joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008f33
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x1b9
cmp dword [ebp - 0x18], 0x259c
jle 0x10008f98
test eax, 0x47d0bbe0
std
fst dword [edx]
cmp eax, 0x16a31aab
stosb byte es:[edi], al
int1
dec esp
sbb ah, byte [ebx + 0x4cf1aa16]
mov dh, byte [0x91235e98]
int 0x49
sbb byte [edi], bl
salc
xchg esi, eax
salc
dec ebp
jp 0x10008f9b
sar dword ss:[eax], 0x27
pop edx
loop 0x10008f8e
lds eax, [ecx - 0x5d]
dec esi
jbe 0x10008f57
ljmp 0x9e31:0x6d273309
out 0x72, al
invalid
mov dword [ebp - 0xc], 0x1f
jmp 0x10008fa8
pop ds
add byte [eax], al
add bl, ch
pop es
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x1000929e
mov dword [ebp - 0x1c], 0xde8
cmp dword [ebp - 0x1c], 0x220f
jle 0x100090c0
invalid
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 8]
je 0x100090d3
mov byte [ebp - 1], 1
jmp 0x100090d7
add ebx, ebp
add al, 0xc6
inc ebp
inc dword [eax]
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov byte [ebp - 3], al
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
shl eax, cl
and eax, dword [ebp + 0xc]
je 0x100090f0
mov byte [ebp - 2], 1
jmp 0x100090f4
mov byte [ebp - 2], 0
mov al, byte [ebp - 2]
mov byte [ebp - 4], al
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
and eax, ecx
je 0x1000910c
and dword [ebp - 0x14], 0
jmp 0x10009119
movzx eax, byte [ebp - 3]
movzx ecx, byte [ebp - 4]
or eax, ecx
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 0x14]
mov byte [ebp - 5], al
mov dword [ebp - 0x20], 0x10a4
cmp dword [ebp - 0x20], 0x209d
jle 0x100091ba
jns 0x10009186
jne 0x100090d0
mov esi, 0x495681b5
sbb edi, dword [ebx + 0x19cc0074]
int 0xbc
xchg esi, eax
fstpnce st(7), st(0)
lodsb al, byte [esi]
cmp dh, byte [eax]
or byte [ecx + 0x1d], 0xd2
fsubr dword [eax - 0x6d595c0e]
and eax, 0x3b0718e7
dec esp
cdq
stosb byte es:[edi], al
cmp dword [edx + esi*4 - 0x4d92da30], esp
invalid
mov byte [ebx], dh
test dword [esi + 0x24dd38c0], edx
dec esi
invalid
inc edx
push ecx
mov ah, 0x75
add byte [edx - 0x28e454cf], bh
test edx, esp
pop ds
jle 0x100091e0
push ebp
sbb edx, eax
lodsd eax, dword [esi]
mov eax, dword [0x25280462]
fsubr st(6), st(0)
adc byte [edx - 0x7ef1e57f], ah
jmp 0x10009174
mov eax, dword [ebp - 0x10]
shl eax, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0x4e2
cmp dword [ebp - 0x24], 0x26ba
jle 0x1000928f
adc bl, ah
inc esi
sbb eax, edi
invalid
add eax, 0xa47e7607
inc edi
cld
rcl dword [0xc97e9404], 0x27
clc
fadd dword [edx + ecx*8 + 0x6bd855c6]
out 0xb6, eax
xchg byte [edx], ch
test dword [eax - 0x47419f73], 0x7846ab8b
push ecx
pushfd
xchg esp, eax
mov al, byte [0xbdca95fa]
mov bh, 0x85
mov al, byte [0xc63edd13]
and eax, 0x40d2d1a
xor bh, 0x27
adc eax, 0x288650a4
aas
invalid
movzx eax, byte [ebp - 5]
or eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
jmp 0x10008fa1
mov dword [ebp - 0x28], 0x734
cmp dword [ebp - 0x28], 0x1eb4
jle 0x10009308
iretd
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x1000936c
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x136c
call fcn.1007b470
push esi
push edi
mov dword [ebp - 0xc8], 0xfffffff9
mov dword [ebp - 0x2dc], 0
jmp 0x1000939e
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 2
jge 0x100093ba
mov eax, dword [ebp - 0x2dc]
mov dword [ebp + eax*4 - 0x418], 0x56834504
jmp 0x10009391
mov dword [ebp - 0xc8], 1
jmp 0x100093d3
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x10009479
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp + eax*4 - 0x418]
mov dword [ebp - 0x119c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x418]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x418]
mov ecx, dword [ebp - 0xc8]
cmp eax, dword [ebp + ecx*4 - 0x418]
jle 0x10009429
mov dword [ebp - 0x894], 1
jmp 0x10009430
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0xc8]
mov ecx, 0x526d2e85
sub ecx, dword [ebp + eax*4 - 0x418]
sub ecx, dword [ebp - 0x894]
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x418], ecx
mov byte [ebp - 0x13e], 0
movzx eax, byte [ebp - 0x13e]
test eax, eax
je 0x10009474
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
jmp 0x100093c6
mov byte [ebp - 0x117], 0
movzx eax, byte [ebp - 0x117]
test eax, eax
je 0x10009493
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0xbf8], 9
mov dword [ebp - 0x1cc], 0xebd004dd
mov dword [ebp - 0xd3c], 0xfffffffb
mov dword [ebp - 0x2e4], 0
jmp 0x100094d1
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 3
jge 0x100094ed
mov eax, dword [ebp - 0x2e4]
mov dword [ebp + eax*4 - 0x458], 0x624039b6
jmp 0x100094c4
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x10009507
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x20], 0
jmp 0x10009517
Function at 0x100328e7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 1
call fcn.100322fc
add esp, 0xc
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10032917
xor eax, eax
jmp 0x10032a75
lea eax, [ebp - 0x10]
push eax
push 1
push 0x111d
push 0x73e8
push 0x7d78
push 0x4f5e
lea eax, [ebp - 8]
push eax
push 0x7889
lea eax, [ebp + 8]
push eax
call fcn.1003234d
add esp, 0x24
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10032958
xor eax, eax
jmp 0x10032a75
push 0x2e59
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
call fcn.100326fa
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x1003297c
xor eax, eax
jmp 0x10032a75
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x7c3c
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x574f
call fcn.100321b4
add esp, 0x20
push 0x3d
push 0x4685
push dword [ebp + 8]
push 0
push 0x6e94
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.1002f60d
add esp, 0x1c
lea eax, [ebp - 0x14]
push eax
push 0x4f14
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
call fcn.100327f2
add esp, 0x14
cmp dword [ebp - 0x14], 0
je 0x100329f7
push 1
push 0x7618
push dword [ebp - 0x14]
push dword [ebp - 4]
call fcn.1002c5d5
add esp, 0x10
push dword [ebp - 4]
call fcn.10031d89
pop ecx
test eax, eax
jne 0x10032a08
xor eax, eax
jmp 0x10032a75
push 1
push 0x1303
lea eax, [ebp - 4]
push eax
call fcn.10032890
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10032a5d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10032a3a
xor eax, eax
jmp 0x10032a75
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10032a53
xor eax, eax
jmp 0x10032a75
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10032a6e
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10032a72
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x100475c2
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10047602
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0xf
push 5
call fcn.10044111
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov dword [ecx + 4], eax
jmp 0x10047611
push 0xd14
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret

Function at 0x10047d77
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10047dae
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
add eax, dword [ecx]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x10047dbb
push 0x247
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x1007b27e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10083330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006c02c
mov dword [ebp - 0x14], eax
cmp dword [0x152288e4], esi
jne 0x1007b371
push 0x800
push esi
push 0x10007c04
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007b2fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007b451
push esi
push esi
push 0x10007c04
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007b451
push 0x10007c1c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007b451
push eax
call ebx
push 0x10007c28
push edi
mov dword [0x152288e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007c38
push edi
mov dword [0x152288e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007c4c
push edi
mov dword [0x152288ec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x152288f4], eax
test eax, eax
je 0x1007b36e
push 0x10007c68
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x152288f0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007b396
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007b389
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007b3ab
push 4
pop eax
jmp 0x1007b453
cmp dword [ebp - 0x14], esi
je 0x1007b3ab
push dword [0x152288e4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007b390
mov eax, dword [0x152288f0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007b409
cmp dword [0x152288f4], edi
je 0x1007b409
push eax
call ebx
push dword [0x152288f4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007b409
test eax, eax
je 0x1007b409
call ecx
test eax, eax
je 0x1007b3fe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007b3fe
test byte [ebp - 8], 1
jne 0x1007b409
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007b439
mov eax, dword [0x152288e8]
cmp eax, edi
je 0x1007b436
push eax
call ebx
test eax, eax
je 0x1007b436
call eax
mov esi, eax
test esi, esi
je 0x1007b436
mov eax, dword [0x152288ec]
cmp eax, edi
je 0x1007b436
push eax
call ebx
test eax, eax
je 0x1007b436
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x152288e4]
call ebx
test eax, eax
je 0x1007b451
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007b453
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10068222
mov esp, ebp
pop ebp
ret
Function at 0x807d19
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
lea eax, [ebp - 0x140]
push 0x100
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x807d7f
mov eax, dword [eax + 0xc]
push esi
lea ecx, [ebp - 0x40]
xor esi, esi
sub ecx, eax
mov edx, dword [eax]
test edx, edx
je 0x807d7a
mov edx, dword [edx]
inc esi
mov dword [ecx + eax], edx
add eax, 4
cmp esi, 0x10
jl 0x807d50
jmp 0x807d7a
mov eax, dword [ebp + esi*4 - 0x44]
dec esi
test eax, eax
je 0x807d7a
push eax
push dword [ebp + 8]
call fcn.00807545
pop ecx
pop ecx
test esi, esi
jg 0x807d66
pop esi
leave
ret

Function at 0x807d81
Capabilities:
Create tcp socket
Create thread
Create udp socket
Start tcp server

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x2c
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
push 0x2c
push 0
push esi
mov dword [0x808244], esi
call sub.MSVCRT.dll_memset
call fcn.008071e7
push esi
mov dword [esi + 0x24], eax
call fcn.00807d19
push esi
call fcn.00807c77
push esi
call fcn.00807400
push esi
call fcn.008074a2
mov edi, dword [sym.imp.WS2_32.dll_htons]
and dword [esi + 4], 0
add esp, 0x20
mov word [esi], 2
push 0x412
call edi
mov ebx, dword [sym.imp.WS2_32.dll_socket]
push 6
push 1
push 2
mov word [esi + 2], ax
call ebx
mov ebp, dword [sym.imp.WS2_32.dll_bind]
jmp 0x807e23
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov word [esi], 2
and dword [esi + 4], 0
push 0x412
call edi
push 6
push 1
push 2
mov word [esi + 2], ax
call ebx
push 0x10
push esi
push eax
mov dword [esi + 0x10], eax
call ebp
test eax, eax
jne 0x807df3
push bind
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_listen]
mov ebp, dword [sym.imp.KERNEL32.DLL_CreateThread]
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
push ebx
push esi
push 0x807b7a
push ebx
push ebx
call ebp
push 0x1c
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
push 0x1c
push ebx
push edi
call sub.MSVCRT.dll_memset
add esp, 0x10
lea eax, [edi + 0x18]
mov dword [edi], esi
mov dword [eax], 0x10
push eax
lea eax, [edi + 8]
push eax
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_accept]
cmp eax, ebx
mov dword [edi + 4], eax
jg 0x807e9e
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
jmp 0x807e56
lea eax, [esp + 0x10]
push eax
push ebx
push edi
push 0x80783e
jmp 0x807e52

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x404070
Capabilities:
Check for sandbox and av modules

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x404102
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.sbiedll.dll
call esi
test eax, eax
jne 0x404102
push str.sbieDll.dll
call esi
test eax, eax
jne 0x404102
push str.vboxhook.dll
call esi
test eax, eax
jne 0x404102
push str.VBoxHook.dll
call esi
test eax, eax
jne 0x404102
push str.vmcheck.dll
call esi
test eax, eax
jne 0x404102
push str.vmsrvc.dll
call esi
test eax, eax
jne 0x404102
push str.vmtools.dll
call esi
test eax, eax
jne 0x404102
push str.vgauth.dll
call esi
test eax, eax
jne 0x404102
push str.vmhgfs.dll
call esi
test eax, eax
jne 0x404102
push str.vmguestlib.dll
call esi
test eax, eax
jne 0x404102
push str.vmhgfs.dll
call esi
test eax, eax
jne 0x404102
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
Function at 0x406070
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, edx
push esi
push edi
mov edi, ecx
cmp dword [ebx], 0
jne 0x406087
mov dword [ebx], edi
cmp dword [ebx + 4], 0
jne 0x406094
mov dword [ebx + 4], 0x400
mov eax, dword [ebx + 8]
or eax, dword [ebx + 0xc]
jne 0x4060b3
mov eax, dword [0x44f624]
inc eax
mov dword [0x44f624], eax
mov eax, dword [0x44f624]
cdq
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
lea eax, [edi + 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0xcc]
cmp eax, 0xffffffff
jne 0x40610f
lea esi, [edi + 0xc8]
push esi
push ecx
call fcn.004096c0
add esp, 8
test eax, eax
jne 0x406287
mov edx, dword [esi]
mov ecx, edi
call fcn.00406b70
mov esi, eax
mov ecx, esi
mov dword [esi + 0xa8], 0x405f00
call fcn.00407da0
mov dword [esi + 0x20], 3
inc dword [edi + 0x3c]
mov eax, dword [edi + 0xcc]
push 0
push 1
push 0x4495c4
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x406287
cmp dword [edi + 0xd8], 0
jne 0x406182
mov dword [edi + 0xdc], 0
mov dword [edi + 0xd4], 0
mov dword [edi + 0xd8], 0x10
lock inc dword [0x44f628]
push 0x280
call fcn.0042ff7c
mov esi, eax
add esp, 4
test esi, esi
je 0x40629b
push 0x280
push 0
push esi
call fcn.0042a720
add esp, 0xc
mov dword [edi + 0xd0], esi
mov esi, dword [edi + 0xd4]
mov ecx, dword [edi + 0xd8]
cmp esi, ecx
jne 0x40621f
lea edx, [ecx + ecx]
mov eax, 0x10
test edx, edx
cmove edx, eax
lea eax, [ecx + ecx*4]
shl eax, 3
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0xd0]
lea esi, [edx + edx*4]
mov dword [esp + 0x14], edx
shl esi, 3
lock inc dword [0x44f628]
test eax, eax
je 0x4061cf
lock inc dword [0x44f62c]
push esi
push eax
call fcn.0042c81e
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4061eb
push str.realloc_failed__n
jmp 0x4062a0
mov ecx, dword [esp + 0xc]
cmp esi, ecx
jbe 0x406207
sub esi, ecx
add eax, ecx
push esi
push 0
push eax
call fcn.0042a720
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov edx, dword [edi + 0xdc]
mov dword [edi + 0xd0], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 0xd8], eax
jmp 0x406255
mov edx, dword [edi + 0xdc]
lea eax, [edx + esi]
cmp eax, ecx
jne 0x406255
mov ecx, dword [edi + 0xd0]
lea eax, [esi + esi*4]
shl eax, 3
push eax
lea eax, [edx + edx*4]
lea eax, [ecx + eax*8]
push eax
push ecx
call fcn.0042b1a0
add esp, 0xc
mov dword [edi + 0xdc], 0
xor edx, edx
mov eax, dword [edi + 0xd4]
movups xmm0, xmmword [ebx]
add eax, edx
lea ecx, [eax + eax*4]
mov eax, dword [edi + 0xd0]
movups xmmword [eax + ecx*8], xmm0
movups xmm0, xmmword [ebx + 0x10]
movups xmmword [eax + ecx*8 + 0x10], xmm0
movq xmm0, qword [ebx + 0x20]
movq qword [eax + ecx*8 + 0x20], xmm0
inc dword [edi + 0xd4]
lea eax, [edi + 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.malloc_failed__n
push 2
call fcn.0042c79a
add esp, 4
push eax
call fcn.00408c50
add esp, 8
push 0xffffffffffffffff
call fcn.00431995
int3
Function at 0x4075d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], 0x1c
lea eax, [ebp - 4]
push eax
push dword [esi + 0x44]
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jns 0x40760d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, esi
mov dword [esi + 0x34], eax
call fcn.00408130
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1c
push eax
push dword [esi + 0x40]
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp dword [esi + 0x28], 0x1000000
jne 0x407744
mov ebx, dword [esi + 0xf8]
test ebx, ebx
jne 0x4076a6
mov eax, dword [esi + 0xfc]
test eax, eax
jne 0x40767a
mov eax, dword [0x44f638]
test eax, eax
jne 0x40767a
call fcn.0040abc0
or dword [esi + 0x24], 0x8000
mov dword [esi + 0xfc], eax
test eax, eax
jne 0x40767a
mov eax, 0x411
mov ecx, esi
mov dword [esi + 0x34], eax
call fcn.00408130
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x30]
mov ecx, eax
call fcn.0040aff0
mov ebx, eax
test ebx, ebx
jne 0x4076a0
mov eax, 0x412
mov ecx, esi
mov dword [esi + 0x34], eax
call fcn.00408130
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0xf8], ebx
mov eax, dword [esi + 0x100]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x407734
mov edi, eax
lea ecx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x4076c0
sub edi, ecx
cmp edi, 0xff
ja 0x407734
mov edx, dword [ebx + 0xc0]
test edx, edx
je 0x407705
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4076e3
sub ecx, dword [ebp - 8]
je 0x4076fc
mov eax, edx
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4076f1
push edx
call fcn.0042f371
add esp, 4
lea eax, [edi + 1]
push eax
push 1
call fcn.0042c694
add esp, 8
mov dword [ebx + 0xc0], eax
test eax, eax
je 0x407734
push edi
push dword [ebp - 0xc]
push eax
call fcn.0042b1a0
mov eax, dword [ebx + 0xc0]
add esp, 0xc
mov byte [edi + eax], 0
push esi
call fcn.00407210
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0xd8]
test ecx, ecx
je 0x407767
call fcn.004069f0
mov dword [esi + 0xd8], 0
mov dword [esi + 0xbc], 0
or dword [esi + 0x24], 0x10
mov eax, dword [esi + 0xb8]
test eax, eax
je 0x40777b
push esi
call eax
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4077b0
Capabilities:
Get local ipv4 addresses
Get socket information
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov eax, dword [esi + 0x28]
cmp eax, 0x2000
jg 0x407826
je 0x4077d7
cmp eax, 0x100
je 0x4077d7
cmp eax, 0x1000
jne 0x407838
mov edx, dword [esi + 0x44]
mov edi, 0x10
mov ecx, 0x1c
cmp word [edx], 2
cmove ecx, edi
push ecx
push edx
push 0
push dword [ebp + 8]
push ebx
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_sendto]
mov edi, eax
mov eax, dword [esi + 0x40]
cmp word [eax + 2], 0
jne 0x40781d
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0x1c
push ecx
push eax
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_getsockname]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x100000
je 0x407905
cmp eax, 0x1000000
je 0x40784e
push dword [ebp + 8]
push ebx
push dword [esi + 0x30]
call fcn.00434fd8
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esi + 0xf8]
test esi, esi
je 0x4078f9
cmp dword [esi], 0
je 0x4078f9
cmp dword [esi + 4], 0x1b
je 0x40787a
mov ecx, esi
call fcn.0040bc80
test eax, eax
jne 0x407914
mov ecx, dword [esi + 0x40]
mov eax, 0x4000
mov edi, dword [ebp + 8]
test ecx, ecx
je 0x407898
cmp dword [ecx + 0x34], 0x304
mov edx, 0x3fff
cmove eax, edx
cmp edi, eax
cmova edi, eax
cmp dword [esi + 0xb4], 0
je 0x4078bc
mov ecx, esi
call fcn.0040e180
test eax, eax
je 0x40781d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0xb0], edi
mov dword [esi + 0xac], 0x17
test edi, edi
je 0x4078e0
push edi
push ebx
push dword [esi + 0xa8]
call fcn.0042b1a0
add esp, 0xc
mov edx, 1
mov ecx, esi
call fcn.0040e220
test eax, eax
jne 0x407914
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xffff8f00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push dword [ebp + 8]
push ebx
push dword [esi + 0x30]
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret