joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b4243
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
jne 0x5b4251
mov eax, 0xffffff53
pop ebx
ret
mov eax, dword [ebx + 0x60]
push ebp
push esi
push edi
push 0x40
pop edi
lea ebp, [ebx + 0x20]
mov byte [eax + ebp], 0x80
inc dword [ebx + 0x60]
mov ecx, dword [ebx + 0x60]
push 0x38
pop esi
cmp ecx, esi
jbe 0x5b429e
mov eax, edi
sub eax, ecx
push eax
lea eax, [ecx + ebp]
push 0
push eax
call fcn.005b7039
push edi
mov edx, ebp
mov dword [ebx + 0x60], edi
mov ecx, ebp
call fcn.005b3a8c
add esp, 0x10
mov edx, ebp
mov ecx, ebx
call fcn.005b3b2a
test eax, eax
jne 0x5b42fa
and dword [ebx + 0x60], eax
mov eax, dword [ebx + 0x60]
sub esi, eax
push esi
add eax, ebp
push 0
push eax
call fcn.005b7039
lea edi, [ebx + 0x64]
mov edx, ebp
mov ecx, dword [edi]
lea esi, [ebx + 0x68]
mov eax, dword [esi]
shr ecx, 0x1d
push 0x40
lea eax, [ecx + eax*8]
mov ecx, ebp
mov dword [esi], eax
mov eax, dword [edi]
shl eax, 3
mov dword [edi], eax
call fcn.005b3a8c
push 4
lea eax, [ebp + 0x38]
push esi
push eax
call fcn.005b6ab9
push 4
lea eax, [ebp + 0x3c]
push edi
push eax
call fcn.005b6ab9
add esp, 0x28
mov edx, ebp
mov ecx, ebx
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.005b3b2a
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x5b42ff
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x5b4336
test edi, edi
je 0x5b4336
call fcn.005b4243
test eax, eax
jne 0x5b433b
push 0x20
mov edx, esi
mov ecx, esi
call fcn.005b3a8c
push 0x20
push esi
push edi
call fcn.005b6ab9
add esp, 0x10
mov ecx, esi
pop edi
pop esi
jmp 0x5b3ab6
mov eax, 0xffffff53
pop edi
pop esi
ret

Function at 0x5b43ee
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov eax, edx
mov ebp, ecx
neg eax
mov dword [esp + 8], eax
test ebp, ebp
je 0x5b4488
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x5b4488
mov edx, dword [ebp]
mov ecx, ebx
inc edx
call fcn.005afad1
mov dword [esp + 0xc], eax
test eax, eax
jne 0x5b448d
xor edx, edx
push esi
push edi
cmp dword [ebp], edx
jle 0x5b444e
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.005b43d8
mov ecx, ebx
mov esi, eax
call fcn.005b43d8
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebp]
jl 0x5b4428
jmp 0x5b4473
mov ecx, dword [esp + 0x10]
jmp 0x5b4473
mov edi, dword [ebx + 0xc]
mov ecx, ebp
call fcn.005b43d8
mov ecx, ebx
mov esi, eax
call fcn.005b43d8
mov ecx, dword [esp + 0x10]
xor esi, eax
and esi, ecx
xor dword [edi + edx*4], esi
inc edx
cmp edx, dword [ebx]
jl 0x5b4454
mov eax, dword [ebp]
xor eax, dword [ebx]
and eax, ecx
xor dword [ebx], eax
mov eax, dword [esp + 0x14]
pop edi
pop esi
jmp 0x5b448d
mov eax, 0xffffff53
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x5cc23f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005cc0be
Function at 0x6b0a69c1
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x24]
test ebx, ebx
mov esi, dword [esp + 0x20]
jle 0x6b0a68e0
push 0x37c
push str.._ssld1_both.c
mov eax, dword [sym.imp.msvcrt.dll__iob]
push str.invalid_state_reached__s:_d
add eax, 0x40
push eax
call sym._fprintf
mov edx, 1
add esp, 0x10
add esp, 0x10
pop ebx
pop esi
mov eax, edx
pop edi
ret
sub esp, 0xc
push esi
call sym.libssl32.dll_SSL_get_rbio
push 0
push 0
push 0x25
push eax
call sym._BIO_ctrl
add esp, 0x20
test eax, eax
mov edx, ebx
je 0x6b0a68d7
sub esp, 0xc
push esi
call sym.libssl32.dll_SSL_state
add esp, 0x10
test ah, 0x30
je 0x6b0a69dc
mov edx, dword [esi + 0x5c]
mov ecx, dword [edx + 0xdc]
inc ecx
cmp ecx, 0xc
mov dword [edx + 0xdc], ecx
ja 0x6b0a6a0d
mov eax, dword [edx + 0xd4]
inc eax
cmp eax, 2
jbe 0x6b0a6a02
mov dword [edx + 0xd4], 1
mov ebx, dword [edx + 0x9c]
mov dword [esp + 8], 0
sub esp, 0xc
push ebx
call sym._pqueue_iterator
pop edx
lea edi, [esp + 0x18]
mov dword [esp + 0x18], eax
push edi
call sym._pqueue_next
add esp, 0x10
test eax, eax
je 0x6b0a69f6
lea ebx, [esp + 8]
jmp 0x6b0a6990
sub esp, 0xc
push edi
call sym._pqueue_next
add esp, 0x10
test eax, eax
je 0x6b0a69f6
mov ecx, dword [eax + 8]
push ebx
push 0
mov ax, word [ecx + 8]
and eax, 0xffff
push eax
push esi
call sym._dtls1_retransmit_message
add esp, 0x10
test eax, eax
jg 0x6b0a6980
mov edx, dword [esp + 8]
test edx, edx
je 0x6b0a6980
mov edx, dword [sym.imp.msvcrt.dll__iob]
add edx, 0x40
push edx
push 0x22
push 1
push str.dtls1_retransmit_message___failed_n
call sym._fwrite
mov eax, 0xffffffff
add esp, 0x10
mov edx, eax
jmp 0x6b0a68d7
sub esp, 8
push 1
push esi
call sym.libssl32.dll_SSL_get_rbio
mov dword [esp], eax
call sym._BIO_set_flags
mov edx, ebx
jmp 0x6b0a68d4
mov eax, 1
mov edx, eax
jmp 0x6b0a68d7
mov dword [edx + 0xd4], eax
jmp 0x6b0a6946
sub esp, 0xc
push 0x393
push str.._ssld1_both.c
push 0x138
push 0x103
push 0x14
call sym._ERR_put_error
xor edx, edx
add esp, 0x20
jmp 0x6b0a68d7

Function at 0x6b0aa5e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp - 0x37c], 0
je 0x6b0aa5eb
jmp sym._lh_insert
jmp fcn.6b0a9ee3

Function at 0x6b0aa700
Capabilities:
Access peb ldr_data

Disassembly:
fldln2
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
invalid

Function at 0x6b0ab870
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x401000
Capabilities:
Create thread

Disassembly:
sub esp, 8
push ebx
xor ebx, ebx
cmp dword [esp + 0x10], ebx
jne 0x401016
mov eax, 0x80070057
pop ebx
add esp, 8
ret
push esi
push edi
push 0x444a3c
push 0x2c
call fcn.004034b3
add esp, 8
cmp eax, ebx
mov edi, 1
je 0x40104e
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0x24], edi
mov dword [eax + 0x28], edi
mov esi, eax
jmp 0x401050
xor esi, esi
cmp esi, ebx
mov eax, esi
mov dword [esp + 0x10], eax
jne 0x40106e
mov ecx, dword [esp + 0x18]
mov edi, 0x8007000e
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call ebp
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
mov dword [esi + 8], eax
je 0x401161
push esi
push eax
push edi
call fcn.004016a8
mov edi, eax
cmp edi, ebx
jl 0x401186
mov ecx, dword [esi]
lea eax, [esp + 0x10]
push eax
push 0xc
push ecx
call fcn.0040180a
mov edi, eax
cmp edi, ebx
jl 0x401186
mov eax, dword [esp + 0x10]
add eax, 4
cmp eax, 0x400
mov dword [esi + 0x10], eax
jbe 0x4010d6
mov edi, 0x80070008
mov dword [esi + 0x10], ebx
jmp 0x401186
push 0x444a3c
push eax
call fcn.004034e2
add esp, 8
cmp eax, ebx
mov dword [esi + 0xc], eax
jne 0x4010f8
mov dword [esi + 0x10], ebx
mov edi, 0x8007000e
jmp 0x401186
mov eax, dword [esi]
lea edx, [esp + 0x10]
push edx
push 0xc
push eax
call fcn.0040180a
mov edi, eax
cmp edi, ebx
jl 0x401186
mov eax, dword [esp + 0x10]
add eax, 4
cmp eax, 0x400
mov dword [esi + 0x1c], eax
jbe 0x401128
mov edi, 0x80070008
mov dword [esi + 0x1c], ebx
jmp 0x401186
push 0x444a3c
push eax
call fcn.004034e2
add esp, 8
cmp eax, ebx
mov dword [esi + 0x18], eax
jne 0x401147
mov dword [esi + 0x1c], ebx
mov edi, 0x8007000e
jmp 0x401186
push ebx
call ebp
push ebx
push ebx
push esi
push 0x401540
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x401182
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, ebx
jne 0x401174
mov edi, 0x507
jmp 0x401176
jle 0x401182
and edi, 0xffff
or edi, 0x80070000
cmp edi, ebx
jge 0x4011e6
mov eax, dword [esi]
cmp eax, ebx
je 0x401194
push eax
call fcn.004016dc
mov dword [esi], ebx
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x4011a5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x4011b8
push eax
call fcn.004034ae
add esp, 4
mov dword [esi + 0xc], ebx
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x4011cb
push eax
call fcn.004034ae
add esp, 4
mov dword [esi + 0x18], ebx
push esi
call fcn.004034a9
mov ecx, dword [esp + 0x20]
add esp, 4
xor eax, eax
pop ebp
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
pop ebp
mov dword [ecx], eax
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x401550
Capabilities:
Create process on windows
Get common file path
Print debug messages

Disassembly:
mov eax, 0x1024c
call fcn.0040ccd0
mov eax, dword [0x441438]
xor eax, esp
mov dword [esp + 0x10248], eax
push esi
mov esi, dword [esp + 0x1025c]
push 0x8000
lea eax, [esp + 0x250]
push 0
push eax
call fcn.004039d0
add esp, 0xc
test esi, esi
je 0x4015bc
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401590
sub eax, edx
sar eax, 1
cmp eax, 0x400
ja 0x4015bc
push esi
lea ecx, [esp + 0x250]
push 0x8000
push ecx
call fcn.004034e7
add esp, 0xc
push 0x43f7ac
lea edx, [esp + 0x250]
push 0x8000
push edx
call fcn.00403553
add esp, 0xc
lea eax, [esp + 0x44]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 4]
push ecx
call fcn.00401000
xor edx, edx
test eax, eax
setl dl
push 0x3c
lea eax, [esp + 0x10]
push 0
push eax
sub edx, 1
and edx, dword [esp + 0x14]
mov esi, edx
call fcn.004039d0
add esp, 0x10
lea eax, [esp + 8]
lea ecx, [esp + 0x24c]
lea edx, [esp + 0x44]
push eax
mov dword [esp + 0xc], 0x3c
mov dword [esp + 0x18], str.open
mov dword [esp + 0x1c], str.Fouc.exe
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 5
mov dword [esp + 0x10], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x401675
mov ecx, dword [esp + 0x40]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401680
push str.Failed_to_launch_Fouc.exe
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test esi, esi
je 0x40168e
cmp esi, 0xffffffff
je 0x40168e
call fcn.00401200
mov ecx, dword [esp + 0x1024c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.0040349a
add esp, 0x1024c
ret 0x10

Function at 0x40198c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x20], 3
je 0x4019a0
mov eax, 0x8000ffff
jmp 0x401a1b
cmp dword [esi + 0x2c], 2
jne 0x4019bc
push 0
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4019bc
mov eax, 0x80004004
jmp 0x401a1b
and dword [esi + 0x18], 0
and dword [esi + 0x14], 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401a0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4019f8
mov eax, 0x507
jmp 0x401a03
cmp eax, 0x3e5
je 0x401a0f
test eax, eax
jle 0x401a1b
and eax, 0xffff
or eax, 0x80070000
jmp 0x401a1b
mov dword [esi + 0x20], 1
mov eax, 0x8000000a
pop esi
leave
ret 8
Function at 0x401a20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x20], 3
je 0x401a34
mov eax, 0x8000ffff
jmp 0x401aaf
cmp dword [esi + 0x2c], 2
jne 0x401a50
push 0
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x401a50
mov eax, 0x80004004
jmp 0x401aaf
and dword [esi + 0x18], 0
and dword [esi + 0x14], 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401aa3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401a8c
mov eax, 0x507
jmp 0x401a97
cmp eax, 0x3e5
je 0x401aa3
test eax, eax
jle 0x401aaf
and eax, 0xffff
or eax, 0x80070000
jmp 0x401aaf
mov dword [esi + 0x20], 2
mov eax, 0x8000000a
pop esi
leave
ret 8
Function at 0x401cec
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x1e4]
sub esp, 0x264
mov eax, dword [0x441438]
xor eax, ebp
mov dword [ebp + 0x1e0], eax
mov eax, dword [ebp + 0x1ec]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
push ebx
mov dword [ebp - 0x58], eax
call esi
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
mov dword [ebp - 0x50], eax
jne 0x401d48
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x401d41
mov esi, 0x507
jmp 0x401e47
mov esi, eax
jmp 0x401e47
push edi
mov dword [ebp - 0x4c], 0x22c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebx
mov edi, eax
call esi
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x50]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x401d86
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x401d7f
mov esi, 0x507
jmp 0x401e3d
mov esi, eax
jmp 0x401e3d
cmp dword [ebp - 0x44], edi
push ebx
je 0x401d9c
call esi
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x50]
call sub.KERNEL32.dll_Process32NextW
jmp 0x401d67
call esi
push dword [ebp - 0x34]
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp - 0x54], eax
jne 0x401dc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x401dc5
mov esi, 0x507
jmp 0x401e2f
mov esi, eax
jmp 0x401e2f
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessTimes]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x54]
call edi
test eax, eax
je 0x401db4
push ebx
call esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x401db4
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 0xffffffff
je 0x401e27
mov esi, 0xe9
jmp 0x401e2f
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
cmp dword [ebp - 0x54], ebx
je 0x401e3d
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp + 0x1e0]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040349a
add ebp, 0x1e4
leave
ret 4
Function at 0x40349a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x441438]
jne 0x4034a4
repz ret
jmp fcn.00403baa

Function at 0x40465d
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4415f8]
je 0x404678
inc edi
cmp edi, 0x17
jb 0x404669
cmp edi, 0x17
jae 0x4047f8
push ebp
push 3
call fcn.00408e60
cmp eax, 1
pop ecx
je 0x4047c4
push 3
call fcn.00408e60
test eax, eax
pop ecx
jne 0x4046ac
cmp dword [0x441434], 1
je 0x4047c4
cmp ebx, 0xfc
je 0x4047f7
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x444dd0
push ebp
call fcn.00408dfb
add esp, 0xc
test eax, eax
je 0x4046e2
push esi
push esi
push esi
push esi
push esi
call fcn.00404157
add esp, 0x14
push 0x104
mov esi, 0x444de9
push esi
push 0
mov byte [0x444eed], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404726
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00408dfb
add esp, 0xc
test eax, eax
je 0x404726
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00404157
add esp, 0x14
push esi
call fcn.00408d70
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40476b
push esi
call fcn.00408d70
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4450e4
push 0x43e404
sub ecx, eax
push ecx
push eax
call fcn.00408cbc
add esp, 0x14
test eax, eax
je 0x40476b
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00404157
add esp, 0x14
jmp 0x40476d
xor esi, esi
push 0x43e400
push ebx
push ebp
call fcn.00408c4b
add esp, 0xc
test eax, eax
je 0x40478d
push esi
push esi
push esi
push esi
push esi
call fcn.00404157
add esp, 0x14
push dword [edi*8 + 0x4415fc]
push ebx
push ebp
call fcn.00408c4b
add esp, 0xc
test eax, eax
je 0x4047af
push esi
push esi
push esi
push esi
push esi
call fcn.00404157
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00408a8e
add esp, 0xc
jmp 0x4047f7
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4047f7
cmp ebp, 0xffffffff
je 0x4047f7
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4415fc]
push dword [esi]
call fcn.00408d70
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x408a8e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040520e
xor ebx, ebx
cmp dword [0x44549c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x408b64
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x408c44
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x408c44
push eax
call fcn.004051a0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44549c], eax
call esi
push eax
call fcn.004051a0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4454a0], eax
call esi
push eax
call fcn.004051a0
mov dword [0x4454a4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004043ea
test eax, eax
pop ecx
pop ecx
je 0x408b32
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00404157
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x408b64
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004051a0
cmp eax, ebx
pop ecx
mov dword [0x4454ac], eax
je 0x408b64
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004051a0
pop ecx
mov dword [0x4454a8], eax
mov eax, dword [0x4454a8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x408be9
cmp dword [0x4454ac], ecx
je 0x408be9
push eax
call fcn.00405217
push dword [0x4454ac]
mov esi, eax
call fcn.00405217
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x408be9
cmp edi, ebx
je 0x408be9
call esi
cmp eax, ebx
je 0x408bb6
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408bb6
test byte [ebp - 0x18], 1
jne 0x408be9
lea eax, [ebp - 0x10]
push eax
call fcn.00404421
test eax, eax
pop ecx
je 0x408bd1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00404157
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x408be0
or dword [ebp + 0x10], 0x200000
jmp 0x408c24
or dword [ebp + 0x10], 0x40000
jmp 0x408c24
mov eax, dword [0x4454a0]
cmp eax, dword [ebp - 8]
je 0x408c24
push eax
call fcn.00405217
cmp eax, ebx
pop ecx
je 0x408c24
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x408c24
mov eax, dword [0x4454a4]
cmp eax, dword [ebp - 8]
je 0x408c24
push eax
call fcn.00405217
cmp eax, ebx
pop ecx
je 0x408c24
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44549c]
call fcn.00405217
cmp eax, ebx
pop ecx
je 0x408c44
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c46
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x40104a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
push eax
add ecx, 0x40
push str.WSAStartup_failed_with_error__d_n
push ecx
call dword [sym.imp.MSVCRT.dll_fprintf]
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
add esp, 0x190
ret
xor eax, eax
add esp, 0x190
ret

Function at 0x4010d0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x318
mov eax, 1
push ebx
mov dword [esp + 0x114], eax
mov dword [esp + 0x218], eax
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x324]
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x224]
push ecx
lea eax, [esp + 0x124]
push edx
xor ebx, ebx
push eax
push 3
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x134], esi
mov dword [esp + 0x238], esi
mov dword [esp + 0x30], esi
call dword [sym.imp.WS2_32.dll_select]
lea ecx, [esp + 0x18]
mov edi, eax
push ecx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x401155
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x318
ret
xor eax, eax
cmp edi, ebx
setg al
cmp eax, ebx
je 0x4011bc
lea edx, [esp + 0x11c]
push edx
push esi
call sub.WS2_32.dll___WSAFDIsSet
cmp eax, ebx
je 0x4011bc
mov al, byte [0x4164b8]
push 2
lea ecx, [esp + 0x13]
push 1
push ecx
push esi
mov byte [esp + 0x1f], al
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, ebx
jg 0x4011bc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2744
je 0x4011b7
cmp eax, 0x2745
je 0x4011b7
cmp eax, 0x2746
je 0x4011b7
cmp eax, 0x2726
je 0x4011b7
cmp esi, ebx
jne 0x4011bc
mov ebx, 1
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x318
ret

Function at 0x4011d0
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push esi
cmp eax, 0x3e8
push edi
jg 0x4011e5
pop edi
mov eax, 1
pop esi
ret
mov esi, dword [esp + 0xc]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [esp + 0x10]
push 4
push eax
push 0x1006
push 0xffff
push esi
call edi
cmp eax, 0xffffffff
jne 0x40120d
pop edi
xor eax, eax
pop esi
ret
lea ecx, [esp + 0x10]
push 4
push ecx
push 0x1005
push 0xffff
push esi
call edi
cmp eax, 0xffffffff
jne 0x40122b
pop edi
xor eax, eax
pop esi
ret
lea edx, [esp + 0xc]
push 4
push edx
push 8
push 0xffff
push esi
mov dword [esp + 0x20], 1
call edi
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
pop edi
mov eax, ecx
pop esi
ret