joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aac20
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push ebx
xor ecx, ecx
mov dword [ebp - 0x17c], ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a84
mov eax, dword [ebp - 8]
call fcn.00404a84
lea eax, [ebp - 0x160]
mov edx, dword [0x407b5c]
call fcn.00404ff4
xor eax, eax
push ebp
push 0x4aaec4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040489c
mov edx, dword [ebp - 4]
mov al, byte [edx + eax - 1]
sub al, 0x2f
je 0x4aacaf
sub al, 0x2d
je 0x4aacaf
lea eax, [ebp - 4]
mov edx, 0x4aaedc
call fcn.004048a4
mov eax, dword [ebp - 8]
call fcn.0040489c
mov edx, dword [ebp - 8]
mov al, byte [edx + eax - 1]
sub al, 0x2f
je 0x4aacd3
sub al, 0x2d
je 0x4aacd3
lea eax, [ebp - 8]
mov edx, 0x4aaedc
call fcn.004048a4
lea eax, [ebp - 0x164]
mov ecx, 0x4aaee8
mov edx, dword [ebp - 4]
call fcn.004048e8
mov eax, dword [ebp - 0x164]
lea ecx, [ebp - 0x160]
mov edx, 0x3f
call fcn.00408ff8
test eax, eax
jne 0x4aae88
mov eax, dword [ebp - 0x154]
mov edx, 0x4aaef4
call fcn.004049e0
je 0x4aae6a
mov eax, dword [ebp - 0x154]
mov edx, 0x4aaf00
call fcn.004049e0
je 0x4aae6a
lea edx, [ebp - 0x16c]
mov eax, dword [0x4ae698]
mov eax, dword [eax]
call fcn.00462bfc
mov eax, dword [ebp - 0x16c]
lea edx, [ebp - 0x168]
call fcn.00409154
mov edx, dword [ebp - 0x168]
mov eax, dword [ebp - 0x154]
call fcn.004049e0
je 0x4aae6a
mov eax, dword [ebp - 0x154]
mov edx, 0x4aaf0c
call fcn.004049e0
je 0x4aae6a
lea edx, [ebp - 0x170]
mov eax, 0x4aaf20
call fcn.0040ce50
mov edx, dword [ebp - 0x170]
mov eax, dword [ebp - 0x154]
call fcn.004049e0
je 0x4aae6a
mov eax, dword [ebp - 0x154]
mov edx, 0x4aaf5c
call fcn.004049e0
je 0x4aae6a
lea eax, [ebp - 0x174]
mov ecx, dword [ebp - 0x154]
mov edx, dword [ebp - 8]
call fcn.004048e8
mov eax, dword [ebp - 0x174]
call fcn.00404a94
push eax
lea eax, [ebp - 0x178]
mov ecx, dword [ebp - 0x154]
mov edx, dword [ebp - 4]
call fcn.004048e8
mov eax, dword [ebp - 0x178]
call fcn.00404a94
push eax
call sub.KERNEL32.DLL_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4aae6a
push 0x142
push 0x4aaf6c
lea eax, [ebp - 0x17c]
push eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x184], eax
mov byte [ebp - 0x180], 0xb
lea edx, [ebp - 0x184]
xor ecx, ecx
mov eax, 0x4aaf78
call fcn.004099d4
mov eax, dword [ebp - 0x17c]
call fcn.00404a94
push eax
mov eax, dword [0x4afda0]
call fcn.00448024
push eax
call sub.user32.dll_MessageBoxA_1
sub eax, 3
je 0x4aae88
dec eax
je 0x4aadbd
lea eax, [ebp - 0x160]
call fcn.00409048
test eax, eax
je 0x4aad04
lea eax, [ebp - 0x160]
call fcn.0040906c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aaecb
lea eax, [ebp - 0x17c]
mov edx, 7
call fcn.00404608
lea eax, [ebp - 0x160]
mov edx, dword [0x407b5c]
call fcn.004050c4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404608
ret
Function at 0x4ab560
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ab5cc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x100]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.00409458
mov eax, dword [ebp - 0x104]
mov ecx, ebx
mov dl, 1
call fcn.004ab44c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab5d3
lea eax, [ebp - 0x104]
call fcn.004045e4
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rdata
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x16e7fef
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6b4e7440
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x41c40eca
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x689e6a86
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4083b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x499790
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4c9124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0046d010
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.00456f64
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40eeb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x40efa4
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x40ef93
jg 0x40eef0
test edx, edx
je 0x40ef93
nop dword [eax]
call fcn.00407100
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x40ef44
jg 0x40ef07
test esi, esi
je 0x40ef44
cmp ebx, eax
jg 0x40ef17
jl 0x40ef11
cmp edi, esi
jae 0x40ef17
mov esi, edi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x20]
push dword [eax]
call fcn.00473580
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x40ef77
mov eax, dword [esp + 0x10]
movzx ecx, byte [eax]
mov eax, dword [esp + 0xc]
push ecx
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4a02ac]
mov ecx, dword [esp + 0x10]
call esi
cmp eax, 0xffffffff
je 0x40ef8d
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x40eef0
jl 0x40ef8d
test edi, edi
jne 0x40eef0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x40efc6
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x40efc8
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x40f046
jg 0x40efdb
test esi, esi
je 0x40f046
test eax, eax
jl 0x40f02a
jg 0x40efe5
test ebx, ebx
je 0x40f02a
cmp edi, eax
jg 0x40eff5
jl 0x40efef
cmp esi, ebx
jae 0x40eff5
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00473580
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x40f046
jg 0x40f02d
test esi, esi
je 0x40f046
jmp 0x40f02d
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x40f046
push eax
push esi
push 1
push edx
call fcn.0047a649
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40f5d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4c9124]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, 0xffffffff
jne 0x40f600
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046cddf
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi + 0x20]
push esi
mov ecx, dword [eax]
test ecx, ecx
je 0x40f63c
mov edx, dword [edi + 0x30]
mov esi, dword [edx]
lea eax, [esi + ecx]
cmp ecx, eax
jae 0x40f63c
lea ecx, [esi - 1]
mov dword [edx], ecx
mov edx, dword [edi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046cddf
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x4c], 0
je 0x40f737
mov esi, dword [edi + 0xc]
lea eax, [edi + 0x3c]
cmp dword [esi], eax
jne 0x40f664
mov edx, dword [edi + 0x54]
mov ecx, dword [edi + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [edi + 0x1c]
mov dword [eax], ecx
mov eax, dword [edi + 0x2c]
mov dword [eax], edx
mov eax, dword [edi + 0x38]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x40f69a
push dword [edi + 0x4c]
movsx eax, bl
push eax
call fcn.00479bf3
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046cddf
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 0x25], bl
mov esi, dword [eax]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 4]
push eax
mov esi, dword [esi + 0x1c]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [edi + 0x40]
push eax
call dword [0x4a02ac]
mov ecx, dword [ebp - 0x2c]
call esi
sub eax, 0
je 0x40f707
sub eax, 1
je 0x40f707
sub eax, 2
jne 0x40f737
push dword [edi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.00479bf3
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop esi
pop edi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046cddf
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x30]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x40f727
lfence
push dword [edi + 0x4c]
push esi
push 1
push eax
call fcn.0047a649
add esp, 0x10
cmp esi, eax
jne 0x40f737
lea eax, [ebp - 0x25]
mov byte [edi + 0x3d], 1
cmp dword [ebp - 0x34], eax
jne 0x40f627
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.0046cddf
mov esp, ebp
pop ebp
ret 4
Function at 0x40fce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4c9124]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40fdbb
cmp byte [ebx + 0x3d], 0
je 0x40fdbb
mov eax, dword [ebx]
push esi
push 0xffffffffffffffff
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4a02ac]
mov ecx, ebx
call esi
cmp eax, 0xffffffff
je 0x40fda9
push edi
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov esi, dword [edi]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebx + 0x40]
push eax
mov esi, dword [esi + 0x20]
mov ecx, esi
call dword [0x4a02ac]
mov ecx, edi
call esi
pop edi
sub eax, 0
je 0x40fd6e
sub eax, 1
je 0x40fd72
sub eax, 2
jne 0x40fda9
mov byte [ebx + 0x3d], al
mov al, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046cddf
mov esp, ebp
pop ebp
ret
mov byte [ebx + 0x3d], 0
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub esi, eax
je 0x40fd92
lfence
push dword [ebx + 0x4c]
push esi
push 1
push eax
call fcn.0047a649
add esp, 0x10
cmp esi, eax
jne 0x40fda9
cmp byte [ebx + 0x3d], 0
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046cddf
mov esp, ebp
pop ebp
ret
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046cddf
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop ebx
call fcn.0046cddf
mov esp, ebp
pop ebp
ret
Function at 0x418db0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49ad48
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4c9124]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
call eax
test eax, eax
jge 0x418df5
or eax, 0xffffffff
jmp 0x418f7b
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x124
push ecx
mov ecx, dword [ebp + 8]
call fcn.00418090
test eax, eax
je 0x418e20
mov edx, dword [ebp - 0x10]
add edx, 0x124
mov dword [ebp - 0x14], edx
jmp 0x418e3c
mov eax, dword [ebp - 0x10]
add eax, 0x18
push eax
mov ecx, dword [ebp + 8]
call fcn.00418830
test eax, eax
je 0x418e3c
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
je 0x418eea
mov ecx, dword [ebp + 8]
call fcn.00418070
and eax, 0
jne 0x418eea
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [ebp + 8]
call fcn.00417f90
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.00419030
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.0041a250
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.0041a280
mov dword [ebp - 0x1c], eax
jmp 0x418ea7
lea ecx, [ebp - 0x3c]
call fcn.0041a280
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x418edb
mov edx, dword [ebp - 0x18]
add edx, 0x14
cmp edx, dword [ebp - 0x20]
jae 0x418edb
mov eax, dword [ebp - 0x1c]
push eax
push str._H__p
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
lea eax, [edx + ecx*2]
push eax
call fcn.00420000
add esp, 0xc
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
jmp 0x418e9c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00417400
mov ecx, dword [ebp + 8]
call fcn.004182f0
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 8]
call fcn.00418070
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
mov ecx, dword [ebp + 8]
call fcn.00418f90
push eax
mov ecx, dword [ebp + 8]
call fcn.004196b0
push eax
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
call fcn.004184e0
push eax
mov ecx, dword [ebp + 8]
call fcn.00418420
push eax
mov ecx, dword [ebp + 8]
call fcn.00418400
push eax
push 0
mov ecx, dword [ebp + 8]
call fcn.00417f90
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x418f78
mov ecx, dword [ebp - 0x10]
call fcn.0040b510
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [ebp - 0x10]
call fcn.0040b510
jmp 0x418f7b
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4210a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4210df
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 8], eax
call fcn.00479715
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
or eax, 0xffffffff
jmp 0x4210e8
mov eax, dword [ebp - 4]
jmp 0x4210e8
mov esp, ebp
pop ebp
ret

Function at 0x421180
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x18], 0
jne 0x421195
mov dword [ebp - 4], 0
jmp 0x4211a0
mov ecx, dword [ebp + 0x18]
call fcn.0041f2e0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4211e3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
call fcn.00479715
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
or eax, 0xffffffff
jmp 0x4211ec
mov eax, dword [ebp - 8]
jmp 0x4211ec
mov esp, ebp
pop ebp
ret

Function at 0x4211f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x421272
call fcn.00421880
call fcn.00479715
cmp dword [eax], 0x2747
je 0x42122c
or eax, 0xffffffff
jmp 0x421275
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00423e20
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x421267
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0xc], eax
call fcn.00479715
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
or eax, 0xffffffff
jmp 0x421275
mov eax, dword [ebp - 4]
jmp 0x421275
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4214b0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_WSASend]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x421533
call fcn.00421880
call fcn.00479715
cmp dword [eax], 0x2747
jne 0x421501
cmp dword [ebp - 8], 0
je 0x421506
or eax, 0xffffffff
jmp 0x421536
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00423ea0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x42152d
call fcn.00421880
or eax, 0xffffffff
jmp 0x421536
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x423e20
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 1
mov eax, 1
test eax, eax
je 0x423e8a
mov ecx, dword [ebp + 0x10]
shr ecx, 1
mov edx, dword [ebp + 0x10]
sub edx, ecx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x423e6b
jmp 0x423e8a
call fcn.00421880
call fcn.00479715
cmp dword [eax], 0x2747
jne 0x423e83
cmp dword [ebp - 8], 0
je 0x423e88
or eax, 0xffffffff
jmp 0x423e8d
jmp 0x423e34
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x424110
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x4c9124]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4cc7d8], 0
jne 0x42419c
mov eax, dword [ebp + 8]
and eax, 0xff
movzx ecx, al
mov edx, dword [ebp + 0xc]
and edx, 0xff
movzx eax, dl
shl eax, 8
or ecx, eax
mov word [ebp - 0x198], cx
lea ecx, [ebp - 0x194]
push ecx
movzx edx, word [ebp - 0x198]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x424192
mov eax, dword [ebp - 0x19c]
push eax
push str.ACE_OS::socket_init__WSAStartup_failed__WSAGetLastError_returned__d_n
push 2
call fcn.0047a358
add esp, 4
push eax
call fcn.0041fed0
add esp, 0xc
mov dword [0x4cc7d8], 1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046cddf
mov esp, ebp
pop ebp
ret

Function at 0x426040
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0xffffffff
jne 0x4260ba
call fcn.00402330
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub eax, 3
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x4d
ja case.0x426078.1
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 0x4260d4]
jmp dword [edx*4 + 0x4260c0]
call fcn.00479715
mov dword [eax], 0xc
jmp case.0x426078.1
call fcn.00479715
mov dword [eax], 0x11
jmp case.0x426078.1
call fcn.00479715
mov dword [eax], 0xd
jmp case.0x426078.1
call fcn.00479715
mov dword [eax], 2
or eax, 0xffffffff
jmp 0x4260bc
xor eax, eax
mov esp, ebp
pop ebp
ret