joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417c54
Capabilities:
Query or enumerate registry value

Disassembly:
lea edx, [esp + 8]
mov ebx, 1
push edx
push ebx
push 0
push str.CLSID4be8a061_c73b_4f23_8114_317aae3e8698InProcServer32
dec esp
add byte [eax], ch
add byte [eax], al
add bh, 0x44
and al, 0x1c
add byte [eax], al
add byte [eax], al
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [0x4c7f6c], eax
mov eax, dword [0x4c6b3c]
push eax

Function at 0x417c5c
Capabilities:
Query or enumerate registry value

Disassembly:
call dword [sym.imp.GDI32.dll_GetBkMode]
mov dword [esp + 4], eax
and al, 4
mov eax, dword [0x4c7f6c]
test eax, eax
invalid
jne 0x417cdc
push 0x4c6c4c

Function at 0x417cac
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add byte [ebp + 0x7f6ca3c0], al
dec esp
invalid

Function at 0x473594
Capabilities:
Encode data using base64

Disassembly:
or edx, edx
xor byte [edi + ebp*8 - 0xa112522], bh
cmc

Function at 0x4735dc
Capabilities:
Encode data using base64

Disassembly:
bound ebp, qword [eax]
or ebx, edi
xor byte [edi + 0x3f715aeb], 0x50
jno 0x473625
push eax

Function at 0x4735e4
Capabilities:
Encode data using base64

Disassembly:
bound ebp, qword [eax]
or ebx, edi
xor byte [edi + 0x3f715aeb], 0x50
jno 0x473625
push eax

Function at 0x4735ec
Capabilities:
Encode data using base64

Disassembly:
dec byte [edx]
int1
or dh, cl
imul edi, dword [edi + 7], 0xc
rcl cl, cl
sal dword [esi - 0xa], 1

Function at 0x4735f4
Capabilities:
Encode data using base64

Disassembly:
dec byte [edx]
int1
or dh, cl
imul edi, dword [edi + 7], 0xc
rcl cl, cl
sal dword [esi - 0xa], 1
Function at 0x4ac134
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
add al, 0x6d
dec edx
push ds
or al, 0xa9
push edx
push es
push 0xffffffffffffff81
jne 0x4ac122
clc
clc
jle 0x4ac0e3
dec esi
bnd je 0x4ac117
pop ss
mov esp, dword [eax - 0x62]
push 0x839e3025
pop ds
dec esp
mov ebp, dword [esi - 0x28f1a514]
iretd
add ebp, esp
out 0x21, eax
cld
push 0xffffffffffffff87
dec edx
mov ch, 0x60
pushal
jne 0x4ac147
sub eax, 0x3bc2aac2
loop 0x4ac10e
ret 0xc2aa
jns 0x4ac13f
mov bh, 0x7b
out 0x70, eax
jnp 0x4ac0d7
push 0xffffffffffffffa5
push 0x3bfe9708
pop esi
inc ebp
outsb dx, byte [esi]
or eax, 0xb16f1bc0
sbb ebp, dword [edi - 0x4f]
sbb ebp, dword [edi - 0x4f]
out 0x9d, al
add ecx, dword cs:[ebx]
mov dl, 0x82
xchg ebx, eax
imul eax, dword [edx - 0x7e6fbecb], 0x29
and eax, 0x1d267fc9
mov esi, 0xc8507e01
push ecx
push es
std
leave
jg 0x4ac170
sbb eax, 0x507e01be
enter 0x651, 0xfffffffffffffffd
lodsb al, byte [esi]
and byte [eax], 0xf
push es
xchg cl, ch
shl dword [esi - 0x7f], 1
push ds
loope 0x4ac119
xchg al, bl
movsd dword es:[edi], dword [esi]
add eax, 0xb28da244
adc dword [eax], ebp
xor dword [ecx], ecx
cmpsd dword [esi], dword es:[edi]
sub esi, dword [esi + 0x4f]
add al, dl
and dword [ecx - 0x4d945809], ebx
push esp
inc eax
and eax, 0x7463b358
xor cl, byte [ebp + 8]
dec edx
mov eax, 0x781e6ed9
mul dword [edx - 0x5e]
cmp byte [esi + 0xe], ch
loopne 0x4ac1ab
cmc
mov esp, dword [ebp - 0x40124edb]
out dx, al
je 0x4ac1f1
movsb byte es:[edi], byte [esi]
call 0x49f5da21
sub al, 0x99
js 0x4ac1a5
lea ecx, [ecx - 0x71]
int3
dec ecx
invalid
mov byte [edi], ch
pop edx
bound eax, qword [eax]
invalid
mov dword ss:[0x26c76e7f], eax
mov byte [ebx + 0x7760b8a6], cl
jmp 0x5976f3dc
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x1a6057d7
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x37d84af5
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4019c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
mov edx, dword [esp + 8]
mov eax, dword [edx + 0x24]
sub eax, 5
cmp eax, 1
jbe 0x401b80
mov eax, dword [edx + 8]
mov ecx, 0xfff
xor edi, edi
mov dword [edx + 0x10], 0
mov word [edx + 0xc], cx
mov dword [edx + 0x24], 0
lea ecx, [edx + 0xf8]
mov dword [edx + 0x30], 0
mov dword [edx + 0x34], 0
mov dword [edx + 0x38], 0
mov dword [edx + 0x3c], 0
mov dword [edx + 0x40], 0
mov dword [edx + 0x44], 0
mov dword [edx + 0x48], 0
mov dword [edx + 0x4c], 0
mov dword [edx + 0x50], 0
mov dword [edx + 0x54], 0
mov dword [edx + 0x58], 0
mov dword [edx + 0x5c], 0
mov dword [edx + 0x60], 0
mov dword [edx + 0x64], 0
mov dword [edx + 0x68], 0
mov dword [edx + 0x6c], 0x20
mov dword [edx + 0x70], 0x20
mov dword [edx + 0x74], 0
mov dword [edx + 0x78], 0
mov dword [edx + 0x7c], 2
mov dword [edx + 0x80], 2
mov dword [edx + 0x84], 0x1388
mov dword [edx + 0x88], 0x1f4
mov dword [edx + 0x8c], 0x20
mov dword [edx + 0x90], 0x1388
mov dword [edx + 0x94], 0x7530
mov dword [edx + 0x98], 0x1f4
mov dword [edx + 0x9c], 0x1f4
mov dword [edx + 0xa0], 0
mov dword [edx + 0xa4], 0
mov dword [edx + 0xa8], 0x1f4
mov eax, dword [eax + 0x18]
mov word [edx + 0xbc], di
lea edi, [edx + 0xfc]
mov dword [edx + 0xac], 0
mov dword [edx + 0xb8], 0
mov dword [edx + 0xb4], 0x10000
and edi, 0xfffffffc
mov dword [edx + 0xb0], eax
xor eax, eax
sub ecx, edi
mov word [edx + 0xf4], ax
xor eax, eax
sub ecx, 0xffffff80
mov word [edx + 0xf6], ax
xor eax, eax
shr ecx, 2
mov dword [edx + 0x178], 0
mov dword [edx + 0x17c], 0
mov dword [edx + 0xf8], 0
mov dword [edx + 0x174], 0
rep stosd dword es:[edi], eax
mov dword [esp + 8], edx
pop edi
jmp fcn.00401650
mov eax, dword [edx + 0x30]
test eax, eax
mov eax, dword [edx + 8]
je 0x401b91
sub dword [eax + 0x2894], 1
sub dword [eax + 0x2890], 1
jmp 0x4019d7

Function at 0x401ec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov eax, dword [ebx + 0x24]
lea edx, [eax - 7]
cmp edx, 2
jbe 0x401f90
test eax, eax
je 0x401f90
mov dword [esp], ebx
call fcn.00401650
mov dword [esp], esi
call dword [sym.imp.WS2_32.dll_htonl]
mov edi, eax
mov eax, dword [ebx + 0x24]
sub esp, 4
mov dword [esp], 0x54
sub eax, 5
cmp eax, 2
sbb esi, esi
and esi, 0x40
add esi, 0x44
call fcn.00409150
test eax, eax
je 0x401f48
mov ecx, esi
xor edx, edx
mov byte [eax + 0x21], 0xff
mov byte [eax + 0x20], cl
mov dword [eax + 0x24], edi
mov dword [eax + 0x18], 0
mov word [eax + 0x1c], dx
mov dword [eax + 0x50], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00401cf0
mov eax, dword [ebx + 0x24]
sub eax, 5
cmp eax, 1
jbe 0x401f70
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.00404170
mov dword [esp + 0x20], ebx
add esp, 0x10
pop ebx
pop esi
pop edi
jmp fcn.004019c0
mov eax, dword [ebx + 0x30]
test eax, eax
mov eax, dword [ebx + 8]
je 0x401f81
sub dword [eax + 0x2894], 1
sub dword [eax + 0x2890], 1
mov dword [ebx + 0x24], 7
nop
add esp, 0x10
pop ebx
pop esi
pop edi
ret
Function at 0x403450
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
mov esi, eax
mov eax, edx
lea edx, [esi + 0xc8]
sub esp, 0x2c
mov ebx, dword [esi + 0xc8]
mov byte [esp + 0x14], cl
cmp ebx, edx
je 0x403556
mov ebp, ecx
jmp 0x40348a
mov ebx, dword [ebx]
cmp ebx, edx
je 0x403550
cmp word [ebx + 8], ax
jne 0x403480
cmp byte [ebx + 0x21], cl
jne 0x403480
cmp ebx, edx
mov byte [esp + 0x14], cl
mov ecx, ebp
je 0x403556
mov ebp, 1
movzx ecx, cl
cmp ecx, dword [esi + 0x2c]
jae 0x4034e0
imul ecx, ecx, 0x3c
mov eax, dword [esi + 0x28]
shr edi, 0xc
mov dword [esp + 0x14], edi
add eax, ecx
lea edi, [eax + edi*2]
movzx ecx, word [edi + 6]
test cx, cx
je 0x4034e0
sub ecx, 1
test cx, cx
mov word [edi + 6], cx
je 0x4035cc
nop
lea esi, [esi]
movzx eax, byte [ebx + 0x20]
mov dword [esp], ebx
mov dword [esp + 0x14], edx
mov edi, eax
call fcn.004091d0
mov eax, dword [ebx + 0x50]
and edi, 0xf
mov edx, dword [esp + 0x14]
test eax, eax
je 0x403517
test ebp, ebp
je 0x40350e
movzx ecx, word [ebx + 0x1c]
sub dword [esi + 0xb8], ecx
sub dword [eax], 1
je 0x4035b0
mov dword [esp], ebx
mov dword [esp + 0x14], edx
call fcn.00409190
mov eax, dword [esi + 0xc8]
mov edx, dword [esp + 0x14]
cmp eax, edx
je 0x4035ed
mov edx, dword [eax + 0xc]
add edx, dword [eax + 0x10]
mov eax, edi
mov dword [esi + 0x50], edx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov byte [esp + 0x14], cl
mov ecx, ebp
mov ebx, dword [esi + 0xd8]
lea ebp, [esi + 0xd8]
mov dword [esp + 0x18], ebp
cmp ebx, ebp
je 0x4035e3
cmp word [ebx + 0x1e], 0
je 0x4035e3
mov dword [esp + 0x1c], edx
mov ebp, ecx
mov edx, dword [esp + 0x18]
movzx ecx, byte [esp + 0x14]
jmp 0x40358f
mov ebx, dword [ebx]
cmp ebx, edx
je 0x4035e3
cmp word [ebx + 0x1e], 0
je 0x4035e3
cmp word [ebx + 8], ax
jne 0x403582
cmp byte [ebx + 0x21], cl
jne 0x403582
cmp ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, ebp
je 0x4035e3
xor ebp, ebp
jmp 0x4034a8
or dword [eax + 4], 0x100
mov dword [esp], eax
mov dword [esp + 0x14], edx
call fcn.004010b0
mov edx, dword [esp + 0x14]
jmp 0x403517
movzx ecx, byte [esp + 0x14]
mov edi, 1
shl edi, cl
not edi
and word [eax + 4], di
jmp 0x4034e0
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
jmp 0x403540
Function at 0x406ed0
Capabilities:
Initialize winsock library

Disassembly:
push ebx
sub esp, 0x1a8
lea eax, [esp + 0x10]
mov dword [esp], 0x101
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
mov ebx, eax
jne 0x406f40
movzx edx, word [esp + 0x10]
cmp dl, 1
jne 0x406f23
shr dx, 8
cmp dx, 1
jne 0x406f23
mov dword [esp], 1
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
sub esp, 4
add esp, 0x1a8
mov eax, ebx
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ebx, 0xffffffff
add esp, 0x1a8
mov eax, ebx
pop ebx
ret
mov ebx, 0xffffffff
jmp 0x406f19

Function at 0x406fc0
Capabilities:
Resolve dns

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x24]
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
sub esp, 4
test eax, eax
je 0x406fdf
cmp word [eax + 8], 2
je 0x407000
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_inet_addr]
sub esp, 4
cmp eax, 0xffffffff
je 0x407014
mov edx, dword [esp + 0x20]
mov dword [edx], eax
xor eax, eax
add esp, 0x18
pop ebx
ret
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x20]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ecx], eax
add esp, 0x18
xor eax, eax
pop ebx
ret
mov eax, 0xffffffff
jmp 0x406ff8

Function at 0x4071b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
sub esp, 0x38
lea eax, [esp + 0x1c]
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x1c], 0x10
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getsockname]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x407202
mov eax, dword [esp + 0x24]
mov dword [ebx], eax
movzx eax, word [esp + 0x22]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [ebx + 4], ax
sub esp, 4
xor eax, eax
add esp, 0x38
pop ebx
ret

Function at 0x407250
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp dword [esp + 0x20], 2
mov dword [esp + 8], 0
mov dword [esp], 2
sete al
add eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
add esp, 0x1c
ret
Function at 0x407280
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x3c
mov eax, dword [esp + 0x44]
cmp eax, 9
ja case.0x407290.60
jmp dword [eax*4 + 0x46e4a0]
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 1
mov dword [esp + 4], 6
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
cmp eax, 0xffffffff
sete al
movzx eax, al
neg eax
add esp, 0x3c
ret
mov eax, dword [esp + 0x48]
mov dword [esp + 4], 0x8004667e
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
sub esp, 0xc
jmp 0x4072d0
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x20
mov dword [esp + 0xc], eax
nop
lea esi, [esi]
mov eax, dword [esp + 0x40]
mov dword [esp + 4], 0xffff
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_setsockopt]
sub esp, 0x14
jmp 0x4072d0
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x1002
mov dword [esp + 0xc], eax
jmp 0x407330
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x1001
mov dword [esp + 0xc], eax
jmp 0x407330
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 4
mov dword [esp + 0xc], eax
jmp 0x407330
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x1006
mov dword [esp + 0xc], eax
jmp 0x407330
lea eax, [esp + 0x48]
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x1005
mov dword [esp + 0xc], eax
jmp 0x407330
mov eax, 0xffffffff
jmp 0x4072db

Function at 0x4075e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
sub esp, 0x58
mov ebx, dword [esp + 0x64]
test ebx, ebx
je 0x4076a0
mov eax, 2
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov word [esp + 0x40], ax
movzx eax, word [ebx + 4]
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htons]
sub esp, 4
mov edx, 0x10
mov word [esp + 0x42], ax
mov eax, dword [ebx]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSASendTo]
sub esp, 0x24
cmp eax, 0xffffffff
mov edx, dword [esp + 0x3c]
je 0x4076b0
add esp, 0x58
mov eax, edx
pop ebx
ret
xor edx, edx
xor eax, eax
jmp 0x40763e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor edx, edx
cmp eax, 0x2733
setne dl
add esp, 0x58
neg edx
mov eax, edx
pop ebx
ret
Function at 0x4076d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push ebx
sub esp, 0x54
mov esi, dword [esp + 0x64]
mov dword [esp + 0x34], 0x10
mov dword [esp + 0x38], 0
test esi, esi
je 0x407780
lea edx, [esp + 0x34]
lea eax, [esp + 0x40]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
sub esp, 0x24
cmp eax, 0xffffffff
mov ebx, eax
je 0x407790
test byte [esp + 0x39], 0x80
jne 0x4077b0
test esi, esi
je 0x40776e
mov eax, dword [esp + 0x44]
mov dword [esi], eax
movzx eax, word [esp + 0x42]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ntohs]
sub esp, 4
mov word [esi + 4], ax
mov ebx, dword [esp + 0x3c]
add esp, 0x54
mov eax, ebx
pop ebx
pop esi
ret
xor edx, edx
xor eax, eax
jmp 0x4076f9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x4077a4
cmp eax, 0x2746
jne 0x407772
xor ebx, ebx
add esp, 0x54
mov eax, ebx
pop ebx
pop esi
ret
mov ebx, 0xffffffff
jmp 0x407772

Function at 0x407820
Capabilities:
Get socket status

Disassembly:
push ebp
push edi
mov edx, 0x10624dd3
push esi
push ebx
sub esp, 0x23c
mov ecx, dword [esp + 0x258]
mov ebx, dword [esp + 0x254]
mov esi, dword [esp + 0x250]
mov dword [esp + 0x28], 0
mov dword [esp + 0x12c], 0
mov eax, ecx
mul edx
mov eax, dword [ebx]
shr edx, 6
mov dword [esp + 0x20], edx
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x3e8
test al, 1
mov dword [esp + 0x24], ecx
je 0x40788c
mov dword [esp + 0x130], esi
mov dword [esp + 0x12c], 1
test al, 2
je 0x40789c
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 1
lea eax, [esp + 0x20]
lea ebp, [esp + 0x12c]
lea edi, [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
lea eax, [esi + 1]
mov dword [esp + 8], ebp
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_select]
sub esp, 0x14
test eax, eax
js 0x407925
mov dword [ebx], 0
jne 0x4078f0
xor eax, eax
add esp, 0x23c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebp
mov dword [esp], esi
call sub.WS2_32.dll___WSAFDIsSet
sub esp, 8
test eax, eax
jne 0x407920
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.WS2_32.dll___WSAFDIsSet
sub esp, 8
test eax, eax
je 0x4078da
or dword [ebx], 2
jmp 0x4078da
or dword [ebx], 1
jmp 0x407903
mov eax, 0xffffffff
jmp 0x4078dc
Function at 0x40c6e0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465c35
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x493014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
push 0x3d
mov dword [ebp - 0x1c], 0
call fcn.004649c1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x3d
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov byte [eax + 0x3c], 0
mov dword [eax], 4
mov dword [eax + 4], 1
mov dword [eax + 8], 0xffffffff
mov dword [eax + 0x10], 8
mov dword [eax + 0x18], 0
sub esp, 0x14
mov byte [ebp - 4], 1
mov ecx, esp
xorps xmm0, xmm0
push 0x10
movups xmmword [ecx], xmm0
push str.OnConsoleMessage
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004569a0
lea ecx, [ebp - 0x1c]
call fcn.0040c160
sub esp, 0x18
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.0044f450
lea ecx, [ebp - 0x1c]
call fcn.0040c160
push 1
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.00401000
push eax
push 0
push edi
call fcn.004021c0
push dword [ebp - 0x14]
call fcn.0046476b
mov ecx, dword [ebp + 0x1c]
add esp, 0x1c
cmp ecx, 0x10
jb 0x40c834
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40c82a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40c82a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0046470a
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004646fc
mov esp, ebp
pop ebp
ret
Function at 0x40cb10
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465cc5
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x493014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
push 0x3d
mov dword [ebp - 0x1c], 0
call fcn.004649c1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x3d
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov byte [eax + 0x3c], 0
mov dword [eax], 4
mov dword [eax + 4], 1
mov dword [eax + 8], 0xffffffff
mov dword [eax + 0x10], 8
mov dword [eax + 0x18], 0
sub esp, 0x14
mov byte [ebp - 4], 1
mov ecx, esp
xorps xmm0, xmm0
push 0xd
movups xmmword [ecx], xmm0
push str.OnNameChanged
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004569a0
lea ecx, [ebp - 0x1c]
call fcn.0040c160
mov edi, dword [ebp - 0x18]
lea eax, [edi + 6]
push eax
call fcn.004649c1
mov esi, dword [ebp - 0x14]
push edi
push esi
push eax
mov dword [ebp - 0x20], eax
call sub.VCRUNTIME140.dll_memcpy
push esi
call fcn.0046476b
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
lea eax, [edi + edx]
mov esi, dword [ebp - 0x24]
mov byte [eax], cl
inc ecx
mov byte [eax + 1], 9
mov dword [eax + 2], esi
lea eax, [edi + 6]
push ecx
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov byte [edx + 0x3c], cl
mov ecx, esp
push eax
mov dword [ebp - 0x14], edx
call fcn.0044f450
lea ecx, [ebp - 0x1c]
call fcn.0040c160
mov esi, dword [ebp - 0x14]
push 1
push dword [ebp - 0x18]
push esi
call fcn.00401000
push eax
push 0
push dword [ebp - 0x28]
call fcn.004021c0
push esi
call fcn.0046476b
mov ecx, dword [ebp + 0x1c]
add esp, 0x1c
cmp ecx, 0x10
jb 0x40ccad
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40cca3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40cca3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0046470a
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004646fc
mov esp, ebp
pop ebp
ret
Function at 0x40ccd0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465c35
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x493014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
push 0x3d
mov dword [ebp - 0x1c], 0
call fcn.004649c1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x3d
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov byte [eax + 0x3c], 0
mov dword [eax], 4
mov dword [eax + 4], 1
mov dword [eax + 8], 0xffffffff
mov dword [eax + 0x10], 8
mov dword [eax + 0x18], 0
sub esp, 0x14
mov byte [ebp - 4], 1
mov ecx, esp
xorps xmm0, xmm0
push 0xf
movups xmmword [ecx], xmm0
push str.OnDialogRequest
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.004569a0
lea ecx, [ebp - 0x1c]
call fcn.0040c160
sub esp, 0x18
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.0044f450
lea ecx, [ebp - 0x1c]
call fcn.0040c160
push 1
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.00401000
push eax
push 0
push edi
call fcn.004021c0
push dword [ebp - 0x14]
call fcn.0046476b
mov ecx, dword [ebp + 0x1c]
add esp, 0x1c
cmp ecx, 0x10
jb 0x40ce24
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ce1a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40ce1a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0046470a
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004646fc
mov esp, ebp
pop ebp
ret