joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4139f0
Capabilities:
Get file version info

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
push edi
mov edi, ecx
push ebx
xor esi, esi
call fcn.0040d800
add esp, 4
test eax, eax
je 0x413ae6
lea eax, [esp + 0x14]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x413ad1
push ebx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [edi + 8], eax
je 0x413ad1
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
test ebp, ebp
je 0x413ad1
mov ecx, dword [esp + 0x14]
push ebp
push ebx
mov ebx, dword [esp + 0x24]
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
mov esi, eax
xor eax, eax
cmp esi, eax
je 0x413aae
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], eax
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
push str.VarFileInfoTranslation
push ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x413aae
cmp dword [esp + 0x1c], 4
jne 0x413aae
mov eax, dword [esp + 0x10]
xor edx, edx
xor ecx, ecx
mov dx, word [eax]
mov cx, word [eax + 2]
shl edx, 0x10
or ecx, edx
push ecx
push str._08lx
push edi
call fcn.0040c040
add esp, 0xc
mov eax, dword [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test esi, esi
je 0x413ad1
push ebx
lea ecx, [edi + 4]
call fcn.0040b700
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov eax, dword [edi + 8]
test eax, eax
je 0x413adf
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [edi + 8], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4

Function at 0x4140fd
Capabilities:
Initialize winsock library

Disassembly:
push 0x4441b0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp fcn.00414157
Function at 0x414157
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c8
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x4441ac], esi
jne 0x414223
lea eax, [ebp - 0x1c8]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x4141e1
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x30
mov ebx, eax
pop edi
lea eax, [ebp - 0x38]
push edi
push esi
push eax
call fcn.004206e0
add esp, 0xc
lea eax, [ebp - 0x38]
mov esi, str.GatorAsyncWndClass
mov dword [ebp - 0x38], edi
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_GetClassInfoExA]
test eax, eax
jne 0x4141d7
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], edi
push eax
mov dword [ebp - 0x30], 0x418041
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], esi
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x4141e1
mov dword [0x4441ac], 1
mov byte [0x4441b4], 0
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push str.GetHostByNameTimeout
push str.softwareGator.comGatordyn
push reloc.WSOCK32.dll_bind
mov dword [ebp - 4], esi
call fcn.0040cbf0
add esp, 0x14
test eax, eax
je 0x414219
mov eax, dword [ebp - 4]
cmp eax, esi
mov dword [0x43bd10], eax
jne 0x414223
mov dword [0x43bd10], 0x14
call fcn.004142bc
test eax, eax
je 0x4142b2
cmp dword [0x43bd14], 0xffffffff
jne 0x4142b2
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x43bd14], esi
mov esi, 0x108
push esi
push 0x40
call ebx
lea ecx, [ebp - 4]
mov edi, eax
push ecx
lea ecx, [ebp - 8]
xor eax, eax
push ecx
push edi
push eax
mov dword [edi], esi
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], eax
call dword [0x4441c4]
cmp eax, 0x25b
jne 0x414298
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 8]
push 0x40
call ebx
mov edi, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
mov dword [edi], esi
call dword [0x4441c4]
test eax, eax
jne 0x4142ab
cmp dword [ebp - 4], eax
je 0x4142ab
mov dword [0x43bd14], 1
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [0x4441ac]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414641
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, edi
cmp byte [edi], bl
je 0x414670
movsx eax, byte [esi]
push eax
call fcn.00420a15
test eax, eax
pop ecx
jne 0x41466b
cmp byte [esi], 0x2e
jne 0x414678
inc esi
cmp byte [esi], bl
jne 0x414658
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
call fcn.00414157
test eax, eax
je 0x414673
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push closesocket
push str.GatorAsyncWnd
push str.GatorAsyncWndClass
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x41477d
lea ecx, [ebp - 0x42c]
push 0x400
push ecx
mov esi, 0x43e
push edi
push esi
push eax
call sub.WSOCK32.dll_WSAAsyncGetHostByName
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x414774
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x43bd10]
imul ecx, ecx, 0x3e8
add eax, ecx
mov dword [ebp - 0xc], eax
call edi
cmp dword [ebp - 0xc], eax
jbe 0x414767
push 1
push ebx
push ebx
lea eax, [ebp - 0x2c]
push dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x414752
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [ebp - 0x28], esi
jne 0x414752
mov eax, dword [ebp - 0x20]
shr eax, 0x10
test ax, ax
jne 0x414752
mov eax, dword [ebp - 0x420]
mov eax, dword [eax]
push dword [eax]
call sub.WSOCK32.dll_inet_ntoa
push eax
push dword [ebp + 8]
call fcn.00421870
pop ecx
mov dword [ebp - 4], 1
pop ecx
cmp byte [0x4441b4], bl
jne 0x414767
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], ebx
je 0x4146f1
cmp dword [ebp - 4], ebx
jne 0x414774
push dword [ebp - 0x10]
call sub.WSOCK32.dll_WSACancelAsyncRequest
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 4]
jmp 0x414673
Function at 0x414ed9
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
push edi
push 0x50
pop ebx
lea eax, [ebp - 0x84]
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 4], ebx
push eax
call fcn.00421870
lea eax, [ebp - 0x84]
push 0x3a
push eax
call fcn.00420be0
xor edi, edi
add esp, 0x10
cmp eax, edi
je 0x414f31
and byte [eax], 0
lea ecx, [ebp - 4]
push ecx
inc eax
push 0x4399b4
push eax
call fcn.00421777
add esp, 0xc
cmp eax, 1
je 0x414f31
mov dword [ebp - 4], ebx
and byte [esi + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0x24], edi
jne 0x414f48
push 8
pop eax
jmp 0x41500d
call fcn.00414137
test eax, eax
jne 0x414f5b
mov eax, 0x45a
jmp 0x41500d
mov eax, dword [ebp + 0x24]
cmp eax, edi
je 0x414f64
mov dword [eax], edi
mov ebx, dword [ebp + 0x28]
mov dword [ebx], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x414f86
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esi + 0x24]
push dword [esi + 0x102c]
mov eax, dword [ecx]
push dword [esi + 0x1028]
call dword [eax + 0xc]
push dword [ebp + 0x34]
mov edx, dword [ebp + 0x14]
mov ecx, dword [esi + 0x24]
push dword [ebp + 0x30]
mov eax, dword [ecx]
push dword [ebp + 0x2c]
push ebx
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [edx*4 + 0x43be8c]
lea edx, [ebp - 0x84]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
push edx
call dword [eax + 8]
mov dword [ebp + 0x24], eax
call edi
mov edi, eax
xor eax, eax
cmp dword [ebp + 0x18], eax
je 0x414fe9
push dword [ebp + 0x18]
call fcn.00421960
pop ecx
sub edi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebx]
push eax
lea eax, [ebp - 0x84]
push dword [ebp + 0x24]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp - 4]
push eax
call fcn.004150b4
mov eax, dword [ebp + 0x24]
pop edi
pop esi
pop ebx
leave
ret 0x30

Function at 0x4152dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [esi], eax
cmp ebx, eax
mov byte [ebp - 1], al
mov dword [edi], eax
je 0x41534a
cmp byte [ebx], al
je 0x41534a
lea eax, [ebp - 0x108]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x41534a
lea eax, [ebp - 0x108]
push 0x43b6a4
push eax
call fcn.00421880
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.00421880
push esi
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.00415352
add esp, 0x1c
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415352
Capabilities:
Check if file exists
Get file attributes
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and byte [ebp - 1], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
and dword [esi], 0
and dword [edi], 0
test ebx, ebx
je 0x4153de
cmp byte [ebx], 0
je 0x4153de
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4153de
lea eax, [ebp + 8]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp + 0xc], eax
je 0x4153de
push eax
call fcn.004205ed
pop ecx
mov dword [ebp + 0x10], eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x43b6a4
push dword [ebp + 0x10]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4153d5
mov eax, dword [ebp - 8]
mov byte [ebp - 1], 1
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov eax, dword [eax + 0xc]
mov dword [esi], eax
push dword [ebp + 0x10]
call fcn.004203d7
pop ecx
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x415414
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
push esi
lea esi, [ecx + 0x6c]
lea ecx, [esp + 4]
xor eax, eax
push ecx
push esi
push 0x104
push eax
push str.wininet.dll
push eax
mov byte [esi], al
call dword [sym.imp.KERNEL32.dll_SearchPathA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop esi
pop ecx
ret
Function at 0x41568d
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
push edi
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x415726
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x415726
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x41571e
push esi
push edi
push dword [ebp - 4]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x415717
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x43b6a4
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x415717
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
shr ecx, 0x10
mov dword [edx], ecx
mov edx, dword [ebp + 0x10]
movzx ecx, word [eax + 8]
mov dword [edx], ecx
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp + 0x14]
shr ecx, 0x10
mov dword [edx], ecx
mov ecx, dword [ebp + 0x18]
movzx eax, word [eax + 0xc]
mov dword [ecx], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
push 1
pop eax
pop edi
pop ebx
leave
ret 0x14
Function at 0x418150
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
cmp dword [0x4454dc], 0
je 0x418167
push 1
pop eax
leave
ret
lea eax, [ebp - 0x1c4]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x418233
push ebx
push esi
push edi
push eax
mov dword [0x4454dc], 1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x30
mov ebx, eax
pop edi
lea eax, [ebp - 0x34]
mov esi, str.GatorAsyncWndClass
push eax
push esi
push ebx
mov dword [ebp - 0x34], edi
call dword [sym.imp.USER32.dll_GetClassInfoExA]
test eax, eax
je 0x4181b9
push ebx
push esi
call dword [sym.imp.USER32.dll_UnregisterClassA]
push edi
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.004206e0
add esp, 0xc
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x418041
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], esi
call dword [sym.imp.USER32.dll_RegisterClassExA]
pop edi
pop esi
test ax, ax
pop ebx
je 0x418233
mov byte [0x44559c], 0
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push str.GetHostByNameTimeout
push str.softwareGator.comGatordyn
push reloc.WSOCK32.dll_bind
call fcn.0040cbf0
add esp, 0x14
test eax, eax
je 0x418222
mov eax, dword [ebp - 4]
test eax, eax
mov dword [0x43d7a0], eax
jne 0x41822c
mov dword [0x43d7a0], 0x14
mov eax, dword [0x4454dc]
leave
ret
xor eax, eax
leave
ret
Function at 0x4182a2
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, edi
cmp byte [edi], bl
je 0x4182d1
movsx eax, byte [esi]
push eax
call fcn.00420a15
test eax, eax
pop ecx
jne 0x4182cc
cmp byte [esi], 0x2e
jne 0x4182d9
inc esi
cmp byte [esi], bl
jne 0x4182b9
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
call fcn.00418150
test eax, eax
je 0x4182d4
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push closesocket
push str.GatorAsyncWnd
push str.GatorAsyncWndClass
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x4183de
lea ecx, [ebp - 0x42c]
push 0x400
push ecx
mov esi, 0x43e
push edi
push esi
push eax
call sub.WSOCK32.dll_WSAAsyncGetHostByName
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x4183d5
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x43d7a0]
imul ecx, ecx, 0x3e8
add eax, ecx
mov dword [ebp - 0xc], eax
call edi
cmp dword [ebp - 0xc], eax
jbe 0x4183c8
push 1
push ebx
push ebx
lea eax, [ebp - 0x2c]
push dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4183b3
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [ebp - 0x28], esi
jne 0x4183b3
mov eax, dword [ebp - 0x20]
shr eax, 0x10
test ax, ax
jne 0x4183b3
mov eax, dword [ebp - 0x420]
mov eax, dword [eax]
push dword [eax]
call sub.WSOCK32.dll_inet_ntoa
push eax
push dword [ebp + 8]
call fcn.00421870
pop ecx
mov dword [ebp - 4], 1
pop ecx
cmp byte [0x44559c], bl
jne 0x4183c8
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 4], ebx
je 0x418352
cmp dword [ebp - 4], ebx
jne 0x4183d5
push dword [ebp - 0x10]
call sub.WSOCK32.dll_WSACancelAsyncRequest
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 4]
jmp 0x4182d4
Function at 0x4188f6
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov edi, ecx
push ebp
push edi
call fcn.0041930b
pop ecx
pop ecx
push str.send
push ebp
push 1
mov ecx, edi
call fcn.004192cc
test eax, eax
je 0x4189d7
cmp dword [esp + 0x1c], ebp
mov esi, dword [esp + 0x18]
jge 0x418934
push esi
call fcn.00421960
pop ecx
mov dword [esp + 0x1c], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebp
call ebx
mov esi, eax
mov eax, dword [edi + 0x20]
imul eax, eax, 0x3e8
add esi, eax
push ebp
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [edi]
call sub.WSOCK32.dll_send
mov ebp, eax
cmp ebp, 0xffffffff
je 0x418989
add dword [esp + 0x10], ebp
test ebp, ebp
jle 0x41897f
call ebx
mov esi, eax
mov eax, dword [edi + 0x20]
imul eax, eax, 0x3e8
add esi, eax
add dword [esp + 0x18], ebp
sub dword [esp + 0x1c], ebp
jmp 0x41899f
mov ecx, edi
call fcn.004192bf
cmp eax, 0x2733
jne 0x4189b9
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x1c], 0
je 0x4189db
call ebx
cmp eax, esi
ja 0x4189ca
cmp byte [0x44559c], 0
jne 0x4189db
xor ebp, ebp
jmp 0x418951
push eax
push str.Send_failed___d_.
push edi
call fcn.0041930b
add esp, 0xc
jmp 0x4189d7
push str.Send_timed_out.
push edi
call fcn.0041930b
pop ecx
pop ecx
xor eax, eax
jmp 0x4189e9
mov al, byte [0x44559c]
neg al
sbb al, al
inc al
movzx eax, al
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x418fe3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push esi
call fcn.0041930b
cmp dword [esi + 8], edi
pop ecx
pop ecx
jne 0x419015
push str.retrieve_file_headers
push 1
push 1
mov ecx, esi
call fcn.004192cc
test eax, eax
je 0x419156
cmp dword [esi + 8], edi
push ebx
jne 0x419152
push 0x2000
call fcn.0041853c
mov dword [esi + 8], eax
and byte [eax], 0
xor ebx, ebx
pop ecx
and dword [ebp - 8], ebx
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x24]
imul ecx, ecx, 0x3e8
add eax, ecx
cmp dword [ebp - 4], 0
mov dword [ebp - 0x10], eax
jne 0x419145
mov eax, 0x2000
cmp edi, eax
jae 0x4190ca
test ebx, ebx
jne 0x4190ce
mov ecx, eax
mov eax, 0x80
sub ecx, edi
cmp ecx, eax
ja 0x419072
mov eax, ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
mov eax, edi
mov ecx, esi
add eax, dword [esi + 8]
push eax
call fcn.00419172
add edi, dword [ebp - 0xc]
cmp dword [ebp - 4], 0
jne 0x4190aa
cmp dword [ebp - 0xc], 0
jne 0x4190aa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x10]
ja 0x4190c3
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._r_n_r_n
push dword [esi + 8]
call fcn.004214f0
cmp dword [ebp - 4], 0
pop ecx
pop ecx
mov ebx, eax
je 0x419056
jmp 0x4190ca
mov dword [ebp - 4], 1
test ebx, ebx
je 0x419145
and byte [ebx], 0
mov ecx, esi
call fcn.004189f1
push dword [esi + 8]
cmp eax, 0x64
jne 0x419118
call fcn.00421960
sub edi, eax
pop ecx
sub edi, 4
je 0x4190ff
add ebx, 4
push edi
push ebx
push dword [esi + 8]
call fcn.004219e0
add esp, 0xc
jmp 0x419107
mov eax, dword [esi + 8]
xor edi, edi
and byte [eax], 0
xor ebx, ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x419038
jmp 0x419152
call fcn.00421960
sub edi, eax
pop ecx
lea eax, [edi - 4]
test eax, eax
mov dword [esi + 0x10], eax
je 0x419152
push eax
call fcn.0041853c
push dword [esi + 0x10]
add ebx, 4
mov dword [esi + 0xc], eax
push ebx
push eax
call fcn.004219e0
add esp, 0x10
jmp 0x419152
push str.Reply_contains_no_headers.
push esi
call fcn.0041930b
pop ecx
pop ecx
mov eax, dword [esi + 8]
pop ebx
pop edi
pop esi
leave
ret
Function at 0x419172
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
push ebx
push esi
mov dword [ebp - 4], ebx
call fcn.0041930b
pop ecx
pop ecx
push str.read_file
push 1
push 1
mov ecx, esi
call fcn.004192cc
test eax, eax
je 0x4192b8
mov edi, dword [ebp + 0x10]
mov dword [edi], ebx
mov ebx, dword [ebp + 0x14]
and dword [ebx], 0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x419228
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x419228
mov ebx, dword [ebp + 0xc]
cmp ebx, ecx
jb 0x4191e5
push ecx
push eax
push dword [ebp + 8]
call fcn.004219e0
mov eax, dword [esi + 0x10]
mov dword [edi], eax
push dword [esi + 0xc]
and dword [esi + 0x10], 0
call fcn.004203d7
add esp, 0x10
and dword [esi + 0xc], 0
jmp 0x419220
push ebx
push eax
push dword [ebp + 8]
call fcn.004219e0
mov dword [edi], ebx
mov edi, dword [esi + 0x10]
sub edi, ebx
push edi
call fcn.0041853c
mov ecx, dword [esi + 0xc]
push edi
add ecx, ebx
mov dword [ebp + 8], eax
push ecx
push eax
call fcn.004219e0
push dword [esi + 0xc]
call fcn.004203d7
mov eax, dword [ebp + 8]
add esp, 0x20
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
push 1
pop eax
jmp 0x4192b8
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x419270
mov ecx, esi
call fcn.004192bf
cmp eax, 0x2733
je 0x419261
push eax
push str.Recv_failed___d_
push esi
mov dword [ebx], 1
call fcn.0041930b
add esp, 0xc
jmp 0x41928c
push 1
pop eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41929e
test eax, eax
jle 0x41927f
mov dword [edi], eax
mov dword [ebp - 4], 1
jmp 0x41929e
mov ecx, esi
mov dword [ebx], 1
call fcn.004192bf
cmp dword [ebx], 0
jne 0x41929e
push str.No_data_was_received
push esi
call fcn.0041930b
pop ecx
pop ecx
cmp byte [0x44559c], 0
je 0x4192ab
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4192b8
mov dword [ebx], 1
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x419efc
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
test edi, edi
je 0x419f3d
push edi
call fcn.00419f42
mov ecx, esi
call fcn.00419fc8
cmp eax, edi
jb 0x419f32
mov eax, dword [esi + 8]
push edi
push dword [esp + 0x10]
add eax, dword [esi + 0xc]
push eax
call fcn.00420f00
add esp, 0xc
add dword [esi + 0xc], edi
jmp 0x419f3d
push str.Out_of_memory_in_CMemBuffer___Cannot_append_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
ret 8

Function at 0x419f42
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call fcn.00419fc8
mov ecx, dword [esp + 0x10]
cmp eax, ecx
jae 0x419fa5
add ecx, dword [esi + 4]
mov ebx, dword [esi + 8]
mov edi, ecx
lea eax, [edi + 2]
push eax
call fcn.004205ed
test eax, eax
pop ecx
mov dword [esi + 8], eax
je 0x419f97
push edi
push 0
push eax
call fcn.004206e0
add esp, 0xc
test ebx, ebx
je 0x419f92
push dword [esi + 4]
push ebx
push dword [esi + 8]
call fcn.00420f00
push ebx
call fcn.004203d7
add esp, 0x10
mov dword [esi + 4], edi
jmp 0x419fa5
push str.Out_of_memory_in_CMemBuffer__r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esi + 8], ebx
pop edi
pop esi
pop ebx
ret 4

Function at 0x41a520
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov dword [esi + 0x1a88], 1
mov eax, dword [esi + 0x1a84]
test eax, eax
je 0x41a57b
lea ecx, [esi + 0xc]
call fcn.00415169
push 0x2710
mov eax, dword [esi + 0x1a84]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41a564
push 0x7b
mov ecx, dword [esi + 0x1a84]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x1a84]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1a84], 0
pop esi
ret