joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444d30
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x444d63
push esi
call fcn.00447e30
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x444d5c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x444de9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x444dd2
mov eax, dword [esi + 8]
test eax, eax
je 0x444d87
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x444dce
cmp eax, 2
je 0x444dd2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x444d7a
cmp eax, 3
je 0x444dad
cmp eax, 1
jne 0x444d7a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x444d7a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x444d7a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00444e10
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x444df8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00444e10
add esp, 4
pop esi
ret

Function at 0x4639e9
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x463a21
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00461a9d
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00461a75
jmp 0x463a2d
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4650db
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x46511d
call fcn.0046ac90
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x46511d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x465114
xor eax, eax
jmp 0x465125
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0046512b
pop edi
pop esi
pop ebx
ret 4

Function at 0x46b1c0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46b1ee
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46b20c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0046b126
jmp 0x46b20c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46b20c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0046b126
test edi, edi
mov eax, edi
jne 0x46b1f6
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x403e60
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x190
push esi
push 0xfe
push 0x434064
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [esp + 0x1a0]
push ecx
call fcn.004037e0
add esp, 4
test al, al
je 0x403f7c
lea edx, [esp + 4]
push edx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x1840
call fcn.00404347
add esp, 4
test eax, eax
je 0x403ec0
mov ecx, eax
call fcn.00401250
mov esi, eax
jmp 0x403ec2
xor esi, esi
push esi
push 0x403e50
call dword [sym.imp.zlnetsdk.dll_Ordinal_1]
test eax, eax
je 0x403f7c
test esi, esi
je 0x403f70
mov cx, word [0x42f488]
mov eax, dword [esi]
push str.123456
push str.admin
push ecx
push str.192.168.1.88
mov ecx, esi
call dword [eax + 0x7c]
test al, al
je 0x403f5e
mov ecx, 0x434168
call fcn.0040d5b0
mov ecx, 0x434168
mov dword [0x434184], esi
call fcn.0040d5c0
mov al, byte [0x4344f8]
test al, al
jne 0x403f40
mov ecx, esi
call fcn.00401590
push 0x3e8
call fcn.0040d110
mov al, byte [0x4344f8]
add esp, 4
test al, al
je 0x403f23
mov ecx, 0x434168
call fcn.0040d5b0
mov ecx, 0x434168
mov dword [0x434184], 0
call fcn.0040d5c0
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x80]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
call dword [sym.imp.zlnetsdk.dll_Ordinal_2]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop esi
add esp, 0x190
ret 0x10

Function at 0x40caf0
Capabilities:
Create udp socket

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0xffffffff
je 0x40cafe
mov al, 1
pop esi
ret 4
mov eax, dword [esp + 8]
push 0
push eax
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi], eax
setne al
pop esi
ret 4

Function at 0x40cc40
Capabilities:
Connect socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x110
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ioctlsocket]
push esi
mov esi, ecx
lea eax, [esp + 8]
push edi
mov ecx, dword [esi]
push eax
mov edi, 1
push 0x8004667e
push ecx
mov dword [esp + 0x18], edi
call ebx
mov edx, dword [esp + 0x120]
mov eax, dword [esi]
push 0x10
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, dword [esi]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ecx
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x20]
mov edx, dword [esp + 0x124]
mov dword [esp + 0x14], eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push 0
push ecx
push 0
push 2
mov dword [esp + 0x24], edx
call dword [sym.imp.WS2_32.dll_select]
lea edx, [esp + 0xc]
mov edi, eax
mov eax, dword [esi]
push edx
push 0x8004667e
push eax
mov dword [esp + 0x18], 0
call ebx
test edi, edi
pop edi
pop esi
setg al
pop ebx
add esp, 0x110
ret 8
Function at 0x40cd10
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
push esi
mov esi, ecx
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x40cd2c
or eax, eax
pop esi
add esp, 0x10c
ret 0xc
push edi
mov dword [esp + 0x14], eax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x10], 1
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x120]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push 0
push edx
push 0
push 2
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
pop edi
jg 0x40cd80
xor eax, eax
pop esi
add esp, 0x10c
ret 0xc
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x114]
mov edx, dword [esi]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
pop esi
add esp, 0x10c
ret 0xc

Function at 0x40cde0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
push esi
mov esi, ecx
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x40ce82
push edi
mov dword [esp + 0x14], eax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x10], 1
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x120]
lea ecx, [esp + 8]
push ecx
push 0
lea edx, [esp + 0x18]
push 0
push edx
push 2
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
pop edi
jg 0x40ce48
xor eax, eax
pop esi
add esp, 0x10c
ret 0xc
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x114]
mov edx, dword [esi]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jge 0x40ce80
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
pop esi
neg eax
sbb eax, eax
add esp, 0x10c
ret 0xc
jne 0x40ce85
or eax, 0xffffffff
pop esi
add esp, 0x10c
ret 0xc

Function at 0x40ce90
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
push esi
mov esi, ecx
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x40ceac
or eax, eax
pop esi
add esp, 0x10c
ret 0xc
push edi
mov dword [esp + 0x14], eax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x10], 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
push 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x128]
push 0
push edx
push 2
mov dword [esp + 0x20], eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
pop edi
jg 0x40cefc
xor eax, eax
pop esi
add esp, 0x10c
ret 0xc
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x114]
mov edx, dword [esi]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jge 0x40cf36
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
pop esi
neg eax
sbb eax, eax
and al, 0xfe
add esp, 0x10c
ret 0xc
jne 0x40cf3d
mov eax, 0xfffffffd
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40ce96
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
push esi
mov esi, ecx
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x40ceac
or eax, eax
pop esi
add esp, 0x10c
ret 0xc
push edi
mov dword [esp + 0x14], eax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x10], 1
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
push 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x128]
push 0
push edx
push 2
mov dword [esp + 0x20], eax
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
pop edi
jg 0x40cefc
xor eax, eax
pop esi
add esp, 0x10c
ret 0xc
mov eax, dword [esp + 0x118]
mov ecx, dword [esp + 0x114]
mov edx, dword [esi]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jge 0x40cf36
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2733
pop esi
neg eax
sbb eax, eax
and al, 0xfe
add esp, 0x10c
ret 0xc
jne 0x40cf3d
mov eax, 0xfffffffd
pop esi
add esp, 0x10c
ret 0xc

Function at 0x40cf50
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x20
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x40cf68
xor al, al
add esp, 0x20
ret
mov ecx, dword [eax + 0xc]
push esi
push edi
push 0
mov esi, dword [ecx]
mov word [esp + 0xc], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
mov edx, dword [esi]
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
mov dword [esp + 0x10], edx
call fcn.0040ca20
lea ecx, [esp + 0x18]
call fcn.0040cab0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov al, 1
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x30]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x20
ret
Function at 0x40d310
Capabilities:
Connect socket
Get socket status
Set socket configuration

Disassembly:
sub esp, 0x158
push edi
mov ecx, 0xa
or eax, 0xffffffff
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x168]
mov dword [esp + 0xc], 0
cmp eax, 0xa
mov dword [esp + 4], 1
mov dword [esp + 0x10], 0xffffffff
jle 0x40d354
or eax, 0xffffffff
pop edi
add esp, 0x158
ret
push ebx
push ebp
test eax, eax
push esi
jle 0x40d390
mov esi, dword [esp + 0x16c]
lea edi, [esp + 0x2c]
sub edi, esi
mov ebx, eax
mov ecx, esi
call fcn.0040cc20
push 1
mov ecx, esi
call fcn.0040caf0
test al, al
je 0x40d383
mov eax, dword [esi]
mov dword [edi + esi], eax
add esi, 4
dec ebx
jne 0x40d36a
mov eax, dword [esp + 0x174]
mov ebp, dword [sym.imp.WS2_32.dll_ioctlsocket]
mov dword [esp + 0x64], 0
test eax, eax
jle 0x40d453
mov ecx, dword [esp + 0x170]
lea edx, [esp + 0x2c]
sub ecx, edx
lea ebx, [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], eax
mov eax, dword [ecx + ebx]
test eax, eax
jbe 0x40d441
mov ecx, dword [esp + 0x178]
push ecx
push eax
lea ecx, [esp + 0x5c]
call fcn.0040ca50
lea ecx, [esp + 0x54]
mov dword [esp + 0x10], 1
call fcn.0040cae0
mov esi, dword [ebx]
lea edx, [esp + 0x10]
push edx
push 0x8004667e
push esi
mov edi, eax
call ebp
push 0x10
push edi
push esi
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, dword [esp + 0x64]
xor eax, eax
test ecx, ecx
jbe 0x40d41e
lea edx, [esp + 0x68]
cmp dword [edx], esi
je 0x40d41e
inc eax
add edx, 4
cmp eax, ecx
jb 0x40d412
cmp eax, ecx
jne 0x40d434
cmp ecx, 0x40
jae 0x40d434
mov dword [esp + eax*4 + 0x68], esi
mov eax, dword [esp + 0x64]
inc eax
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
inc eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
add ebx, 4
dec eax
mov dword [esp + 0x20], eax
jne 0x40d3bf
mov eax, dword [esp + 0x17c]
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x68]
push 0
push edx
inc eax
push 0
push eax
mov dword [esp + 0x3c], 0
call dword [sym.imp.WS2_32.dll_select]
mov ebx, dword [esp + 0x174]
mov dword [esp + 0x14], eax
test ebx, ebx
jle 0x40d4b2
lea esi, [esp + 0x2c]
mov edi, ebx
mov edx, dword [esi]
lea ecx, [esp + 0x10]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x1c], 0
call ebp
add esi, 4
dec edi
jne 0x40d495
mov eax, dword [esp + 0x14]
test eax, eax
jle 0x40d4dd
xor esi, esi
test ebx, ebx
jle 0x40d4dd
lea edi, [esp + 0x2c]
mov ecx, dword [edi]
lea eax, [esp + 0x64]
push eax
push ecx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x40d4fe
inc esi
add edi, 4
cmp esi, ebx
jl 0x40d4c4
mov ebp, dword [esp + 0x1c]
test ebx, ebx
jle 0x40d51a
mov esi, dword [esp + 0x16c]
mov edi, ebx
test ebp, ebp
je 0x40d50d
cmp ebp, dword [esi]
jne 0x40d50d
mov dword [esi], 0xffffffff
jmp 0x40d514
mov edx, dword [esp + 0x180]
mov ebp, dword [esp + esi*4 + 0x2c]
mov dword [edx], esi
jmp 0x40d4e1
mov ecx, esi
call fcn.0040cc20
add esi, 4
dec edi
jne 0x40d4ee
mov eax, ebp
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x158
ret
Function at 0x40ea81
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x264]
mov ecx, ebx
call fcn.00415f50
test al, al
jne 0x40eb6a
push edi
cmp dword [esi + 0x194], 2
jne 0x40eb50
mov eax, dword [esi + 0x158]
lea ecx, [esi + 0x158]
call dword [eax + 0x10]
mov edi, eax
test edi, edi
je 0x40eae2
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0x698], eax
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 4]
lea edx, [edi + 0x10]
push ecx
push edx
push eax
mov ecx, esi
call fcn.0040f110
push edi
call fcn.00403f90
jmp 0x40eae9
push 1
call fcn.0040d110
add esp, 4
mov ecx, esi
call fcn.00412070
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esi + 0x210]
test ecx, ecx
jne 0x40eb0a
mov dword [esi + 0x210], eax
jmp 0x40eb23
mov edx, eax
sub edx, ecx
cmp edx, 0x2710
jbe 0x40eb23
mov ecx, esi
mov dword [esi + 0x210], eax
call fcn.0040e440
mov ecx, esi
call fcn.0040ec00
test al, al
je 0x40eb5a
push 0x4326ac
mov ecx, esi
call fcn.00412f90
lea ecx, [esi + 0x198]
call fcn.0040cc20
mov eax, dword [esi]
push 0
mov ecx, esi
call dword [eax + 0x30]
jmp 0x40eb5a
push 0x64
call fcn.0040d110
add esp, 4
mov ecx, ebx
call fcn.00415f50
test al, al
je 0x40ea9a
pop edi
pop esi
pop ebx
ret

Function at 0x416550
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
jne 0x416577
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x416610
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 8], eax
je 0x416581
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 8]
xor eax, eax
test ecx, ecx
mov byte [esi + 0x10], 0
pop esi
setne al
ret
Function at 0x416640
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
sub esp, 0x1c
push esi
push edi
mov esi, ecx
push 0
mov word [esp + 0x18], 2
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x11
push 2
push 2
mov word [esp + 0x22], ax
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x416689
mov dword [esi], eax
pop edi
xor al, al
pop esi
add esp, 0x1c
ret 4
lea ecx, [esp + 0x14]
push 0x10
push ecx
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x4166a6
pop edi
xor al, al
pop esi
add esp, 0x1c
ret 4
mov eax, dword [esi]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea edx, [esp + 0x28]
push 4
push edx
push 0x1006
push 0xffff
push eax
mov dword [esp + 0x3c], 0
call edi
test eax, eax
je 0x4166d8
pop edi
xor al, al
pop esi
add esp, 0x1c
ret 4
mov edx, dword [esi]
lea ecx, [esp + 8]
push 4
push ecx
push 0x1002
push 0xffff
push edx
mov dword [esp + 0x1c], 0x10000
call edi
test eax, eax
je 0x416704
pop edi
xor al, al
pop esi
add esp, 0x1c
ret 4
mov ecx, dword [esi]
lea eax, [esp + 0xc]
push 4
push eax
push 3
push 0
push ecx
mov dword [esp + 0x20], 0xb0
call edi
mov ecx, dword [esi]
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push ecx
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
mov edx, dword [esp + 0x16]
push edx
call dword [sym.imp.WS2_32.dll_ntohs]
mov word [esi + 4], ax
pop edi
mov al, 1
pop esi
add esp, 0x1c
ret 4

Function at 0x416780
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, ecx
cmp dword [edi], 0xffffffff
je 0x4167f3
mov ecx, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 8], eax
push ecx
mov dword [esp + 0x10], eax
mov word [esp + 0xc], 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_htonl]
mov edx, dword [esp + 0x28]
mov dword [esp + 0xc], eax
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [edi]
mov word [esp + 0xa], ax
lea eax, [esp + 8]
push 0x10
push eax
push 0
push esi
push ecx
push edx
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, esi
je 0x4167f3
push esi
push eax
push str.nSent_d__nLen_d_n
call fcn.004150fa
add esp, 0xc
pop edi
pop esi
add esp, 0x10
ret 0x10

Function at 0x416800
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov eax, dword [ecx]
sub esp, 0x100
cmp eax, 0xffffffff
jne 0x416816
xor eax, eax
add esp, 0x100
ret
lea eax, [esp]
push 0x100
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x416833
xor eax, eax
add esp, 0x100
ret
lea ecx, [esp]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x416849
add esp, 0x100
ret
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
push eax
call dword [sym.imp.WS2_32.dll_ntohl]
add esp, 0x100
ret
Function at 0x417430
Capabilities:
Create directory

Disassembly:
sub esp, 0x104
mov al, byte [0x433f60]
push esi
push edi
mov byte [esp + 0xc], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0xd]
mov dword [esp + 8], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push ecx
stosw word es:[edi], ax
call fcn.00415015
lea edx, [esp + 0xc]
push edx
call fcn.00414eb5
mov esi, eax
add esp, 8
test esi, esi
je 0x417524
mov edi, dword [esp + 0x110]
push edi
call fcn.00417190
push str.d:UVCCenter
lea eax, [esp + 0x14]
push str._slog
push eax
call fcn.004041be
add esp, 0x10
lea ecx, [esp + 0xc]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
inc eax
push edx
add ecx, 0x76c
push eax
push ecx
push edi
push str.d:UVCCenter
lea edx, [esp + 0x20]
push str._slog_s__d__02d__02d_.log
push edx
call fcn.004041be
lea eax, [esp + 0x28]
push 0x432c80
push eax
call fcn.004289b0
mov edi, eax
add esp, 0x24
test edi, edi
je 0x417524
mov ecx, dword [esp + 0x114]
mov edx, dword [esi]
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esi + 8]
push edx
mov edx, dword [esi + 0xc]
push eax
mov eax, dword [esi + 0x10]
push ecx
mov ecx, dword [esi + 0x14]
inc eax
push edx
add ecx, 0x76c
push eax
push ecx
push str.__02d__02d__02d__02d:_02d:_02d_:_s_n
push edi
call fcn.00428afc
push edi
call fcn.0040b07a
add esp, 0x28
pop edi
pop esi
add esp, 0x104
ret

Function at 0x417d60
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push 0x40
push eax
push 0x434750
call fcn.004180a0
push 0x40
push 0x42cb3c
push 0x434750
push 0x434750
call fcn.00417fc0
mov al, byte [esp + 0x3c]
add esp, 0x1c
test al, al
jne 0x417deb
mov ebx, dword [esp + 0x1c]
mov ebp, 0x10
mov eax, dword [0x43298c]
mov ecx, 8
mov esi, eax
mov edi, 0x4346a4
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00417f00
mov ecx, dword [0x432988]
mov edx, dword [0x43298c]
push 0x20
push ecx
push edx
call fcn.00418010
mov edi, dword [0x432988]
add esp, 0x14
mov ecx, 8
mov esi, 0x4346a4
add ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x417d9f
jmp 0x417e44
mov eax, dword [esp + 0x1c]
mov ebp, 0x10
lea ebx, [eax + 0x2d0]
mov eax, dword [0x432988]
mov ecx, 8
mov esi, eax
mov edi, 0x4346a4
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00417f00
mov ecx, dword [0x43298c]
mov edx, dword [0x432988]
push 0x20
push ecx
push edx
call fcn.00418010
mov edi, dword [0x43298c]
add esp, 0x14
mov ecx, 8
mov esi, 0x4346a4
sub ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x417dfa
push 0x40
push 0x42cb7c
push 0x434750
push 0x434750
call fcn.00417fc0
mov eax, dword [esp + 0x24]
push 0x40
push 0x434750
push eax
call fcn.004180e0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x417e80
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0x40
push eax
push 0x434710
call fcn.004180a0
push 0x38
push 0x42cc0c
push 0x434710
push 0x434710
call fcn.00417fc0
mov edi, dword [esp + 0x28]
add esp, 0x1c
xor esi, esi
movsx ecx, byte [esi + 0x42cc74]
mov edx, dword [0x432990]
push ecx
push 0x1c
push edx
call fcn.00418040
movsx eax, byte [esi + 0x42cc74]
mov ecx, dword [0x432994]
push eax
push 0x1c
push ecx
call fcn.00418040
push 0x30
push 0x42cc44
push 0x434710
push edi
call fcn.00417fc0
add esp, 0x28
inc esi
add edi, 0x30
cmp esi, 0x10
jl 0x417eb2
pop edi
pop esi
ret

Function at 0x417f00
Capabilities:
Encrypt data using des

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x30
push 0x42cbbc
push esi
push 0x4346c4
call fcn.00417fc0
mov eax, dword [esp + 0x1c]
push 0x30
push eax
push 0x4346c4
call fcn.00418010
push 0x4346c4
push esi
call fcn.00417f50
push 0x20
push 0x42cbec
push esi
push esi
call fcn.00417fc0
add esp, 0x34
pop esi
ret

Function at 0x418010
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x418032
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x418024
pop ebx
pop esi
ret