joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421180
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x4d90c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push dword [0x4dcb80]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 1
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], 0
push eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
mov eax, dword [0x4dcfe8]
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push 0x65
push eax
mov dword [ebp - 0x84], 0x30
mov dword [ebp - 0x80], 3
mov dword [ebp - 0x7c], 0x421000
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], eax
call esi
push 0x7f00
push 0
mov dword [ebp - 0x6c], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push dword [ebp - 0x70]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], str.KOACS_GAME_BEGIN
call esi
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
test ax, ax
jne 0x421269
push 0x4daf20
push str.Call_to_RegisterClassEx_failed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x421391
push dword [ebp - 0x70]
push 0
push 0
push 0xdb
push 0x1c0
push 0
push 0
push connect
push 0x4daf20
push str.KOACS_GAME_BEGIN
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebx, eax
mov dword [0x4dcb84], ebx
test ebx, ebx
jne 0x4212b8
push eax
push 0x4daf20
push str.Call_to_CreateWindow_failed_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x421391
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x54]
push ecx
push eax
call esi
lea eax, [ebp - 0x44]
push eax
push ebx
call esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
sub eax, dword [ebp - 0x3c]
cdq
sub eax, edx
mov edi, eax
push 1
sar edi, 1
call esi
sub eax, dword [ebp - 0x38]
push 4
push 0xdb
cdq
push 0x1c0
sub eax, edx
sar eax, 1
push eax
push edi
push 0
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push 0
lea eax, [ebp - 0x34]
movq qword [ebp - 0x24], xmm0
push eax
movups xmmword [ebp - 0x34], xmm0
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x421375
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
nop dword [eax]
cmp eax, 0xffffffff
je 0x421375
lea eax, [ebp - 0x34]
push eax
call esi
lea eax, [ebp - 0x34]
push eax
call edi
push 0
push 0
push 0
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x421350
push ebx
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [ebp - 0x70]
push dword [ebp - 0x5c]
call dword [sym.imp.USER32.dll_UnregisterClassA]
push dword [ebp - 8]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00472221
mov esp, ebp
pop ebp
ret
Function at 0x4213b0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp dword [0x4dd33c], 2
jne 0x421505
mov eax, dword [0x4dcb88]
cmp byte [eax + 0x14c], 0
je 0x421505
push ebx
mov byte [ebp - 0x1c], 0x29
mov al, 0x66
xor al, byte [ebp - 0x1c]
mov cl, 0x59
xor cl, byte [ebp - 0x1c]
mov bh, 0x4c
mov byte [ebp - 0x1b], al
mov ah, 0x46
mov byte [ebp - 0x1a], cl
mov dl, 0x5d
mov cl, byte [ebp - 0x1c]
mov ch, 0x47
mov byte [ebp - 1], 0x51
xor ah, cl
mov al, byte [ebp - 1]
mov dh, 7
xor al, cl
mov byte [ebp - 2], bh
mov byte [ebp - 0x13], al
mov bl, 0x40
mov al, byte [ebp - 2]
xor dl, cl
push 9
push 0
xor al, cl
mov byte [ebp - 0x17], ah
push 0
mov byte [ebp - 0x12], al
xor bl, cl
lea eax, [ebp - 0x1b]
mov byte [ebp - 0x11], 0
push eax
push 0
xor ch, cl
mov dword [0x4dcfc4], 1
xor dh, cl
mov dword [0x4dd33c], 1
xor bh, cl
mov byte [ebp - 0x19], dl
push 0
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x16], ch
mov byte [ebp - 0x15], dh
mov byte [ebp - 0x14], bh
mov byte [ebp - 0x11], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 2
jne 0x4214fc
movaps xmm0, xmmword [0x4d31c0]
mov al, 0x2c
mov byte [ebp - 0x10], 0x60
mov cl, 1
xor al, byte [ebp - 0x10]
mov ch, 8
mov byte [ebp - 0xf], al
mov dl, 0x15
mov al, byte [ebp - 0x10]
mov bl, 0xe
mov ah, 3
mov byte [ebp - 7], 0
mov dh, 5
mov byte [ebp - 7], 0
mov bh, 0x12
mov dword [ebp - 0x24], 0x6b706a63
xor cl, al
mov word [ebp - 0x20], 0x2b61
xor ch, al
mov byte [ebp - 0xe], cl
xor dl, al
mov byte [ebp - 0xa], ch
xor bl, al
mov byte [ebp - 0xd], dl
xor ah, al
mov byte [ebp - 0xc], bl
xor dh, al
mov byte [ebp - 0xb], ah
xor bh, al
mov byte [ebp - 9], dh
mov byte [ebp - 8], bh
xor ecx, ecx
movups xmmword [ebp - 0x34], xmm0
mov byte [ebp - 0x1e], 0
nop dword [eax]
mov al, byte [ebp - 0x34]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0x15
jb 0x4214d0
push 0x40
lea eax, [ebp - 0xf]
mov byte [ebp - 0x1e], 0
push eax
lea eax, [ebp - 0x33]
push eax
push dword [0x4dcb80]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422aa0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x168
mov eax, dword [0x4d90c0]
xor eax, esp
mov dword [esp + 0x164], eax
push esi
push edi
push 0
push 2
mov dword [esp + 0x48], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [esp + 0x40]
push eax
push esi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x422bf8
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x422bf8
nop
xorps xmm0, xmm0
mov dword [esp + 0x30], 0
lea ecx, [esp + 0x64]
movaps xmmword [esp + 0x20], xmm0
mov dword [esp + 0x34], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x422b20
sub ecx, edx
lea eax, [esp + 0x64]
push ecx
push eax
lea ecx, [esp + 0x28]
call fcn.004080c0
mov dl, 0x59
mov dword [esp + 0xc], 0x18361259
mov dword [esp + 0x10], 0x381e2a3a
xor eax, eax
mov dword [esp + 0x14], 0x3c773c34
mov word [esp + 0x18], 0x3c21
mov byte [esp + 0x1a], 0
lea ecx, [esp + 0xd]
xor byte [ecx + eax], dl
inc eax
cmp eax, 0xd
jae 0x422b73
mov dl, byte [esp + 0xc]
jmp 0x422b60
lea edx, [esp + 0xd]
mov byte [esp + 0x1a], 0
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x422b80
mov edi, dword [esp + 0x34]
lea eax, [esp + 0xd]
mov esi, dword [esp + 0x20]
sub edx, ecx
push edx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x24]
cmp edi, 0xf
push eax
cmova ecx, esi
push 0
call fcn.00407d20
add esp, 0xc
cmp eax, 0xffffffff
jne 0x422c0e
cmp edi, 0xf
jbe 0x422be0
lea ecx, [edi + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x422bd6
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x422c4e
push ecx
push esi
call fcn.00472269
add esp, 8
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x422b00
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.00472221
mov esp, ebp
pop ebp
ret
cmp edi, 0xf
jbe 0x422c38
inc edi
mov eax, esi
cmp edi, 0x1000
jb 0x422c2e
mov esi, dword [eax - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x422c4e
push edi
push esi
call fcn.00472269
add esp, 8
mov ecx, dword [esp + 0x16c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.00472221
mov esp, ebp
pop ebp
ret
call fcn.00479f90
int3
Function at 0x4268b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4d90c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
push edi
test ecx, ecx
je 0x426a3b
mov edx, dword [ecx + 0x48]
test edx, edx
je 0x426a3b
cmp esi, dword [ecx + 0x10]
jae 0x426a3b
cmp dword [ecx + 0x14], 1
jne 0x426a3b
mov eax, dword [edx + 0x10]
mov edi, dword [eax + esi*4]
add edi, dword [edx]
je 0x426a3b
test ebx, ebx
je 0x426a3b
mov dword [ebx], esi
xorps xmm0, xmm0
mov eax, dword [ecx + 0x48]
movlpd qword [ebp - 0x10], xmm0
mov dword [ebp - 8], 0xffffffff
mov eax, dword [eax + 0x10]
mov eax, dword [eax + esi*4]
mov dword [ebx + 4], eax
movzx eax, word [edi + 4]
mov word [ebx + 8], ax
movzx eax, word [edi + 6]
mov word [ebx + 0xa], ax
movzx eax, word [edi + 8]
mov word [ebx + 0xc], ax
movzx eax, word [edi + 0xa]
mov word [ebx + 0xe], ax
movzx ecx, word [edi + 0xe]
movzx edx, word [edi + 0xc]
mov eax, ecx
shr eax, 9
add eax, 0x50
mov dword [ebp - 0x14], eax
mov eax, ecx
shr eax, 5
and ecx, 0x1f
and eax, 0xf
mov dword [ebp - 0x1c], ecx
dec eax
mov dword [ebp - 0x18], eax
mov eax, edx
shr eax, 0xb
mov dword [ebp - 0x20], eax
mov eax, edx
shr eax, 5
and edx, 0x1f
and eax, 0x3f
add edx, edx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], edx
call fcn.0047e1ca
mov dword [ebx + 0x10], eax
mov esi, 0x103
mov dword [ebx + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], 0
mov eax, dword [edi + 0x18]
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], 0
movzx eax, word [edi + 0x24]
mov word [ebx + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [ebx + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], 0
movzx eax, word [edi + 0x1c]
cmp eax, esi
cmovb esi, eax
lea eax, [edi + 0x2e]
push esi
push eax
lea eax, [ebx + 0x44]
push eax
call fcn.00473f20
mov byte [ebx + esi + 0x44], 0
mov esi, 0xff
movzx eax, word [edi + 0x20]
cmp eax, esi
cmovb esi, eax
mov dword [ebx + 0x40], esi
movzx ecx, word [edi + 0x1e]
movzx eax, word [edi + 0x1c]
add ecx, edi
add eax, 0x2e
push esi
add eax, ecx
push eax
lea eax, [ebx + 0x148]
push eax
call fcn.00473f20
add esp, 0x1c
mov byte [ebx + esi + 0x148], 0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472221
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00472221
mov esp, ebp
pop ebp
ret
Function at 0x4273c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x800c
call fcn.00472c80
mov eax, dword [0x4d90c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ecx]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x800c], ecx
mov byte [ebp - 0x8005], al
push edi
cmp al, 0x41
jl 0x4273f2
cmp al, 0x5a
jle 0x4273f8
sub al, 0x61
cmp al, 0x19
ja 0x427408
cmp byte [ecx + 1], 0x3a
lea edi, [ecx + 1]
jne 0x42740b
mov ebx, 1
jmp 0x42740d
lea edi, [ecx + 1]
xor ebx, ebx
push 0x8000
lea eax, [ebp - 0x8004]
push 0
push eax
call fcn.00473b50
add esp, 0xc
test ebx, ebx
je 0x427441
mov al, byte [ebp - 0x8005]
mov esi, 2
mov byte [ebp - 0x8004], al
movzx eax, byte [edi]
mov byte [ebp - 0x8003], al
mov edi, dword [ebp - 0x800c]
add edi, esi
cmp byte [edi], 0
je 0x42749f
nop
cmp esi, 0x7fff
jge 0x42749f
mov al, byte [edi]
cmp al, 0x2f
je 0x427462
cmp al, 0x5c
jne 0x42748f
test ebx, ebx
jne 0x42746c
test esi, esi
jg 0x427471
jmp 0x42748f
cmp esi, 2
jle 0x42748f
lea eax, [ebp - 0x8004]
push eax
call fcn.0047c267
add esp, 4
cmp eax, 0xffffffff
jne 0x42748f
call fcn.0047be3e
cmp dword [eax], 0x11
jne 0x4274b2
mov al, byte [edi]
inc edi
mov byte [ebp + esi - 0x8004], al
inc esi
cmp byte [edi], 0
jne 0x427450
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472221
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00472221
mov esp, ebp
pop ebp
ret
Function at 0x430bb0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x18
mov eax, dword [0x4d90c0]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x430c7b
lea eax, [esp + 4]
push eax
push esi
push 2
call fcn.0044c1a0
add esp, 0xc
test eax, eax
jne 0x430c7b
lea eax, [esp + 8]
push eax
push esi
push 0x17
call fcn.0044c1a0
add esp, 0xc
test eax, eax
jne 0x430c7b
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x430c04
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.0044c170
add esp, 0xc
test eax, eax
je 0x430c38
sub eax, esi
push eax
push 0x2e
push esi
call fcn.0044c170
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x430c3a
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x430c66
mov al, byte [esi]
push eax
call fcn.0043f560
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x430c48
pop edi
movzx eax, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00472221
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00472221
add esp, 0x18
ret
Function at 0x43b840
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4d90c0]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x118]
mov edx, dword [esp + 0x114]
push ebx
mov ebx, dword [esp + 0x114]
mov dword [esp + 8], eax
xor eax, eax
push ebp
mov ebp, dword [esp + 0x128]
mov ecx, dword [ebx + 0x424]
cmp edx, ecx
push esi
sete al
mov esi, 0x440
push edi
lea eax, [eax*4 + 0x420]
mov eax, dword [eax + ebx]
mov dword [esp + 0x10], eax
mov eax, 0x450
cmove esi, eax
mov eax, dword [ebx + 0x540]
add esi, ebx
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x43b94e
xor eax, eax
cmp edx, ecx
sete al
lea eax, [eax*4 + 0x430]
cmp dword [eax + ebx], 0x43b400
jne 0x43b94e
cmp dword [esi], 0
je 0x43b8d8
test edi, edi
je 0x43b94e
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [esp + 0x20]
call fcn.0044a990
add esp, 0x14
cmp eax, 0xffffffff
je 0x43b94e
test al, 1
je 0x43b94e
mov ecx, dword [esi]
test ecx, ecx
jne 0x43b92b
mov eax, dword [ebx]
mov eax, dword [eax + 0x90c]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [section..data]
mov edi, dword [esi + 4]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test ecx, ecx
je 0x43b947
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x43b94e
add dword [esi + 8], eax
jmp 0x43b94e
mov dword [esi + 4], 0
push 0
push dword [esp + 0x130]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
jne 0x43b9b7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x43b988
mov dword [ebp], 0
lea eax, [edi + 0x52]
jmp 0x43b9bc
push 0x100
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.00428290
push eax
push str.Send_failure:__s
push dword [ebx]
call fcn.0043b150
mov eax, dword [ebx]
add esp, 0x18
mov dword [eax + 0xd44], esi
mov eax, 0x37
jmp 0x43b9b9
xor eax, eax
mov dword [ebp], edi
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00472221
add esp, 0x10c
ret

Function at 0x43bde0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax + 0x46c], 0
je 0x43bdfd
push eax
call fcn.00435200
add esp, 4
test eax, eax
jne 0x43be1c
xor al, al
ret
mov eax, dword [eax + 0x420]
cmp eax, 0xffffffff
je 0x43bdfa
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x43bdfa
mov al, 1
ret
Function at 0x43db20
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push 0x49f63c
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x43db3a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x49f658
push esi
call fcn.00484140
add esp, 8
test eax, eax
je 0x43db82
test ebp, ebp
je 0x43db73
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x43dba8
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43dba8
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x43dc5f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43dbc5
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x43dc55
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x43dc55
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43dbf7
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43dc10
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x43dc20
test ebp, ebp
je 0x43dc4c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x4d9004]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x4d9004]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x4430e0
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4430f4
mov eax, dword [eax]
mov eax, dword [eax + 0x78]
mov al, byte [eax + 0xe7]
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x443108
xor al, al
ret
push eax
push 0
call fcn.0043bd10
add esp, 8
mov al, 1
ret
Function at 0x448ec0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
sub esp, 0x34
mov eax, dword [0x4d90c0]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [esp + 0x48]
push esi
mov esi, dword [sym.imp.WS2_32.dll_socket]
push edi
push 6
push 1
push 2
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x18], 1
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x4490a6
xorps xmm0, xmm0
mov eax, 2
push 0x7f000001
movlpd qword [esp + 0x20], xmm0
mov word [esp + 0x18], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 0x18], eax
xor eax, eax
push 4
mov word [esp + 0x1a], ax
lea eax, [esp + 0x10]
push eax
push 4
push 0xffff
push edi
mov dword [ebx + 4], 0xffffffff
mov dword [ebx], 0xffffffff
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x449094
push 0x10
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x449094
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x449094
push 1
push edi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x449094
push 0
push 1
push 2
call esi
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x449094
push 0x10
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x449094
push 0
push 0
push edi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x449094
push ebx
push 0x4ce204
lea eax, [esp + 0x2c]
push 0xc
push eax
call fcn.0043e200
lea esi, [esp + 0x34]
add esp, 0x10
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x448ff2
push 0
sub esi, ecx
lea eax, [esp + 0x28]
push esi
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, esi
jne 0x449094
push 0
push 0xc
lea eax, [esp + 0x38]
push eax
push dword [ebx + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, esi
jne 0x449094
lea ecx, [esp + 0x24]
lea edx, [esp + 0x30]
sub esi, 4
jb 0x449047
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x44904c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x449036
cmp esi, 0xfffffffc
je 0x449079
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x449094
cmp esi, 0xfffffffd
je 0x449079
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x449094
cmp esi, 0xfffffffe
je 0x449079
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x449094
cmp esi, 0xffffffff
je 0x449079
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x449094
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00472221
add esp, 0x34
ret
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
push edi
call esi
push dword [ebx]
call esi
push dword [ebx + 4]
call esi
mov ecx, dword [esp + 0x3c]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00472221
add esp, 0x34
ret
Function at 0x44cee0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x1c]
push esi
xor esi, esi
mov dword [esp + 4], esi
mov dword [eax], esi
lea eax, [esp + 8]
push eax
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x44d092
push ebx
mov ebx, dword [esp + 0xc]
push edi
test ebx, ebx
je 0x44d07c
push ebp
mov eax, dword [ebx + 4]
cmp eax, 2
jne 0x44cf2f
lea ebp, [eax + 0xe]
jmp 0x44cf3b
cmp eax, 0x17
jne 0x44cfe9
lea ebp, [eax + 5]
cmp dword [ebx + 0x18], 0
je 0x44cfe9
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x44cfe9
cmp eax, ebp
jb 0x44cfe9
push 0x20
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
je 0x44d071
mov ecx, dword [ebx]
mov dword [edi], ecx
mov ecx, dword [ebx + 4]
mov dword [edi + 4], ecx
mov ecx, dword [ebx + 8]
mov dword [edi + 8], ecx
mov eax, dword [ebx + 0xc]
push ebp
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], ebp
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
call dword [section..data]
add esp, 4
mov dword [edi + 0x18], eax
test eax, eax
je 0x44d060
push ebp
push dword [ebx + 0x18]
push eax
call fcn.00473f20
mov eax, dword [ebx + 0x14]
add esp, 0xc
test eax, eax
je 0x44cfd5
push eax
call dword [0x4d900c]
add esp, 4
mov dword [edi + 0x14], eax
test eax, eax
je 0x44d046
mov eax, dword [esp + 0x10]
test esi, esi
cmove esi, edi
test eax, eax
je 0x44cfe5
mov dword [eax + 0x1c], edi
mov dword [esp + 0x10], edi
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
jne 0x44cf22
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
pop ebp
test eax, eax
je 0x44d008
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test ebx, ebx
je 0x44d078
test esi, esi
je 0x44d035
push dword [esi + 0x18]
call dword [0x4d9004]
push dword [esi + 0x14]
call dword [0x4d9004]
mov edi, dword [esi + 0x1c]
push esi
call dword [0x4d9004]
add esp, 0xc
mov esi, edi
test edi, edi
jne 0x44d010
mov eax, dword [esp + 0x28]
xor esi, esi
pop edi
mov dword [eax], esi
mov eax, ebx
pop ebx
pop esi
add esp, 0xc
ret
push dword [edi + 0x18]
mov ebx, 8
call dword [0x4d9004]
push edi
call dword [0x4d9004]
add esp, 8
jmp 0x44cff8
push edi
mov ebx, 8
call dword [0x4d9004]
add esp, 4
jmp 0x44cff8
mov ebx, 8
jmp 0x44cff8
test esi, esi
jne 0x44d088
mov ebx, 0x2af9
push ebx
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x28]
pop edi
mov dword [eax], esi
mov eax, ebx
pop ebx
pop esi
add esp, 0xc
ret