joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4142e4
Capabilities:
Get file size

Disassembly:
cmp dword [0x46cf30], 0
mov eax, 1
jne 0x414420
mov eax, dword [str.ipbase.bin]
test eax, eax
je 0x41441e
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
push 0
push eax
call fcn.0040357d
pop ecx
mov esi, eax
pop ebx
test eax, eax
jns 0x414342
mov eax, dword [str.ipbase.bin]
cmp eax, str.ipbase.bin
je 0x4143af
push edx
push eax
push str.Cant_open__s
push 0x4634a0
call fcn.0040423a
add esp, 0x10
jmp 0x4143af
push ecx
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
pop ebx
pop eax
cmp edi, 0xff
jle 0x41438d
sub esp, 0xc
lea eax, [edi + 0x10]
push eax
call fcn.0042d128
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x41438d
push eax
push edi
push ebx
push esi
call fcn.00403603
pop edx
cmp eax, edi
jge 0x4143b3
push edi
push ebx
push 0
push dword [0x451048]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop eax
push ecx
push dword [0x438cd8]
push str.Error_loading__s
push 0x4634a0
call fcn.0040423a
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
xor eax, eax
jmp 0x414416
mov eax, dword [ebx]
cmp eax, 0x4d6559
jne 0x4143c4
mov dword [0x46cf30], ebx
jmp 0x4143e8
cmp eax, 0x4d6558
jne 0x41437c
mov eax, dword [ebx + 4]
sub esp, 0xc
add eax, 0x2008
push eax
call fcn.0042d128
add esp, 0x10
mov dword [0x46cf30], eax
test eax, eax
je 0x41437c
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x46cf30]
call fcn.0041425b
pop eax
pop edx
push str.IP___country_base_loaded
push 0x4634a0
call fcn.0040423a
add esp, 0x10
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
ret
Function at 0x4165f2
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x818]
push ebx
sub esp, 0x814
mov esi, dword [ebp + 0xc]
push edi
push dword [ebp + 8]
call fcn.00401256
add esp, 0x10
test eax, eax
jle 0x416639
lea ebx, [ebp - 0x418]
push eax
push eax
push ebx
push esi
call fcn.00401256
add esp, 0x10
test eax, eax
jle 0x416639
push esi
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x416645
push ebx
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edx
pop ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x41664f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x418]
push ebx
sub esp, 0x414
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push edi
push ebx
call fcn.00401256
add esp, 0x10
test eax, eax
jle 0x416681
push eax
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x41668b
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edx
pop ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x416695
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp - 0x408]
sub esp, 0x408
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.00401256
add esp, 0x10
test eax, eax
jle 0x4166c3
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4166cd
sub esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
add esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x4166d7
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp - 0x408]
sub esp, 0x408
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.00401256
add esp, 0x10
test eax, eax
jle 0x416705
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x41670f
sub esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x416719
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp - 0x408]
sub esp, 0x408
mov ebx, dword [ebp + 8]
push esi
push ebx
call fcn.00401256
add esp, 0x10
test eax, eax
jle 0x416747
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x416751
sub esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x41675b
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x418]
push ebx
sub esp, 0x414
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push edi
push ebx
call fcn.00401256
add esp, 0x10
test eax, eax
jle 0x41678d
push eax
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x416797
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edx
pop ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x419500
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], 0
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x419528
mov eax, dword [0x42e654]
mov dword [ebp - 0x2c], eax
mov byte [edi], 0
xor esi, esi
cmp dword [ebp - 0x1c], 0
jg 0x419562
push eax
push ebx
push 0
push dword [ebp - 0x2c]
call fcn.0040bd38
add esp, 0x10
test eax, eax
jg 0x419550
push esi
push esi
push ebx
push str.Timeout
jmp 0x41957d
lea eax, [ebp - 0x1c]
push edx
push eax
push 0x4004667f
push ebx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
pop ecx
lea eax, [edi + esi]
push 0
push 1
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x41958a
push eax
push eax
push ebx
push str.Connection_closed
call fcn.0040432d
add esp, 0x10
or eax, 0xffffffff
jmp 0x419605
inc esi
dec dword [ebp - 0x1c]
cmp byte [edi + esi - 1], 0xa
mov byte [edi + esi], 0
je 0x4195a1
cmp esi, 0x1ff
jne 0x41952d
cmp esi, 2
mov eax, 2
cmovge eax, esi
cmp dword [ebp + 0x10], 0
mov dword [edi + eax - 2], 0
jne 0x4195c8
sub esp, 0xc
push edi
call fcn.004123ba
add esp, 0x10
jmp 0x4195cf
mov eax, dword [edi]
or eax, 0x20202020
test byte [0x46c97a], 0x40
je 0x419605
cmp dword [ebp + 0x10], 0
mov edx, str.___.256s_r_n
mov esi, str.__.256s_r_n
mov dword [ebp - 0x2c], eax
cmove edx, esi
sub esp, 0xc
push edx
push 0
push ebx
push edi
push dword [0x46346c]
call fcn.00403f0e
mov eax, dword [ebp - 0x2c]
add esp, 0x20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4199c4
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x9c
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x419ae8
cmp byte [ebx], 0
je 0x419ae8
push eax
push eax
push str.____t_r_n
push ebx
call fcn.00403442
add esp, 0x10
mov dword [ebp - 0x9c], eax
test eax, eax
je 0x419a03
mov byte [eax], 0
sub esp, 0xc
push dword [ebp + 0xc]
lea esi, [ebp - 0x98]
call fcn.0040b436
add esp, 0x10
test eax, eax
je 0x419a41
push eax
push eax
mov eax, dword [ebp + 0xc]
add eax, 8
push eax
push esi
call fcn.00403813
add esp, 0xc
add eax, esi
push ebx
push str.._64s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x419a74
sub esp, 0xc
push dword [ebp + 0xc]
call fcn.0040b462
add esp, 0xc
movzx edx, al
push ebx
push edx
movzx edx, ah
push edx
mov edx, eax
shr eax, 0x18
shr edx, 0x10
movzx edx, dl
push edx
push eax
push str._u._u._u._u._.64s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
sub esp, 0xc
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
add esp, 0xc
test eax, eax
je 0x419ac5
push ebx
push dword [edi + 0x80]
push str._u__.64s_spamers_list_content_your_IP_r_n
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
pop edx
pop ecx
mov ecx, edi
push eax
push esi
call fcn.0042d3ac
lea eax, [edi + 0x10]
push ebx
push str.__r_n_.4000s
push eax
push dword [edi]
push esi
push dword [0x46346c]
call fcn.00403f0e
add esp, 0x20
mov eax, 1
jmp 0x419aea
cmp dword [ebp - 0x9c], 0
je 0x419ae8
mov eax, dword [ebp - 0x9c]
sub esp, 0xc
inc eax
push eax
call fcn.00404cfd
add esp, 0x10
mov ebx, eax
jmp 0x4199d5
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x419af4
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x82c
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test eax, eax
jne 0x419b62
test esi, esi
jne 0x419b17
xor ebx, ebx
jmp 0x419cfa
mov edx, dword [ecx + 0x1fc]
test edx, edx
je 0x419b10
lea edi, [edx + 5]
mov ecx, 0x100
test edi, edi
je 0x419b34
jecxz 0x419b34
cld
repne scasb al, byte es:[edi]
je 0x419b39
mov edi, 1
dec edi
sub esp, 0xc
inc edi
mov ecx, edx
push edi
call fcn.0041128e
add esp, 0xc
push esi
lea esi, [ebp - 0x81c]
push eax
push str._.128s_.64s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, esi
add esp, 0x10
cmp byte [eax], 0
je 0x419b10
mov dword [ebp - 0x824], 0
lea edx, [ebp - 0x81c]
mov dword [ebp - 0x820], edx
push edx
push edx
push 0
push eax
call fcn.0040357d
pop ecx
pop esi
mov dword [ebp - 0x828], eax
test eax, eax
jle 0x419b10
lea ecx, [ebp - 0x828]
call fcn.0041986e
test eax, eax
jle 0x419ce6
sub esp, 0xc
lea eax, [ebp - 0x81c]
push eax
call fcn.00404cfd
add esp, 0x10
mov esi, eax
mov al, byte [eax]
cmp al, 0x3f
jne 0x419cc3
push eax
push eax
push str._checkhello
push esi
call fcn.004034b9
add esp, 0x10
test eax, eax
je 0x419c75
cmp byte [ebx + 0x1f4], 0
jne 0x419c75
sub esp, 0xc
lea edi, [ebx + 0xec]
mov byte [ebx + 0x1f4], 0x30
push edi
call fcn.0040edd5
add esp, 0x10
test eax, eax
je 0x419c75
push eax
push eax
push 0x2e
push edi
call fcn.004033de
add esp, 0x10
test eax, eax
je 0x419c75
push eax
push eax
push str.________
push edi
call fcn.00403442
add esp, 0x10
test eax, eax
jne 0x419c75
sub esp, 0xc
push edi
call fcn.0042d208
add esp, 0x10
cmp eax, 0x3f
ja 0x419c75
sub esp, 0xc
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
add esp, 0xc
test eax, eax
je 0x419c75
mov eax, dword [eax + 0xc]
test eax, eax
je 0x419c75
mov edx, dword [eax]
test edx, edx
je 0x419c75
mov ecx, dword [ebx]
mov edi, dword [ecx + 4]
cmp dword [edx], edi
jne 0x419c70
mov byte [ebx + 0x1f4], 0x31
jmp 0x419c75
add eax, 4
jmp 0x419c54
cmp byte [esi + 1], 0x3f
jne 0x419ca5
sub esp, 0xc
add esi, 2
mov ecx, dword [ebx + 4]
mov edi, dword [ebx]
push esi
mov dword [ebp - 0x82c], ecx
call fcn.00404cfd
pop edx
pop ecx
push edi
push eax
mov ecx, dword [ebp - 0x82c]
call fcn.004199c4
pop esi
pop edi
jmp 0x419cb4
sub esp, 0xc
inc esi
mov ecx, ebx
push esi
call fcn.0041992a
add esp, 0xc
test eax, eax
je 0x419b97
mov ebx, 1
jmp 0x419ce8
cmp al, 0x23
je 0x419b97
test al, al
je 0x419b97
push eax
push eax
push esi
push dword [ebx + 0xb0]
call fcn.004034dd
add esp, 0x10
jmp 0x419cb4
xor ebx, ebx
sub esp, 0xc
push dword [ebp - 0x828]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x41cc1c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
xor esi, esi
push ebx
lea ebx, [ecx + 4]
sub esp, 0x1c
cmp dword [edi], esi
jle 0x41cc87
push eax
push eax
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str._s_s_8.8s._s
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
test eax, eax
jne 0x41cc81
mov edx, dword [0x46346c]
mov dword [ebp - 0x1c], edx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [ebp - 0x1c]
push eax
push dword [ebp + 8]
push str.Cant_delete__s___d_
push edx
call fcn.0040423a
add esp, 0x10
inc esi
add ebx, 8
jmp 0x41cc2c
mov dword [edi], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10

Function at 0x41cc98
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push edi
lea edi, [ecx + 8]
push esi
push ebx
mov ebx, ecx
sub esp, 0x978
mov esi, dword [ebp + 8]
mov edx, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 0x81c], 0
push edi
push dword [ebp + 0xc]
push dword [ecx + 0xc]
push str._s_s._s
push esi
mov dword [ebp - 0x970], edx
call edx
lea eax, [ebp - 0x95c]
add esp, 0x18
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x96c], eax
inc eax
pop edx
mov edx, dword [ebp - 0x970]
pop ecx
jne 0x41cd02
cmp byte [ebx + 8], 0x61
jne 0x41cdff
jmp 0x41cdd6
lea eax, [ebp - 0x950]
test byte [0x46c97d], 8
jne 0x41cd17
lea eax, [ebp - 0x948]
mov ecx, dword [ebp + 0x10]
cmp dword [eax + 4], ecx
jae 0x41cd90
cmp byte [ebp - 0x930], 0x2e
je 0x41cd90
sub esp, 0xc
lea eax, [ebp - 0x930]
push eax
call fcn.0042d208
add esp, 0x10
cmp eax, 8
jbe 0x41cd90
cmp byte [ebp - 0x928], 0x2e
jne 0x41cd90
cmp dword [ebp - 0x81c], 0xfe
jle 0x41cd67
push edi
lea ecx, [ebp - 0x81c]
push dword [ebp + 0xc]
push dword [ebx + 0xc]
push esi
call fcn.0041cc1c
mov eax, dword [ebp - 0x81c]
mov edx, dword [ebp - 0x930]
mov dword [ebp + eax*4 - 0x818], edx
lea edx, [eax + 2]
mov dword [ebp - 0x81c], edx
mov edx, dword [ebp - 0x92c]
mov dword [ebp + eax*4 - 0x814], edx
push eax
push eax
lea eax, [ebp - 0x95c]
push eax
push dword [ebp - 0x96c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
pop edx
pop ecx
test eax, eax
jg 0x41cd02
sub esp, 0xc
push dword [ebp - 0x96c]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x81c]
add esp, 0xc
push edi
push dword [ebp + 0xc]
push dword [ebx + 0xc]
push esi
call fcn.0041cc1c
jmp 0x41cdff
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x41cdff
test byte [0x46c97e], 0x80
je 0x41cdff
push eax
push dword [ebx + 0xc]
push 0x446df6
push esi
call edx
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
add esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x41ce0a
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1ac
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ecx + 0xc]
push 0x446dfc
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
pop eax
lea eax, [ebp - 0x158]
pop edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x1ac], eax
inc eax
pop ecx
pop esi
je 0x41ceec
test byte [ebp - 0x158], 0x10
je 0x41cebb
sub esp, 0xc
lea esi, [ebp - 0x12c]
push esi
call fcn.0042d208
add esp, 0x10
cmp eax, 2
jle 0x41cebb
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
jne 0x41ce8f
push eax
mov ecx, ebx
push dword [ebp + 0x10]
push esi
push edi
call fcn.0041ce0a
push dword [ebp + 0x10]
mov ecx, ebx
push esi
push edi
call fcn.0041cc98
jmp 0x41ceba
lea edx, [ebp - 0x1a0]
push esi
push dword [ebp + 0xc]
push str._.8s_.64s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [ebp - 0x1a0]
mov ecx, ebx
add esp, 0xc
push dword [ebp + 0x10]
push edx
push edi
call fcn.0041cc98
pop esi
push eax
push eax
lea eax, [ebp - 0x158]
push eax
push dword [ebp - 0x1ac]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
pop edx
pop ecx
test eax, eax
jg 0x41ce4c
sub esp, 0xc
push dword [ebp - 0x1ac]
call dword [sym.imp.KERNEL32.dll_FindClose]
add esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x41e330
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0xc
mov esi, dword [ebp + 8]
sub esp, 0xc
lea edi, [ebx + 0x200]
mov ecx, ebx
push edi
call fcn.0041e1d2
add esp, 0xc
test eax, eax
je 0x41e391
cmp byte [ebx + 0x244], 0
je 0x41e36e
cmp dword [ebx + 0x28c], esi
jne 0x41e33e
mov eax, 1
jmp 0x41e393
sub esp, 0xc
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
add esp, 0xc
test eax, eax
je 0x41e33e
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
test edx, edx
je 0x41e33e
cmp dword [edx], esi
je 0x41e367
add eax, 4
jmp 0x41e382
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x41e39d
Capabilities:
Create udp socket
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
cmp dword [str.127.0.0.1], 0
mov ebx, dword [ebp + 0xc]
jne 0x41e3b9
xor eax, eax
jmp 0x41e55b
push eax
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x3c], eax
pop edx
test eax, eax
js 0x41e3b2
mov eax, dword [str.127.0.0.1]
sub esp, 0xc
mov edi, ebx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
call fcn.004125ec
mov ecx, 0x10
xor edx, edx
mov esi, eax
lea eax, [ebp - 0x28]
call fcn.0041e014
mov dword [ebp - 0x24], esi
mov ecx, 0xc
mov esi, 0x438d80
mov dword [ebp - 0x28], 0x35000002
inc word [0x438d80]
test edi, edi
je 0x41e41d
test esi, esi
je 0x41e41d
jecxz 0x41e41d
cld
rep movsb byte es:[edi], byte [esi]
lea eax, [ebx + 0xc]
pop esi
pop edi
push dword [ebp + 8]
push eax
mov esi, 6
call fcn.0041e024
add esp, 0x10
mov dword [ebp - 0x30], eax
mov dword [eax], 0x1000f00
push eax
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x30]
push 0x10
sub eax, ebx
push edi
add eax, 4
push 0
push eax
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.WS2_32.dll_sendto]
pop edx
pop ecx
test eax, eax
jle 0x41e3b2
push eax
push dword [ebp - 0x3c]
push 0
push esi
mov dword [ebp - 0x2c], 0xffffffff
call fcn.0040bd38
add esp, 0x10
test eax, eax
jle 0x41e4a3
push eax
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], 0x10
push edi
push 0
push 0x200
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.WS2_32.dll_recvfrom]
pop edx
pop ecx
mov dword [ebp - 0x2c], eax
jmp 0x41e4a9
dec esi
cmp esi, 2
jne 0x41e43c
sub esp, 0xc
push dword [ebp - 0x3c]
call fcn.0040be6c
mov eax, dword [ebp - 0x2c]
add esp, 0x10
test eax, eax
jle 0x41e3b2
test word [ebx + 2], 0xf00
jne 0x41e4d0
cmp byte [ebx + 7], 0
jne 0x41e534
cmp dword [ebp + 0x10], 0
jne 0x41e3b2
cmp dword [0x46c97c], 0
jns 0x41e3b2
sub esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
add esp, 0xc
test eax, eax
je 0x41e3b2
lea eax, [ebx + 0x258]
mov ecx, 0x34
xor edx, edx
call fcn.0041e014
mov eax, dword [ebp + 8]
mov dword [ebx + 0x258], eax
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebx + 0x288], 1
mov dword [ebx + 0x25c], eax
jmp 0x41e555
cmp dword [ebp + 0x10], 0
jne 0x41e555
mov dword [ebx + eax], 0
mov eax, dword [ebp - 0x30]
sub esp, 0xc
mov ecx, ebx
add eax, 4
push eax
call fcn.0041e08a
add esp, 0xc
mov eax, dword [ebp - 0x30]
add eax, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41f880
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0xa8]
push ebx
mov ebx, ecx
sub esp, 0xb0
push 0x10
push 0
push edi
call fcn.0042d1cc
mov eax, dword [ebx + 0x178]
add esp, 0x10
mov dword [ebp - 0xa8], 0x35000002
test eax, eax
je 0x41f8da
cmp byte [ebx + 0x171], 0x18
ja 0x41f8da
mov edx, dword [ebx + 0xc8]
lea ecx, [ebx + 0x11c]
xor esi, esi
mov dword [ebp - 0xac], ecx
test edx, edx
jne 0x41f963
push edx
movzx edx, byte [ebx + 0x171]
push edx
push dword [ebp + 8]
push dword [ebx + 0xc8]
push dword [ebx + 0x17c]
push eax
push str.Error_typ_u__u__u__d__d
push dword [0x46347c]
call fcn.0040423a
mov eax, dword [ebx + 0xc8]
add esp, 0x20
jmp 0x41fa43
movzx eax, byte [ebx + 0x170]
cmp eax, edx
jl 0x41f923
mov byte [ebx + 0x170], 0
movzx eax, byte [ebx + 0x170]
sub esp, 0xc
mov dword [ebp - 0xb0], edx
lea ecx, [eax + 1]
mov byte [ebx + 0x170], cl
mov eax, dword [ebx + eax*4 + 0xcc]
mov ecx, dword [ebp - 0xac]
push eax
mov dword [ebp - 0xa4], eax
call fcn.0041efe2
mov edx, dword [ebp - 0xb0]
add esp, 0xc
test eax, eax
je 0x41f96c
inc esi
cmp esi, edx
jl 0x41f911
jmp 0x41fa41
sub esp, 0xc
lea esi, [ebx + 0x182]
push 0x46d348
call fcn.0040366a
add esp, 0x10
cmp dword [ebp - 0xa4], 0
jne 0x41f9ae
push dword [ebx + 0xc8]
movzx eax, byte [ebx + 0x170]
push eax
push str.Error_resend_Bad_addres__u__u
push dword [0x46347c]
call fcn.0040423a
add esp, 0x10
jmp 0x41f9d3
mov byte [ebx + 0x18d], 0
push edx
push edx
push 0x10
push edi
push 0
push dword [ebx + 0x17c]
push esi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_sendto]
or word [ebx + 2], 1
pop ecx
pop eax
movzx eax, byte [ebx + 0x170]
cmp eax, dword [ebx + 0xc8]
jl 0x41f9e9
mov byte [ebx + 0x170], 0
inc byte [ebx + 0x171]
push eax
push eax
lea eax, [ebx + 0xac]
add ebx, 0x18e
push 0
push eax
mov dword [0x46d348], 0
call fcn.0042d5fc
add esp, 0xc
push esi
push ebx
lea ebx, [ebp - 0x98]
push ebx
call fcn.0041f537
push ebx
mov ecx, dword [0x46347c]
push edi
movsx eax, byte [eax + 1]
push eax
push str._recursion_
call fcn.0041ecbc
mov eax, 1
add esp, 0x10
jmp 0x41fa43
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x4201b2
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov esi, dword [ebp + 8]
test byte [ecx + 3], 2
je 0x4201f6
mov eax, dword [ecx + 0x17c]
cmp eax, 0x1f4
ja 0x4201f6
add eax, esi
push edi
push 0xb
push 0x447a78
push eax
call fcn.0042d1ac
add dword [ebx + 0x17c], 0xb
add esp, 0x10
inc byte [esi + 0xb]
and word [ebx + 2], 0xfdff
lea eax, [ebx + 0x18]
xor edi, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + edi*4 + 4]
cmp word [ebx + 0x180], 0
mov edx, esi
mov dword [ebp - 0x20], eax
je 0x42022b
mov ecx, dword [ebx + 0x17c]
lea edx, [esi - 2]
mov eax, ecx
xchg al, ah
add ecx, 2
mov word [esi - 2], ax
mov dword [ebx + 0x17c], ecx
mov ax, word [ebx + edi*2 + 0xb4]
mov ecx, 0x10
mov word [esi], ax
mov eax, dword [ebp - 0x1c]
cmp word [eax], 0x17
mov eax, 0x1c
cmovne eax, ecx
push ecx
inc edi
push ecx
push eax
push dword [ebp - 0x1c]
push 0
push dword [ebx + 0x17c]
push edx
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_sendto]
movzx eax, word [ebx]
pop edx
pop ecx
cmp eax, edi
jle 0x42027a
add dword [ebp - 0x1c], 0x1c
cmp word [ebx + 0x180], 0
je 0x4201fe
mov eax, dword [ebx + 0xc0]
test eax, eax
je 0x42029f
push edx
push dword [ebx + 0x17c]
push esi
push eax
call fcn.0041f00c
add esp, 0x10
mov dword [ebx + 0xc0], 0
mov ecx, ebx
call fcn.00420162
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4