joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404200
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f4e8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x42a010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0
push 0
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x4042ad
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea ecx, [ebp - 0x24]
call fcn.0040b400
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x40425b
mov eax, dword [eax]
push eax
push 0x42634c
push 3
push str.AgNet::CSClientSocket::SendClosedMessage
push 0x3ca
push str.SClientSocket.cpp
call fcn.0040bc30
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 8
jb 0x404292
push dword [ebp - 0x24]
call fcn.0040ed3b
add esp, 4
xor eax, eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov ecx, esi
mov eax, dword [esi]
mov dword [ebp - 0x14], 0
call dword [eax + 0x24]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x404420
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f526
mov eax, dword fs:[0]
push eax
sub esp, 0x494
mov eax, dword [0x42a010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x484], eax
mov edi, ecx
mov ecx, eax
call fcn.00404d90
push 0x250
lea eax, [ebp - 0x480]
push 0
push eax
call fcn.00411600
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00411600
lea ecx, [ebp - 0x218]
mov esi, edi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x4044bf
movzx eax, word [esi + ecx]
test ax, ax
je 0x4044bf
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x4044a1
jmp 0x4044c3
test edx, edx
jne 0x4044c6
sub ecx, 2
xor eax, eax
mov word [ecx], ax
push ecx
lea ecx, [ebp - 0x218]
call fcn.00401a00
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
xor eax, eax
mov dword [ebp - 0x488], esi
cmp esi, 0xffffffff
je 0x404684
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
mov dword [ebp - 4], eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov edi, edi
lea eax, [ebp - 0x454]
push eax
push 0x42646c
call ebx
test eax, eax
je 0x404647
lea eax, [ebp - 0x454]
push eax
push 0x426470
call ebx
test eax, eax
je 0x404647
cmp word [edi], 0
jne 0x404556
xor eax, eax
jmp 0x40456f
mov eax, edi
lea edx, [eax + 2]
jmp 0x404560
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404560
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0x230]
call fcn.00401830
cmp word [ebp - 0x454], 0
jne 0x40458a
xor ecx, ecx
jmp 0x4045a2
lea ecx, [ebp - 0x454]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404593
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x230]
call fcn.004012b0
cmp dword [ebp - 0x21c], 8
lea edx, [ebp - 0x230]
mov dword [ebp - 0x48c], 7
cmovae edx, dword [ebp - 0x230]
xor eax, eax
mov dword [ebp - 0x490], 0
mov word [ebp - 0x4a0], ax
cmp word [edx], ax
jne 0x4045ef
xor ecx, ecx
jmp 0x404609
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4045f4
sub ecx, esi
mov esi, dword [ebp - 0x488]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4a0]
call fcn.00401830
mov ecx, dword [ebp - 0x484]
lea eax, [ebp - 0x4a0]
push eax
mov byte [ebp - 4], 1
call fcn.00404cd0
mov byte [ebp - 4], 0
cmp dword [ebp - 0x48c], 8
jb 0x404647
push dword [ebp - 0x4a0]
call fcn.0040ed3b
add esp, 4
lea eax, [ebp - 0x480]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404520
cmp dword [ebp - 0x21c], 8
jb 0x404674
push dword [ebp - 0x230]
call fcn.0040ed3b
add esp, 4
mov edx, dword [ebp - 0x484]
xor eax, eax
mov ecx, dword [edx]
cmp ecx, dword [edx + 4]
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ed40
mov esp, ebp
pop ebp
ret
Function at 0x404970
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f5a6
mov eax, dword fs:[0]
push eax
sub esp, 0x698
mov eax, dword [0x42a010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x678]
push 0x44
push 0
push eax
call fcn.00411600
add esp, 0xc
mov dword [ebp - 0x678], 0x44
xorps xmm0, xmm0
lea ecx, [ebp - 0x630]
movdqu xmmword [ebp - 0x688], xmm0
call fcn.0040b750
push 0xe
push str.CameraShow.exe
lea ecx, [ebp - 0x630]
mov dword [ebp - 4], 0
call fcn.004012b0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00411600
add esp, 0xc
lea eax, [ebp - 0x630]
cmp dword [ebp - 0x61c], 8
cmovae eax, dword [ebp - 0x630]
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0040fb31
add esp, 0xc
lea eax, [ebp - 0x618]
push 0x400
push 0
push eax
call fcn.00411600
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x404a53
mov esi, dword [esi]
push dword [ebp + 0x1c]
lea eax, [ebp - 0x618]
push 1
push 0x1e0
push 0x280
push 0x1e
push esi
push str._s__d__d__d__d__izhiling__d
push 0x200
push eax
call fcn.00401a80
add esp, 0x24
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x678]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x404b23
push 7
lea esi, [edi + 0x30]
push 0x4265a0
mov ecx, esi
call fcn.00401830
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x6a0]
call fcn.0040b400
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x404ae0
mov eax, dword [eax]
cmp dword [esi + 0x14], 8
jb 0x404ae8
mov esi, dword [esi]
push eax
push esi
push 0x42649c
push 3
push 0x4265b0
push 0x560
push str.SClientSocket.cpp
call fcn.0040bc30
add esp, 0x1c
cmp dword [ebp - 0x68c], 8
jb 0x404b8d
push dword [ebp - 0x6a0]
call fcn.0040ed3b
add esp, 4
xor esi, esi
jmp 0x404b96
mov ecx, dword [ebp - 0x688]
mov eax, dword [ebp - 0x684]
push 0x7530
push ecx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
cmp eax, 0x102
jne 0x404b6a
push 0x426604
push 3
push 0x4265b0
push 0x56a
push str.SClientSocket.cpp
call fcn.0040bc30
add esp, 0x14
xor esi, esi
jmp 0x404b96
cmp eax, 0xffffffff
jne 0x404b91
push 0x42661c
push 3
push 0x4265b0
push 0x56f
push str.SClientSocket.cpp
call fcn.0040bc30
add esp, 0x14
xor esi, esi
jmp 0x404b96
mov esi, 1
cmp dword [ebp - 0x61c], 8
jb 0x404bad
push dword [ebp - 0x630]
call fcn.0040ed3b
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ed40
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4070b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4070c9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x407104
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x407100
lea ebx, [ebx]
cmp esi, edx
jae 0x407104
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4070f0
cmp esi, edx
jb 0x40710b
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x407c90
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41f778
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x42a010]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov edi, 0xfb8
push 0xfb8
push 0
push dword [esi + 0x1c]
call fcn.00411600
add esp, 0xc
push 0
push edi
push dword [esi + 0x1c]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
je 0x407d67
test edi, edi
je 0x407d2d
mov eax, dword [esi + 0x14]
push edi
push dword [esi + 0x1c]
add eax, ebx
push edi
push eax
call fcn.0040f3e4
add ebx, edi
add esp, 0x10
mov edi, 0xfb8
sub edi, ebx
cmp ebx, 0xfb8
jne 0x407cc5
mov eax, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
push 0x426784
push 1
push str.AgNet::CTcpSocket::Recv
push 0xaa
push str.TcpSocket.cpp
call fcn.0040bc30
add esp, 0x14
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea ecx, [esp + 0x14]
call fcn.0040b400
mov dword [esp + 0x38], 0
cmp dword [eax + 0x14], 8
jb 0x407d96
mov eax, dword [eax]
push eax
push 0x426720
push 3
push str.AgNet::CTcpSocket::Recv
push 0xa4
push str.TcpSocket.cpp
call fcn.0040bc30
add esp, 0x18
cmp dword [esp + 0x28], 8
jb 0x407dc8
push dword [esp + 0x14]
call fcn.0040ed3b
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407de0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41f7a8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x42a010]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push 0
push 0xfb8
push dword [esi + 0x18]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, 0xfb8
je 0x407ea0
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x24]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x28]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea ecx, [esp + 0xc]
call fcn.0040b400
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 8
jb 0x407e59
mov eax, dword [eax]
push eax
push edi
push 0x426794
push 3
push str.AgNet::CTcpSocket::Send
push 0xca
push str.TcpSocket.cpp
call fcn.0040bc30
add esp, 0x1c
cmp dword [esp + 0x20], 8
jb 0x407e8c
push dword [esp + 0xc]
call fcn.0040ed3b
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x407fd0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
push edi
mov edi, dword [ebp + 0x14]
push ecx
mov dword [ebp - 4], edx
mov dword [edi], 0
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x408062
cmp word [ebx + 8], 2
push esi
jne 0x408032
cmp word [ebx + 0xa], 4
jne 0x408032
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x408032
lea ecx, [ecx]
push dword [eax]
mov edx, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
call fcn.00407f50
mov dword [edi], eax
test eax, eax
je 0x408054
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x408010
push 0x400
push dword [ebx]
push 0x401
push dword [ebp + 0x10]
call fcn.0040ff66
add esp, 0x10
xor eax, eax
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop esi
pop edi
mov eax, 8
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x408072.11001
jmp dword [eax*4 + 0x4080a0]
pop edi
mov eax, 0x2af9
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
mov eax, 0x2afa
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
mov eax, 0x2afb
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4088e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x42a010]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x42ccf0], 0
mov ax, cx
push ebx
push esi
push edi
mov word [ebp - 0x23a], ax
mov dword [ebp - 0x238], str.getaddrinfo
mov dword [ebp - 0x234], 0x408390
mov dword [ebp - 0x230], str.getnameinfo
mov dword [ebp - 0x22c], 0x408690
mov dword [ebp - 0x228], str.freeaddrinfo
mov dword [ebp - 0x224], fcn.00408340
je 0x40894d
movzx eax, ax
jmp 0x408a76
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x408a65
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x118]
push 0x10c
push eax
call fcn.0040fadc
push str.ws2_32
lea eax, [ebp - 0x118]
push 0x10c
push eax
call fcn.0041042b
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x4089c6
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x408a1b
push edi
call esi
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x118]
push 0x10c
push eax
call fcn.0040fadc
push str.wship6
lea eax, [ebp - 0x118]
push 0x10c
push eax
call fcn.0041042b
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408a65
push str.getaddrinfo
push edi
call ebx
test eax, eax
jne 0x408a1b
push edi
call esi
jmp 0x408a65
xor esi, esi
lea ecx, [ecx]
push dword [ebp + esi*8 - 0x238]
push edi
call ebx
mov dword [ebp + esi*8 - 0x234], eax
test eax, eax
je 0x408a5e
inc esi
cmp esi, 3
jl 0x408a20
mov eax, dword [ebp - 0x234]
mov dword [0x42b5d4], eax
mov eax, dword [ebp - 0x22c]
mov dword [0x42b5dc], eax
mov eax, dword [ebp - 0x224]
mov dword [fcn.00408340], eax
jmp 0x408a65
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, word [ebp - 0x23a]
mov dword [0x42ccf0], 1
mov ecx, dword [ebp - 4]
mov eax, dword [eax*8 + 0x42b5d4]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040ed40
mov esp, ebp
pop ebp
ret
Function at 0x408a90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f2d8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push esi
mov eax, dword [0x42a010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x42ca64], 0
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
jne 0x408b30
push 0
push 0
push 0
push 0
call esi
mov dword [0x42ca64], eax
test eax, eax
je 0x408add
cmp eax, 0xffffffff
jne 0x408b30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x24]
call fcn.0040b400
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x408afc
mov eax, dword [eax]
push eax
push 0x425d5c
push 3
push str.AgNet::CAgTcpServer::InitListenEvent
push 0x39
push str.CTcpServer.cpp
call fcn.0040bc30
add esp, 0x18
cmp dword [ebp - 0x10], 8
jb 0x408b29
push dword [ebp - 0x24]
call fcn.0040ed3b
add esp, 4
push 0xfffffffffffffffe
call fcn.0040f750
cmp dword [0x42ca60], 0
jne 0x408ba4
push 0
push 0
push 0
push 0
call esi
mov dword [0x42ca60], eax
test eax, eax
je 0x408b51
cmp eax, 0xffffffff
jne 0x408ba4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x24]
call fcn.0040b400
mov dword [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x408b70
mov eax, dword [eax]
push eax
push 0x425d5c
push 3
push str.AgNet::CAgTcpServer::InitListenEvent
push 0x45
push str.CTcpServer.cpp
call fcn.0040bc30
add esp, 0x18
cmp dword [ebp - 0x10], 8
jb 0x408b9d
push dword [ebp - 0x24]
call fcn.0040ed3b
add esp, 4
push 0xfffffffffffffffe
call fcn.0040f750
cmp dword [0x42ca5c], 0
jne 0x408c18
push 0
push 0
push 1
push 0
call esi
mov dword [0x42ca5c], eax
test eax, eax
je 0x408bc5
cmp eax, 0xffffffff
jne 0x408c18
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x3c]
call fcn.0040b400
mov dword [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x408be4
mov eax, dword [eax]
push eax
push 0x425d5c
push 3
push str.AgNet::CAgTcpServer::InitListenEvent
push 0x51
push str.CTcpServer.cpp
call fcn.0040bc30
add esp, 0x18
cmp dword [ebp - 0x28], 8
jb 0x408c11
push dword [ebp - 0x3c]
call fcn.0040ed3b
add esp, 4
push 0xfffffffffffffffe
call fcn.0040f750
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x408c30
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push ecx
mov dword [esi + 0x194], 0
mov dword [esi + 0x1ec], 0xffffffff
mov dword [esi + 0x1f0], 0
mov dword [esi + 0x1f4], 0
mov dword [esi + 0x1f8], 0
call fcn.00409220
push ecx
mov ecx, esi
call fcn.00409280
mov ecx, esi
call fcn.004092e0
mov dword [esi + 0x194], eax
test eax, eax
je 0x408ca6
mov ecx, esi
call fcn.00409870
mov ecx, esi
call fcn.00409f40
test eax, eax
je 0x408cc8
call fcn.00408a90
call fcn.00408e20
mov eax, esi
pop esi
ret 8
push 0x4268cc
push 3
push 0x4268e0
push 0x77
push str.CTcpServer.cpp
call fcn.0040bc30
add esp, 0x14
push 0
call fcn.0040f750
push 0x426924
push 3
push 0x4268e0
push 0x7d
push str.CTcpServer.cpp
call fcn.0040bc30
add esp, 0x14
push 0xfffffffffffffffd
call fcn.0040f750
int3
Function at 0x408cf0
Capabilities:
Terminate thread

Disassembly:
push ecx
push esi
push edi
push dword [0x42ca5c]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1388
push dword [0x42ca60]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x408d7c
push 0x426c94
push 3
push str.AgNet::CAgTcpServer::CloseListenSocket
push 0x24e
push str.CTcpServer.cpp
call fcn.0040bc30
mov eax, dword [esi + 0x1ec]
add esp, 0x14
cmp eax, 0xffffffff
je 0x408d46
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push str.:__g
push 3
push str.AgNet::CAgTcpServer::CAgTcpServer
push 0x8e
push str.CTcpServer.cpp
mov dword [esi + 0x1ec], 0xffffffff
call fcn.0040bc30
add esp, 0x14
push 0xffffffffffffffff
push dword [esi + 0x1f4]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [esi + 0x1f0]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x194], 0
test eax, eax
je 0x408da9
push eax
call edi
mov dword [esi + 0x1f0], 0
mov eax, dword [esi + 0x1f8]
test eax, eax
je 0x408dcd
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esi + 0x1f8]
call edi
mov eax, dword [0x42ca64]
test eax, eax
je 0x408dd9
push eax
call edi
mov eax, dword [0x42ca60]
mov dword [0x42ca64], 0
test eax, eax
je 0x408def
push eax
call edi
mov eax, dword [0x42ca5c]
mov dword [0x42ca60], 0
test eax, eax
je 0x408e05
push eax
call edi
pop edi
mov dword [0x42ca5c], 0
pop esi
pop ecx
ret
Function at 0x408e20
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f7db
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x42a010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x40], 0x626f6c47
push 0x5a
push eax
mov word [ebp - 0xa0], ax
lea eax, [ebp - 0x9e]
push eax
mov dword [ebp - 0x3c], 0x7b5c6c61
mov dword [ebp - 0x38], 0x41413143
mov dword [ebp - 0x34], 0x34333533
mov dword [ebp - 0x30], 0x4135432d
mov dword [ebp - 0x2c], 0x37342d38
mov dword [ebp - 0x28], 0x412d4434
mov dword [ebp - 0x24], 0x2d443545
mov dword [ebp - 0x20], 0x41453641
mov dword [ebp - 0x1c], 0x46344635
mov dword [ebp - 0x18], 0x37463735
mov byte [ebp - 0x14], 0x7d
call fcn.00411600
add esp, 0xc
xor ecx, ecx
lea ebx, [ebx]
movzx eax, byte [ebp + ecx - 0x40]
mov word [ebp + ecx*2 - 0xa0], ax
inc ecx
cmp ecx, 0x2d
jl 0x408ec0
lea eax, [ebp - 0xa0]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea ecx, [ebp - 0xa0]
mov esi, eax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408ef0
sub ecx, edx
lea eax, [ebp - 0xa0]
sar ecx, 1
je 0x408f10
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x408f07
mov ecx, 0x2d
lea eax, [ebp - 0x40]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x408f18
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x408f80
mov edx, eax
lea ecx, [ebp - 0xb8]
call fcn.0040b400
mov dword [ebp - 4], esi
cmp dword [eax + 0x14], 8
jb 0x408f43
mov eax, dword [eax]
push eax
push 0x426988
push 3
push str.AgNet::CAgTcpServer::CreateFlag
push 0xcc
push str.CTcpServer.cpp
call fcn.0040bc30
add esp, 0x18
cmp dword [ebp - 0xa4], 8
jb 0x408f79
push dword [ebp - 0xb8]
call fcn.0040ed3b
add esp, 4
push 0xffffffffffffffff
call fcn.0040f750
cmp eax, 0xb7
jne 0x408f95
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffffe
call fcn.0040f750
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ed40
mov esp, ebp
pop ebp
ret

Function at 0x4091b0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x42ca94]
push 0
push 0
push esi
push 0x408fc0
push 0
push 0
call fcn.0041048e
add esp, 0x18
mov dword [esi + 0x1f4], eax
push 0x4e20
push dword [0x42ca64]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4091f7
mov eax, dword [esi + 0x1f4]
pop esi
mov esp, ebp
pop ebp
ret
push 0x426a84
push 3
push str.AgNet::CAgTcpServer::Run
push 0x128
push str.CTcpServer.cpp
call fcn.0040bc30
add esp, 0x14
push 0xfffffffffffffffe
call fcn.0040f750
int3
Function at 0x4092e0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f4e8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x42a010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x190
lea edi, [esi + 4]
push 0
push edi
call fcn.00411600
add esp, 0xc
mov eax, 0x202
mov word [esi], ax
push edi
push eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40938c
mov edx, eax
lea ecx, [ebp - 0x24]
call fcn.0040b400
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x409349
mov eax, dword [eax]
push eax
push 0x426ae0
push 3
push str.AgNet::CAgTcpServer::InitAPI
push 0x162
push str.CTcpServer.cpp
call fcn.0040bc30
add esp, 0x18
cmp dword [ebp - 0x10], 8
jb 0x4093d1
push dword [ebp - 0x24]
call fcn.0040ed3b
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [edi], 2
jne 0x4093ad
cmp byte [edi + 1], 2
jne 0x4093ad
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x426b38
push 3
push str.AgNet::CAgTcpServer::InitAPI
push 0x168
push str.CTcpServer.cpp
call fcn.0040bc30
add esp, 0x14
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret