joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dd4d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push esi
lea eax, [ebp - 0x204]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x204]
push 0x5c
push eax
call fcn.00452580
and byte [eax], 0
lea eax, [ebp - 0x204]
push 0x47431c
push eax
call fcn.004524a0
mov esi, 0x100
lea eax, [ebp - 0x100]
push esi
push 0
push eax
call fcn.00451f50
add esp, 0x1c
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x100]
push esi
push eax
push 0
push str.log4cpp.rootCategory
push str.log4cpp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x100]
or esi, 0xffffffff
push eax
push str.DEBUG
call fcn.00452400
pop ecx
test eax, eax
pop ecx
jne 0x41dde4
push 3
pop esi
jmp 0x41de33
lea eax, [ebp - 0x100]
push eax
push str.INFO
call fcn.00452400
pop ecx
test eax, eax
pop ecx
jne 0x41ddff
push 2
jmp 0x41dde1
lea eax, [ebp - 0x100]
push eax
push str.WARN
call fcn.00452400
pop ecx
test eax, eax
pop ecx
jne 0x41de1a
push 1
jmp 0x41dde1
lea eax, [ebp - 0x100]
push eax
push str.ERROR
call fcn.00452400
pop ecx
test eax, eax
pop ecx
jne 0x41de33
xor esi, esi
mov eax, esi
pop esi
leave
ret
Function at 0x422b3f
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
push 0x43
mov dword [ebp - 4], 1
call dword [sym.imp.WS2_32.dll_htons]
push dword [ebp + 8]
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, edi
mov dword [ebp - 0x10], eax
call fcn.004229eb
test eax, eax
jl 0x422c18
mov eax, dword [edi + 0x50]
lea esi, [edi + 0x50]
push 2
mov ecx, esi
call dword [eax + 0xc]
mov ebx, eax
test ebx, ebx
jge 0x422b92
push str.socket_create_failed_n
jmp 0x422bc3
push dword [ebp - 0x12]
call dword [sym.imp.WS2_32.dll_ntohs]
push dword [ebp - 0x10]
mov ebx, eax
call dword [sym.imp.WS2_32.dll_ntohl]
mov edx, dword [esi]
push 0
push ebx
push eax
mov ecx, esi
call dword [edx + 0x14]
mov ebx, eax
test ebx, ebx
jge 0x422bcd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
push str.bind_dhcp_port_failed_n
call fcn.00452e0e
pop ecx
mov eax, ebx
jmp 0x422c18
lea eax, [ebp - 4]
push 4
push eax
push 0x20
push 0xffff
push dword [edi + 0x7c]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x422bf9
push str.setsockopt_failed_n
call fcn.00452e0e
pop ecx
mov eax, 0xc0000001
jmp 0x422c18
mov eax, dword [edi]
and dword [edi + 0x84], 0
push 4
mov word [ebp + 8], 4
push dword [ebp + 8]
mov ecx, edi
call dword [eax + 8]
test eax, eax
jl 0x422c18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x423d59
Capabilities:
Enumerate files on windows
Get file attributes
Set current directory

Disassembly:
mov eax, 0x463b03
call fcn.00451b80
sub esp, 0x174
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
mov al, byte [ebp + 0xb]
push 1
pop ebx
lea ecx, [ebp - 0x20]
push edi
mov dword [ebp - 4], ebx
mov byte [ebp - 0x20], al
call fcn.004079c3
mov al, byte [ebp + 0xb]
push edi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
mov byte [ebp - 0x30], al
call fcn.004079c3
mov al, byte [ebp + 0xb]
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
mov byte [ebp - 0x40], al
call fcn.004079c3
mov esi, 0x47cdfc
push esi
call fcn.004525b0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.0040819b
test byte [0x47ceb0], bl
mov byte [ebp - 4], 4
jne 0x423df9
mov al, byte [ebp + 0xb]
or byte [0x47ceb0], bl
push 0x423f86
mov byte [0x47cea0], al
mov dword [0x47cea4], edi
mov dword [0x47cea8], edi
mov dword [0x47ceac], edi
call fcn.00452cce
pop ecx
push dword [0x47cea8]
mov ecx, 0x47cea0
push dword [0x47cea4]
call fcn.00411728
mov eax, dword [ebp + 0x10]
cmp eax, edi
jne 0x423e1b
mov eax, 0x466500
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [0x466504]
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x30]
push edi
push eax
call fcn.004080af
mov esi, str..
push esi
call fcn.004525b0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.0040796c
mov eax, dword [ebp - 0x2c]
cmp eax, edi
jne 0x423e57
mov eax, 0x466500
lea ecx, [ebp - 0x180]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x423e81
mov ecx, dword [ebp + 8]
push 0x47cea0
call fcn.00418c87
mov dword [ebp - 0x10], ebx
jmp 0x423f41
lea eax, [ebp - 0x154]
push 0x47506c
push eax
call fcn.004535bc
pop ecx
test eax, eax
pop ecx
je 0x423f14
lea eax, [ebp - 0x154]
push 0x475068
push eax
call fcn.004535bc
pop ecx
test eax, eax
pop ecx
je 0x423f14
push dword [0x466504]
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x20]
push edi
push eax
call fcn.004080af
push 0x5c
push ebx
lea ecx, [ebp - 0x20]
call fcn.00408d95
lea eax, [ebp - 0x154]
push eax
call fcn.004525b0
pop ecx
push eax
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040796c
mov eax, dword [ebp - 0x1c]
cmp eax, edi
jne 0x423ef6
mov eax, 0x466500
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test byte [ebp - 0x180], 0x10
je 0x423f14
lea eax, [ebp - 0x20]
mov ecx, 0x47cea0
push eax
call fcn.00418cef
lea eax, [ebp - 0x180]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x423e81
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
push 0x47cea0
call fcn.00418c87
mov dword [ebp - 0x10], ebx
push ebx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.004079c3
push ebx
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.004079c3
push ebx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.004079c3
and byte [ebp - 4], 0
push ebx
lea ecx, [ebp + 0xc]
call fcn.004079c3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42c437
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebx + 0x1a]
mov esi, ecx
push 0
mov dword [ebp - 4], esi
call dword [sym.imp.WS2_32.dll_htons]
push edi
call dword [sym.imp.WS2_32.dll_htonl]
mov eax, dword [ebx + 8]
cmp dword [esi + 0x60], 0
mov dword [ebp - 0x14], eax
movzx eax, byte [ebx + 0x11]
mov dword [ebp - 0x10], eax
jne 0x42c471
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
lea ecx, [esi + 0x3c]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0042f2e3
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x40]
je 0x42c52e
add eax, 0x14
lea edi, [ebp - 0x20]
mov esi, eax
mov dword [ebp - 8], eax
movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x1c], eax
ja 0x42c4b3
cmp dword [ebp - 0x1c], 0
je 0x42c4b3
mov ecx, dword [ebx + 0x1a]
cmp dword [ebp - 0x20], ecx
jne 0x42c4c4
jmp 0x42c4b6
mov ecx, dword [ebx + 0x1a]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
call fcn.0040273d
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0xc]
sub eax, dword [ebp - 0x1c]
cmp eax, 0x1900
jbe 0x42c50c
cmp word [ebx + 2], 0x8000
je 0x42c50c
xor esi, esi
push esi
call dword [sym.imp.WS2_32.dll_htons]
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_htonl]
call fcn.0040273d
sub eax, dword [ebp - 0x18]
cmp eax, 0xa
jbe 0x42c523
mov eax, dword [ebx + 0x1a]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
call fcn.0040273d
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
lea esi, [eax + 0x4c]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 8]
lea esi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x42c576
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov word [eax + 4], si
jmp 0x42c518
mov eax, dword [ebx + 0x1a]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x1c], eax
call fcn.0040273d
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
lea esi, [ebp - 0x20]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
push eax
mov eax, dword [ebp - 4]
movsd dword es:[edi], dword [esi]
lea ecx, [eax + 0x3c]
call fcn.0042f18b
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
lea esi, [eax + 0x4c]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x42d5ce
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
lea esi, [ebx + 0xd]
lea eax, [ebp + 8]
push esi
lea ecx, [edi + 4]
push eax
mov dword [ebp - 4], ecx
call fcn.0042f6f0
mov eax, dword [ebp + 8]
cmp eax, dword [edi + 8]
je 0x42d604
call fcn.0040273d
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
jmp 0x42d62b
call fcn.0040273d
mov dword [ebx + 4], eax
mov eax, dword [esi]
push 7
mov dword [ebp - 0x28], eax
pop ecx
lea eax, [ebp - 0x28]
mov esi, ebx
lea edi, [ebp - 0x24]
push eax
lea eax, [ebp - 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
push eax
call fcn.0042f326
pop edi
pop esi
mov al, 1
pop ebx
leave
ret 4

Function at 0x431ba4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea ecx, [ebp - 4]
xor eax, eax
push ecx
push eax
push 0x47cf08
push 0x431b85
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 1
mov dword [0x47cf08], eax
pop eax
leave
ret
Function at 0x433cd3
Capabilities:
Create directory

Disassembly:
mov eax, 0x464710
call fcn.00451b80
mov eax, 0x483c
call fcn.00452660
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi + 0x43]
call fcn.0043d288
test al, al
pop ecx
je 0x433ed8
lea eax, [ebp - 0x4848]
push eax
call fcn.0040404e
movzx eax, al
xor ebx, ebx
pop ecx
cmp eax, ebx
mov dword [ebp - 0x18], eax
jl 0x433eda
lea eax, [esi + 0x47]
push eax
lea eax, [ebp - 0x2848]
push eax
call fcn.00452490
lea eax, [ebp - 0x4848]
push eax
call fcn.004040c6
movzx eax, al
add esp, 0xc
mov dword [ebp - 0x18], eax
mov al, byte [ebp + 0xb]
lea ecx, [ebp - 0x48]
push ebx
mov byte [ebp - 0x48], al
call fcn.004079c3
lea eax, [ebp - 0x2848]
push eax
call fcn.004525b0
pop ecx
push eax
lea eax, [ebp - 0x2848]
push eax
lea ecx, [ebp - 0x48]
call fcn.0040819b
mov al, byte [ebp + 0xb]
mov dword [ebp - 4], ebx
mov byte [ebp - 0x28], al
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov al, byte [ebp + 0xb]
push ebx
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
mov byte [ebp - 0x38], al
call fcn.004079c3
mov edi, 0x474eac
push edi
call fcn.004525b0
pop ecx
push eax
push edi
lea ecx, [ebp - 0x38]
call fcn.0040819b
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00412f7c
add esp, 0xc
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
push 1
call fcn.004079c3
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
je 0x433e97
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add eax, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x466500
mov eax, dword [eax]
cmp eax, ebx
je 0x433df8
mov dword [ebp - 0x14], eax
mov edx, 0xff
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x447]
mov byte [ebp - 0x448], bl
mov byte [ebp - 0x848], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x847]
push dword [ebp - 0x14]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x448]
push eax
call fcn.00452490
lea eax, [ebp - 0x448]
push 0x474560
push eax
call fcn.004524a0
add esp, 0x10
lea eax, [ebp - 0x448]
push ebx
push eax
call esi
push dword [ebp - 0x14]
lea eax, [ebp - 0x848]
push eax
call fcn.00452490
lea eax, [ebp - 0x848]
push 0x47456c
push eax
call fcn.004524a0
add esp, 0x10
lea eax, [ebp - 0x848]
push ebx
push eax
call esi
add dword [ebp - 0x10], 0x10
mov eax, dword [ebp - 0x10]
add eax, 0xfffffffc
cmp eax, dword [ebp - 0x20]
jne 0x433de5
mov esi, dword [ebp + 8]
push 1
add esi, 0x2c
sub esp, 0x10
lea eax, [ebp - 0x18]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
push 0x871c
push 4
push eax
mov eax, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
push dword [eax + 0x43]
movsd dword es:[edi], dword [esi]
call fcn.0041bb1a
add esp, 0x28
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.004105e6
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x48]
call fcn.004079c3
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x4379ff
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
push ebx
push esi
mov ebx, dword [sym.imp.WS2_32.dll_htons]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov word [ebp - 0x14], 2
movzx esi, word [edi + 6]
mov ax, word [edi + 4]
mov ecx, dword [edi]
push eax
dec esi
mov dword [ebp + 8], ecx
call ebx
push dword [ebp + 8]
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_htonl]
cmp dword [edi + 0x10], 1
mov dword [ebp - 0x10], eax
jne 0x437a76
movsx eax, word [edi + 0x20]
movzx ecx, word [edi + 6]
cmp ecx, eax
je 0x437a59
mov dword [ebp + 8], 0x200
jmp 0x437a6b
shl eax, 9
mov ecx, eax
mov eax, dword [edi + 0x1c]
sub eax, ecx
add eax, 0x200
mov dword [ebp + 8], eax
push dword [ebp + 8]
shl esi, 9
add esi, dword [edi + 0x24]
jmp 0x437aa6
movsx eax, word [edi + 0x2c]
movzx ecx, word [edi + 6]
cmp ecx, eax
je 0x437a8b
mov dword [ebp + 8], 0x200
jmp 0x437a9d
shl eax, 9
mov ecx, eax
mov eax, dword [edi + 0x28]
sub eax, ecx
add eax, 0x200
mov dword [ebp + 8], eax
push dword [ebp + 8]
shl esi, 9
add esi, dword [edi + 0x30]
lea eax, [ebp - 0x610]
push esi
push eax
call fcn.00451bc0
add esp, 0xc
push 3
call ebx
mov word [ebp - 0x614], ax
mov ax, word [edi + 6]
push eax
call ebx
mov word [ebp - 0x612], ax
mov eax, dword [ebp + 8]
push 0x10
lea esi, [eax + 4]
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x614]
push esi
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0x7c]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jl 0x437afe
cmp eax, esi
jne 0x437afe
push 1
pop eax
jmp 0x437b00
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x439056
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
mov esi, ecx
push edi
push 0x3f
lea edi, [ebp - 0x108]
mov eax, dword [esi + 4]
pop ecx
mov dword [ebp - 0x10c], eax
xor eax, eax
mov dword [ebp - 0x110], 1
xor ebx, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
neg eax
sbb eax, eax
mov dword [ebp - 8], ebx
and eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x4390e0
cmp dword [ebp - 4], ebx
je 0x4390c4
push dword [ebp - 4]
lea eax, [ebp - 0x110]
push ebx
push eax
push ebx
push ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x4390db
push ebx
push dword [ebp + 0x10]
push edi
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, ebx
jl 0x4390ea
sub dword [ebp + 0x10], eax
add edi, eax
cmp dword [ebp + 0x10], ebx
jne 0x4390a8
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
xor eax, eax
jmp 0x4390e3
Function at 0x4390ee
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
mov esi, ecx
push edi
push 0x3f
lea edi, [ebp - 0x108]
mov eax, dword [esi + 4]
pop ecx
mov dword [ebp - 0x10c], eax
xor eax, eax
mov dword [ebp - 0x110], 1
xor ebx, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
neg eax
sbb eax, eax
mov dword [ebp - 8], ebx
and eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x43917a
cmp dword [ebp - 4], ebx
je 0x43915c
push dword [ebp - 4]
lea eax, [ebp - 0x110]
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x439175
push ebx
push dword [ebp + 0x10]
push edi
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, ebx
jl 0x439184
je 0x439184
sub dword [ebp + 0x10], eax
add edi, eax
cmp dword [ebp + 0x10], ebx
jne 0x439140
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
xor eax, eax
jmp 0x43917d

Function at 0x439188
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
mov esi, ecx
push edi
push 0x3f
lea edi, [ebp - 0x108]
mov eax, dword [esi + 4]
pop ecx
mov dword [ebp - 0x10c], eax
xor eax, eax
mov dword [ebp - 0x110], 1
xor ebx, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
neg eax
sbb eax, eax
mov dword [ebp - 8], ebx
and eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, ebx
mov dword [ebp + 0x10], eax
je 0x439214
cmp dword [ebp - 4], ebx
je 0x4391f6
push dword [ebp - 4]
lea eax, [ebp - 0x110]
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x43921e
push ebx
push dword [ebp + 0x10]
push edi
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, ebx
jl 0x43921e
je 0x43921e
sub dword [ebp + 0x10], eax
add edi, eax
cmp dword [ebp + 0x10], ebx
jne 0x4391da
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
xor eax, eax
jmp 0x439217

Function at 0x43933d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push 0xe
pop ecx
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
and dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x24], 0
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [ebp + 0x18], 0
pop edi
je 0x43939b
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
leave
ret
Function at 0x439a2d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x604
cmp dword [ebp + 0x14], 0x5fc
push ebx
push esi
push edi
push 2
pop ebx
jbe 0x439a4f
mov eax, 0xc0000001
jmp 0x439b26
mov esi, dword [ebp + 8]
push 4
lea eax, [ebp - 0x604]
push 0
and word [esi + 0xe], 0
push eax
call fcn.00401165
add esp, 0xc
call fcn.0040273d
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
mov byte [ebp - 0x604], 0x72
mov word [ebp - 0x603], di
je 0x439a9e
push dword [ebp + 0x14]
lea eax, [ebp - 0x601]
push dword [ebp + 0x10]
push eax
call fcn.00401194
add esp, 0xc
mov eax, dword [ebp + 0x14]
mov edx, dword [esi]
push 0
add eax, 4
push dword [ebp + 0x20]
mov ecx, esi
push eax
lea eax, [ebp - 0x604]
push eax
call dword [edx + 0x18]
test eax, eax
jne 0x439abf
push 1
pop ebx
call fcn.0040273d
mov dword [ebp + 8], eax
cmp ebx, dword [ebp + 0x28]
jbe 0x439acf
push 4
pop ebx
push ebx
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
push esi
call fcn.004399e4
add esp, 0x1c
test eax, eax
je 0x439af3
mov eax, dword [ebp + 0x18]
cmp word [eax + 1], di
je 0x439b1d
call fcn.0040273d
sub eax, dword [ebp + 8]
cmp eax, ebx
jb 0x439ac7
cmp ebx, 0x14
jae 0x439b08
add ebx, ebx
jmp 0x439b0b
push 2
pop ebx
call fcn.0040273d
sub eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x28]
jae 0x439b21
jmp 0x439a75
xor eax, eax
jmp 0x439b26
mov eax, 0xe0000044
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43bd31
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
cmp dword [ebx + 0x10b14], edi
jne 0x43bd80
call fcn.0040273d
mov dword [ebx + 0x10b14], eax
lea eax, [ebp - 0x614]
push eax
call fcn.00404135
test al, al
pop ecx
je 0x43bdd2
lea eax, [ebp - 0x220]
push eax
lea eax, [ebx + 0x109e4]
push eax
call fcn.00452490
lea eax, [ebp - 0x394]
jmp 0x43bdc2
call fcn.0040273d
mov ecx, eax
sub ecx, dword [ebx + 0x10b14]
cmp ecx, 0x14
jbe 0x43be0c
mov dword [ebx + 0x10b14], eax
lea eax, [ebp - 0x614]
push eax
call fcn.00404135
test al, al
pop ecx
je 0x43bdd2
lea eax, [ebp - 0x220]
push eax
lea eax, [ebx + 0x109e4]
push eax
call fcn.00452490
lea eax, [ebp - 0x394]
push eax
lea eax, [ebx + 0x10a64]
push eax
call fcn.00452490
add esp, 0x10
lea esi, [ebx + 0x10a64]
push esi
call fcn.004525b0
test eax, eax
pop ecx
jbe 0x43bdf7
lea eax, [ebx + 0x10b18]
push 0x54b
push eax
push esi
call fcn.00403988
jmp 0x43be09
push 0x80
lea eax, [ebx + 0x10b18]
push edi
push eax
call fcn.00451f50
add esp, 0xc
mov eax, dword [ebp + 8]
push 1
sub esp, 0x10
add ebx, 0x10b18
lea esi, [eax + 0x2c]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
push 0x871d
movsd dword es:[edi], dword [esi]
push 0x80
push ebx
push dword [eax + 0x43]
movsd dword es:[edi], dword [esi]
call fcn.0041bb1a
add esp, 0x28
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4423a6
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
and byte [ebp - 0x2c], 0
push edi
xor eax, eax
lea edi, [ebp - 0x2b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x240]
mov dword [ebp - 8], ecx
push eax
push 0
call fcn.004056ae
pop ecx
test al, al
pop ecx
jne 0x4423de
xor eax, eax
jmp 0x4424d5
lea eax, [ebp - 0x240]
push str.BSSvrCfg.ini
push eax
call fcn.004524a0
pop ecx
lea eax, [ebp - 0x240]
pop ecx
push eax
lea eax, [ebp - 0x2c]
push 0x200
push eax
push 0
push str.NetBCBaseIPAdr
push str.BSSvrCfg
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x2c]
push eax
call fcn.004525b0
test eax, eax
pop ecx
jne 0x442437
push str.234.2.2.2
lea eax, [ebp - 0x2c]
push 0x4773e4
push eax
call fcn.00451ef5
add esp, 0xc
mov edi, dword [sym.imp.WS2_32.dll_inet_addr]
push ebx
lea eax, [ebp - 0x2c]
push esi
push eax
call edi
mov esi, 0x47506c
push esi
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
call fcn.00453eea
push eax
call fcn.00452a87
add esp, 0xc
mov dword [ebp - 0x18], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 4], 3
push esi
push 0
call fcn.00453eea
push eax
call fcn.00452a87
mov dword [ebx], eax
add esp, 0xc
add ebx, 4
dec dword [ebp - 4]
jne 0x44246e
push 0x14
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.00451f50
mov esi, dword [ebp - 8]
add esp, 0xc
mov eax, dword [esi + 0x74]
inc eax
push eax
lea eax, [ebp - 0x40]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push str._d._d._d._d
push eax
call fcn.00451ef5
add esp, 0x18
inc dword [esi + 0x74]
push 0
call dword [sym.imp.WS2_32.dll_htons]
lea eax, [ebp - 0x40]
push eax
call edi
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
pop esi
pop ebx
pop edi
leave
ret