joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402db8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
push edx
pop ebx
mov esi, eax
push ebx
pop eax
call fcn.00404d9c
test esi, esi
jne 0x402def
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
push eax
pop ecx
lea edx, [esp + 4]
push ebx
pop eax
call fcn.00404e8c
jmp 0x402e10
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402c54
mov dword [esp], eax
test esi, esi
je 0x402e10
cmp dword [ebx], 0
je 0x402e10
dec esi
jmp 0x402df7
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403520
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
sub ebx, ebx
imul edx, dword [ebx + 0x45c008], 0x8088405
inc edx
mov dword [ebx + 0x45c008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403944
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, eax
movzx eax, word [eax + 4]
sub eax, 0xd7b2
cmp eax, 1
ja 0x403977
push 0
push esp
pop eax
push 0
push eax
push dword [ebx + 8]
push edx
push dword [ebx]
call sub.KERNEL32.DLL_WriteFile_1
pop edx
dec eax
jne 0x40397e
cmp edx, dword [ebx + 8]
je 0x403988
push 0x65
pop eax
push edi
pop edi
jmp 0x403983
push 5
pop eax
pushal
popal
jmp 0x403983
call sub.KERNEL32.DLL_GetLastError_1
call fcn.00402b94
mov eax, ebx
pop ebx
ret

Function at 0x404b9c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x45f044], 0
je 0x404bfd
cmp word [0x45f218], 0xd7b2
jne 0x404bc5
cmp dword [0x45f220], 0
jbe 0x404bc5
mov eax, 0x45f214
call dword [0x45f230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45c094
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404c24
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x45c034], 0
jne 0x404c19
push 0
push 0x45c08c
push 0x45c094
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret

Function at 0x404d58
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push ecx
pop edi
mov esi, edx
push eax
pop ebx
mov eax, 8
call fcn.00402a50
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x45f045], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404d20
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4058f4
Capabilities:
Packed with generic packer

Disassembly:
pushal
popal
push 1
pop ecx
jmp fcn.00405808
Function at 0x405918
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
pop ebx
mov esi, edx
xor eax, eax
mov al, byte [ecx + 1]
lea edi, [eax + ecx + 0xa]
mov ebp, dword [edi - 4]
sub eax, eax
mov ecx, dword [edi - 8]
push ecx
mov ecx, dword [edi + 4]
sub ecx, eax
jle 0x405944
push eax
pop edx
add eax, esi
add edx, ebx
call fcn.00402c14
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov edx, dword [edx]
mov cl, byte [edx]
cmp cl, 0xa
je 0x405983
cmp cl, 0xb
je 0x405994
cmp cl, 0xc
je 0x4059a5
cmp cl, 0xd
je 0x4059b6
cmp cl, 0xe
je 0x4059d6
cmp cl, 0xf
je 0x4059ef
cmp cl, 0x11
je 0x405a00
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.00402b68
mov edx, dword [eax + esi]
add eax, ebx
call fcn.00404df0
nop
push 4
nop
pop eax
jmp 0x405a11
mov edx, dword [eax + esi]
add eax, ebx
call fcn.00405498
nop
push 4
nop
pop eax
jmp 0x405a11
lea edx, [eax + esi]
add eax, ebx
call fcn.00405900
push 0x10
pop eax
pushal
popal
jmp 0x405a11
sub ecx, ecx
mov cl, byte [edx + 1]
push dword [ecx + edx + 2]
push dword [ecx + edx + 6]
mov ecx, dword [ecx + edx + 0xa]
mov ecx, dword [ecx]
lea edx, [eax + esi]
add eax, ebx
call fcn.00405a34
pop eax
jmp 0x405a11
sub ecx, ecx
mov cl, byte [edx + 1]
mov ecx, dword [ecx + edx + 2]
push ecx
mov ecx, edx
lea edx, [eax + esi]
add eax, ebx
call fcn.00405918
pop eax
jmp 0x405a11
mov edx, dword [eax + esi]
add eax, ebx
call fcn.0040679c
push 4
pop eax
nop
nop
jmp 0x405a11
push edx
pop ecx
mov edx, dword [eax + esi]
add eax, ebx
call fcn.00406074
nop
push 4
nop
pop eax
add eax, dword [edi + 4]
add edi, 8
dec ebp
jne 0x405932
pop ecx
sub ecx, eax
jle 0x405a2d
lea edx, [eax + ebx]
add eax, esi
call fcn.00402c14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x409160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
push ebx
pop eax
call fcn.0040525c
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x409179
test al, 0x10
jne 0x40917d
sub eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40926c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov byte [esp], dl
push eax
pop esi
xor ebx, ebx
mov eax, esi
call fcn.0040525c
mov ebp, eax
push ebp
call sub.KERNEL32.DLL_GetFileAttributesA
push eax
pop edi
cmp edi, 0xffffffff
je 0x4092a9
cmp byte [esp], 0
je 0x409299
or edi, 1
jmp 0x40929c
and edi, 0xfffffffe
push edi
push ebp
call sub.KERNEL32.DLL_SetFileAttributesA
cmp eax, 1
sbb ebx, ebx
inc ebx
push ebx
pop eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40bfd4
Capabilities:
Get geographical location

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xffffff00
push ebx
push esi
push ecx
pop esi
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
or eax, eax
jle 0x40c00d
push eax
pop ecx
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404e8c
jmp 0x40c016
mov eax, ebx
push esi
pop edx
call fcn.00404df0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c020
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
push ecx
pop ebx
push edx
pop esi
push eax
pop edi
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x40c041
mov al, byte [esp]
jmp 0x40c043
push ebx
pop eax
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40d5fc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
sub edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40d660
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
nop
push 7
nop
pop ecx
call fcn.0040500c
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00408d9c
push eax
pop ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d667
lea eax, [ebp - 0xc]
call fcn.00404d9c
ret
Function at 0x419970
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push esp
pop ebp
push ebx
push esi
push edi
mov edi, 0x45f880
cmp dword [edi], 0
jne 0x4199ec
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x45f87c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x45c46c
mov ecx, 2
call fcn.00402c14
mov edx, 0x419948
lea eax, [esi + 5]
call fcn.00419968
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
push ebx
pop eax
call fcn.00419968
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
push ebx
pop eax
sub eax, esi
cmp eax, 0xffc
jl 0x4199c1
mov dword [0x45f87c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41b0e4
Capabilities:
Encode data using xor

Disassembly:
push edx
pop ecx
push eax
pop edx
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41b0ea
ret

Function at 0x41d1ec
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41d23d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41d224
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41d214
jmp 0x41d23d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41d225
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429d80
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push eax
pop ebx
cmp dword [ebx + 0x14], 0xca
jne 0x429dae
mov eax, ebx
call fcn.0042a834
cmp dword [ebx + 0x40], 0
je 0x429da7
mov dword [ebx + 0x14], 0xcf
pushfd
xor eax, eax
inc eax
popfd
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x429e1f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x429e11
cmp dword [ebx + 8], 0
je 0x429dd0
push ebx
pop eax
mov edx, dword [eax + 8]
call dword [edx]
push ebx
pop eax
mov edx, dword [eax + 0x1b4]
call dword [edx]
or eax, eax
jne 0x429de2
sub eax, eax
pop ebx
ret
cmp eax, 2
je 0x429e11
cmp dword [ebx + 8], 0
je 0x429dc3
cmp eax, 3
je 0x429df5
dec eax
jne 0x429dc3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x429dc3
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x429dc3
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x429e3d
cmp dword [ebx + 0x14], 0xcc
je 0x429e3d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
push ebx
pop eax
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00429e48
pop ebx
ret

Function at 0x429e48
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
cmp dword [ebx + 0x14], 0xcc
je 0x429edd
push ebx
pop eax
mov edx, dword [eax + 0x1a4]
call dword [edx]
sub ecx, ecx
mov dword [ebx + 0x8c], ecx
mov dword [ebx + 0x14], 0xcc
jmp 0x429edd
mov eax, dword [ebx + 8]
test eax, eax
je 0x429e8e
mov dword [eax + 4], edx
mov edx, dword [ebx + 0x74]
mov dword [eax + 8], edx
push ebx
pop eax
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov esi, dword [ebx + 0x8c]
push 0
lea ecx, [ebx + 0x8c]
mov edi, dword [eax + 0x1a8]
sub edx, edx
call dword [edi + 4]
cmp esi, dword [ebx + 0x8c]
jne 0x429eb5
xor eax, eax
jmp 0x429f03
mov edx, dword [ebx + 0x8c]
cmp edx, dword [ebx + 0x74]
jb 0x429e77
push ebx
pop eax
mov edx, dword [eax + 0x1a4]
call dword [edx + 4]
push ebx
pop eax
mov edx, dword [eax + 0x1a4]
call dword [edx]
sub ecx, ecx
mov dword [ebx + 0x8c], ecx
mov eax, dword [ebx + 0x1a4]
cmp dword [eax + 8], 0
jne 0x429eb5
cmp dword [ebx + 0x44], 0
je 0x429ef6
mov edx, 0xce
jmp 0x429efb
mov edx, 0xcd
mov dword [ebx + 0x14], edx
pushfd
xor eax, eax
inc eax
popfd
pop edi
pop esi
pop ebx
ret
Function at 0x43c148
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
sub edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040524c
xor eax, eax
push ebp
push 0x43c231
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, 1
call fcn.0045686c
xor ebx, ebx
mov dl, 1
mov eax, dword [0x412cfc]
call fcn.00403f88
mov dword [ebp - 8], eax
mov dl, 0x7c
mov eax, dword [ebp - 8]
call fcn.004152fc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0041516c
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
or eax, eax
jl 0x43c213
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
xor eax, eax
push ebp
push 0x43c1ff
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.00408dd4
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov esi, eax
push 0
push esi
call sub.KERNEL32.DLL_TerminateProcess
test eax, eax
je 0x43c1f5
mov bl, 1
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x43c20b
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x43c1b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c238
lea eax, [ebp - 0x14]
call fcn.00404d9c
lea eax, [ebp - 4]
call fcn.00404d9c
ret
Function at 0x43c244
Capabilities:
Terminate process

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xfffffeb4
push ebx
push esi
push edi
sub edx, edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040524c
xor eax, eax
push ebp
push 0x43c3eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, 1
call fcn.0045686c
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404e34
xor edx, edx
push 2
pop eax
push eax
pop eax
call fcn.00423164
push eax
pop esi
mov dword [ebp - 0x130], 0x128
lea edx, [ebp - 0x130]
mov eax, esi
call fcn.00423184
push eax
pop ebx
jmp 0x43c3a7
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.0040500c
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.004094c4
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004087e8
mov eax, dword [ebp - 0x134]
push eax
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 8]
call fcn.004087e8
mov edx, dword [ebp - 0x140]
pop eax
call fcn.004051a8
je 0x43c37b
lea eax, [ebp - 0x148]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.0040500c
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.004087e8
mov eax, dword [ebp - 0x144]
push eax
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 8]
call fcn.004087e8
mov edx, dword [ebp - 0x14c]
pop eax
call fcn.004051a8
jne 0x43c398
mov eax, dword [ebp - 0x128]
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov edi, eax
push 0
push edi
call sub.KERNEL32.DLL_TerminateProcess
lea edx, [ebp - 0x130]
push esi
pop eax
call fcn.004231a4
push eax
pop ebx
or ebx, ebx
jne 0x43c2d6
push esi
mov eax, dword [0x45e484]
mov eax, dword [eax]
call eax
sub eax, eax
call fcn.0045686c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c3f2
lea eax, [ebp - 0x14c]
nop
push 7
nop
pop edx
call fcn.00404dc0
lea eax, [ebp - 8]
pushal
popal
push 2
pop edx
call fcn.00404dc0
ret
Function at 0x43dbe4
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
sub eax, eax
push ebp
push 0x43dc6d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x45f97c
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
or ebx, ebx
je 0x43dc57
lea edx, [ebp - 0x1c]
push ebx
pop eax
call fcn.0040bf88
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x43dc84
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x45e360]
mov dl, 1
mov eax, dword [0x43d3e8]
call fcn.0040c8bc
call fcn.00404758
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43dc74
lea eax, [ebp - 0x1c]
call fcn.00404d9c
ret

Function at 0x43e238
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, eax
xor esi, esi
sub edi, edi
mov al, byte [0x43e290]
cmp al, byte [ebx + 0x28]
je 0x43e25a
mov esi, 0x401
mov eax, ebx
call fcn.0043e380
mov edi, eax
xor eax, eax
mov al, byte [ebx + 0x28]
push eax
push esi
push edi
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov al, byte [0x43e290]
cmp al, byte [ebx + 0x28]
jne 0x43e289
xor eax, eax
mov dword [esp], eax
push esp
push 0x8004667e
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_ioctlsocket
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x43e314
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
push eax
pop ebx
mov eax, ebx
call fcn.0043e238
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.004041c0
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x43e378
call fcn.0043db2c
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x43e36a
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.004041c0
pop esi
pop ebx
ret

Function at 0x43e39c
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push edx
pop ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0043e0d4
sub eax, eax
push ebp
push 0x43e41b
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
pop eax
call fcn.00404d9c
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x43e3d5
call fcn.00404804
jmp 0x43e422
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_getsockname
or eax, eax
jne 0x43e405
push dword [ebp - 0x14]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
push ebx
pop eax
call fcn.00404f94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43e422
mov eax, dword [ebp - 4]
call fcn.0043e0e0
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e428
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.0040525c
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
sub ecx, ecx
mov edx, 4
call fcn.00403500
test ebx, ebx
je 0x43e473
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret

Function at 0x43e9b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xffffffd8
push ebx
push esi
sub ebx, ebx
mov dword [ebp - 0x28], ebx
push ecx
pop esi
mov ebx, edx
mov dword [ebp - 4], eax
sub eax, eax
push ebp
push 0x43ead2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0043e0d4
sub eax, eax
push ebp
push 0x43eab5
push dword fs:[eax]
mov dword fs:[eax], esp
sub eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x43ea00
call fcn.00404804
jmp 0x43eabc
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x43ea9f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x43ea9f
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004041c0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x43ea9f
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040bf88
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x43eaec
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x45e360]
mov dl, 1
mov eax, dword [0x43d3e8]
call fcn.0040c8bc
call fcn.00404758
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43eabc
mov eax, dword [ebp - 4]
call fcn.0043e0e0
ret
sub eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ead9
lea eax, [ebp - 0x28]
call fcn.00404d9c
ret
Function at 0x43eb38
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xffffffd8
push ebx
push esi
sub ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
push edx
pop esi
mov dword [ebp - 4], eax
sub eax, eax
push ebp
push 0x43ec82
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0043e0d4
sub eax, eax
push ebp
push 0x43ec65
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x43eb9d
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x43eb9d
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x43ec4f
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x43ebb0
call fcn.00404804
jmp 0x43ec6c
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x43ec4f
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x43ec4f
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004041c0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x43ec4f
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040bf88
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x43ec9c
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x45e360]
mov dl, 1
mov eax, dword [0x43d3e8]
call fcn.0040c8bc
call fcn.00404758
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ec6c
mov eax, dword [ebp - 4]
call fcn.0043e0e0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ec89
lea eax, [ebp - 0x28]
call fcn.00404d9c
ret
Function at 0x4425a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_GetPriorityClass
mov ebx, eax
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.KERNEL32.DLL_GetThreadPriority
push eax
pop esi
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_SetPriorityClass
push 0xf
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.KERNEL32.DLL_SetThreadPriority
push 0xa
call sub.KERNEL32.DLL_Sleep_1
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x1f4
call sub.KERNEL32.DLL_Sleep_1
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push esi
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.KERNEL32.DLL_SetThreadPriority
push ebx
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.KERNEL32.DLL_SetPriorityClass
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
fild qword [ebp - 0x18]
fdiv dword [0x442654]
call fcn.00402e68
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret