joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424210
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov byte [0x4b2078], 8
mov byte [0x4b2079], 0
mov word [0x4b207a], 0
mov ax, word [0x4afac4]
mov word [0x4b207c], ax
mov ecx, dword [0x4afac4]
add ecx, 1
mov dword [0x4afac4], ecx
mov dx, word [0x4afac0]
mov word [0x4b207e], dx
mov eax, dword [0x4afac0]
add eax, 1
mov dword [0x4afac0], eax
mov dword [ebp - 4], 0
jmp 0x424278
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x20
jge 0x42428f
mov edx, dword [ebp - 4]
add edx, 0x20
mov eax, dword [ebp - 4]
mov byte [eax + 0x4b2085], dl
jmp 0x42426f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4b2081], eax
push 0x2d
push 0x4b2078
mov ecx, dword [ebp - 8]
call fcn.00424450
mov word [0x4b207a], ax
push 0x10
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0x2d
push 0x4b2078
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4242de
push str.sendto__
mov ecx, dword [ebp - 8]
call fcn.004243b0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x4242f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov dword [ebp - 0x154], ecx
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0x141
lea edx, [ebp - 0x150]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x42433f
push str.recvfrom__
mov ecx, dword [ebp - 0x154]
call fcn.004243b0
mov ecx, dword [ebp + 0x10]
mov dl, byte [ebp - 0x148]
mov byte [ecx], dl
mov eax, dword [ebp - 0x133]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x424360
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 8], 2
mov dword [ebp - 4], 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0
lea edx, [ebp - 0x110]
push edx
push 1
call dword [sym.imp.WS2_32.dll_select]
mov esp, ebp
pop ebp
ret 4

Function at 0x4243b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push edi
mov dword [ebp - 0x40c], ecx
mov al, byte [0x495baf]
mov byte [ebp - 0x408], al
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x407]
rep stosd dword es:[edi], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s___WSAError:__ld_r_n
lea edx, [ebp - 0x408]
push edx
call fcn.0046b198
add esp, 0x10
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [ebp - 0x40c]
add ecx, 8
push ecx
call fcn.0046b270
add esp, 8
push 0
lea edx, [ebp - 0x408]
push edx
call fcn.0046b430
add esp, 4
push eax
lea eax, [ebp - 0x408]
push eax
mov ecx, dword [ebp - 0x40c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_send]
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x42c320
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc14
call fcn.0040d520
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
push eax
push 4
lea ecx, [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc48]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 8], 4
je 0x42c383
mov ecx, dword [ebp - 0x10]
add ecx, 0xc14
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc14]
call dword [eax + 0x14]
xor eax, eax
jmp 0x42c44b
cmp dword [ebp + 0x10], 0
je 0x42c3cf
mov dword [ebp - 8], 0
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0xc48]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
je 0x42c3cf
mov ecx, dword [ebp - 0x10]
add ecx, 0xc14
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc14]
call dword [eax + 0x14]
xor eax, eax
jmp 0x42c44b
cmp dword [ebp + 0x14], 0
je 0x42c431
mov dword [ebp - 0xc], 0
push 0
lea ecx, [ebp - 0xc]
push ecx
push 4
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc48]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0xc], 4
je 0x42c417
mov ecx, dword [ebp - 0x10]
add ecx, 0xc14
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc14]
call dword [eax + 0x14]
xor eax, eax
jmp 0x42c44b
mov ecx, dword [ebp - 0x10]
add ecx, 0xc14
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc14]
call dword [eax + 0x14]
mov eax, dword [ebp - 4]
jmp 0x42c44b
mov ecx, dword [ebp - 0x10]
add ecx, 0xc14
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc14]
call dword [eax + 0x14]
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x433b60
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2140
call fcn.0046b3f0
push edi
mov dword [ebp - 0x2140], ecx
mov al, byte [0x4966e8]
mov byte [ebp - 0x1128], al
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x1127]
rep stosd dword es:[edi], eax
push 0x4be5e4
push 0x4966ec
lea ecx, [ebp - 0x1128]
push ecx
call fcn.0046b198
add esp, 0xc
push 0
lea edx, [ebp - 0x1128]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [0x4966ef]
mov byte [ebp - 0x1020], al
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x101f]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [ebp - 0xa]
push edx
movzx eax, word [ebp - 0xe]
push eax
movzx ecx, word [ebp - 0x10]
push ecx
push 0x4966f0
lea edx, [ebp - 0x1020]
push edx
call fcn.0046b198
add esp, 0x14
lea eax, [ebp - 0x1020]
push eax
push 0x4be5e4
push 0x496700
lea ecx, [ebp - 0x1128]
push ecx
call fcn.0046b198
add esp, 0x10
mov dword [ebp - 0x14], 0
push 0x496710
lea edx, [ebp - 0x1128]
push edx
call fcn.0046d1f4
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x433d99
mov al, byte [0x496713]
mov byte [ebp - 0x2130], al
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x212f]
rep stosd dword es:[edi], eax
push str.username_treceived_byte__tsent_byte__r_n
lea ecx, [ebp - 0x2130]
push ecx
call fcn.0046b198
add esp, 8
mov edx, dword [ebp - 0x14]
push edx
push 1
lea eax, [ebp - 0x2130]
push eax
call fcn.0046b430
add esp, 4
push eax
lea ecx, [ebp - 0x2130]
push ecx
call fcn.0046d14c
add esp, 0x10
mov dword [ebp - 0x2134], 0
jmp 0x433cb3
mov edx, dword [ebp - 0x2134]
add edx, 1
mov dword [ebp - 0x2134], edx
mov ecx, dword [ebp - 0x2140]
add ecx, 0x410
call fcn.00404a70
cmp dword [ebp - 0x2134], eax
jge 0x433d8d
push 0x10
mov eax, dword [ebp - 0x2134]
push eax
mov ecx, dword [ebp - 0x2140]
add ecx, 0x410
call fcn.00404ab0
push eax
mov ecx, dword [ebp - 0x2140]
call fcn.00434270
mov dword [ebp - 0x213c], eax
push 0x11
mov ecx, dword [ebp - 0x2134]
push ecx
mov ecx, dword [ebp - 0x2140]
add ecx, 0x410
call fcn.00404ab0
push eax
mov ecx, dword [ebp - 0x2140]
call fcn.00434270
mov dword [ebp - 0x2138], eax
mov edx, dword [ebp - 0x2138]
push edx
mov eax, dword [ebp - 0x213c]
push eax
mov ecx, dword [ebp - 0x2134]
push ecx
mov ecx, dword [ebp - 0x2140]
add ecx, 0x410
call fcn.00404ab0
push eax
push str._s_t_ld_t_ld_r_n
lea edx, [ebp - 0x2130]
push edx
call fcn.0046b198
add esp, 0x14
mov eax, dword [ebp - 0x14]
push eax
push 1
lea ecx, [ebp - 0x2130]
push ecx
call fcn.0046b430
add esp, 4
push eax
lea edx, [ebp - 0x2130]
push edx
call fcn.0046d14c
add esp, 0x10
jmp 0x433ca4
mov eax, dword [ebp - 0x14]
push eax
call fcn.0046cff4
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4385f0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov dword [ebp - 0x224], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x21c], 0
jmp 0x438637
mov ecx, dword [ebp - 0x21c]
add ecx, 1
mov dword [ebp - 0x21c], ecx
mov edx, dword [ebp - 0x21c]
cmp edx, dword [ebp - 0x108]
jae 0x43865b
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp + eax*4 - 0x104]
cmp ecx, dword [ebp + 8]
jne 0x438659
jmp 0x43865b
jmp 0x438628
mov edx, dword [ebp - 0x21c]
cmp edx, dword [ebp - 0x108]
jne 0x438691
cmp dword [ebp - 0x108], 0x40
jae 0x438691
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x104], ecx
mov edx, dword [ebp - 0x108]
add edx, 1
mov dword [ebp - 0x108], edx
xor eax, eax
jne 0x43861c
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x220], 0
jmp 0x4386ba
mov ecx, dword [ebp - 0x220]
add ecx, 1
mov dword [ebp - 0x220], ecx
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp - 0x218]
jae 0x4386de
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp + eax*4 - 0x214]
cmp ecx, dword [ebp + 8]
jne 0x4386dc
jmp 0x4386de
jmp 0x4386ab
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp - 0x218]
jne 0x438714
cmp dword [ebp - 0x218], 0x40
jae 0x438714
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x214], ecx
mov edx, dword [ebp - 0x218]
add edx, 1
mov dword [ebp - 0x218], edx
xor eax, eax
jne 0x43869f
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x218]
push edx
push 0
lea eax, [ebp - 0x108]
push eax
push 0x40
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x43873f
xor eax, eax
jmp 0x438776
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x43875a
mov eax, 1
jmp 0x438776
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x438773
or eax, 0xffffffff
jmp 0x438776
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8
Function at 0x438bc0
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
cmp dword [ebp + 0x14], 8
jne 0x438c76
mov dword [ebp - 8], 0
jmp 0x438be5
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
cmp edx, dword [ecx]
jge 0x438c6e
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x10], 0
je 0x438c6e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x10], 0
je 0x438c69
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00438780
test eax, eax
je 0x438c3c
push 0
push 1
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x438c3a
xor eax, eax
jmp 0x438cf0
jmp 0x438c69
cmp dword [0x4afae8], 0
jg 0x438c47
jmp 0x438c01
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xc]
mov edx, dword [0x4afae8]
imul edx, edx, 0x3e8
cmp eax, edx
jle 0x438c67
xor eax, eax
jmp 0x438cf0
jmp 0x438c01
jmp 0x438bdc
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
jmp 0x438cf0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x10], 0
je 0x438cee
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00438780
test eax, eax
je 0x438cc4
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
xor ecx, ecx
cmp dword [eax], 0
setg cl
mov eax, ecx
jmp 0x438cf0
cmp dword [0x4afae8], 0
jg 0x438ccf
jmp 0x438c7f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
mov edx, dword [0x4afae8]
imul edx, edx, 0x3e8
cmp eax, edx
jle 0x438cec
xor eax, eax
jmp 0x438cf0
jmp 0x438c7f
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43a720
Capabilities:
Create tcp socket
Create thread
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ea35
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
cmp dword [eax + 0x10], 0
je 0x43a751
mov eax, 1
jmp 0x43a86c
cmp dword [ebp + 8], 0
jne 0x43a7c5
mov ecx, dword [ebp - 0x48]
mov dword [ecx + 0x10], 1
lea ecx, [ebp - 0x3c]
call fcn.0042c8a0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x24], edx
lea eax, [ebp - 0x3c]
push eax
mov ecx, 0x4d7678
call fcn.00459130
cmp eax, 0xffffffff
jne 0x43a7a7
mov dword [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.0042c8f0
mov eax, dword [ebp - 0x40]
jmp 0x43a86c
mov dword [ebp - 0x44], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.0042c8f0
mov eax, dword [ebp - 0x44]
jmp 0x43a86c
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 0x48]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x48]
cmp dword [edx + 4], 0xffffffff
jne 0x43a7e7
xor eax, eax
jmp 0x43a86c
mov word [ebp - 0x20], 2
mov dword [ebp - 0x1c], 0
mov ax, word [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
push 0x10
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x48]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x43a835
mov ecx, dword [ebp - 0x48]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp - 0x48]
mov dword [eax + 4], 0xffffffff
xor eax, eax
jmp 0x43a86c
mov ecx, dword [ebp - 0x48]
mov dword [ecx + 0x10], 1
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov dword [edx + 8], eax
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 0x48]
push edx
push 0x43b9b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x48]
mov dword [ecx + 0xc], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x43a880
Capabilities:
Create tcp socket
Create thread
Create udp socket
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 8]
jne 0x43a89e
mov eax, 1
jmp 0x43a9b9
mov edx, dword [ebp - 0x1c]
cmp dword [edx + 4], 0xffffffff
je 0x43a8be
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xc], 0
je 0x43a911
push 0x4bf
push 0x7d0
push 1
mov ecx, dword [ebp - 0x1c]
add ecx, 0xc
push ecx
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43a8fa
push 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xc], 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x43a934
xor eax, eax
jmp 0x43a9b9
mov word [ebp - 0x14], 2
mov dword [ebp - 0x10], 0
mov dx, word [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x43a982
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 4], 0xffffffff
xor eax, eax
jmp 0x43a9b9
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x10], 1
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
push 0x43b9b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0xc], eax
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x43a9c0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x43a9d9
mov eax, 1
jmp 0x43aa52
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 8]
cmp dword [edx + 4], 0xffffffff
je 0x43aa03
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp - 8]
mov dword [edx + 4], 0xffffffff
push 0x7d0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43aa2d
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0xc], 0
je 0x43aa4d
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], 0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x43b870
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
shr edx, 0x16
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
and eax, 0xff
cmp eax, 1
jae 0x43b8a8
xor eax, eax
jmp 0x43b99e
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
cmp ecx, 0x80
jae 0x43b90f
push 0x1000
mov edx, dword [ebp - 0xc]
and edx, 0xfffff000
push edx
push 0
push 4
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
shr edx, 0xc
and edx, 0x3ff
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [ebp - 0xc]
and ecx, 0xfffff000
mov dword [ebp - 0xc], ecx
jmp 0x43b929
mov edx, dword [ebp - 0xc]
and edx, 0xfffff000
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
and ecx, 0x3ff000
add edx, ecx
mov dword [ebp - 0xc], edx
push 0x1000
mov edx, dword [ebp - 0xc]
push edx
push 0
push 4
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43b997
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
and edx, 0xfff
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
jmp 0x43b973
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x70
jge 0x43b98b
mov edx, dword [ebp + 0x14]
add edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [edx], cl
jmp 0x43b96a
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x43b99b
xor eax, eax
jmp 0x43b99e
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x444000
Capabilities:
Create tcp socket
Create thread
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ee8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
cmp dword [eax + 0x10], 0
je 0x444038
mov eax, 1
jmp 0x4441de
cmp dword [0x4d7548], 0
jne 0x44404b
mov eax, 1
jmp 0x4441de
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
jmp 0x44406b
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [0x4d7548]
jge 0x444159
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x118
cmp dword [eax + 0x4d3e9c], 0
jne 0x4440af
mov esi, dword [ebp - 0x18]
imul esi, esi, 0x118
push 1
push 0
push 0
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [esi + 0x4d3e98], eax
jmp 0x4440d0
mov esi, dword [ebp - 0x18]
imul esi, esi, 0x118
push 1
push 0
push 0
push 0
push 2
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [esi + 0x4d3e98], eax
mov word [ebp - 0x28], 2
mov ecx, dword [ebp - 0x18]
imul ecx, ecx, 0x118
mov dx, word [ecx + 0x4d3fac]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x26], ax
mov dword [ebp - 0x24], 0
push 0x10
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x18]
imul ecx, ecx, 0x118
mov edx, dword [ecx + 0x4d3e98]
push edx
call dword [sym.imp.WS2_32.dll_bind]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x444154
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x118
mov ecx, dword [eax + 0x4d3e98]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x118
mov eax, dword [edx + 0x4d3fac]
mov dword [ebp - 0x34], eax
push 0x4a83e4
lea ecx, [ebp - 0x34]
push ecx
call fcn.0046bdd1
jmp 0x444062
jmp 0x44419b
mov dword [ebp - 4], 0xffffffff
jmp 0x4441a9
mov ecx, dword [ebp - 0x3c]
mov dword [ecx + 0x10], 1
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 0x3c]
push eax
push 0x43b9b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx + 0xc], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4