joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415720
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c15c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x510
push edi
mov al, byte [0x4af244]
mov byte [ebp - 0x51c], al
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x51b]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x51c]
push ecx
call fcn.00403ef0
add esp, 4
lea ecx, [ebp - 0x414]
call fcn.00403ac0
mov dword [ebp - 4], 0
mov dword [ebp - 0x410], 0
jmp 0x415795
mov edx, dword [ebp - 0x410]
add edx, 1
mov dword [ebp - 0x410], edx
mov ecx, dword [ebp + 8]
call fcn.00415c00
cmp dword [ebp - 0x410], eax
jae 0x415873
push 0x400
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp - 0x410]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00415c40
lea ecx, [ebp - 0x414]
call fcn.00415620
test eax, eax
jne 0x41586e
lea edx, [ebp - 0x51c]
push edx
push 0x400
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x414]
call fcn.0042e500
push eax
lea ecx, [ebp - 0x414]
call fcn.0042e500
push eax
push str.String
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx ecx, byte [ebp - 0x40c]
test ecx, ecx
je 0x415843
lea edx, [ebp - 0x40c]
push edx
mov eax, dword [ebp - 0x410]
push eax
mov ecx, dword [ebp + 8]
call fcn.00415c20
push eax
push 0x400
mov ecx, dword [ebp - 0x410]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00415cc0
mov edx, dword [ebp - 0x410]
push edx
mov ecx, dword [ebp + 8]
call fcn.00415c90
test eax, eax
je 0x41586e
mov eax, dword [ebp - 0x410]
push eax
mov ecx, dword [ebp + 8]
call fcn.00415c90
push eax
call fcn.00415720
add esp, 4
jmp 0x415786
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.00480fc4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4159b0
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4159d2
xor al, al
jmp 0x415a50
push 0x14
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4159f9
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x415a50
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x415a30
cmp dword [ebp - 0x18], 2
jne 0x415a2c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x415a2e
jmp 0x415a30
jmp 0x415a07
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x18], 4
jne 0x415a4e
mov al, 1
jmp 0x415a50
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x416b43
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0xb4], 0
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x70
call fcn.00417480
push 1
push 0x4be
mov ecx, dword [ebp - 4]
call fcn.00480539
mov ecx, eax
call fcn.0048076c
push 0
push 0x3e9
mov ecx, dword [ebp - 4]
call fcn.00480539
mov ecx, eax
call fcn.0048076c
mov esp, ebp
pop ebp
ret
Function at 0x41966a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c500
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x64], 0
jne 0x41972a
lea ecx, [ebp - 0x14]
call fcn.00403ac0
mov dword [ebp - 4], 0
push 0x104
push 0x104
lea ecx, [ebp - 0x14]
call fcn.004813f4
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.00481443
push str.winhlp32.exe
lea ecx, [ebp - 0x14]
call fcn.004813a0
lea ecx, [ebp - 0x14]
call fcn.0042e500
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x419711
push 0x6a
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x419711
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_CopyIcon]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x64], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00480fc4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x419738
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov dword [ebp - 0x114], ecx
lea eax, [ebp - 8]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4197a5
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4199a3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov dword [ebp - 0x210], ecx
lea eax, [ebp - 0x208]
push eax
push 0x4a5b84
push accept
mov ecx, dword [ebp - 0x210]
call fcn.00419738
test eax, eax
jne 0x419ab8
push 0x4a5b8c
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x208]
push eax
push accept
mov ecx, dword [ebp - 0x210]
call fcn.00419738
test eax, eax
jne 0x419ab8
push 0x4a5ba0
lea ecx, [ebp - 0x208]
push ecx
call fcn.00415b80
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x419a7b
push 0x4a5ba8
lea edx, [ebp - 0x208]
push edx
call fcn.004652d0
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x419a70
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp + eax - 0x209]
mov dword [ebp - 0x20c], ecx
jmp 0x419a79
mov edx, dword [ebp - 0x20c]
mov byte [edx], 0
jmp 0x419a84
mov eax, dword [ebp - 0x20c]
mov byte [eax], 0
push 0x4a5bac
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x419aba
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x41ba49
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 0x208]
push eax
push str..htm
push accept
call fcn.0041bb54
add esp, 0xc
test eax, eax
jne 0x41bb50
push str._shellopencommand
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x208]
push eax
push accept
call fcn.0041bb54
add esp, 0xc
test eax, eax
jne 0x41bb50
push 0x4a5e10
lea ecx, [ebp - 0x208]
push ecx
call fcn.00415b80
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x41bb15
push 0x4a5e18
lea edx, [ebp - 0x208]
push edx
call fcn.004652d0
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x41bb0a
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp + eax - 0x209]
mov dword [ebp - 0x20c], ecx
jmp 0x41bb13
mov edx, dword [ebp - 0x20c]
mov byte [edx], 0
jmp 0x41bb1e
mov eax, dword [ebp - 0x20c]
mov byte [eax], 0
push 0x4a5e1c
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x41bb54
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
lea eax, [ebp - 8]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41bbbb
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x420daf
Capabilities:
Create service
Delete service
Persist via windows service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x103c
call fcn.00465440
mov dword [ebp - 0x103c], ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
je 0x420ecd
push 0xf01ff
mov eax, dword [ebp - 0x103c]
add eax, 0x8c
push eax
mov ecx, dword [ebp - 0x100c]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x1014], eax
cmp dword [ebp - 0x1014], 0
je 0x420eaa
lea edx, [ebp - 0x1030]
push edx
push 1
mov eax, dword [ebp - 0x1014]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x420e74
lea ecx, [ebp - 0x1030]
push ecx
mov edx, dword [ebp - 0x1014]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x420e61
cmp dword [ebp - 0x102c], 3
jne 0x420e5d
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x420e5f
jmp 0x420e61
jmp 0x420e2f
cmp dword [ebp - 0x102c], 1
je 0x420e74
mov dword [ebp - 0x1010], 0
mov eax, dword [ebp - 0x1014]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x420e91
mov dword [ebp - 0x1034], 1
jmp 0x420e9b
mov dword [ebp - 0x1038], 0
mov ecx, dword [ebp - 0x1014]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x420eb4
mov dword [ebp - 0x1010], 1
mov edx, dword [ebp - 0x100c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 0x1010], 1
jmp 0x420ed7
mov dword [ebp - 0x1010], 0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x1004], eax
cmp dword [ebp - 0x1004], 0
jne 0x420efc
xor eax, eax
jmp 0x420fbe
push 0x7d0
lea eax, [ebp - 0x800]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x420f1b
xor eax, eax
jmp 0x420fbe
push str._service
lea ecx, [ebp - 0x800]
push ecx
push 0x4a6200
lea edx, [ebp - 0x1000]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1000]
push eax
push 1
push 2
push 0x110
push 0xf01ff
mov ecx, dword [ebp - 0x103c]
add ecx, 0x28
push ecx
mov edx, dword [ebp - 0x103c]
add edx, 0x8c
push edx
mov eax, dword [ebp - 0x1004]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x1008], eax
cmp dword [ebp - 0x1008], 0
jne 0x420f9f
mov ecx, dword [ebp - 0x1004]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x420fbe
mov edx, dword [ebp - 0x1008]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x1004]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x420fc2
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x421096
push 0xf01ff
mov eax, dword [ebp - 0x34]
add eax, 0x8c
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42107c
lea edx, [ebp - 0x28]
push edx
push 1
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x421052
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x421045
cmp dword [ebp - 0x24], 3
jne 0x421041
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x421043
jmp 0x421045
jmp 0x42101c
cmp dword [ebp - 0x24], 1
je 0x421052
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x421069
mov dword [ebp - 0x2c], 1
jmp 0x421070
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x421083
mov dword [ebp - 8], 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [ebp - 8], 1
jmp 0x42109d
mov dword [ebp - 8], 0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x42270b
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48cc37
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x2024
call fcn.00465440
mov dword [ebp - 0x2030], ecx
push 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x201c], eax
mov ecx, dword [ebp - 0x2030]
add ecx, 0x5c
call fcn.00405640
cmp dword [ebp - 0x201c], 0
je 0x422893
mov dword [ebp - 0x2020], 0
mov eax, dword [ebp - 0x201c]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x2020]
cmp dword [ecx + edx*4], 0
je 0x422893
mov eax, dword [ebp - 0x201c]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x2020]
mov eax, dword [ecx + edx*4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x202c]
call fcn.00481032
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x202c]
call fcn.0042e500
push eax
mov ecx, dword [ebp - 0x2030]
add ecx, 0x5c
call fcn.00405610
mov dword [ebp - 0x2024], 0
mov dword [ebp - 0x2028], 0
jmp 0x4227ec
mov edx, dword [ebp - 0x2028]
add edx, 1
mov dword [ebp - 0x2028], edx
cmp dword [ebp - 0x2028], 0xa
jge 0x422834
mov eax, dword [ebp - 0x2028]
cmp dword [eax*4 + 0x4bae1c], 0
je 0x422834
lea ecx, [ebp - 0x202c]
call fcn.0042e500
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [ebp - 0x2028]
cmp dword [ecx*4 + 0x4bae1c], eax
jne 0x422832
mov dword [ebp - 0x2024], 1
jmp 0x422834
jmp 0x4227dd
mov edx, dword [ebp - 0x2024]
push edx
mov eax, dword [ebp - 0x2020]
push eax
mov ecx, dword [ebp - 0x2030]
add ecx, 0x5c
call fcn.00422ae0
mov ecx, dword [ebp - 0x2020]
add ecx, 1
mov dword [ebp - 0x2020], ecx
cmp dword [ebp - 0x2020], 0xa
jl 0x42287c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x202c]
call fcn.00480fc4
jmp 0x422893
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x202c]
call fcn.00480fc4
jmp 0x422766
push 0x4a6254
push 0x4baa18
lea ecx, [ebp - 0x2018]
call fcn.0044f570
lea ecx, [ebp - 0x2018]
call fcn.0044f5b1
push eax
push 0
mov ecx, dword [ebp - 0x2030]
add ecx, 0x5c
call fcn.0040d970
push eax
mov ecx, dword [ebp - 0x2030]
add ecx, 0x5c
call fcn.004055e0
mov ecx, dword [ebp - 0x2030]
call fcn.004229b5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x422e5a
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov byte [0x4af960], 8
mov byte [0x4af961], 0
mov word [0x4af962], 0
mov ax, word [0x4a6258]
mov word [0x4af964], ax
mov ecx, dword [0x4a6258]
add ecx, 1
mov dword [0x4a6258], ecx
mov dx, word [0x4a625c]
mov word [0x4af966], dx
mov eax, dword [0x4a625c]
add eax, 1
mov dword [0x4a625c], eax
mov dword [ebp - 4], 0
jmp 0x422ec2
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x20
jge 0x422ed9
mov edx, dword [ebp - 4]
add edx, 0x20
mov eax, dword [ebp - 4]
mov byte [eax + 0x4af96d], dl
jmp 0x422eb9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4af969], eax
push 0x2d
push 0x4af960
mov ecx, dword [ebp - 8]
call fcn.00423084
mov word [0x4af962], ax
push 0x10
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0x2d
push 0x4af960
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x422f28
push str.sendto__
mov ecx, dword [ebp - 8]
call fcn.00422ff3
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x422f31
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov dword [ebp - 0x150], ecx
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0x141
lea edx, [ebp - 0x148]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
jne 0x422f86
push str.recvfrom__
mov ecx, dword [ebp - 0x150]
call fcn.00422ff3
mov ecx, dword [ebp + 0x10]
mov dl, byte [ebp - 0x140]
mov byte [ecx], dl
mov eax, dword [ebp - 0x12b]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x422f9d
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x104], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x10c], 2
mov dword [ebp - 0x108], 0
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
lea edx, [ebp - 0x104]
push edx
push 1
call dword [sym.imp.WS2_32.dll_select]
mov esp, ebp
pop ebp
ret 4

Function at 0x422ff3
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push edi
mov dword [ebp - 0x408], ecx
mov al, byte [0x4af994]
mov byte [ebp - 0x404], al
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x403]
rep stosd dword es:[edi], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s___WSAError:__ld_r_n
lea edx, [ebp - 0x404]
push edx
call fcn.004650e4
add esp, 0x10
lea eax, [ebp - 0x404]
push eax
mov ecx, dword [ebp - 0x408]
add ecx, 8
push ecx
call fcn.00465360
add esp, 8
push 0
lea edx, [ebp - 0x404]
push edx
call fcn.00465470
add esp, 4
push eax
lea eax, [ebp - 0x404]
push eax
mov ecx, dword [ebp - 0x408]
mov edx, dword [ecx]
push edx
call dword [sym.imp.WS2_32.dll_send]
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x42789a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2134
call fcn.00465440
push edi
mov dword [ebp - 0x2134], ecx
mov al, byte [0x4aff40]
mov byte [ebp - 0x11c], al
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
push 0x4ba5e4
push 0x4a6898
lea ecx, [ebp - 0x11c]
push ecx
call fcn.004650e4
add esp, 0xc
push 0
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [0x4aff44]
mov byte [ebp - 0x1120], al
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x111f]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [ebp - 0xe]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x12]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x14]
and ecx, 0xffff
push ecx
push 0x4a689c
lea edx, [ebp - 0x1120]
push edx
call fcn.004650e4
add esp, 0x14
lea eax, [ebp - 0x1120]
push eax
push 0x4ba5e4
push 0x4a68ac
lea ecx, [ebp - 0x11c]
push ecx
call fcn.004650e4
add esp, 0x10
mov dword [ebp - 4], 0
push 0x4a68bc
lea edx, [ebp - 0x11c]
push edx
call fcn.004669ba
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x427ae3
mov al, byte [0x4aff48]
mov byte [ebp - 0x2124], al
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x2123]
rep stosd dword es:[edi], eax
push str.username_treceived_byte__tsent_byte__r_n
lea ecx, [ebp - 0x2124]
push ecx
call fcn.004650e4
add esp, 8
mov edx, dword [ebp - 4]
push edx
push 1
lea eax, [ebp - 0x2124]
push eax
call fcn.00465470
add esp, 4
push eax
lea ecx, [ebp - 0x2124]
push ecx
call fcn.00466850
add esp, 0x10
mov dword [ebp - 0x2128], 0
jmp 0x4279fb
mov edx, dword [ebp - 0x2128]
add edx, 1
mov dword [ebp - 0x2128], edx
mov ecx, dword [ebp - 0x2134]
add ecx, 0x420
call fcn.00404620
cmp dword [ebp - 0x2128], eax
jae 0x427ad7
push 0
push 0x10
mov eax, dword [ebp - 0x2128]
push eax
mov ecx, dword [ebp - 0x2134]
add ecx, 0x420
call fcn.00404660
push eax
mov ecx, 0x4afa18
call fcn.0042b424
mov dword [ebp - 0x2130], eax
push 0
push 0x11
mov ecx, dword [ebp - 0x2128]
push ecx
mov ecx, dword [ebp - 0x2134]
add ecx, 0x420
call fcn.00404660
push eax
mov ecx, 0x4afa18
call fcn.0042b424
mov dword [ebp - 0x212c], eax
mov edx, dword [ebp - 0x212c]
push edx
mov eax, dword [ebp - 0x2130]
push eax
mov ecx, dword [ebp - 0x2128]
push ecx
mov ecx, dword [ebp - 0x2134]
add ecx, 0x420
call fcn.00404660
push eax
push str._s_t_ld_t_ld_r_n
lea edx, [ebp - 0x2124]
push edx
call fcn.004650e4
add esp, 0x14
mov eax, dword [ebp - 4]
push eax
push 1
lea ecx, [ebp - 0x2124]
push ecx
call fcn.00465470
add esp, 4
push eax
lea edx, [ebp - 0x2124]
push edx
call fcn.00466850
add esp, 0x10
jmp 0x4279ec
mov eax, dword [ebp - 4]
push eax
call fcn.004667d3
add esp, 4
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x435816
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov dword [ebp - 0x21c], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x214], 0
jmp 0x43585d
mov ecx, dword [ebp - 0x214]
add ecx, 1
mov dword [ebp - 0x214], ecx
mov edx, dword [ebp - 0x214]
cmp edx, dword [ebp - 0x104]
jae 0x435881
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp + eax*4 - 0x100]
cmp ecx, dword [ebp + 8]
jne 0x43587f
jmp 0x435881
jmp 0x43584e
mov edx, dword [ebp - 0x214]
cmp edx, dword [ebp - 0x104]
jne 0x4358b7
cmp dword [ebp - 0x104], 0x40
jae 0x4358b7
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x100], ecx
mov edx, dword [ebp - 0x104]
add edx, 1
mov dword [ebp - 0x104], edx
xor eax, eax
test eax, eax
jne 0x435842
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x218], 0
jmp 0x4358e2
mov ecx, dword [ebp - 0x218]
add ecx, 1
mov dword [ebp - 0x218], ecx
mov edx, dword [ebp - 0x218]
cmp edx, dword [ebp - 0x208]
jae 0x435906
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp + eax*4 - 0x204]
cmp ecx, dword [ebp + 8]
jne 0x435904
jmp 0x435906
jmp 0x4358d3
mov edx, dword [ebp - 0x218]
cmp edx, dword [ebp - 0x208]
jne 0x43593c
cmp dword [ebp - 0x208], 0x40
jae 0x43593c
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x204], ecx
mov edx, dword [ebp - 0x208]
add edx, 1
mov dword [ebp - 0x208], edx
xor eax, eax
test eax, eax
jne 0x4358c7
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x208]
push edx
push 0
lea eax, [ebp - 0x104]
push eax
push 0x40
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x435969
xor eax, eax
jmp 0x4359a0
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x435984
mov eax, 1
jmp 0x4359a0
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x43599d
or eax, 0xffffffff
jmp 0x4359a0
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 8