joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1d2373d
Capabilities:
Set current directory

Disassembly:
push ebx
push ebp
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.MSVCR100.dll__time64]
push eax
call dword [sym.imp.MSVCR100.dll_srand]
pop ecx
pop ecx
call sub.mfc100.dll_Ordinal_1929
mov eax, dword [eax + 8]
push 0x104
lea ebx, [esi + 0x590]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
call ebp
lea edi, [esi + eax]
call sub.mfc100.dll_Ordinal_1929
mov eax, dword [eax + 4]
push dword [eax + 0x64]
call ebp
push str..EXE
sub edi, eax
call ebp
sub edi, eax
push ebx
mov byte [edi + 0x590], 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push ebx
push str._sSkin
lea eax, [esi + 0x48c]
push 0x104
push eax
call dword [sym.imp.MSVCR100.dll__snprintf]
add esp, 0x10
lea ecx, [esi + 0xaf0]
call fcn.01d23d4c
test al, al
jne 0x1d237d2
xor al, al
jmp 0x1d238bc
lea ecx, [esi + 0xcac]
call fcn.01d23e65
test al, al
je 0x1d237cb
lea ecx, [esi + 0xe68]
call fcn.01d23f7e
test al, al
je 0x1d237cb
lea ecx, [esi + 0x1024]
call fcn.01d24097
test al, al
je 0x1d237cb
mov eax, dword [esi + 0x115c]
mov ecx, dword [eax]
lea edx, [esi + 0x7a0]
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0x115c]
mov ecx, dword [eax]
lea edx, [esi + 0x7d8]
push edx
push eax
call dword [ecx + 0x1c]
mov eax, dword [esi + 0x115c]
mov ecx, dword [eax]
lea edx, [esi + 0x87c]
push edx
push eax
call dword [ecx + 0x24]
mov eax, dword [esi + 0x115c]
mov ecx, dword [eax]
lea edx, [esi + 0x900]
push edx
push eax
call dword [ecx + 0x28]
mov eax, dword [esi + 0x115c]
mov ecx, dword [eax]
lea edx, [esi + 0x920]
push edx
push eax
call dword [ecx + 0x20]
mov eax, dword [esi + 0x115c]
mov ecx, dword [eax]
lea edx, [esi + 0x9bc]
push edx
push eax
call dword [ecx + 0x30]
mov eax, dword [esi + 0x115c]
mov ecx, dword [eax]
lea edx, [esi + 0x9ec]
push edx
push eax
call dword [ecx + 0x2c]
mov eax, dword [esi + 0x115c]
mov ecx, dword [eax]
push 0x8010100
push 0x1d66bdc
push eax
call dword [ecx + 0x14]
add esp, 0x44
push eax
call dword [sym.imp.SkinControls.dll_public:_static_bool___cdecl_CSkinResourceManager::LoadSkinResource_struct_IUnknownEx__]
pop ecx
test al, al
je 0x1d237cb
mov esi, dword [esi + 0xfa0]
mov eax, dword [esi]
push esi
call dword [eax + 8]
pop ecx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1d28cb2
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x434]
xor ebx, ebx
cmp dword [edi], ebx
je 0x1d28ceb
push ebx
push ebx
push 2
push 4
call fcn.01d27c9c
push 0x3e8
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1d28ceb
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esi + 0x430]
mov dword [esi + 0x3e8], ebx
mov dword [eax + 4], ebx
push dword [esi + 0x438]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [edi]
call esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
pop esi
pop ebx
ret
Function at 0x1d28cb3
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x434]
xor ebx, ebx
cmp dword [edi], ebx
je 0x1d28ceb
push ebx
push ebx
push 2
push 4
call fcn.01d27c9c
push 0x3e8
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1d28ceb
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esi + 0x430]
mov dword [esi + 0x3e8], ebx
mov dword [eax + 4], ebx
push dword [esi + 0x438]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [edi]
call esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
pop esi
pop ebx
ret
Function at 0x1d2ab20
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1d59bbd
call fcn.01d55708
sub esp, 0x58
push ebx
push esi
mov esi, ecx
lea eax, [esi + 0x434]
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
xor ebx, ebx
push edi
cmp eax, ebx
je 0x1d2abdf
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1d2abdf
mov eax, dword [esi + 0x430]
cmp dword [eax + 4], ebx
je 0x1d2abd3
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x430]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 0x20]
lea ecx, [ebp - 0x20]
push dword [esi + 0x3e8]
call fcn.01d4ce60
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.01d27bb5
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.01d2aa1c
push 1
push 4
lea ecx, [ebp - 0x20]
call fcn.01d4cc40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.01d4cc30
push 2
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov eax, dword [ebp - 0x10]
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esi + 0x430]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x3e8], ebx
mov dword [eax + 4], ebx
push dword [esi + 0x438]
call edi
mov eax, dword [ebp - 0x10]
push dword [eax]
call edi
mov edi, dword [ebp - 0x10]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebp - 0x14]
stosd dword es:[edi], eax
call dword [sym.imp.mfc100.dll_Ordinal_316]
movzx eax, byte [esi + 0x370]
push eax
movzx eax, word [esi + 0x368]
push eax
lea eax, [esi + 0x3f0]
push eax
mov eax, dword [esi + 0xbc]
mov eax, dword [eax + 0x24]
add eax, 0x58
push eax
xor edi, edi
lea eax, [ebp - 0x14]
push str._s__RoomToken:_s__ServerType:_ld__HideUserInfo:_d
inc edi
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.mfc100.dll_Ordinal_4283]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x64]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0x24
push 3
pop eax
push dword [ebp - 0x10]
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x64], esi
call dword [sym.imp.mfc100.dll_Ordinal_4499]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
mov esi, eax
call dword [sym.imp.mfc100.dll_Ordinal_11439]
cmp esi, ebx
jne 0x1d2acb5
mov edi, dword [ebp - 0x10]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov eax, ebx
jmp 0x1d2abc4
mov ebx, edi
jmp 0x1d2aca5
Function at 0x1d2ab2e
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov eax, 0x1d59bbd
call fcn.01d55708
sub esp, 0x58
push ebx
push esi
mov esi, ecx
lea eax, [esi + 0x434]
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
xor ebx, ebx
push edi
cmp eax, ebx
je 0x1d2abdf
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1d2abdf
mov eax, dword [esi + 0x430]
cmp dword [eax + 4], ebx
je 0x1d2abd3
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x430]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 0x20]
lea ecx, [ebp - 0x20]
push dword [esi + 0x3e8]
call fcn.01d4ce60
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.01d27bb5
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.01d2aa1c
push 1
push 4
lea ecx, [ebp - 0x20]
call fcn.01d4cc40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.01d4cc30
push 2
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov eax, dword [ebp - 0x10]
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esi + 0x430]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x3e8], ebx
mov dword [eax + 4], ebx
push dword [esi + 0x438]
call edi
mov eax, dword [ebp - 0x10]
push dword [eax]
call edi
mov edi, dword [ebp - 0x10]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebp - 0x14]
stosd dword es:[edi], eax
call dword [sym.imp.mfc100.dll_Ordinal_316]
movzx eax, byte [esi + 0x370]
push eax
movzx eax, word [esi + 0x368]
push eax
lea eax, [esi + 0x3f0]
push eax
mov eax, dword [esi + 0xbc]
mov eax, dword [eax + 0x24]
add eax, 0x58
push eax
xor edi, edi
lea eax, [ebp - 0x14]
push str._s__RoomToken:_s__ServerType:_ld__HideUserInfo:_d
inc edi
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.mfc100.dll_Ordinal_4283]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x64]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0x24
push 3
pop eax
push dword [ebp - 0x10]
mov word [ebp - 0x34], ax
lea eax, [ebp - 0x64]
push eax
push ebx
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x64], esi
call dword [sym.imp.mfc100.dll_Ordinal_4499]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
mov esi, eax
call dword [sym.imp.mfc100.dll_Ordinal_11439]
cmp esi, ebx
jne 0x1d2acb5
mov edi, dword [ebp - 0x10]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov eax, ebx
jmp 0x1d2abc4
mov ebx, edi
jmp 0x1d2aca5
Function at 0x1d302e6
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1d5a127
call fcn.01d55708
sub esp, 0x128
push ebx
push esi
push ecx
mov dword [ebp - 0x14], esp
lea eax, [ebp - 0xd]
mov esi, ecx
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 0x18], esi
call fcn.01d2f9b3
xor ebx, ebx
push 0xff
lea eax, [ebp - 0x133]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x134], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
push str.._ServerAddressInfo.ini
push pe_nt_image_headers32
lea eax, [ebp - 0x134]
push eax
push 0x1d6aca0
push str.SERVERADDRESS
push str.SERVER_ADDRESS_INFO
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xb
push str.192.168.0.7
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x34], bl
call fcn.01d0ca33
lea eax, [ebp - 0x34]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.01d30242
lea ecx, [ebp - 0x134]
push ecx
mov ecx, eax
call fcn.01d0caa7
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.01d0c7ec
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x1d3ed99
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push edi
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 2
pop eax
mov word [ebx], ax
xor eax, eax
mov word [ebx + 2], ax
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x80]
sub edx, eax
pop edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1d3edc0
mov al, byte [ebp - 0x80]
push esi
lea esi, [ebp - 0x80]
test al, al
je 0x1d3edfc
cmp byte [esi], 0x3a
jne 0x1d3edf3
lea eax, [esi + 1]
push eax
mov byte [esi], 0
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebx + 2], ax
inc esi
cmp byte [esi], 0
jne 0x1d3edd5
mov al, byte [ebp - 0x80]
sub al, 0x30
pop esi
cmp al, 9
ja 0x1d3ee24
lea eax, [ebp - 0x80]
push 0x1d6dc00
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x1d3ee24
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
jmp 0x1d3ee3d
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x1d3ee36
xor al, al
leave
ret
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebx + 4], eax
mov al, 1
leave
ret

Function at 0x1d3f16d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x14]
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x1d3f226
mov ecx, edi
call fcn.01d3e371
push 0xffffffffffffffff
mov ecx, edi
call fcn.01d3e47c
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
mov dword [ebp - 0x18], 0x756f5354
mov dword [ebp - 0x14], 0x20656372
mov dword [ebp - 0x10], 0x69676e45
mov dword [ebp - 0xc], 0x5120656e
mov dword [ebp - 8], 0x79726575
mov byte [ebp - 4], bl
call fcn.01d3e4ba
mov eax, dword [esi]
push ebx
push 0x6987
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
push ebx
push 0x6988
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
push ebx
push 0x6989
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
push ebx
push 0x698a
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
push ebx
push 0x698b
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
push ebx
push 0x698c
mov ecx, esi
call dword [eax + 0x10]
call fcn.01d404f4
fstp dword [0x1d8d330]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1d3f6ea
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [ebp - 8], esi
call dword [eax + 0x14]
mov dword [ebp - 4], eax
test eax, eax
je 0x1d3f7fe
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, eax
imul ebx, ebx, 0x1bc
add ebx, dword [esi + 0x18]
push edi
mov cl, byte [ebx + 4]
mov byte [ebp - 0x18], cl
mov cl, byte [ebx + 5]
mov byte [ebp - 0x17], cl
mov cl, byte [ebx + 6]
mov byte [ebp - 0x16], cl
mov cl, byte [ebx + 7]
mov byte [ebp - 0x15], cl
mov ecx, dword [ebx + 8]
mov dx, word [ebx + 8]
sar ecx, 8
and ecx, 0xff
shl dx, 8
or cx, dx
push 5
mov word [ebp - 0xa], cx
pop ecx
mov dword [ebp - 0x1c], 3
lea esi, [ebp - 0x1c]
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
lea edx, [ebp - 0x50]
push edx
push eax
push ecx
lea eax, [ebp + 0xc]
push eax
call fcn.01d3fb72
mov eax, dword [eax]
add esp, 0x10
cmp eax, dword [esi + 0xc]
je 0x1d3f78a
mov word [ebx + 0x24], pe_nt_image_headers32
jmp 0x1d3f7fc
mov ecx, dword [ebp - 4]
mov dword [ebx + 0xc], 1
call fcn.01d3e371
mov ecx, dword [ebp - 4]
push 0xffffffffffffffff
call fcn.01d3e47c
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 0x756f5354
mov dword [ebp - 0x30], 0x20656372
mov dword [ebp - 0x2c], 0x69676e45
mov dword [ebp - 0x28], 0x5120656e
mov dword [ebp - 0x24], 0x79726575
mov byte [ebp - 0x20], 0
call fcn.01d3e4ba
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
push 0
lea edx, [ebp - 0x1c]
push edx
call dword [eax + 0xc]
call fcn.01d404f4
fstp dword [ebp - 0x38]
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 0x50]
push ecx
push eax
lea ecx, [esi + 0xc]
call fcn.01d3fd7e
pop edi
pop ebx
pop esi
leave
ret 8

Function at 0x1d401d1
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
cmp byte [ebx + 8], 0
push 5
lea edi, [ebx + 0x2084]
pop ecx
mov byte [ebx + 0x2098], 0
rep movsd dword es:[edi], dword [esi]
jne 0x1d401fb
xor eax, eax
jmp 0x1d40257
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x1d4020b
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
mov esi, eax
mov ecx, dword [0x1d874b8]
mov eax, dword [ecx]
lea edx, [ebp - 0x10]
push edx
push dword [ebp + 8]
call dword [eax]
push 0x10
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, esi
call fcn.01d3e208
push eax
mov ecx, esi
call fcn.01d3e204
push eax
push dword [ebx + 0x207c]
call dword [sym.imp.WS2_32.dll_sendto]
mov ecx, esi
mov edi, eax
call fcn.01d3e208
mov ecx, eax
mov eax, edi
sub eax, ecx
neg eax
sbb eax, eax
not eax
and eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1d4025e
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov esi, ecx
xor eax, eax
mov byte [esi + 0x2098], 1
lea edi, [esi + 0x2084]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp byte [esi + 8], 0
jne 0x1d40286
xor eax, eax
jmp 0x1d402f5
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x1d40294
mov eax, dword [esi]
call dword [eax + 0x14]
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [0x1d874b8]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x24]
mov word [ebp - 0x12], ax
mov dword [ebp - 0x24], 2
mov eax, dword [ecx]
push edx
call dword [eax]
push 0x10
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, edi
call fcn.01d3e208
push eax
mov ecx, edi
call fcn.01d3e204
push eax
push dword [esi + 0x207c]
call dword [sym.imp.WS2_32.dll_sendto]
mov ecx, edi
mov esi, eax
call fcn.01d3e208
mov ecx, eax
mov eax, esi
sub eax, ecx
neg eax
sbb eax, eax
not eax
and eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x1d40345
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
mov dword [esi], vtable.CSocketThread.0
call fcn.01d3feea
lea eax, [esi + 8]
xor edi, edi
push eax
mov dword [esi + 0x20], edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
push eax
push edi
push esi
push 0x1d3fdae
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x24], eax
pop edi
mov eax, esi
pop esi
ret

Function at 0x1d4038c
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 8]
push edi
mov dword [esi], vtable.CSocketThread.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [esi + 0x2c]
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop edi
pop esi
pop ebx
ret

Function at 0x1d4038d
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 8]
push edi
mov dword [esi], vtable.CSocketThread.0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push dword [esi + 0x2c]
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
pop edi
pop esi
pop ebx
ret
Function at 0x1d40500
Capabilities:
Create udp socket
Set socket configuration

Disassembly:
mov eax, 0x1d5ac7a
call fcn.01d55708
sub esp, 0x18
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esi], vtable.CSocket.0
push edi
mov dword [ebp - 0x14], esi
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov edi, dword [ebp + 8]
push ebx
push edi
lea ecx, [esi + 0x38]
mov dword [ebp - 4], ebx
call fcn.01d3e41d
push fcn.01d3e1d9
push 0x1d409bf
push 0x10
push 0x203c
lea eax, [esi + 0x20ac]
push eax
mov byte [ebp - 4], 1
call fcn.01d55a54
xor eax, eax
inc eax
push 0x18
mov byte [ebp - 4], 2
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], eax
mov dword [esi + 4], edi
mov byte [esi + 8], bl
mov byte [esi + 0x20], bl
mov dword [esi + 0x2078], ebx
mov dword [esi + 0x2080], ebx
mov byte [esi + 0x2098], bl
mov dword [esi + 0x209c], ebx
mov dword [esi + 0x20a0], ebx
mov dword [esi + 0x20a8], ebx
call sub.mfc100.dll_Ordinal_1294
pop ecx
push eax
mov dword [esi + 0x2074], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.01d40425
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
or edi, 0xffffffff
mov dword [esi + 0x207c], eax
cmp eax, edi
je 0x1d4065a
lea ecx, [ebp + 8]
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, edi
jne 0x1d405f6
push dword [esi + 0x207c]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x207c], ebx
jmp 0x1d4065a
push 4
lea eax, [ebp - 0x10]
push eax
push 0x20
push 0xffff
push dword [esi + 0x207c]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, edi
je 0x1d405e2
mov dword [ebp - 0x20], ebx
cmp dword [ebp + 0xc], edi
jne 0x1d4061f
xor eax, eax
jmp 0x1d40628
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
push 2
mov word [ebp - 0x22], ax
pop eax
mov word [ebp - 0x24], ax
push 0x10
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0x207c]
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, edi
je 0x1d405e2
mov byte [esi + 8], 1
call fcn.01d40425
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx + 4]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x1d40c3e
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.01d558b0
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jge 0x1d40c68
xor eax, eax
jmp 0x1d40d08
mov eax, dword [ebp + 0xc]
or dword [eax], 0xffffffff
xor esi, esi
cmp dword [edi + 4], esi
je 0x1d40c61
push esi
push 0x8000027
push 3
push esi
push 1
push connect
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x1d40cd4
jmp 0x1d40c61
cmp dword [ebp + 8], esi
je 0x1d40cf2
push esi
push edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov ebx, dword [ebp - 8]
mov edi, dword [ebx + 4]
lea esi, [ebp - 0x1008]
mov ebx, dword [ebp + 8]
lea edx, [esi + ebx]
xor eax, eax
mov bl, byte [esi]
mov al, cl
inc esi
xor al, bl
shr ecx, 8
mov ebx, dword [edi + eax*4]
xor ecx, ebx
cmp edx, esi
jne 0x1d40cb6
pop edi
pop esi
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor esi, esi
push esi
lea eax, [ebp + 8]
push eax
push 0x1000
lea eax, [ebp - 0x1008]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1d40c98
cmp dword [ebp - 4], esi
je 0x1d40d00
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
not dword [eax]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1d40dbc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push esi
push 0x1d6dd18
push 0x187
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x1d40ea3
call sub.mfc100.dll_Ordinal_1929
mov eax, dword [eax + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1d40ea3
push ebx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, 0x1d9d550
lea ebp, [eax + 2]
mov esi, pe_nt_image_headers32
push edi
xor edi, edi
push 0x10
push 0
push ebp
call dword [sym.imp.MSVCR100.dll_strtol]
add esp, 0xc
mov byte [ebx + edi], al
inc edi
add ebp, 4
cmp edi, esi
jl 0x1d40e16
add ebx, esi
cmp ebx, 0x1dad550
jl 0x1d40e14
push str.dict
push 0x186
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x1d40ea0
call sub.mfc100.dll_Ordinal_1929
mov eax, dword [eax + 8]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1d40ea0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, 0x1d8d550
lea ebp, [eax + 2]
xor edi, edi
push 0x10
push 0
push ebp
call dword [sym.imp.MSVCR100.dll_strtol]
add esp, 0xc
mov byte [ebx + edi], al
inc edi
add ebp, 4
cmp edi, esi
jl 0x1d40e7d
add ebx, esi
cmp ebx, 0x1d9d550
jl 0x1d40e7b
pop edi
pop ebp
pop ebx
mov eax, dword [esp + 4]
pop esi
pop ecx
ret