joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42520c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
push edi
test eax, eax
je 0x425220
mov eax, dword [eax]
jmp 0x425222
xor eax, eax
push eax
mov eax, dword [ebp + 0xc]
push eax
push eax
push eax
push eax
lea ebx, [ecx + 4]
push str.SELECT_Paket.Marke__Paket.Reparaturgruppe__Paket.Bildnummer___s._FROM_Paket_INNER_JOIN___s__ON_Paket.Marke____s_.Marke_AND_Paket.Abgrenzung_ID____s_.Abgrenzung_ID_WHERE_Paket.Marke_s
push ebx
call fcn.0040b760
add esp, 0x1c
lea ecx, [esi + 8]
call fcn.0040151b
mov edi, 0x473590
test eax, eax
je 0x42526f
mov esi, dword [esi + 8]
test esi, esi
je 0x425257
mov esi, dword [esi]
jmp 0x425259
xor esi, esi
push esi
push str._AND_Paket.Reparaturgruppe_s
push edi
call fcn.0040b760
push edi
push ebx
call fcn.0042bf71
add esp, 0x14
mov esi, dword [ebp + 8]
lea ecx, [esi + 0xc]
call fcn.0040151b
test eax, eax
je 0x4252a1
mov eax, dword [esi + 0xc]
test eax, eax
je 0x425289
mov eax, dword [eax]
jmp 0x42528b
xor eax, eax
push eax
push str._AND_Paket.Bildnummer_s
push edi
call fcn.0040b760
push edi
push ebx
call fcn.0042bf71
add esp, 0x14
push dword [ebp + 0xc]
mov esi, 0x473390
push dword [ebp + 0xc]
push str._ORDER_BY_Paket.Marke__Paket.Reparaturgruppe__Paket.Bildnummer____s_.Abgrenzung_ID____s_.Abgrenzungskette_ID
push esi
call fcn.0040b760
push esi
push ebx
call fcn.0042bf71
add esp, 0x18
cmp dword [ebp + 0x10], 0
je 0x4252de
push 0x45dbfc
push ebx
call fcn.0042bf71
push dword [ebp + 0x10]
push ebx
call fcn.0042bf71
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4252e5
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 4], ecx
test eax, eax
je 0x4252fa
mov eax, dword [eax]
jmp 0x4252fc
xor eax, eax
push esi
push edi
push eax
push str.SELECT__FROM_Pseudoersatzteil_WHERE_Marke___s
mov esi, 0x473990
push esi
call fcn.0040b760
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
sub eax, dword [edi]
add esp, 0xc
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x425387
push ebx
push str._AND_Pseudoersatzteilnummer_IN__
push esi
call fcn.0042bf71
mov ebx, dword [edi]
pop ecx
pop ecx
jmp 0x425374
cmp ebx, dword [edi]
je 0x425347
push 0x45dbfc
push esi
call fcn.0042bf71
pop ecx
pop ecx
cmp dword [ebx + 0x14], 8
jb 0x425351
mov eax, dword [ebx]
jmp 0x425353
mov eax, ebx
push eax
push 0x45e8a4
push 0x473790
call fcn.0040b760
push 0x473790
push esi
call fcn.0042bf71
add esp, 0x14
add ebx, 0x1c
cmp ebx, dword [edi + 4]
jne 0x425336
push 0x45e89c
push esi
call fcn.0042bf71
pop ecx
pop ecx
pop ebx
mov eax, dword [ebp - 4]
add eax, 4
push esi
push eax
call fcn.0042bfa2
pop ecx
pop ecx
pop edi
pop esi
leave
ret 8
Function at 0x42539c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 4], ecx
test eax, eax
je 0x4253b1
mov eax, dword [eax]
jmp 0x4253b3
xor eax, eax
push esi
push edi
push eax
push str.SELECT_Ersatzteil.__Ersatzteilbezeichnung.Sprachkennzeichen__Ersatzteilbezeichnung.Bezeichnung_FROM_Ersatzteil_INNER_JOIN_Ersatzteilbezeichnung_ON_Ersatzteil.Ersatzteilnummer__Ersatzteilbezeichnung.Ersatzteilnummer_AND_Ersatzteil.Marke__Ersatzteilbezeichnung.Marke_WHERE_Ersatzteil.Marke___s
mov esi, 0x476a70
push esi
call fcn.0040b760
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
sub eax, dword [edi]
add esp, 0xc
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x42543e
push ebx
push str._AND_Ersatzteil.Ersatzteilnummer_IN__
push esi
call fcn.0042bf71
mov ebx, dword [edi]
pop ecx
pop ecx
jmp 0x42542b
cmp ebx, dword [edi]
je 0x4253fe
push 0x45dbfc
push esi
call fcn.0042bf71
pop ecx
pop ecx
cmp dword [ebx + 0x14], 8
jb 0x425408
mov eax, dword [ebx]
jmp 0x42540a
mov eax, ebx
push eax
push 0x45ea24
push 0x476870
call fcn.0040b760
push 0x476870
push esi
call fcn.0042bf71
add esp, 0x14
add ebx, 0x1c
cmp ebx, dword [edi + 4]
jne 0x4253ed
push 0x45e89c
push esi
call fcn.0042bf71
pop ecx
pop ecx
pop ebx
push str._ORDER_BY_Ersatzteil.Marke__Ersatzteil.Ersatzteilnummer__Ersatzteilbezeichnung.Sprachkennzeichen
push esi
call fcn.0042bf71
mov eax, dword [ebp - 4]
add eax, 4
push esi
push eax
call fcn.0042bfa2
add esp, 0x10
pop edi
pop esi
leave
ret 8
Function at 0x4255d0
Capabilities:
Reference sql statements

Disassembly:
push 0x4c
mov eax, 0x451a02
call fcn.0042bcfc
cmp byte [ebp + 0x18], 0
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
mov eax, dword [eax + 4]
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x4c], edx
jne 0x425626
test eax, eax
je 0x425605
mov eax, dword [eax]
jmp 0x425607
xor eax, eax
push edx
push ecx
push eax
push 0x45a02c
push str.SELECT__FROM__s_WHERE_Marke___s_AND___Arbeitspositionsnummer___s_OR_Arbeitspositionsnummer___s__
mov esi, 0x47fd90
push esi
call fcn.0040b760
push str.Arbeitspositionsnummer
jmp 0x42564d
test eax, eax
je 0x42562e
mov eax, dword [eax]
jmp 0x425630
xor eax, eax
push edx
push ecx
push eax
push 0x45a07c
push str.SELECT__FROM__s_WHERE_Marke___s_AND___Ersatzteilnummer___s_OR_Ersatzteilnummer___s__
mov esi, 0x47fd90
push esi
call fcn.0040b760
push 0x45a0a4
push 0x47fd10
call fcn.0042bfa2
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
add esp, 0x20
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x425744
push str._AND__
push esi
call fcn.0042bf71
mov edi, dword [ebx]
jmp 0x42572c
cmp edi, dword [ebx]
je 0x425690
push str._OR
push esi
call fcn.0042bf71
pop ecx
pop ecx
cmp dword [edi + 0x10], 4
jne 0x4256ff
push 2
push 2
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
call fcn.00401dfe
mov ebx, eax
and dword [ebp - 4], 0
push 2
push 0
lea eax, [ebp - 0x48]
push eax
mov ecx, edi
call fcn.00401dfe
cmp dword [ebx + 0x14], 8
jb 0x4256c2
mov ebx, dword [ebx]
cmp dword [eax + 0x14], 8
jb 0x4256ca
mov eax, dword [eax]
push ebx
push eax
push str._Reparaturgruppe___s_AND_Bildnummer___s_
push 0x47fb10
call fcn.0040b760
add esp, 0x10
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.0040172e
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040172e
mov ebx, dword [ebp - 0x58]
jmp 0x42571e
cmp dword [edi + 0x14], 8
jb 0x425709
mov eax, dword [edi]
jmp 0x42570b
mov eax, edi
push eax
push 0x45ef00
push 0x47fb10
call fcn.0040b760
add esp, 0xc
push 0x47fb10
push esi
call fcn.0042bf71
add edi, 0x1c
pop ecx
pop ecx
cmp edi, dword [ebx + 4]
jne 0x42567f
push 0x45eefc
push esi
call fcn.0042bf71
pop ecx
pop ecx
mov edi, dword [ebp - 0x50]
add edi, 4
push esi
push edi
call fcn.0042bfa2
push dword [ebp - 0x4c]
push dword [ebp - 0x54]
call fcn.0042c4fc
add esp, 0x10
test eax, eax
mov eax, str._ASC
jg 0x42576d
mov eax, str._DESC
push eax
push 0x47fd10
push str._ORDER_BY_Marke__Reparaturgruppe__Bildnummer__Selektionskennzeichen1__Selektionskennzeichen2__Alternativgruppe_ID__Alternative_ID___s__s
push esi
call fcn.0040b760
push esi
push edi
call fcn.0042bf71
add esp, 0x18
call fcn.0042bd7f
ret 0x14

Function at 0x42bc84
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x471188]
jne 0x42bc8e
repz ret
jmp fcn.0043268c
Function at 0x437285
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x471188]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004306fe
and dword [ebp - 0x14], 0
cmp dword [0x483a48], 0
mov dword [ebp - 0x18], eax
jne 0x437338
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4373e0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4635f0
push ebx
call edi
test eax, eax
je 0x4373e0
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x483a48], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x483a4c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x483a50], eax
call edi
push eax
call esi
mov dword [0x483a58], eax
test eax, eax
je 0x437338
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x483a54], eax
mov eax, dword [0x483a54]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x437391
cmp dword [0x483a58], ecx
je 0x437391
push eax
call esi
push dword [0x483a58]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x437391
test ebx, ebx
je 0x437391
call edi
test eax, eax
je 0x437388
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x437388
test byte [ebp - 8], 1
jne 0x437391
or dword [ebp + 0x10], 0x200000
jmp 0x4373c4
mov eax, dword [0x483a4c]
cmp eax, dword [ebp - 0x18]
je 0x4373c4
push eax
call esi
test eax, eax
je 0x4373c4
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4373c4
mov eax, dword [0x483a50]
cmp eax, dword [ebp - 0x18]
je 0x4373c4
push eax
call esi
test eax, eax
je 0x4373c4
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x483a48]
call esi
test eax, eax
je 0x4373e0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4373e2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042bc84
leave
ret
Function at 0x1000241e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
cmp dword [ebx + 0x45e14c], 0
jne 0x10002459
push edx
and dword [esp], 0
or dword [esp], ecx
push 0
call dword [ebx + 0x45e580]
push 0
mov dword [esp], esi
sub esi, esi
xor esi, eax
mov dword [ebx + 0x45e14c], esi
pop esi
and ecx, 0
or ecx, dword [esp]
sub esp, 0xfffffffc
push dword [ebp - 8]
mov dword [esp], ecx
push 0
mov dword [esp], eax
sub eax, eax
xor eax, dword [ebp + 8]
mov ecx, eax
pop eax
push esi
sub dword [esp], esi
add dword [esp], ecx
push dword [ebp + 8]
mov dword [ebp - 0x10], 0
push dword [ebp - 0x10]
xor dword [esp], ecx
push dword [ebp + 0xc]
call fcn.10001c6b
sub ecx, ecx
mov ecx, dword [esp]
sub esp, 0xfffffffc
dec ecx
jne 0x1000246c
push edi
and edi, 0
xor edi, dword [ebp + 8]
and eax, 0
xor eax, edi
pop edi
and ecx, 0
pop dword [ebp - 0x10]
add ecx, dword [ebp - 0x10]
leave
ret 8
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x506044cf
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x78503dd
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401cf0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432573
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x11c
mov eax, dword [0x43c2d0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push str.7A23EC47_F9C9_4b1a_A812_489C7A8C8927
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401d52
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x401e3a
call fcn.00407720
test eax, eax
je 0x401e2e
mov dword [ebp - 4], 0
mov byte [ebp - 0x128], 0
push 0x103
push 0
lea ecx, [ebp - 0x127]
push ecx
call fcn.00422670
add esp, 0xc
lea ecx, [ebp - 0x15]
call fcn.00411ad0
mov byte [ebp - 4], 1
push 0x104
lea edx, [ebp - 0x128]
push edx
lea ecx, [ebp - 0x15]
call fcn.00411e20
push str.Windows_7
lea eax, [ebp - 0x128]
push eax
call fcn.004033b0
add esp, 8
test eax, eax
setne cl
mov byte [ebp - 0x129], cl
movzx edx, byte [ebp - 0x129]
test edx, edx
jne 0x401dd4
call fcn.0041b3a0
jmp 0x401dd9
call fcn.0041b940
lea ecx, [ebp - 0x12a]
call fcn.00411ad0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x12a]
call fcn.00404f40
call fcn.00401b80
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12a]
call fcn.004090a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x15]
call fcn.004090a0
jmp 0x401e22
mov dword [ebp - 4], 0xffffffff
call fcn.00407790
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041d3f6
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403470
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 8
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0x403450
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x404e90
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5010
call fcn.004272f0
mov eax, dword [0x43c2d0]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x5000
lea eax, [ebp - 0x5010]
push eax
call fcn.0041dd8d
add esp, 0x10
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x5010]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041d3f6
mov esp, ebp
pop ebp
ret
Function at 0x4050d0
Capabilities:
Enumerate process modules
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x43c2d0]
xor eax, ebp
mov dword [ebp - 0x2c], eax
push str.Enter_SetWindowsAPIHook_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x4050fd
xor eax, eax
jmp 0x4051e7
mov ecx, dword [ebp + 8]
cmp dword [ecx + 4], 0
jne 0x40510d
xor eax, eax
jmp 0x4051e7
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0
jne 0x40511d
xor eax, eax
jmp 0x4051e7
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
jne 0x4051d2
mov dword [ebp - 0x258], 0x224
push 0x220
push 0
lea ecx, [ebp - 0x254]
push ecx
call fcn.00422670
add esp, 0xc
push 0x1c
lea edx, [ebp - 0x28]
push edx
push fcn.00404fe0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x258]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Module32First
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4051be
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 4]
je 0x4051a9
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x23c]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp + 8]
push eax
call fcn.00404fe0
add esp, 4
lea ecx, [ebp - 0x258]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Module32Next
mov dword [ebp - 0xc], eax
jmp 0x405180
push str.Exit_SetWindowsAPIHook_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
jmp 0x4051e7
mov eax, dword [ebp + 8]
push eax
call fcn.00404fe0
add esp, 4
mov eax, 1
jmp 0x4051e7
mov ecx, dword [ebp - 0x2c]
xor ecx, ebp
call fcn.0041d3f6
mov esp, ebp
pop ebp
ret

Function at 0x407720
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x43c2d0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x43e9dc], 0
jne 0x40777c
lea eax, [ebp - 0x198]
push eax
push 0x202
call sub.WSOCK32.dll_WSAStartup
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jne 0x407768
mov dword [0x43e9dc], 1
jmp 0x40777c
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
test ecx, ecx
jne 0x40773c
mov eax, dword [0x43e9dc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041d3f6
mov esp, ebp
pop ebp
ret
Function at 0x4077a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x10], 0
jne 0x4077b3
mov al, 1
jmp 0x407860
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
push 0
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WSOCK32.dll_send
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x40780e
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jae 0x40780c
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4077c8
jmp 0x407845
cmp dword [ebp - 0x10], 0
jge 0x407845
cmp dword [ebp - 0xc], 5
jae 0x407845
cmp dword [ebp - 8], 5
jae 0x407845
cmp dword [ebp - 0xc], 0
jne 0x40782f
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x4077c8
cmp dword [ebp + 0x14], 0
je 0x407853
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp eax, dword [ebp + 0x10]
sete cl
mov al, cl
mov esp, ebp
pop ebp
ret
Function at 0x407950
Capabilities:
Connect socket
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004078f0
add esp, 0xc
cmp dword [ebp + 0x14], 0
jle 0x407abc
mov dword [ebp - 4], 1
lea eax, [ebp - 4]
push eax
push 0x8004667e
mov ecx, dword [ebp + 8]
push ecx
call sub.WSOCK32.dll_ioctlsocket
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x407abc
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.WSOCK32.dll_connect
mov dword [ebp - 8], eax
mov dword [ebp - 0x114], 0
cmp dword [ebp - 8], 0xffffffff
jne 0x4079cc
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 0x114], eax
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0x8004667e
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.dll_ioctlsocket
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x407a02
cmp dword [ebp - 0x114], 0x2733
je 0x407a02
or eax, 0xffffffff
jmp 0x407acd
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x228], 0
cmp dword [ebp - 0x110], 0x40
jae 0x407a3e
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0x10c], edx
mov eax, dword [ebp - 0x110]
add eax, 1
mov dword [ebp - 0x110], eax
xor ecx, ecx
jne 0x407a16
cmp dword [ebp - 0x228], 0x40
jae 0x407a6a
mov edx, dword [ebp - 0x228]
mov eax, dword [ebp + 8]
mov dword [ebp + edx*4 - 0x224], eax
mov ecx, dword [ebp - 0x228]
add ecx, 1
mov dword [ebp - 0x228], ecx
xor edx, edx
jne 0x407a42
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], 0
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x110]
push eax
push 0
push 0
call sub.WSOCK32.dll_select
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x407ab7
xor eax, eax
jmp 0x407acd
or eax, 0xffffffff
jmp 0x407acd
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WSOCK32.dll_connect
mov esp, ebp
pop ebp
ret
Function at 0x4080e0
Capabilities:
Print debug messages
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push str.localhost
mov eax, dword [ebp + 8]
push eax
call fcn.0041ec85
add esp, 8
test eax, eax
jne 0x408111
push str.127.0.0.1
call sub.WSOCK32.dll_inet_addr
jmp 0x4081bc
mov ecx, dword [ebp + 8]
push ecx
call fcn.00408010
add esp, 4
test eax, eax
je 0x408134
mov edx, dword [ebp + 8]
push edx
call sub.WSOCK32.dll_inet_addr
jmp 0x4081bc
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.dll_gethostbyname
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408153
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x4081b4
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
sub edx, 0x2af9
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 3
ja case.default.0x408176
mov eax, dword [ebp - 0xc]
jmp dword [eax*4 + 0x4081c0]
push str.The_host_was_not_found._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp case.default.0x408176
push str.The_name_is_valid_but_it_has_no_address._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp case.default.0x408176
push str.A_non_recoverable_name_server_error_occurred._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp case.default.0x408176
push str.The_name_server_is_temporarily_unavailable.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
or eax, 0xffffffff
jmp 0x4081bc
mov eax, dword [ebp - 4]
jmp 0x4081bc
mov esp, ebp
pop ebp
ret
Function at 0x410690
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 4
mov ecx, dword [ebp - 4]
push ecx
push 0x410660
push 0
push 0
call fcn.0041eac7
add esp, 0x18
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x4106c8
xor al, al
jmp 0x4106ca
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4106d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x4106ed
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
mov esp, ebp
pop ebp
ret