joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc0e459
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
ret
mov esp, ebp
movzx ebp, si
mov bp, 0xd414
not bp
pop ebp
ret
mov dword [ebp - 8], eax
sub ax, di
ror eax, cl
mov eax, dword [ebp - 8]
cmp dx, sp
clc
cmp ebx, 0xf6b9e91b
cmp eax, dword [ecx + edx + 0x14]
jmp 0x80fd01
je 0x8f7bfa
cmp eax, ecx
jmp 0xb9f24c
jmp 0x791e79
jle 0xbfad68
lea ebx, [esi + 1]
test ebx, 0xa35e3b9
cmp ebx, edi
mov edx, dword [ebp + 8]
jmp 0xba765e
test esi, esi
jmp 0x8a459b
pop ebp
jmp 0x76fc76
jae 0x8f7bfa
mov esi, dword [ecx + edx + 0x1c]
test esi, esp
clc
cmp edi, ebx
lea eax, [esi + eax*4]
test dl, ah
test edi, 0x722b3d81
mov eax, dword [eax + edx]
test eax, eax
jmp 0x79c752
je 0x8f7bfa
cmp cl, 0x2e
je 0xc03d9f
mov cl, byte [esi + 1]
jmp 0x8f7bf0
je 0x867284
mov esi, dword [ebp + 0xc]
jmp 0x8005ce
je 0x8bef37
xor eax, eax
pop esi
mov esp, ebp
jmp 0x80bb78
mov eax, dword [ebp - 0xc]
clc
mov ecx, dword [ebp + 0x10]
bt esi, 0x2e
lea esi, [edi + ebx]
sar esi, 1
mov eax, dword [eax + esi*4]
clc
cmp sp, 0x6da1
push ecx
mov ecx, dword [ebp + 0xc]
add eax, edx
call fcn.00832e1d
add esp, 4
clc
cmp si, dx
cmp ax, 0x310
test eax, eax
jge 0x7e0183
lea edi, [esi - 1]
jmp 0x7e0192
jae 0x884ba6
mov cl, byte [eax + edx]
bsr esi, esp
lea eax, [eax + edx]
test si, si
movzx esi, dx
cmc
mov esi, eax
cmp esp, eax
stc
test ax, dx
test cl, cl
jmp 0x8156f0
pop edi
pop ebx
add eax, edx
pop esi
jmp 0x77db08
je 0x867284
mov eax, 0x5a4d
test esp, 0xa73a783e
cmp word [edx], ax
jmp 0x86727e
sub ecx, eax
stc
cmp ecx, 0x104
jae 0x8f7bfa
xor edi, edi
jmp 0x8c45ca
mov eax, dword [edx + 0x3c]
add eax, edx
cmp di, 0x3e83
stc
cmp di, ax
cmp dword [eax], 0x4550
jmp 0xbafd35
test ecx, ecx
jmp 0xc3c6b6
inc esi
clc
test cl, cl
jne 0x8156f6
jb 0x884ba6
mov esi, dword [ebp - 0x10]
clc
lea esi, [esi + ecx]
cmp di, di
cmp eax, esi
jmp 0x8780da
dec edi
test edi, edx
lea eax, [eax + edx]
xor ebx, ebx
test ecx, ebp
test ch, 0
mov dword [ebp - 0xc], eax
clc
cmp bp, 0x9331
stc
test edi, edi
jmp 0xc207f3
jle 0x86b7eb
mov ecx, dword [ebp - 4]
jmp 0x7c1bb4
je 0x867284
mov eax, dword [eax + 0x7c]
push ebx
cmp bp, 0x87af
push edi
test edi, 0xfa1c2910
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
ja 0xc2c9dc
mov eax, esi
stc
cmp bp, ax
sub eax, dword [ecx + edx + 0x10]
jmp 0xc2e670
jne 0x867284
mov ecx, dword [eax + 0x78]
test edi, eax
stc
mov dword [ebp - 4], ecx
test ecx, ecx
jmp 0xbad5c4
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmc
mov ecx, dword [edx + eax + 0x24]
add dh, 0x1c
sbb edx, esi
lea edx, [ecx + esi*2]
rol cl, cl
movzx ecx, si
movzx eax, word [edx + eax]
shld edx, edi, 0x25
mov ecx, dword [ebp - 4]
rcr dl, cl
or dh, 0x2a
btc dx, 0xd
mov edx, dword [ebp + 8]
test ebp, eax
cmp edx, ebp
jmp 0x791e71
mov ecx, esi
jmp 0x8a9d3f
push ebp
adc dx, di
sub edx, ebx
mov ebp, esp
rcl dl, cl
setge dl
mov edx, dword [ebp + 8]
stc
test cl, 0x8e
clc
sub esp, 0x114
push esi
cmc
test sp, 0xb42f
stc
test edx, edx
jmp 0x82b40c
jl 0x791e79
jmp 0x86b7ef
mov edi, dword [ecx + edx + 0x18]
test edi, edi
je 0x791e79
mov eax, dword [ecx + edx + 0x20]
jmp 0xb9f555
jmp 0x791e71
Function at 0x10001000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 0x10]
xor edx, edx
mov ecx, 0x5ab
div ecx
push esi
mov esi, dword [ebp + 0xc]
add dl, 0x3d
test esi, esi
je 0x1000102c
mov ecx, dword [ebp + 8]
mov al, byte [ecx]
xor al, dl
add al, dl
mov byte [ecx], al
inc ecx
sub esi, 1
jne 0x1000101e
pop esi
pop ebp
ret

Function at 0x10001563
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x1000157b
xor eax, eax
jmp 0x1000168a
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
je 0x10001590
xor eax, eax
jmp 0x10001689
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push dword [ebx + 0x50]
push dword [ebx + 0x34]
call edi
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
jne 0x100015ca
push 4
push 0x2000
push dword [ebx + 0x50]
push eax
call edi
mov esi, eax
mov dword [ebp - 4], eax
test esi, esi
je 0x10001685
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
xor eax, eax
push 4
push 0x1000
mov dword [edi + 4], esi
mov dword [edi + 0xc], eax
mov dword [edi + 8], eax
mov dword [edi + 0x10], eax
push dword [ebx + 0x50]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x1000
push dword [ebx + 0x54]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx + 0x54]
mov esi, eax
mov eax, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
push ecx
push eax
push esi
call fcn.100025c0
mov edx, dword [ebp + 8]
push edi
push ebx
push edx
mov eax, dword [edx + 0x3c]
add eax, esi
mov esi, dword [ebp - 4]
mov dword [edi], eax
mov dword [eax + 0x34], esi
call fcn.1000125b
mov eax, esi
add esp, 0x18
sub eax, dword [ebx + 0x34]
je 0x1000164b
push eax
push edi
call fcn.100013ba
pop ecx
pop ecx
push edi
call fcn.10001147
pop ecx
test eax, eax
je 0x1000167e
push edi
call fcn.100012fd
mov eax, dword [edi]
pop ecx
mov eax, dword [eax + 0x28]
test eax, eax
je 0x1000167a
add eax, esi
je 0x1000167e
push 0
xor ebx, ebx
inc ebx
push ebx
push esi
call eax
test eax, eax
je 0x1000167e
mov dword [edi + 0x10], ebx
mov eax, edi
jmp 0x10001687
push edi
call fcn.1000144d
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006905
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100069a2
push ebx
push esi
call fcn.100068ce
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10006817
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000694f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100069a1
push edi
push eax
call fcn.10004744
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000696f
call fcn.1000470a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100069a0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10006817
add esp, 0x20
test eax, eax
jne 0x1000698e
push edi
call fcn.1000470a
jmp 0x10006996
push ebx
call fcn.1000470a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10006c0d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x1001035c
push str.FlsAlloc
push 0x1e
call fcn.10006b2b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10006c41
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f148]
call esi
jmp 0x10006c47
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10006c8b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x10010380
push str.FlsGetValue
push 0x20
call fcn.10006b2b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10006cc2
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000f148]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5c174d53
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..text
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x57d77e41
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x4a4408]
shl eax, 2
mov dword [0x4a440c], eax
push edi
push ecx
xor eax, eax
mov edi, 0x4fd32c
mov ecx, 0x57aa08
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00492d70
pop edx
call fcn.00492cd4
call fcn.00492db0
push 0
call fcn.004941ec
pop ecx
push 0x4a43d0
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4a4410], eax
push 0
jmp fcn.0049e600
Function at 0x41b734
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x4f2a2c
call fcn.00493610
mov word [ebp - 0x14], 8
mov edx, dword [ebp + 8]
mov dword [edx], fcn.0041b844
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 1
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0x4e4dbe
mov edx, dword [ebp + 0x14]
dec edx
jle 0x41b77f
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 0x18], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], str.Code_not_updated_at_2019_09_26
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 0x20], eax
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx + 0x24], ecx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
mov dword [ecx + 0x30], eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
mov dword [edx + 0x34], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x20]
mov dword [eax + 0x38], edx
push 0
call fcn.0049f19c
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x3c], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x40], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 0x48], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x44], eax
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 0x4c], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x50], 1
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 0x14], eax
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx + 0xc], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret

Function at 0x421adc
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
inc dword [0x4f3538]
push 0
push 1
push 2
call sub.WSOCK32.DLL_socket
mov ebx, eax
test eax, eax
jge 0x421b47
call sub.WSOCK32.DLL_WSAGetLastError
cmp eax, 0x276d
jne 0x421b47
mov ax, 2
lea edx, [ebp - 0x190]
push edx
push eax
call sub.WSOCK32.DLL_WSAStartup
test eax, eax
je 0x421b22
xor eax, eax
jmp 0x421b67
mov dl, byte [ebp - 0x190]
cmp dl, 2
jne 0x421b3c
movzx ecx, word [ebp - 0x190]
sar ecx, 8
test cl, 0xff
je 0x421b62
call sub.WSOCK32.DLL_WSACleanup
xor eax, eax
jmp 0x421b67
test ebx, ebx
jl 0x421b62
push ebx
call sub.WSOCK32.DLL_closesocket
mov edx, dword [0x4f3538]
dec edx
jne 0x421b62
xor ecx, ecx
mov dword [0x4f353c], ecx
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x422938
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.DLL_send
test eax, eax
jle 0x42295a
add dword [0x4f3528], eax
pop ebp
ret
Function at 0x42295c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call sub.WSOCK32.DLL_recv
test eax, eax
jle 0x42297e
add dword [0x4f352c], eax
pop ebp
ret
Function at 0x424038
Capabilities:
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov eax, 0x4f5660
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
call fcn.00493610
mov word [ebp - 0x14], 8
mov edx, dword [ebp + 0x20]
push edx
mov ecx, dword [ebp + 0x1c]
push ecx
mov eax, dword [ebp + 0x18]
push eax
push edi
push ebx
push esi
mov edx, dword [ebp + 8]
push edx
call fcn.0041b734
inc dword [ebp - 8]
add esp, 0x1c
mov ecx, dword [ebp + 8]
test ebx, ebx
mov dword [ecx], 0x4f588c
je 0x42408b
mov al, byte [ebx]
test al, al
jne 0x424090
mov ebx, str.0.0.0.0
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x18], edx
call fcn.00421adc
test eax, eax
jne 0x4240b0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c], 0x4f5230
jmp 0x4241a7
push 0x10
push 0
lea eax, [ebp - 0x3c]
push eax
call fcn.004930bc
add esp, 0xc
mov word [ebp - 0x3c], 2
push ebx
call fcn.004228b4
pop ecx
test eax, eax
je 0x4240f6
push ebx
call sub.WSOCK32.DLL_gethostbyname
test eax, eax
jne 0x4240ea
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], 0x4f5253
jmp 0x4241a7
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
mov edx, dword [eax]
mov dword [ebp - 0x38], edx
jmp 0x4240ff
push ebx
call sub.WSOCK32.DLL_inet_addr
mov dword [ebp - 0x38], eax
push esi
call sub.WSOCK32.DLL_htons
mov word [ebp - 0x3a], ax
push 0
push 1
push 2
call sub.WSOCK32.DLL_socket
mov ecx, dword [ebp + 8]
test eax, eax
mov dword [ecx + 0x20], eax
jge 0x42412a
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], str.Cannot_create_socket.__Server_
jmp 0x4241a7
mov dword [ebp - 0x28], 1
lea ecx, [ebp - 0x28]
push ecx
push 0x8004667e
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
push edx
call sub.WSOCK32.DLL_ioctlsocket
test edi, edi
je 0x42416a
mov dword [ebp - 0x2c], 1
push 4
lea ecx, [ebp - 0x2c]
push ecx
push 4
push 0xffff
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
push edx
call sub.WSOCK32.DLL_setsockopt
push 0x10
lea ecx, [ebp - 0x3c]
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
push edx
call sub.WSOCK32.DLL_bind
test eax, eax
jge 0x42418c
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c], str.Cannot_bind_socket.__Server_
jmp 0x4241a7
push 0x7fffffff
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
push edx
call sub.WSOCK32.DLL_listen
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 1
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d3d8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x42d3e1
mov eax, dword [ebp - 4]
add esp, 4
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x42d55b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [edx + 0xa], 0
jbe 0x42d414
mov byte [ebx + 0xb4], 0
jmp 0x42d41b
mov byte [ebx + 0xb4], 1
mov eax, dword [edx]
sub eax, 0x465
je 0x42d43e
dec eax
je 0x42d515
dec eax
je 0x42d541
dec eax
je 0x42d54a
jmp 0x42d551
movzx eax, word [edx + 8]
cmp eax, 8
jg 0x42d460
je 0x42d4fd
dec eax
je 0x42d4eb
dec eax
je 0x42d4f4
jmp 0x42d551
sub eax, 0x10
je 0x42d46f
sub eax, 0x10
je 0x42d49b
jmp 0x42d551
cmp byte [ebx + 0xb4], 0
je 0x42d551
mov byte [ebx + 0x2a0], 1
cmp word [ebx + 0x3a], 0
je 0x42d551
mov edx, ebx
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
jmp 0x42d551
push 0
push 0x3fff
lea eax, [ebp - 0x4000]
push eax
movzx eax, word [ebx + 0x294]
push eax
call sub.WSOCK32.DLL_recv
mov esi, eax
test esi, esi
jle 0x42d4cf
lea edx, [ebp - 0x4000]
mov eax, dword [ebx + 0x29c]
mov ecx, esi
call fcn.00484130
dec esi
jl 0x42d4db
cmp byte [ebx + 0x84], 0
je 0x42d49b
mov byte [ebx + 0x2a0], 0
mov eax, ebx
call fcn.0042da04
jmp 0x42d551
mov eax, ebx
call fcn.0042d56c
jmp 0x42d551
mov eax, ebx
call fcn.0042d7a0
jmp 0x42d551
mov byte [ebx + 0x2a0], 1
cmp word [ebx + 0x32], 0
je 0x42d551
mov edx, ebx
mov eax, dword [ebx + 0x34]
call dword [ebx + 0x30]
jmp 0x42d551
mov byte [ebx + 0xd4], 1
cmp word [edx + 8], 8
jne 0x42d551
mov byte [ebx + 0x2a0], 1
test byte [ebx + 0x20], 8
jne 0x42d551
cmp word [ebx + 0x42], 0
je 0x42d551
mov edx, ebx
mov eax, dword [ebx + 0x44]
call dword [ebx + 0x40]
jmp 0x42d551
mov eax, ebx
call fcn.0042d7a0
jmp 0x42d551
mov eax, ebx
call fcn.0042d56c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42d565
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d56c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x42d575
mov eax, dword [ebp - 4]
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x4010], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42d792
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x84], 0
je 0x42d5f0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x294]
push eax
call sub.WSOCK32.DLL_WSAAsyncSelect
mov eax, dword [ebp - 4]
cmp word [eax + 0x28e], 0
je 0x42d5f0
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x290]
call dword [ebx + 0x28c]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x79], 0
jne 0x42d771
xor eax, eax
push ebp
push 0x42d76a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x79], 1
lea edx, [ebp - 0x4010]
mov eax, dword [0x4fd2d4]
call fcn.00492408
mov ecx, dword [ebp - 0x4010]
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.0042dbbc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x29c]
mov eax, ebx
call fcn.0048407c
mov edx, eax
mov eax, ebx
call fcn.00484070
push 0
push 0x3fff
lea eax, [ebp - 0x4009]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x294]
push eax
call sub.WSOCK32.DLL_recv
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42d6df
lea edx, [ebp - 0x4009]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x29c]
mov ecx, ebx
call fcn.00484130
mov eax, dword [ebp - 4]
cmp byte [eax + 0x78], 0
je 0x42d6b7
mov eax, dword [ebp - 4]
add dword [eax + 0xc0], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0xc6], 0
je 0x42d6b7
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xc8]
call dword [esi + 0xc4]
mov byte [ebp - 9], 1
cmp ebx, 0x3fff
jne 0x42d739
mov eax, dword [ebp - 4]
push eax
push 0
push 0x468
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
push eax
call sub.USER32.DLL_PostMessageA
jmp 0x42d739
call sub.WSOCK32.DLL_WSAGetLastError
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x88], ebx
lea ecx, [ebp - 8]
mov edx, ebx
cmp edx, 0xffff
jbe 0x42d701
call fcn.004902ec
mov eax, dword [ebp - 4]
call fcn.0042ce70
mov eax, dword [ebp - 4]
cmp word [eax + 0x4a], 0
je 0x42d739
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
cmp ecx, 0xffff
jbe 0x42d72d
call fcn.004902ec
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x4c]
call dword [ebx + 0x48]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d771
mov eax, dword [ebp - 4]
mov byte [eax + 0x79], 0
cmp byte [ebp - 9], 0
je 0x42d769
mov eax, dword [ebp - 4]
cmp word [eax + 0x2a], 0
je 0x42d769
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2c]
call dword [ebx + 0x28]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d799
lea eax, [ebp - 0x4010]
call fcn.00490d68
lea eax, [ebp - 8]
call fcn.00490d68
ret
Function at 0x42d7a0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x42d7a9
mov eax, dword [ebp - 4]
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x4004], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x42d9f5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x79], 0
jne 0x42d9dc
mov byte [ebx + 0x79], 1
lea edx, [ebp - 0x4004]
mov eax, dword [0x4fd2d8]
call fcn.00492408
mov ecx, dword [ebp - 0x4004]
mov dl, 8
mov eax, ebx
call fcn.0042dbbc
cmp byte [ebx + 0x288], 0
je 0x42d823
mov eax, dword [ebx + 0xa8]
call fcn.00484060
mov esi, eax
mov eax, dword [ebx + 0xa8]
call fcn.0048407c
cmp esi, eax
jl 0x42d843
cmp byte [ebx + 0x288], 0
jne 0x42d9d8
mov eax, dword [ebx + 0xa8]
call fcn.0048407c
test eax, eax
je 0x42d9d8
cmp byte [ebx + 0x84], 0
jne 0x42d9d8
cmp byte [ebx + 0x288], 0
jne 0x42d868
xor edx, edx
mov eax, dword [ebx + 0xa8]
call fcn.00484070
jmp 0x42d879
mov edx, dword [ebx + 0x80]
mov eax, dword [ebx + 0xa8]
call fcn.00484070
lea edx, [ebp - 0x4000]
mov ecx, 0x3fff
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax]
call dword [esi + 4]
mov edi, eax
push 0
push edi
lea eax, [ebp - 0x4000]
push eax
movzx eax, word [ebx + 0x294]
push eax
call sub.WSOCK32.DLL_send
mov esi, eax
cmp esi, 0xffffffff
jle 0x42d9bc
mov eax, dword [ebx + 0xa8]
call fcn.00484060
sub eax, edi
add eax, esi
push eax
mov eax, dword [ebx + 0xa8]
call fcn.0048407c
pop edx
cmp edx, eax
jl 0x42d8f3
cmp byte [ebx + 0x288], 0
jne 0x42d8e7
mov eax, dword [ebx + 0xa8]
call fcn.004844c0
mov byte [ebx + 0x286], 1
jmp 0x42d996
cmp byte [ebx + 0x288], 0
jne 0x42d966
mov eax, dword [ebx + 0xac]
call fcn.004844c0
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.00484070
mov edi, dword [ebx + 0xa8]
mov eax, edi
call fcn.0048407c
mov ecx, eax
sub ecx, esi
mov edx, edi
mov eax, dword [ebx + 0xac]
call fcn.004841ac
mov eax, dword [ebx + 0xa8]
call fcn.004844c0
mov eax, dword [ebx + 0xac]
mov edx, dword [ebx + 0xa8]
mov dword [ebx + 0xac], edx
mov edx, eax
mov dword [ebx + 0xa8], edx
mov eax, edx
xor edx, edx
call fcn.00484070
mov byte [ebx + 0x79], 0
jmp 0x42d982
mov eax, dword [ebx + 0xa8]
call fcn.00484060
mov edx, eax
sub edx, edi
add edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.00484070
push ebx
push 0
push 0x467
mov eax, dword [ebx + 0x298]
push eax
call sub.USER32.DLL_PostMessageA
add dword [ebx + 0x80], esi
cmp byte [ebx + 0x78], 0
je 0x42d9d8
cmp word [ebx + 0xce], 0
je 0x42d9d8
mov edx, ebx
mov eax, dword [ebx + 0xd0]
call dword [ebx + 0xcc]
jmp 0x42d9d8
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [ebx + 0x88], eax
xor edx, edx
mov eax, dword [ebx + 0xa8]
call fcn.00484070
mov byte [ebx + 0x79], 0
mov byte [ebx + 0x79], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d9fc
lea eax, [ebp - 0x4004]
call fcn.00490d68
ret