joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4058cd
Capabilities:
Check if file exists

Disassembly:
push 0x18
mov eax, 0x46ab1b
call fcn.0043eaab
lea edi, [ebp - 0x24]
call fcn.004068fc
and dword [ebp - 4], 0
mov edi, dword [ebp + 8]
lea esi, [edi + 0x4c]
mov ecx, esi
call fcn.0040141e
test eax, eax
je 0x4059a6
lea eax, [edi + 0x54]
push eax
lea ebx, [ebp - 0x24]
call fcn.00406926
mov eax, esi
call fcn.00401471
test eax, eax
je 0x4059a6
mov esi, edi
call fcn.00405ae4
push edi
call fcn.004059bb
lea ebx, [edi + 0x4c]
lea esi, [ebp - 0x10]
mov eax, ebx
call fcn.00401489
lea ecx, [ebp + 8]
push str.desctl.exe
push ecx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.004016d7
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004023f7
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004023f7
test esi, esi
push edi
je 0x405975
call fcn.00405a1c
jmp 0x40597a
call fcn.00405a80
mov ecx, ebx
call fcn.0040141e
mov eax, dword [edi + 0x54]
push dword [edi + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x58]
mov dword [ebp - 0x18], eax
mov eax, ebx
call fcn.00401471
neg eax
sbb al, al
inc al
lea ecx, [ebp - 0x24]
push eax
call fcn.004069d4
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004023f7
xor eax, eax
call fcn.0043eb83
ret 4

Function at 0x405ccd
Capabilities:
Read .ini file

Disassembly:
push 8
mov eax, 0x469ec0
call fcn.0043eaab
push 0x4713dc
lea eax, [ebp - 0x10]
push eax
call fcn.00401673
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
call fcn.00412810
pop ecx
lea edi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004018d4
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 1
jge 0x405d2e
xor esi, esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, esi
call fcn.0043eb83
ret
push str.datakxesetting.dat
lea eax, [ebp - 0x10]
push eax
call fcn.004036ef
push dword [ebp - 0x10]
push 1
push str.kxesc
push str.duba_setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
jmp 0x405d1b

Function at 0x4072cf
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
xor esi, esi
mov dword [ebp - 4], 0x288
push dword [ebp - 4]
call fcn.00436e9c
mov edi, eax
test edi, edi
pop ecx
je 0x40731c
push dword [ebp - 4]
push 0
push edi
call fcn.00437c90
add esp, 0xc
lea eax, [ebp - 4]
push eax
push edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov esi, eax
cmp esi, 0x6f
jne 0x407322
push edi
call fcn.00437d0a
pop ecx
xor edi, edi
inc ebx
cmp ebx, 2
jl 0x4072e5
test esi, esi
jne 0x407369
test edi, edi
mov esi, edi
je 0x407374
push 6
lea eax, [esi + 0x10c]
push str.vmware
push eax
call fcn.0045bc84
add esp, 0xc
test eax, eax
jne 0x40734e
mov esi, dword [esi]
test esi, esi
jne 0x40732c
jmp 0x407369
push 8
add esi, 0x194
push esi
push dword [ebp + 8]
call fcn.00437f20
add esp, 0xc
mov dword [ebp - 8], 1
test edi, edi
je 0x407374
push edi
call fcn.00437d0a
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40767d
Capabilities:
Check if file exists

Disassembly:
push 0x14
mov eax, 0x469e30
call fcn.0043eaab
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov ecx, 0x481bd4
call fcn.0040189d
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
inc edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4076f2
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.004074c6
test eax, eax
pop ecx
pop ecx
je 0x4076f2
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
lea esi, [ebp - 0x14]
call fcn.00407418
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
call fcn.004018d4
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, dword [ebp + 8]
call fcn.0043eb83
ret

Function at 0x4076fb
Capabilities:
Check if file exists

Disassembly:
push 0x10
mov eax, 0x46933b
call fcn.0043eaab
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov ecx, 0x481bd4
call fcn.0040189d
xor esi, esi
mov dword [ebp - 4], edi
inc esi
cmp dword [ebp + 0xc], edi
mov dword [ebp - 0x10], esi
je 0x40779d
push dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
call fcn.00401673
lea eax, [ebp + 0xc]
push eax
mov dword [ebp - 4], esi
call fcn.0041263a
pop ecx
lea eax, [ebp + 0xc]
push eax
call fcn.004077a6
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x407792
push dword [ebp + 0xc]
lea esi, [ebp - 0x1c]
call fcn.0041e9bb
lea eax, [ebp - 0x14]
push eax
mov eax, esi
push eax
mov byte [ebp - 4], 2
call fcn.0041eaa7
mov byte [ebp - 4], 3
mov edi, dword [ebp + 8]
call fcn.004018d4
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004023f7
mov ecx, esi
call fcn.0041e9d5
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, dword [ebp + 8]
call fcn.0043eb83
ret

Function at 0x407c20
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x407c38
mov eax, dword [esp + 4]
add eax, ecx
xor byte [eax], 0x88
inc ecx
cmp ecx, dword [esp + 8]
jl 0x407c28
ret 8

Function at 0x407dbc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
push esi
push 2
push esi
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x407e03
push esi
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x407dfc
cmp dword [ebp + 8], ebx
jne 0x407dfc
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x4083d4
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x480244]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x46928e
call fcn.0043eaab
xor ebx, ebx
push 0x206
mov dword [ebp - 4], ebx
lea eax, [ebp + 2]
mov esi, ecx
push ebx
mov dword [ebp - 0x18], ebx
push eax
mov dword [ebp - 0x1c], esi
mov word [ebp], bx
call fcn.00437c90
add esp, 0xc
mov ecx, 0x481bd4
call fcn.0040189d
xor edi, edi
inc edi
push edi
push 0x23
lea eax, [ebp]
push eax
mov dword [ebp - 4], ebx
push ebx
mov dword [ebp - 0x18], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, ebx
lea eax, [ebp]
jne 0x4084a4
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, ebx
je 0x4084eb
lea eax, [ebp]
push eax
push esi
call fcn.00401ef0
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
mov eax, esi
call fcn.0040737c
mov dword [ebp - 4], edi
mov edi, 0x472238
push edi
push eax
call fcn.00402d3a
test eax, eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
setne byte [ebp - 0xd]
add eax, 0xfffffff0
call fcn.004023f7
cmp byte [ebp - 0xd], bl
je 0x40849d
push edi
push esi
call fcn.004036ef
push str.All_UsersApplication_Data_
jmp 0x4084e5
push eax
push esi
call fcn.00401ef0
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
mov eax, esi
call fcn.0040737c
mov edi, 0x472238
push edi
push eax
mov dword [ebp - 4], 2
call fcn.00402d3a
test eax, eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
setne byte [ebp - 0xd]
add eax, 0xfffffff0
call fcn.004023f7
cmp byte [ebp - 0xd], bl
je 0x4084eb
push edi
push esi
call fcn.004036ef
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00437538
add ebp, 0x20c
leave
ret

Function at 0x409a9d
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x409ab5
mov eax, dword [esp + 4]
add eax, ecx
xor byte [eax], 0x88
inc ecx
cmp ecx, dword [esp + 8]
jl 0x409aa5
ret 8

Function at 0x409c39
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
push esi
push 2
push esi
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x409c80
push esi
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x409c79
cmp dword [ebp + 8], ebx
jne 0x409c79
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x40aa02
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
je 0x40aa8a
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 4]
push edx
push ecx
lea edx, [ebp - 8]
push edx
push ecx
mov ebx, str.svrid
push ebx
push eax
call edi
cmp dword [ebp - 8], 1
je 0x40aa40
cmp dword [ebp - 8], 2
jne 0x40aa88
push esi
mov esi, dword [ebp + 0xc]
call fcn.00401735
mov eax, dword [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.0040197a
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push 0
push ebx
push dword [eax]
call edi
test eax, eax
jne 0x40aa87
mov eax, dword [ebp - 4]
shr eax, 1
and word [esi + eax*2], 0
mov esi, dword [ebp + 0xc]
call fcn.00401780
mov dword [ebp - 0xc], 1
pop esi
pop edi
pop ebx
mov eax, dword [ebp - 0xc]
leave
ret 8

Function at 0x40aa91
Capabilities:
Set registry value

Disassembly:
push edi
xor edi, edi
cmp dword [esi], edi
je 0x40aac0
push dword [esp + 8]
call fcn.00437547
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0xc]
push 1
push edi
push str.svrid
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40aac0
inc edi
mov eax, edi
pop edi
ret 4

Function at 0x40af5b
Capabilities:
Read .ini file

Disassembly:
push 4
mov eax, 0x469d42
call fcn.0043eaab
lea eax, [ebp - 0x10]
push eax
call fcn.00412810
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [esp], str.ressrcchsuplive.svr
push eax
call fcn.004036ef
push dword [ebp - 0x10]
push 0
push str.TryNo
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, esi
call fcn.0043eb83
ret
Function at 0x40afae
Capabilities:
Read .ini file

Disassembly:
push ebp
sub esp, 0xc8
lea ebp, [esp - 4]
mov eax, dword [0x480244]
xor eax, ebp
mov dword [ebp + 0xc8], eax
push 0x18
mov eax, 0x469d12
call fcn.0043eaab
mov edi, 0x481bd4
xor ebx, ebx
mov ecx, edi
lea esi, [ebp - 0x20]
mov dword [ebp - 0x24], ebx
call fcn.0040189d
mov ecx, edi
lea esi, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.0040189d
push 0xc6
lea eax, [ebp + 2]
push ebx
mov byte [ebp - 4], 1
push eax
mov word [ebp], bx
call fcn.00437c90
add esp, 0xc
mov ecx, edi
lea esi, [ebp - 0x18]
call fcn.0040189d
mov ecx, edi
lea esi, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0040189d
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 3
call fcn.00412810
pop ecx
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.004018d4
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, edi
call fcn.004077ee
mov eax, edi
lea edi, [ebp - 0x20]
call fcn.004018d4
push str.ressrcchsuplive.svr
lea eax, [ebp - 0x14]
push eax
call fcn.004036ef
push str.ressrcchskismain.ini
mov eax, edi
push eax
call fcn.004036ef
push dword [ebp - 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x64
lea eax, [ebp]
push eax
mov esi, 0x4713dc
push esi
push str.Version
push str.Common
call ebx
test eax, eax
je 0x40b163
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00401ef0
lea eax, [ebp - 0x10]
call fcn.004077ee
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push 2
pop ecx
call fcn.004045b1
lea edi, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.004018d4
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004023f7
push esi
push 0x4734f8
mov eax, edi
push eax
call fcn.0040b45b
push esi
push 0x4734fc
mov eax, edi
push eax
call fcn.0040b45b
push dword [ebp - 0x20]
lea eax, [ebp]
push 0x64
push eax
push esi
push 0x4732f4
push str.infos
call ebx
test eax, eax
je 0x40b163
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00401ef0
lea eax, [ebp - 0x1c]
push eax
push 6
pop ecx
lea eax, [ebp - 0x10]
call fcn.0040737c
mov byte [ebp - 4], 6
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
mov eax, edi
call fcn.00403731
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004023f7
push dword [ebp - 0x18]
call fcn.00438abd
pop ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc8]
xor ecx, ebp
call fcn.00437538
add ebp, 0xcc
leave
ret
Function at 0x40b794
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 4
mov eax, 0x469c47
call fcn.0043eaab
lea eax, [ebp - 0x10]
push eax
call fcn.0040b653
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x10]
mov dword [esp], 0x473598
push eax
call fcn.004036ef
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40b7de
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, esi
call fcn.0043eb83
ret
push dword [ebp - 0x10]
push esi
push str.Channel
push str.Other
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
jmp 0x40b7cb

Function at 0x40ba17
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push 4
mov eax, 0x469bf9
call fcn.0043eaab
lea eax, [ebp - 0x10]
push eax
xor esi, esi
call fcn.0040b653
mov dword [ebp - 4], esi
lea eax, [ebp - 0x10]
mov dword [esp], 0x4735e0
push eax
call fcn.004036ef
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ba64
push dword [ebp - 0x10]
push esi
push str.TryNo
push str.common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, esi
call fcn.0043eb83
ret

Function at 0x40ba77
Capabilities:
Check if file exists

Disassembly:
push 4
mov eax, 0x469bd6
call fcn.0043eaab
lea eax, [ebp - 0x10]
push eax
call fcn.0040b653
pop ecx
and dword [ebp - 4], 0
mov edi, dword [ebp + 8]
add edi, 8
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x40badc
push str.dgver.dll
lea eax, [ebp - 0x10]
push eax
call fcn.004036ef
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40badc
push dword [ebp - 0x10]
lea eax, [ebp + 8]
push eax
call fcn.00405df3
pop ecx
pop ecx
mov byte [ebp - 4], 1
call fcn.004018d4
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004023f7
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004023f7
call fcn.0043eb83
ret 4
Function at 0x40d0f2
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x480244]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
add edi, 4
mov eax, dword [edi]
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x18], edi
je 0x40d11e
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov dword [edi], esi
push 0x20
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.00437c90
add esp, 0xc
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], esi
call dword [0x480010]
cmp dword [ebp + 8], esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], esi
je 0x40d193
push dword [ebp + 8]
call ebx
mov edi, eax
inc edi
push esi
mov eax, edi
cdq
push 2
push edx
push eax
mov dword [ebp - 0xc], edi
call fcn.004562d0
cmp edx, esi
jg 0x40d18a
jl 0x40d179
cmp eax, 0x7fffffff
ja 0x40d18a
push edx
push eax
lea ecx, [ebp - 0xc]
call fcn.00412024
mov edi, dword [ebp - 0xc]
pop ecx
pop ecx
jmp 0x40d18f
mov eax, 0x80070057
cmp eax, esi
jge 0x40d198
mov dword [ebp - 0x10], esi
jmp 0x40d1d2
cmp edi, 0x400
jg 0x40d1b6
push edi
call fcn.00411faf
test al, al
pop ecx
je 0x40d1b6
mov eax, edi
call fcn.004466a0
mov eax, esp
jmp 0x40d1bf
push edi
lea esi, [ebp - 8]
call fcn.00411f44
push dword [ebp - 0x14]
mov esi, eax
push edi
push dword [ebp + 8]
call fcn.004097f0
mov dword [ebp - 0x10], eax
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x40d216
push dword [ebp + 0xc]
call ebx
mov edi, eax
inc edi
push esi
mov eax, edi
cdq
push 2
push edx
push eax
mov dword [ebp - 0xc], edi
call fcn.004562d0
cmp edx, esi
jg 0x40d20d
jl 0x40d1fc
cmp eax, 0x7fffffff
ja 0x40d20d
push edx
push eax
lea ecx, [ebp - 0xc]
call fcn.00412024
mov edi, dword [ebp - 0xc]
pop ecx
pop ecx
jmp 0x40d212
mov eax, 0x80070057
cmp eax, esi
jge 0x40d21a
xor eax, eax
jmp 0x40d251
cmp edi, 0x400
jg 0x40d238
push edi
call fcn.00411faf
test al, al
pop ecx
je 0x40d238
mov eax, edi
call fcn.004466a0
mov eax, esp
jmp 0x40d241
push edi
lea esi, [ebp - 8]
call fcn.00411f44
push dword [ebp - 0x14]
mov esi, eax
push edi
push dword [ebp + 0xc]
call fcn.004097f0
xor esi, esi
cmp dword [ebp - 0x10], esi
je 0x40d289
cmp eax, esi
je 0x40d289
push dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
push ecx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
cmp dword [ebp - 8], esi
mov ebx, eax
je 0x40d285
mov eax, dword [ebp - 8]
mov edi, dword [eax]
push eax
mov dword [ebp - 8], edi
call fcn.00438ede
cmp edi, esi
pop ecx
jne 0x40d272
mov eax, ebx
jmp 0x40d2ac
push 8
call dword [sym.imp.WS2_32.dll_WSASetLastError]
cmp dword [ebp - 8], esi
je 0x40d2a9
mov eax, dword [ebp - 8]
mov edi, dword [eax]
push eax
mov dword [ebp - 8], edi
call fcn.00438ede
cmp edi, esi
pop ecx
jne 0x40d296
or eax, 0xffffffff
lea esp, [ebp - 0x48]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00437538
leave
ret 8
Function at 0x40d316
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x481b40]
test eax, eax
je 0x40d331
push 0x4819b0
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x481b40], eax
xor ecx, ecx
test eax, eax
sete cl
mov al, cl
ret

Function at 0x40d4d1
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
xor ebx, ebx
cmp byte [esi + 0x44], bl
je 0x40d4e3
mov al, 1
jmp 0x40d555
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
mov byte [ebp - 1], 1
jne 0x40d4f3
xor al, al
jmp 0x40d555
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x40d54f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x40d549
push dword [esi + 0x4c]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40d54c
push 0x2c
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.00437c90
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
push ebx
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x40d54f
mov dword [esi + 0x48], eax
mov byte [ebp - 1], bl
mov al, byte [ebp - 1]
mov byte [esi + 0x44], al
pop ebx
leave
ret 8

Function at 0x40d55a
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
push dword [esi + 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xc]
call edi
test eax, eax
je 0x40d581
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x40d628
push ebx
xor ebx, ebx
push ebx
push dword [esi + 8]
call edi
cmp eax, 0x102
jne 0x40d59f
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x40d627
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
lea eax, [esi + 0x28]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 8]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x40d5e7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x40d619
push dword [esi + 0x4c]
push dword [esi + 8]
call edi
test eax, eax
jne 0x40d61c
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x40]
mov dword [ebp + 0xc], ebx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x40d613
mov bl, 1
jmp 0x40d61c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
pop edi
leave
ret 0xc
Function at 0x40d648
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push dword [esi + 0x4c]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40d66c
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x40d734
push ebx
xor ebx, ebx
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
jne 0x40d68e
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x40d733
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [edi]
push 0x14
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push ebx
push eax
mov dword [edi], ebx
mov dword [ebp - 4], ebx
call fcn.00437c90
lea eax, [esi + 0x10]
add esp, 0xc
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi + 4]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
push edi
push 1
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x40d6f1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x40d725
push dword [esi + 0x4c]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40d728
lea eax, [ebp - 4]
push eax
push ebx
push edi
lea eax, [ebp - 0x20]
push eax
push dword [esi + 0x40]
mov dword [ebp - 4], ebx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x40d71f
mov bl, 1
jmp 0x40d728
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
pop ebx
leave
ret 4

Function at 0x40dae2
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x40dafa
mov eax, dword [esp + 4]
add eax, ecx
xor byte [eax], 0x88
inc ecx
cmp ecx, dword [esp + 8]
jl 0x40daea
ret 8

Function at 0x40dbe6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
push esi
push 2
push esi
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40dc2d
push esi
lea eax, [ebp + 8]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40dc26
cmp dword [ebp + 8], ebx
jne 0x40dc26
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
ret 8