joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405334
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x405343
pop dword [ebp - 0x40]
mov eax, 0xab748eed
add eax, 0x54cbc456
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x818f51b9
add dword [ebp - 0x50], 0xccc2f392
mov dword [ebp - 0x4c], 0x3058fcb8
add dword [ebp - 0x4c], 0x1da4f8d
mov dword [ebp - 0x48], 0x1cda7403
sub dword [ebp - 0x48], 0xd08e2fd5
mov dword [ebp - 0x44], 0x26b01f85
add dword [ebp - 0x44], 0xd94fe07b
lea eax, [ebp - 0x50]
push eax
mov eax, 0x2e16354c
sub eax, 0x2dd59540
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xc9b6fa2c
add dword [ebp - 0x50], 0xaabb6f2a
mov dword [ebp - 0x4c], 0xf18ae4ed
add dword [ebp - 0x4c], 0x4fe17c88
mov dword [ebp - 0x48], 0xf7f0b39b
sub dword [ebp - 0x48], 0x9481472f
mov dword [ebp - 0x44], 0xe941a308
sub dword [ebp - 0x44], 0xe941a308
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xd6f481b6
add eax, 0x294c1e5e
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x366e8
push 0
call eax
mov ecx, 0x354734a3
sub ecx, 0x3546f637
xor ebx, ebx
add ebx, eax
mov esi, 0x34d25a9c
add esi, 0xcb716364
add esi, dword [ebp - 0x40]
mov edi, 0x1ba9b276
sub edi, 0xbe75b53d
add dword [ebp - 0x34], edi
mov edx, dword [esi]
xor dword [ebp - 0x34], 0x283b60
sub edx, edi
sub dword [ebp - 0x2c], 0x71093ec7
mov dword [ebx], edx
mov dword [ebp - 0x34], 0xc650316a
add ebx, 0x2896177f
add ebx, 0xd769e885
add esi, 4
loop 0x405467
add eax, 0x725c0a3
sub eax, 0x724d420
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x414dfc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x390]
sub esp, 0x410
mov eax, dword [0x494334]
xor eax, ebp
mov dword [ebp + 0x38c], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x398]
lea eax, [ebp - 0x78]
push eax
push 1
xor ebx, ebx
mov dword [ebp - 0x7c], 0x400
push ebx
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414ed0
lea eax, [ebp - 0x7c]
mov byte [ebp - 0x74], bl
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push str.TransferJobID
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7c], ebx
jbe 0x414ed0
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x414ed0
lea eax, [ebp - 0x74]
push eax
call fcn.00446b50
pop ecx
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jg 0x414eb0
lea eax, [esi + esi]
call fcn.00441310
mov eax, esp
lea ecx, [ebp - 0x74]
push 3
push esi
push ecx
push eax
call fcn.004043eb
mov ebx, eax
push edi
push ebx
call dword [sym.imp.ole32.dll_CLSIDFromString]
push 0x10
push 0x47a848
push edi
call fcn.0044355e
add esp, 0xc
test eax, eax
je 0x414ed0
xor eax, eax
jmp 0x414ed5
mov eax, 0x80004005
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x38c]
xor ecx, ebp
call fcn.0044119a
add ebp, 0x390
leave
ret
Function at 0x41e820
Capabilities:
Create pipe

Disassembly:
sub esp, 0xc
and dword [esp + 4], 0
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], 0xc
push 0
push eax
xor ebp, ebp
lea edi, [esi + 0xc8]
inc ebp
push edi
lea ebx, [esi + 0xc4]
mov dword [esp + 0x24], ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x41e3bc
mov eax, dword [edi]
or dword [esi + 0x9c], 0x100
push 0
push ebp
push dword [ebx]
mov dword [esi + 0xb0], eax
mov dword [esi + 0xac], eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor ebx, ebx
inc ebx
push ebx
mov dword [esi + 0x50], ebx
call fcn.00418a5b
mov ecx, eax
call fcn.00418cc4
test al, al
je 0x41e3b8
push str.Create_pipe_SUCCESS
push str.Executor::createPipe
push 0xe8
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u401_683_install_src_windows_common_Executor.cpp
push ebx
call fcn.00418a5b
mov ecx, eax
call fcn.00408843
mov al, bl
jmp 0x41e3f0
push ebp
call fcn.00418a5b
mov ecx, eax
call fcn.00418cc4
test al, al
je 0x41e3ee
push str.Create_pipe_FAILURE
push str.Executor::createPipe
push 0xeb
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u401_683_install_src_windows_common_Executor.cpp
push ebp
call fcn.00418a5b
mov ecx, eax
call fcn.00408843
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push esi
push edi
mov edi, ecx
push 0x44
push 0
lea esi, [edi + 0x70]
push esi
call fcn.00442b50
push 0x10
lea eax, [edi + 0x60]
mov dword [esi], 0x44
push 0
push eax
call fcn.00442b50
add esp, 0x18
cmp dword [edi + 0xb4], 1
jne 0x41e867
or dword [edi + 0x9c], 1
xor eax, eax
mov word [edi + 0xa0], ax
mov dword [edi + 0x54], 0x8000000
cmp byte [edi + 0xc1], 0
je 0x41e879
mov ecx, edi
pop edi
pop esi
jmp 0x41e322
pop edi
pop esi
ret
Function at 0x41e9a0
Capabilities:
Create process on windows

Disassembly:
push 0x20
mov eax, 0x4691a2
call fcn.0044120d
mov esi, ecx
xor ebx, ebx
lea edi, [esi + 0x30]
inc ebx
push ebx
call fcn.00418a5b
mov ecx, eax
call fcn.00418cc4
test al, al
je 0x41ea04
push edi
lea eax, [ebp - 0x28]
push str.Executor.exec__:
push eax
call fcn.0041497d
add esp, 0xc
and dword [ebp - 4], 0
push eax
push str.Executor::startExecution
push 0x93
push str.c:_jenkins_workspace_8_2_build_windows_x64_cygwin_sans_NAS_jdk8u401_683_install_src_windows_common_Executor.cpp
push ebx
call fcn.00418a5b
mov ecx, eax
call fcn.00418cd0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00408398
mov ecx, esi
call fcn.0041e820
cmp dword [edi + 0x14], 0x10
mov ecx, edi
jb 0x41ea15
mov ecx, dword [edi]
mov eax, dword [edi + 0x10]
add eax, ecx
cmp dword [edi + 0x14], 0x10
jb 0x41ea22
mov edi, dword [edi]
lea ecx, [ebp - 0x29]
push ecx
push eax
push edi
lea ecx, [ebp - 0x1c]
call fcn.00413163
lea eax, [ebp - 0x29]
mov dword [ebp - 4], ebx
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 0x29], 0
call fcn.00413225
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x41ea4d
mov ecx, dword [esi]
lea eax, [esi + 0x60]
push eax
lea eax, [esi + 0x70]
push eax
push dword [esi + 0x5c]
push dword [esi + 0x58]
push dword [esi + 0x54]
push dword [esi + 0x50]
push dword [esi + 0x4c]
push dword [esi + 0x48]
push dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
lea ecx, [ebp - 0x1c]
setne bl
call fcn.004130d8
mov al, bl
call fcn.004411bc
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x40892d
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
call fcn.00408946
push ebx
pop esi
xor dword [edx], ecx
or ebx, ebx
sub esi, esi
inc edx
cmp edx, edi
jne fcn.0040892d
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x29a010c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x29a010d6
pop dword [ebp - 0x24]
mov eax, 0xe2bce75c
add eax, 0x46e3297a
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xf27dd0b3
add dword [ebp - 0x34], 0x5bd47498
mov dword [ebp - 0x30], 0xcc5230aa
sub dword [ebp - 0x30], 0x9a1ee465
mov dword [ebp - 0x2c], 0xcda8b9c5
add dword [ebp - 0x2c], 0x7ea38a69
mov dword [ebp - 0x28], 0xe5cc661f
add dword [ebp - 0x28], 0x1a3399e1
lea eax, [ebp - 0x34]
push eax
mov eax, 0x125fc76a
sub eax, 0xe8be86de
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x4dd257d8
sub dword [ebp - 0x34], 0xd95fee82
mov dword [ebp - 0x30], 0xb82d0628
add dword [ebp - 0x30], 0x893f5b4d
mov dword [ebp - 0x2c], 0x3c9f5e04
add dword [ebp - 0x2c], 0x26d00e68
mov dword [ebp - 0x28], 0x45d258b2
add dword [ebp - 0x28], 0xba2da74e
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xfaefc99b
add eax, 0x2eb176a9
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3b75b
push 0
call eax
mov ecx, 0xf4b153fd
sub ecx, 0xf4b1074d
mov edi, eax
mov ebx, 0x29a22000
add ebx, dword [ebp - 0x24]
mov esi, 0x15a2439f
add dword [ebp - 0x14], 0xcc58e2ce
mov edx, dword [ebx]
add dword [ebp - 0x14], 0x8781db70
xor edx, esi
sub dword [ebp - 0x14], ecx
mov dword [edi], edx
xor dword [ebp - 0x10], ecx
add edi, 0xfe4cea31
sub edi, 0xfe4cea2d
add ebx, 0xd03ee1b8
sub ebx, 0xd03ee1b4
loop 0x29a011ec
add eax, 0x3c5aeae5
sub eax, 0x3c59c552
xor ebx, ebx
add ebx, eax
add eax, 0x866c52b1
add eax, 0x7993ad54
mov ecx, 0x29a00000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x438c88
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x438a14
add ecx, 0x9bf5234b
dec ecx
or ecx, eax
call fcn.00438cbc
add eax, ecx
xor dword [edx], ebx
add ecx, ecx
inc edx
sub eax, 0x8f32d82c
dec ecx
cmp edx, edi
jne fcn.00438c88
or ecx, ecx
mov ecx, ecx
ret
Function at 0x10007cac
Capabilities:
Read file on windows

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push 2
push 0xffffffffffffffff
push 0xffffffffffffffea
push ebp
call fcn.1001bdfd
mov ebx, edx
add esp, 0x10
mov esi, eax
test ebx, ebx
jl 0x10007e1f
jg 0x10007cdb
test esi, esi
jb 0x10007e1f
mov edi, dword [esp + 0x20]
push 0x16
push edi
push ebp
call fcn.10017328
add esp, 0xc
test eax, eax
js 0x10007e1f
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x10007d3d
push edi
call fcn.1000822e
pop ecx
test eax, eax
je 0x10007d34
push ebx
push esi
push edi
push ebp
call fcn.1001bdfd
add esp, 0x10
mov esi, eax
mov ebx, edx
mov eax, esi
mov edx, ebx
jmp 0x10007e24
push 2
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.1001bdfd
mov ebp, eax
add esp, 0x10
mov eax, edx
mov dword [esp + 0x14], eax
cmp eax, ebx
jl 0x10007e1f
jg 0x10007d66
cmp ebp, ebx
jb 0x10007e1f
mov ecx, 0x10015
cmp eax, ebx
jg 0x10007d7b
jl 0x10007d75
cmp ebp, ecx
jae 0x10007d7b
mov esi, ebp
mov ecx, eax
jmp 0x10007d7f
mov esi, ecx
mov ecx, ebx
mov eax, esi
neg eax
push 2
adc ecx, ebx
neg ecx
push ecx
push eax
push dword [esp + 0x28]
call fcn.1001bdfd
add esp, 0x10
cmp edx, ebx
jl 0x10007e1f
jg 0x10007da5
cmp eax, ebx
jb 0x10007e1f
push 0x10015
call fcn.1001bdfd
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10007e1f
push esi
push ebx
push dword [esp + 0x24]
call fcn.10017328
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
js 0x10007e18
lea edx, [ebx + eax]
lea esi, [edx - 0x16]
jmp 0x10007e14
cmp byte [esi], 0x50
jne 0x10007e13
movzx ecx, byte [esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
shl ecx, 8
or ecx, 0x50
cmp ecx, 0x6054b50
jne 0x10007e13
movzx ecx, byte [esi + 0x15]
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0x16]
add eax, ecx
cmp eax, edx
je 0x10007e2b
dec esi
cmp esi, ebx
jae 0x10007dd4
push ebx
call fcn.1001bdfd
pop ecx
or eax, 0xffffffff
or edx, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push 0x16
push esi
push edi
call fcn.1000a190
push ebx
call fcn.1001bdfd
mov eax, dword [esp + 0x20]
add eax, ebx
sub eax, esi
mov esi, dword [esp + 0x24]
cdq
sub ebp, eax
push edi
sbb esi, edx
call fcn.1000822e
add esp, 0x14
test eax, eax
je 0x10007e6b
push esi
push ebp
push edi
push dword [esp + 0x28]
call fcn.1001bdfd
add esp, 0x10
mov ebp, eax
mov esi, edx
mov eax, ebp
mov edx, esi
jmp 0x10007e24
Function at 0x1001bdfd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1001be0c
pop dword [ebp - 0x48]
mov eax, 0x12ec3e42
add eax, 0xfd157fca
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x66602680
sub dword [ebp - 0x58], 0x180de135
mov dword [ebp - 0x54], 0xefd28948
sub dword [ebp - 0x54], 0xbd9f3d03
mov dword [ebp - 0x50], 0x71a24733
sub dword [ebp - 0x50], 0x25560305
mov dword [ebp - 0x4c], 0x9a1f4f1c
add dword [ebp - 0x4c], 0x65e0b0e4
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xc45ef623
add dword [ebp - 0x58], 0xb0137333
mov dword [ebp - 0x54], 0x7f38044c
sub dword [ebp - 0x54], 0x3dcba2d7
mov dword [ebp - 0x50], 0x61e310e6
add dword [ebp - 0x50], 0x18c5b86
mov dword [ebp - 0x4c], 0xf1235041
sub dword [ebp - 0x4c], 0xf1235041
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3b63d
push 0
call eax
mov ecx, 0x1c6b6bb9
add ecx, 0xe394d2f8
xor esi, esi
add esi, eax
mov edi, 0xd9496a25
sub edi, 0xc9461025
add edi, dword [ebp - 0x48]
mov ebx, 0xbb9fe624
sub ebx, 0x1433983f
sub dword [ebp - 0x24], 0xe4627f10
mov edx, dword [edi]
xor dword [ebp - 0x34], eax
xor edx, ebx
add dword [ebp - 0x38], eax
mov dword [esi], edx
add dword [ebp - 0x28], 0xb223decb
add esi, 4
add edi, 0xf20cd6c1
sub edi, 0xf20cd6bd
loop 0x1001bf26
add eax, 0x61061658
add eax, 0x9efad73f
mov ebx, eax
add eax, 0x409fd534
sub eax, 0x409fd52f
mov ecx, 0xa30cc49a
add ecx, 0x6cf33b66
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x401ab6
push 0
push 0
call sub.kernel32.dll_CreateThread
ret
Function at 0x401779
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
push eax
push ebx
push ecx
push edx
push edi
push esi
push 0x400
lea eax, [ebp - 0x400]
push eax
call fcn.00401a84
push 4
lea eax, [ebp - 0x404]
push eax
call fcn.00401a84
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
jmp 0x4017c3
mov al, byte [ebx + edi]
xor byte [esi], al
inc esi
inc ebx
dec ecx
cmp ebx, dword [ebp + 0xc]
jne 0x4017c3
xor ebx, ebx
cmp ecx, 0
jg 0x4017b4
cmp dword [ebp - 0x404], 1
je 0x40188d
mov eax, 0xfffefdfc
mov ecx, 0x40
mov dword [ebp + ecx*4 - 0x404], eax
sub eax, 0x4040404
dec ecx
jne 0x4017df
xor eax, eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
jmp 0x4017ff
inc bl
dec esi
je 0x4017f3
mov dl, byte ss:[ecx + ebp - 0x400]
add al, byte [ebx + edi]
add al, dl
mov dh, byte ss:[eax + ebp - 0x400]
mov byte ss:[ecx + ebp - 0x400], dh
mov byte ss:[eax + ebp - 0x400], dl
inc cl
jne 0x4017fa
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
test edi, edi
je 0x40187e
xor eax, eax
xor edx, edx
xor ecx, ecx
xor ebx, ebx
inc bl
mov dl, byte ss:[ebx + ebp - 0x400]
add al, dl
mov cl, byte ss:[eax + ebp - 0x400]
mov byte ss:[ebx + ebp - 0x400], cl
mov byte ss:[eax + ebp - 0x400], dl
add cl, dl
mov cl, byte ss:[ecx + ebp - 0x400]
xor byte [esi], cl
inc esi
dec edi
jne 0x40183a
xor eax, eax
lea edi, [ebp - 0x400]
mov ecx, 0x40
cld
rep stosd dword es:[edi], eax
mov dword [ebp - 0x404], 1
jmp 0x4017a7
pop esi
pop edi
pop edx
pop ecx
pop ebx
pop eax
leave
ret 0x10

Function at 0x401897
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push edi
push esi
mov dword [ebp - 4], 0xa
cmp dword [ebp + 0x14], 0
je 0x4018b7
push 0xffffffffffffffff
push dword [ebp + 0x14]
call sub.kernel32.dll_WaitForSingleObject
mov esi, dword [ebp + 0xc]
jmp 0x401900
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp + 8]
call fcn.00401a4a
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x401906
push 0
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call sub.wsock32.dll_send
test eax, eax
jle 0x401906
sub dword [ebp + 0x10], eax
add esi, eax
dec dword [ebp - 4]
je 0x401906
cmp dword [ebp + 0x10], 0
jne 0x4018bc
cmp dword [ebp + 0x14], 0
je 0x401914
push dword [ebp + 0x14]
call sub.kernel32.dll_SetEvent
mov eax, dword [ebp + 0x10]
pop esi
pop edi
pop ebx
leave
ret 0x10

Function at 0x40191e
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push edi
push esi
push 0
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 8]
call fcn.00401a4a
lea edx, [ebp - 8]
cmp dword [ebp + 0x14], 0
jne 0x401945
xor edx, edx
push edx
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x40196a
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.wsock32.dll_recv
pop esi
pop edi
pop ebx
leave
ret 0x10
Function at 0x401971
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd4
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.00401a84
push 0x20
lea eax, [ebp - 0x20]
push eax
call fcn.00401a84
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 6
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp + 8]
call sub.ws2_32.dll_getaddrinfo
or eax, eax
jne 0x4019f0
mov esi, dword [ebp - 0x24]
jmp 0x4019ec
cmp dword [ebp + 0xc], 2
jne 0x4019e9
cmp dword [esi + 4], 2
jne 0x4019e9
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 4]
mov dword [ebp - 0x42c], eax
push dword [ebp - 0x24]
call sub.ws2_32.dll_freeaddrinfo
jmp 0x4019f0
mov esi, dword [esi + 0x1c]
or esi, esi
jne 0x4019c7
mov eax, dword [ebp - 0x42c]
pop esi
pop edi
pop ebx
leave
ret 8

Function at 0x401c48
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.00401a84
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 4], eax
push 4
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.004019fd
mov dword [ebp - 0x2c], 1
push 4
lea eax, [ebp - 0x2c]
push eax
push 1
push 6
push dword [ebp - 4]
call sub.wsock32.dll_setsockopt
lea eax, section..data
lea ecx, [0x403075]
sub ecx, eax
push ecx
push 0x403075
push section..data
call fcn.00401d9e
push dword [ebp + 0xc]
call fcn.00401c08
or eax, eax
je 0x401cc5
mov eax, dword [ebp + 0xc]
jmp 0x401cd5
push 2
push dword [ebp + 0xc]
call fcn.00401971
push eax
call sub.wsock32.dll_inet_ntoa
push eax
call sub.wsock32.dll_inet_addr
test eax, eax
je 0x401d76
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
cmp eax, 0x10000
jbe 0x401cf6
push eax
call fcn.00401a15
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x26], ax
mov word [ebp - 0x28], 2
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x2c]
push eax
push 0x8004667e
push dword [ebp - 4]
call sub.wsock32.dll_ioctlsocket
push 0x10
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call sub.wsock32.dll_connect
push 0
push dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push eax
push 0
push dword [ebp - 4]
call fcn.00401a4a
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x401d76
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
push 0x8004667e
push dword [ebp - 4]
call sub.wsock32.dll_ioctlsocket
mov dword [ebp - 0x30], 1
lea eax, section..data
lea ecx, [0x403075]
sub ecx, eax
push ecx
push 0x403075
push section..data
call fcn.00401d9e
mov eax, dword [ebp - 0x30]
pop esi
pop edi
pop ebx
leave
ret 0x10
Function at 0x401414
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401426
mov eax, dword [0x49d08b]
shl eax, 2
mov dword [0x49d08f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.0048fac0
pop edx
call fcn.0048fa24
call fcn.0048fb00
push 0
call fcn.00490f64
pop ecx
push 0x49d034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x49d093], eax
push 0
jmp fcn.00497078

Function at 0x402a4c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
lea ebx, [ebp - 0x30]
mov eax, 0x49d710
call fcn.004902c4
mov dword [ebx + 0x1c], 1
lea edx, [ebp + 8]
lea eax, [ebp + 8]
call fcn.0049b2cc
inc dword [ebx + 0x1c]
xor edx, edx
mov word [ebx + 0x10], 8
mov word [ebx + 0x10], 0x14
mov dword [ebp - 4], edx
inc dword [ebx + 0x1c]
mov word [ebx + 0x10], 8
cmp dword [ebp + 8], 0
je 0x402a9a
mov ecx, dword [ebp + 8]
jmp 0x402a9f
mov ecx, 0x49d30d
push ecx
xor eax, eax
mov word [ebx + 0x10], 0x20
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
inc dword [ebx + 0x1c]
mov eax, dword [0x4a7dfc]
mov eax, dword [eax]
call fcn.00468684
lea eax, [ebp - 8]
mov eax, dword [eax]
xor edx, edx
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0xc]
inc dword [ebx + 0x1c]
call fcn.004275fc
cmp dword [ebp - 0xc], 0
je 0x402add
mov eax, dword [ebp - 0xc]
jmp 0x402ae2
mov eax, 0x49d30c
push eax
push str._s_:__s_n
lea edx, [ebp - 4]
push edx
call fcn.0049b414
add esp, 0x10
dec dword [ebx + 0x1c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0049b308
dec dword [ebx + 0x1c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0049b308
cmp dword [ebp - 4], 0
je 0x402b1f
mov ecx, dword [ebp - 4]
jmp 0x402b24
mov ecx, 0x49d30e
push ecx
call sub.KERNEL32.DLL_OutputDebugStringA
dec dword [ebx + 0x1c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0049b308
dec dword [ebx + 0x1c]
lea eax, [ebp + 8]
mov edx, 2
call fcn.0049b308
mov ecx, dword [ebx]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret