joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413b30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
push edi
mov edi, ecx
dec dword [edi + 0x44]
dec dword [edi + 0x38]
cmp byte [edi + 4], 0
mov edx, dword [edi + 0x38]
mov eax, dword [edi + 8]
mov ebx, dword [eax + edx*4]
mov dword [ebp - 4], ebx
je 0x413b97
mov eax, dword [edi + 0x40]
test eax, eax
je 0x413b76
push eax
push 2
push 1
push 0x41bf9c
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
jmp 0x413c8b
push 2
lea ecx, [edi + 0xd0]
call fcn.00414440
mov cx, word [0x41bf9c]
mov word [eax - 1], cx
mov byte [eax + 1], 0
jmp 0x413c8b
cmp dword [edi + 0x48], 0
jge 0x413bd1
cmp byte [ebp + 8], 0
jne 0x413bd1
mov eax, dword [edi + 0x40]
test eax, eax
je 0x413bb4
push eax
push 0xa
call esi
add esp, 8
jmp 0x413bc7
push 1
lea ecx, [edi + 0xd0]
call fcn.00414440
mov word [eax - 1], 0xa
mov eax, dword [edi]
mov ecx, edi
push dword [edi + 0x44]
call dword [eax + 0x2c]
mov eax, dword [edi + 0x40]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
test eax, eax
je 0x413bef
push eax
push 2
push 1
push 0x41bfa0
call esi
add esp, 0x10
jmp 0x413c0b
push 2
lea ecx, [edi + 0xd0]
call fcn.00414440
mov cx, word [0x41bfa0]
mov word [eax - 1], cx
mov byte [eax + 1], 0
lea ecx, [ebx + 1]
nop
mov al, byte [ebx]
inc ebx
test al, al
jne 0x413c10
mov eax, dword [edi + 0x40]
sub ebx, ecx
test eax, eax
je 0x413c2e
push eax
push ebx
push 1
push dword [ebp - 4]
call esi
add esp, 0x10
jmp 0x413c54
push ebx
lea ecx, [edi + 0xd0]
call fcn.00414440
push ebx
push dword [ebp - 4]
lea esi, [eax - 1]
push esi
call sub.VCRUNTIME140.dll_memcpy
mov byte [ebx + esi], 0
add esp, 0xc
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov eax, dword [edi + 0x40]
test eax, eax
je 0x413c6c
push eax
push 1
push 1
push 0x41bcdc
call esi
add esp, 0x10
jmp 0x413c85
push 1
lea ecx, [edi + 0xd0]
call fcn.00414440
mov cl, byte [0x41bcdc]
mov byte [eax - 1], cl
mov byte [eax], 0
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov eax, dword [edi + 0x44]
cmp dword [edi + 0x48], eax
jne 0x413c9a
mov dword [edi + 0x48], 0xffffffff
cmp byte [ebp + 8], 0
jne 0x413cd3
test eax, eax
jne 0x413cd3
mov eax, dword [edi + 0x40]
test eax, eax
je 0x413cc0
push eax
push 0xa
call esi
add esp, 8
mov byte [edi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 1
lea ecx, [edi + 0xd0]
call fcn.00414440
mov word [eax - 1], 0xa
mov byte [edi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x413ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov eax, dword [edi + 0x44]
dec eax
cmp byte [edi + 4], 0
mov dword [edi + 0x48], eax
je 0x413d1f
mov eax, dword [edi + 0x40]
mov byte [edi + 4], 0
test eax, eax
je 0x413d0c
push eax
push 0x3e
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
jmp 0x413d1f
push 1
lea ecx, [edi + 0xd0]
call fcn.00414440
mov word [eax - 1], 0x3e
cmp byte [ebp + 0xc], 0
je 0x413e02
mov eax, dword [edi + 0x40]
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
test eax, eax
je 0x413d48
push eax
push 9
push 1
push str.___CDATA_
call esi
add esp, 0x10
jmp 0x413d6f
push 9
lea ecx, [edi + 0xd0]
call fcn.00414440
movq xmm0, qword [str.___CDATA_]
movq qword [eax - 1], xmm0
mov cl, byte [0x41bc98]
mov byte [eax + 7], cl
mov byte [eax + 8], 0
mov ecx, dword [ebp + 8]
push ebx
mov ebx, ecx
lea edx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x413d78
mov eax, dword [edi + 0x40]
sub ebx, edx
test eax, eax
je 0x413d94
push eax
push ebx
push 1
push ecx
call esi
add esp, 0x10
jmp 0x413dba
push ebx
lea ecx, [edi + 0xd0]
call fcn.00414440
push ebx
push dword [ebp + 8]
lea esi, [eax - 1]
push esi
call sub.VCRUNTIME140.dll_memcpy
mov byte [ebx + esi], 0
add esp, 0xc
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov eax, dword [edi + 0x40]
pop ebx
test eax, eax
je 0x413dd7
push eax
push 3
push 1
push 0x41bcd0
call esi
add esp, 0x10
pop esi
pop edi
pop ebp
ret 8
push 3
lea ecx, [edi + 0xd0]
call fcn.00414440
mov cx, word [0x41bcd0]
pop esi
pop edi
mov word [eax - 1], cx
mov cl, byte [0x41bcd2]
mov byte [eax + 1], cl
mov byte [eax + 2], 0
pop ebp
ret 8
push 1
push dword [ebp + 8]
mov ecx, edi
call fcn.004136a0
pop edi
pop ebp
ret 8
Function at 0x413e20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
push edi
mov edi, ecx
cmp byte [edi + 4], 0
je 0x413e5b
mov eax, dword [edi + 0x40]
mov byte [edi + 4], 0
test eax, eax
je 0x413e48
push eax
push 0x3e
call esi
add esp, 8
jmp 0x413e5b
push 1
lea ecx, [edi + 0xd0]
call fcn.00414440
mov word [eax - 1], 0x3e
cmp dword [edi + 0x48], 0
jge 0x413e9b
cmp byte [edi + 0x3c], 0
jne 0x413e9b
cmp byte [edi + 0x4d], 0
jne 0x413e9b
mov eax, dword [edi + 0x40]
test eax, eax
je 0x413e7e
push eax
push 0xa
call esi
add esp, 8
jmp 0x413e91
push 1
lea ecx, [edi + 0xd0]
call fcn.00414440
mov word [eax - 1], 0xa
mov eax, dword [edi]
mov ecx, edi
push dword [edi + 0x44]
call dword [eax + 0x2c]
mov eax, dword [edi + 0x40]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov byte [edi + 0x3c], 0
test eax, eax
je 0x413ebd
push eax
push 4
push 1
push str.____
call esi
add esp, 0x10
jmp 0x413ed7
push 4
lea ecx, [edi + 0xd0]
call fcn.00414440
mov ecx, dword [str.____]
mov dword [eax - 1], ecx
mov byte [eax + 3], 0
mov ecx, dword [ebp + 8]
push ebx
mov ebx, ecx
lea edx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x413ee0
mov eax, dword [edi + 0x40]
sub ebx, edx
test eax, eax
je 0x413efc
push eax
push ebx
push 1
push ecx
call esi
add esp, 0x10
jmp 0x413f22
push ebx
lea ecx, [edi + 0xd0]
call fcn.00414440
push ebx
push dword [ebp + 8]
lea esi, [eax - 1]
push esi
call sub.VCRUNTIME140.dll_memcpy
mov byte [ebx + esi], 0
add esp, 0xc
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov eax, dword [edi + 0x40]
pop ebx
test eax, eax
je 0x413f3f
push eax
push 3
push 1
push 0x41bcd4
call esi
add esp, 0x10
pop edi
pop esi
pop ebp
ret 4
push 3
lea ecx, [edi + 0xd0]
call fcn.00414440
mov cx, word [0x41bcd4]
pop edi
pop esi
mov word [eax - 1], cx
mov cl, byte [0x41bcd6]
mov byte [eax + 1], cl
mov byte [eax + 2], 0
pop ebp
ret 4
Function at 0x413f70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
push edi
mov edi, ecx
cmp byte [edi + 4], 0
je 0x413fab
mov eax, dword [edi + 0x40]
mov byte [edi + 4], 0
test eax, eax
je 0x413f98
push eax
push 0x3e
call esi
add esp, 8
jmp 0x413fab
push 1
lea ecx, [edi + 0xd0]
call fcn.00414440
mov word [eax - 1], 0x3e
cmp dword [edi + 0x48], 0
jge 0x413feb
cmp byte [edi + 0x3c], 0
jne 0x413feb
cmp byte [edi + 0x4d], 0
jne 0x413feb
mov eax, dword [edi + 0x40]
test eax, eax
je 0x413fce
push eax
push 0xa
call esi
add esp, 8
jmp 0x413fe1
push 1
lea ecx, [edi + 0xd0]
call fcn.00414440
mov word [eax - 1], 0xa
mov eax, dword [edi]
mov ecx, edi
push dword [edi + 0x44]
call dword [eax + 0x2c]
mov eax, dword [edi + 0x40]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov byte [edi + 0x3c], 0
test eax, eax
je 0x41400d
push eax
push 2
push 1
push 0x41bc84
call esi
add esp, 0x10
jmp 0x414029
push 2
lea ecx, [edi + 0xd0]
call fcn.00414440
mov cx, word [0x41bc84]
mov word [eax - 1], cx
mov byte [eax + 1], 0
mov ecx, dword [ebp + 8]
push ebx
mov ebx, ecx
lea edx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x414032
mov eax, dword [edi + 0x40]
sub ebx, edx
test eax, eax
je 0x41404e
push eax
push ebx
push 1
push ecx
call esi
add esp, 0x10
jmp 0x414074
push ebx
lea ecx, [edi + 0xd0]
call fcn.00414440
push ebx
push dword [ebp + 8]
lea esi, [eax - 1]
push esi
call sub.VCRUNTIME140.dll_memcpy
mov byte [ebx + esi], 0
add esp, 0xc
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov eax, dword [edi + 0x40]
pop ebx
test eax, eax
je 0x414091
push eax
push 2
push 1
push 0x41bcd8
call esi
add esp, 0x10
pop edi
pop esi
pop ebp
ret 4
push 2
lea ecx, [edi + 0xd0]
call fcn.00414440
mov cx, word [0x41bcd8]
pop edi
pop esi
mov word [eax - 1], cx
mov byte [eax + 1], 0
pop ebp
ret 4
Function at 0x4140c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
push edi
mov edi, ecx
cmp byte [edi + 4], 0
je 0x4140fb
mov eax, dword [edi + 0x40]
mov byte [edi + 4], 0
test eax, eax
je 0x4140e8
push eax
push 0x3e
call esi
add esp, 8
jmp 0x4140fb
push 1
lea ecx, [edi + 0xd0]
call fcn.00414440
mov word [eax - 1], 0x3e
cmp dword [edi + 0x48], 0
jge 0x41413b
cmp byte [edi + 0x3c], 0
jne 0x41413b
cmp byte [edi + 0x4d], 0
jne 0x41413b
mov eax, dword [edi + 0x40]
test eax, eax
je 0x41411e
push eax
push 0xa
call esi
add esp, 8
jmp 0x414131
push 1
lea ecx, [edi + 0xd0]
call fcn.00414440
mov word [eax - 1], 0xa
mov eax, dword [edi]
mov ecx, edi
push dword [edi + 0x44]
call dword [eax + 0x2c]
mov eax, dword [edi + 0x40]
mov byte [edi + 0x3c], 0
test eax, eax
je 0x41415b
push eax
push 2
push 1
push 0x41bc9c
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
jmp 0x414177
push 2
lea ecx, [edi + 0xd0]
call fcn.00414440
mov cx, word [0x41bc9c]
mov word [eax - 1], cx
mov byte [eax + 1], 0
mov ecx, dword [ebp + 8]
push ebx
mov ebx, ecx
lea edx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x414180
mov eax, dword [edi + 0x40]
sub ebx, edx
test eax, eax
je 0x4141a0
push eax
push ebx
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
jmp 0x4141c6
push ebx
lea ecx, [edi + 0xd0]
call fcn.00414440
push ebx
push dword [ebp + 8]
lea esi, [eax - 1]
push esi
call sub.VCRUNTIME140.dll_memcpy
mov byte [ebx + esi], 0
add esp, 0xc
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov eax, dword [edi + 0x40]
pop ebx
test eax, eax
je 0x4141dc
push eax
push 0x3e
call esi
add esp, 8
pop edi
pop esi
pop ebp
ret 4
push 1
lea ecx, [edi + 0xd0]
call fcn.00414440
pop edi
pop esi
mov word [eax - 1], 0x3e
pop ebp
ret 4

Function at 0x414200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov al, byte [edx + 0x35]
mov byte [ecx + 0x4c], al
cmp byte [edx + 0x34], 0
je 0x414274
push edi
mov edi, 0x41c244
lea edx, [edi + 1]
nop dword [eax + eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x414220
mov eax, dword [ecx + 0x40]
sub edi, edx
test eax, eax
je 0x414249
push eax
push edi
push 1
push 0x41c244
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov al, 1
pop edi
pop ebp
ret 4
push esi
push edi
add ecx, 0xd0
call fcn.00414440
push edi
push 0x41c244
lea esi, [eax - 1]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [edi + esi], 0
mov al, 1
pop esi
pop edi
pop ebp
ret 4
mov al, 1
pop ebp
ret 4
Function at 0x417149
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x41e468
call fcn.00417740
push 1
call fcn.004169a8
pop ecx
test al, al
je 0x4172ab
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00416976
mov byte [ebp - 0x24], al
mov eax, dword [0x42094c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4172ab
test eax, eax
jne 0x4171d3
mov dword [0x42094c], ecx
push 0x419440
push 0x419430
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4171b6
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4172a5
push 0x41942c
push 0x41941c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x42094c], 2
jmp 0x4171d8
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00416b15
pop ecx
call fcn.004178b7
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x417209
push esi
call fcn.00416a8b
pop ecx
test al, al
je 0x417209
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call dword [0x419418]
call esi
call fcn.004178bd
mov esi, eax
cmp dword [esi], edi
je 0x417227
push esi
call fcn.00416a8b
pop ecx
test al, al
je 0x417227
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv
mov edi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov esi, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_wide_environment
push eax
push edi
push dword [esi]
call main
add esp, 0xc
mov esi, eax
call fcn.004176a7
test al, al
je 0x4172b2
test bl, bl
jne 0x41725a
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push 0
push 1
call fcn.00416b32
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4172a5
call fcn.00417786
ret
push 7
call fcn.0041758b
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.004d6000
jmp 0x417149
Function at 0x4010ce
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
push edi
movzx esi, ax
movzx edi, dx
shr esi, 3
imul edi, esi
mov ecx, dword [ebp + 0x10]
mov word [0x41b226], ax
imul edi, ecx
shr ax, 3
mov dword [0x41b220], edi
imul eax, edx
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edi
mov word [0x41b218], 1
fild qword [ebp - 8]
mov word [0x41b21a], dx
mov dword [0x41b21c], ecx
mov word [0x41b224], ax
mov word [0x41b228], di
fmul dword [0x415590]
call sub.MSVCRT.dll__ftol
imul esi, eax
push 0x30008
push edi
push 0x40122d
push 0x41b218
push 0xffffffffffffffff
push 0x41b198
mov dword [0x41b1d0], eax
mov dword [0x41b1d4], esi
call dword [sym.imp.WINMM.dll_waveInOpen]
push edi
call fcn.00401181
inc edi
pop ecx
cmp edi, 2
jb 0x401164
push dword [0x41b198]
call dword [sym.imp.WINMM.dll_waveInStart]
pop edi
pop esi
leave
ret

Function at 0x401181
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [0x41b1d4]
mov edi, 0x41b200
mov ecx, edi
push dword [ebp + 8]
call fcn.0040180c
mov ecx, eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_int_]
mov esi, dword [ebp + 8]
push dword [ebp + 8]
mov ecx, edi
shl esi, 5
call fcn.0040180c
mov ecx, eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
mov ecx, dword [0x41b1dc]
push 0x20
mov dword [esi + ecx], eax
mov eax, dword [0x41b1dc]
mov ecx, dword [0x41b1d4]
mov dword [esi + eax + 4], ecx
mov ecx, dword [0x41b1dc]
xor eax, eax
mov dword [esi + ecx + 8], eax
mov ecx, dword [0x41b1dc]
mov dword [esi + ecx + 0xc], eax
mov ecx, dword [0x41b1dc]
mov dword [esi + ecx + 0x10], eax
mov ecx, dword [0x41b1dc]
mov dword [esi + ecx + 0x14], eax
mov eax, dword [0x41b1dc]
add eax, esi
push eax
push dword [0x41b198]
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov eax, dword [0x41b1dc]
push 0x20
add esi, eax
push esi
push dword [0x41b198]
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
pop edi
pop esi
pop ebp
ret
Function at 0x4013be
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx ecx, word [0x41b21a]
movzx eax, word [0x41b226]
imul eax, ecx
mov edx, eax
push ebx
imul edx, dword [0x41b21c]
push esi
push edi
shr edx, 3
mov dword [ebp - 0x10], edx
push 8
cdq
pop esi
xor edi, edi
idiv esi
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
imul eax, ecx
mov dword [ebp - 0x18], eax
add eax, 0x24
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401438
xor al, al
jmp 0x401514
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp + 8]
push edi
push eax
push 4
push str.RIFF
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 4]
push 4
push eax
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
push 4
push str.WAVE
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
push 4
push str.fmt
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 8]
push 4
push eax
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0xc]
push 2
push eax
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
push 2
push 0x41b21a
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
push 4
push 0x41b21c
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x10]
push 4
push eax
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x14]
push 2
push eax
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
push 2
push 0x41b226
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
push 4
push 0x415594
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
lea eax, [ebp - 0x18]
push 4
push eax
push ebx
call esi
lea eax, [ebp + 8]
push edi
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 4]
push dword [eax]
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40209b
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ecx + 4]
push edi
lea esi, [ebp + 8]
mov edi, eax
push 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
push dword [ecx]
movsd dword es:[edi], dword [esi]
call sub.WS2_32.dll_connect
neg eax
sbb al, al
pop edi
inc al
pop esi
pop ebp
ret 0x10

Function at 0x402118
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ecx + 0x14], eax
xor eax, eax
push eax
push eax
push ecx
push 0x402137
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret 4
Function at 0x402149
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
lea eax, [ebp - 1]
push edi
push eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const__]
lea eax, [ebp - 1]
lea ecx, [ebp - 0x14]
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::allocator_char__const__]
and dword [esi + 0x30], 0
push dword [esi + 0x34]
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov ebx, eax
push 0
push dword [esi + 0x34]
push ebx
push dword [esi]
call sub.WS2_32.dll_recv
mov edi, eax
test edi, edi
jle 0x4021da
lea eax, [ebp - 1]
lea ecx, [ebp - 0x34]
push eax
push edi
push ebx
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___unsigned_int__class_std::allocator_char__const__]
push eax
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea ecx, [ebp - 0x34]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x14]
push eax
call dword [0x4152e8]
sub dword [esi + 0x30], edi
cmp dword [esi + 0x30], 0
jg 0x4021da
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov ecx, esi
push dword [ebp + 8]
push eax
call fcn.0040221e
push ebx
call dword [sym.imp.MSVCRT.dll_free]
test edi, edi
pop ecx
jg 0x402172
mov ecx, esi
call fcn.004020f4
mov ecx, esi
call fcn.0040221a
test al, al
je 0x402201
push 1
mov ecx, esi
call fcn.00402750
lea ecx, [ebp - 0x14]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x24]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x402526
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push esi
push 6
push 1
push 0
call sub.WS2_32.dll_socket
mov esi, eax
push 0x10
push 0x41b320
push esi
call sub.WS2_32.dll_connect
test eax, eax
jne 0x402569
push esi
lea eax, [ebp + 0xc]
sub esp, 0x10
mov ecx, esp
push eax
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
push dword [ebp + 8]
call fcn.00402440
add esp, 0x18
cmp byte [ebp + 0x1c], 0
je 0x402572
push esi
call sub.WS2_32.dll_closesocket
or esi, 0xffffffff
lea ecx, [ebp + 0xc]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, esi
pop esi
pop ebp
ret

Function at 0x402580
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x38], bl
jne 0x40262f
cmp byte [ebp + 0xc], bl
push edi
mov edi, dword [ebp + 8]
jne 0x4025a4
mov byte [esi + 0x44], 1
jmp 0x402613
cmp byte [0x41bcac], bl
je 0x402613
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 2]
push edi
push eax
movzx eax, word [ebp - 4]
push eax
lea ecx, [ebp - 0x30]
movzx eax, word [ebp - 6]
push eax
movzx eax, word [ebp - 8]
push eax
lea eax, [ebp + 0xf]
push str.KeepAlive_Enabled__Timeout:__i_seconds_n
push eax
push str._02i:_02i:_02i:_03i__INFO_
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const___class_std::allocator_char__const__]
push eax
lea eax, [ebp - 0x20]
push eax
call sub.MSVCP60.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_std::operator_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::c_str_void_const]
push eax
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 0x18
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push ebx
push ebx
push esi
push 0x4027a2
push ebx
push ebx
mov byte [esi + 0x38], 1
mov dword [esi + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
pop edi
jmp 0x402631
xor al, al
pop esi
pop ebx
leave
ret 8