joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e959a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [edi - 1], 0
pushfd
mov byte [esp + 4], ch
push dword [esp + 4]
pushfd
lea esp, [esp + 0x10]
jne 0x101ab4ee
rcl di, cl
not di
rcr edi, cl
movzx di, cl
mov edi, dword [edx + 0x24]
call fcn.101ab5f6

Function at 0x100e9f43
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
jbe 0x101a5ed2
jmp 0x100ea21e
ja 0x101aac4f
jmp 0x101ab48c
shl di, 0xf
ror edi, 5
sbb di, 0xbe5c
adc di, sp
sub ecx, 1
bts di, 4
clc
sub ecx, 1
shl di, cl
btc di, 4
mov dword [ebp - 4], ecx

Function at 0x100ea0b4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
push dword [esp]
lea eax, [ebx + eax*4]
mov byte [esp], dl
pushfd
lea esp, [esp + 0x2c]
jns 0x100ea2c1
call fcn.100fdb00
jp 0x100e9312
push ebx
pushfd
pushal
lea esp, [esp + 0x28]
jb 0x100f8fd0
jge 0x100f9424
push ecx
mov byte [esp], 0x86
push dword [esp]
lea esp, [esp + 8]
call fcn.100fdb00
pushal
lea esp, [esp + 0x20]
jb 0x100f8fd0
call fcn.100e937c

Function at 0x100ea692
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x2c]
jb 0x100e9281
neg al
mov eax, dword [ebp - 0x20]
dec dh
not cl
test bh, ah
not eax
xchg dh, cl
rcl dh, 1
mov cl, byte [eax + edi]
bts ax, 8
xadd ah, dh
add cl, cl
movzx ax, cl
mov dh, dl
jmp 0x101a4453

Function at 0x100eb590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp], 0x12d7
push 0x266f0842
call fcn.101a65ff
add byte [eax], al
dec ebp
popal
jo 0x100eb5dc
imul esp, dword [ebp + 0x77], 0x6946664f
insb byte es:[edi], dx
add byte gs:[ebp - 0x17efdb9c], cl
lea esp, [esp + 0x10]
call fcn.100ebc58
call 0x101a53e3
add byte [eax], al
dec ecx
jae 0x100eb5e5
popal
push edi
jb 0x100eb611
je 0x100eb60f
push eax
je 0x100eb61f
add dh, dh
rol dh, 1
add al, 0x24
pop ss
jae 0x100eb651
and al, 0x28
jmp 0x101a360a
or eax, dword [eax]
and byte [esi - 0x7cf6ae5c], 0x39
jl 0x100eb5f1
mov cl, dl
pop ebp
imul ebx, dword [edi + ecx*8], 0x5f
adc eax, 0x89d7539b
out 0xa7, eax
into
mov esp, esi
out 0x91, eax
mov bl, byte [ecx]
xlatb
pop ebx
stc
out dx, al
and ebp, dword [bp + di]
Function at 0x100ebbd6
Capabilities:
Check http status code

Disassembly:
bt cx, sp
push 0xc26601fa
sub ecx, 1
mov byte [esp], al
call fcn.101ab5ae
add edi, eax
jmp 0x101ab60b
push esi
mov ah, al
mov eax, ecx
stc
test bl, 0x96
pushfd
shl eax, 4
bt cx, 5
cmc
add eax, edx
pushfd
pushfd
push edx
lea eax, [ebx + eax*4]
call fcn.101a5b46
add byte [eax], al
push ebp
jo 0x100fd855
popal
je 0x100fd859
push edi
imul ebp, dword [esi + 0x64], 0xe800776f
xor byte [edi + 0xfac000a], al
mov dword [0xe392e9e3], eax
invalid
clc
fsubr dword [eax + 0x70]
pop ebp
pop edx
jg 0x100fd861
invalid
push 0xdb4ec2b2
lea esp, [esp + 8]
jne 0x100ea685
stc
dec edx
neg edx
btr cx, cx
mov dword [ebp - 0x1c], edi
rcr cx, cl
push esi
sal edx, cl
bsr edi, esi
mov edi, dword [ebp + 0xc]
sbb dl, bh
stc
sub eax, eax
adc dh, al
mov byte [ebp - 2], al
shr cl, 5
xadd ch, dl
mov ecx, eax
movzx edx, dl
mov dword [ebp - 0x20], eax
test ch, al
bsr dx, sp
adc dl, 0xef
mov dword [ebp - 0x24], eax
shl dx, 3
rol dl, cl
bswap dx
rol edx, cl
mov dword [ebp - 0x28], eax
shrd dx, dx, cl
add dh, 0xf2
mov dword [ebp - 0x14], eax
add dh, 0x7d
sub eax, 1
cmc
mov dword [ebp - 0x18], eax
cmp ah, 0xc8
bswap ax
cmp dh, cl
mov edx, edi
btr ax, di
sub edx, dword [ebp + 0xc]
sets al
setle ah
and edx, 3
jmp 0x100fd7cc
lea esp, [esp + 0x54]
jb 0x100ea01a
sub ecx, 1
push ebp
jmp 0x101ab284

Function at 0x100f8db1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 8], edi
pushfd
pushfd
mov dword [esp + 0xc], ebx
call fcn.100eb590

Function at 0x100f8e28
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x48]
jb 0x101a5ee0
stc
pushfd
test ah, dh
cmp eax, dword [ebp - 0x10]
pushfd
lea esp, [esp + 8]
jae 0x101a5ee0
push 0x862cbd35
push dword [esp]
pushfd
mov word [esp], 0xba5
lea esp, [esp + 0xc]
jmp fcn.100e92af
Function at 0x100f8fcb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, ecx
pushfd
pushfd
pushal
lea esp, [esp + 0x34]
jb 0x101aa673
lahf
das
sub ah, 0x6f
pushal
cmp ecx, 0xa
setge al
movzx ax, bl
mov eax, 3
mov byte [esp + 8], bl
mov word [esp], dx
push 0x4bc90c5e
pushfd
lea esp, [esp + 0x28]
jb 0x101aa673
shl eax, cl
ror ah, cl
add ax, ax
mov eax, 6
test ax, cx
sub ecx, eax
not al
mov al, byte [ebp - 2]
call fcn.101ad697
add byte [eax], al
dec eax
popal
jo 0x100e9bb2
jb 0x100e9bd6
popal
je 0x100e9bd9
add al, al
rol byte [ebx], 0xe8
ret 0xbc5
xor byte [ebp + 0x660000f3], 0xf
mov dh, 0xd0
mov ecx, eax
cmp si, 0xf11c
cmp dh, 0xf4
or dx, 0x15cc
mov edx, 1
jnp 0x100fd86e
add dword [eax], eax
shr ecx, 1
pushal
adc edx, edx
pushal
test cl, ah
cmc
jmp 0x70e0ad3b
shl byte [eax - 0x7c], cl
loope 0x100e9bd3
pushfd
sub ecx, 1
test al, 0x23
shl edx, cl
pushfd
pushfd
cmc
mov dword [ebp - 0x20], edx
push 0x4e57a930
jmp 0x101abe31
call fcn.101a4396
call fcn.100eb45e
add byte [eax], al
jb 0x100f9392
popal
add al, ch
call 0x101aa84e
not al
push ecx
call fcn.100fdd49
sar cl, 0xe8
inc ebx
sbb dword [ebx], ecx
add byte [eax - 0x2f], ch
push 0x30df51d1
lea esp, [esp + 0x30]
jae 0x100e9281
push 0x44dc0c34
xor bh, ch
rcl bh, cl
aaa
mov ebx, dword [esp + 4]
shrd cx, sp, 6
xor al, 0x7e
daa
mov ecx, dword [esp + 8]
cwde
movzx ax, bl
bsr ax, bp
mov byte [ebp - 2], dl
shrd ax, cx, 4
shld ax, bx, cl
stc
lea eax, [esp - 0x46cddb5a]
cmp ecx, 4
not ah
lahf
setg ah
jmp 0x100e9b11
jmp 0x101a5540
jmp 0x101a43d3
pushal
test esi, esp
test si, 0x9630
test edx, edx
jmp 0x100fd836
mov word [esp + 4], di
push ebx
lea esp, [esp + 0x24]
je 0x101a5ed2
movzx cx, cl
add edx, eax
rol cl, cl
push esp
mov ecx, dword [esi + 0x7c]
jmp 0x101a93c3
mov esi, dword [eax + 0x3c]
stc
add esi, eax
shr dh, 5
mov edx, dword [esi + 0x78]
ja 0x101a3c63
cmc
clc
pushfd
test edx, edx
push dword [esp]
mov byte [esp], dl
push dword [esp]
lea esp, [esp + 0xc]
je 0x101a5ed2
pushfd
setae cl
add edx, eax
sbb cx, bx
shl ch, 5
bt bx, 1
sar cx, 6
mov ecx, dword [esi + 0x7c]
pushfd
pushfd
clc
cmp dl, ah
add ecx, edx
pushfd
cmp bh, ah
push ebx
mov dword [ebp - 0x10], ecx
inc cl
or ch, 0x13
stc
mov ecx, dword [ebp + 0xc]
pushal
bt si, 5
cmc
clc
cmp ecx, 0xffff
pushfd
pushfd
jmp 0x101a6471
test ah, 0xbb
stc
add ecx, edx
pushal
mov dword [ebp - 0x10], ecx
cmc
call fcn.101a363c
add byte [eax], al
inc edi
je 0x101a9426
outsd dx, dword [esi]
jne 0x101a9449
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
jb 0x101a9451
popal
je 0x101a9450
outsd dx, dword [esi]
outsb dx, byte [esi]
invalid

Function at 0x100f9011
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shrd ax, ax, 0xa
lea ebp, [esp + 4]
btc ax, 0xa
sub ax, bp
sub esp, 0x14
lahf
rcl ax, 6
btr eax, ebx
bsr ax, ax
push esi
ror ah, 1
pushal
mov dword [esp + 0x1c], edi
cmc
pushfd
mov dword [esp + 0x1c], ebx
bswap ax
sar ax, cl
aaa
mov dword [esp + 0x18], edx
btc ax, bp
mov eax, dword [ebp + 8]
clc
cmp di, 0x1a9f
Function at 0x100f90b2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x28]
jb 0x101abd0c
cmc
xor dh, dl
call fcn.100f941f
jmp 0x101a4570
call fcn.100ea086
insd dword es:[edi], dx
jae 0x101a455f
arpl word [edx + 0x74], si
insb byte es:[edi], dx
insb byte es:[edi], dx
add dh, al
add al, 0x24
push ebp
pushfd
lea esp, [esp + 0x30]
ja 0x101a5b3a
push esp
neg al
sbb al, 0xaf
sub ebx, edi
lea edi, [ebx*8 - 0x245544ac]
bsr di, sp
shl al, 4
sub esp, 0xfffffffc
add ebx, esp
bt cx, 0xd
mov edi, ebx
not al
mov al, 0x2e
call fcn.101aabfb
ror byte [ebx - 0x639f1fbb], 0xe8
xor dl, byte [eax + eax]
add byte [esi - 0x17], dl
or eax, 0xf2000065
scasb al, byte es:[edi]
repne scasb al, byte es:[edi]
jmp 0x101a44e1

Function at 0x100f941f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.100e926c
jmp 0x101a6322
imul eax, eax, 0x300
rcl edx, cl
test edi, ebx
lea eax, [ebx + eax*4 + 0x94d8]
rcl dh, cl
push ecx
stc
lea edx, [ebx + 0x513f9a5e]
push ebx
btc ebx, ebx
mov ebx, eax
inc dh
bt ecx, 0x10
pushal
dec dx
mov edx, 1
bt dx, ax
bt bp, 7
cmp ecx, 7
jmp 0x100eacf5
pushfd
push dword [esp]
pushfd
lea esp, [esp + 0xc]
call fcn.100fdb00
pushal
lea esp, [esp + 0x20]
jb 0x100f8fd0
aad 0x43
cdq
movzx eax, byte [ebp - 2]
bsr dx, dx
rol dx, 1
jmp 0x101ad6b3
shr eax, 5
btr dx, 5
jmp 0x101a3f58

Function at 0x101a35f5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
jne 0x101a5412

Function at 0x101a4396
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x10]
ja 0x100ea7b4
push esi
lea esp, [esp + 4]
jb 0x100eb4c8
clc
call fcn.100e959a

Function at 0x101a4fcd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test ch, bl
repne scasb al, byte es:[edi]
pushal
lea esp, [esp + 0x2c]
jne 0x101a5ed2
xchg esi, ecx
jmp 0x101a5b21
shld si, ax, cl
mov ecx, edi
sub si, dx
sub ecx, ebx
btr si, si
test al, 0x3d
bswap si
cmp ch, 0xfa
mov esi, esp
Function at 0x101a5ff4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], ch
lea esp, [esp + 0x10]
call fcn.100fdb00
call fcn.101abcfd
pushfd
mov byte [ebp - 2], al
pushfd
pushfd
lea esp, [esp + 0x38]
jmp 0x101a33ff

Function at 0x101a6396
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [ebp - 2], al
sub ch, 0x9b
adc dh, al
bt dx, cx
shld edx, esp, 6
mov ecx, eax
bts dx, 9
seta dh
setns dl
mov dword [ebp - 0x20], eax
neg dh
pushfd
ror dl, cl
mov dword [ebp - 0x24], eax
sub dl, ah
shl dl, 4
sar dl, 3
sub dx, sp
mov dword [ebp - 0x28], eax
shr dx, 2
not dh
mov dword [ebp - 0x14], eax
shl dh, 2
sub eax, 1
test dl, 0x3c
bt ebp, esi
mov dword [ebp - 0x18], eax
sbb dh, 0xa1
rdtsc
cwde
mov edx, edi
bt sp, 0xc
adc ah, al
sub edx, dword [ebp + 0xc]
neg ah
and edx, 3
btr eax, ebp
mov eax, ecx
cmp dh, 0xa7
stc
stc
shl eax, 4
pushal
add eax, edx
call fcn.101a9876

Function at 0x101a6c69
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ror al, 1
jmp 0x101a6431
cmp di, 0x7416
sub al, 1
jmp 0x101a5047

Function at 0x101a8ccf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], bh
call 0x101a9c1d
shl bh, cl
cmc
bswap ebx
mov ebx, eax
cmp ah, 0x76
cmp byte [edi], 0x23
pushal
lea esp, [esp + 0x20]
jne 0x101a5412
shrd ax, si, cl
aad 0x7b
btr ax, 3
sub edx, edx
cwde
dec al
mov eax, edx
neg al
pushal
add al, cl
add edi, 1
pushal
sub al, dl
mov al, byte [edi]
push edx
cmc
test cl, 0xd7
clc
test al, al
mov byte [esp + 4], 0x9c
lea esp, [esp + 0x44]
jmp 0x101a54ec

Function at 0x101a942a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
lea esp, [esp + 0x44]
jb 0x100f8fd0
pushfd
pushal
lea esp, [esp + 0x24]
jmp 0x100ea0e1

Function at 0x101aa661
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x34]
jb 0x101aa673
sete al
mov eax, 6

Function at 0x101ab124
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
jne 0x101a5412
test bx, ax
pushfd
bsr eax, ebp
dec eax
xor edx, edx
bswap ax
mov eax, edx
push dword [esp]
adc al, 0x5b
pushfd
add edi, 1
cmc
pushfd
stc
mov al, byte [edi]
test si, 0x720
pushal
bt sp, 7
stc
test al, al
mov word [esp], 0xe8cd
mov byte [esp], 0x1b
lea esp, [esp + 0x30]
jmp 0x101a54ec

Function at 0x101abcfd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
adc dl, dl
pushal
pushfd
lea esp, [esp + 0x2c]
jae 0x100e9281
Function at 0x40ad60
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x44c5c0]
sub esp, 0x190
lea edx, [esp]
push esi
mov esi, ecx
push edi
push edx
mov dword [esi + 0x24], eax
mov ecx, dword [0x44c5c0]
mov dword [esi + 0x30], ecx
push 0x101
mov dword [esi], 0x43d36c
call sub.WSOCK32.dll_WSAStartup
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
je 0x40adaa
push 0
push 0x44bad4
push 0x44c1f4
push 0
call edi
cmp word [esp + 8], 0x101
je 0x40adcd
push 0
push 0x44bad4
push str.Wrong_version_or_WinSock_not_loaded
push 0
call edi
push 0
call fcn.00415406
add esp, 4
mov dword [esi + 0x1c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x2c], eax
mov eax, esi
pop edi
pop esi
add esp, 0x190
ret

Function at 0x40ae10
Capabilities:
Access peb ldr_data
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x43a61b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x43d36c
push 0xc8
mov dword [esi + 0x20], 0x10
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x1c], 0xffffffff
je 0x40ae65
mov eax, dword [esi + 8]
push 0x200
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x1c]
push ecx
call sub.WSOCK32.dll_closesocket
call sub.WSOCK32.dll_WSACleanup
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.00427141
lea ecx, [esi + 0x24]
mov dword [esp + 0x14], 0xffffffff
call fcn.00427141
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x40aea0
Capabilities:
Access peb ldr_data
Create thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43a638
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 0x30]
mov dword [esp + 0x10], 0
mov dword [esi + 4], eax
mov dword [esi + 0x20], 0
call fcn.0042727a
mov dx, word [esp + 0x1c]
mov ecx, esi
mov word [esi + 0x34], dx
call fcn.0040b2c0
mov dword [esi + 0x20], eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x40af50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 8], eax
mov dword [esp + 0xc], 0xffffffff
lea ecx, [esp + 0x18]
jne 0x40af31
call fcn.00427141
xor al, al
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0xc
call fcn.00427141
mov ecx, dword [esp + 4]
mov al, 1
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0xc
Function at 0x40b2c0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 8
push esi
mov esi, ecx
xor ecx, ecx
lea eax, [esi + 0xc]
mov edx, eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov word [eax], 2
mov eax, dword [esi + 0x30]
push eax
call sub.WSOCK32.dll_inet_addr
mov dword [esi + 0x10], eax
mov ax, word [esi + 0x34]
push eax
call sub.WSOCK32.dll_htons
mov word [esi + 0xe], ax
mov eax, dword [esi + 0x1c]
cmp eax, 0xffffffff
je 0x40b305
push eax
call sub.WSOCK32.dll_closesocket
push 0
push 1
push 2
mov dword [esi + 0x1c], 0xffffffff
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x1c], eax
jne 0x40b333
push 0
push 0x44bad4
push 0x44c210
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 4]
push 4
push ecx
push 0x1005
push 0xffff
push edx
mov dword [esp + 0x18], 0x64
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x40b36d
mov eax, dword [esi + 0x1c]
push eax
call sub.WSOCK32.dll_closesocket
mov eax, 4
pop esi
add esp, 8
ret
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 8]
push 4
push ecx
push 0x1006
push 0xffff
push edx
mov dword [esp + 0x1c], 0x64
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x40b3a7
mov eax, dword [esi + 0x1c]
push eax
call sub.WSOCK32.dll_closesocket
mov eax, 4
pop esi
add esp, 8
ret
mov eax, 2
pop esi
add esp, 8
ret

Function at 0x40b3c0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43a658
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
lea eax, [esp + 0x14]
lea ecx, [esi + 0x30]
push eax
mov dword [esp + 0x10], 0
call fcn.0042727a
mov cx, word [esp + 0x18]
mov dword [esp + 0xc], 0xffffffff
mov word [esi + 0x34], cx
lea ecx, [esp + 0x14]
call fcn.00427141
mov ecx, dword [esp + 4]
pop esi
mov dword fs:[0], ecx
add esp, 0xc
ret 8

Function at 0x40b470
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [0x44c5c0]
sub esp, 0x190
lea edx, [esp]
push esi
mov esi, ecx
push edx
push 0x101
mov dword [esi + 0x1c], eax
mov ecx, dword [0x44c5c0]
mov dword [esi + 0x148], ecx
mov dword [esi], 0x43d370
call sub.WSOCK32.dll_WSAStartup
mov dword [esi + 0x18], eax
lea eax, [esi + 0x10]
mov edx, eax
xor ecx, ecx
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [eax], 2
mov dword [esi + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x144], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x128], 0xffffffff
mov eax, esi
pop esi
add esp, 0x190
ret
Function at 0x40b510
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x43a689
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x43d370
push 0xa
mov dword [esp + 0x18], 1
mov dword [esi + 0x124], 0x10
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x128], 0xffffffff
je 0x40b584
mov eax, dword [esi + 0xc]
push 0x300
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, esi
call fcn.0040b830
mov ecx, dword [esi + 0x128]
push ecx
call sub.WSOCK32.dll_closesocket
mov dword [esi + 0x124], 0x10
call sub.WSOCK32.dll_WSACleanup
lea ecx, [esi + 0x148]
mov dword [esp + 0x14], 0
call fcn.00427141
lea ecx, [esi + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00427141
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x40b5c0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
mov dl, byte [esp + 0xc]
push ebx
push esi
mov esi, ecx
mov bl, 1
mov ecx, dword [esp + 0x10]
mov dword [esi + 4], eax
mov dword [esi + 0x12c], ecx
mov byte [esi + 8], dl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
mov dword [esi + 0x144], eax
call fcn.0040b660
cmp eax, 4
mov dword [esi + 0x124], eax
jne 0x40b5fe
xor bl, bl
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x40b7e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x40b623
pop esi
xor al, al
pop ebx
ret 0xc
mov al, bl
pop esi
pop ebx
ret 0xc
Function at 0x40b660
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x10
push esi
push edi
push 0
push 1
mov esi, ecx
push 2
call sub.WSOCK32.dll_socket
lea ecx, [esp + 8]
push 4
push ecx
push 0x1005
mov edi, 0x1388
push 0xffff
push eax
mov dword [esi + 0x128], eax
mov dword [esp + 0x1c], edi
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
je 0x40b714
mov ecx, dword [esi + 0x128]
lea eax, [esp + 0xc]
push 4
push eax
push 0x1006
push 0xffff
push ecx
mov dword [esp + 0x20], edi
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
je 0x40b714
mov ecx, dword [esi + 0x128]
lea eax, [esp + 0x10]
push 4
push eax
push 0x1002
mov edi, 0x8000
push 0xffff
push ecx
mov dword [esp + 0x24], edi
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
je 0x40b714
mov ecx, dword [esi + 0x128]
lea eax, [esp + 0x14]
push 4
push eax
push 0x1001
push 0xffff
push ecx
mov dword [esp + 0x28], edi
call sub.WSOCK32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x40b72b
mov edx, dword [esi + 0x128]
push edx
call sub.WSOCK32.dll_closesocket
pop edi
mov eax, 4
pop esi
add esp, 0x10
ret
lea edi, [esi + 0x130]
xor eax, eax
mov ecx, edi
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dx, word [esi + 0x12c]
push edx
mov word [edi], 2
mov dword [esi + 0x134], eax
call sub.WSOCK32.dll_htons
mov word [esi + 0x132], ax
mov eax, dword [esi + 0x128]
push 0x10
push edi
push eax
call sub.WSOCK32.dll_bind
test eax, eax
mov dword [esi + 0x18], eax
jge 0x40b78c
mov ecx, dword [esi + 0x128]
push ecx
call sub.WSOCK32.dll_closesocket
pop edi
mov eax, 4
pop esi
add esp, 0x10
ret
mov edx, dword [esi + 0x128]
push 5
push edx
call sub.WSOCK32.dll_listen
test eax, eax
mov dword [esi + 0x18], eax
jge 0x40b7b8
mov eax, dword [esi + 0x128]
push eax
call sub.WSOCK32.dll_closesocket
pop edi
mov eax, 4
pop esi
add esp, 0x10
ret
mov ecx, dword [esi + 0x128]
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], ecx
mov eax, dword [esi + 0x20]
inc eax
pop edi
mov dword [esi + 0x20], eax
mov eax, 1
pop esi
add esp, 0x10
ret

Function at 0x40b890
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [ecx + 0x20]
cmp eax, 1
jle 0x40b8b1
mov edx, dword [esp + 8]
mov eax, dword [ecx + eax*4 + 0x20]
push 0
push edx
mov edx, dword [esp + 0xc]
push edx
push eax
call sub.WSOCK32.dll_send
ret 8
mov eax, 0xfffffffe
ret 8
Function at 0x40b8c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x124]
cmp eax, 0x10
ja case.0x40b8d7.4
xor ecx, ecx
mov cl, byte [eax + 0x40b98c]
jmp dword [ecx*4 + 0x40b978]
mov ecx, esi
call fcn.0040b660
mov dword [esi + 0x124], eax
pop edi
pop esi
ret
mov ecx, esi
call fcn.0040b9a0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov edx, dword [esi + 0x144]
mov dword [esi + 0x140], eax
sub eax, edx
cmp eax, 0xea60
jb case.0x40b8d7.3
call edi
mov dword [esi + 0x144], eax
mov dword [esi + 0x124], 4
pop edi
pop esi
ret
mov ecx, esi
call fcn.0040b830
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x144], eax
mov dword [esi + 0x124], 8
pop edi
pop esi
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov edx, dword [esi + 0x140]
mov dword [esi + 0x144], eax
sub edx, eax
cmp edx, 2
jb case.0x40b8d7.3
call edi
mov dword [esi + 0x144], eax
mov dword [esi + 0x124], 0
pop edi
pop esi
ret