joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404570
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x10
fld qword [0x446098]
push ebx
mov bl, byte [esp + 0x1c]
fstp qword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x1c]
and bl, 1
push ebp
mov byte [esp + 0xe], bl
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
je 0x4045bc
lea eax, [esp + 0xc]
lea ebx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
call fcn.004042c0
pop ebp
pop ebx
add esp, 0x10
ret
mov al, byte [0x446030]
test al, al
push esi
push edi
mov byte [esp + 0x13], al
je 0x4045ec
test byte [esp + 0x28], 4
jne 0x4045e5
mov edi, ebp
call fcn.00404460
test eax, eax
je 0x4045ec
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, ebp
call fcn.00404540
test bl, bl
jne 0x404606
push ebp
call fcn.0041dd50
push eax
push str.Resolving__s...
push 0
call fcn.0041e020
add esp, 0x10
fld qword [esp + 0x18]
sub esp, 8
mov eax, ebp
fstp qword [esp]
call fcn.004043c0
add esp, 8
test eax, eax
jne 0x40466c
test bl, bl
jne 0x404662
call fcn.0041e306
cmp dword [eax], 0x274c
je 0x404653
call sub.WSOCK32.dll_WSAGetLastError
call fcn.00404420
push eax
push str.failed:__s._n
push 0
call fcn.0041e020
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
push str.failed:_timed_out._n
push 0
call fcn.0041de30
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov ebx, dword [eax + 0xc]
call fcn.004042c0
mov esi, eax
mov al, byte [esp + 0x12]
test al, al
jne 0x4046ee
mov eax, dword [esi]
cmp eax, 3
mov edi, eax
jle 0x40468c
mov edi, 3
xor ebx, ebx
test edi, edi
jle 0x4046cc
lea ebp, [edi - 1]
mov ecx, dword [esi + 4]
mov edx, dword [ecx + ebx*8 + 4]
lea eax, [ecx + ebx*8]
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
push 0
call fcn.0041de30
add esp, 8
cmp ebx, ebp
jge 0x4046c3
push 0x42ec78
push 0
call fcn.0041de30
add esp, 8
inc ebx
cmp ebx, edi
jl 0x404695
mov ebp, dword [esp + 0x24]
cmp edi, dword [esi]
je 0x4046df
push str.__...
push 0
call fcn.0041de30
add esp, 8
push 0x42ec58
push 0
call fcn.0041de30
add esp, 8
mov al, byte [esp + 0x13]
test al, al
je 0x4046fd
mov eax, ebp
call fcn.004044a0
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x40daf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
call fcn.0041cc30
add eax, 3
and eax, 0xfffffffc
call fcn.0041e3c0
mov esi, esp
push esi
call fcn.0041cc40
mov edx, dword [ebp + 0xc]
mov eax, edx
add esp, 4
lea edi, [eax + 1]
jmp 0x40db20
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40db20
sub eax, edi
push esi
push eax
push edx
call fcn.0041cc50
mov ecx, dword [ebp + 0x10]
mov eax, ecx
add esp, 0xc
lea edi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40db40
sub eax, edi
push esi
push eax
push ecx
call fcn.0041cc50
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.0041cc60
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
xor eax, edi
mov edi, dword [ebp + 8]
xor ecx, edx
add esp, 0x14
test edi, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
jle 0x40dbbf
push esi
call fcn.0041cc40
push esi
lea ecx, [ebp - 8]
push 8
push ecx
call fcn.0041cc50
lea edx, [ebp - 0x18]
push edx
push esi
call fcn.0041cc60
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
xor eax, ecx
mov ecx, dword [ebp - 0x14]
xor ecx, edx
add esp, 0x18
dec edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
jne 0x40db81
lea ecx, [ebp - 8]
mov eax, 0x43f474
call fcn.0040d890
lea esp, [ebp - 0x20]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x417610
Capabilities:
Terminate process

Disassembly:
push esi
push str.WGETRC
call fcn.00420cd3
mov esi, eax
add esp, 4
test esi, esi
je 0x417660
cmp byte [esi], 0
je 0x417660
push esi
call fcn.00418cc0
add esp, 4
test al, al
push esi
jne 0x417656
mov eax, dword [0x446138]
push eax
push str._s:_WGETRC_points_to__s__which_doesnt_exist._n
push 0x43c810
call fcn.00420340
add esp, 0x10
push 1
call fcn.0042153a
call fcn.0041bf20
add esp, 4
pop esi
ret
push edi
push str.HOME
call fcn.00420cd3
add esp, 4
test eax, eax
jne 0x41767b
call fcn.0041c410
test eax, eax
je 0x4176ba
push eax
call fcn.0041bf20
mov edi, eax
add esp, 4
test edi, edi
je 0x4176ba
push edi
push str._s_.wgetrc
call fcn.00418a50
push edi
mov esi, eax
call fcn.0041bf50
add esp, 0xc
test esi, esi
je 0x4176ba
push esi
call fcn.00418cc0
add esp, 4
test al, al
jne 0x4176d3
push esi
call fcn.0041bf50
add esp, 4
call fcn.0041c410
test eax, eax
je 0x4176ed
push eax
push str._s_wget.ini
call fcn.00418a50
add esp, 8
mov esi, eax
test esi, esi
je 0x4176ed
push esi
call fcn.00418cc0
add esp, 4
test al, al
jne 0x4176f2
push esi
call fcn.0041bf50
add esp, 4
pop edi
xor eax, eax
pop esi
ret
pop edi
mov eax, esi
pop esi
ret
Function at 0x417900
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov eax, esi
push edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417910
sub eax, edx
add eax, 6
and eax, 0xfffffffc
call fcn.0041e3c0
mov ebx, esp
lea edx, [ebx + 2]
mov byte [ebx], 0x2d
mov byte [ebx + 1], 0x2d
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x417934
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x41795c
push 0x274
push str.init.c
push str.val___NULL
call fcn.0041e3fd
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.004174b0
add esp, 4
mov esi, eax
call fcn.004178a0
test al, al
jne 0x41797a
push 2
call fcn.0042153a
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x417990
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
mov eax, esi
call fcn.00417700
add esp, 0xc
test eax, eax
je 0x4179d5
mov eax, dword [0x446138]
push esi
push eax
push str._s:_Invalid___execute_command___s_n
push 0x43c810
call fcn.00420340
add esp, 0x10
push 2
call fcn.0042153a
mov esi, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
call fcn.004178a0
test al, al
jne 0x4179f3
push 2
call fcn.0042153a
push ebx
call fcn.0041bf50
push edi
call fcn.0041bf50
add esp, 8
pop edi
pop ebx
pop esi
add esp, 0xc
ret

Function at 0x4183e0
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.00417500
call fcn.00417610
mov esi, eax
test esi, esi
je 0x41840e
push esi
call fcn.00418220
add esp, 4
test al, 1
jne 0x418405
push 2
call fcn.0042153a
push esi
call fcn.0041bf50
add esp, 4
pop esi
ret
Function at 0x41abc0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push edi
xor edi, edi
test ebp, ebp
jle 0x41ac4e
lea edx, [ebp - 1]
mov eax, 0xaaaaaaab
mul edx
push ebx
push esi
mov esi, dword [esp + 0x14]
shr edx, 1
add esi, 2
inc edx
lea edi, [edx + edx*2]
lea esp, [esp]
movzx eax, byte [esi - 2]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx ebx, byte [esi - 1]
xor eax, eax
mov al, byte [esi - 2]
shr ebx, 4
inc ecx
add esi, 3
and eax, 3
shl eax, 4
mov al, byte [eax + ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx ebx, byte [esi - 3]
xor eax, eax
mov al, byte [esi - 4]
shr ebx, 6
inc ecx
and eax, 0xf
mov al, byte [ebx + eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
xor eax, eax
mov al, byte [esi - 3]
inc ecx
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
inc ecx
dec edx
jne 0x41abf0
pop esi
pop ebx
lea edx, [ebp + 1]
cmp edi, edx
jne 0x41ac67
mov eax, ecx
mov byte [ecx - 1], 0x3d
mov byte [ecx], 0
mov ecx, dword [esp + 0x14]
pop edi
sub eax, ecx
pop ebp
ret
add ebp, 2
cmp edi, ebp
jne 0x41ac76
mov al, 0x3d
mov byte [ecx - 2], al
mov byte [ecx - 1], al
mov eax, ecx
mov byte [ecx], 0
mov ecx, dword [esp + 0x14]
pop edi
sub eax, ecx
pop ebp
ret
Function at 0x41bdc0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 8
push esi
push 0x18
call fcn.0041beb0
mov esi, eax
mov al, byte [0x444cc1]
add esp, 4
test al, al
jne 0x41be1f
lea eax, [esp + 4]
push eax
mov byte [0x444cc1], 1
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [esp + 4]
or ecx, dword [esp + 8]
je 0x41be1f
fild qword [esp + 4]
push esi
mov byte [0x444cc0], 1
fstp qword [0x444cc8]
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x41be39
mov al, byte [0x444cc0]
test al, al
je 0x41be31
push esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
jmp 0x41be39
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi], eax
fld qword [0x42ea78]
mov eax, esi
fstp qword [esi + 8]
fld qword [0x42ea78]
fstp qword [esi + 0x10]
pop esi
add esp, 8
ret

Function at 0x41be60
Capabilities:
Terminate process

Disassembly:
push 0
call fcn.0041da10
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [0x446138]
push eax
push ecx
push edx
push str._s:__s:_Failed_to_allocate__ld_bytes__memory_exhausted._n
push 3
call fcn.0041e020
add esp, 0x18
push 1
call fcn.0042153a
int3
Function at 0x41c0d0
Capabilities:
Accept command line arguments
Create process on windows
Read file via mapping
Resume thread
Terminate process

Disassembly:
sub esp, 0x170
push ebp
push 0x105
lea eax, [esp + 0x70]
xor ebp, ebp
push eax
push ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, ebp
je 0x41c2d4
cmp eax, 0x105
jae 0x41c2d4
push ebx
push ebp
push ebp
push ebp
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], 0xc
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], 1
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebx, eax
cmp ebx, ebp
je 0x41c2d3
push esi
push edi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
push ebp
push ebp
push 0xc
push 1
push ebp
push ebp
mov dword [esp + 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [esp + 0x9c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
test esi, esi
je 0x41c2a0
mov edx, dword [esp + 0x18]
push edx
push str.gnu_wget_fake_fork__lu
call fcn.00418a50
add esp, 8
mov esi, eax
push esi
push 0x10c
push ebp
push 4
push ebp
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.0041bf50
add esp, 4
test ebp, ebp
je 0x41c29e
cmp edi, 0xb7
je 0x41c29e
mov edi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push 0
push 0
push 0
push 2
push ebp
call edi
test eax, eax
je 0x41c29e
push eax
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, eax
test esi, esi
jne 0x41c213
mov ecx, dword [esp + 0x10]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x41c2a0
mov edx, dword [esp + 0x10]
push 0x493e0
push 0
lea eax, [esp + 0x28]
push eax
push 2
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], edx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x41c2a0
push 0
push 0
push 0
push 4
push ebp
call edi
mov edi, eax
test edi, edi
je 0x41c29e
mov al, byte [edi + 4]
test al, al
je 0x41c26b
push 0x105
lea ecx, [edi + 5]
push 0
push ecx
call fcn.00420d20
add esp, 0xc
test eax, eax
je 0x41c29e
mov edx, dword [esp + 0x18]
push edx
push str.Continuing_in_background__pid__lu._n
call fcn.0042168b
mov al, byte [edi + 4]
add esp, 8
test al, al
je 0x41c295
lea eax, [edi + 5]
push eax
push str.Output_will_be_written_to___s._n
call fcn.0042168b
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x41c2a0
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call edi
test ebp, ebp
je 0x41c2b0
push ebp
call edi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x41c2bb
push eax
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41c2c6
push eax
call edi
pop edi
test esi, esi
pop esi
je 0x41c2d3
push 0
call fcn.0042153a
pop ebx
pop ebp
add esp, 0x170
ret
Function at 0x41c330
Capabilities:
Set console window title

Disassembly:
mov eax, dword [0x444cf0]
test eax, eax
je 0x41c342
push eax
call fcn.0041bf50
add esp, 4
mov eax, dword [0x444cf4]
test eax, eax
je 0x41c354
push eax
call fcn.0041bf50
add esp, 4
push esi
mov esi, dword [esp + 8]
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c360
sub eax, edx
add eax, 0x14
push eax
call fcn.0041be90
push esi
mov dword [0x444cf0], eax
call fcn.0041bf20
push eax
mov dword [0x444cf4], eax
mov eax, dword [0x444cf0]
push str.Wget__s
push eax
mov dword [0x43c418], 0xffffffff
call fcn.0041e9ee
mov ecx, dword [0x444cf0]
add esp, 0x14
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
pop esi
ret

Function at 0x41c3b0
Capabilities:
Set console window title

Disassembly:
mov edx, dword [0x444cf0]
sub esp, 8
test edx, edx
je 0x41c40c
mov ecx, dword [0x444cf4]
test ecx, ecx
je 0x41c40c
fld qword [esp + 0xc]
fistp qword [esp]
mov eax, dword [esp]
test eax, eax
jge 0x41c3d9
xor eax, eax
jmp 0x41c3e3
cmp eax, 0x64
jle 0x41c3e3
mov eax, 0x64
cmp eax, dword [0x43c418]
je 0x41c40c
push ecx
push eax
push str.Wget___d_____s
push edx
mov dword [0x43c418], eax
call fcn.0041e9ee
mov eax, dword [0x444cf0]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
add esp, 8
ret

Function at 0x41c480
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x41c4b8
mov ecx, dword [0x446138]
push ecx
push str._s:_Couldnt_find_usable_socket_driver._n
push 0x43c810
call fcn.00420340
add esp, 0xc
push 1
call fcn.0042153a
cmp word [esp], 0x101
jae 0x41c4e5
mov edx, dword [0x446138]
push edx
push str._s:_Couldnt_find_usable_socket_driver._n
push 0x43c810
call fcn.00420340
add esp, 0xc
call sub.WSOCK32.dll_WSACleanup
push 1
call fcn.0042153a
push 0x41bfe0
call fcn.00421eeb
add esp, 4
push str.SetThreadExecutionState
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41c514
push reloc.WSOCK32.dll_accept
call eax
push 1
push 0x41c320
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
add esp, 0x190
ret
Function at 0x41c560
Capabilities:
Create thread
Terminate thread

Disassembly:
mov al, byte [0x4460de]
sub esp, 0x10
test al, al
je 0x41c583
fld qword [esp + 0x14]
sub esp, 8
fstp qword [esp]
push str.seconds__.2f_
call fcn.0041e0b0
add esp, 0xc
fld qword [0x42ea78]
push esi
fld qword [esp + 0x18]
mov esi, dword [esp + 0x24]
fucompp
push edi
mov edi, dword [esp + 0x24]
fnstsw ax
test ah, 0x44
jnp 0x41c612
mov eax, dword [0x444cfc]
test eax, eax
je 0x41c5c0
push 0x21d
push str.mswindows.c
push str.thread_hnd__NULL
call fcn.0041e3fd
add esp, 0xc
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], esi
call sub.WSOCK32.dll_WSAGetLastError
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
push eax
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x41c530
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x444cfc], eax
jne 0x41c620
mov al, byte [0x4460de]
test al, al
je 0x41c612
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateThread___failed___0x_x__n
call fcn.0041e0b0
add esp, 8
push esi
call edi
add esp, 4
pop edi
xor al, al
pop esi
add esp, 0x10
ret
fld qword [esp + 0x1c]
push ebx
fmul qword [0x4310d0]
fistp qword [esp + 0x20]
mov edx, dword [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41c669
mov eax, dword [esp + 0x18]
push eax
call sub.WSOCK32.dll_WSASetLastError
mov al, byte [0x4460de]
test al, al
je 0x41c665
call sub.WSOCK32.dll_WSAGetLastError
push eax
push str.Winsock_error:__d_n
call fcn.0041e0b0
add esp, 8
xor bl, bl
jmp 0x41c67a
mov ecx, dword [0x444cfc]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov bl, 1
mov edx, dword [0x444cfc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop ebx
pop edi
mov dword [0x444cfc], 0
pop esi
add esp, 0x10
ret

Function at 0x41c700
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
push eax
push ecx
push edx
call sub.WSOCK32.dll_connect
mov esi, eax
test esi, esi
jge 0x41c72b
push edi
call fcn.0041e306
mov edi, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [edi], eax
pop edi
mov eax, esi
pop esi
ret

Function at 0x41c790
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call sub.WSOCK32.dll_recv
mov esi, eax
test esi, esi
jge 0x41c7c0
push edi
call fcn.0041e306
mov edi, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [edi], eax
pop edi
mov eax, esi
pop esi
ret

Function at 0x41c7d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call sub.WSOCK32.dll_send
mov esi, eax
test esi, esi
jge 0x41c800
push edi
call fcn.0041e306
mov edi, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [edi], eax
pop edi
mov eax, esi
pop esi
ret
Function at 0x41c810
Capabilities:
Get socket status

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push esi
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push ecx
call sub.WSOCK32.dll_select
mov esi, eax
test esi, esi
jge 0x41c845
push edi
call fcn.0041e306
mov edi, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [edi], eax
pop edi
mov eax, esi
pop esi
ret

Function at 0x41c850
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
push eax
push ecx
push edx
call sub.WSOCK32.dll_getsockname
mov esi, eax
test esi, esi
jge 0x41c87b
push edi
call fcn.0041e306
mov edi, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [edi], eax
pop edi
mov eax, esi
pop esi
ret

Function at 0x41c8b0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push esi
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push ecx
call sub.WSOCK32.dll_setsockopt
mov esi, eax
test esi, esi
jge 0x41c8e5
push edi
call fcn.0041e306
mov edi, eax
call sub.WSOCK32.dll_WSAGetLastError
mov dword [edi], eax
pop edi
mov eax, esi
pop esi
ret

Function at 0x41cc40
Capabilities:
Hash data with md5

Disassembly:
jmp 0x41cc70
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], ecx
ret
Function at 0x41da20
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x41da7d
mov al, byte [esp + 0xc]
test al, al
mov eax, 0x430ca4
jne 0x41da3b
mov eax, 0x431df8
push eax
push esi
call fcn.0041eba1
add esp, 8
test eax, eax
mov dword [0x444d04], eax
jne 0x41daa5
call fcn.0041e306
mov eax, dword [eax]
push eax
call fcn.0041cbf0
mov ecx, dword [0x446138]
push eax
push esi
push ecx
push str._s:__s:__s_n
push 0x43c810
call fcn.00420340
add esp, 0x18
push 1
call fcn.0042153a
push 0x43c810
mov dword [0x444d04], 0x43c810
call fcn.0042d852
push eax
call fcn.00420f32
add esp, 8
test eax, eax
je 0x41daa5
mov byte [0x444d08], 1
pop esi
ret
Function at 0x421477
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4355c8
call fcn.004239c0
push 8
call fcn.00426043
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x445ab0], esi
jne 0x4214ab
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x445aac], esi
mov al, byte [ebp + 0x10]
mov byte [0x445aa8], al
cmp dword [ebp + 0xc], edi
jne 0x4214f5
cmp dword [0x446580], edi
je 0x4214e5
mov eax, dword [0x44657c]
sub eax, 4
mov dword [0x44657c], eax
cmp eax, dword [0x446580]
jb 0x4214e5
mov eax, dword [eax]
cmp eax, edi
je 0x4214c6
call eax
jmp 0x4214c6
push 0x439028
mov eax, 0x439020
call fcn.004213f5
pop ecx
push 0x439030
mov eax, 0x43902c
call fcn.004213f5
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x421526
cmp dword [ebp + 0x10], edi
jne 0x421534
mov dword [0x445ab0], esi
push dword [ebp + 8]
call fcn.004213b3
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x421533
push 8
call fcn.00425f8e
pop ecx
ret
call fcn.004239fb
ret
Function at 0x421ff3
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x18
push 0x435928
call fcn.004239c0
mov edi, 0x94
mov eax, edi
call fcn.0041e3c0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x445a70], ecx
mov eax, dword [esi + 4]
mov dword [0x445a7c], eax
mov edx, dword [esi + 8]
mov dword [0x445a80], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x445a74], esi
cmp ecx, 2
je 0x422053
or esi, 0x8000
mov dword [0x445a74], esi
shl eax, 8
add eax, edx
mov dword [0x445a78], eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x42208c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42208c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4220a4
cmp eax, 0x20b
je 0x422091
mov dword [ebp - 0x1c], edi
jmp 0x4220b8
cmp dword [ecx + 0x84], 0xe
jbe 0x42208c
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x4220b2
cmp dword [ecx + 0x74], 0xe
jbe 0x42208c
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00428b20
pop ecx
test eax, eax
jne 0x4220cc
push 0x1c
call fcn.00421fcf
pop ecx
call fcn.00422b09
test eax, eax
jne 0x4220dd
push 0x10
call fcn.00421fcf
pop ecx
call fcn.00428704
mov dword [ebp - 4], edi
call fcn.004274d7
test eax, eax
jge 0x4220f6
push 0x1b
call fcn.00421faa
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x446574], eax
call fcn.00429b5e
mov dword [0x445b40], eax
call fcn.00429abc
test eax, eax
jge 0x42211c
push 8
call fcn.00421faa
pop ecx
call fcn.00429889
test eax, eax
jge 0x42212d
push 9
call fcn.00421faa
pop ecx
push 1
call fcn.0042140d
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x422143
push eax
call fcn.00421faa
pop ecx
mov eax, dword [0x445a90]
mov dword [0x445a94], eax
push eax
push dword [0x445a88]
push dword [0x445a84]
call fcn.0041b4a0
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x1c], edi
jne 0x422172
push esi
call fcn.0042153a
call fcn.0042155c
jmp 0x4221a4
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.004239fb
ret