joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ac57
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [edi + 0xc], 0x1f3
push ebx
jne 0x42ad35
mov ecx, dword [edi + 8]
xor ebx, ebx
cmp ecx, ebx
jbe 0x42ad01
test dword [esi + 0x1690], 0xfffffff8
mov dword [ebp - 4], ebx
jne 0x42aca1
push ebx
lea eax, [ebp - 4]
push eax
push ecx
push dword [edi + 4]
push dword [esi + 0x1698]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42acc2
jmp 0x42acbe
mov eax, dword [esi + 0x186c]
cmp eax, ebx
je 0x42accd
push dword [esi + 0x188c]
push ecx
push dword [edi + 4]
call eax
add esp, 0xc
test eax, eax
jge 0x42acc2
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 4], 0xffffffff
jne 0x42accd
push 0x28
push ebx
jmp 0x42ad39
lea ebx, [esi + 0x1640]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
lea eax, [esi + 0x628]
add dword [eax], ecx
push ebx
adc dword [eax + 4], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [edi + 8]
lea eax, [esi + 0xb8]
add dword [eax], ecx
adc dword [eax + 4], 0
xor ebx, ebx
mov eax, dword [esi + 0xf4]
cmp eax, ebx
je 0x42ad32
cmp byte [esi + 0xf0], 0
je 0x42ad32
mov ecx, dword [edi]
mov dword [ebp - 8], ecx
lea ecx, [ebp - 8]
push ecx
push dword [esi + 0xf8]
mov dword [ebp - 4], ebx
push 0xe41a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
jmp 0x42acca
push 0x33
push 0
push 0xe411
push dword [esi]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
xor eax, eax
pop ebx
leave
ret
Function at 0x42b028
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x50dadd
call fcn.00508264
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push dword [ebp + 0x14]
mov dword [esi], eax
mov al, byte [ebp + 0x10]
lea ecx, [esi + 8]
mov byte [esi + 4], al
call fcn.00403731
push dword [ebp + 0x18]
xor eax, eax
mov dword [ebp - 4], eax
or dword [esi + 0x28], 0xffffffff
lea ecx, [esi + 0x54]
mov dword [esi + 0x24], 0x64
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
call fcn.00403731
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x14

Function at 0x42b5f2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
or dword [ebp + 0xc], 0xffffffff
push edi
push 0
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push ecx
push eax
push dword [esi]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x42b65f
call edi
test eax, eax
je 0x42b65f
push 0x53c09c
call fcn.00413df9
push dword [ebp - 4]
push dword [ebp - 8]
push str.LowPart:__d_HighPart:__d_n
call fcn.00413df9
add esp, 0x10
call edi
mov ecx, dword [esi + 4]
mov dword [ecx + 0x8c], eax
mov eax, dword [esi + 4]
mov dword [eax + 0x90], 2
jmp 0x42b6a5
push 0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42b6aa
push dword [ebp + 0x14]
push dword [ebp - 8]
call edi
push eax
push 0x53c070
call fcn.00413df9
add esp, 0x10
call edi
mov ecx, dword [esi + 4]
mov dword [ecx + 0x8c], eax
mov eax, dword [esi + 4]
mov dword [eax + 0x90], 1
or eax, 0xffffffff
jmp 0x42b6ad
mov eax, dword [ebp + 0xc]
pop edi
leave
ret 0x10
Function at 0x42cb61
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov esi, eax
push edi
lea edi, [esi + 0x178]
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x42cb83
push eax
call ebp
or dword [edi], 0xffffffff
cmp byte [esp + 0x30], 0
push 8
pop ebx
je 0x42cc6a
cmp dword [esi + 0x58], ebx
jb 0x42cb9b
mov eax, dword [esi + 0x44]
jmp 0x42cb9e
lea eax, [esi + 0x44]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
cmp dword [esi + 0x3c], ebx
jb 0x42cbb1
mov eax, dword [esi + 0x28]
jmp 0x42cbb4
lea eax, [esi + 0x28]
push eax
call edi
mov eax, dword [esi + 0xdc]
test eax, eax
je 0x42cbc7
push eax
call fcn.00435ff3
push 0x53c260
call fcn.00413df9
pop ecx
push dword [esi]
call ebp
push 0x53c274
call fcn.00413df9
or dword [esi], 0xffffffff
mov eax, dword [esi + 4]
add esi, 8
test dword [eax + 0x1690], 0xfffffff8
pop ecx
je 0x42cc00
push str.._p4p_
jmp 0x42ccb6
cmp dword [esi + 0x18], ebx
jb 0x42cc0a
mov eax, dword [esi + 4]
jmp 0x42cc0d
lea eax, [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42cc33
cmp dword [esi + 0x18], ebx
jb 0x42cc22
mov eax, dword [esi + 4]
jmp 0x42cc25
lea eax, [esi + 4]
push eax
call edi
test eax, eax
jne 0x42cc33
xor al, al
jmp 0x42cce3
push str.._p4p_
lea eax, [esp + 0x14]
push esi
push eax
call fcn.00409dbb
add esp, 0xc
cmp dword [esi + 0x18], ebx
jb 0x42cc50
mov esi, dword [esi + 4]
jmp 0x42cc53
add esi, 4
cmp dword [eax + 0x18], ebx
jb 0x42cc5d
mov eax, dword [eax + 4]
jmp 0x42cc60
add eax, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x42ccd4
cmp dword [esi + 0x58], ebx
jb 0x42cc74
mov eax, dword [esi + 0x44]
jmp 0x42cc77
lea eax, [esi + 0x44]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
cmp dword [esi + 0x3c], ebx
jb 0x42cc8a
mov eax, dword [esi + 0x28]
jmp 0x42cc8d
lea eax, [esi + 0x28]
push eax
call edi
push 0x53c260
call fcn.00413df9
pop ecx
push dword [esi]
call ebp
push 0x53c274
call fcn.00413df9
or dword [esi], 0xffffffff
mov dword [esp], str.._p4p_
add esi, 8
lea eax, [esp + 0x14]
push esi
push eax
call fcn.00409dbb
add esp, 0xc
cmp dword [eax + 0x18], ebx
jb 0x42ccce
mov eax, dword [eax + 4]
jmp 0x42ccd1
add eax, 4
push eax
call edi
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.0040184d
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x42d0ac
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x50e0e9
call fcn.00508264
sub esp, 0x5c
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov ebx, ecx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebx + 0xdc]
push edi
cmp eax, esi
je 0x42d0d6
push eax
call fcn.00435ff3
cmp dword [ebx + 0x174], esi
je 0x42d10d
push 1
call fcn.0042ea3f
mov esi, dword [ebx + 0x174]
lea eax, [ebp - 0x30]
push eax
call fcn.00416950
pop ecx
push dword [ebx + 0x174]
call fcn.0049a490
and dword [ebx + 0x174], 0
pop ecx
jmp 0x42d20b
lea eax, [ebp - 0x48]
push eax
mov edi, 0x10000
call fcn.0042eddd
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x3c]
jne 0x42d12f
call fcn.0049af27
mov eax, dword [ebp - 0x3c]
push 0x58
mov dword [ebp - 0x14], eax
call fcn.0049ad2e
pop ecx
mov dword [ebx + 0x174], eax
call fcn.00416880
push esi
push esi
push esi
push dword [ebx]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x42d1cc
cmp dword [ebp - 0x10], 0
je 0x42d1dc
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0xf4]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x42d1a6
fild qword [ebp - 0x28]
fmul qword [0x53ca78]
fild qword [ebx + 0xd0]
fdivp st(1)
call fcn.004a0660
push eax
mov eax, dword [ebx + 4]
push dword [eax + 0xf8]
push 0xe41d
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x174]
call fcn.004168b0
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x28], eax
pop ecx
push 0
adc dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp - 0x14]
push dword [ebx]
call esi
test eax, eax
jne 0x42d162
mov esi, dword [ebx + 0x174]
lea eax, [ebp - 0x30]
push eax
call fcn.00416950
pop ecx
push dword [ebx + 0x174]
call fcn.0049a490
and dword [ebx + 0x174], 0
pop ecx
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.0042ec20
mov ecx, dword [ebp + 8]
push 0x535d5a
call fcn.00401644
xor edi, edi
xor ebx, ebx
inc edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], edi
xor esi, esi
movzx eax, byte [ebp + esi - 0x30]
push eax
lea eax, [ebp - 0x18]
push 0x53c290
push eax
call fcn.0049b026
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x64]
call fcn.00401644
push 0xffffffffffffffff
push ebx
mov dword [ebp - 4], 2
mov ecx, dword [ebp + 8]
push eax
call fcn.00409cc4
push ebx
push edi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0
call fcn.004017de
inc esi
cmp esi, 0x10
jl 0x42d225
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x42ea3f
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x50e0a4
call fcn.00508264
sub esp, 0x28
or eax, 0xffffffff
push esi
push edi
cmp dword [ebx + 0x178], eax
je 0x42eb85
mov eax, dword [ebx + 0x170]
cmp eax, dword [ebx + 0xd8]
jge 0x42eb83
xor esi, esi
cmp dword [ebx + 0x174], esi
je 0x42eb83
mov eax, dword [ebx + 4]
mov edi, dword [eax + 0x16f4]
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x18], edi
call fcn.0042eddd
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], esi
jne 0x42eaa5
call fcn.0049af27
mov eax, dword [ebx + 0x170]
cmp eax, dword [ebx + 0xd8]
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x14], esi
jge 0x42eb7b
lea esi, [ebx + 0x158]
mov eax, dword [ebx + 0x170]
shr eax, 3
push eax
call fcn.004244fe
mov ecx, dword [ebx + 0x170]
movsx eax, byte [eax]
xor edx, edx
and ecx, 7
inc edx
shl edx, cl
test eax, edx
je 0x42eb7b
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
push edi
push dword [ebx + 0x178]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42eba4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x174]
push edi
call fcn.004168b0
mov eax, dword [ebx + 4]
test dword [eax + 0x1690], 0xfffffff8
pop ecx
je 0x42eb43
mov ecx, dword [eax + 0x186c]
test ecx, ecx
je 0x42eb43
push dword [eax + 0x188c]
push dword [ebp - 0x10]
push edi
call ecx
add esp, 0xc
jmp 0x42eb45
xor eax, eax
test eax, eax
jl 0x42eb95
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebx + 0x170]
inc dword [ebp - 0x14]
cmp byte [ebp + 8], 0
jne 0x42eb69
cmp dword [ebp - 0x14], 0x2800
jge 0x42eb7b
mov eax, dword [ebx + 0x170]
cmp eax, dword [ebx + 0xd8]
jl 0x42eac3
lea esi, [ebp - 0x30]
call fcn.0042ec20
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret 4
push 0xfffffffffffffffe
pop edi
lea esi, [ebp - 0x30]
call fcn.0042ec20
mov eax, edi
jmp 0x42eb85
push 0xfffffffffffffffd
jmp 0x42eb97

Function at 0x43000e
Capabilities:
Get file size

Disassembly:
mov eax, 0x50daef
call fcn.00508264
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43004b
mov al, 1
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 0x14], ebx
je 0x430061
or eax, 0xffffffff
push esi
cmp dword [ebp + 0xc], eax
je 0x43006f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43003b
lea eax, [ebp - 0x30]
push eax
call fcn.0042ff63
pop ecx
pop ecx
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x30]
call fcn.0040713e
test eax, eax
je 0x4300a7
mov byte [ebp - 0xd], 1
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.004017de
mov al, byte [ebp - 0xd]
jmp 0x43003d
mov byte [ebp - 0xd], bl
jmp 0x430097
Function at 0x431b22
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x50fd6d
call fcn.00508264
mov eax, dword [edi]
sub esp, 0xc
push ebx
push esi
mov ecx, edi
call dword [eax + 0xc]
xor ebx, ebx
cmp dword [edi + 0x204], ebx
je 0x431c22
mov ecx, dword [edi + 0xe8]
cmp ecx, ebx
je 0x431b5c
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0xe8], ebx
push 0xc
call fcn.0049ad2e
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x431b77
call fcn.004380ce
jmp 0x431b79
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [edi + 0xe8], eax
mov byte [edi + 0xef], bl
cmp byte [edi + 0x1ec], bl
jne 0x431be9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub esp, 0x1c
lea esi, [edi + 0x104]
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.00403731
call fcn.00433bc5
add esp, 0x1c
push dword [edi + 0x120]
mov ecx, esi
push dword [edi + 0xe8]
mov byte [ebp - 0xe], al
call fcn.00438178
mov byte [ebp - 0xd], al
cmp byte [edi + 0xef], bl
jne 0x431bfe
cmp byte [edi + 0xac], bl
je 0x431bfe
cmp byte [ebp - 0xe], bl
je 0x431bfe
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x431bfe
push dword [edi + 0x194]
lea ecx, [edi + 0x178]
push eax
call fcn.00438178
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], bl
je 0x431c22
cmp byte [edi + 0xef], bl
jne 0x431c22
mov byte [edi + 0xec], bl
mov byte [edi + 0xef], bl
mov byte [edi + 0x100], 1
xor eax, eax
jmp 0x431c25
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x434509
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
call fcn.0049db30
mov ebx, eax
xor esi, esi
pop ecx
test ebx, ebx
jle 0x434536
push 0
push ebx
lea eax, [esi + edi]
push eax
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x43453b
add esi, eax
cmp esi, ebx
jl 0x43451a
mov eax, esi
pop esi
pop ebx
ret
or eax, 0xffffffff
jmp 0x434538

Function at 0x434607
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
or dword [esi], 0xffffffff
or dword [esi + 4], 0xffffffff
sub esp, 0x194
push edi
xor eax, eax
push 0x3c
push eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea eax, [esi + 0x10]
push eax
call fcn.0049d740
mov edi, 0x1000
push edi
call fcn.00499a0f
push edi
mov dword [esi + 0x20], eax
call fcn.00499a0f
push edi
mov dword [esi + 0x2c], eax
call fcn.00499a0f
push edi
mov dword [esi + 0x34], eax
call fcn.00499a0f
add esp, 0x1c
mov dword [esi + 0x3c], eax
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x434677
push str.An_error_occured_at_WSAStartup___function__n
call fcn.00413df9
pop ecx
mov eax, esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x434e57
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Parse url
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.004a1280
push ebx
push esi
xor ebx, ebx
push 0xfff
lea eax, [ebp - 0x100f]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x1010], bl
call fcn.0049d740
add esp, 0xc
mov eax, esi
call fcn.00434df7
lea ecx, [esi + 0x10]
push ecx
push ebx
mov eax, 0x1000
push ebx
push dword [ebp + 8]
mov dword [ecx], 0x3c
mov dword [esi + 0x24], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x434ebe
or eax, 0xffffffff
jmp 0x434fef
cmp dword [esi + 0x30], ebx
jne 0x434ee0
push str.anonymous
push dword [esi + 0x2c]
call fcn.00507af0
push str.you_youraddr.com
push dword [esi + 0x34]
call fcn.00507af0
add esp, 0x10
push edi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
or edi, 0xffffffff
mov dword [esi], eax
cmp eax, edi
jne 0x434efd
mov eax, edi
jmp 0x434fee
push 2
pop eax
push dword [esi + 0x20]
mov word [ebp - 0x10], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0xc], eax
cmp eax, edi
jne 0x434f2f
push dword [esi + 0x20]
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x434fe1
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
movzx eax, word [esi + 0x28]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, edi
je 0x434fe1
push dword [esi]
lea edi, [ebp - 0x1010]
call fcn.004345b8
pop ecx
cmp eax, 0xdc
jne 0x434fe1
push dword [esi + 0x2c]
mov eax, edi
push str.USER__s_r_n
push eax
call fcn.0049b026
push dword [esi]
call fcn.00434509
push dword [esi]
call fcn.004345b8
add esp, 0x14
push 0x64
cdq
pop ecx
idiv ecx
cmp eax, 2
je 0x434fc6
cmp eax, 3
jne 0x434fe1
push dword [esi + 0x34]
mov eax, edi
push str.PASS__s_r_n
push eax
call fcn.0049b026
push dword [esi]
call fcn.00434509
push dword [esi]
call fcn.004345b8
add esp, 0x14
push 0x64
cdq
pop ecx
idiv ecx
cmp eax, 2
jne 0x434fe1
push 0xfff
push dword [ebp + 8]
add esi, 0x104c
push esi
call fcn.00507930
add esp, 0xc
xor eax, eax
jmp 0x434fee
push dword [esi]
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
mov dword [esi], eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x43808c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
cmp dword [0x55a4f4], 0
jne 0x4380c6
lea eax, [ebp - 0x198]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4380c6
push 0x547e9c
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], str.Could_not_start_WSA
call fcn.0049dbbb
inc dword [0x55a4f4]
leave
ret
Function at 0x4380ce
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ecx
and dword [esi + 4], 0
mov dword [esi], vtable.Socket.0
call fcn.0043808c
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 4
mov dword [esi + 4], eax
call fcn.0049ad2e
pop ecx
test eax, eax
je 0x438101
mov dword [eax], 1
jmp 0x438103
xor eax, eax
mov dword [esi + 8], eax
mov eax, esi
pop ecx
ret

Function at 0x438178
Capabilities:
Connect socket
Resolve dns

Disassembly:
mov eax, 0x50da41
call fcn.00508264
sub esp, 0x30
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x24], 0xf
call fcn.00401979
mov dword [ebp - 4], ebx
cmp dword [esi + 0x18], 0x10
jb 0x4381aa
mov esi, dword [esi + 4]
jmp 0x4381ad
add esi, 4
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
cmp esi, ebx
jne 0x4381f2
call fcn.004a4b71
push dword [eax]
call fcn.00507a7c
pop ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004017bb
mov byte [ebp + 0xf], bl
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.004017de
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0xf]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
push 2
pop eax
push dword [ebp + 0xc]
mov word [ebp - 0x20], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
mov eax, dword [esi + 0xc]
xor edi, edi
cmp dword [eax], ebx
je 0x4381d0
xor ecx, ecx
mov eax, dword [eax + ecx]
mov eax, dword [eax]
push 8
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.0049d740
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
add esp, 0xc
cmp eax, ebx
je 0x438243
push 0x10
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x438256
mov eax, dword [esi + 0xc]
inc edi
mov ecx, edi
shl ecx, 2
cmp dword [eax + ecx], ebx
jne 0x438211
jmp 0x4381d0
mov byte [ebp + 0xf], 1
jmp 0x4381d3

Function at 0x43825f
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [ebx + 4]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, 0x400
mov eax, edi
test ecx, ecx
je 0x4382ae
test eax, eax
je 0x4382ae
cmp eax, 0x2746
je 0x4382ae
test esi, esi
je 0x4382ae
cmp esi, edi
mov eax, esi
jl 0x43828a
mov eax, edi
push 0
push eax
mov eax, dword [esp + 0x14]
sub eax, esi
add eax, dword [esp + 0x18]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4382ae
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x4382ae
sub esi, eax
jmp 0x438273
mov eax, dword [esp + 0x10]
pop edi
sub eax, esi
pop esi
ret 8
Function at 0x438353
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, 0x50df5c
call fcn.00508264
sub esp, 0x60
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x14], esi
push esi
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x1c], 0xf
call fcn.00401979
push str._r_n_r_n
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], esi
call fcn.00401644
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
mov eax, dword [edi + 4]
cmp eax, esi
je 0x438463
push esi
push ebx
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x438424
cmp eax, esi
je 0x438446
push dword [ebp - 0x18]
lea ecx, [ebp - 0x34]
push ebx
call fcn.004113d2
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x3c]
jb 0x4383f1
sub eax, dword [ebp - 0x3c]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040711c
mov ecx, eax
mov byte [ebp - 4], 2
or dword [ebp - 0x14], 2
lea eax, [ebp - 0x50]
call fcn.0040713e
mov byte [ebp - 0xd], bl
test eax, eax
je 0x4383f5
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], ebx
test byte [ebp - 0x14], 2
je 0x43840c
and dword [ebp - 0x14], 0xfffffffd
push esi
push ebx
lea ecx, [ebp - 0x6c]
call fcn.004017de
cmp byte [ebp - 0xd], 0
je 0x43838d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x34]
push eax
call fcn.00403731
jmp 0x438470
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x43838d
push dword [edi + 4]
push eax
push str.recv
call fcn.00413df9
add esp, 0xc
cmp dword [ebp - 0x1c], 0x10
mov eax, dword [ebp - 0x30]
jae 0x438452
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x20]
push str.ReceiveHttpHeader
call fcn.00413df9
add esp, 0xc
mov ecx, dword [ebp + 8]
push 0x535d5a
call fcn.00401644
push esi
push ebx
lea ecx, [ebp - 0x50]
call fcn.004017de
push esi
push ebx
lea ecx, [ebp - 0x34]
call fcn.004017de
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x438497
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
push edi
jle 0x4384fb
mov eax, dword [ebx + 4]
cmp eax, esi
je 0x4384f7
cmp esi, dword [esp + 0x10]
jge 0x4384f7
mov ecx, dword [esp + 0x10]
push 0
sub ecx, esi
push ecx
mov ecx, dword [esp + 0x14]
add ecx, esi
push ecx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4384d9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x4384e4
mov eax, dword [ebx + 4]
add esi, edi
test eax, eax
jne 0x4384a8
jmp 0x4384f7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.sendbytes_socket_error:__d_n
call fcn.00413df9
pop ecx
pop ecx
mov eax, esi
jmp 0x4384fe
or eax, 0xffffffff
pop edi
pop esi
ret 8
Function at 0x43b3d5
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push ebx
mov dword [ebp - 4], ebx
call sub.IPHLPAPI.DLL_GetIpForwardTable
cmp eax, 0x7a
jne 0x43b431
push esi
push dword [ebp - 4]
call fcn.00499a0f
mov esi, eax
pop ecx
cmp esi, ebx
je 0x43b430
push ebx
lea eax, [ebp - 4]
push eax
push esi
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
jne 0x43b429
mov ecx, dword [esi]
xor edx, edx
cmp ecx, ebx
jbe 0x43b429
lea eax, [esi + 4]
cmp dword [eax], ebx
je 0x43b427
inc edx
add eax, 0x38
cmp edx, ecx
jb 0x43b419
jmp 0x43b429
mov bl, 1
push esi
call fcn.0049ac10
pop ecx
pop esi
movzx eax, bl
pop ebx
leave
ret

Function at 0x43b437
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret