joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ad0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, ecx
mov ecx, dword [esp + 4]
cmp ecx, 0x100012c
ja 0x401b44
je 0x401b3e
add ecx, 0xfefffff6
cmp ecx, 0xd7
ja case.0x401b97.16777727
movzx ecx, byte [ecx + 0x401d3c]
jmp dword [ecx*4 + 0x401d0c]
add eax, 4
ret 4
add eax, 0x10
ret 4
add eax, 8
ret 4
add eax, 0x14
ret 4
add eax, 0x18
ret 4
add eax, 0x1c
ret 4
add eax, 0x20
ret 4
add eax, 0x24
ret 4
add eax, 0x28
ret 4
add eax, 0xdc
ret 4
add eax, 0x2c
ret 4
cmp ecx, 0x10001f4
ja 0x401b7e
je 0x401b78
sub ecx, 0x100012d
je 0x401b72
sub ecx, 1
je 0x401b6c
sub ecx, 1
jne case.0x401b97.16777727
add eax, 0xd8
ret 4
add eax, 0x34
ret 4
add eax, 0x30
ret 4
add eax, 0x38
ret 4
add ecx, 0xfefffe0b
cmp ecx, 0xa2
ja case.0x401b97.16777727
movzx edx, byte [ecx + 0x401edc]
jmp dword [edx*4 + 0x401e14]
add eax, 0x3c
ret 4
add eax, 0x40
ret 4
add eax, 0x44
ret 4
add eax, 0x48
ret 4
add eax, 0x4c
ret 4
add eax, 0x50
ret 4
add eax, 0x54
ret 4
add eax, 0x58
ret 4
add eax, 0x5c
ret 4
add eax, 0x60
ret 4
add eax, 0x64
ret 4
add eax, 0x68
ret 4
add eax, 0x6c
ret 4
add eax, 0x70
ret 4
add eax, 0x74
ret 4
add eax, 0x78
ret 4
add eax, 0x7c
ret 4
add eax, 0x80
ret 4
add eax, 0x84
ret 4
add eax, 0x88
ret 4
add eax, 0x8c
ret 4
add eax, 0x90
ret 4
add eax, 0x94
ret 4
add eax, 0x98
ret 4
add eax, 0x9c
ret 4
add eax, 0xa0
ret 4
add eax, 0xa4
ret 4
add eax, 0xa8
ret 4
add eax, 0xac
ret 4
add eax, 0xb0
ret 4
add eax, 0xb4
ret 4
add eax, 0xb8
ret 4
add eax, 0xbc
ret 4
add eax, 0xc0
ret 4
add eax, 0xc4
ret 4
add eax, 0xc8
ret 4
add eax, 0xcc
ret 4
add eax, 0xd0
ret 4
add eax, 0xd4
ret 4
add eax, 0xe0
ret 4
add eax, 0xe4
ret 4
add eax, 0xe8
ret 4
add eax, 0xec
ret 4
add eax, 0xf0
ret 4
add eax, 0xf4
ret 4
add eax, 0xf8
ret 4
add eax, 0xfc
ret 4
add eax, 0x100
ret 4
add eax, 0x104
ret 4
xor eax, eax
ret 4
Function at 0x402720
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x430dd0]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [esp + 0x220]
push ebx
mov ebx, dword [esp + 0x21c]
push ebp
push esi
mov esi, dword [esp + 0x228]
push eax
push 0
push 0
push 0
mov ebp, ecx
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
mov dword [ebx], eax
mov ecx, ebp
jne 0x402774
mov eax, dword [ebp]
mov edx, dword [eax + 0x10]
call edx
jmp 0x40280c
lea eax, [esp + 0x10]
push eax
push 0x1000066
mov dword [esp + 0x18], 0
call fcn.00402360
test byte [esp + 0x10], 1
je 0x40279b
mov ecx, dword [ebx]
mov dword [esi], ecx
jmp 0x402849
mov eax, dword [0x4321d8]
cmp eax, 1
jne 0x402840
push edi
push 0x104
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edi, [esp + 0x18]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4027c1
lea eax, [esp + 0x18]
mov ecx, 7
mov esi, 0x426a98
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
pop edi
je 0x402802
push str.OpenVxDHandle
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x402828
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edx, dword [ebp]
mov eax, dword [edx + 0x10]
mov ecx, ebp
call eax
xor eax, eax
mov ecx, dword [esp + 0x21c]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00412951
add esp, 0x214
ret 0xc
mov ecx, dword [ebx]
push ecx
call eax
mov edx, dword [esp + 0xc]
push esi
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [esp + 0xc]
jmp 0x402849
cmp eax, 2
jne 0x402802
mov eax, dword [ebx]
mov dword [esi], eax
cmp dword [esi], 0
je 0x402802
mov eax, 1
jmp 0x40280e

Function at 0x402940
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
call edx
cmp dword [esi + 0x180], 0
jne 0x402963
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
mov eax, 1
pop esi
ret
mov eax, dword [esi + 0x17c]
test eax, eax
jne 0x40297a
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
xor eax, eax
pop esi
ret
push eax
mov dword [esi + 0x34], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x40296d
mov eax, dword [esi + 0x180]
test eax, eax
je 0x4029f0
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4029d9
mov eax, dword [esi + 0x180]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x180]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
mov dword [esi + 0x180], 0
call eax
xor eax, eax
pop esi
ret
mov ecx, dword [esi + 0x180]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x180], 0
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov eax, 1
pop esi
ret
Function at 0x402f00
Capabilities:
Get file version info

Disassembly:
sub esp, 0x218
mov eax, dword [0x430dd0]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
mov ebx, ecx
test ebx, ebx
je 0x402f20
lea eax, [ebx + 4]
jmp 0x402f22
xor eax, eax
push 0x34
push 0
push eax
call fcn.00412510
mov eax, dword [ebx + 0x38]
add esp, 0xc
test eax, eax
je 0x402f52
push 0x104
lea ecx, [esp + 0x14]
push ecx
push eax
mov dword [ebx + 0x58], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
ja 0x402f6a
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00412951
add esp, 0x218
ret
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x402f81
push eax
call fcn.00405b4d
add esp, 4
mov dword [ebx + 0x54], 0
push esi
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
jbe 0x402fd1
push esi
call fcn.00405b48
add esp, 4
push eax
push esi
push 0
lea ecx, [esp + 0x20]
push ecx
mov dword [ebx + 0x54], eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x402fd1
mov ecx, dword [ebx + 0x54]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
push 0x426ae8
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x402fea
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00412951
add esp, 0x218
ret
mov esi, dword [esp + 8]
push ebp
push edi
lea edx, [esp + 0x14]
push edx
lea ebp, [ebx + 4]
lea eax, [esp + 0x14]
push eax
mov ecx, 0xd
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x54]
push str.VarFileInfoTranslation
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x403028
cmp dword [esp + 0x14], 4
jb 0x403028
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
mov dword [ebx + 0x3c], eax
mov ecx, dword [esp + 0x224]
xor eax, eax
cmp dword [ebp], 0xfeef04bd
pop edi
pop ebp
pop esi
sete al
pop ebx
xor ecx, esp
call fcn.00412951
add esp, 0x218
ret
Function at 0x403ca0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
call edx
or eax, 0xffffffff
cmp dword [esi + 4], eax
je 0x403cb8
cmp dword [esi + 0x58], eax
jne 0x403cc6
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
xor eax, eax
pop esi
pop ecx
ret
cmp dword [esi + 0x180], 0
je 0x403cd6
mov ecx, esi
call fcn.00402940
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x4037f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x180], eax
jne 0x403d05
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
xor eax, eax
pop esi
pop ecx
ret
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov eax, 1
pop esi
pop ecx
ret

Function at 0x403d60
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
call edx
cmp dword [esi + 0x28], 0
je 0x403d78
mov ecx, esi
call fcn.00402b50
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
mov dword [esi + 0x24], eax
jne 0x403d9b
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
xor eax, eax
pop esi
pop ecx
ret
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x403a10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x28], eax
jne 0x403dc7
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
xor eax, eax
pop esi
pop ecx
ret
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov eax, 1
pop esi
pop ecx
ret

Function at 0x4046a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4046b9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4046f4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4046f0
lea ebx, [ebx]
cmp esi, eax
jae 0x4046f4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4046e0
cmp esi, eax
jb 0x4046fa
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x409ca6
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x409cdf
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00409c3f
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00408abd
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]
Function at 0x40b86a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x40b8ad
call fcn.0040cb4d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40b8ad
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40b8c8
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0040b424
test ebx, ebx
mov esi, eax
je 0x40b8c6
test edi, edi
je 0x40b8c6
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4106c7
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4106f5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x410713
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00410631
jmp 0x410713
mov eax, dword [esi + 0x14]
test eax, eax
je 0x410713
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00410631
test edi, edi
mov eax, edi
jne 0x4106fd
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4340a8]
test ecx, ecx
je 0x4107d6
jmp 0x4106c6
ret 8

Function at 0x412951
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430dd0]
jne 0x41295b
repz ret
jmp fcn.00417c9c
Function at 0x41c8d2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00416724
xor ebx, ebx
cmp dword [0x434e78], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x41c9a7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x41c912
xor eax, eax
jmp 0x41ca6b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x41c90b
push eax
call fcn.004166c1
mov dword [esp], 0x429538
push edi
mov dword [0x434e78], eax
call esi
push eax
call fcn.004166c1
mov dword [esp], 0x429524
push edi
mov dword [0x434e7c], eax
call esi
push eax
call fcn.004166c1
mov dword [0x434e80], eax
lea eax, [ebp - 8]
push eax
call fcn.00415104
test eax, eax
pop ecx
pop ecx
je 0x41c975
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00418037
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x41c9a7
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004166c1
cmp eax, ebx
pop ecx
mov dword [0x434e88], eax
je 0x41c9a7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004166c1
pop ecx
mov dword [0x434e84], eax
mov eax, dword [0x434e84]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x41ca20
cmp dword [0x434e88], esi
je 0x41ca20
push eax
call fcn.0041672d
pop ecx
call eax
cmp eax, ebx
je 0x41c9ed
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x434e88]
call fcn.0041672d
pop ecx
call eax
test eax, eax
je 0x41c9ed
test byte [ebp - 0x18], 1
jne 0x41ca20
lea eax, [ebp - 0xc]
push eax
call fcn.0041513b
test eax, eax
pop ecx
je 0x41ca08
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00418037
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x41ca17
or dword [ebp + 0x10], 0x200000
jmp 0x41ca51
or dword [ebp + 0x10], 0x40000
jmp 0x41ca51
mov eax, dword [0x434e7c]
cmp eax, esi
je 0x41ca51
push eax
call fcn.0041672d
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x41ca51
mov eax, dword [0x434e80]
cmp eax, esi
je 0x41ca51
push dword [ebp - 4]
push eax
call fcn.0041672d
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434e78]
call fcn.0041672d
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4240de
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x430dd0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00424073
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00412510
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x42412d
cmp dword [ebp - 0x1c], 5
jb 0x424145
jmp 0x424141
cmp dword [ebp - 0x10], 1
jne 0x424145
cmp dword [ebp - 0x1c], 4
ja 0x424141
jne 0x424145
cmp dword [ebp - 0x18], 0
jbe 0x424145
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x42a788
call fcn.00423f64
test eax, eax
jge 0x424166
mov byte [0x4321c0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00412951
add ebp, 0x78
leave
ret
Function at 0x401a4d
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
movzx esi, word [0x46faa6]
mov ebx, edx
push edi
movzx edi, word [0x46fa9a]
xor ebp, ebp
imul esi, edi
push ebp
push 0x80
push 2
push ebp
mov eax, esi
mov dword [esp + 0x2c], 1
imul eax, dword [0x46fa9c]
push ebp
push 0x40000000
push ecx
mov dword [esp + 0x34], 0x10
shr eax, 3
mov dword [esp + 0x3c], eax
mov eax, esi
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x40], eax
mov eax, dword [ebx + 4]
imul eax, edi
mov dword [esp + 0x44], eax
add eax, 0x24
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401acd
xor al, al
jmp 0x401bc1
mov esi, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea eax, [esp + 0x10]
push ebp
push eax
push 4
pop ebp
push ebp
push 0x462d90
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [esp + 0x20]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push str.WAVE
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push str.fmt
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [esp + 0x24]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x28]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 2
push 0x46fa9a
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push 0x46fa9c
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [esp + 0x2c]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x30]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 2
push 0x46faa6
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
push str.data
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [esp + 0x34]
push eax
push edi
call esi
push 0
lea ecx, [esp + 0x14]
push ecx
push dword [ebx + 4]
push dword [ebx]
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4048a8
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x46facc]
sub esp, 0x1c
push ebx
push edi
push dword [eax + 0x10]
mov edi, ecx
push dword [eax + 0x18]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x4049fb
cmp byte [edi + 1], al
je 0x4049f7
cmp byte [edi + 0x31], al
je 0x404906
sub esp, 0x18
lea eax, [edi + 0x34]
mov ecx, esp
mov edx, str.TLS_Handshake...______
push eax
call fcn.004052fe
sub esp, 0x14
mov ecx, esp
push 0x462f54
call fcn.00402073
call fcn.004194da
add esp, 0x30
call fcn.0041ea15
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x404921
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_1
jmp 0x404a5b
mov edx, dword [edi + 4]
mov ecx, eax
call fcn.0041ec44
cmp eax, 1
je 0x404967
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_2
call fcn.00402073
sub esp, 0x18
mov ecx, esp
push 0x462eb8
call fcn.00402073
call fcn.004194da
add esp, 0x30
mov ecx, dword [edi + 0x4c]
call fcn.0041ea55
and dword [edi + 0x4c], 0
jmp 0x404a77
mov ecx, dword [edi + 0x4c]
call fcn.0041f7f5
cmp eax, 1
je 0x4049a4
sub esp, 0x18
mov ecx, esp
push str.TLS_Authentication_Failed
call fcn.00402073
sub esp, 0x18
mov ecx, esp
push 0x462eb8
call fcn.00402073
call fcn.004194da
mov ecx, dword [edi + 0x4c]
add esp, 0x30
call fcn.0041ee67
jmp 0x404956
mov ecx, dword [edi + 0x4c]
call fcn.0041ebbb
mov dword [edi + 0x50], eax
test eax, eax
jne 0x4049d9
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_3
call fcn.00402073
sub esp, 0x18
mov ecx, esp
push 0x462eb8
call fcn.00402073
call fcn.004194da
add esp, 0x30
xor ebx, ebx
push ebx
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
push ebx
push 1
push ebx
push ebx
mov dword [edi + 0x70], eax
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov dword [edi + 0x6c], eax
mov al, 1
jmp 0x404a79
cmp byte [edi + 0x31], 0
je 0x404a77
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2736
je 0x404a77
sub ecx, 0x17
je 0x404a51
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.0041a86b
sub esp, 0x18
mov edx, str.Connection_Failed:
mov ecx, esp
push eax
call fcn.004052dd
sub esp, 0x14
mov ecx, esp
push 0x462eb8
call fcn.00402073
call fcn.004194da
add esp, 0x30
lea ecx, [ebp - 0x1c]
call fcn.00401fb8
jmp 0x404a77
sub esp, 0x18
mov ecx, esp
push str.Connection_Refused
call fcn.00402073
sub esp, 0x18
mov ecx, esp
push 0x462eb8
call fcn.00402073
call fcn.004194da
add esp, 0x30
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404a81
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp + 0xc]
call fcn.0040245c
push 4
pop esi
xor ebx, ebx
lea ecx, [ebp - 0x20]
push ebx
add eax, esi
push 0xc
mov dword [ebp - 8], eax
call fcn.004051ec
push esi
lea eax, [edi + 0x2c]
push eax
push ebx
lea ecx, [ebp - 0x20]
call fcn.004051c3
push eax
call fcn.004346b0
add esp, 0xc
lea eax, [ebp - 8]
lea ecx, [ebp - 0x20]
push esi
push eax
push esi
call fcn.004051c3
push eax
call fcn.004346b0
add esp, 0xc
lea eax, [ebp + 8]
lea ecx, [ebp - 0x20]
push esi
push eax
push 8
call fcn.004051c3
push eax
call fcn.004346b0
add esp, 0xc
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x20]
push eax
call fcn.00403356
cmp byte [edi + 1], bl
jne 0x404b20
push ebx
lea ecx, [ebp - 0x20]
call fcn.0040245c
push eax
lea ecx, [ebp - 0x20]
call fcn.00401f8b
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
jmp 0x404b5b
or ebx, 0xffffffff
push ebx
push dword [edi + 0x70]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0040245c
push eax
lea ecx, [ebp - 0x20]
call fcn.00401f8b
mov ecx, dword [edi + 0x50]
mov edx, eax
call fcn.0041edef
pop ecx
mov esi, eax
pop ecx
push dword [edi + 0x70]
test esi, esi
cmove esi, ebx
call dword [sym.imp.KERNEL32.DLL_SetEvent]
lea ecx, [ebp - 0x20]
call fcn.00401fb8
lea ecx, [ebp + 0xc]
call fcn.00401fb8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x404b76
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
push edi
mov edi, ecx
cmp byte [edi + 1], 0
je 0x404bad
push 0xffffffffffffffff
push dword [edi + 0x6c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov edx, dword [esp + 0xc]
push ecx
push dword [esp + 0x14]
mov ecx, dword [edi + 0x4c]
call fcn.0041ee2b
pop ecx
pop ecx
push dword [edi + 0x6c]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_SetEvent]
mov eax, esi
jmp 0x404bc0
push 0
push dword [esp + 0x14]
push dword [esp + 0x14]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_recv]
pop edi
pop esi
ret 0xc

Function at 0x404bc5
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
mov dword [ecx + 8], eax
xor eax, eax
push eax
push eax
push ecx
push 0x404be1
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
ret 4