joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4088b7
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [0x543f94]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x20], esi
je 0x4088dd
mov eax, dword [eax + 4]
mov dword [esp + 0x10], eax
jmp 0x4088e1
mov dword [esp + 0x10], esi
cmp dword [esp + 0x10], esi
jne 0x4088f5
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, esi
mov dword [esp + 0x10], eax
je 0x408922
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [esp + 0x10], eax
je 0x408922
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x408922
push esi
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x20], 1
push ecx
mov eax, esp
push dword [esp + 0x14]
mov dword [edi + 0x378], esi
mov ebx, edi
mov dword [eax], esi
call fcn.004091e7
mov edx, eax
cmp edx, esi
mov dword [esp + 0x18], edx
jne 0x408955
push 1
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x408a42
call fcn.0042429b
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
lea ebx, [edi + 4]
push ebx
call fcn.0042414e
cmp dword [edi + 0x36c], esi
je 0x4089e5
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push 0x2001
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x43
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x14]
je 0x4089c5
push 1
push eax
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x14]
je 0x4089e5
push esi
push eax
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
call fcn.004ae26a
push 0x97
push esi
push esi
push esi
push esi
push esi
push dword [ebx]
mov dword [edi + 0x378], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x20], esi
je 0x408a2e
push 1
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [esp + 0x10], esi
je 0x408a2e
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx]
jne 0x408a2e
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [esp + 0x24]
call fcn.0042429b
push dword [ebx]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [edi + 0x28]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415e65
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
test byte [esi + 0x14], 2
je 0x415ebd
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
sub eax, ecx
je 0x415eae
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
sub edx, eax
je 0x415eae
mov edx, dword [esi + 0x10]
push 0x11
push 0
push 0
sub ecx, edx
push ecx
sub eax, edx
push eax
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x415ebd
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [esi + 0x14], 0xfd
leave
ret 4

Function at 0x415ec1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 1
push edi
mov edi, eax
jne 0x415ee1
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [edi + 0x14], 0xfd
jmp 0x415f3e
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
je 0x415f43
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
je 0x415f43
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x10000000
je 0x415f3e
or byte [edi + 0x14], 4
mov al, byte [edi + 0x14]
test al, 2
jne 0x415f35
push dword [ebp + 8]
or al, 2
mov byte [edi + 0x14], al
call fcn.00415f57
push 8
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x415f3e
cmp dword [edi + 0x18], esi
je 0x415f3e
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], esi
jmp 0x415f52
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
and byte [edi + 0x14], 0xfd
pop edi
leave
ret 8

Function at 0x41656b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x41658a
xor eax, eax
jmp 0x4165da
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 8], eax
je 0x416586
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x416586
push ebx
lea ebx, [edi + 1]
push ebx
call fcn.0042483c
test eax, eax
je 0x4165c6
push edi
push dword [ebp - 4]
push eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov eax, ebx
call fcn.004164bb
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret
Function at 0x4165de
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [esi]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
push edi
mov dword [ebp - 8], ebx
je 0x4166bb
mov eax, dword [0x5438cc]
mov ecx, 0x5438cc
call dword [eax + 0xc]
push dword [ebp + 0x10]
add eax, 0x10
push dword [ebp + 8]
mov dword [ebp - 4], eax
push dword [esi]
lea eax, [ebp - 4]
push str._s_d._s
push eax
call fcn.0042a016
add esp, 0x14
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 0x10], eax
je 0x4166b0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
je 0x4166a7
mov esi, dword [ebp + 0xc]
push ebx
lea eax, [ebp + 8]
push eax
push edi
lea eax, [edi + 0xa]
push eax
mov dword [ebp + 8], ebx
call fcn.0042483c
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x41669e
cmp dword [ebp + 8], edi
jne 0x41669e
mov eax, edi
call fcn.004164bb
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401239
xor eax, eax
inc eax
jmp 0x4166be
xor eax, eax
mov edx, esi
call fcn.0042481c
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.00401239
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4193f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.004191d9
push dword [esi]
lea eax, [ebp - 4]
push eax
push esi
call fcn.0041951a
mov edi, dword [ebp - 4]
xor esi, esi
cmp dword [edi - 0xc], esi
je 0x419474
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x419474
lea eax, [ebp - 0x14]
mov ebx, vtable.Gdiplus::PrivateFontCollection.0
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
call sub.gdiplus.dll_GdipNewPrivateFontCollection
push edi
push dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
call sub.gdiplus.dll_GdipPrivateAddFontFile
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call sub.gdiplus.dll_GdipGetFontCollectionFamilyCount
mov esi, dword [ebp - 8]
test esi, esi
mov dword [ebp - 0x10], eax
jg 0x419483
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x18], ebx
call sub.gdiplus.dll_GdipDeletePrivateFontCollection
mov dword [ebp - 0x18], vtable.Gdiplus::FontCollection.0
lea eax, [edi - 0x10]
call fcn.00401239
pop edi
pop esi
pop ebx
leave
ret 4
xor ecx, ecx
push 8
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call sub.gdiplus.dll_GdipAlloc
test eax, eax
je 0x4194c6
mov dword [eax], esi
add eax, 4
lea edx, [esi - 1]
test edx, edx
mov ecx, eax
jl 0x4194c8
and dword [ecx], 0
and dword [ecx + 4], 0
add ecx, 8
dec edx
jns 0x4194b7
jmp 0x4194c8
xor eax, eax
test eax, eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
jne 0x4194ed
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x18], ebx
call sub.gdiplus.dll_GdipDeletePrivateFontCollection
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], vtable.Gdiplus::FontCollection.0
add eax, 0xfffffff0
jmp 0x419477
push eax
push esi
lea edi, [ebp - 0xc]
lea eax, [ebp - 0x18]
call fcn.004196fe
test eax, eax
jne 0x419510
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jle 0x419510
mov eax, dword [ebp + 8]
mov dword [eax + 8], esi
mov dword [eax + 0xc], ecx
jmp 0x4194d2
mov esi, dword [ebp + 8]
call fcn.004191d9
jmp 0x4194d2

Function at 0x41965b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and word [ebp - 0x210], 0
push 0x20e
lea eax, [ebp - 0x20e]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp + 8]
call fcn.004014ce
mov eax, dword [ebp + 8]
leave
ret 4
Function at 0x41d896
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor edi, edi
inc edi
cmp eax, 0xf
mov esi, ecx
jne 0x41d8c5
mov ecx, dword [ebp + 0x18]
lea eax, [esi + 0xac]
mov dword [eax], edi
and dword [ecx], 0
cmp dword [eax], 0
je 0x41d8fc
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
cmp eax, 2
jne 0x41d91d
push dword [esi + 0x10]
mov dword [esi + 0xac], edi
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
test ebx, ebx
je 0x41d8f6
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41d8f6
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], 0
cmp dword [esi + 0xac], 0
jne 0x41d8bc
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00417c3f
jmp 0x41d8be
cmp eax, 0x47
jne 0x41d942
push dword [ebp + 0x14]
lea ebx, [esi + 0xac]
mov eax, esi
mov dword [ebx], edi
call fcn.0041d968
mov eax, dword [ebp + 0x18]
and dword [eax], 0
cmp dword [ebx], 0
jmp 0x41d8ba
cmp eax, 0x18
jne 0x41d8fc
push dword [ebp + 0x10]
lea ebx, [esi + 0xac]
mov dword [ebx], edi
call fcn.0041da32
mov eax, dword [ebp + 0x18]
and dword [eax], 0
cmp dword [ebx], 0
jne 0x41d8bc
jmp 0x41d8fc

Function at 0x423e00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
xor ebx, ebx
lea edi, [esi + 0x2c0]
cmp dword [edi], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x423e2e
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [edi], ebx
mov eax, dword [esi + 0x2b4]
cmp eax, ebx
je 0x423f0c
push eax
call fcn.00416963
mov edi, eax
cmp edi, ebx
pop ecx
je 0x423ec1
mov eax, dword [edi]
push 2
push ebx
mov ecx, edi
call dword [eax + 0x28]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x34]
test eax, eax
je 0x423e66
push 1
push edi
call fcn.00416cb5
mov eax, dword [esi + 0x2b4]
cmp eax, dword [esi + 0x2b0]
jne 0x423ec1
movzx eax, word [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, edi
push 0x202
call fcn.00416c8a
mov eax, dword [edi + 0x40]
cmp eax, ebx
je 0x423eb0
cmp word [eax], bx
je 0x423eb0
push 1
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x423ec1
mov eax, dword [edi + 0x10]
cmp eax, ebx
je 0x423ec1
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
cmp dword [ebp - 4], ebx
mov dword [esi + 0x2b4], ebx
je 0x423f0c
mov eax, dword [esi + 4]
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
push dword [esi + 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0x1c]
push ecx
push dword [ebp - 0x18]
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x42a38e
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
xor eax, eax
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
call fcn.004014ce
xor ecx, ecx
inc ecx
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.0042a06a
lea edi, [ebp - 4]
call fcn.0042a0a0
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.00401239
push 0x5108d8
mov eax, edi
push eax
call fcn.00407371
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
mov eax, dword [ebp - 0xc]
je 0x42a411
mov ecx, dword [ebp - 0x10]
shrd ecx, eax, 0x14
shr eax, 0x14
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0x10]
mov ebx, eax
lea eax, [esi - 0x10]
call fcn.00401239
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
leave
ret
Function at 0x42a539
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
xor eax, eax
push esi
push 0x206
push eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x218]
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x42a6cf
push ebx
push edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x218]
push eax
call edi
mov ebx, dword [sym.imp.MSVCR80.dll_wcscat_s]
push str.kpopclt.dll
lea eax, [ebp - 0x218]
push esi
push eax
call ebx
lea eax, [ebp - 0x218]
push 0
push eax
call dword [sym.imp.MSVCR80.dll__waccess]
add esp, 0x14
test eax, eax
je 0x42a6b6
push esi
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x42a6cd
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
push eax
call edi
push str.kpopclt.dll
lea eax, [ebp - 0x218]
push esi
push eax
call ebx
lea eax, [ebp - 0x218]
push 0
push eax
call dword [sym.imp.MSVCR80.dll__waccess]
add esp, 0x14
test eax, eax
je 0x42a6b6
lea eax, [ebp - 4]
push eax
push str.SOFTWAREkingsoftKISCommon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x42a6cd
and dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.ProgramPath
push dword [ebp - 4]
mov dword [ebp - 0x10], 0x206
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42a6cd
cmp dword [ebp - 0xc], 1
jne 0x42a6cd
mov eax, dword [ebp - 0x10]
shr eax, 1
and word [ebp + eax*2 - 0x218], 0
lea eax, [ebp - 0x218]
push eax
call edi
push str.kpopclt.dll
lea eax, [ebp - 0x218]
push esi
push eax
call ebx
lea eax, [ebp - 0x218]
push 0
push eax
call dword [sym.imp.MSVCR80.dll__waccess]
add esp, 0x14
test eax, eax
jne 0x42a6cd
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop ebx
cmp dword [ebp - 4], 0
pop esi
je 0x42a6df
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret 4
Function at 0x42b8a2
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov edi, eax
add edi, 4
mov eax, dword [edi]
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x10], edi
je 0x42b8c4
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov dword [edi], esi
push 0x20
lea eax, [ebp - 0x30]
push esi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], esi
call dword [section..data]
cmp dword [ebp + 8], esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], esi
je 0x42b939
push dword [ebp + 8]
call ebx
mov edi, eax
inc edi
push esi
mov eax, edi
cdq
push 2
push edx
push eax
mov dword [ebp - 4], edi
call fcn.004d5f30
cmp edx, esi
jg 0x42b930
jl 0x42b91f
cmp eax, 0x7fffffff
ja 0x42b930
push edx
push eax
lea ecx, [ebp - 4]
call fcn.0042e875
mov edi, dword [ebp - 4]
pop ecx
pop ecx
jmp 0x42b935
mov eax, 0x80070057
cmp eax, esi
jge 0x42b93e
mov dword [ebp + 8], esi
jmp 0x42b978
cmp edi, 0x400
jg 0x42b95c
push edi
call fcn.0042e7cf
test al, al
pop ecx
je 0x42b95c
mov eax, edi
call fcn.004d6090
mov eax, esp
jmp 0x42b965
push edi
lea esi, [ebp - 8]
call fcn.0042e796
push dword [ebp - 0xc]
mov esi, eax
push edi
push dword [ebp + 8]
call fcn.0042e842
mov dword [ebp + 8], eax
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x42b9bc
push dword [ebp + 0xc]
call ebx
mov edi, eax
inc edi
push esi
mov eax, edi
cdq
push 2
push edx
push eax
mov dword [ebp - 4], edi
call fcn.004d5f30
cmp edx, esi
jg 0x42b9b3
jl 0x42b9a2
cmp eax, 0x7fffffff
ja 0x42b9b3
push edx
push eax
lea ecx, [ebp - 4]
call fcn.0042e875
mov edi, dword [ebp - 4]
pop ecx
pop ecx
jmp 0x42b9b8
mov eax, 0x80070057
cmp eax, esi
jge 0x42b9c0
xor eax, eax
jmp 0x42b9f7
cmp edi, 0x400
jg 0x42b9de
push edi
call fcn.0042e7cf
test al, al
pop ecx
je 0x42b9de
mov eax, edi
call fcn.004d6090
mov eax, esp
jmp 0x42b9e7
push edi
lea esi, [ebp - 8]
call fcn.0042e796
push dword [ebp - 0xc]
mov esi, eax
push edi
push dword [ebp + 0xc]
call fcn.0042e842
xor esi, esi
cmp dword [ebp + 8], esi
je 0x42ba1f
cmp eax, esi
je 0x42ba1f
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
lea esi, [ebp - 8]
mov edi, eax
call fcn.0042e894
mov eax, edi
jmp 0x42ba32
push 8
call dword [sym.imp.WS2_32.dll_WSASetLastError]
lea esi, [ebp - 8]
call fcn.0042e894
or eax, 0xffffffff
lea esp, [ebp - 0x40]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x42bb61
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
xor ebx, ebx
cmp byte [esi + 0x44], bl
je 0x42bb73
mov al, 1
jmp 0x42bbe5
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
mov byte [ebp - 1], 1
jne 0x42bb83
xor al, al
jmp 0x42bbe5
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x42bbdf
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x42bbd9
push dword [esi + 0x4c]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42bbdc
push 0x2c
lea eax, [ebp - 0x30]
push ebx
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
push ebx
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x42bbdf
mov dword [esi + 0x48], eax
mov byte [ebp - 1], bl
mov al, byte [ebp - 1]
mov byte [esi + 0x44], al
pop ebx
leave
ret 8

Function at 0x42bbea
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
push dword [esi + 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xc]
call edi
test eax, eax
je 0x42bc11
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x42bcb8
push ebx
xor ebx, ebx
push ebx
push dword [esi + 8]
call edi
cmp eax, 0x102
jne 0x42bc2f
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x42bcb7
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
lea eax, [esi + 0x28]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 8]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x42bc77
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x42bca9
push dword [esi + 0x4c]
push dword [esi + 8]
call edi
test eax, eax
jne 0x42bcac
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x40]
mov dword [ebp + 0xc], ebx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x42bca3
mov bl, 1
jmp 0x42bcac
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
pop edi
leave
ret 0xc
Function at 0x42bcbd
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push dword [esi + 0x4c]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42bce1
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x42bda9
push ebx
xor ebx, ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
jne 0x42bd03
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x42bda8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [edi]
push 0x14
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push ebx
push eax
mov dword [edi], ebx
mov dword [ebp - 4], ebx
call sub.MSVCR80.dll_memset
lea eax, [esi + 0x10]
add esp, 0xc
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
push edi
push 1
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x42bd66
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x42bd9a
push dword [esi + 0x4c]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x42bd9d
lea eax, [ebp - 4]
push eax
push ebx
push edi
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x40]
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x42bd94
mov bl, 1
jmp 0x42bd9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
leave
ret 4