joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469dc7
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
jmp 0x469dde

Function at 0x479cc2
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x479d0c
ror cl, cl
jbe 0x479ce8
rdtsc
lea ebx, reloc.MSVCRT.dll_strncpy
jmp 0x479cf6
rdtsc
lea ebx, reloc.MSVCRT.dll_strncpy
jmp 0x479cf6
mov ebp, dword [esp + 0x2c]
push ebp
inc dh
jb 0x479d37
jae 0x479d21
xchg byte [esi], al
xchg esp, eax
push cs
mov esp, 0x88691e37
sub eax, dword [edi - reloc.MSVCRT.dll_strncpy]
mov dh, 0xce
invalid
xchg bh, bl
dec ebx
jmp 0x479d7a
xchg bh, bl
dec ebx
jmp 0x479d7a
not cl
inc ecx
call fcn.0047a12c
jl 0x479d6b
jmp [edi + 0xa]
outsd dx, dword [esi]
or bh, cl
mov bh, 0x5a
rol byte [esi + 0x21], 1
shl byte [edx - 0x33], 1
pop esp
scasd eax, dword es:[edi]
mov dh, 0x8d
je 0x479da1
lea esi, [esp + 4]
xchg edx, ecx
sbb ax, cx
jg 0x479d62
add al, 0x87
retf 0x1b66
jle 0x479da5
sub esp, 0xbc
mov edi, esp
call fcn.00479e00
test al, 0x21
mov cl, pe_nt_image_headers32
and edx, dword [ebp - reloc.MSVCRT.dll_strncpy]
invalid
pop edx
mov ch, 0xa4
xlatb
not cl
inc ecx
jmp 0x479d87

Function at 0x47bef1
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x47becf
mov edi, ecx
jmp 0x47befe
mov ebp, dword [esp + 0x2c]
bswap edi
cpuid
jmp 0x47bf2d
lea edi, [esp]
dec bx
jmp 0x47bf70
rdtsc
btc si, bx
neg cx
jmp 0x47bf7a
neg cx
jmp 0x47bf7a
jle 0x47bf38
rdtsc
btc si, bx
jmp 0x47bf5a
sub esp, 0xc0
jmp 0x47bf9b
mov esi, esp
dec cx
jmp 0x47bfcc

Function at 0x47bf91
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0468858
jmp 0x47bf1b
lea esi, [esi - 0xb8]
sbb ebx, 0x17d35e67
je 0x47bef6
mov edi, ecx
jmp 0x47befe
pushfd
jmp 0x47b43e
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
jmp 0x47bf54
Function at 0x4b19a7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test edi, edi
jmp 0x4b1c06
call fcn.004b1af5
cmc
in al, 0x17
jle 0x46a88e
test al, 0x1a
cli
test al, 0x8b
cwde
mov fs, word [esi - 0x2a05bc80]
jmp 0x4b18c8
movzx edx, byte [eax + 1]
dec bl
jmp 0x4b1992
mov dword [esp], eax
mov ecx, edi
cmc
jmp 0x46a9d5
shr ecx, 0x1d
lea esp, [esp + 4]
add dword [esi + 4], ecx
jmp 0x4b1a74
dec ecx
mov ch, 0x40
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
jmp 0x4b18d6
stc
dec edi
jmp 0x4b19bf
je 0x46a839
mov cx, 0xf5d7
bswap ecx
push ebx
jmp 0x46a84f
inc dword [ebp + 8]
clc
jmp 0x4b194c
lea esp, [esp + 0x20]
inc eax
cmc
cmc
jmp 0x4b18ff
lea eax, [esi + 0x1a]
jmp 0x46a865
mov dl, cl
lea edx, reloc.MSVCRT.dll_strncpy
jmp 0x4b191e
cmp eax, 0x40
jne 0x46a823
xor ecx, ecx
jmp 0x4b1934
movzx ebx, byte [eax]
push sp
stc
call fcn.004b196f
movzx ebx, byte [eax - 1]
call 0x4b19a7
in eax, 0xc1
loop 0x4b19b2
jmp 0x4b19ef
iretd
mov byte [eax + esi + 0x18], cl
pushal
stc
sub esp, 3
lea esp, [esp + 3]
jmp 0x4b1915
push ebx
shl edx, 8
sub esp, 0x16
lea esp, [esp + 2]
jmp 0x4b1a36
or edx, ebx
bts ebx, edx
lea ebx, [esi*4]
movzx ebx, byte [eax - 2]
jmp 0x4b19d1
add esi, 0xffffffc0
mov dword [esi], edx
pop esi
jmp 0x4b1a52
mov esi, ecx
lea esi, [esi*4]
lea esi, [esi + ebp]
jmp 0x4b1a01
or edx, ebx
clc
push esi
jmp 0x4b1a17
cmp ecx, 0x10
jmp 0x4b1a5c
lea esp, [esp + 0x28]
inc ecx
add eax, 4
jmp 0x4b1a3c
jb 0x46a865
jae 0x4b1ef4
arpl si, di
insb byte es:[edi], dx
or eax, dword [esi]
lds ecx, [edi - 0x2a]
inc ecx
ret
mov dword [esi], edx
clc
push bx
lea esp, [esp + 2]
test edi, edi
jmp 0x4b18ed
jne 0x46a84f
mov ebx, dword [esp]
lea esp, [esp + 4]
jmp 0x46a839
call fcn.004876d9
xor eax, eax
jmp 0x46a823
lea ecx, [esi + 8]
pushfd
lea esp, [esp + 4]
lea eax, [ebp - 0x40]
jmp 0x4b1d59

Function at 0x525e5b
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
lea eax, [esi*4]
not ah
rdtsc
ror si, 6
setne bl
jmp 0x525e20
mov byte [esp + 2], dl
mov word [esp], dx
mov word [esp + 1], si
lea esp, [esp + 4]
jmp 0x525e36

Function at 0x5267bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg bp
xchg bh, ch
shl edx, 0xd
bswap ebx
rdtsc
sete ah
jmp 0x526614
shl ebp, 0x15
rdtsc
sub esp, 0
sub esp, 0x19
mov edx, esi
bsf bp, di
jmp 0x52662a
jmp 0x52675b

Function at 0x527150
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edi, ebp
cmc
lea edi, [ebx*4]
lea eax, [edx + esi]
jmp 0x526020
cpuid
xchg edi, ebp
xchg word [esp + 0x14], bx
push word [esp]
pop ecx
xchg dword [esp + 4], ebp
jmp 0x525ff6
mov dword [esp + 0x10], ebx
bsf bp, dx
xchg byte [esp + 0x19], bl
clc
mov edi, 0xa5a0f3f0
mov dword [esp], ecx
sbb di, cx
bsf ebp, edx
mov ecx, 0xc1a568ab
mov eax, dword [esp + 0xf]
pop dword [esp + 6]
cld
jmp 0x52600c
lea edi, [esi*4]
xchg bx, ax
sub esp, 0x1c
lea eax, reloc.MSVCRT.dll_strncpy
not edx
xchg ebx, eax
jmp 0x526044
add esp, 0xa
lea edx, [ebx*4]
lea edx, [ecx + ecx]
lea edx, reloc.MSVCRT.dll_strncpy
xchg edx, esi
mov byte [esp + 5], bl
jmp 0x5260ea
mov byte [esp + 4], cl
xchg si, di
mov byte [esp + 0xc], cl
jmp 0x5263ab
Function at 0x527611
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
mov byte [esp], dh
lea esp, [esp + 1]
push esi
sub esp, 0x11
jmp 0x52762d

Function at 0x527bfe
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg edx, eax
bts ax, sp
mov dx, cx
jmp 0x527c22

Function at 0x527ce8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], ch
mov dword [esp], esp
push word [esp + 5]
jmp 0x527d0a

Function at 0x527f86
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 3]
push word [esp + 3]
xchg ebx, eax
mov al, byte [esp + 5]
bswap edx
jmp 0x527fc5
neg al
not ebx
bsf bx, bp
pop word [esp]
pop word [esp + 1]
mov ebx, 0x7cecde11
jmp 0x527fab

Function at 0x528051
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xf]
mov bh, bl
mov dword [esp + 6], ebx
jmp 0x52806e

Function at 0x528255
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dx, bx
jmp 0x5282cd
ror bx, cl
lea eax, [edx + esi]
mov dx, word [esp + 3]
mov bh, ch
rdtsc
mov dh, 0xeb
jmp 0x52827e
mov bx, word [esp + 2]
lea ebx, [ecx + esi]
xchg dword [esp], ebx
clc
lea edx, [ebx*4]
mov dx, cx
jmp 0x528294

Function at 0x528755
Capabilities:
Execute anti-debugging instructions

Disassembly:
not bh
lea esp, [esp]
bswap eax
lea edx, [ecx - 6]
bsf ebx, ecx
jmp 0x528598
mov eax, edi
sub esp, 9
lea esp, [esp + 0x10]
rdtsc
rdtsc
xchg word [esp], dx
jmp 0x528558
not edx
bswap ebx
mov dh, byte [esp]
bswap ebx
btr bx, bx
xchg ah, al
jmp 0x5285be
xchg word [esp], ax
cmc
mov bx, cx
inc bh
mov byte [esp], bl
std
jmp 0x528581
xchg word [esp], bx
cld
xchg byte [esp], al
mov word [esp], bx
jmp 0x528609
cmp ah, ah
push word [esp]
mov ax, 0x4a01
pop word [esp]
rdtsc
mov dx, bp
jmp 0x5285a8
dec dx
lea eax, [ecx*4]
lea esp, [esp + 2]
jmp 0x528634
mov edx, dword [esp + 0x11]
lea ebx, [eax + ecx]
mov edx, 0xa33ddfe1
sub esp, 0x12
rcl bx, 1
pop edx
jmp 0x5285d3
mov eax, 0x94c85ea5
mov edx, 0x47559518
mov byte [esp], dh
mov al, byte [esp]
pop ax
pushal
jmp 0x5285e9
mov ax, si
mov ax, word [esp]
neg ax
mov eax, dword [esp + 0x35]
jmp 0x52864b
mov ebx, dword [esp + 0x2c]
mov edx, 0x6d2e3e10
sub esp, 0
mov al, 0x64
mov edx, dword [esp + 0x30]
mov eax, dword [esp]
jmp 0x52861e
lea esp, [esp + 0x3c]
popfd
lea esp, [esp + 4]
call fcn.005286d6
push esi
lea esp, [esp + 1]
lea esp, [esp + 1]
mov dword [esp], eax
call fcn.005286a4
das
mov eax, 0x11b8492e
adc eax, 0x691e3784
and ax, sp
mov bx, word [esp + 0xc]
add esp, 4
ror ax, cl
mov ebx, 0xd5c88efe
cmc
jmp 0x52856e
lea edx, [eax + esi]
jmp 0x528675
Function at 0x40313f
Capabilities:
Get common file path
Get disk information
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc50
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ebx
mov ebx, dword [eax + 4]
push esi
xor esi, esi
cmp dword [0x4d7aa0], 0x594
push edi
mov dword [ebp - 0x10], ecx
jne 0x40316c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov eax, dword [str.F8I]
mov dword [ebp - 0x24], eax
mov eax, dword [0x42856c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0x30], 0x9e3779b9
call fcn.00403138
mov eax, dword [0x428570]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x428574]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, dword [ebp - 0x10]
shl eax, 4
cmp dword [0x4d7aa0], 0xc
mov dword [ebp - 4], eax
jne 0x403217
lea eax, [ebp - 0x450]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor eax, eax
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0xc50]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
lea eax, [ebp - 0x38]
push eax
push esi
lea eax, [ebp - 0x50]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x4d7aa0]
cmp eax, 0xfa9
jne 0x403233
mov dword [0x4d703c], 0xedeb2e40
cmp eax, 0x3eb
jne 0x403240
mov dword [0x4d69e8], esi
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add eax, edi
shr edi, cl
mov dword [ebp - 0x14], eax
mov dword [0x4d7038], 0xf4ea3dee
add edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edi, dword [ebp - 4]
cmp dword [0x4d7aa0], 0x213
jne 0x40327d
push 0x402cf8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub ebx, edi
cmp dword [0x4d7aa0], 0xc
jne 0x40329e
lea eax, [ebp - 0x14]
push eax
push esi
push esi
lea eax, [ebp - 0x3c]
push eax
push esi
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_BackupRead]
mov eax, ebx
lea ecx, [ebp - 4]
call fcn.00403132
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov edx, ebx
shr edx, cl
add eax, ebx
mov dword [ebp - 0x14], eax
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
sub dword [ebp - 8], eax
dec dword [ebp - 0x1c]
jne 0x4031ac
cmp dword [0x4d7aa0], 0xa6d
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
mov dword [edi], eax
jne 0x4032fa
push esi
push esi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov dword [edi + 4], ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4040e6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4273b8]
jne 0x4040f0
repz ret
jmp fcn.0040863c

Function at 0x40b3eb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004067fc
and dword [ebp - 4], 0
cmp dword [0x42aa08], 0
mov ebx, eax
jne 0x40b49c
push 0x402b04
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b54d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402af8
push edi
call esi
test eax, eax
je 0x40b54d
push eax
call fcn.0040678a
mov dword [esp], 0x402ae8
push edi
mov dword [0x42aa08], eax
call esi
push eax
call fcn.0040678a
mov dword [esp], 0x402ad4
push edi
mov dword [0x42aa0c], eax
call esi
push eax
call fcn.0040678a
mov dword [esp], 0x402ab8
push edi
mov dword [0x42aa10], eax
call esi
push eax
call fcn.0040678a
pop ecx
mov dword [0x42aa18], eax
test eax, eax
je 0x40b49c
push 0x402aa0
push edi
call esi
push eax
call fcn.0040678a
pop ecx
mov dword [0x42aa14], eax
mov eax, dword [0x42aa14]
cmp eax, ebx
je 0x40b4f4
cmp dword [0x42aa18], ebx
je 0x40b4f4
push eax
call fcn.00406805
push dword [0x42aa18]
mov esi, eax
call fcn.00406805
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b4f4
test edi, edi
je 0x40b4f4
call esi
test eax, eax
je 0x40b4eb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b4eb
test byte [ebp - 0xc], 1
jne 0x40b4f4
or dword [ebp + 0x10], 0x200000
jmp 0x40b52d
mov eax, dword [0x42aa0c]
cmp eax, ebx
je 0x40b52d
push eax
call fcn.00406805
pop ecx
test eax, eax
je 0x40b52d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b52d
mov eax, dword [0x42aa10]
cmp eax, ebx
je 0x40b52d
push eax
call fcn.00406805
pop ecx
test eax, eax
je 0x40b52d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42aa08]
call fcn.00406805
pop ecx
test eax, eax
je 0x40b54d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b54f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404f20
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov ecx, 0x88
xor eax, eax
mov edi, 0x430800
mov esi, dword [sym.imp.MSVCRT.dll_fprintf]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov al, byte [0x42d924]
test al, al
je 0x404f50
mov eax, dword [0x42d920]
push str._n___RfcLastError_n
push eax
call esi
add esp, 8
push 0x430800
call sub.LIBRFC32.dll_RfcLastError
mov eax, dword [0x42d91c]
test eax, eax
je 0x404f7f
mov cl, byte [0x42d924]
test cl, cl
je 0x404f7f
mov ecx, dword [0x42d920]
push eax
push str._nFUNCTION:__s
push ecx
call esi
add esp, 0xc
mov eax, dword [0x42d918]
test eax, eax
je 0x404fa4
mov cl, byte [0x42d924]
test cl, cl
je 0x404fa4
mov edx, dword [0x42d920]
push eax
push str._nEXCEPTION:__s
push edx
call esi
add esp, 0xc
mov al, byte [0x42d924]
test al, al
je 0x40507d
mov eax, dword [esp + 0xc]
mov ecx, dword [0x42d920]
push eax
push str._nRFC_operation_code__s_n
push ecx
call esi
mov al, byte [0x42d924]
add esp, 0xc
test al, al
je 0x40507d
mov edx, dword [0x42d920]
push str.ERROR_EXCEPTION_n
push edx
call esi
mov al, byte [0x42d924]
add esp, 8
test al, al
je 0x40507d
mov eax, dword [0x42d920]
push 0x430800
push str.key_____:__s_n
push eax
call esi
mov al, byte [0x42d924]
add esp, 0xc
test al, al
je 0x40507d
mov ecx, dword [0x42d920]
push 0x430821
push str.status__:__s_n
push ecx
call esi
mov al, byte [0x42d924]
add esp, 0xc
test al, al
je 0x40507d
mov edx, dword [0x42d920]
push 0x4308a1
push str.message_:__s_n
push edx
call esi
mov al, byte [0x42d924]
add esp, 0xc
test al, al
je 0x40507d
mov eax, dword [0x42d920]
push 0x4309a1
push str.internal:__s_n
push eax
call esi
mov al, byte [0x42d924]
add esp, 0xc
test al, al
je 0x40507d
mov ecx, dword [0x42d920]
push str._n___RfcClose_n
push ecx
call esi
add esp, 8
push 0
call sub.LIBRFC32.dll_RfcClose
push 1
call dword [sym.imp.MSVCRT.dll_exit]
add esp, 4
pop edi
pop esi
ret 4

Function at 0x4050a0
Capabilities:
Terminate process

Disassembly:
mov al, byte [0x42d924]
push esi
mov esi, dword [esp + 8]
test al, al
je 0x4050c3
mov eax, dword [0x42d920]
push esi
push str._n___RfcAbort________s
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0xc
mov ecx, dword [0x4307f0]
push esi
push ecx
call sub.LIBRFC32.dll_RfcAbort
push 1
call dword [sym.imp.MSVCRT.dll_exit]
add esp, 4
pop esi
ret
Function at 0x4052b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x4054b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x430b5c], 0xffffffff
mov dword [0x430b60], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x42d948]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x42d944]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x430b64], ecx
call fcn.004054a0
mov eax, dword [0x415ba0]
test eax, eax
jne 0x405341
push 0x405490
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00405470
push 0x41400c
push 0x414008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x42d940]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x42d93c]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x414004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [edx]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x40544f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x4053b5
cmp al, 0x22
jne 0x4053a7
cmp byte [esi], 0x22
jne 0x4053be
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x4053ce
cmp al, 0x20
ja 0x4053ce
inc esi
mov dword [ebp - 0x74], esi
jmp 0x4053be
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x4053ef
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x4053f4
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x405434
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x4053be
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40544f

Function at 0x40b8c1
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x40b907
push dword [esp + 4]
push eax
push str.gethostbyname
push str.NiPHostToAddr
push 0xfffffffffffffffe
push 0xfffffffffffffffe
call fcn.0040a304
pop ecx
push eax
push 1
push 0xc0
push 0x418230
push 0x1f
push 0x411010
call fcn.00401266
add esp, 0x2c
push 0xfffffffffffffffe
pop eax
ret
mov eax, dword [eax + 0xc]
push 4
push dword [eax]
push dword [esp + 0x10]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
cmp dword [0x414530], 2
jl 0x40b94b
call fcn.00405210
push dword [esp + 8]
call fcn.0040a863
pop ecx
push eax
push str.read_hostaddr__s_from_operating_system_n
push dword [0x4307f8]
call fcn.004050e0
add esp, 0xc
call fcn.00405240
xor eax, eax
ret
Function at 0x40ba76
Capabilities:
Get hostname

Disassembly:
cmp dword [0x430460], 0
jne 0x40ba84
call fcn.004054fe
push dword [esp + 8]
push dword [esp + 8]
call sub.WSOCK32.dll_gethostname
test eax, eax
jge 0x40bacf
call sub.WSOCK32.dll_WSAGetLastError
push eax
push str.gethostname
push str.NiPMyHostName
push 0xfffffffffffffff2
push 0xfffffffffffffff2
call fcn.0040a304
pop ecx
push eax
push 1
push 0x162
push 0x418324
push 0x1f
push 0x411010
call fcn.00401266
add esp, 0x28
push 0xfffffffffffffff2
pop eax
ret
xor eax, eax
ret

Function at 0x40bbb7
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 1
pop ebx
push 4
lea eax, [ebp - 4]
push eax
push ebx
push 6
push edi
mov dword [ebp - 4], ebx
call sub.WSOCK32.dll_setsockopt
test eax, eax
jge 0x40bc23
cmp dword [0x414530], 0
je 0x40bc23
call fcn.00405210
push 0x1a7
push 0x418390
call fcn.0040bb8f
pop ecx
push eax
push 0x418398
push 0x42d928
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push str.setsockopt_TCP_NODELAY
push dword [0x4307f8]
call fcn.004054a0
pop ecx
pop ecx
call fcn.00405240
push 4
lea eax, [ebp - 4]
push eax
push 0x1002
mov esi, 0xffff
push esi
push edi
mov dword [ebp - 4], 0x8000
call sub.WSOCK32.dll_setsockopt
test eax, eax
jge 0x40bc8e
cmp dword [0x414530], 0
je 0x40bc8e
call fcn.00405210
push 0x1ae
push 0x4183bc
call fcn.0040bb8f
pop ecx
push eax
push 0x4183c4
push 0x42d928
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push str.setsockopt_SO_RCVBUF
push dword [0x4307f8]
call fcn.004054a0
pop ecx
pop ecx
call fcn.00405240
push 4
lea eax, [ebp - 4]
push eax
push 0x1001
push esi
push edi
mov dword [ebp - 4], 0x8000
call sub.WSOCK32.dll_setsockopt
test eax, eax
jge 0x40bcf4
cmp dword [0x414530], 0
je 0x40bcf4
call fcn.00405210
push 0x1b5
push 0x4183e8
call fcn.0040bb8f
pop ecx
push eax
push 0x4183f0
push 0x42d928
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push str.setsockopt_SO_SNDBUF
push dword [0x4307f8]
call fcn.004054a0
pop ecx
pop ecx
call fcn.00405240
push 0
push edi
call fcn.0040bde8
pop ecx
pop ecx
push 4
lea eax, [ebp - 4]
push eax
push 4
push esi
push edi
mov dword [ebp - 4], ebx
call sub.WSOCK32.dll_setsockopt
test eax, eax
jge 0x40bd5d
cmp dword [0x414530], 0
je 0x40bd5d
call fcn.00405210
push 0x1c0
push 0x418414
call fcn.0040bb8f
pop ecx
push eax
push 0x41841c
push 0x42d928
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push str.setsockopt_SO_REUSEADDR
push dword [0x4307f8]
call fcn.004054a0
pop ecx
pop ecx
call fcn.00405240
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x40bd64
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0xffff
push dword [ebp + 8]
mov dword [ebp - 4], 1
call sub.WSOCK32.dll_setsockopt
test eax, eax
jge 0x40bde3
call sub.WSOCK32.dll_WSAGetLastError
cmp dword [0x414530], 0
mov esi, eax
je 0x40bde3
call fcn.00405210
push 0x1e4
push 0x418440
call fcn.0040bb8f
pop ecx
push eax
push 0x418448
push 0x42d928
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push esi
call fcn.0041008e
pop ecx
push eax
push esi
push str.setsockopt_SO_REUSEADDR:___d___s
push dword [0x4307f8]
call fcn.004054a0
add esp, 0x10
call fcn.00405240
xor eax, eax
pop esi
leave
ret

Function at 0x40bde8
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
cmp byte [ebp + 0xc], al
push 4
setne al
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push 8
push 0xffff
push dword [ebp + 8]
call sub.WSOCK32.dll_setsockopt
test eax, eax
jge 0x40be58
cmp dword [0x414530], 0
je 0x40be58
call fcn.00405210
push 0x208
push 0x418478
call fcn.0040bb8f
pop ecx
push eax
push 0x418480
push 0x42d928
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push str.setsockopt_SO_KEEPALIVE
push dword [0x4307f8]
call fcn.004054a0
pop ecx
pop ecx
call fcn.00405240
xor eax, eax
pop ebp
ret

Function at 0x40bf33
Capabilities:
Connect socket

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push 0x10
push esi
push dword [esp + 0x10]
call sub.WSOCK32.dll_connect
test eax, eax
jge 0x40c024
push edi
push ebx
call sub.WSOCK32.dll_WSAGetLastError
cmp byte [0x430364], 0
mov ebx, eax
mov edi, 0x430350
je 0x40bfd7
push 0x10
push edi
push esi
call sub.MSVCRT.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x40bfd7
cmp dword [0x414530], 2
jl 0x40bfa2
call fcn.00405210
push ebx
call fcn.0041008e
pop ecx
push eax
push ebx
push str.connect_to_partner_failed__errno__d___s_n
push dword [0x4307f8]
call fcn.004050e0
add esp, 0x10
call fcn.00405240
push 0x418544
push 0x418548
push ebx
push 0x41854c
push 0x418554
push 0xfffffffffffffff6
push 0xfffffffffffffff6
call fcn.0040a304
pop ecx
push eax
push 0
push 0x26a
push 0x418560
push 0x1f
push 0x418568
jmp 0x40c00a
push 0x418580
push 0x418584
push ebx
push str.connect
push str.NiPConnect
push 0xfffffffffffffff6
push 0xfffffffffffffff6
call fcn.0040a304
pop ecx
push eax
push 1
push 0x270
push 0x41859c
push 0x1f
push 0x411010
call fcn.00401266
mov byte [0x430364], 1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0x30
push 0xfffffffffffffff6
movsd dword es:[edi], dword [esi]
pop eax
pop ebx
movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret
and byte [0x430364], 0
xor eax, eax
pop esi
ret