joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451072
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00442a73
and dword [ebp - 4], 0
cmp dword [0x48f478], 0
mov ebx, eax
jne 0x451123
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4511d4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4511d4
push eax
call fcn.00442a01
mov dword [esp], 0x479b34
push edi
mov dword [0x48f478], eax
call esi
push eax
call fcn.00442a01
mov dword [esp], 0x479b20
push edi
mov dword [0x48f47c], eax
call esi
push eax
call fcn.00442a01
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x48f480], eax
call esi
push eax
call fcn.00442a01
pop ecx
mov dword [0x48f488], eax
test eax, eax
je 0x451123
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00442a01
pop ecx
mov dword [0x48f484], eax
mov eax, dword [0x48f484]
cmp eax, ebx
je 0x45117b
cmp dword [0x48f488], ebx
je 0x45117b
push eax
call fcn.00442a7c
push dword [0x48f488]
mov esi, eax
call fcn.00442a7c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x45117b
test edi, edi
je 0x45117b
call esi
test eax, eax
je 0x451172
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x451172
test byte [ebp - 0xc], 1
jne 0x45117b
or dword [ebp + 0x10], 0x200000
jmp 0x4511b4
mov eax, dword [0x48f47c]
cmp eax, ebx
je 0x4511b4
push eax
call fcn.00442a7c
pop ecx
test eax, eax
je 0x4511b4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4511b4
mov eax, dword [0x48f480]
cmp eax, ebx
je 0x4511b4
push eax
call fcn.00442a7c
pop ecx
test eax, eax
je 0x4511b4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x48f478]
call fcn.00442a7c
pop ecx
test eax, eax
je 0x4511d4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4511d6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x662103c9
Capabilities:
Enumerate pe sections

Disassembly:
adc cl, byte [ebx - 0x24ccefbb]
cmp eax, ebx
je 0x662109d4
mov edi, dword [eax + 0x3c]
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.662101db
dec edx
rol byte [edx + esi*8 + 0xf], 0xb7
inc edi
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.662101db
mov ebx, 0x661c0027
mov eax, dword [edi + 6]
inc edi
push es
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x66210e9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x66210ecf
cmp dword [ebp - 0x398], 0
je 0x66211099
cmp dword [ebp + 0xc], 1
je 0x66211099
cmp dword [ebp + 0xc], 8
jne 0x66211061
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
invalid
invalid
push ecx
Function at 0x40c692
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push edi
push dword [esi + 0x144]
lea ebx, [esi + 0x78]
push dword [esi + 0x20]
lea eax, [esi + 0x1f0]
push ebx
push eax
mov dword [ebp - 8], 1
call fcn.0041c36a
mov edi, eax
test edi, edi
jns 0x40c6cf
push 0x43baa8
jmp 0x40c84f
lea eax, [esi + 0xe8]
push ebx
push eax
call fcn.00421464
mov edi, eax
test edi, edi
jns 0x40c6ec
push 0x43ba74
jmp 0x40c84f
cmp dword [esi + 0x268], 1
jne 0x40c740
lea eax, [ebp - 4]
push eax
push 1
lea ebx, [esi + 0x274]
push ebx
call fcn.0040d730
mov edi, eax
test edi, edi
jns 0x40c717
push 0x43ba36
jmp 0x40c84f
push ebx
call fcn.0040d94c
mov edi, eax
test edi, edi
jns 0x40c72d
push 0x43ba08
jmp 0x40c84f
cmp dword [ebp - 4], 0
je 0x40c740
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0xe4]
push eax
push dword [esi + 0x144]
lea eax, [esi + 0x9c]
push dword [esi + 0x20]
lea ebx, [esi + 0x78]
push eax
push ebx
call fcn.00420732
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x40c776
push 0x43b9e6
jmp 0x40c84f
cmp dword [ebp - 8], eax
jne 0x40c78e
push 0xe0000035
push 1
call fcn.0040c33a
xor edi, edi
jmp 0x40c855
cmp dword [esi + 0xa8], eax
je 0x40c7a9
cmp dword [esi + 0x20], 2
jle 0x40c7a9
lea ecx, [esi + 0x34]
push ecx
push eax
push dword [ebp + 8]
call fcn.0041f71a
push esi
push dword [ebp + 8]
call fcn.0041ba7a
mov edi, eax
test edi, edi
jns 0x40c7c2
push 0x43b764
jmp 0x40c84f
push esi
call fcn.004170d2
mov edi, eax
test edi, edi
jns 0x40c7d5
push 0x43b9c8
jmp 0x40c84f
push ebx
push dword [esi + 0x1c]
call fcn.0041d5c0
mov edi, eax
test edi, edi
jns 0x40c7eb
push 0x43b9a8
jmp 0x40c84f
push ebx
lea eax, [esi + 0xe8]
push eax
call fcn.00411d84
mov edi, eax
test edi, edi
jns 0x40c805
push 0x43b982
jmp 0x40c84f
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x40c82d
cmp word [eax], 0
je 0x40c82d
push 0
push eax
push 0x402658
push ebx
call fcn.00415a0e
mov edi, eax
test edi, edi
jns 0x40c82d
push 0x43b934
jmp 0x40c84f
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
mov eax, esi
call fcn.0040c53c
mov edi, eax
test edi, edi
js 0x40c84a
cmp dword [ebp + 8], 0
jne 0x40c82d
jmp 0x40c857
push 0x43b91e
push edi
call fcn.00431454
pop ecx
pop ecx
push esi
call fcn.0041b7a2
lea eax, [esi + 0x78]
push eax
call fcn.00416816
cmp dword [esi + 0x284], 0xffffffff
je 0x40c892
cmp dword [esi + 0x268], 1
jne 0x40c87d
mov eax, dword [esi + 0x18]
jmp 0x40c87f
xor eax, eax
push eax
push dword [esi + 0xe4]
lea eax, [esi + 0x274]
push eax
call fcn.0040dc3a
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40c8ae
push 0
push 0
push 0x10
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [ebp - 4], 0
je 0x40c8bd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebx
leave
ret 4
Function at 0x407980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [ebp + 0xc]
add eax, 0x59
movzx ecx, byte [ebp - 0xf5]
sub eax, ecx
add eax, dword [ebp + 0x14]
or eax, dword [ebp - 0xec]
mov byte [ebp - 0x109], al
movzx edx, word [ebp - 0xe4]
movzx eax, byte [ebp - 0x91]
add eax, 0x5d
or edx, eax
movzx ecx, byte [ebp - 0xf5]
add ecx, edx
mov byte [ebp - 0xf5], cl
movzx edx, word [ebp - 0xc8]
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x4b]
sub ecx, dword [ebp + 8]
mov word [ebp - 0x1b0], cx
mov dword [ebp - 0xe0], 0x31
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x248], 0
jmp 0x407a12
mov eax, dword [ebp - 0x248]
add eax, 1
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xb
jge 0x407a7f
movzx ecx, byte [ebp - 0x195]
add ecx, 0x10
mov dword [ebp - 0x19c], ecx
lea edx, [ebp - 0x1b4]
sub edx, 0x1e
movzx eax, byte [edx]
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0x1b4]
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x230], 0x3a
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x19c]
lea ecx, [eax + edx - 0x4c]
and ecx, 0x27
xor ecx, 0x3e
mov byte [ebp - 0x1a9], cl
mov dword [ebp + 0x14], 0x40
mov edx, dword [ebp + 8]
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x6c], 0xb
jmp 0x407a03
movzx eax, word [ebp - 0x1a4]
mov ecx, 0x28
sub ecx, eax
add ecx, dword [0x42f03c]
mov dword [0x42f03c], ecx
movzx edx, byte [ebp + 0x14]
mov dword [ebp - 0x19c], edx
mov dword [ebp - 0x20c], 0x43
mov eax, dword [ebp - 0x234]
mov dword [ebp + 8], eax
movzx ecx, word [ebp - 0x228]
movzx edx, byte [ebp - 7]
add ecx, edx
mov eax, dword [0x42f04c]
sub eax, ecx
mov dword [0x42f04c], eax
movzx ecx, byte [ebp - 6]
mov edx, dword [ebp + 0x14]
sub edx, ecx
and edx, 0x22
movzx eax, word [ebp - 0xc]
sub eax, edx
mov word [ebp - 0xc], ax
mov eax, dword [ebp - 0xe0]
mov esp, ebp
pop ebp
ret
Function at 0x4095f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov dword [ebp - 0x240], 0
jmp 0x409614
mov eax, dword [ebp - 0x240]
add eax, 1
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0xb
jge 0x409678
movzx ecx, byte [ebp - 0xfe]
add ecx, 0x45
sub ecx, dword [ebp + 0x14]
mov word [ebp - 0x230], cx
mov dword [ebp + 0xc], 0x84
mov edx, dword [ebp - 0x98]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x1b0]
push ecx
call fcn.0041c030
add esp, 0xc
mov dword [ebp + 0x10], eax
mov edx, dword [ebp - 0x194]
mov dword [ebp - 0x108], edx
movzx eax, word [ebp - 0x18]
mov ecx, 0x27
sub ecx, eax
and ecx, 0x53
mov word [ebp - 0xfc], cx
jmp 0x409605
movzx edx, word [ebp - 0xf0]
xor edx, 0x1a
mov dword [0x42f038], edx
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x214], 0x31
movzx ecx, byte [ebp - 0x91]
add ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x8c]
and ecx, 0x31
mov word [ebp - 0x14], cx
mov dword [ebp + 8], 0x50
movzx edx, byte [ebp - 0x10e]
and edx, dword [ebp - 0x9c]
mov dword [ebp + 0x10], edx
mov eax, 0xffffffeb
sub eax, dword [ebp - 0xe4]
mov ecx, 0x4a
sub ecx, dword [ebp - 0xa0]
and eax, ecx
mov byte [ebp - 7], al
mov dword [ebp - 0x14c], 0x45
mov edx, 0x48
sub edx, dword [ebp + 0x18]
add edx, dword [ebp - 0x98]
mov word [ebp - 0xc0], dx
movzx eax, byte [ebp - 0x10e]
mov ecx, dword [ebp + 0x1c]
lea edx, [eax + ecx - 2]
mov dword [ebp - 0xd0], edx
movzx eax, word [ebp - 0x1a0]
movzx ecx, word [ebp - 0xdc]
add eax, ecx
movzx edx, byte [ebp - 0x239]
add eax, edx
movzx ecx, word [ebp - 0xd4]
imul ecx, eax
mov word [ebp - 0xd4], cx
mov dword [ebp + 0xc], 0x55
mov dword [ebp - 0xa0], 0x5e
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x164], edx
mov dword [ebp + 0x10], 0x70
lea eax, [ebp - 0x1b0]
sub eax, 0x43
mov ecx, dword [eax]
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x138], 0xd
mov edx, dword [ebp - 0xa4]
add edx, 0x97
mov dword [ebp - 0xd0], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x98]
lea edx, [ecx + eax + 0x41]
mov dword [ebp - 0x9c], edx
movzx eax, byte [ebp - 0x10e]
or eax, 0x28
mov dword [ebp - 0x98], eax
mov ecx, 0x3d
sub ecx, dword [ebp + 0x14]
mov dword [ebp - 0xa0], ecx
mov edx, 0x13
sub edx, dword [ebp - 0xa0]
mov eax, dword [ebp + 0xc]
lea ecx, [edx + eax + 0x2b]
xor ecx, dword [ebp + 0x18]
mov byte [ebp - 5], cl
mov edx, dword [ebp + 8]
mov dword [ebp + 0xc], edx
movzx eax, word [ebp - 0xb4]
imul eax, dword [0x42f050]
mov dword [0x42f050], eax
mov eax, dword [ebp - 0x98]
mov esp, ebp
pop ebp
ret
Function at 0x409cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov dword [ebp - 0xe4], 0x4d
movzx eax, byte [ebp - 0x101]
movzx ecx, word [ebp - 0xd8]
add eax, dword [ebp - 0xa0]
lea edx, [ecx + eax + 0x5c]
mov word [ebp - 0x18], dx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x194]
push edx
call fcn.0041b5f0
add esp, 0xc
mov ecx, dword [ebp - 0xac]
lea edx, [ecx + eax + 0x51]
or edx, 0x3d
mov word [ebp - 0x114], dx
movzx eax, byte [ebp - 0x1a5]
add eax, 0xa0
sub eax, dword [ebp + 0x14]
mov word [ebp - 0x1a4], ax
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 0xc], ecx
mov edx, 0xe
sub edx, dword [ebp + 0xc]
and edx, 0x25
mov dword [ebp - 0x1a0], edx
movzx eax, byte [ebp - 0xbd]
add eax, 0xb
mov byte [ebp - 0xbd], al
mov dword [ebp - 0x1e0], 0x28
movzx ecx, byte [ebp - 0x1a]
add ecx, 0xd
movzx edx, byte [ebp - 0x19]
add edx, dword [ebp - 0x194]
and ecx, edx
mov word [ebp - 0x90], cx
movzx eax, word [ebp - 0x100]
sub eax, dword [ebp + 0x18]
movzx ecx, byte [ebp - 0xe9]
or eax, ecx
movzx edx, word [ebp - 0x234]
or edx, eax
mov word [ebp - 0x234], dx
mov eax, 0x6b
sub eax, dword [ebp - 0xf8]
sub eax, 0x44
xor eax, 0x60
mov byte [ebp - 0x251], al
mov ecx, 0xffffffd8
sub ecx, dword [ebp + 0x10]
add ecx, 0x14
mov byte [ebp - 7], cl
mov edx, dword [ebp - 0x194]
mov eax, dword [ebp + 0x10]
lea ecx, [eax + edx + 0x5f]
movzx edx, word [ebp - 0xd4]
sub ecx, edx
mov word [ebp - 0x14], cx
mov eax, dword [ebp - 0xe4]
push eax
mov ecx, dword [ebp - 0x194]
push ecx
call fcn.0041bc90
add esp, 8
add eax, 0x8e
mov dword [ebp - 0xf8], eax
movzx edx, word [ebp - 0x1a4]
sub edx, 0x28
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0x258], 0
jmp 0x409e29
mov eax, dword [ebp - 0x258]
add eax, 1
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0xb
jge 0x409ec8
movzx ecx, word [ebp - 0x108]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x64], 0x1a
mov edx, dword [ebp - 0xb0]
sub edx, dword [ebp + 0xc]
add edx, 0x44
or edx, 0x25
mov byte [ebp - 0x115], dl
movzx eax, byte [ebp - 7]
mov ecx, dword [ebp - 0x23c]
lea edx, [ecx + eax - 0x64]
sub edx, dword [ebp - 0xb8]
mov word [ebp - 0x90], dx
mov dword [ebp + 8], 0x3c
movzx eax, byte [ebp - 0x1a5]
sub eax, 0x2c
movzx ecx, word [ebp - 0x240]
add ecx, 0x2d
and eax, ecx
mov word [ebp - 0x114], ax
mov dword [ebp + 0x18], 0x37
mov dword [ebp - 0x194], 0x4f
mov edx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x110]
lea ecx, [eax + edx - 0x42]
mov word [ebp - 0x190], cx
jmp 0x409e1a
movzx edx, word [ebp - 0xc8]
and edx, 0x53
mov word [ebp - 0xc8], dx
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x30], eax
movzx ecx, word [ebp - 0xfc]
add ecx, 0x12
mov word [ebp - 0xfc], cx
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x194], edx
mov eax, dword [0x42f050]
add eax, 0x2d
mov dword [0x42f050], eax
movzx ecx, byte [ebp - 0x19]
movzx edx, word [ebp - 0xf0]
and edx, ecx
mov word [ebp - 0xf0], dx
mov eax, dword [ebp - 0x108]
mov esp, ebp
pop ebp
ret
Function at 0x4211d6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434ae4]
jne 0x4211e0
repz ret
jmp fcn.004223fc

Function at 0x42b9e4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00423c1e
and dword [ebp - 4], 0
cmp dword [0x4654e4], 0
mov ebx, eax
jne 0x42ba95
push 0x46e354
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42bb46
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x46e348
push edi
call esi
test eax, eax
je 0x42bb46
push eax
call fcn.00423bac
mov dword [esp], 0x46e338
push edi
mov dword [0x4654e4], eax
call esi
push eax
call fcn.00423bac
mov dword [esp], 0x46e324
push edi
mov dword [0x4654e8], eax
call esi
push eax
call fcn.00423bac
mov dword [esp], 0x46e308
push edi
mov dword [0x4654ec], eax
call esi
push eax
call fcn.00423bac
pop ecx
mov dword [0x4654f4], eax
test eax, eax
je 0x42ba95
push 0x46e2f0
push edi
call esi
push eax
call fcn.00423bac
pop ecx
mov dword [0x4654f0], eax
mov eax, dword [0x4654f0]
cmp eax, ebx
je 0x42baed
cmp dword [0x4654f4], ebx
je 0x42baed
push eax
call fcn.00423c27
push dword [0x4654f4]
mov esi, eax
call fcn.00423c27
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42baed
test edi, edi
je 0x42baed
call esi
test eax, eax
je 0x42bae4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42bae4
test byte [ebp - 0xc], 1
jne 0x42baed
or dword [ebp + 0x10], 0x200000
jmp 0x42bb26
mov eax, dword [0x4654e8]
cmp eax, ebx
je 0x42bb26
push eax
call fcn.00423c27
pop ecx
test eax, eax
je 0x42bb26
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42bb26
mov eax, dword [0x4654ec]
cmp eax, ebx
je 0x42bb26
push eax
call fcn.00423c27
pop ecx
test eax, eax
je 0x42bb26
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4654e4]
call fcn.00423c27
pop ecx
test eax, eax
je 0x42bb46
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42bb48
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x4010a7
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
test edi, edi
je 0x401099
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x401095
cmp edi, eax
jae 0x401099
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x401087
cmp edi, eax
jb 0x40109d
xor eax, eax
jmp 0x4010a6
movzx eax, word [edi]
neg eax
sbb eax, eax
and eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x401c16
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, eax
mov eax, dword [ebp + 0x18]
and dword [esi], 0
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x401c8b
cmp word [ebx + 8], 2
jne 0x401c6b
cmp word [ebx + 0xa], 4
jne 0x401c6b
mov edi, dword [ebx + 0xc]
jmp 0x401c65
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00401baf
mov dword [esi], eax
test eax, eax
je 0x401c86
lea esi, [eax + 0x1c]
add edi, 4
mov eax, dword [edi]
test eax, eax
jne 0x401c49
push 0x400
push dword [ebx]
push 0x401
push dword [ebp + 0x18]
call fcn.00436e73
add esp, 0x10
xor eax, eax
jmp 0x401cb1
push 8
pop eax
jmp 0x401cb1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x401cb1
dec ecx
je 0x401cac
dec ecx
je 0x401ca5
dec ecx
jmp 0x401cb1
mov eax, 0x2afb
jmp 0x401cb1
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x402304
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x46b1f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x46f94c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x238], str.getaddrinfo
mov dword [ebp - 0x234], 0x401e6a
mov dword [ebp - 0x230], str.getnameinfo
mov dword [ebp - 0x22c], 0x402139
mov dword [ebp - 0x228], str.freeaddrinfo
mov dword [ebp - 0x224], fcn.00401e2e
jne 0x402483
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
je 0x402479
lea eax, [ebp - 0x220]
push eax
mov esi, 0x10c
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.00436a8c
push str.ws2_32
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.00436e06
mov ebx, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call ebx
mov edi, eax
test edi, edi
je 0x4023dd
push str.getaddrinfo
push edi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
jne 0x4023d9
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor edi, edi
test edi, edi
jne 0x402432
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.00436a8c
push str.wship6
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.00436e06
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
call ebx
mov edi, eax
test edi, edi
je 0x402479
push str.getaddrinfo
push edi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
jne 0x40242e
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor edi, edi
test edi, edi
je 0x402479
xor esi, esi
push dword [ebp + esi*8 - 0x238]
push edi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp + esi*8 - 0x234], eax
test eax, eax
je 0x402455
inc esi
cmp esi, 3
jl 0x402434
jmp 0x40245e
push edi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor edi, edi
test edi, edi
je 0x402479
xor eax, eax
mov ecx, dword [ebp + eax - 0x234]
mov dword [eax + 0x46c674], ecx
add eax, 8
cmp eax, 0x18
jl 0x402464
mov dword [0x46f94c], 1
movzx eax, word [ebp + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [eax*8 + 0x46c674]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00435124
leave
ret 4
Function at 0x40382d
Capabilities:
Initialize winsock library

Disassembly:
push 0
mov eax, 0x448ca2
call fcn.004482ac
mov esi, dword [ebp + 8]
lea eax, [esi + 0x10]
push eax
call fcn.004019b9
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [esi + 0x28]
push eax
call fcn.004019b9
mov byte [ebp - 4], 1
or dword [esi + 0x40], 0xffffffff
mov dword [esi], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov byte [esi + 0x44], bl
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 0x2710
cmp dword [0x46e9d0], ebx
je 0x403891
push 0x46e840
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x46e9d0], eax
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00448384
ret 4

Function at 0x4039fb
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x46b1f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [esi + 0x44], bl
je 0x403a17
mov al, 1
jmp 0x403a87
mov eax, dword [esi + 0x40]
mov byte [ebp - 0x31], 1
cmp eax, 0xffffffff
jne 0x403a27
xor al, al
jmp 0x403a87
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_WSAConnect]
test eax, eax
je 0x403a81
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x403a7b
push dword [esi + 0x4c]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
jne 0x403a7e
push 0x2c
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.00439030
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
push ebx
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x403a81
mov dword [esi + 0x48], eax
mov byte [ebp - 0x31], bl
mov al, byte [ebp - 0x31]
mov byte [esi + 0x44], al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00435124
leave
ret 4
Function at 0x403a96
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
push dword [esi + 0x4c]
mov edi, dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [esi + 0xc]
call edi
test eax, eax
je 0x403abd
mov dword [esi + 0x48], 0x2749
xor al, al
jmp 0x403b64
push ebx
xor ebx, ebx
push ebx
push dword [esi + 8]
call edi
cmp eax, 0x102
jne 0x403adb
mov dword [esi + 0x48], 0x2734
xor al, al
jmp 0x403b63
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
lea eax, [esi + 0x28]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [esi + 8]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.WS2_32.dll_WSAResetEvent]
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x40]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x403b23
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
jne 0x403b55
push dword [esi + 0x4c]
push dword [esi + 8]
call edi
test eax, eax
jne 0x403b58
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x40]
mov dword [ebp + 0xc], ebx
call dword [sym.imp.WS2_32.dll_WSAGetOverlappedResult]
test eax, eax
je 0x403b4f
mov bl, 1
jmp 0x403b58
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esi + 0x48], eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov al, bl
pop ebx
pop edi
leave
ret 0xc