joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441af0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x8fab2c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x8fab24]
sub esp, 4
test ebx, ebx
je 0x441b45
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x441b3e
test esi, esi
je 0x441b3e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x441b20
mov dword [esp], 0x8fab2c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x441e80
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x441ea5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x441eb0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x441ea5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x441ef8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x441eee
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x441efa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x441ee0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40350c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403543
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x32]
and dl, 0x7f
mov eax, dword [ebp + 8]
mov byte [eax + 0x32], dl
mov eax, 1
jmp 0x403646
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x4035a3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x403575
jmp 0x403612
push 5
mov edx, dword [ebp + 8]
push edx
call fcn.00403d80
add esp, 8
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x32]
and dl, 0x7f
mov eax, dword [ebp + 8]
mov byte [eax + 0x32], dl
xor eax, eax
jmp 0x403646
cmp dword [ebp - 8], 0
jne 0x4035d4
push 6
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403d80
add esp, 8
mov edx, dword [ebp + 8]
mov dword [edx + 0x1c], 0
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x32]
and cl, 0x7f
mov edx, dword [ebp + 8]
mov byte [edx + 0x32], cl
xor eax, eax
jmp 0x403646
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jb 0x4035fb
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp + 8]
mov al, byte [edx + 0x32]
and al, 0x7f
mov ecx, dword [ebp + 8]
mov byte [ecx + 0x32], al
mov eax, 1
jmp 0x403646
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x403543
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
push 3
mov edx, dword [ebp + 8]
push edx
call fcn.00403d80
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40364a
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0
jne 0x40369f
push 0x400
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0xc], 0
jne 0x40368b
push 5
mov eax, dword [ebp + 8]
push eax
call fcn.00403d80
add esp, 8
xor eax, eax
jmp 0x4037d9
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0x400
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0x10]
cmp edx, dword [ecx + 0x14]
jb 0x403700
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
add ecx, 0x400
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4036ee
push 5
mov edx, dword [ebp + 8]
push edx
call fcn.00403d80
add esp, 8
xor eax, eax
jmp 0x4037d9
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x14], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp + 8]
add edx, dword [eax + 0x10]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x14]
sub eax, dword [edx + 0x10]
mov dword [ebp - 0xc], eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jge 0x40376f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x40375d
push 2
mov edx, dword [ebp + 8]
push edx
call fcn.00403d80
add esp, 8
xor eax, eax
jmp 0x4037d9
push 5
mov eax, dword [ebp + 8]
push eax
call fcn.00403d80
add esp, 8
xor eax, eax
jmp 0x4037d9
cmp dword [ebp - 8], 0
jne 0x403787
push 6
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403d80
add esp, 8
xor eax, eax
jmp 0x4037d9
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
add eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004071d2
add esp, 0xc
test eax, eax
jne 0x4037c0
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.00403d80
add esp, 8
xor eax, eax
jmp 0x4037d9
mov eax, dword [ebp + 8]
push eax
call fcn.0040350c
add esp, 4
test eax, eax
jne 0x4037d4
xor eax, eax
jmp 0x4037d9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x403e1a
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x403e25
jmp 0x403e5c
push 0x20
push 0x41f490
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0x40
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x28
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp + 8]
mov dword [edx + 0x20], 0
mov dword [edx + 0x24], 0
pop ebp
ret
Function at 0x4041bc
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
push 0x40
push 0
lea eax, [ebp - 0xdc]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x40
push 0
lea ecx, [ebp - 0x40]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xdc]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x40]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov dword [ebp - 0x9c], 0
jmp 0x40422e
mov edx, dword [ebp - 0x9c]
add edx, 1
mov dword [ebp - 0x9c], edx
cmp dword [ebp - 0x9c], 0x40
jge 0x40426d
mov eax, dword [ebp - 0x9c]
mov cl, byte [ebp + eax - 0xdc]
xor cl, 0x36
mov edx, dword [ebp - 0x9c]
mov byte [ebp + edx - 0xdc], cl
mov eax, dword [ebp - 0x9c]
mov cl, byte [ebp + eax - 0x40]
xor cl, 0x5c
mov edx, dword [ebp - 0x9c]
mov byte [ebp + edx - 0x40], cl
jmp 0x40421f
lea eax, [ebp - 0x98]
push eax
call fcn.00404331
add esp, 4
push 0x40
lea ecx, [ebp - 0xdc]
push ecx
lea edx, [ebp - 0x98]
push edx
call fcn.00404371
add esp, 0xc
cmp dword [ebp + 0x14], 0
je 0x4042b1
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x98]
push edx
call fcn.00404371
add esp, 0xc
cmp dword [ebp + 0x1c], 0
je 0x4042ce
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
lea edx, [ebp - 0x98]
push edx
call fcn.00404371
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp + 0x20]
push ecx
call fcn.00404470
add esp, 8
lea edx, [ebp - 0x98]
push edx
call fcn.00404331
add esp, 4
push 0x40
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x98]
push ecx
call fcn.00404371
add esp, 0xc
push 0x10
mov edx, dword [ebp + 0x20]
push edx
lea eax, [ebp - 0x98]
push eax
call fcn.00404371
add esp, 0xc
lea ecx, [ebp - 0x98]
push ecx
mov edx, dword [ebp + 0x20]
push edx
call fcn.00404470
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x404331
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x4054ad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov cl, byte [eax]
mov byte [ebp - 0xc], cl
mov edx, dword [ebp + 8]
mov al, byte [edx + 1]
mov byte [ebp - 0x10], al
mov ecx, dword [ebp + 8]
add ecx, 2
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0
jmp 0x4054df
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0x14]
jge 0x405575
mov cl, byte [ebp - 0xc]
add cl, 1
mov byte [ebp - 0xc], cl
mov edx, dword [ebp - 0xc]
and edx, 0xff
mov eax, dword [ebp - 0x18]
mov cl, byte [eax + edx]
mov byte [ebp - 4], cl
mov dl, byte [ebp - 0x10]
add dl, byte [ebp - 4]
mov byte [ebp - 0x10], dl
mov eax, dword [ebp - 0x10]
and eax, 0xff
mov ecx, dword [ebp - 0x18]
mov dl, byte [ecx + eax]
mov byte [ebp - 8], dl
mov eax, dword [ebp - 0xc]
and eax, 0xff
mov ecx, dword [ebp - 0x18]
mov dl, byte [ebp - 8]
mov byte [ecx + eax], dl
mov eax, dword [ebp - 0x10]
and eax, 0xff
mov ecx, dword [ebp - 0x18]
mov dl, byte [ebp - 4]
mov byte [ecx + eax], dl
mov eax, dword [ebp - 4]
and eax, 0xff
mov ecx, dword [ebp - 8]
and ecx, 0xff
add eax, ecx
and eax, 0xff
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dl, byte [edx]
xor dl, byte [ecx + eax]
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x14]
mov byte [eax], dl
jmp 0x4054d6
mov ecx, dword [ebp + 8]
mov dl, byte [ebp - 0xc]
mov byte [ecx], dl
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 0x10]
mov byte [eax + 1], cl
mov esp, ebp
pop ebp
ret

Function at 0x4057ce
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
cmp dword [0x433598], 0
jne 0x4057fa
push 0x430124
push str._dev_urandom
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 8
mov dword [0x433598], eax
cmp dword [0x433598], 0
je 0x40581f
mov eax, dword [0x433598]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp eax, dword [ebp + 0xc]
sete cl
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x406018
Capabilities:
Encrypt data using rsa via embedded library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
and edx, 0xffff
mov eax, dword [ebp - 8]
sub eax, edx
sub eax, 3
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 0
cmp dword [ebp + 0x18], 0
je 0x406068
mov edx, dword [ebp + 0x14]
mov byte [edx + 1], 1
mov eax, dword [ebp - 0x10]
push eax
push 0xff
mov ecx, dword [ebp + 0x14]
add ecx, 2
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
jmp 0x40608e
mov edx, dword [ebp + 0x14]
mov byte [edx + 1], 2
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x14]
add ecx, 2
push ecx
call fcn.004061ec
add esp, 8
test eax, eax
jge 0x40608e
or eax, 0xffffffff
jmp 0x406133
mov edx, dword [ebp + 0x14]
add edx, dword [ebp - 0x10]
mov byte [edx + 2], 0
mov eax, dword [ebp + 0x10]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x14]
lea ecx, [eax + edx + 3]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x24]
push edx
call fcn.0040217e
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x18], 0
je 0x4060ed
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00406256
add esp, 8
mov dword [ebp - 0x14], eax
jmp 0x406100
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00406a60
add esp, 8
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
push eax
call fcn.00406137
add esp, 0x10
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x24]
push edx
call fcn.0040317d
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x406bf8
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
push 0x40
push 0
lea eax, [ebp - 0xec]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x40
push 0
lea ecx, [ebp - 0x40]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0xec]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x40]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov dword [ebp - 0xac], 0
jmp 0x406c6a
mov edx, dword [ebp - 0xac]
add edx, 1
mov dword [ebp - 0xac], edx
cmp dword [ebp - 0xac], 0x40
jge 0x406ca9
mov eax, dword [ebp - 0xac]
mov cl, byte [ebp + eax - 0xec]
xor cl, 0x36
mov edx, dword [ebp - 0xac]
mov byte [ebp + edx - 0xec], cl
mov eax, dword [ebp - 0xac]
mov cl, byte [ebp + eax - 0x40]
xor cl, 0x5c
mov edx, dword [ebp - 0xac]
mov byte [ebp + edx - 0x40], cl
jmp 0x406c5b
lea eax, [ebp - 0xa8]
push eax
call fcn.00403e1a
add esp, 4
push 0x40
lea ecx, [ebp - 0xec]
push ecx
lea edx, [ebp - 0xa8]
push edx
call fcn.00405830
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xa8]
push edx
call fcn.00405830
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00406d4a
add esp, 8
lea edx, [ebp - 0xa8]
push edx
call fcn.00403e1a
add esp, 4
push 0x40
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0xa8]
push ecx
call fcn.00405830
add esp, 0xc
push 0x20
mov edx, dword [ebp + 0x18]
push edx
lea eax, [ebp - 0xa8]
push eax
call fcn.00405830
add esp, 0xc
lea ecx, [ebp - 0xa8]
push ecx
mov edx, dword [ebp + 0x18]
push edx
call fcn.00406d4a
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x409072
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x67452301
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], 0x10325476
mov edx, dword [ebp + 8]
mov dword [edx + 0x18], 0xc3d2e1f0
pop ebp
ret
Function at 0x40c2f4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll__beginthread]
add esp, 0xc
pop ebp
ret

Function at 0x40c49a
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x58]
and ecx, 0x100
test ecx, ecx
je 0x40c4e0
push 0x10
mov edx, dword [ebp + 8]
add edx, 0x14
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [ebp - 4], 0
setl al
dec eax
and eax, dword [ebp - 4]
jmp 0x40c4f7
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
add eax, 0x34
push eax
call fcn.0040c188
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x40c77b
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40c794
jmp 0x40c7b2
push 4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, 1
jmp 0x40c7b4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40ceed
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax]
sub ecx, 2
neg ecx
sbb ecx, ecx
and ecx, 0
add ecx, 0x10
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0xffffffff
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax]
push ecx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x40cf7f
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x40cf7f
cmp dword [ebp + 0xc], 2
je 0x40cf5f
push closesocket
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
jne 0x40cf7f
mov eax, dword [ebp - 8]
push eax
call fcn.0040cf9d
add esp, 4
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
jmp 0x40cf96
cmp dword [ebp - 8], 0xffffffff
je 0x40cf96
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40d089
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0x10
cmp dword [ebp + 0xc], 0
je 0x40d184
cmp dword [ebp + 0x10], 0
jbe 0x40d184
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0x14]
and edx, 4
test edx, edx
je 0x40d0de
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_getpeername]
jmp 0x40d0f0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_getsockname]
mov eax, dword [ebp + 0x14]
and eax, 1
test eax, eax
je 0x40d116
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov ecx, dword [ebp + 0x14]
and ecx, 2
test ecx, ecx
je 0x40d184
mov edx, dword [ebp + 0x14]
and edx, 1
test edx, edx
je 0x40d133
mov dword [ebp - 0x18], 0x430b64
jmp 0x40d13a
mov dword [ebp - 0x18], 0x4335a0
mov ax, word [ebp - 0xe]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push str._s_d
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
add eax, 1
mov ecx, dword [ebp + 0x10]
sub ecx, eax
push ecx
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov ecx, dword [ebp + 0xc]
add ecx, eax
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x40dc0f
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
add eax, 0x34
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x40], 0
je 0x40dc99
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
push ecx
call fcn.00403b45
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x40dc88
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040dbc4
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
je 0x40dc72
cmp dword [ebp - 0xc], 3
jne 0x40dc77
jmp 0x40dd01
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x58]
or edx, 0x10
mov eax, dword [ebp + 8]
mov dword [eax + 0x58], edx
jmp 0x40dc97
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x58]
and edx, 0xffffff9f
mov eax, dword [ebp + 8]
mov dword [eax + 0x58], edx
jmp 0x40dcb8
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
push ecx
push 4
mov edx, dword [ebp + 8]
push edx
call fcn.0040c990
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call fcn.0040db51
add esp, 4
test eax, eax
je 0x40dceb
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x58]
or edx, 0x10
mov eax, dword [ebp + 8]
mov dword [eax + 0x58], edx
jmp 0x40dd01
cmp dword [ebp - 8], 0
jle 0x40dd01
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0040c2ad
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x40dd05
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov dword [ebp - 0x830], 0x10
push 0x5c
push 0
lea eax, [ebp - 0x5c]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x830]
push ecx
lea edx, [ebp - 0x48]
push edx
push 0
push 0x7d0
lea eax, [ebp - 0x82c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
jg 0x40dd5f
jmp 0x40ddcf
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x50], ecx
lea edx, [ebp - 0x82c]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x54]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x48]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x4c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x100
lea ecx, [ebp - 0x834]
push ecx
push 3
lea edx, [ebp - 0x5c]
push edx
call fcn.0040c990
add esp, 0xc
mov esp, ebp
pop ebp
ret