joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x240a3f83
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x58c26514
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1bbe020
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7d1000]
push edi
or ebp, 0xffffffff
jmp 0x1bbe042
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1bbe049
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1bbe038
mov eax, 1
add ebx, ebx
jne 0x1bbe05b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1bbe06c
jne 0x1bbe08b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1bbe08b
dec eax
add ebx, ebx
jne 0x1bbe078
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1bbe050
add ebx, ebx
jne 0x1bbe087
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1bbe0dd
xor ecx, ecx
sub eax, 3
jb 0x1bbe0a3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1bbe112
sar eax, 1
mov ebp, eax
jmp 0x1bbe0ae
add ebx, ebx
jne 0x1bbe0ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1bbe07c
inc ecx
add ebx, ebx
jne 0x1bbe0bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1bbe07c
add ebx, ebx
jne 0x1bbe0c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1bbe0be
jne 0x1bbe0da
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1bbe0be
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1bbe0fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1bbe0ee
jmp 0x1bbe03e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1bbe0fc
add edi, ecx
jmp 0x1bbe03e
pop esi
mov edi, esi
mov ecx, 0x4da3e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1bbe11a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1bbe11f
lea edi, [esi + 0xcba000]
mov eax, dword [edi]
or eax, eax
je 0x1bbe187
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd3ad08]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd3ae34]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1bbe145
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd3ae38]
or eax, eax
je 0x1bbe181
mov dword [ebx], eax
add ebx, 4
jmp 0x1bbe162
call dword [esi + 0xd3ae48]
mov ebp, dword [esi + 0xd3ae3c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1bbe1bb
sub esp, 0xffffff80
jmp 0x15a85fc
Function at 0x10001140
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000d1b0
push 0x1000b6a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x100011a6
mov byte [ebp - 0x3d], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3d]
jmp 0x1000122f
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], 0x4550
je 0x100011cd
mov byte [ebp - 0x3e], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3e]
jmp 0x1000122f
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add eax, dword [edx + 0xd8]
cmp dword [ebp + 0xc], eax
jb 0x10001208
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
add edx, dword [ecx + 0xd8]
mov eax, dword [ebp - 0x3c]
add edx, dword [eax + 0xdc]
cmp dword [ebp + 0xc], edx
jae 0x10001208
mov byte [ebp - 0x3f], 1
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x3f]
jmp 0x1000122f
mov byte [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x40]
jmp 0x1000122f
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100012d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10011210]
mov dword [ebp - 4], eax
jmp 0x100012e9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10001306
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100012e0
mov esp, ebp
pop ebp
ret
Function at 0x10001310
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10011220], eax
je 0x1000132e
mov eax, 0x10dd
jmp 0x10001410
mov eax, dword [0x10011230]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100013ad
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
xor eax, eax
mov al, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x1000138b
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x10], 0
je 0x1000138b
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x10]
push eax
call fcn.10001480
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.1000b050
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x10001336
mov dword [0x10011230], 0
call fcn.10001420
mov ecx, dword [0x1001122c]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x100013fa
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.1000b050
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
jmp 0x100013c5
mov dword [0x1001122c], 0
mov dword [0x10011220], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10001980
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10001995
xor eax, eax
jmp 0x10001a0a
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 0x10000
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
jmp 0x100019c2
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x38d
jae 0x10001a05
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
cmp dword [eax + edx + 0x40], 0
je 0x10001a03
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x100019ff
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x10001a03
xor eax, eax
jmp 0x10001a0a
jmp 0x100019b9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001ac0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10011224], 0
je 0x10001ad9
mov eax, dword [0x10011224]
jmp 0x10001b79
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x10001aeb
xor eax, eax
jmp 0x10001b79
push 8
call fcn.1000a78b
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001b41
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x10001b2a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1000b050
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10011224], eax
mov dword [0x10011228], 0
mov eax, dword [ebp - 8]
jmp 0x10001b79
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10001b5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x10001b0b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x1001122c]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x1001122c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10008b27
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 8], 1
mov ecx, dword [esi + 0xc]
jne 0x10008b40
mov ax, word [esi]
mov word [ecx + 2], ax
jmp 0x10008b5f
cmp dword [esi + 8], 2
jne 0x10008b59
mov dword [ecx + 2], 0xc1e7cae
mov ecx, dword [esi + 0xc]
mov ax, word [esi]
mov word [ecx + 6], ax
jmp 0x10008b5f
mov ax, word [esi]
mov word [ecx], ax
mov ecx, esi
call fcn.1000a61e
mov ecx, dword [esi + 0xc]
push 0
movzx eax, word [ecx]
add eax, 2
push eax
push ecx
push dword [0x1001163c]
call dword [sym.imp.WS2_32.dll_send]
push dword [esi + 0xc]
call fcn.1000abc4
push 0x10
push esi
call fcn.1000a7bb
add esp, 0xc
pop esi
pop ebp
ret 4
Function at 0x10008ea7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x160
mov eax, dword [0x10011040]
xor eax, esp
mov dword [esp + 0x15c], eax
cmp dword [ebp + 0xc], 1
jne 0x10008f52
push 0x104
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movaps xmm0, xmmword [0x1000ec20]
lea eax, [esp + 0x38]
sub esp, 0xc
lea edx, [esp + 0x14]
mov ecx, esp
movups xmmword [esp + 0x14], xmm0
movaps xmm0, xmmword [0x1000ec90]
push ecx
movups xmmword [esp + 0x28], xmm0
push eax
movaps xmm0, xmmword [0x1000ec50]
push edx
movups xmmword [esp + 0x40], xmm0
call fcn.10004ee3
lea ecx, [esp + 0x44]
call fcn.10009a90
add esp, 0xc
cmp dword [eax + 0x14], 0xf
jbe 0x10008f28
mov eax, dword [eax]
push eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x38]
call fcn.1000305c
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x100115e4], eax
call fcn.10008b97
mov ecx, dword [esp + 0x15c]
xor eax, eax
xor ecx, esp
inc eax
call fcn.1000a77d
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10009bce
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
push 0x40
push 5
push ebx
mov edi, edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
mov byte [ebx], 0xe9
push eax
push dword [ebp - 4]
sub edi, ebx
push 5
sub edi, 5
push ebx
mov dword [ebx + 1], edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
leave
ret

Function at 0x1000a5f2
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, 0x10008357
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push ecx
push ecx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov byte [esi + 8], cl
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
setne al
mov byte [esi + 8], al
mov eax, esi
pop esi
ret 0xc
Function at 0x1000a61e
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x7998bc]
push ebx
push esi
push edi
mov dword [ebp - 0x28], eax
mov edi, ecx
mov eax, dword [0x7998c0]
push 6
mov dword [ebp - 0x24], eax
mov eax, dword [0x7998c4]
mov esi, dword [edi]
pop ebx
mov dword [ebp - 0x20], eax
mov eax, dword [0x7998c8]
push 2
mov dword [ebp - 0x1c], eax
pop eax
cmp dword [edi + 8], eax
mov dword [ebp - 0x14], edi
cmovne ebx, eax
add esi, ebx
mov dword [ebp - 0x18], ebx
mov ecx, esi
mov dword [ebp - 8], esi
and ecx, 0x80000007
jns 0x1000a673
dec ecx
or ecx, 0xfffffff8
add ecx, 1
je 0x1000a67f
push 8
pop eax
sub eax, ecx
add esi, eax
mov dword [ebp - 8], esi
mov ecx, dword [edi + 0xc]
mov eax, esi
cdq
add ecx, ebx
and edx, 3
mov dword [ebp - 0xc], ecx
add eax, edx
xor edx, edx
sar eax, 2
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
test eax, eax
jle 0x1000a713
mov edi, dword [ecx + edx*4]
xor esi, esi
mov ebx, dword [ecx + edx*4 + 4]
push 0x20
pop edx
mov ecx, ebx
mov eax, ebx
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, esi
and eax, 3
add ecx, ebx
mov eax, dword [ebp + eax*4 - 0x28]
add eax, esi
sub esi, 0x61c88647
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, esi
shr eax, 0xb
add ecx, edi
and eax, 3
mov eax, dword [ebp + eax*4 - 0x28]
add eax, esi
xor ecx, eax
add ebx, ecx
sub edx, 1
jne 0x1000a6aa
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + edx*4], edi
mov dword [ecx + edx*4 + 4], ebx
add edx, 2
mov dword [ebp - 4], edx
cmp edx, dword [ebp - 0x10]
jl 0x1000a69e
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov eax, dword [edi + 0xc]
lea ecx, [ebx - 2]
add ecx, esi
mov word [eax], cx
mov dword [edi], esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411ef0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a32c6
push eax
mov dword fs:[0], esp
mov eax, dword [esp + 0x10]
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.004120b0
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x18]
push edx
push eax
call fcn.004120b0
mov edx, dword [edi + 0x10]
xor ebp, ebp
add esp, 0x10
xor eax, eax
cmp edx, ebp
jle 0x411f4f
mov ecx, dword [edi + 0xc]
mov ebx, dword [esp + 0x28]
mov esi, dword [ecx]
cmp dword [esi], ebx
je 0x411fa4
inc eax
add ecx, 4
cmp eax, edx
jl 0x411f41
push 0x14
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x20], ebp
je 0x411f75
lea ecx, [esp + 0x28]
push ecx
mov ecx, eax
call fcn.00411c50
mov esi, eax
jmp 0x411f77
xor esi, esi
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
add edi, 0xc
inc eax
cmp eax, ecx
mov dword [esp + 0x20], 0xffffffff
jle 0x411f95
push eax
mov ecx, edi
call fcn.00418270
mov edx, dword [edi + 4]
mov eax, dword [edi]
mov dword [eax + edx*4], esi
mov eax, dword [edi + 4]
inc eax
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
cmp ecx, eax
jne 0x412074
mov ecx, dword [0x4afd50]
mov edx, dword [esi + 0xc]
mov ebx, dword [esi + 0x10]
add eax, ecx
mov dword [esi + 8], eax
mov dword [esp + 0x2c], edx
shl eax, 2
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, dword [esi + 8]
mov dword [esi + 0xc], eax
lea ecx, [edi*4 + 4]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 8
mov dword [esp + 0x14], eax
cmp eax, ebp
mov dword [esp + 0x20], 1
je 0x41200e
push fcn.00435730
push fcn.00415f10
lea ebp, [eax + 4]
push edi
push 4
push ebp
mov dword [eax], edi
call fcn.00446456
mov ecx, dword [esi + 4]
xor eax, eax
test ecx, ecx
mov dword [esp + 0x20], 0xffffffff
mov dword [esi + 0x10], ebp
jle 0x412046
mov edx, dword [esp + 0x2c]
sub edx, ebx
mov edi, dword [esi + 0xc]
lea ecx, [ebx + eax*4]
inc eax
mov ebp, dword [edx + ecx]
mov dword [edi + eax*4 - 4], ebp
mov edi, dword [esi + 0x10]
mov ecx, dword [ecx]
mov dword [edi + eax*4 - 4], ecx
mov ecx, dword [esi + 4]
cmp eax, ecx
jl 0x412028
mov edx, dword [esp + 0x2c]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
test ebx, ebx
je 0x412074
mov eax, dword [ebx - 4]
lea edi, [ebx - 4]
push fcn.00435730
push eax
push 4
push ebx
call fcn.004464d8
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov eax, dword [esp + 0x30]
pop edi
mov dword [edx + ecx*4], eax
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x10]
mov eax, dword [esp + 0xc]
mov dword [edx + ecx*4], eax
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x14]
inc eax
mov dword [esi + 4], eax
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x427ee0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push edi
mov dword [esi + 0x38], eax
mov eax, dword [esp + 0x10]
mov dword [esi], 0x4a6a8c
mov dword [esi + 8], eax
lea edi, [eax + 1]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
lea ecx, [edi + edi]
mov dword [esi + 0x24], eax
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esi + 0x24]
xor ecx, ecx
add esp, 8
cmp edx, ecx
mov dword [esi + 4], eax
je 0x427f57
cmp eax, ecx
je 0x427f57
mov eax, 1
mov dword [esi + 0x10], ecx
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], 0xa
mov edx, dword [sym.imp.MSVCRT.dll__iob]
mov dword [esi + 0x28], edx
mov edx, dword [sym.imp.MSVCRT.dll__iob]
add edx, 0x20
mov dword [esi + 0x30], eax
mov dword [esi + 0x2c], edx
mov dword [esi + 0x34], ecx
mov eax, esi
pop edi
pop esi
ret 8
push str.No_space_for_scanner_
push esi
call fcn.00427fa0
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop

Function at 0x428a20
Capabilities:
Create process on windows
Initialize winsock library

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a4bdb
push eax
mov dword fs:[0], esp
sub esp, 0x6f8
lea eax, [esp + 4]
push esi
push eax
push 0x202
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x428a75
push str.WSAStartup_...__n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [esp + 0x6f8]
mov dword fs:[0], ecx
add esp, 0x704
ret
mov esi, dword [sym.imp.MSVCRT.dll_printf]
push str.Parsing_VRML_file..._n
call esi
add esp, 4
lea ecx, [esp + 0x198]
push 0
call fcn.0042e140
mov ecx, dword [esp + 0x710]
mov edx, dword [esp + 0x70c]
push 0
push ecx
push edx
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x710], 0
call fcn.0042eed0
test eax, eax
mov dword [esp + 4], eax
jne 0x428afd
push str.Error_parsing_VRML_file_n
call esi
add esp, 4
lea ecx, [esp + 0x198]
mov dword [esp + 0x704], 0xffffffff
call fcn.0042e6b0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x6f8]
mov dword fs:[0], ecx
add esp, 0x704
ret
push str.Finished_parsing_VRML_file..._n
call esi
mov eax, dword [esp + 0x718]
add esp, 4
test eax, eax
je 0x428b1f
lea eax, [esp + 4]
push eax
call fcn.00428b70
add esp, 4
call sub.WSOCK32.dll_WSACleanup
push 1
push 0
push 0
push str.index.html
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, dword [esp + 4]
lea ecx, [esp + 0x198]
mov dword [esp + 0x704], 0xffffffff
call fcn.0042e6b0
mov ecx, dword [esp + 0x6fc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x704
ret
Function at 0x42abb0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi + 0x40], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 4], eax
mov dword [esi + 8], 1
lea ecx, [eax + eax + 2]
mov dword [esi], 1
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esi + 4]
mov dword [esi + 0x10], eax
lea eax, [edx*4 + 4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esi + 0x10]
add esp, 8
test ecx, ecx
mov dword [esi + 0x14], eax
je 0x42ac02
test eax, eax
je 0x42ac02
mov eax, esi
pop esi
ret 8
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
push str.Not_enough_space_for_parser_stacks
add ecx, 0x40
push ecx
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x42ca50
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
test ebx, ebx
mov edi, ecx
jne 0x42ca6b
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 8
cmp dword [edi + 4], 0xffffffff
je 0x42ca78
mov ecx, edi
call fcn.0042cb60
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [edi + 4], eax
jne 0x42caa4
push str.socket_...__n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
mov esi, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0xc], eax
push esi
mov dword [esp + 0x14], eax
mov word [esp + 0x10], 2
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call sub.WSOCK32.dll_htons
push ebx
mov word [esp + 0x12], ax
mov dword [esp + 0x14], 0
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x42cb12
push ebx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x42cb07
push ebx
push str.Couldnt_resolve___s___n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esp + 0x10], eax
mov edx, dword [edi + 4]
lea ecx, [esp + 0xc]
push 0x10
push ecx
push edx
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x42cb48
and esi, 0xffff
push esi
push ebx
push str.Could_not_connect_to__s_on_port__u__n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret 8

Function at 0x42cb80
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 4], 0xffffffff
jne 0x42cb8f
xor eax, eax
pop esi
ret
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push ecx
push 0x4de080
call dword [sym.imp.MSVCRT.dll_vsprintf]
mov edi, 0x4de080
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [esi + 4]
push eax
not ecx
dec ecx
push ecx
push 0x4de080
push edx
call sub.WSOCK32.dll_send
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
mov eax, ecx
pop esi
ret

Function at 0x42cbe0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push 0
mov eax, dword [esi]
push eax
mov eax, dword [ecx + 4]
push edx
push eax
call sub.WSOCK32.dll_recv
test eax, eax
jne 0x42cc00
pop esi
ret 8
cmp eax, 0xffffffff
jne 0x42cc0b
or eax, eax
pop esi
ret 8
mov dword [esi], eax
mov eax, 1
pop esi
ret 8
Function at 0x42cc20
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x42cc3b
xor eax, eax
pop esi
add esp, 0x10c
ret
lea edx, [esp + 4]
xor ecx, ecx
push edx
push ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
push ecx
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x18]
inc eax
push ecx
push eax
mov dword [esp + 0x20], 1
call sub.WSOCK32.dll_select
mov eax, dword [esi + 4]
lea edx, [esp + 0xc]
push edx
push eax
call sub.WSOCK32.dll___WSAFDIsSet
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x10c
ret