joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x475004]
jne 0x401010
repz ret
jmp fcn.004017e1

Function at 0x406b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040250a
and dword [ebp - 4], 0
cmp dword [0x476ffc], 0
mov ebx, eax
jne 0x406c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406ce0
push eax
call fcn.00402498
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x476ffc], eax
call esi
push eax
call fcn.00402498
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x477000], eax
call esi
push eax
call fcn.00402498
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x477004], eax
call esi
push eax
call fcn.00402498
pop ecx
mov dword [0x47700c], eax
test eax, eax
je 0x406c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402498
pop ecx
mov dword [0x477008], eax
mov eax, dword [0x477008]
cmp eax, ebx
je 0x406c87
cmp dword [0x47700c], ebx
je 0x406c87
push eax
call fcn.00402513
push dword [0x47700c]
mov esi, eax
call fcn.00402513
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406c87
test edi, edi
je 0x406c87
call esi
test eax, eax
je 0x406c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406c7e
test byte [ebp - 0xc], 1
jne 0x406c87
or dword [ebp + 0x10], 0x200000
jmp 0x406cc0
mov eax, dword [0x477000]
cmp eax, ebx
je 0x406cc0
push eax
call fcn.00402513
pop ecx
test eax, eax
je 0x406cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406cc0
mov eax, dword [0x477004]
cmp eax, ebx
je 0x406cc0
push eax
call fcn.00402513
pop ecx
test eax, eax
je 0x406cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x476ffc]
call fcn.00402513
pop ecx
test eax, eax
je 0x406ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46e8b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push edi
cmp ebp, 0x19f
jne 0x46e8d1
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edi, edi
test ebp, ebp
jle 0x46e926
push esi
jmp 0x46e8e0
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 5
mov dword [esp + 0x10], 0
call fcn.0046e8a0
mov eax, dword [esp + 0x10]
add eax, 0x46
mov dword [esp + 0xc], eax
sub dword [esp + 0xc], 0x46
movsx eax, byte [edi + ebx]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
xor dword [esp + 0x18], eax
mov cl, byte [esp + 0x18]
mov byte [edi + ebx], cl
inc edi
cmp edi, ebp
jl 0x46e8e0
pop esi
pop edi
cmp ebp, 0x2d
pop ebp
jne 0x46e941
mov dword [0x2b75218], 0xa62e7790
mov dword [0x2b7521c], 0xffffffff
add esp, 8
ret
Function at 0x41a910
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x1e4dc
mov dword [ebp - 0xc], 0x3000
mov dword [ebp - 4], 0x40
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_VirtualAllocEx]
mov esp, ebp
pop ebp
ret

Function at 0x41aa60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 8], 0x11cb
mov dword [ebp - 0x10], 0
jmp 0x41aa7f
mov eax, dword [ebp - 0x10]
add eax, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0xc]
jae 0x41ab46
mov dword [ebp - 8], 0x4189
cmp dword [ebp - 0x10], 0
jne 0x41aae8
push 0x104
push 0x41d9b8
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
push str.SYSTEM32CABINET.DLL
push 0x41d9b8
call dword [sym.imp.kernel32.dll_lstrcatA]
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 1
push 0x41d9b8
call dword [sym.imp.kernel32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x41aae1
cmp dword [ebp - 4], 0
jne 0x41aae8
mov eax, 0x42
jmp 0x41ab46
mov edx, dword [ebp - 0x10]
add edx, 0x1eed7
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
xor edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov dword [eax], edx
jmp 0x41aa76
mov esp, ebp
pop ebp
ret
Function at 0x401710
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
cdq
sub eax, edx
xor ecx, ecx
mov esi, eax
sar esi, 1
test esi, esi
jle 0x40173b
mov edx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x14]
mov al, byte [edx]
add edx, 2
xor al, 0xad
mov byte [ecx + edi], al
inc ecx
cmp ecx, esi
jl 0x40172b
pop edi
pop esi
ret

Function at 0x4017b0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 4]
add eax, 8
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x401801
mov ecx, dword [esi + 4]
push edi
mov dword [eax], ecx
mov ecx, dword [esi + 4]
mov esi, dword [esi + 8]
mov edx, ecx
lea edi, [eax + 4]
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
push eax
and ecx, 3
push 0x401820
push 0
rep movsb byte es:[edi], byte [esi]
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, dword [esp + 8]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
ret

Function at 0x401bf0
Capabilities:
Enumerate process modules

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401c25
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push eax
push 4
push ecx
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x401c25
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push edx
push eax
push ecx
push esi
call sub.PSAPI.DLL_GetModuleFileNameExA
pop esi
pop ecx
ret
Function at 0x401c30
Capabilities:
Parse pe header

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
cmp word [eax], 0x5a4d
push edi
je 0x401c48
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [esp + 0x10], edi
cmp dword [edi], 0x4550
je 0x401c61
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push eax
push ecx
call esi
mov ebp, eax
test ebp, ebp
jne 0x401c98
mov edx, dword [edi + 0x50]
push 4
push 0x2000
push edx
push eax
call esi
mov ebp, eax
test ebp, ebp
jne 0x401c98
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
xor eax, eax
push 4
push 0x1000
mov dword [ebx + 4], ebp
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x50]
push eax
push ebp
call esi
mov ecx, dword [edi + 0x54]
push 4
push 0x1000
push ecx
push ebp
call esi
mov esi, dword [esp + 0x18]
mov edx, dword [edi + 0x54]
mov edi, eax
push ebx
mov ecx, dword [esi + 0x3c]
add ecx, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
push esi
push ecx
mov edx, dword [ecx + 0x3c]
add eax, edx
mov dword [ebx], eax
mov dword [eax + 0x34], ebp
call fcn.00401d80
mov ecx, dword [esi + 0x34]
mov eax, ebp
add esp, 0xc
sub eax, ecx
je 0x401d21
push eax
push ebx
call fcn.00401f10
add esp, 8
push ebx
call fcn.00401f90
add esp, 4
test eax, eax
je 0x401d51
push ebx
call fcn.00401e50
mov eax, dword [ebx]
add esp, 4
mov eax, dword [eax + 0x28]
test eax, eax
je 0x401d69
add eax, ebp
test eax, eax
je 0x401d51
push 0
push 1
push ebp
call eax
test eax, eax
jne 0x401d62
push ebx
call fcn.00402140
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [ebx + 0x10], 1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
Function at 0x401d80
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
xor ecx, ecx
mov ebp, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x401e41
push esi
push edi
add ebx, 0x10
cmp dword [ebx], 0
jne 0x401deb
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x401e1f
mov eax, dword [ebx - 4]
push 4
push 0x1000
add eax, ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x401e1f
mov ecx, dword [ebx - 4]
mov eax, dword [ebx]
push 4
push 0x1000
add ecx, ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [esp + 0x18]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x401dae
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x401e50
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
xor ecx, ecx
push ebp
mov ebx, dword [eax]
xor ebp, ebp
mov cx, word [ebx + 0x14]
cmp word [ebx + 6], bp
lea eax, [ecx + ebx + 0x18]
jbe 0x401f04
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x401ea7
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x401eea
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov edx, dword [edx*4 + 0x4046f4]
je 0x401ebe
or dh, 2
mov ecx, dword [edi - 0x14]
test ecx, ecx
jne 0x401ed7
test al, 0x40
je 0x401ece
mov ecx, dword [ebx + 0x20]
jmp 0x401ed5
test al, 0x80
je 0x401eea
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x401eea
lea eax, [esp + 0x10]
push eax
push edx
push ecx
mov ecx, dword [edi - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x18]
xor eax, eax
inc ebp
add edi, 0x28
mov ebx, dword [edx]
mov ax, word [ebx + 6]
cmp ebp, eax
jl 0x401e74
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4058c6
Capabilities:
Encode data using xor

Disassembly:
add byte [eax - 0x7f7fff80], al
add byte [eax - 0x7f7fff80], al
add byte [eax - 0x7f7fff80], al
add byte [eax - 0x7f7fff80], al
add byte [eax - 0x7f7fff80], al
add byte [eax - 0x7f7fff80], al
add byte [eax - 0x7f7fff80], al
add byte [eax - 0x7f7fff80], al
add byte [eax - 0x7f7fff80], al
add byte [eax - 0x7f7fff80], al
add byte [eax - 0x7f7fff80], al
add byte [eax - 0x7f7fff80], al
add byte [eax - 0x7f7fff80], al
add byte [eax - 0x7f7fff80], al
add byte [eax + 0x800000], al
add byte [eax + 0x808000], 0x80
add byte [eax], 0x80
add byte [eax], 0x80
add byte [eax], 0x80
add byte [eax], 0x80
cmp al, 0x3a
cmp al, byte [eax + 0x3a3c8000]
cmp al, byte [eax + 0x3a3c8000]
cmp bh, byte [edx + edi]
cmp bh, byte [edx + edi]
cmp bh, byte [edx + edi]
cmp bh, byte [ebx]
cmp dword [ecx], edi
xor eax, 0x35353635
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor eax, 0x33353333
xor esi, dword [edx + esi]
xor dh, byte [ebx]
xor dh, byte [edx]
xor al, 0x33
xor esi, dword [edi]
inc ebx
inc ecx
inc ecx
xor eax, 0x2c2e3333
sub al, 0x2e
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2a
sub ch, byte [ebx]
sub dword [ecx], ebp
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub al, 0x2c
sub byte [edi], ah
daa
adc dl, byte [ecx]
adc dword [edi], eax
pop es
pop es
push es
push es
push es
or cl, byte [edx]
or cl, byte [edi]
push cs
push cs
adc al, 0x13
adc ebx, dword [eax]
pop ss
pop ss
sbb bl, byte [ecx]
sbb dword [edx], ebx
sbb dword [ecx], ebx
sbb bl, byte [ecx]
sbb dword [edx], ebx
sbb dword [ecx], ebx
sbb bl, byte [ecx]
sbb dword [ebx + esi], esi
xor edi, dword [ecx + 0x79]
jns 0x4059b2
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
out 0xe6, al
out 0xe9, al
jmp 0xeb2b44f7

Function at 0x4173d0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x60de7c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x417420
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x41741a
shr eax, 8
cmp al, 2
jne 0x41741a
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004162c6
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
mov eax, 2
xor ecx, ebp
call fcn.004162c6
mov esp, ebp
pop ebp
ret
Function at 0x4191d0
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x48
push 1
call dword [0x60dea4]
mov esi, dword [ebp + 8]
mov edi, eax
add esp, 8
mov ebx, 8
mov dword [esi + 0x3bc], edi
test edi, edi
je 0x4192ac
push dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
lea eax, [edi + 0x10]
push ecx
push dword [ebp + 0xc]
mov dword [esi + 0x3ac], ecx
mov dword [esi + 0x3b4], 0
mov dword [esi + 0x3b8], 0
mov dword [esi + 0x3b0], 0
push eax
mov dword [edi + 4], 0xffffffff
mov dword [edi], 0
call fcn.004192e0
add esp, 0x10
test eax, eax
je 0x4192ac
mov eax, dword [esi + 0x3a8]
test eax, eax
je 0x419264
push eax
call dword [0x60de98]
add esp, 4
mov dword [esi + 0x3a8], 0
push dword [ebp + 0xc]
call dword [0x60dea0]
add esp, 4
mov dword [esi + 0x3a8], eax
test eax, eax
je 0x4192ac
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x4192ac
lea eax, [edi + 0x10]
push eax
push 0x419140
call fcn.00427920
add esp, 8
mov dword [edi], eax
test eax, eax
jne 0x4192c9
call fcn.00449aa8
mov ebx, dword [eax]
lea eax, [esi + 0x3a8]
push eax
call fcn.00419050
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x421e60
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push edi
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ecx + eax*4 + 0x130]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, dword [ebp + 0x18]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x421ede
push esi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x421eae
pop esi
pop edi
mov dword [ebx], 0x51
xor eax, eax
pop ebx
pop ebp
ret
push esi
push dword [ebp + 8]
call fcn.00426420
push eax
mov eax, dword [ebp + 8]
push str.Send_failure:__s
push dword [eax]
call fcn.00421b40
mov eax, dword [ebp + 8]
add esp, 0x14
mov eax, dword [eax]
mov dword [eax + 0x856c], esi
mov eax, edi
mov dword [ebx], 0x37
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4220c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x164]
test eax, eax
je 0x4220e9
push dword [esi + 0xf4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call eax
add esp, 0x14
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp eax, 2
ja 0x42211f
push dword [esi + 0xf0]
lea eax, [eax + eax*2]
push 1
add eax, 0x45d3e8
push 2
push eax
call fcn.0044a8cc
push dword [esi + 0xf0]
push 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0044a8cc
add esp, 0x20
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4222b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x530]
cmp ecx, 0xffffffff
je 0x42230b
mov eax, dword [eax + 0x524]
mov eax, dword [eax]
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x42230b
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4222d9
mov dword [ecx], eax
cmp dword [eax + 0x148], 0
push esi
mov esi, dword [eax + 0x130]
je 0x4222ef
or eax, 0xffffffff
pop esi
pop ebp
ret
push 2
push 1
lea eax, [ebp + 0xb]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
or ecx, 0xffffffff
test eax, eax
cmove esi, ecx
mov eax, esi
pop esi
pop ebp
ret
or eax, 0xffffffff
pop ebp
ret

Function at 0x4224f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x60de7c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x19c], 0
mov ebx, dword [edi]
jne 0x422663
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x84]
mov dword [ebp - 0x108], 0x80
push eax
push esi
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x42256e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.00426420
push eax
push esi
push str.getpeername___failed_with_errno__d:__s
push ebx
call fcn.00421b40
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004162c6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], 0x80
push eax
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4225c1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push edi
call fcn.00426420
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.00421b40
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004162c6
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xcc]
push eax
lea eax, [edi + 0x9e]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00422a60
add esp, 0xc
test eax, eax
jne 0x422612
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.00426420
push eax
push esi
push str.ssrem_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.00421b40
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004162c6
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x100]
push eax
lea eax, [edi + 0xd0]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00422a60
add esp, 0xc
test eax, eax
jne 0x422663
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push edi
call fcn.00426420
push eax
push esi
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.00421b40
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004162c6
mov esp, ebp
pop ebp
ret
push edi
call fcn.00422310
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004162c6
mov esp, ebp
pop ebp
ret
Function at 0x422ed0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push 4
mov esi, dword [edi]
mov eax, dword [esi + 0x314]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 1
push 6
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x422f1a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
call fcn.00426420
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
push esi
call fcn.00421be0
add esp, 0x14
pop edi
pop esi
pop ebp
ret
push str.TCP_NODELAY_set_n
push esi
call fcn.00421be0
add esp, 8
pop edi
pop esi
pop ebp
ret

Function at 0x424fb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 8]
movsx eax, cl
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x424fc1
jmp dword [eax*4 + 0x425034]
mov al, 0x41
pop ebp
ret
mov al, 0x42
pop ebp
ret
mov al, 0x43
pop ebp
ret
mov al, 0x44
pop ebp
ret
mov al, 0x45
pop ebp
ret
mov al, 0x46
pop ebp
ret
mov al, 0x47
pop ebp
ret
mov al, 0x48
pop ebp
ret
mov al, 0x49
pop ebp
ret
mov al, 0x4a
pop ebp
ret
mov al, 0x4b
pop ebp
ret
mov al, 0x4c
pop ebp
ret
mov al, 0x4d
pop ebp
ret
mov al, 0x4e
pop ebp
ret
mov al, 0x4f
pop ebp
ret
mov al, 0x50
pop ebp
ret
mov al, 0x51
pop ebp
ret
mov al, 0x52
pop ebp
ret
mov al, 0x53
pop ebp
ret
mov al, 0x54
pop ebp
ret
mov al, 0x55
pop ebp
ret
mov al, 0x56
pop ebp
ret
mov al, 0x57
pop ebp
ret
mov al, 0x58
pop ebp
ret
mov al, 0x59
pop ebp
ret
mov al, 0x5a
pop ebp
ret
mov al, cl
pop ebp
ret
Function at 0x425d70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x60de7c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x60ed18], 0
mov dword [ebp - 0x230], str.getaddrinfo
mov dword [ebp - 0x22c], 0x425880
mov dword [ebp - 0x228], str.getnameinfo
mov dword [ebp - 0x224], 0x425b20
mov dword [ebp - 0x220], str.freeaddrinfo
mov dword [ebp - 0x21c], fcn.00425830
jne 0x425ef2
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x425ee8
push ebx
push esi
push edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.0044c34b
push str.ws2_32
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.0044c3a5
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x425e48
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x425e9d
push edi
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.0044c34b
push str.wship6
lea eax, [ebp - 0x110]
push 0x10c
push eax
call fcn.0044c3a5
add esp, 0x18
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x425ee5
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x425e9d
push edi
call esi
jmp 0x425ee5
xor esi, esi
nop
push dword [ebp + esi*8 - 0x230]
push edi
call ebx
mov dword [ebp + esi*8 - 0x22c], eax
test eax, eax
je 0x425ede
inc esi
cmp esi, 3
jl 0x425ea0
mov eax, dword [ebp - 0x22c]
mov dword [0x60deac], eax
mov eax, dword [ebp - 0x224]
mov dword [0x60deb4], eax
mov eax, dword [ebp - 0x21c]
mov dword [fcn.00425830], eax
jmp 0x425ee5
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov dword [0x60ed18], 1
movzx eax, word [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, dword [eax*8 + 0x60deac]
call fcn.004162c6
mov esp, ebp
pop ebp
ret 4