joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412c3f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
push 0
push dword [ebp + 8]
call fcn.0040357d
pop edi
pop edx
test eax, eax
jle 0x412dc9
mov edi, eax
push ebx
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
lea eax, [eax + 8]
push esi
push eax
mov dword [ebp - 0x1c], ecx
call fcn.0042d4e4
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x412ddc
mov ecx, dword [ebp - 0x1c]
add eax, ecx
cmp eax, dword [0x46dcd0]
jbe 0x412c97
mov dword [0x46dcd0], eax
lea esi, [ebx + 1]
mov byte [ebx], 0x20
push edx
push ecx
push esi
push edi
mov dword [ebp - 0x1c], ecx
call fcn.00403603
mov ecx, dword [ebp - 0x1c]
mov byte [ebx + ecx + 1], 0
mov ebx, esi
push ecx
push ecx
push edi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
add esp, 0xc
movsx eax, byte [ecx]
cmp al, 0x20
je 0x412d65
jg 0x412cee
cmp al, 0xa
jg 0x412ce5
cmp al, 8
jg 0x412d5c
test al, al
je 0x412d2a
jmp 0x412d8b
cmp al, 0xd
je 0x412d5c
jmp 0x412d8b
cmp al, 0x23
je 0x412cff
cmp al, 0x60
je 0x412d50
cmp al, 0x22
je 0x412d50
jmp 0x412d8b
cmp ecx, esi
je 0x412d0e
mov al, byte [ecx - 1]
test al, 0xdf
je 0x412d0e
cmp al, 0xa
jne 0x412d8b
mov byte [ebx], 0x20
inc ebx
push eax
push eax
push 0xa
push ecx
call fcn.004033de
add esp, 0x10
mov ecx, eax
test eax, eax
jne 0x412d95
jmp 0x412de1
sub esp, 0xc
mov byte [ebx], 0
mov ebx, dword [0x46de80]
push esi
call fcn.00412df0
add esp, 0x10
cmp dword [0x46d4bc], 0
mov dword [0x46de80], ebx
jne 0x412dc5
jmp 0x412d9b
test edi, edi
je 0x412d89
cmp eax, edi
jne 0x412d8b
xor edi, edi
jmp 0x412d8b
test edi, edi
jne 0x412d8b
mov byte [ecx], 0x20
jmp 0x412d69
test edi, edi
jne 0x412d8b
mov al, byte [ecx + 1]
lea edi, [eax - 0x3b]
and edi, 0xfd
je 0x412d93
cmp al, 0x20
je 0x412d93
mov al, byte [ebx - 1]
xor edi, edi
sub eax, 0x3b
test al, 0xfd
je 0x412d95
jmp 0x412d58
mov edi, eax
mov al, byte [ecx]
inc ebx
mov byte [ebx - 1], al
jmp 0x412d95
xor edi, edi
inc ecx
jmp 0x412cc3
sub esp, 0xc
push dword [ebp + 8]
call fcn.0042d5c4
add eax, 2
mov dword [esp], eax
call fcn.0042d4e4
add esp, 0x10
mov dword [0x46d4bc], eax
test eax, eax
je 0x412dc5
mov edx, dword [ebp + 8]
call fcn.00412420
xor eax, eax
jmp 0x412de8
push 0x10
push dword [ebp + 8]
push dword [0x433c70]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
jmp 0x412de8
mov al, byte [pe_dos_header]
ud2
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x414378
Capabilities:
Get file size

Disassembly:
cmp dword [0x46df30], 0
mov eax, 1
jne 0x4144b4
mov eax, dword [str.ipbase.bin]
test eax, eax
je 0x4144b2
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
push 0
push eax
call fcn.0040357d
pop ecx
mov esi, eax
pop ebx
test eax, eax
jns 0x4143d6
mov eax, dword [str.ipbase.bin]
cmp eax, str.ipbase.bin
je 0x414443
push edx
push eax
push str.Cant_open__s
push 0x4644a0
call fcn.0040423a
add esp, 0x10
jmp 0x414443
push ecx
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
pop ebx
pop eax
cmp edi, 0xff
jle 0x414421
sub esp, 0xc
lea eax, [edi + 0x10]
push eax
call fcn.0042d4e4
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x414421
push eax
push edi
push ebx
push esi
call fcn.00403603
pop edx
cmp eax, edi
jge 0x414447
push edi
push ebx
push 0
push dword [0x452048]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop eax
push ecx
push dword [0x438e18]
push str.Error_loading__s
push 0x4644a0
call fcn.0040423a
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
xor eax, eax
jmp 0x4144aa
mov eax, dword [ebx]
cmp eax, 0x4d6559
jne 0x414458
mov dword [0x46df30], ebx
jmp 0x41447c
cmp eax, 0x4d6558
jne 0x414410
mov eax, dword [ebx + 4]
sub esp, 0xc
add eax, 0x2008
push eax
call fcn.0042d4e4
add esp, 0x10
mov dword [0x46df30], eax
test eax, eax
je 0x414410
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x46df30]
call fcn.004142ef
pop eax
pop edx
push str.IP___country_base_loaded
push 0x4644a0
call fcn.0040423a
add esp, 0x10
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
ret
Function at 0x416686
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x818]
push ebx
sub esp, 0x814
mov esi, dword [ebp + 0xc]
push edi
push dword [ebp + 8]
call fcn.00401256
add esp, 0x10
test eax, eax
jle 0x4166cd
lea ebx, [ebp - 0x418]
push eax
push eax
push ebx
push esi
call fcn.00401256
add esp, 0x10
test eax, eax
jle 0x4166cd
push esi
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x4166d9
push ebx
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edx
pop ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4166e3
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x418]
push ebx
sub esp, 0x414
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push edi
push ebx
call fcn.00401256
add esp, 0x10
test eax, eax
jle 0x416715
push eax
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x41671f
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edx
pop ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x416729
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp - 0x408]
sub esp, 0x408
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.00401256
add esp, 0x10
test eax, eax
jle 0x416757
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x416761
sub esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
add esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x41676b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp - 0x408]
sub esp, 0x408
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.00401256
add esp, 0x10
test eax, eax
jle 0x416799
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4167a3
sub esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x4167ad
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp - 0x408]
sub esp, 0x408
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.00401256
add esp, 0x10
test eax, eax
jle 0x4167db
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x4167e5
sub esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x4167ef
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x418]
push ebx
sub esp, 0x414
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push edi
push ebx
call fcn.00401256
add esp, 0x10
test eax, eax
jle 0x416821
push eax
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x41682b
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edx
pop ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x419594
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], 0
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x4195bc
mov eax, dword [0x42e654]
mov dword [ebp - 0x2c], eax
mov byte [edi], 0
xor esi, esi
cmp dword [ebp - 0x1c], 0
jg 0x4195f6
push eax
push ebx
push 0
push dword [ebp - 0x2c]
call fcn.0040bdd0
add esp, 0x10
test eax, eax
jg 0x4195e4
push esi
push esi
push ebx
push str.Timeout
jmp 0x419611
lea eax, [ebp - 0x1c]
push edx
push eax
push 0x4004667f
push ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop ecx
lea eax, [edi + esi]
push 0
push 1
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x41961e
push eax
push eax
push ebx
push str.Connection_closed
call fcn.0040432d
add esp, 0x10
or eax, 0xffffffff
jmp 0x419699
inc esi
dec dword [ebp - 0x1c]
cmp byte [edi + esi - 1], 0xa
mov byte [edi + esi], 0
je 0x419635
cmp esi, 0x1ff
jne 0x4195c1
cmp esi, 2
mov eax, 2
cmovge eax, esi
cmp dword [ebp + 0x10], 0
mov dword [edi + eax - 2], 0
jne 0x41965c
sub esp, 0xc
push edi
call fcn.0041244e
add esp, 0x10
jmp 0x419663
mov eax, dword [edi]
or eax, 0x20202020
test byte [0x46d97a], 0x40
je 0x419699
cmp dword [ebp + 0x10], 0
mov edx, str.___.256s_r_n
mov esi, str.__.256s_r_n
mov dword [ebp - 0x2c], eax
cmove edx, esi
sub esp, 0xc
push edx
push 0
push ebx
push edi
push dword [0x46446c]
call fcn.00403f0e
mov eax, dword [ebp - 0x2c]
add esp, 0x20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x419a58
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x9c
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x419b7c
cmp byte [ebx], 0
je 0x419b7c
push eax
push eax
push str.____t_r_n
push ebx
call fcn.00403442
add esp, 0x10
mov dword [ebp - 0x9c], eax
test eax, eax
je 0x419a97
mov byte [eax], 0
sub esp, 0xc
push dword [ebp + 0xc]
lea esi, [ebp - 0x98]
call fcn.0040b474
add esp, 0x10
test eax, eax
je 0x419ad5
push eax
push eax
mov eax, dword [ebp + 0xc]
add eax, 8
push eax
push esi
call fcn.00403813
add esp, 0xc
add eax, esi
push ebx
push str.._64s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x419b08
sub esp, 0xc
push dword [ebp + 0xc]
call fcn.0040b4a0
add esp, 0xc
movzx edx, al
push ebx
push edx
movzx edx, ah
push edx
mov edx, eax
shr eax, 0x18
shr edx, 0x10
movzx edx, dl
push edx
push eax
push str._u._u._u._u._.64s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
sub esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
add esp, 0xc
test eax, eax
je 0x419b59
push ebx
push dword [edi + 0x80]
push str._u__.64s_spamers_list_content_your_IP_r_n
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
pop edx
pop ecx
mov ecx, edi
push eax
push esi
call fcn.0042d768
lea eax, [edi + 0x10]
push ebx
push str.__r_n_.4000s
push eax
push dword [edi]
push esi
push dword [0x46446c]
call fcn.00403f0e
add esp, 0x20
mov eax, 1
jmp 0x419b7e
cmp dword [ebp - 0x9c], 0
je 0x419b7c
mov eax, dword [ebp - 0x9c]
sub esp, 0xc
inc eax
push eax
call fcn.00404cfd
add esp, 0x10
mov ebx, eax
jmp 0x419a69
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x419b88
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x82c
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test eax, eax
jne 0x419bf6
test esi, esi
jne 0x419bab
xor ebx, ebx
jmp 0x419d8e
mov edx, dword [ecx + 0x1fc]
test edx, edx
je 0x419ba4
lea edi, [edx + 5]
mov ecx, 0x100
test edi, edi
je 0x419bc8
jecxz 0x419bc8
cld
repne scasb al, byte es:[edi]
je 0x419bcd
mov edi, 1
dec edi
sub esp, 0xc
inc edi
mov ecx, edx
push edi
call fcn.00411322
add esp, 0xc
push esi
lea esi, [ebp - 0x81c]
push eax
push str._.128s_.64s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, esi
add esp, 0x10
cmp byte [eax], 0
je 0x419ba4
mov dword [ebp - 0x824], 0
lea edx, [ebp - 0x81c]
mov dword [ebp - 0x820], edx
push edx
push edx
push 0
push eax
call fcn.0040357d
pop ecx
pop esi
mov dword [ebp - 0x828], eax
test eax, eax
jle 0x419ba4
lea ecx, [ebp - 0x828]
call fcn.00419902
test eax, eax
jle 0x419d7a
sub esp, 0xc
lea eax, [ebp - 0x81c]
push eax
call fcn.00404cfd
add esp, 0x10
mov esi, eax
mov al, byte [eax]
cmp al, 0x3f
jne 0x419d57
push eax
push eax
push str._checkhello
push esi
call fcn.004034b9
add esp, 0x10
test eax, eax
je 0x419d09
cmp byte [ebx + 0x1f4], 0
jne 0x419d09
sub esp, 0xc
lea edi, [ebx + 0xec]
mov byte [ebx + 0x1f4], 0x30
push edi
call fcn.0040ee69
add esp, 0x10
test eax, eax
je 0x419d09
push eax
push eax
push 0x2e
push edi
call fcn.004033de
add esp, 0x10
test eax, eax
je 0x419d09
push eax
push eax
push str.________
push edi
call fcn.00403442
add esp, 0x10
test eax, eax
jne 0x419d09
sub esp, 0xc
push edi
call fcn.0042d5c4
add esp, 0x10
cmp eax, 0x3f
ja 0x419d09
sub esp, 0xc
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
add esp, 0xc
test eax, eax
je 0x419d09
mov eax, dword [eax + 0xc]
test eax, eax
je 0x419d09
mov edx, dword [eax]
test edx, edx
je 0x419d09
mov ecx, dword [ebx]
mov edi, dword [ecx + 4]
cmp dword [edx], edi
jne 0x419d04
mov byte [ebx + 0x1f4], 0x31
jmp 0x419d09
add eax, 4
jmp 0x419ce8
cmp byte [esi + 1], 0x3f
jne 0x419d39
sub esp, 0xc
add esi, 2
mov ecx, dword [ebx + 4]
mov edi, dword [ebx]
push esi
mov dword [ebp - 0x82c], ecx
call fcn.00404cfd
pop edx
pop ecx
push edi
push eax
mov ecx, dword [ebp - 0x82c]
call fcn.00419a58
pop esi
pop edi
jmp 0x419d48
sub esp, 0xc
inc esi
mov ecx, ebx
push esi
call fcn.004199be
add esp, 0xc
test eax, eax
je 0x419c2b
mov ebx, 1
jmp 0x419d7c
cmp al, 0x23
je 0x419c2b
test al, al
je 0x419c2b
push eax
push eax
push esi
push dword [ebx + 0xb0]
call fcn.004034dd
add esp, 0x10
jmp 0x419d48
xor ebx, ebx
sub esp, 0xc
push dword [ebp - 0x828]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x41cd0c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
xor esi, esi
push ebx
lea ebx, [ecx + 4]
sub esp, 0x1c
cmp dword [edi], esi
jle 0x41cd77
push eax
push eax
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str._s_s_8.8s._s
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
test eax, eax
jne 0x41cd71
mov edx, dword [0x46446c]
mov dword [ebp - 0x1c], edx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [ebp - 0x1c]
push eax
push dword [ebp + 8]
push str.Cant_delete__s___d_
push edx
call fcn.0040423a
add esp, 0x10
inc esi
add ebx, 8
jmp 0x41cd1c
mov dword [edi], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10

Function at 0x41cd88
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ecx + 8]
push esi
push ebx
mov ebx, ecx
sub esp, 0x978
mov esi, dword [ebp + 8]
mov edx, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 0x81c], 0
push edi
push dword [ebp + 0xc]
push dword [ecx + 0xc]
push str._s_s._s
push esi
mov dword [ebp - 0x970], edx
call edx
lea eax, [ebp - 0x95c]
add esp, 0x18
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x96c], eax
inc eax
pop edx
mov edx, dword [ebp - 0x970]
pop ecx
jne 0x41cdf2
cmp byte [ebx + 8], 0x61
jne 0x41ceef
jmp 0x41cec6
lea eax, [ebp - 0x950]
test byte [0x46d97d], 8
jne 0x41ce07
lea eax, [ebp - 0x948]
mov ecx, dword [ebp + 0x10]
cmp dword [eax + 4], ecx
jae 0x41ce80
cmp byte [ebp - 0x930], 0x2e
je 0x41ce80
sub esp, 0xc
lea eax, [ebp - 0x930]
push eax
call fcn.0042d5c4
add esp, 0x10
cmp eax, 8
jbe 0x41ce80
cmp byte [ebp - 0x928], 0x2e
jne 0x41ce80
cmp dword [ebp - 0x81c], 0xfe
jle 0x41ce57
push edi
lea ecx, [ebp - 0x81c]
push dword [ebp + 0xc]
push dword [ebx + 0xc]
push esi
call fcn.0041cd0c
mov eax, dword [ebp - 0x81c]
mov edx, dword [ebp - 0x930]
mov dword [ebp + eax*4 - 0x818], edx
lea edx, [eax + 2]
mov dword [ebp - 0x81c], edx
mov edx, dword [ebp - 0x92c]
mov dword [ebp + eax*4 - 0x814], edx
push eax
push eax
lea eax, [ebp - 0x95c]
push eax
push dword [ebp - 0x96c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
pop edx
pop ecx
test eax, eax
jg 0x41cdf2
sub esp, 0xc
push dword [ebp - 0x96c]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x81c]
add esp, 0xc
push edi
push dword [ebp + 0xc]
push dword [ebx + 0xc]
push esi
call fcn.0041cd0c
jmp 0x41ceef
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x41ceef
test byte [0x46d97e], 0x80
je 0x41ceef
push eax
push dword [ebx + 0xc]
push 0x447e36
push esi
call edx
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
add esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x41cefa
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1ac
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ecx + 0xc]
push 0x447e3c
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
pop eax
lea eax, [ebp - 0x158]
pop edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x1ac], eax
inc eax
pop ecx
pop esi
je 0x41cfdc
test byte [ebp - 0x158], 0x10
je 0x41cfab
sub esp, 0xc
lea esi, [ebp - 0x12c]
push esi
call fcn.0042d5c4
add esp, 0x10
cmp eax, 2
jle 0x41cfab
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
jne 0x41cf7f
push eax
mov ecx, ebx
push dword [ebp + 0x10]
push esi
push edi
call fcn.0041cefa
push dword [ebp + 0x10]
mov ecx, ebx
push esi
push edi
call fcn.0041cd88
jmp 0x41cfaa
lea edx, [ebp - 0x1a0]
push esi
push dword [ebp + 0xc]
push str._.8s_.64s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [ebp - 0x1a0]
mov ecx, ebx
add esp, 0xc
push dword [ebp + 0x10]
push edx
push edi
call fcn.0041cd88
pop esi
push eax
push eax
lea eax, [ebp - 0x158]
push eax
push dword [ebp - 0x1ac]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
pop edx
pop ecx
test eax, eax
jg 0x41cf3c
sub esp, 0xc
push dword [ebp - 0x1ac]
call dword [sym.imp.KERNEL32.dll_FindClose]
add esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x41e420
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0xc
mov esi, dword [ebp + 8]
sub esp, 0xc
lea edi, [ebx + 0x200]
mov ecx, ebx
push edi
call fcn.0041e2c2
add esp, 0xc
test eax, eax
je 0x41e481
cmp byte [ebx + 0x244], 0
je 0x41e45e
cmp dword [ebx + 0x28c], esi
jne 0x41e42e
mov eax, 1
jmp 0x41e483
sub esp, 0xc
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
add esp, 0xc
test eax, eax
je 0x41e42e
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
test edx, edx
je 0x41e42e
cmp dword [edx], esi
je 0x41e457
add eax, 4
jmp 0x41e472
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x41e48d
Capabilities:
Create udp socket
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
cmp dword [str.127.0.0.1], 0
mov ebx, dword [ebp + 0xc]
jne 0x41e4a9
xor eax, eax
jmp 0x41e64b
push eax
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x3c], eax
pop edx
test eax, eax
js 0x41e4a2
mov eax, dword [str.127.0.0.1]
sub esp, 0xc
mov edi, ebx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
call fcn.00412680
mov ecx, 0x10
xor edx, edx
mov esi, eax
lea eax, [ebp - 0x28]
call fcn.0041e104
mov dword [ebp - 0x24], esi
mov ecx, 0xc
mov esi, 0x438ec0
mov dword [ebp - 0x28], 0x35000002
inc word [0x438ec0]
test edi, edi
je 0x41e50d
test esi, esi
je 0x41e50d
jecxz 0x41e50d
cld
rep movsb byte es:[edi], byte [esi]
lea eax, [ebx + 0xc]
pop esi
pop edi
push dword [ebp + 8]
push eax
mov esi, 6
call fcn.0041e114
add esp, 0x10
mov dword [ebp - 0x30], eax
mov dword [eax], 0x1000f00
push eax
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x30]
push 0x10
sub eax, ebx
push edi
add eax, 4
push 0
push eax
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.WS2_32.dll_sendto]
pop edx
pop ecx
test eax, eax
jle 0x41e4a2
push eax
push dword [ebp - 0x3c]
push 0
push esi
mov dword [ebp - 0x2c], 0xffffffff
call fcn.0040bdd0
add esp, 0x10
test eax, eax
jle 0x41e593
push eax
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x10
push edi
push 0
push 0x200
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.WS2_32.dll_recvfrom]
pop edx
pop ecx
mov dword [ebp - 0x2c], eax
jmp 0x41e599
dec esi
cmp esi, 2
jne 0x41e52c
sub esp, 0xc
push dword [ebp - 0x3c]
call fcn.0040bf04
mov eax, dword [ebp - 0x2c]
add esp, 0x10
test eax, eax
jle 0x41e4a2
test word [ebx + 2], 0xf00
jne 0x41e5c0
cmp byte [ebx + 7], 0
jne 0x41e624
cmp dword [ebp + 0x10], 0
jne 0x41e4a2
cmp dword [0x46d97c], 0
jns 0x41e4a2
sub esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
add esp, 0xc
test eax, eax
je 0x41e4a2
lea eax, [ebx + 0x258]
mov ecx, 0x34
xor edx, edx
call fcn.0041e104
mov eax, dword [ebp + 8]
mov dword [ebx + 0x258], eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebx + 0x288], 1
mov dword [ebx + 0x25c], eax
jmp 0x41e645
cmp dword [ebp + 0x10], 0
jne 0x41e645
mov dword [ebx + eax], 0
mov eax, dword [ebp - 0x30]
sub esp, 0xc
mov ecx, ebx
add eax, 4
push eax
call fcn.0041e17a
add esp, 0xc
mov eax, dword [ebp - 0x30]
add eax, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41f9de
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0xa8]
push ebx
mov ebx, ecx
sub esp, 0xb0
push 0x10
push 0
push edi
call fcn.0042d588
mov eax, dword [ebx + 0x178]
add esp, 0x10
mov dword [ebp - 0xa8], 0x35000002
test eax, eax
je 0x41fa38
cmp byte [ebx + 0x171], 0x18
ja 0x41fa38
mov edx, dword [ebx + 0xc8]
lea ecx, [ebx + 0x11c]
xor esi, esi
mov dword [ebp - 0xac], ecx
test edx, edx
jne 0x41fac1
push edx
movzx edx, byte [ebx + 0x171]
push edx
push dword [ebp + 8]
push dword [ebx + 0xc8]
push dword [ebx + 0x17c]
push eax
push str.Error_typ_u__u__u__d__d
push dword [0x46447c]
call fcn.0040423a
mov eax, dword [ebx + 0xc8]
add esp, 0x20
jmp 0x41fba1
movzx eax, byte [ebx + 0x170]
cmp eax, edx
jl 0x41fa81
mov byte [ebx + 0x170], 0
movzx eax, byte [ebx + 0x170]
sub esp, 0xc
mov dword [ebp - 0xb0], edx
lea ecx, [eax + 1]
mov byte [ebx + 0x170], cl
mov eax, dword [ebx + eax*4 + 0xcc]
mov ecx, dword [ebp - 0xac]
push eax
mov dword [ebp - 0xa4], eax
call fcn.0041f0d2
mov edx, dword [ebp - 0xb0]
add esp, 0xc
test eax, eax
je 0x41faca
inc esi
cmp esi, edx
jl 0x41fa6f
jmp 0x41fb9f
sub esp, 0xc
lea esi, [ebx + 0x182]
push 0x46e344
call fcn.0040366a
add esp, 0x10
cmp dword [ebp - 0xa4], 0
jne 0x41fb0c
push dword [ebx + 0xc8]
movzx eax, byte [ebx + 0x170]
push eax
push str.Error_resend_Bad_addres__u__u
push dword [0x46447c]
call fcn.0040423a
add esp, 0x10
jmp 0x41fb31
mov byte [ebx + 0x18d], 0
push edx
push edx
push 0x10
push edi
push 0
push dword [ebx + 0x17c]
push esi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
or word [ebx + 2], 1
pop ecx
pop eax
movzx eax, byte [ebx + 0x170]
cmp eax, dword [ebx + 0xc8]
jl 0x41fb47
mov byte [ebx + 0x170], 0
inc byte [ebx + 0x171]
push eax
push eax
lea eax, [ebx + 0xac]
add ebx, 0x18e
push 0
push eax
mov dword [0x46e344], 0
call fcn.0042d9b8
add esp, 0xc
push esi
push ebx
lea ebx, [ebp - 0x98]
push ebx
call fcn.0041f695
push ebx
mov ecx, dword [0x46447c]
push edi
movsx eax, byte [eax + 1]
push eax
push str._recursion_
call fcn.0041edac
mov eax, 1
add esp, 0x10
jmp 0x41fba1
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4