joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403be0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x403be9
xor ecx, ecx
jne 0x403be9
xor edx, edx
jne 0x403bf1
xor eax, eax
jne 0x403bf1
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x14]
ja 0x403c32
jb 0x403c27
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jae 0x403c32
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x18]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 8], 0
jne 0x403c65
call fcn.004043c0
jmp 0x403cfe
cmp dword [ebp + 0xc], 0
jne 0x403c7f
mov eax, dword [ebp - 8]
sub eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
sbb ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x403c88
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x1c]
mov dword [edx + 0x18], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0x10], edx
mov eax, dword [ebp + 0x14]
mov dword [ecx + 0x14], eax
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x18]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov edx, dword [ebp - 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jne 0x403cfc
call fcn.004043c0
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
jmp 0x403cfe
xor eax, eax
mov esp, ebp
pop ebp
ret 0x18

Function at 0x403e40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
xor eax, eax
jne 0x403e49
xor ecx, ecx
jne 0x403e49
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x403e82
call fcn.004043c0
jmp 0x403e98
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
je 0x403e96
push 0x26
call fcn.00403f00
add esp, 4
jmp 0x403e98
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x405870
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x46e140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 0x114], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x1a4], 0
jne 0x405a30
mov dword [ebp - 0x110], 0x80
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x88]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x405904
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004243f0
add esp, 8
push eax
mov edx, dword [ebp - 0x10c]
push edx
push str.getpeername___failed_with_errno__d:__s
mov eax, dword [ebp - 0x114]
push eax
call fcn.00420dd0
add esp, 0x10
jmp 0x405a3c
mov dword [ebp - 0x110], 0x80
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x40596a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x10c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004243f0
add esp, 8
push eax
mov eax, dword [ebp - 0x10c]
push eax
push str.getsockname___failed_with_errno__d:__s
mov ecx, dword [ebp - 0x114]
push ecx
call fcn.00420dd0
add esp, 0x10
jmp 0x405a3c
mov edx, dword [ebp + 8]
add edx, 0xcc
push edx
mov eax, dword [ebp + 8]
add eax, 0x9e
push eax
lea ecx, [ebp - 0x88]
push ecx
call fcn.00405a50
add esp, 0xc
test eax, eax
jne 0x4059cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10c], eax
mov edx, dword [ebp - 0x10c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004243f0
add esp, 8
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
push str.ssrem_inet_ntop___failed_with_errno__d:__s
mov edx, dword [ebp - 0x114]
push edx
call fcn.00420dd0
add esp, 0x10
jmp 0x405a3c
mov eax, dword [ebp + 8]
add eax, 0x100
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xd0
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.00405a50
add esp, 0xc
test eax, eax
jne 0x405a30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004243f0
add esp, 8
push eax
mov edx, dword [ebp - 0x10c]
push edx
push str.ssloc_inet_ntop___failed_with_errno__d:__s
mov eax, dword [ebp - 0x114]
push eax
call fcn.00420dd0
add esp, 0x10
jmp 0x405a3c
mov ecx, dword [ebp + 8]
push ecx
call fcn.00405800
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00446cea
mov esp, ebp
pop ebp
ret
Function at 0x405f30
Capabilities:
Check os version
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x46e140]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x4020
mov dword [ebp - 8], 0
mov dword [ebp - 4], 4
cmp dword [0x46f584], 0
jne 0x405faf
push 0x114
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.00446c70
add esp, 0xc
mov dword [ebp - 0x128], 0x114
mov dword [0x46f584], 1
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x405faf
cmp dword [ebp - 0x124], 6
jb 0x405faf
mov dword [0x46f584], 2
cmp dword [0x46f584], 2
jne 0x405fba
jmp 0x405ffe
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x405fe4
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xc]
jle 0x405fe4
jmp 0x405ffe
push 4
lea eax, [ebp - 0xc]
push eax
push 0x1001
push 0xffff
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00446cea
mov esp, ebp
pop ebp
ret
Function at 0x406340
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 0x408], 0
setne cl
mov dword [ebp - 4], ecx
push 4
lea edx, [ebp - 4]
push edx
push 8
push 0xffff
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x40638d
mov ecx, dword [ebp + 0xc]
push ecx
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
mov edx, dword [ebp + 8]
push edx
call fcn.00420d30
add esp, 0xc
jmp 0x406423
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40c]
push ecx
call fcn.0042f280
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
imul edx, edx, 0x3e8
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x410]
push edx
call fcn.0042f280
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
imul eax, eax, 0x3e8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x406423
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov edx, dword [ebp + 0xc]
push edx
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
mov eax, dword [ebp + 8]
push eax
call fcn.00420d30
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x4069f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x314]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 6
push 4
lea ecx, [ebp - 0xc]
push ecx
push 1
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jge 0x406a52
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004243f0
add esp, 8
push eax
push str.Could_not_set_TCP_NODELAY:__s_n
mov edx, dword [ebp - 8]
push edx
call fcn.00420d30
add esp, 0xc
jmp 0x406a63
push str.TCP_NODELAY_set_n
mov eax, dword [ebp - 8]
push eax
call fcn.00420d30
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x406c70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
jne 0x406c76
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x550], 0
je 0x406d42
mov edx, dword [ebp + 8]
cmp dword [edx + 0xc], 0
je 0x406d42
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x550]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x550]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
push 0x406d50
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0x64]
push ecx
call fcn.004055f0
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x406ce9
mov edx, dword [ebp + 8]
mov dword [edx + 0x550], 0
or eax, 0xffffffff
jmp 0x406d4a
cmp dword [ebp + 0xc], 0
je 0x406cf7
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x130]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x150], 0
je 0x406d1f
mov edx, 1
test edx, edx
je 0x406d1d
or eax, 0xffffffff
jmp 0x406d4a
jmp 0x406d40
push 2
push 1
lea eax, [ebp - 0x11]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x130]
push edx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x406d40
or eax, 0xffffffff
jmp 0x406d4a
jmp 0x406d47
or eax, 0xffffffff
jmp 0x406d4a
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40ae00
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [0x46e140]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, 0x202
mov word [ebp - 0x19c], ax
lea ecx, [ebp - 0x198]
push ecx
movzx edx, word [ebp - 0x19c]
push edx
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40ae44
mov eax, 2
jmp 0x40ae9f
movzx eax, word [ebp - 0x198]
and eax, 0xff
movzx ecx, al
movzx edx, word [ebp - 0x19c]
and edx, 0xff
movzx eax, dl
cmp ecx, eax
jne 0x40ae90
movzx ecx, word [ebp - 0x198]
shr ecx, 8
and ecx, 0xff
movzx edx, cl
movzx eax, word [ebp - 0x19c]
shr eax, 8
and eax, 0xff
movzx ecx, al
cmp edx, ecx
je 0x40ae9d
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
jmp 0x40ae9f
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00446cea
mov esp, ebp
pop ebp
ret
Function at 0x40daa0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
xor edx, edx
cmp dword [ecx + 4], 2
sete dl
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x40daf2
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0
jne 0x40dacf
xor eax, eax
jmp 0x40db78
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0x10
mov dword [ebp - 4], eax
jmp 0x40db41
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0
jne 0x40db25
push 0x468a68
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push edx
call fcn.00448afb
add esp, 8
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 8], 0
jne 0x40db25
or eax, 0xffffffff
jmp 0x40db78
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.00449731
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40db75
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
je 0x40db69
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call fcn.00447d70
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x40dda0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x46e140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00449d05
add esp, 4
mov dword [ebp - 0x114], eax
mov byte [ebp - 0x110], 0
cmp dword [ebp - 0x114], 0
je 0x40ddee
push 0x104
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
movsx eax, byte [ebp - 0x110]
test eax, eax
je 0x40de11
lea ecx, [ebp - 0x110]
push ecx
call dword [0x468850]
add esp, 4
mov dword [ebp - 0x118], eax
jmp 0x40de1b
mov dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00446cea
mov esp, ebp
pop ebp
ret
Function at 0x417ce0
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xf0000000
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x417d18
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
push 0
push 0
push 0x8003
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop ebp
ret

Function at 0x41ff90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
movsx eax, byte [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x61
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x19
ja case.default.0x41ffad
mov edx, dword [ebp - 4]
jmp dword [edx*4 + 0x420024]
mov al, 0x41
jmp 0x42001f
mov al, 0x42
jmp 0x42001f
mov al, 0x43
jmp 0x42001f
mov al, 0x44
jmp 0x42001f
mov al, 0x45
jmp 0x42001f
mov al, 0x46
jmp 0x42001f
mov al, 0x47
jmp 0x42001f
mov al, 0x48
jmp 0x42001f
mov al, 0x49
jmp 0x42001f
mov al, 0x4a
jmp 0x42001f
mov al, 0x4b
jmp 0x42001f
mov al, 0x4c
jmp 0x42001f
mov al, 0x4d
jmp 0x42001f
mov al, 0x4e
jmp 0x42001f
mov al, 0x4f
jmp 0x42001f
mov al, 0x50
jmp 0x42001f
mov al, 0x51
jmp 0x42001f
mov al, 0x52
jmp 0x42001f
mov al, 0x53
jmp 0x42001f
mov al, 0x54
jmp 0x42001f
mov al, 0x55
jmp 0x42001f
mov al, 0x56
jmp 0x42001f
mov al, 0x57
jmp 0x42001f
mov al, 0x58
jmp 0x42001f
mov al, 0x59
jmp 0x42001f
mov al, 0x5a
jmp 0x42001f
mov al, byte [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x421040
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax*4 + 0x130]
mov dword [ebp - 8], edx
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp dword [ebp - 4], 0xffffffff
jne 0x4210db
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
jne 0x4210a0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 0x51
jmp 0x4210db
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004243f0
add esp, 8
push eax
push str.Send_failure:__s
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call fcn.00420dd0
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 0x858c], edx
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x37
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4214c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x421505
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2733
jne 0x4214fe
mov eax, 0x51
jmp 0x42150f
mov eax, 0x38
jmp 0x42150f
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x421870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 0x164], 0
je 0x4218aa
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xf4]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x164]
call edx
add esp, 0x14
jmp 0x4218fe
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x4218fc
cmp dword [ebp - 4], 2
jle 0x4218be
jmp 0x4218fc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xf0]
push edx
push 1
push 2
mov eax, dword [ebp + 0xc]
imul eax, eax, 3
add eax, 0x461ca0
push eax
call fcn.0044c3e4
add esp, 0x10
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xf0]
push edx
push 1
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0044c3e4
add esp, 0x10
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x430c60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x461d0c
movzx eax, word [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x430cdc
mov edx, dword [ebp - 0x10]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x430cdc
mov eax, dword [ebp - 8]
push eax
call fcn.0044c836
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004468c0
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [ebp - 4], 0
jne 0x430cf0
xor eax, eax
jmp 0x430d02
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00430a00
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x43d8e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x46f840], eax
mov dword [0x46f844], 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x403780
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3f0], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3f4]
add eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3f4], eax
mov esp, ebp
pop ebp
ret

Function at 0x43dc20
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
movzx eax, word [ebp + 0xc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xc8
je 0x43dc42
jmp 0x43dca3
push 0x3e8
mov ecx, dword [ebp - 8]
add ecx, 4
call fcn.0043ca20
push 3
mov ecx, 0x46f848
call fcn.00404450
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x3f0], 0
je 0x43dc99
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x3f0]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x3f0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov dword [eax + 0x3f0], 0
push 0
mov ecx, dword [ebp - 8]
call fcn.0043dae0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43dcf0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 0xc], 0x3e8
jne 0x43dd0c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3f0], 0
jne 0x43dd1c
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
xor eax, eax
jmp 0x43ddff
push 0x3e8
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0043ca20
push 0xa
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3f0]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43dd94
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x46f840]
cmp eax, 0x2bf20
jbe 0x43dd7b
xor ecx, ecx
jne 0x43dd55
xor edx, edx
jne 0x43dd55
push 4
mov ecx, 0x46f848
call fcn.00404450
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3f0]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0x3e8
push 0x3e8
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0043c9f0
jmp 0x43ddfd
mov edx, dword [ebp - 4]
cmp dword [edx + 0x3f0], 0
je 0x43ddbd
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3f0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
mov dword [edx + 0x3f0], 0
cmp dword [0x46f844], 0
jne 0x43ddd2
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3f4], 0xa
jb 0x43ddde
push 0
mov ecx, dword [ebp - 4]
call fcn.0043dae0
jmp 0x43ddfd
mov ecx, dword [ebp - 4]
call fcn.0043d8e0
push 0
push 0x3e8
push 0x3e8
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.0043c9f0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x43f380
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 1
push 0
push 0
push str.http:__www.huorong.cn
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10