joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435a73
Capabilities:
Create process on windows

Disassembly:
push 0x44
push 0
push 0x4a0898
call fcn.00414350
push 0x10
push 0
push 0x4a0888
call fcn.00414350
mov ecx, dword [esp + 0x1c]
add esp, 0x18
push 0x4a0888
push 0x4a0898
push 0
push 0
push 0x20
push 0
push 0
push 0
push ecx
mov eax, 1
push 0
mov dword [0x4a0898], 0x44
mov dword [0x4a08c4], 1
mov word [0x4a08c8], ax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x435ae6
mov edx, dword [0x4a0888]
mov dword [esp + 4], edx
jmp dword [sym.imp.KERNEL32.dll_CloseHandle]
ret 4

Function at 0x435dff
Capabilities:
Parse url

Disassembly:
sub esp, 0x840
mov ecx, dword [esp + 0x858]
mov edx, dword [esp + 0x85c]
push ebx
mov ebx, dword [esp + 0x84c]
push esi
mov esi, dword [esp + 0x84c]
mov eax, 0x400
push edi
mov edi, dword [esp + 0x860]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x85c]
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x20], eax
lea eax, [esp + 0x4c]
push 0
push esi
mov dword [esp + 0x18], 0x3c
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x3c], edx
mov dword [esp + 0x44], edi
mov dword [esp + 0x4c], eax
call fcn.004143ca
add esp, 4
push eax
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x435ea5
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x840
ret 0x1c
lea edx, [esp + 0x48]
push edx
push edi
call fcn.00412518
movzx eax, word [esp + 0x2c]
mov ecx, dword [esp + 0x860]
mov dword [ecx], eax
mov eax, dword [esp + 0x20]
add esp, 8
sub eax, 1
je 0x435ef7
sub eax, 1
je 0x435ee3
pop edi
pop esi
mov dword [ebx], 3
mov al, 1
pop ebx
add esp, 0x840
ret 0x1c
pop edi
pop esi
mov dword [ebx], 2
mov al, 1
pop ebx
add esp, 0x840
ret 0x1c
pop edi
pop esi
mov dword [ebx], 1
mov al, 1
pop ebx
add esp, 0x840
ret 0x1c
Function at 0x437c1c
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x28
push esi
mov esi, dword [esp + 0x30]
push edi
test esi, esi
jl 0x437ccc
jne 0x437c3d
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
add esp, 0x28
ret
cmp esi, 0xf
jae 0x437cc5
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x18]
push eax
call edi
test eax, eax
je 0x437cc5
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x10]
push edx
call edi
fnstcw word [esp + 0x34]
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
sbb ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
fild qword [esp + 0x20]
movzx eax, word [esp + 0x34]
fild qword [esp + 0x28]
or eax, 0xc00
mov dword [esp + 8], eax
fdivp st(1)
fmul qword [0x487230]
fldcw word [esp + 8]
fistp qword [esp + 8]
mov edx, dword [esp + 8]
fldcw word [esp + 0x34]
cmp edx, esi
jb 0x437c62
pop edi
pop esi
add esp, 0x28
ret
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
add esp, 0x28
ret

Function at 0x437efa
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x29c
push esi
mov esi, dword [esp + 0x2a4]
push edi
mov edi, dword [esp + 0x2ac]
lea eax, [esp + 0x110]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x437fd9
push 0x100
lea ecx, [esp + 0x14]
push ecx
call sub.WSOCK32.dll_gethostname
lea edx, [esp + 0x10]
push edx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x437fd9
mov eax, dword [eax + 0xc]
xor edx, edx
cmp dword [eax], edx
je 0x437f63
mov ecx, eax
lea esp, [esp]
add ecx, 4
inc edx
cmp dword [ecx], 0
jne 0x437f5a
cmp esi, edx
jle 0x437f83
push str.0.0.0.0
push edi
call fcn.00412546
add esp, 8
call sub.WSOCK32.dll_WSACleanup
pop edi
pop esi
add esp, 0x29c
ret
mov eax, dword [eax + esi*4 - 4]
push 4
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00412960
mov edx, dword [esp + 0x18]
add esp, 0xc
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00414c40
lea ecx, [esp + 0x18]
push ecx
or eax, 0xffffffff
call fcn.00410200
mov esi, eax
push esi
push edi
call fcn.00412546
push esi
call fcn.00412949
add esp, 0x18
call sub.WSOCK32.dll_WSACleanup
pop edi
pop esi
add esp, 0x29c
ret
push 0x47f878
push edi
call fcn.00412546
add esp, 8
pop edi
pop esi
add esp, 0x29c
ret
Function at 0x452c43
Capabilities:
Create http request

Disassembly:
sub esp, 0x38
push ebx
mov ebx, dword [esp + 0x48]
push ebp
push esi
push edi
mov edi, dword [esp + 0x4c]
mov eax, dword [edi + 0xd8]
mov ecx, dword [edi + 0xdc]
mov edx, dword [edi + 0xd4]
mov ebp, dword [edi + 0xd0]
mov dword [esp + 0x3c], eax
mov eax, dword [edi + 0xe0]
inc dword [eax]
mov esi, dword [edi + 0xe8]
mov dword [esp + 0x44], eax
mov eax, dword [edi + 0xec]
mov dword [esp + 0x30], eax
mov eax, dword [edi + 0xf0]
mov dword [esp + 0x40], ecx
mov ecx, dword [edi + 0xe4]
inc dword [eax]
mov dword [esp + 0x34], eax
mov eax, dword [edi + 0xfc]
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x100]
mov dword [esp + 0x38], edx
mov edx, dword [edi + 0xf8]
mov dword [esp + 0x28], ecx
mov ecx, dword [edi + 0xf4]
inc dword [eax]
cmp dword [esp + 0x50], 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], eax
jne 0x452d17
mov ebp, dword [edi + 0x104]
lea edx, [edi + 0x108]
push edx
lea esi, [esp + 0x3c]
call fcn.0040ee20
lea eax, [edi + 0x118]
push eax
lea esi, [esp + 0x2c]
call fcn.0040ee20
add edi, 0x128
push edi
lea esi, [esp + 0x1c]
call fcn.0040ee20
mov esi, dword [esp + 0x2c]
push 0
cmp ebp, 1
jne 0x452d25
push 0
push 0
push ebp
jmp 0x452d3e
cmp ebp, 2
jne 0x452d38
mov ecx, dword [esp + 0x3c]
push str._local_
push ecx
push 3
jmp 0x452d3e
push 0
push 0
push 0
push str.AutoIt
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebx], eax
test eax, eax
jne 0x452d76
lea ecx, [esp + 0x18]
call fcn.0040c430
lea ecx, [esp + 0x28]
call fcn.0040c430
lea ecx, [esp + 0x38]
call fcn.0040c430
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 0xc
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 8
lea edx, [esp + 0x14]
push edx
push 0x32
push 0
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0
call edi
cmp ebp, 2
jne 0x452dc2
test esi, esi
je 0x452dc2
mov eax, dword [esp + 0x28]
mov ecx, dword [ebx]
inc esi
push esi
push eax
push 0x2b
push ecx
call edi
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebx]
inc edx
push edx
push eax
push 0x2c
push ecx
call edi
lea ecx, [esp + 0x18]
call fcn.0040c430
lea ecx, [esp + 0x28]
call fcn.0040c430
lea ecx, [esp + 0x38]
call fcn.0040c430
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x38
ret 0xc
Function at 0x41670e
Capabilities:
Set registry value

Disassembly:
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x416714
call fcn.00428690
mov edx, dword [esp + 0x28]
lea ecx, [esp]
call fcn.0041f000
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 4]
call fcn.0041f000
mov edx, dword [esp + 0x30]
lea ecx, [esp + 8]
call fcn.0041f000
mov dword [esp + 0xc], 0
call fcn.004109f4
and eax, eax
je 0x416764
mov eax, 1
jmp 0x416766
xor eax, eax
and eax, eax
je 0x416774
mov dword [esp + 0x18], 0xf013f
jmp 0x41677c
mov dword [esp + 0x18], 0xf003f
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x1c]
push 0
mov eax, 0x457024
push eax
push 0x80000000
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov ebx, eax
and ebx, ebx
jne 0x416802
lea eax, [esp + 0x14]
push eax
push dword [esp + 4]
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_RegCreateKeyW
mov ebx, eax
and ebx, ebx
jne 0x4167f9
push dword [esp + 8]
call fcn.0041ff70
mov ebx, eax
inc ebx
add ebx, ebx
push ebx
push dword [esp + 0xc]
push 2
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegSetValueExW
mov ebx, eax
and ebx, ebx
jne 0x4167f0
mov dword [esp + 0xc], 1
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
push dword [esp + 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [esp + 0xc]
jmp 0x41680a
push dword [esp + 4]
call fcn.004287c0
push dword [esp + 8]
call fcn.004287c0
push dword [esp]
call fcn.004287c0
add esp, 0x20
pop ebx
ret 0xc
Function at 0x416f04
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00428690
push dword [esp + 0x20]
call fcn.0041f380
lea edx, [esp]
push edx
push 0
push 0xb
push 1
push 2
call fcn.004282ce
push 0
push 0
call sub.KERNEL32.dll_GetSystemDirectoryW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x416f72
mov edx, 0x457024
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004287f0
pop eax
push eax
call fcn.0041f350
pop edx
add eax, edx
jmp 0x416fee
mov eax, dword [esp + 0x10]
inc eax
lea edx, [esp]
push edx
push eax
call fcn.0042841c
mov ebx, dword [esp + 0x10]
add ebx, ebx
push ebx
mov ebp, dword [esp + 4]
lea eax, [ebp]
push eax
call fcn.00421d80
push dword [esp + 0x10]
lea eax, [ebp]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryW
mov dword [esp + 0x10], eax
push edx
call fcn.004286f0
pop edx
push eax
push edx
call fcn.004286f0
pop edx
push eax
push 0x19
push 0xffffffff
mov ebp, dword [esp + 0x10]
lea eax, [ebp]
push eax
call fcn.00421ec0
mov edx, 0x45717e
push edx
call fcn.004287f0
pop eax
push eax
call fcn.0041f350
pop edx
add eax, edx
jmp 0x416fee
push eax
push dword [esp + 4]
call fcn.004284ed
pop eax
add esp, 0x14
pop ebx
pop ebp
ret

Function at 0x420a32
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x45be4c]
call fcn.004278f8
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x420b32
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x420a88
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x420a80
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x420ac8
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x420b0a
push 0x22
pop edx
cmp cx, dx
je 0x420aba
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x420aaa
xor ecx, ecx
cmp word [eax], cx
je 0x420b0a
mov ecx, eax
add eax, 2
jmp 0x420b0c
test dx, dx
je 0x420b12
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x420aba
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x420b00
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x420b0a
cmp cx, dx
je 0x420afd
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x420aed
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x420ad2
jmp 0x420aba
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x420b14
xor edx, edx
cmp dword [ebp], ebx
jne 0x420b1d
test edi, edi
jne 0x420b3a
test edx, edx
je 0x420b22
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x420a76
test edi, edi
jne 0x420b4b
mov eax, ebx
jmp 0x420b4f
test esi, esi
je 0x420b4b
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x420b4f
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x4211a0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x45b7f4], 0
jne 0x4211ae
call fcn.00421120
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x45b7f8]
call esi
test eax, eax
jne 0x4211d1
call fcn.00421120
push dword [0x45b7f8]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x4211e0
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x421240
mov ebx, 0x10
test edi, edi
jns 0x421249
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x421212
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x421260
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x45b7f4], 0
jne 0x42126e
call fcn.00421120
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x45b7f8]
call esi
mov edx, eax
test edx, edx
jne 0x421295
call fcn.00421120
push dword [0x45b7f8]
call esi
mov edx, eax
mov ebx, dword [edx]
mov esi, dword [edx + 4]
mov ebp, dword [esp + 0x14]
inc ebp
mov edi, dword [edx + ebx*4 + 0x4c]
mov eax, dword [edx + ebx*4 + 8]
mov ecx, dword [edx + esi*4 + 8]
ror edi, 0xd
add edi, dword [edx + esi*4 + 0x4c]
dec esi
ror eax, 5
add eax, ecx
mov dword [edx + ebx*4 + 8], edi
mov dword [edx + ebx*4 + 0x4c], eax
dec ebx
jns 0x4212c8
mov ebx, 0x10
test esi, esi
jns 0x4212d1
mov esi, 0x10
mov dword [edx], ebx
mov eax, edi
mov dword [edx + 4], esi
test ebp, ebp
je 0x4212e0
mul ebp
mov eax, edx
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x421502
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x42159c
push ebx
push esi
push 0x48
push 8
push dword [0x45b2ac]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 8]
mov esi, eax
xor ebx, ebx
inc ebx
or dword [esi + 4], 0xffffffff
mov dword [esi], ebx
call sub.MSVCRT.dll__wcsdup
push dword [ebp + 0x10]
mov dword [esi + 8], eax
call sub.MSVCRT.dll__wcsdup
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x40], ebx
pop ecx
pop ecx
test bl, al
je 0x42158a
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x4216ef
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x421577
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42157a
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x421582
mov edi, esi
jmp 0x42159a
push esi
call fcn.00421784
jmp 0x421599
push esi
call fcn.004215b1
push esi
mov edi, eax
call fcn.00421784
pop ecx
pop ecx
pop esi
pop ebx
mov eax, edi
pop edi
pop ebp
ret 0xc
Function at 0x4223e6
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x83c
push ebp
mov ebp, dword [esp + 0x844]
xor ecx, ecx
push esi
push edi
xor edi, edi
mov dword [esp + 0xc], ecx
inc edi
cmp word [ebp + 0x20], di
jne 0x422449
push ecx
push ecx
push dword [ebp]
call dword [sym.imp.WSOCK32.DLL_accept]
mov esi, eax
cmp esi, 0xffffffff
je 0x4225aa
lea eax, [ebp + 0x28]
push 0x18
push eax
call fcn.00428276
pop ecx
pop ecx
mov ecx, eax
mov dword [esp + 0xc], edi
mov dword [ecx], edi
mov dword [ecx + 8], esi
mov dword [ecx + 0xc], ebp
mov eax, dword [ebp + 0x24]
mov dword [0x45be7c], eax
mov dword [0x45be78], ecx
jmp 0x4225aa
cmp word [ebp + 0x22], cx
je 0x42247d
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x1c
push eax
lea eax, [esp + 0x30]
push eax
push ecx
push 0x800
lea eax, [esp + 0x58]
push eax
push dword [ebp]
call dword [sym.imp.WSOCK32.DLL_recvfrom]
mov edi, eax
mov dword [esp + 0x10], edi
jmp 0x4224a9
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x10
push eax
lea eax, [esp + 0x20]
push eax
push ecx
push 0x800
lea eax, [esp + 0x58]
push eax
push dword [ebp]
call dword [sym.imp.WSOCK32.DLL_recvfrom]
mov edi, eax
mov dword [esp + 0x10], eax
test edi, edi
jle 0x4225aa
push ebx
lea ebx, [ebp + 0x28]
mov dword [esp + 0x10], 2
mov esi, dword [ebx]
jmp 0x4224ee
xor eax, eax
cmp word [ebp + 0x22], ax
je 0x4224d3
push dword [esp + 0x1c]
lea eax, [esp + 0x34]
jmp 0x4224db
push dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0xc]
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
je 0x4224f4
mov esi, dword [esi]
test esi, esi
jne 0x4224c1
jmp 0x4224fe
lea ebx, [esi + 8]
test esi, esi
jne 0x422537
lea ebx, [ebp + 0x28]
push 0x40
push ebx
call fcn.00428276
mov ebx, eax
mov eax, dword [esp + 0x18]
pop ecx
pop ecx
mov dword [ebx], eax
lea edi, [ebx + 4]
xor eax, eax
mov dword [ebx + 0x24], ebp
cmp word [ebp + 0x22], ax
je 0x42252d
push 7
pop ecx
lea esi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x14]
jmp 0x422539
lea esi, [esp + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x422527
xor eax, eax
cmp dword [ebx + 0x2c], 0
jne 0x422567
push edi
push eax
push dword [0x45b2ac]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push edi
lea ecx, [esp + 0x50]
mov dword [ebx + 0x2c], eax
push ecx
push eax
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x34], eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x42259a
mov eax, dword [ebx + 0x30]
add eax, edi
push eax
push dword [ebx + 0x2c]
push 8
push dword [0x45b2ac]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
lea eax, [esp + 0x4c]
push edi
push eax
mov eax, dword [ebx + 0x30]
add eax, ecx
mov dword [ebx + 0x2c], ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [ebx + 0x30], edi
mov dword [0x45be78], ebx
mov ecx, dword [ebp + 0x24]
mov dword [0x45be7c], ecx
pop ebx
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x83c
ret
Function at 0x4227ad
Capabilities:
Get socket status
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x920
xor eax, eax
inc eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, ebx
cmp dword [edi], eax
jne 0x422830
mov esi, dword [edi + 8]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
lea eax, [ebp - 0x120]
mov dword [ebp - 0x11c], esi
push eax
lea eax, [esi + 1]
mov dword [ebp - 0xc], ebx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.WSOCK32.DLL_select]
test eax, eax
js 0x422827
je 0x42282c
lea eax, [ebp - 0x120]
push eax
push esi
call sub.WSOCK32.DLL___WSAFDIsSet
test eax, eax
je 0x42282c
lea eax, [ebp + 8]
push eax
push 0x4004667f
push esi
call dword [sym.imp.WSOCK32.DLL_ioctlsocket]
test eax, eax
jne 0x422827
cmp dword [ebp + 8], ebx
je 0x422827
push 2
jmp 0x422829
push 4
pop esi
jmp 0x42288a
mov esi, ebx
jmp 0x42288a
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x800
lea eax, [ebp - 0x920]
push eax
push dword [edi + 0x28]
call dword [sym.imp.WSOCK32.DLL_recvfrom]
mov dword [ebp + 8], eax
test eax, eax
jle 0x42288a
push 2
pop esi
push eax
push ebx
push dword [0x45b2ac]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
push ecx
mov dword [edi + 0x30], ecx
lea ecx, [ebp - 0x920]
push ecx
push eax
mov dword [edi + 0x2c], eax
mov dword [edi + 0x34], eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x422f21
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
lea eax, [ebp - 0x100]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0xff
push eax
mov dword [0x45be80], esi
mov dword [0x45be90], esi
mov dword [0x45be94], edi
mov dword [0x45be98], esi
call dword [sym.imp.WSOCK32.DLL_gethostname]
test eax, eax
jne 0x422fcd
cmp edi, 0x10000000
jne 0x422fa9
cmp dword [0x45b810], esi
je 0x422fcd
mov eax, dword [0x45b830]
test eax, eax
je 0x422f85
push eax
call dword [0x45b820]
mov dword [0x45b830], esi
push 0x45b830
push esi
push esi
lea eax, [ebp - 0x100]
push eax
call dword [0x45b81c]
test eax, eax
jne 0x422fcd
mov eax, dword [0x45b830]
mov dword [0x45be98], eax
jmp 0x422fca
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.WSOCK32.DLL_gethostbyname]
test eax, eax
je 0x422fcd
push 0x10
push eax
push 0x45be84
call sub.MSVCRT.dll_memcpy
add esp, 0xc
xor esi, esi
inc esi
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4230ea
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, ebx
cmp dword [esi], 1
jne 0x423110
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 8]
call dword [sym.imp.WSOCK32.DLL_recv]
mov edi, eax
jmp 0x42314d
cmp dword [esi + 0x2c], ebx
je 0x42314d
mov edi, dword [ebp + 0x10]
cmp edi, dword [esi + 0x30]
jle 0x423120
mov edi, dword [esi + 0x30]
push edi
push dword [esi + 0x34]
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0x30], edi
add esp, 0xc
add dword [esi + 0x34], edi
cmp dword [esi + 0x30], ebx
jne 0x42314d
push dword [esi + 0x2c]
push ebx
push dword [0x45b2ac]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 0x2c], ebx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4231de
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
cmp eax, 0xffffffff
jne 0x423201
lea eax, [ebp + 0xc]
push eax
push 0x4004667f
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.DLL_ioctlsocket]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x423248
push 2
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.DLL_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x423241
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2745
je 0x423245
cmp eax, 0x2746
je 0x423245
cmp eax, 0x2749
je 0x423245
cmp eax, 0x274a
je 0x423245
xor esi, esi
jmp 0x423248
test esi, esi
jne 0x423248
push 0xfffffffffffffffe
pop esi
mov eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x4235f6
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
lea eax, [ebp - 0x64]
push esi
push 0x40
push 0
push eax
call sub.MSVCRT.dll_memset
mov esi, dword [ebp + 8]
add esp, 0xc
cmp esi, 6
jne 0x423624
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
jmp 0x42367f
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x42367d
sub esi, 0
je 0x423675
dec esi
je 0x42366d
dec esi
je 0x423665
dec esi
je 0x42365d
dec esi
je 0x423655
dec esi
jne 0x42367d
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
jmp 0x423681
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
jmp 0x423681
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
jmp 0x423681
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
jmp 0x423681
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x50]
jmp 0x423681
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x58]
jmp 0x423681
xor eax, eax
xor edx, edx
pop esi
mov esp, ebp
pop ebp
ret 4