, 0x10
cmp dword [eax + 0x14], ebx
je 0x404c09
push 0x14
push ebx
push eax
call fcn.0040e5b0
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
push edi
push ebx
mov dword [eax + 0x24], ecx
mov eax, dword [esi + 4]
mov dword [eax + 0x28], 1
mov eax, dword [esi + 4]
push dword [eax + 0x14]
call fcn.0040e5b0
mov eax, dword [esi + 4]
add esp, 0x18
mov ecx, dword [eax + 0x14]
mov dword [eax + 0x20], ecx
mov eax, dword [esi + 4]
lea ecx, [ebp + 0x10]
mov dword [eax + 0x1c], edi
mov eax, dword [esi + 4]
mov dword [eax + 0x2c], esi
mov eax, dword [esi + 4]
push eax
push ecx
push 0x20
push 0x20
push ebx
mov dword [ebp + 0x10], ebx
push dword [eax + 0x14]
push dword [eax + 0x24]
push dword [esi + 0x94]
call dword [esi + 0x98]
test eax, eax
jne 0x404c0d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x404c0d
xor eax, eax
jmp 0x404c10
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x404c17
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
mov eax, 0x422af0
call fcn.0040e090
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
lea eax, [esi + 0x74]
lea ecx, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.00408d2c
lea eax, [esi + 0x94]
push 4
push eax
mov eax, dword [esi + 4]
push 0x700b
push 0xffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
push dword [eax + 0x24]
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x404d25
mov eax, dword [esi + 4]
push ebx
push eax
push dword [esi + 0x9c]
push dword [eax + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp eax, ebx
je 0x404d25
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x24]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x64]
push ecx
lea ecx, [esi + 0x3c]
push ecx
push dword [eax + 0x24]
call fcn.00404d58
mov ecx, dword [esi + 0x90]
add esp, 0xc
mov byte [ebp - 4], 1
mov eax, dword [ecx]
push ebx
push ebx
push esi
call dword [eax + 0xc]
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x404d25
push 0x14
push ebx
mov dword [eax + 0x28], 2
push dword [esi + 4]
call fcn.0040e5b0
mov eax, dword [esi + 4]
mov edi, 0x2800
push edi
push ebx
push dword [eax + 0x14]
call fcn.0040e5b0
mov eax, dword [esi + 4]
add esp, 0x18
mov dword [eax + 0x1c], edi
mov eax, dword [esi + 4]
push ebx
mov ecx, dword [eax + 0x14]
mov dword [eax + 0x20], ecx
mov esi, dword [esi + 4]
lea eax, [ebp - 0x18]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [esi + 0x1c]
push 1
push eax
push dword [esi + 0x24]
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x404d23
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x404d25
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00408d45
mov al, bl
jmp 0x404d49
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x404dcd
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, 0x422b04
call fcn.0040e090
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
lea eax, [esi + 0x74]
lea ecx, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], ebx
call fcn.00408d2c
mov eax, dword [esi + 4]
mov dword [ebp - 4], ebx
mov ecx, esi
mov byte [ebp - 4], 1
push dword [eax + 0x18]
push dword [eax + 0x14]
call fcn.0040500a
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x404e7d
push 0x14
push ebx
mov dword [eax + 0x28], 2
push dword [esi + 4]
call fcn.0040e5b0
mov eax, dword [esi + 4]
mov edi, 0x2800
push edi
push ebx
push dword [eax + 0x14]
call fcn.0040e5b0
mov eax, dword [esi + 4]
add esp, 0x18
mov dword [eax + 0x1c], edi
mov eax, dword [esi + 4]
push ebx
mov ecx, dword [eax + 0x14]
mov dword [eax + 0x20], ecx
mov esi, dword [esi + 4]
lea eax, [ebp - 0x18]
push esi
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [esi + 0x1c]
push 1
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
push dword [esi + 0x24]
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x404e7b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x404e7d
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00408d45
mov ecx, dword [ebp - 0xc]
pop edi
mov al, bl
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x4050fb
Capabilities:
Get system information on windows
Initialize winsock library
Terminate process

Disassembly:
mov eax, 0x422b62
call fcn.0040e090
sub esp, 0x1bc
mov al, byte [ebp - 0xd]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
lea ecx, [esi + 0x18]
mov dword [esi], method.CSyncObject.virtual_20
and byte [ecx + 8], 0
mov byte [ecx], al
mov al, byte [ebp - 0xd]
mov byte [ecx + 1], al
call fcn.00406032
and dword [ebp - 4], 0
lea ecx, [esi + 0x28]
call fcn.00408ce8
mov ebx, 0x100
lea edi, [esi + 0x44]
mov ecx, ebx
or eax, 0xffffffff
mov dword [esi], 0x4245c0
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x24]
lea ecx, [esi + 0x448]
lea eax, [eax + eax + 2]
cmp eax, ebx
mov dword [ecx], eax
jbe 0x405170
mov dword [ecx], ebx
xor edi, edi
mov dword [esi + 0x450], edi
lea eax, [ebp - 0x1c8]
push eax
push 0x202
mov dword [esi + 0x10], edi
mov dword [esi + 0x44c], ebx
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x444], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4051a9
push edi
call fcn.0040e7ba
mov ecx, dword [ebp - 0xc]
mov dword [esi + 4], edi
mov dword [esi + 0x458], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40546e
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
push 1
push edi
push edi
push edi
push 1
mov esi, ecx
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
je 0x4055bb
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
lea ecx, [ebp - 4]
push 4
push ecx
push 0x80
push 0xffff
push eax
mov word [ebp - 2], di
mov word [ebp - 4], 1
call ebx
push edi
lea eax, [ebp - 8]
push edi
push eax
lea eax, [esi + 0x454]
push 4
push eax
push 0x10
push 0x42e220
push 0xc8000006
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
jne 0x4054f0
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x4055bb
push 0x30
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, edi
mov dword [esi + 0x14], eax
je 0x4054e2
mov ecx, dword [esi + 0xc]
push edi
mov dword [eax + 0x24], ecx
mov eax, dword [esi + 0x14]
mov dword [eax + 0x28], edi
push dword [esi + 0x14]
push dword [esi + 8]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test eax, eax
jne 0x405544
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [esi + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4055bb
xor eax, eax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [esi + 0x10]
mov word [ebp - 0x18], 2
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x16], ax
lea eax, [ebp - 4]
push 4
push eax
push 4
push 0xffff
push dword [esi + 0xc]
call ebx
lea eax, [ebp - 0x18]
push 0x10
push eax
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x40559c
push 0x400
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x4055bf
push dword [esi + 0xc]
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [esi + 0x14]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [esi + 0x14], 0
xor al, al
jmp 0x4055c1
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405898
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0
call fcn.00410185
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
call fcn.0041a5ce
add esp, 0xc
cmp eax, 0xffffffff
je 0x4058ce
cmp dword [ebp - 0x28], 0x100000
jle 0x4058ce
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 4]
push esi
push eax
call fcn.00410025
push eax
push str._Y__m__d__X
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.0040f734
push 0x42e210
push dword [ebp + 8]
call fcn.0040f721
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x405936
lea eax, [ebp - 0x18]
push eax
push str._s
push esi
call fcn.0041048e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00410453
add esp, 0x18
push 0x42e204
push 0x42cc58
push esi
call fcn.0041048e
push esi
call fcn.0040f4a3
add esp, 0x10
pop esi
leave
ret

Function at 0x40636d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push 0
call fcn.00410185
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3c]
push eax
push edi
call fcn.0041a5ce
add esp, 0xc
cmp eax, 0xffffffff
je 0x4063a4
cmp dword [ebp - 0x28], 0x200000
jle 0x4063a4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 4]
push eax
call fcn.00410025
push eax
push str._Y__m__d__X
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.0040f734
push 0x42e210
push edi
call fcn.0040f721
add esp, 0x1c
mov esi, eax
lea eax, [ebp - 0x18]
test esi, esi
push eax
push str._s
jne 0x406410
mov esi, 0x42f530
push esi
call fcn.0041048e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00410453
call fcn.0041058d
push dword [eax]
call fcn.004104ca
add esp, 0x1c
push eax
push edi
push str.logprintf_error_:_fopen__s_error_:__s_n
push esi
call fcn.0041048e
jmp 0x40643b
push esi
call fcn.0041048e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00410453
add esp, 0x18
push 0x42e204
push 0x42cc58
push esi
call fcn.0041048e
push esi
call fcn.0040f4a3
add esp, 0x10
pop edi
pop esi
leave
ret

Function at 0x406508
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
mov esi, ecx
push eax
push 0x202
or dword [esi + 4], 0xffffffff
mov dword [esi], 0x4245ec
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x406541
push 0x42e4a0
call fcn.004108cc
pop ecx
push 0
call fcn.0040e7ba
mov eax, esi
pop esi
add esp, 0x190
ret

Function at 0x40657c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push esi
push 0
push 1
mov esi, ecx
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x4065ab
mov eax, dword [esi]
push 0x2dc6c0
mov ecx, esi
call dword [eax + 0x44]
mov eax, dword [esi]
push 0x4c4b40
mov ecx, esi
call dword [eax + 0x48]
xor eax, eax
cmp dword [esi + 4], 0xffffffff
pop esi
setne al
ret
Function at 0x4065d1
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push 4
lea eax, [ebp - 4]
push 0
push eax
call fcn.0040e5b0
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40661f
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 4]
push eax
call fcn.0040ebd0
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push dword [ebp + 0xc]
call fcn.0040e140
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
leave
ret 8

Function at 0x406623
Capabilities:
Connect socket
Get socket status
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push 0x10
lea eax, [ebp - 0x10]
push 0
mov esi, ecx
push eax
call fcn.0040e5b0
add esp, 0xc
mov word [ebp - 0x10], 2
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
push dword [ebp + 8]
mov word [ebp - 0xe], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x40668f
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x406679
xor eax, eax
jmp 0x40674f
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0xc]
push eax
call fcn.0040ebd0
add esp, 0xc
cmp dword [ebp + 0x10], 0
jle 0x40673b
mov edi, dword [sym.imp.WS2_32.dll_ioctlsocket]
lea eax, [ebp + 8]
mov ebx, 0x8004667e
push eax
push ebx
mov dword [ebp + 8], 1
push dword [esi + 4]
call edi
cmp eax, 0xffffffff
je 0x406672
lea eax, [ebp - 0x10]
push 0x10
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
xor eax, eax
push ecx
lea ecx, [ebp - 0x11c]
push eax
push ecx
push eax
push eax
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x14], eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x406713
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.time_out:_d__r_n
call fcn.004108cc
pop ecx
jmp 0x406730
and dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [esi + 4]
call edi
cmp eax, 0xffffffff
jne 0x406736
push str.ioctlsocket_fail__r_n
call fcn.004108cc
pop ecx
jmp 0x406672
push 1
pop eax
jmp 0x40674f
lea eax, [ebp - 0x10]
push 0x10
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_connect]
neg eax
sbb eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x406949
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 0x10]
test ecx, ecx
jle 0x40696f
mov eax, ecx
push edi
cdq
mov edi, 0xf4240
idiv edi
imul eax, eax, 0xf4240
sub ecx, eax
push ecx
call fcn.0041090d
pop ecx
pop edi
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jge 0x4069a4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push esi
push str.recv_recv_error____d____d___n
call fcn.004108cc
mov eax, dword [0x42e498]
add esp, 0xc
jmp 0x4069a6
mov eax, esi
pop esi
ret 0xc
Function at 0x406b94
Capabilities:
Get socket status
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push esi
xor esi, esi
push edi
push esi
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, esi
jge 0x406bb9
xor eax, eax
jmp 0x406c8e
push 0x10
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.0040e5b0
add esp, 0xc
mov word [ebp - 0x18], 2
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, esi
je 0x406c85
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.0040ebd0
add esp, 0xc
push 0x89
call dword [sym.imp.WS2_32.dll_htons]
push 0x32
push 0x42e590
push dword [ebp + 0xc]
mov word [ebp - 0x16], ax
call fcn.0040ebd0
add esp, 0xc
lea eax, [ebp - 0x18]
push 0x10
push eax
push esi
push 0x32
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jl 0x406c85
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
push esi
lea eax, [ebp - 0x11c]
push esi
push eax
lea eax, [edi + 1]
push eax
mov dword [ebp - 4], 0xdbba0
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x11c], 1
call dword [sym.imp.WS2_32.dll_select]
lea eax, [ebp - 0x11c]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x406c85
push esi
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, esi
jl 0x406c85
mov esi, eax
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x406de4
Capabilities:
Terminate thread

Disassembly:
cmp dword [ecx + 0xc], 0
mov dword [ecx], 0x424640
je 0x406df5
jmp 0x406e27
ret
push ebx
push esi
mov esi, ecx
push edi
mov bl, 1
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1388
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x406e59
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
xor bl, bl
push dword [esi + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esi + 0x10]
call edi
xor eax, eax
pop edi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 4], eax
mov al, bl
pop esi
pop ebx
ret
Function at 0x406f36
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov esi, ecx
jne 0x406f6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea ecx, [esi + 8]
call fcn.0041b801
push eax
push 0x42e6b0
add esi, 0x1c
push esi
call fcn.0041ae99
add esp, 0x10
jmp 0x40704d
push dword [ebp + 8]
lea ebx, [esi + 8]
mov ecx, ebx
call fcn.0041b710
mov eax, dword [ebx]
cmp dword [eax - 8], edi
je 0x40704d
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.0041a5ce
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x406faf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
mov ecx, ebx
call fcn.0041b801
push eax
push 0x42e67c
jmp 0x406f5e
mov eax, dword [ebx]
push edi
push 0x80
push 3
push edi
push 1
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0xc], eax
jne 0x406fe7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
mov ecx, ebx
call fcn.0041b801
push eax
push 0x42e64c
jmp 0x40703a
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esi + 0x10], eax
jne 0x407012
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
mov ecx, ebx
call fcn.0041b801
push eax
push 0x42e618
jmp 0x40703a
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [esi + 0x14], eax
jne 0x407051
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
mov ecx, ebx
call fcn.0041b801
push eax
push 0x42e5e8
lea eax, [esi + 0x1c]
push eax
call fcn.0041ae99
add esp, 0x10
mov ecx, esi
call fcn.004070ca
xor al, al
jmp 0x40705f
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x18], eax
shr eax, 0xf
mov dword [esi + 4], eax
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x407418
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
call fcn.004073c4
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret

Function at 0x407e78
Capabilities:
Hash data with md5

Disassembly:
push esi
xor eax, eax
lea esi, [ecx + 0x5c]
push 0x40
push eax
push esi
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
call fcn.00408a30
mov byte [esi], 0x80
pop esi
ret