joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b171
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
xor ecx, ecx
inc esi
call fcn.0040a431
test al, al
je 0x40b1ea
push 0x8007
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 4]
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, eax
test edx, edx
je 0x40b1e0
xor ecx, ecx
cmp dword [ebp - 4], ecx
jle 0x40b1d9
mov eax, dword [edx + ecx*4]
test eax, eax
je 0x40b1d3
cmp word [eax], 0x2d
jne 0x40b1d3
movzx eax, word [eax + 2]
cmp eax, 0x6e
je 0x40b1d0
cmp eax, 0x74
jne 0x40b1d3
or ebx, 8
jmp 0x40b1d3
or ebx, 4
inc ecx
cmp ecx, dword [ebp - 4]
jl 0x40b1b0
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
test bl, 8
je 0x40b1f1
mov esi, 0x457
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
shr ebx, 2
not bl
and bl, 1
mov cl, bl
call fcn.0040ae4a
test al, al
je 0x40b1ea
xor esi, esi
test byte [0x440730], 2
je 0x40b1ea
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40b20f

Function at 0x40b611
Capabilities:
Accept command line arguments
Read file via mapping

Disassembly:
push 0x128
push 0x43dc38
call fcn.0043daf8
mov dword [ebp - 0x28], ecx
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x40b758
xor esi, esi
cmp dword [ebp - 0x2c], esi
jle 0x40b683
mov edi, dword [ebx + esi*4]
test edi, edi
je 0x40b678
push 2
push 0x4076b8
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
jne 0x40b678
lea ecx, [edi + 4]
lea edx, [ebp - 0x24]
call fcn.0040bc24
test eax, eax
jne 0x40b678
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x40b680
inc esi
cmp esi, dword [ebp - 0x2c]
jl 0x40b649
jmp 0x40b683
mov dword [ebp - 0x20], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x20], 0
je 0x40b758
cmp dword [ebp - 0x20], 0xffffffff
je 0x40b758
mov edi, 0x1000
push edi
push 0
push dword [0x4420ec]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x40b758
push edi
push 0
push 0
push 4
pop ebx
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x40b718
and dword [ebp - 4], 0
push edi
push eax
push esi
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
mov dword [ebp - 0x138], ebx
push edi
push esi
lea ecx, [ebp - 0x138]
call fcn.004200a8
or dword [ebp - 4], 0xffffffff
jmp 0x40b70f
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, 0x830
cmp dword [esi + 4], eax
je 0x40b730
mov edx, dword [ebp - 0x28]
mov ecx, esi
call fcn.0040ba7c
mov bl, al
jmp 0x40b740
push eax
push esi
push dword [ebp - 0x28]
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
mov bl, 1
mov ecx, esi
call fcn.00430e28
test bl, bl
je 0x40b758
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x40b75a
xor al, al
call fcn.0043db33
ret
Function at 0x40b891
Capabilities:
Create process on windows
Create process suspended
Read file via mapping
Resume thread

Disassembly:
sub esp, 0xb4
and dword [esp + 4], 0
push ebx
push ebp
push esi
push edi
push 0xc
lea eax, [esp + 0x30]
push 0x44074c
mov edi, 0x1000
push eax
mov ebp, ecx
mov dword [esp + 0x24], edi
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
lea eax, [esp + 0x2c]
push 0
push edi
push 0
push 0x8000004
xor ebx, ebx
push eax
inc ebx
push 0xffffffffffffffff
mov dword [esp + 0x4c], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
mov dword [esp + 0x10], esi
test esi, esi
je 0x40b907
push edi
push 0
push 0
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x40b91f
lea ecx, [esp + 0x10]
call fcn.0040b46f
xor bl, bl
lea ecx, [esp + 0x10]
call fcn.0040b46f
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb4
ret
push esi
push 0x4076c0
push 0
lea eax, [esp + 0x90]
push 0x1e
push eax
call fcn.00418a50
add esp, 0x14
test eax, eax
jne 0x40b907
push 0x40
push eax
lea eax, [esp + 0x44]
push eax
call sub.msvcrt.dll_memset
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x28], ecx
add esp, 0xc
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push ecx
push 4
push ebx
push ecx
push ecx
lea eax, [esp + 0xa4]
push eax
push ebp
mov dword [esp + 0x60], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40b907
push dword [esp + 0x1c]
lea ecx, [esp + 0x14]
call fcn.0040b497
test al, al
je 0x40b9ac
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x40b9ae
xor bl, bl
push dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x20]
call esi
jmp 0x40b909

Function at 0x40bd3f
Capabilities:
Check if file exists
Get common file path
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
mov bh, byte [ebp + 0xc]
push esi
push edi
mov edi, edx
mov esi, ecx
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40bdda
mov ecx, esi
test al, 0x10
je 0x40bd6d
call fcn.0041ad18
jmp 0x40bd72
call fcn.0040c62c
test al, al
jne 0x40bdda
push esi
mov edx, 0x104
lea ecx, [ebp - 0x210]
call fcn.004189ac
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 8]
mov ecx, 0xdf
call fcn.0041c8a9
lea eax, [ebp - 0x418]
push eax
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x40bdda
push 1
lea eax, [ebp - 0x418]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp - 0x418]
call fcn.0040c62c
push dword [ebp + 8]
mov edx, edi
mov ecx, esi
call fcn.0041aa31
test al, al
jne 0x40be09
test bh, bh
jne 0x40bdf3
cmp bl, 0xa
je 0x40be05
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
inc bl
jmp 0x40bd54
xor al, al
jmp 0x40be0b
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40c518
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
push esi
mov edi, edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40c575
or dword [ebp - 4], 0xffffffff
and eax, 0x10
shl eax, 0x15
push eax
push 3
push 7
push 0x80000000
push esi
lea ecx, [ebp - 4]
call fcn.0040c239
test al, al
je 0x40c56d
xor eax, eax
push eax
push eax
push eax
push edi
lea ecx, [ebp - 4]
call fcn.0040c45e
test al, al
je 0x40c56d
lea ecx, [ebp - 4]
call fcn.0040c226
mov al, 1
jmp 0x40c577
lea ecx, [ebp - 4]
call fcn.0040c226
xor al, al
pop edi
pop esi
leave
ret 0xc

Function at 0x40c62c
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, ecx
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
pop esi
ret

Function at 0x40cde9
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 1
xor edi, edi
push edi
push edx
push ecx
mov dword [ebp - 8], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp + 0xc]
test eax, eax
jne 0x40ce25
mov edx, dword [ebp + 8]
push 0x208
push esi
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
call fcn.0040cefe
mov ebx, eax
jmp 0x40ce28
or ebx, 0xffffffff
cmp ebx, 0xffffffff
je 0x40ce9f
test bl, 1
jne 0x40ce9f
cmp dword [ebp - 4], 1
je 0x40ce3e
cmp dword [ebp - 4], 2
jne 0x40ce9f
test ebx, ebx
jne 0x40ce49
xor eax, eax
mov word [esi], ax
jmp 0x40ce9b
shr ebx, 1
lea edx, [ebx - 1]
cmp word [esi + edx*2], di
jne 0x40ce57
dec ebx
jmp 0x40ce68
inc edx
cmp edx, 0x104
jae 0x40ce9f
xor eax, eax
mov word [esi + edx*2], ax
mov ebx, edx
cmp edx, 2
jbe 0x40ce9b
cmp dword [ebp - 4], 2
jne 0x40ce9b
mov ecx, esi
call fcn.004339ae
mov edi, eax
test edi, edi
je 0x40ce91
push 0x104
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x40ce94
or ebx, 0xffffffff
mov ecx, edi
call fcn.00430e28
mov eax, ebx
jmp 0x40cea2
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40cf33
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
mov ecx, 0x80000001
push edx
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40cf83
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
push dword [ebp - 4]
inc edx
movzx ebx, bl
test eax, eax
cmove ebx, edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret 0x10
Function at 0x40d010
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
push edi
push 0x409074
mov dword [esp + 0x20], ecx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x24], eax
test eax, eax
je 0x40d1ca
push 0x409080
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
test eax, eax
je 0x40d196
push edi
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x30]
push ecx
call eax
test eax, eax
jne 0x40d196
push edi
push edi
push edi
push 0x407764
call dword [sym.imp.GDI32.dll_CreateDCW]
mov ebx, eax
test ebx, ebx
je 0x40d190
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, eax
test ebp, ebp
je 0x40d189
push 0x8040
push edi
push edi
push 2
push 0x7f00
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x40d0da
lea ecx, [esp + 0x3c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0x40d0d6
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x40d0da
mov dword [esp + 0x14], edi
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 8
push ebx
call esi
mov dword [esp + 0x10], eax
push 0xa
push ebx
call esi
mov dword [esp + 0x18], eax
push eax
push dword [esp + 0x14]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, eax
test esi, esi
je 0x40d182
push esi
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x20], eax
test eax, eax
je 0x40d17b
push 0x40cc0020
push edi
push edi
push ebx
push dword [esp + 0x28]
push dword [esp + 0x24]
push edi
push edi
push ebp
call dword [sym.imp.GDI32.dll_BitBlt]
test eax, eax
je 0x40d170
mov edx, dword [esp + 0x14]
test edx, edx
je 0x40d15f
mov ecx, dword [esp + 0x2c]
sub ecx, dword [esp + 0x40]
push 0
pop eax
cmovs ecx, eax
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x44]
push 0
pop edi
push edx
cmovs eax, edi
push eax
push ecx
push ebp
call dword [sym.imp.USER32.dll_DrawIcon]
push ecx
push dword [esp + 0x20]
lea ecx, [esp + 0x2c]
push esi
call fcn.0042d08a
mov edi, eax
push dword [esp + 0x20]
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebp
call dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esp + 0x24]
jmp 0x40d1a6
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov dword [esp + 0x24], eax
test eax, eax
je 0x40d1ca
push 0x409090
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d1c0
push dword [esp + 0x28]
call eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 4
Function at 0x40d648
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, edx
mov edx, dword [ecx + 0x3c]
push esi
push edi
mov edi, dword [edx + ecx + 0x78]
add edi, ecx
xor esi, esi
mov ebx, dword [edi + 0x1c]
add ebx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x2c], ebx
cmp ebp, 0xffff
jbe 0x40d70d
mov eax, dword [edi + 0x24]
add eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0x20]
add eax, ecx
mov ebx, esi
mov dword [esp + 0x20], eax
cmp dword [edi + 0x18], ebx
jbe 0x40d72f
movzx edx, byte [ebp]
mov dword [esp + 0x24], edx
mov eax, dword [eax + ebx*4]
add eax, ecx
mov dword [esp + 0x14], eax
mov al, byte [eax]
mov byte [esp + 0x13], al
movzx eax, al
sub edx, eax
jne 0x40d6dc
mov edi, dword [esp + 0x14]
mov cl, byte [esp + 0x13]
mov esi, ebp
sub esi, edi
test cl, cl
je 0x40d6d2
inc edi
mov cl, byte [edi]
movzx edx, byte [esi + edi]
movzx eax, cl
sub edx, eax
je 0x40d6c0
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor esi, esi
test edx, edx
js 0x40d6ec
xor eax, eax
inc eax
test edx, edx
cmovg edx, eax
test edx, edx
je 0x40d6fc
inc ebx
cmp ebx, dword [edi + 0x18]
jae 0x40d72c
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
jmp 0x40d69e
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
movzx eax, word [eax + ebx*2]
mov eax, dword [edx + eax*4]
jmp 0x40d725
movzx edx, bp
cmp edx, dword [edi + 0x10]
jb 0x40d744
mov eax, dword [edi + 0x14]
add eax, dword [edi + 0x10]
cmp edx, eax
ja 0x40d744
sub edx, dword [edi + 0x10]
mov eax, dword [ebx + edx*4]
test eax, eax
je 0x40d744
lea esi, [eax + ecx]
mov edx, dword [ecx + 0x3c]
cmp esi, edi
jb 0x40d740
mov ecx, dword [edx + ecx + 0x7c]
add ecx, edi
xor eax, eax
cmp esi, ecx
cmovb esi, eax
mov eax, esi
jmp 0x40d746
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x40de84
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x38
xor ebp, ebp
push ebp
push dword [0x4420ec]
mov edi, edx
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40ded3
mov ebp, 0x1000
push ebp
lea ecx, [esi + 0x18]
call fcn.0040d2d1
lea ecx, [esi + 0x28]
push ebp
call fcn.0040d2d1
mov eax, dword [esp + 0x18]
xor ebp, ebp
mov dword [esi], eax
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], edi
jmp 0x40ded5
mov esi, ebp
test esi, esi
je 0x40df0f
mov edx, dword [esp + 0x14]
mov ecx, dword [edi + 8]
call fcn.0040d924
mov dword [esi + 0xc], eax
test eax, eax
je 0x40df07
push ebp
push ebp
push esi
push 0x40d9e8
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x40df07
mov eax, esi
jmp 0x40df11
push ecx
mov ecx, esi
call fcn.0040df18
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x40e1d6
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x11c]
push edi
mov edi, dword [esp + 0x124]
mov ebx, edx
mov ebp, ecx
test edi, edi
je 0x40e240
cmp edi, 0xffffffff
je 0x40e214
xor edx, edx
mov eax, edi
mov ecx, 0x3e8
div ecx
imul edx, edx, 0x3e8
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
xor ecx, ecx
lea eax, [esp + 0x10]
cmp edi, 0xffffffff
cmove eax, ecx
push eax
push ecx
push ecx
lea eax, [esp + 0x24]
push eax
push ecx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], ebp
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jne 0x40e260
push 0
push esi
push ebx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x40e260
sub esi, eax
add ebx, eax
test esi, esi
jg 0x40e1f2
xor eax, eax
test esi, esi
sete al
jmp 0x40e262
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 8

Function at 0x40e287
Capabilities:
Connect socket

Disassembly:
push esi
push edi
mov edi, ecx
push 6
movzx eax, word [edi]
push 1
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x40e2c4
cmp word [edi], 2
push 0x1c
pop ecx
push 0x10
pop eax
cmove ecx, eax
push ecx
push edi
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x40e2c4
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or esi, 0xffffffff
pop edi
mov eax, esi
pop esi
ret
Function at 0x40e2c9
Capabilities:
Resolve dns

Disassembly:
push ecx
rol dx, 8
push ebx
push ebp
push edi
lea eax, [esp + 0xc]
push eax
xor edi, edi
push edi
push edi
push ecx
movzx ebp, dx
mov ebx, edi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x40e2ef
or eax, 0xffffffff
jmp 0x40e36d
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x40e32b
cmp dword [esi + 4], 2
jne 0x40e30d
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x18]
call fcn.00430e63
mov edi, eax
jmp 0x40e320
cmp dword [esi + 4], 0x17
jne 0x40e320
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x18]
call fcn.00430e63
mov ebx, eax
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x40e2f8
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
or esi, 0xffffffff
test edi, edi
je 0x40e346
mov ecx, edi
mov word [edi + 2], bp
call fcn.0040e287
mov esi, eax
test ebx, ebx
je 0x40e35c
cmp esi, 0xffffffff
jne 0x40e35c
mov ecx, ebx
mov word [ebx + 2], bp
call fcn.0040e287
mov esi, eax
mov ecx, edi
call fcn.00430e28
mov ecx, ebx
call fcn.00430e28
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret

Function at 0x40e3d0
Capabilities:
Get socket status
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x508
push ebx
push ebp
push edi
xor ebp, ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x1c]
push eax
mov ebx, edx
mov edi, ecx
push ebp
mov dword [esp + 0x24], 2
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jl 0x40e47f
push esi
cmp dword [esp + 0x14], 0
mov esi, ebp
jbe 0x40e45a
mov eax, dword [esp + esi*4 + 0x18]
push ebp
push 0x400
lea ecx, [esp + 0x120]
push ecx
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.WS2_32.dll_recv]
mov ebp, eax
cmp ebp, 1
jl 0x40e47e
cmp dword [esp + 0x10], edi
push 0
push ebp
lea eax, [esp + 0x120]
mov ecx, edi
push eax
cmove ecx, ebx
push ecx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, ebp
jne 0x40e47e
inc esi
push 0
pop ebp
cmp esi, dword [esp + 0x14]
jb 0x40e40d
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
push ebp
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], ebx
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 1
jge 0x40e404
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x508
ret
Function at 0x40e489
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [esi + 1]
mov edi, ecx
cmp eax, 0x40
jae 0x40e4f9
push 4
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x100]
push edi
push eax
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
test esi, esi
je 0x40e4d7
mov eax, esi
shl eax, 2
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xfc]
push eax
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
xor esi, esi
push esi
push esi
push esi
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x40e502
push 0x274c
call dword [sym.imp.WS2_32.dll_WSASetLastError]
or eax, 0xffffffff
pop edi
pop esi
leave
ret 0xc
cmp eax, 0xffffffff
je 0x40e4f9
mov ecx, dword [edi + esi*4]
lea edx, [ebp - 0x104]
call fcn.0040e1b8
test al, al
jne 0x40e521
inc esi
cmp esi, 1
jb 0x40e507
jmp 0x40e4f9
mov eax, ecx
jmp 0x40e4fc

Function at 0x40e56a
Capabilities:
Create udp socket

Disassembly:
push ebx
push esi
push edi
push 0x11
push 2
mov edi, ecx
pop ebx
movzx eax, word [edi]
push ebx
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x40e5a9
cmp word [edi], bx
push 0x1c
pop ecx
push 0x10
pop eax
cmove ecx, eax
push ecx
push edi
push esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x40e5a9
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or esi, 0xffffffff
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x40ed53
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push eax
push 0x40
mov edi, edx
push ebx
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40ede4
mov ecx, dword [esi + 0x3c]
mov eax, edi
sub eax, esi
add ecx, esi
lea edx, [eax + ebx]
push edx
push eax
push dword [ecx + 0x34]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov edx, esi
mov ecx, esi
mov dword [ebp - 0xc], eax
call fcn.0040d82e
xor ecx, ecx
mov edx, ecx
test ebx, ebx
je 0x40edc1
and dword [ebp + 8], 0
movzx eax, cl
mov al, byte [ebp + eax + 0xc]
xor byte [edx + edi], al
inc cl
movzx eax, cl
cmp cl, 4
cmove eax, dword [ebp + 8]
inc edx
mov cl, al
cmp edx, ebx
jb 0x40eda0
push dword [ebp - 8]
mov edx, dword [ebp - 0x10]
push dword [ebp - 0xc]
mov edx, dword [edx + 0x34]
push esi
mov ecx, esi
call fcn.0040d82e
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40efc5
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0xb0
push ebp
push esi
mov esi, dword [sym.imp.msvcrt.dll_memcpy]
push edi
mov edi, ecx
cmp edx, 0xffffffff
je 0x40f07d
test byte [esp + 0xc4], 2
mov dword [esp + 0x10], 0x80
je 0x40f00e
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x40f021
or eax, 0xffffffff
jmp 0x40f0f7
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
push edx
call dword [sym.imp.WS2_32.dll_getsockname]
jmp 0x40f002
push 2
pop ebp
cmp word [esp + 0x38], bp
jne 0x40f050
push 4
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x23], 1
call esi
push ebp
lea eax, [esp + 0x4a]
push eax
lea eax, [esp + 0x34]
push eax
call esi
add esp, 0x18
jmp 0x40f0ad
cmp word [esp + 0x38], 0x17
jne 0x40f006
push 0x10
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x23], 4
call esi
push ebp
lea eax, [esp + 0x4a]
push eax
lea eax, [esp + 0x40]
push eax
call esi
add esp, 0x18
jmp 0x40f09e
push 0x1c
lea eax, [esp + 0x20]
push 0
push eax
call dword [sym.imp.msvcrt.dll_memset]
add esp, 0xc
test byte [esp + 0xc4], 1
je 0x40f0a8
mov byte [esp + 0x17], 4
mov dword [esp + 0x10], 0x12
jmp 0x40f0b5
mov byte [esp + 0x17], 1
mov dword [esp + 0x10], 6
mov al, byte [esp + 0xc0]
mov byte [esp + 0x15], al
push 4
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
mov byte [esp + 0x20], 5
mov byte [esp + 0x22], 0
call esi
mov eax, dword [esp + 0x1c]
add esp, 0xc
add eax, 4
push eax
lea edx, [esp + 0x1c]
mov ecx, edi
call fcn.0040e26f
xor ecx, ecx
test al, al
setne cl
mov eax, ecx
pop edi
pop esi
pop ebp
add esp, 0xb0
ret 8
Function at 0x40fad8
Capabilities:
Get local ipv4 addresses
Get socket information
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, ecx
cmp edx, 0xffffffff
je 0x40fb28
test byte [ebp + 0xc], 2
mov dword [ebp - 4], 0x10
je 0x40fb0b
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x40fb1c
or eax, 0xffffffff
jmp 0x40fb53
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push edx
call dword [sym.imp.WS2_32.dll_getsockname]
jmp 0x40fb02
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov ax, word [ebp - 0x1a]
jmp 0x40fb2e
and dword [ebp - 8], 0
xor eax, eax
mov word [ebp - 0xa], ax
mov al, byte [ebp + 8]
push 0
mov byte [ebp - 0xb], al
push 8
lea eax, [ebp - 0xc]
push eax
push esi
mov byte [ebp - 0xc], 0
call dword [sym.imp.WS2_32.dll_send]
sub eax, 8
neg eax
sbb eax, eax
inc eax
pop esi
leave
ret 8