joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1021a338
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1021a3d5
push ebx
push esi
call fcn.1021a301
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10217ac3
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1021a382
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1021a3d4
push edi
push eax
call fcn.102143c0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1021a3a2
call fcn.10213601
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1021a3d3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10217ac3
add esp, 0x20
test eax, eax
jne 0x1021a3c1
push edi
call fcn.10213601
jmp 0x1021a3c9
push ebx
call fcn.10213601
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1021a3d8
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x1021a3e9
pop esi
ret
push ebx
push edi
push esi
call fcn.1021a301
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.102143c0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1021a411
push ebx
push esi
push edi
call fcn.101f6470
add esp, 0xc
push 0
call fcn.10213601
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x1021ab6b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1021a686
Function at 0x1021af86
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1021af02
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1021b0f5
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1021b0f5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1021b0aa
jg 0x1021afe2
test eax, eax
je 0x1021b0a0
push 1
push 0x1000
call fcn.10213125
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1021b005
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1021b097
push 0x8000
push ebx
call fcn.1021ae33
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1021b02e
jg 0x1021b029
cmp ecx, 0x1000
jb 0x1021b02e
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1020fe96
add esp, 0x10
cmp eax, 0xffffffff
je 0x1021b073
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1021b029
jl 0x1021b05a
test ecx, ecx
jne 0x1021b01b
push dword [ebp - 0xc]
push ebx
call fcn.1021ae33
push esi
call fcn.10213601
add esp, 0xc
xor ebx, ebx
jmp 0x1021b103
cmp byte [edi + 0x24], 0
je 0x1021b08a
cmp dword [edi + 0x20], 5
jne 0x1021b08a
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1021b095
mov ebx, dword [edi + 0x18]
jmp 0x1021b097
xor ebx, ebx
push esi
call fcn.10213601
pop ecx
jmp 0x1021b103
test ecx, ecx
jg 0x1021b06c
jl 0x1021b0aa
test eax, eax
jae 0x1021b06c
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10210f63
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1021b0ca
cmp byte [edi + 0x1c], 0
je 0x1021b06c
jmp 0x1021b0fb
push ebx
call fcn.10208912
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1021b06c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1021b103
cmp byte [edi + 0x1c], 0
je 0x1021b100
mov ebx, dword [edi + 0x18]
jmp 0x1021b103
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10210f63
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1021d1ee
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1021132b
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1021d25d
cmp esi, dword [ebp - 4]
je 0x1021d258
cmp dword [ebp + 0xc], 0
je 0x1021d258
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1021d235
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1021cd40
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1021d25f
xor eax, eax
inc eax
jmp 0x1021d25f
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1021d2c4
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x102d94c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1021132b
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1021132b
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1021d33b
cmp word [ecx], dx
je 0x1021d33b
mov eax, dword [0x1029e83c]
push edi
dec eax
push eax
push 0x1029e728
call fcn.1021d263
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1021d3ae
cmp word [eax], dx
je 0x1021d3ae
mov eax, dword [edi]
test eax, eax
je 0x1021d35f
cmp word [eax], dx
je 0x1021d35f
lea eax, [ebp - 0x10]
push eax
call fcn.1021cc46
jmp 0x1021d368
lea eax, [ebp - 0x10]
push eax
call fcn.1021cce1
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1021d3d8
mov eax, dword [0x1029e724]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1029e418
call fcn.1021d263
add esp, 0xc
test al, al
je 0x1021d3d8
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1021d3a3
cmp word [eax], di
je 0x1021d3a3
lea eax, [ebp - 0x10]
push eax
call fcn.1021cc46
pop ecx
jmp 0x1021d3da
lea eax, [ebp - 0x10]
push eax
call fcn.1021cce1
jmp 0x1021d3a0
mov eax, dword [edi]
test eax, eax
je 0x1021d3c5
cmp word [eax], dx
je 0x1021d3c5
lea eax, [ebp - 0x10]
push eax
call fcn.1021cbfb
pop ecx
jmp 0x1021d3d8
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1021d4a3
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1021d0e8
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1021d4a3
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1021d4a3
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1021d4a3
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1021d430
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10213cb2
test ebx, ebx
je 0x1021d49e
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10213cb2
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1021d4a3
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1021d4a3
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1022208b
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1021d4a5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f469d
leave
ret
Function at 0x10221cba
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x102d94c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x10221cfd
call fcn.10202311
mov dword [eax], 0xf
call fcn.10202324
mov dword [eax], 0xd
call fcn.10207539
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f469d
leave
ret
test eax, eax
jne 0x10221d04
inc eax
jmp 0x10221cf1
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x10221cef
xor eax, eax
cmp ecx, 1
setne al
jmp 0x10221cf1
Function at 0x102253c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
mov eax, 1
push esi
push edi
mov ecx, 0x3020100
mov edx, dword [ebx + 0x10c]
mov dword [ebx + 0x114], 0x3020100
add ecx, 0x4040404
mov dword [ebx + eax*4 + 0x114], ecx
inc eax
cmp eax, edx
jbe 0x102253e1
xor esi, esi
xor edi, edi
cmp dword [esp + 0x14], esi
je 0x1022543d
push ebp
mov ebp, dword [esp + 0x14]
movzx eax, byte [esi + ebp]
mov edx, dword [esp + 0x1c]
or edi, eax
mov ebx, edx
mov cl, byte [eax + edx + 0x114]
mov byte [esi + ebp], cl
mov byte [edx + 0x113], cl
nop
mov cl, byte [eax + ebx + 0x113]
mov edx, eax
sub eax, 1
mov byte [edx + ebx + 0x114], cl
jns 0x10225420
inc esi
cmp esi, dword [esp + 0x18]
jb 0x10225402
pop ebp
mov eax, dword [esp + 0x18]
shr edi, 2
mov dword [eax + 0x10c], edi
pop edi
pop esi
pop ebx
ret
Function at 0x1022ca20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1022ca4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1022ca4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x411ed0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd000]
push edi
jmp 0x411eea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x411ef1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x411ee0
mov eax, 1
add ebx, ebx
jne 0x411f03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411ef8
jne 0x411f14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411ef8
xor ecx, ecx
sub eax, 3
jb 0x411f28
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x411f9a
mov ebp, eax
add ebx, ebx
jne 0x411f33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411f40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x411f64
inc ecx
add ebx, ebx
jne 0x411f50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x411f45
jne 0x411f61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411f45
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x411f84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x411f75
jmp 0x411ee6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x411f84
add edi, ecx
jmp 0x411ee6
pop esi
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x411fec
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14330]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x143ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x411fa1
mov ecx, edi
jns 0x411fd0
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x143f4]
or eax, eax
je 0x411fe6
mov dword [ebx], eax
add ebx, 4
jmp 0x411fbe
call dword [esi + 0x143f0]
mov ebp, dword [esi + 0x143f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x412020
sub esp, 0xffffff80
jmp 0x403956
Function at 0x401060
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 0x40d08c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x1c], ebx
jne 0x401094
push 0x10
push 0x40d084
push 0x40d054
push 0
call edi
push 0x40d044
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x4010bc
push 0x10
push 0x40d084
push 0x40d028
push eax
call edi
push esi
call dword [sym.imp.MSVCRT.dll_exit]
mov ecx, dword [ebp + 0x64]
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x18], 0
call esi
cmp eax, 0x6f
jne 0x4010fa
mov edx, dword [ebp + 0x64]
push edx
call sub.MFC42.DLL_operatordelete
mov eax, dword [esp + 0x14]
push eax
call sub.MFC42.DLL_operatornew
add esp, 8
lea ecx, [esp + 0x10]
mov dword [ebp + 0x64], eax
push ecx
push eax
call esi
cmp eax, 0x6f
je 0x4010d4
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x18], 0
test eax, eax
mov dword [esp + 0x14], eax
je 0x4011bb
jmp 0x401117
mov eax, dword [esp + 0x14]
lea ebx, [eax + 0x1ac]
test ebx, ebx
je 0x4011a9
lea edi, [ebx + 4]
mov esi, 0x40d020
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401153
test cl, cl
je 0x40114f
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401153
add eax, 2
add esi, 2
test cl, cl
jne 0x40112f
xor eax, eax
jmp 0x401158
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40119f
mov esi, dword [esp + 0x18]
push 0x28
inc esi
mov dword [esp + 0x1c], esi
call sub.MFC42.DLL_operatornew
lea ecx, [eax + 4]
add esp, 4
mov esi, ecx
xor edx, edx
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov edx, dword [edi]
mov dword [ecx], edx
mov edx, dword [edi + 4]
mov dword [ecx + 4], edx
mov edx, dword [edi + 8]
mov dword [ecx + 8], edx
mov edx, dword [edi + 0xc]
mov dword [ecx + 0xc], edx
mov ecx, dword [ebp + 0x68]
mov dword [eax], ecx
mov dword [ebp + 0x68], eax
mov ebx, dword [ebx]
test ebx, ebx
jne 0x401125
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x401113
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebx
mov dword [ebp + 0x60], edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x401240
Capabilities:
Create udp socket
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x1b0
push ebx
push ebp
push esi
lea eax, [esp + 0x2c]
push edi
push eax
mov esi, ecx
push 0x202
call dword [sym.imp.WSOCK32.dll_WSAStartup]
mov ebp, dword [esp + 0x1c8]
push 0x15
push 0
push 0
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov ecx, dword [esi + 4]
xor edx, edx
push 0x1f42
mov dword [ecx + ebp*4], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov word [esp + 0x18], 2
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], edx
call dword [sym.imp.WSOCK32.dll_htons]
mov ebx, dword [esp + 0x1c4]
mov edi, dword [sym.imp.WSOCK32.dll_inet_addr]
push ebx
mov word [esp + 0x1a], ax
call edi
mov ecx, dword [esi + 4]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push 0x10
mov edx, dword [ecx + ebp*4]
push eax
push edx
call dword [sym.imp.WSOCK32.dll_bind]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x24]
push 4
mov dword [esp + 0x28], 0
mov edx, dword [ecx + ebp*4]
push eax
push 0xb
push 0
push edx
call dword [sym.imp.WSOCK32.dll_setsockopt]
push 0x40d0a4
call edi
push ebx
mov dword [esp + 0x2c], eax
call edi
mov ecx, dword [esi + 4]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
push 8
mov edx, dword [ecx + ebp*4]
push eax
push 0xc
push 0
push edx
call dword [sym.imp.WSOCK32.dll_setsockopt]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
push 0x40d09c
mov edx, dword [eax + ebp*4]
xor eax, eax
mov dword [ecx + ebp*4], edx
lea edx, [esi + 0x1f]
mov ecx, 0x10
mov edi, edx
rep stosd dword es:[edi], eax
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
mov edi, 4
call dword [sym.imp.MSVCRT.dll_rand]
mov ebx, eax
and ebx, 0x80000001
jns 0x401359
dec ebx
or ebx, 0xfffffffe
inc ebx
neg ebx
sbb bl, bl
and bl, 0x20
add bl, 0x41
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x1a
idiv ecx
add bl, dl
mov byte [esi + edi + 0x1f], bl
inc edi
cmp edi, 0x20
jl 0x401344
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push 4
mov dword [esp + 0x14], 4
mov ecx, dword [eax + ebp*4]
push edx
push 0x1006
push 0xffff
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1b0
ret 8
Function at 0x401450
Capabilities:
Get socket status
Send data
Send data on socket
Set socket configuration

Disassembly:
mov eax, 0x282c
call fcn.00408e10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x9c3
xor eax, eax
lea edi, [esp + 0x12d]
mov byte [esp + 0x12c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esi + 0x1f]
lea ecx, [esp + 0x12c]
push eax
push 0x40d0b4
push 0x2710
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
xor edx, edx
add esp, 0x10
mov dword [esp + 0x10], edx
mov word [esp + 0x10], 2
mov dword [esp + 0x14], edx
push 0x1f42
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
call dword [sym.imp.WSOCK32.dll_htons]
push 0x40d0a4
mov word [esp + 0x16], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov ebp, dword [esi + 0x60]
xor edi, edi
xor ecx, ecx
cmp ebp, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 0x14
jle 0x40152a
xor eax, eax
test ecx, ecx
jbe 0x401509
mov edx, dword [esi + 4]
mov ebx, dword [edx + edi*4]
lea edx, [esp + 0x2c]
cmp dword [edx], ebx
je 0x401509
inc eax
add edx, 4
cmp eax, ecx
jb 0x4014fd
cmp eax, ecx
jne 0x401525
cmp ecx, 0x40
jae 0x401525
mov ecx, dword [esi + 4]
mov edx, dword [ecx + edi*4]
mov dword [esp + eax*4 + 0x2c], edx
mov ecx, dword [esp + 0x28]
inc ecx
mov dword [esp + 0x28], ecx
inc edi
cmp edi, ebp
jl 0x4014ed
lea eax, [esp + 0x20]
lea ecx, [esp + 0x28]
push eax
push 0
push ecx
push 0
push 0
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jne 0x401552
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x282c
ret
cmp eax, 0xffffffff
jne 0x401564
pop edi
pop esi
pop ebp
or eax, eax
pop ebx
add esp, 0x282c
ret
mov eax, dword [esi + 0x60]
xor ebp, ebp
test eax, eax
jle 0x4015bc
mov ebx, dword [sym.imp.WSOCK32.dll_sendto]
mov eax, dword [esi + 4]
lea edx, [esp + 0x28]
push edx
mov ecx, dword [eax + ebp*4]
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x4015b4
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push 0x10
push edx
dec ecx
push 0
push ecx
mov ecx, dword [esi + 4]
lea eax, [esp + 0x13c]
mov edx, dword [ecx + ebp*4]
push eax
push edx
call ebx
mov eax, dword [esi + 0x60]
inc ebp
cmp ebp, eax
jl 0x401573
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x282c
ret
Function at 0x40145c
Capabilities:
Get socket status
Send data
Send data on socket
Set socket configuration

Disassembly:
mov eax, 0x282c
call fcn.00408e10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x9c3
xor eax, eax
lea edi, [esp + 0x12d]
mov byte [esp + 0x12c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esi + 0x1f]
lea ecx, [esp + 0x12c]
push eax
push 0x40d0b4
push 0x2710
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
xor edx, edx
add esp, 0x10
mov dword [esp + 0x10], edx
mov word [esp + 0x10], 2
mov dword [esp + 0x14], edx
push 0x1f42
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
call dword [sym.imp.WSOCK32.dll_htons]
push 0x40d0a4
mov word [esp + 0x16], ax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov ebp, dword [esi + 0x60]
xor edi, edi
xor ecx, ecx
cmp ebp, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 0x14
jle 0x40152a
xor eax, eax
test ecx, ecx
jbe 0x401509
mov edx, dword [esi + 4]
mov ebx, dword [edx + edi*4]
lea edx, [esp + 0x2c]
cmp dword [edx], ebx
je 0x401509
inc eax
add edx, 4
cmp eax, ecx
jb 0x4014fd
cmp eax, ecx
jne 0x401525
cmp ecx, 0x40
jae 0x401525
mov ecx, dword [esi + 4]
mov edx, dword [ecx + edi*4]
mov dword [esp + eax*4 + 0x2c], edx
mov ecx, dword [esp + 0x28]
inc ecx
mov dword [esp + 0x28], ecx
inc edi
cmp edi, ebp
jl 0x4014ed
lea eax, [esp + 0x20]
lea ecx, [esp + 0x28]
push eax
push 0
push ecx
push 0
push 0
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jne 0x401552
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x282c
ret
cmp eax, 0xffffffff
jne 0x401564
pop edi
pop esi
pop ebp
or eax, eax
pop ebx
add esp, 0x282c
ret
mov eax, dword [esi + 0x60]
xor ebp, ebp
test eax, eax
jle 0x4015bc
mov ebx, dword [sym.imp.WSOCK32.dll_sendto]
mov eax, dword [esi + 4]
lea edx, [esp + 0x28]
push edx
mov ecx, dword [eax + ebp*4]
push ecx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x4015b4
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push 0x10
push edx
dec ecx
push 0
push ecx
mov ecx, dword [esi + 4]
lea eax, [esp + 0x13c]
mov edx, dword [ecx + ebp*4]
push eax
push edx
call ebx
mov eax, dword [esi + 0x60]
inc ebp
cmp ebp, eax
jl 0x401573
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x282c
ret
Function at 0x407700
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov eax, 0xfefeef11
shr edx, 2
je 0x40771e
mov ecx, dword [esp + 4]
push esi
mov esi, dword [ecx]
add ecx, 4
xor eax, esi
dec edx
jne 0x407713
pop esi
ret
Function at 0x4083e0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2c00
call fcn.00408e10
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push 0x400
push eax
call fcn.00408390
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x1c16]
mov word [esp + 0x1c14], bx
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c0c]
push 0x400
push ecx
lea edx, [esp + 0x14]
push 0xffffffffffffffff
push edx
push ebx
push ebx
stosw word es:[edi], ax
call esi
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x140e]
mov word [esp + 0x140c], bx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x2c10]
push 0x400
stosw word es:[edi], ax
lea eax, [esp + 0x1410]
push eax
push 0xffffffffffffffff
push ecx
push ebx
push ebx
call esi
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0xc0e]
mov word [esp + 0xc0c], bx
rep stosd dword es:[edi], eax
lea edx, [esp + 0xc0c]
push 0x400
stosw word es:[edi], ax
mov eax, dword [esp + 0x2c18]
push edx
push 0xffffffffffffffff
push eax
push ebx
push ebx
call esi
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x40e]
mov word [esp + 0x40c], bx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1c0c]
lea edx, [esp + 0x40c]
push ecx
push 0x40d96c
push edx
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0xc
mov word [esp + 0x240c], bx
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x240e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x40c]
lea ecx, [esp + 0x240c]
push eax
push 0x400
push ecx
lea edx, [esp + 0xc18]
push 0x40dae4
lea eax, [esp + 0x141c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [esp + 0x2c1c]
mov edx, dword [esp + 0x2c18]
push ebx
push 0x40da10
push ecx
push edx
lea eax, [esp + 0x241c]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
pop edi
pop esi
pop ebx
add esp, 0x2c00
ret