joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b8f0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x213c
call fcn.00455e70
mov eax, dword [0x4968d4]
xor eax, esp
mov dword [esp + 0x2138], eax
push esi
mov esi, dword [esp + 0x2144]
test dword [0x49519c], esi
jne 0x42b930
xor eax, eax
pop esi
mov ecx, dword [esp + 0x2138]
xor ecx, esp
call fcn.00454567
add esp, 0x213c
ret
push ebx
xor ebx, ebx
push 0xfff
lea eax, [esp + 0x1145]
push ebx
push eax
mov byte [esp + 0x114c], bl
call fcn.00455df0
mov edx, dword [esp + 0x2158]
xor eax, eax
lea ecx, [esp + 0x215c]
push ecx
push edx
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov word [esp + 0x4d], ax
mov byte [esp + 0x4f], al
lea eax, [esp + 0x1154]
push 0x1000
push eax
mov byte [esp + 0x38], bl
call fcn.00454e11
add esp, 0x1c
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x18]
movzx eax, word [esp + 0x16]
movzx ecx, word [esp + 0x14]
push edx
push eax
push ecx
push 0x47bb88
push 0x20
lea edx, [esp + 0x30]
push 0x20
push edx
call fcn.00455002
push 0xfff
lea eax, [esp + 0x161]
push ebx
push eax
mov byte [esp + 0x168], bl
call fcn.00455df0
lea ecx, [esp + 0x1168]
push ecx
lea edx, [esp + 0x48]
push edx
push esi
push str.__d__s__s_n
push 0x1000
lea eax, [esp + 0x17c]
push 0x1000
push eax
call fcn.00455002
add esp, 0x44
test byte [0x49c030], 1
je 0x42ba2b
lea ecx, [esp + 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [0x49c030], 2
je 0x42ba44
lea edx, [esp + 0x140]
push edx
call fcn.00457957
add esp, 4
test byte [0x49c030], 4
je 0x42bafc
push 0x103
lea eax, [esp + 0x41]
push ebx
push eax
mov byte [esp + 0x48], bl
call fcn.00455df0
movzx ecx, word [esp + 0x20]
movzx edx, word [esp + 0x1e]
movzx eax, word [esp + 0x1a]
push ecx
movzx ecx, word [esp + 0x1c]
push edx
push eax
push ecx
push 0x495098
push str._s__04d__02d__02d__02d.log
push 0x104
lea edx, [esp + 0x64]
push 0x104
push edx
call fcn.00455002
push 0x47bb5c
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x44], ebx
call fcn.004572a8
mov eax, dword [esp + 0x44]
add esp, 0x3c
cmp eax, ebx
jne 0x42bad7
pop ebx
xor eax, eax
pop esi
mov ecx, dword [esp + 0x2138]
xor ecx, esp
call fcn.00454567
add esp, 0x213c
ret
push eax
lea edx, [esp + 0x144]
push edx
call fcn.00457815
mov eax, dword [esp + 0x10]
push eax
call fcn.00456fa7
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00456dad
add esp, 0x10
mov ecx, dword [esp + 0x2140]
pop ebx
pop esi
xor ecx, esp
mov eax, 1
call fcn.00454567
add esp, 0x213c
ret
Function at 0x42bcf0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x28
push esi
xor esi, esi
push str.GetDiskFreeSpaceExA
push 0x47bbbc
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
pop esi
je 0x42bd42
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x28]
push ecx
push edx
call eax
jmp 0x42bd60
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x42bd73
push str.Failed_to_get_disk_free_space
push 4
call fcn.0042b8f0
add esp, 8
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add esp, 0x28
ret
Function at 0x42c0f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4968d4]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov esi, dword [esp + 0x114]
push edi
mov edi, dword [esp + 0x11c]
push 0x103
lea eax, [esp + 0x11]
push 0
push eax
mov byte [esp + 0x18], 0
call fcn.00455df0
push str.version.dat
push esi
lea ecx, [esp + 0x20]
push 0x47ac30
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42c18c
lea eax, [esp + 0xc]
push eax
push str.GetVerFile:Failed_to_CreateFile_:_File___s_
call fcn.0042bb70
lea ecx, [esp + 0x14]
push ecx
push str.GetVerFile:Failed_to_CreateFile_:_File___s_
push 8
call fcn.0042b8f0
add esp, 0x14
jmp 0x42c1fb
push 0
lea edx, [esp + 0xc]
push edx
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42c1cb
cmp dword [esp + 8], 4
jne 0x42c1cb
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.00454567
add esp, 0x10c
ret
lea eax, [esp + 0xc]
push eax
push str.GetVerFile:Failed_to_ReadFile_:_File___s_
call fcn.0042bb70
lea ecx, [esp + 0x14]
push ecx
push str.GetVerFile:Failed_to_ReadFile_:_File___s_
push 8
call fcn.0042b8f0
add esp, 0x14
push esi
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x110]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00454567
add esp, 0x10c
ret
Function at 0x42c220
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4968d4]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
mov esi, dword [esp + 0x114]
push 0x103
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.00455df0
push str.version.dat
push esi
lea ecx, [esp + 0x1c]
push 0x47ac30
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42c2ca
lea eax, [esp + 8]
push eax
push str.SetVerFile:Failed_to_CreateFile_:_File___s_
call fcn.0042bb70
lea ecx, [esp + 0x10]
push ecx
push str.SetVerFile:Failed_to_CreateFile_:_File___s_
push 8
call fcn.0042b8f0
add esp, 0x14
xor eax, eax
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.00454567
add esp, 0x10c
ret
push 0
lea edx, [esp + 8]
push edx
push 4
lea eax, [esp + 0x124]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42c30f
cmp dword [esp + 4], 4
jne 0x42c30f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.00454567
add esp, 0x10c
ret
lea ecx, [esp + 8]
push ecx
push str.SetVerFile:Failed_to_WriteFile_:_File___s_
call fcn.0042bb70
lea edx, [esp + 0x10]
push edx
push str.SetVerFile:Failed_to_WriteFile_:_File___s_
push 8
call fcn.0042b8f0
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.00454567
add esp, 0x10c
ret
Function at 0x42c720
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x473dc1
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4968d4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov eax, dword [0x49ec04]
mov edx, dword [eax + 0xc]
mov edi, 1
mov ecx, 0x49ec04
mov dword [esp + 0x18], edi
call edx
mov esi, dword [esp + 0x20]
add eax, 0x10
mov dword [esi], eax
cmp dword [esp + 0x30], 0
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x24]
jne 0x42c78d
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
push edi
push str._s__d__dN.cab
jmp 0x42c79d
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push edx
push eax
push edi
push str._s__d__dD.cab
push esi
call fcn.00420ca0
lea eax, [edi - 0x10]
add esp, 0x14
mov byte [esp + 0x18], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c7c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x42c7e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x473dc1
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4968d4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
mov eax, dword [0x49ec04]
mov edx, dword [eax + 0xc]
mov edi, 1
mov ecx, 0x49ec04
mov dword [esp + 0x18], edi
call edx
mov esi, dword [esp + 0x20]
add eax, 0x10
mov dword [esi], eax
cmp dword [esp + 0x30], 0
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x24]
jne 0x42c84d
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
push edi
push str._s_d_dN.cab
jmp 0x42c85d
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push edx
push eax
push edi
push str._s_d_dD.cab
push esi
call fcn.00420ca0
lea eax, [edi - 0x10]
add esp, 0x14
mov byte [esp + 0x18], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c887
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x42c8a0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x473deb
mov eax, dword fs:[0]
push eax
sub esp, 0x354
mov eax, dword [0x4968d4]
xor eax, esp
mov dword [esp + 0x350], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4968d4]
xor eax, esp
push eax
lea eax, [esp + 0x368]
mov dword fs:[0], eax
mov esi, dword [esp + 0x378]
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
je 0x42ca84
push 0
push 0
push 0
push 0
push 0x100
lea ecx, [esp + 0x174]
push ecx
push 3
lea edx, [esp + 0x30]
push edx
push esi
call fcn.00456442
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x24
test byte [esp + 0x20], 0x10
je 0x42ca1c
push 0x104
lea eax, [esp + 0x50]
push 0x47b0ac
push eax
call fcn.00456765
add esp, 0xc
test eax, eax
je 0x42ca61
push 0x104
lea ecx, [esp + 0x50]
push 0x47b0a8
push ecx
call fcn.00456765
add esp, 0xc
test eax, eax
je 0x42ca61
mov edx, dword [0x49ec04]
mov eax, dword [edx + 0xc]
mov ecx, 0x49ec04
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x164]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push str._s_s_s.
push ecx
mov dword [esp + 0x384], 0
call fcn.00420ca0
mov edx, dword [esp + 0x2c]
push edx
call fcn.0042c8a0
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x17c]
push ecx
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x3c]
push str._s_s_s
push eax
call fcn.00420ca0
mov esi, dword [esp + 0x44]
add esp, 0x2c
push esi
call edi
lea eax, [esi - 0x10]
mov dword [esp + 0x370], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ca61
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x42ca61
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x164]
push edx
lea eax, [esp + 0x1c]
push eax
push str._s_s_s
lea ecx, [esp + 0x270]
push 0x104
push ecx
call fcn.00454fe6
add esp, 0x18
push 0x80
lea edx, [esp + 0x264]
push edx
call ebp
lea eax, [esp + 0x260]
push eax
call ebx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42c932
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x368]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x350]
xor ecx, esp
call fcn.00454567
add esp, 0x360
ret
Function at 0x42cab0
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x473e28
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4968d4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov eax, dword [0x49ec04]
mov edx, dword [eax + 0xc]
mov ecx, 0x49ec04
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0x20]
push esi
lea eax, [esp + 0x10]
push str._s.
push eax
mov dword [esp + 0x24], 0
call fcn.00420ca0
mov edi, dword [esp + 0x18]
push edi
call fcn.0042c8a0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [edi - 0x10]
mov dword [esp + 0x18], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42cb3d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x42cca0
Capabilities:
Download url
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x473e98
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4968d4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
push eax
push edi
push ebx
push str.Try_to_GetFileFromServerV5_:_URL___s___FILENAME___s___CONTINUE___d_
push 0x40
call fcn.0042b8f0
add esp, 0x14
push edi
lea ecx, [esp + 0x18]
xor esi, esi
call fcn.00421160
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esp + 0x28], esi
call fcn.0042adb0
add esp, 4
test eax, eax
jne 0x42cd6a
mov edx, dword [esp + 0x14]
push edx
push str.Failed_to_RecCreateDirectoryFile_:_Path___s_
call fcn.0042bb70
mov eax, dword [esp + 0x1c]
push eax
push str.Failed_to_RecCreateDirectoryFile_:_Path___s_
push 8
call fcn.0042b8f0
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 0x14
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42cd51
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 3
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x18], esi
cmp byte [0x49c04c], 0
jne 0x42cddb
mov edx, dword [esp + 0x34]
push ebp
push edi
mov ecx, ebx
call fcn.0042c3c0
mov esi, eax
add esp, 8
test esi, esi
je 0x42cddb
cmp esi, 2
je 0x42cddb
cmp dword [esp + 0x34], 0
jne 0x42cdae
push 0
push 0x10
push edi
push ebx
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
je 0x42cdd9
push ebp
push 0
push ebx
mov ecx, edi
call fcn.0042bd80
mov esi, eax
add esp, 0xc
test esi, esi
je 0x42cddb
cmp esi, 2
je 0x42cddb
mov eax, dword [esp + 0x18]
add eax, 1
cmp eax, 3
mov dword [esp + 0x18], eax
jl 0x42cd72
jmp 0x42cddb
xor esi, esi
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42ce03
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x42dd10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4740b8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x4968d4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x49ec04]
mov edx, dword [eax + 0xc]
mov ecx, 0x49ec04
call edx
lea edi, [eax + 0x10]
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x14], ecx
push eax
lea ecx, [esi + 4]
mov dword [esp + 0x28], 0
mov dword [esp + 0x14], edx
call fcn.0042dc70
lea eax, [edi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42dd9e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 0xc

Function at 0x42e570
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push esi
mov esi, ecx
push 0
jne 0x42e588
push eax
push esi
push 0x42e4f0
push eax
push eax
jmp 0x42e597
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
push ecx
push esi
push 0x42e4f0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 4], eax
jne 0x42e5aa
xor eax, eax
pop esi
ret 8
mov ecx, dword [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x42e5a4
mov edx, dword [esi + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
pop esi
ret 8

Function at 0x42e880
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x44], 0
je 0x42e915
mov eax, dword [esi + 0x98]
cmp eax, dword [esi + 0x48]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
lea edi, [esi + 0x98]
lea ebx, [esi + 0x48]
jne 0x42e8ef
mov ecx, dword [esi + 0xa0]
cmp ecx, dword [esi + 0x50]
jne 0x42e8ef
mov edx, dword [esi + 0xa4]
cmp edx, dword [esi + 0x54]
jne 0x42e8ef
mov eax, dword [esi + 0xac]
cmp eax, dword [esi + 0x5c]
jne 0x42e8ef
lea ecx, [esi + 0x58]
push ecx
lea edx, [esi + 0xa8]
push edx
call fcn.0041fff0
add esp, 8
test al, al
je 0x42e8ef
call ebp
sub eax, dword [esi + 0xc8]
cmp eax, 0x64
jb 0x42e912
push ebx
mov ecx, edi
call fcn.0042e820
mov edx, dword [esi + 0xac]
mov ecx, dword [esi + 0x44]
mov eax, dword [ecx]
mov eax, dword [eax]
push edx
mov edx, dword [edi]
push edx
call eax
call ebp
mov dword [esi + 0xc8], eax
pop edi
pop ebp
pop ebx
pop esi
ret
Function at 0x431fe0
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x14
mov eax, dword [0x4968d4]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, ecx
cmp dword [edi], 0xffffffff
jne 0x432010
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00454567
add esp, 0x14
ret 8
push ebx
mov ebx, dword [sym.imp.WSOCK32.dll_inet_addr]
push esi
call ebx
cmp eax, 0xffffffff
je 0x432023
mov eax, esi
jmp 0x43203c
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
test eax, eax
je 0x432040
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
call dword [sym.imp.WSOCK32.dll_inet_ntoa]
test eax, eax
jne 0x432056
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00454567
add esp, 0x14
ret 8
push eax
call ebx
mov edx, dword [esp + 0x28]
push edx
mov dword [esp + 0x14], eax
mov word [esp + 0x10], 2
call dword [sym.imp.WSOCK32.dll_htons]
mov ecx, dword [edi]
mov word [esp + 0xe], ax
push 0x10
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_connect]
mov ecx, dword [esp + 0x1c]
pop ebx
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
add eax, 1
call fcn.00454567
add esp, 0x14
ret 8

Function at 0x4320a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, ecx
cmp dword [ebp], 0xffffffff
jne 0x4320b0
or eax, 0xffffffff
pop ebp
ret 8
cmp dword [esp + 8], 0
je 0x4320a9
push ebx
mov ebx, dword [esp + 0x10]
test ebx, ebx
jle 0x432107
push esi
push edi
mov edi, dword [sym.imp.WSOCK32.dll_send]
xor esi, esi
mov eax, ebx
lea esp, [esp]
mov edx, dword [ebp]
push 0
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esi + eax]
push ecx
push edx
call edi
cmp eax, 0xffffffff
je 0x4320fd
test eax, eax
jle 0x4320fd
add esi, eax
mov eax, ebx
sub eax, esi
test eax, eax
jg 0x4320d0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
pop edi
pop esi
pop ebx
or eax, 0xffffffff
pop ebp
ret 8
pop ebx
xor eax, eax
pop ebp
ret 8

Function at 0x432140
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x4968d4]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
lea eax, [esp + 4]
push eax
push 0x202
mov esi, ecx
call dword [sym.imp.WSOCK32.dll_WSAStartup]
mov ecx, dword [esp + 0x194]
neg eax
sbb eax, eax
add eax, 1
mov dword [esi], eax
mov eax, esi
pop esi
xor ecx, esp
call fcn.00454567
add esp, 0x194
ret

Function at 0x432190
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
test byte [0x49c058], 1
push esi
mov esi, ecx
jne 0x4321ba
or dword [0x49c058], 1
mov ecx, 0x49c054
call fcn.00432140
push 0x4798d0
call fcn.004547de
add esp, 4
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4321c8
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
push 0
push 1
push 2
mov dword [esi], 0xffffffff
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
cmp dword [esi], 0xffffffff
pop esi
setne al
ret
Function at 0x432950
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2108
call fcn.00455e70
mov eax, dword [0x4968d4]
xor eax, esp
mov dword [esp + 0x2104], eax
mov eax, dword [esp + 0x210c]
push ebx
mov ebx, dword [esp + 0x2118]
push ebp
mov ebp, dword [esp + 0x2120]
push esi
mov esi, ecx
mov ecx, dword [esp + 0x211c]
push edi
lea edx, [esp + 0x1114]
mov dword [esp + 0x10], ecx
push edx
lea ecx, [esp + 0x118]
push ecx
push eax
call fcn.00432500
add esp, 0xc
push 0
mov ecx, esi
mov edi, eax
call fcn.00431f60
push edi
lea edx, [esp + 0x118]
push edx
mov ecx, esi
call fcn.00431fe0
test eax, eax
jne 0x4329d4
mov ecx, esi
call fcn.00431f40
xor eax, eax
jmp 0x432b1e
cmp dword [esp + 0x10], 0
je 0x432a94
test ebx, ebx
je 0x432a94
push 5
mov edi, 1
push str.POST
mov ecx, esi
call fcn.004320a0
lea eax, [esp + 0x1114]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x432a04
sub eax, edx
push eax
lea eax, [esp + 0x1118]
push eax
mov ecx, esi
call fcn.004320a0
mov eax, str._HTTP_1.0_r_nConnection:_Close_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_5.0__NeoWiz__r_nHost:
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x432a27
sub eax, edx
push eax
push str._HTTP_1.0_r_nConnection:_Close_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_5.0__NeoWiz__r_nHost:
mov ecx, esi
call fcn.004320a0
lea eax, [esp + 0x114]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x432a50
sub eax, edx
push eax
lea ecx, [esp + 0x118]
push ecx
mov ecx, esi
call fcn.004320a0
test edi, edi
je 0x432aa2
mov edx, dword [ebx]
push edx
lea eax, [esp + 0x18]
push str._r_nContent_Type:_text_plain_r_nContent_Length:__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.004320a0
jmp 0x432ae4
push 4
xor edi, edi
push str.GET
jmp 0x4329f3
test ebp, ebp
je 0x432ae4
mov eax, dword [ebp]
test eax, eax
jge 0x432ab6
mov dword [ebp], 0
jmp 0x432ae4
je 0x432ae4
push eax
lea edx, [esp + 0x18]
push str._r_nRange:_bytes_d_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.004320a0
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 4
push str._r_n_r_n
mov ecx, esi
call fcn.004320a0
test edi, edi
je 0x432b05
mov edx, dword [ebx]
mov eax, dword [esp + 0x10]
push edx
push eax
mov ecx, esi
call fcn.004320a0
push ebx
push esi
mov ecx, ebp
call fcn.00432720
add esp, 8
test eax, eax
je 0x4329c6
mov eax, 1
mov ecx, dword [esp + 0x2114]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00454567
add esp, 0x2108
ret 0x10