joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5beef0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, edx
push ebx
push esi
shl eax, 4
lea esi, [ecx + 0x178]
add esi, eax
mov eax, dword [ecx + 0x2a8]
push edi
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x44], 3
je 0x5befc6
cmp dword [ecx + edx*4 + 0x168], 0x5be970
jne 0x5befc6
cmp dword [esi], 0
je 0x5bef3d
test edi, edi
je 0x5befc6
mov ebx, dword [ecx + edx*4 + 0x150]
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
call fcn.005e2180
add esp, 0x14
cmp eax, 0xffffffff
je 0x5befc6
test al, 1
je 0x5befc6
mov ecx, dword [esi]
test ecx, ecx
jne 0x5befa1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x4e0]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x79ca20]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
test ecx, ecx
jne 0x5bef8c
pop edi
pop esi
lea eax, [ecx + 0x1b]
pop ebx
pop ebp
ret
mov edi, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test ecx, ecx
je 0x5befbf
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push ebx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x5befc6
add dword [esi + 8], eax
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov dword [esi + 4], 0
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x5bf9e0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.005dc980
push dword [ebp + 8]
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x10], xmm0
call fcn.005bd260
push dword [ebp + 0xc]
mov edi, eax
call fcn.005bd260
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x5bfa67
lea eax, [ebp - 0x20]
push eax
call fcn.005dc980
movups xmm0, xmmword [ebp - 0x10]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.005dca30
add esp, 0x20
test edx, edx
ja 0x5bfa8a
jb 0x5bfa55
cmp eax, 0x3e8
ja 0x5bfa8a
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push esi
push edi
call ebx
test eax, eax
je 0x5bfa20
test edi, edi
je 0x5bfa74
push edi
call fcn.00658ebd
add esp, 4
test esi, esi
je 0x5bfa81
push esi
call fcn.00658ebd
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x5bfa97
push edi
call fcn.00658ebd
add esp, 4
test esi, esi
je 0x5bfaa4
push esi
call fcn.00658ebd
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c6a90
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x79cac4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x84]
or esi, 0xffffffff
push ecx
mov ebx, dword [edi + 0xc]
mov eax, dword [ebx + 0x154]
push eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x5c6b04
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 0x80
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push dword [ebp - 0x8c]
push ebx
push edi
call fcn.005e3270
add esp, 0xc
cmp esi, 0xffffffff
jne 0x5c6b3d
push str.Error_accept__ing_server_connect
push edi
call fcn.005be730
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00611399
mov esp, ebp
pop ebp
ret
push str.Connection_accepted_from_server
push edi
call fcn.005be7f0
push 1
push esi
mov byte [ebx + 0x26d], 0
mov dword [ebx + 0x154], esi
call fcn.005efe90
add esp, 0x10
mov byte [ebx + 0x280], 1
cmp dword [edi + 0x1b8], 0
je 0x5c6bba
push 1
push edi
call fcn.005d78b0
mov eax, dword [edi + 0x1b8]
push 1
push esi
push dword [edi + 0x1bc]
call eax
push 0
push edi
mov esi, eax
call fcn.005d78b0
add esp, 0x1c
test esi, esi
je 0x5c6bba
push ebx
push edi
call fcn.005c7000
add esp, 8
mov eax, 0x2a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00611399
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00611399
mov esp, ebp
pop ebp
ret

Function at 0x5c9030
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x5c9062
push str.Couldnt_set_desired_mode
push esi
call fcn.005be730
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
pop ebp
ret
cmp ecx, 0xc8
je 0x5c9079
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push esi
call fcn.005be7f0
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x5c9092
push ebx
push esi
call fcn.005c8cd0
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x14
jne 0x5c90a7
push esi
call fcn.005c7ce0
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x15
jne 0x5c90bc
push esi
call fcn.005c8cb0
add esp, 4
mov edi, eax
pop edi
pop esi
pop ebx
pop ebp
ret
cmp eax, 0x16
jne 0x5c90cc
push esi
call fcn.005c8f10
add esp, 4
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5e4d90
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x79cac4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 4
cmp byte [esi + 0x727], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x5e4ded
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d
push esi
call fcn.005be7f0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00611399
mov esp, ebp
pop ebp
ret
push dword [esi + 0x6c0]
mov dword [ebp - 0x10], 1
call fcn.005bae50
push dword [esi + 0x6c4]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.005bae50
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x5e4e5d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d
push esi
call fcn.005be7f0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00611399
mov esp, ebp
pop ebp
ret
Function at 0x61f660
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68b0aa
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x79cac4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
xor edi, edi
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x28], 0xffffffff
movups xmmword [ebp - 0x20], xmm0
cmp eax, 0xffffffff
je 0x61f6bc
mov dword [ebp - 0x34], edi
mov edi, 1
mov dword [ebp - 0x20], eax
mov eax, dword [0x79cb08]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 0xffffffff
je 0x61f708
push eax
call ebx
test eax, eax
je 0x61f708
mov eax, dword [0x79cb08]
cmp eax, 0xffffffff
jne 0x61f6e1
xor ecx, ecx
jmp 0x61f6eb
push eax
call ebx
mov ecx, eax
mov eax, dword [0x79cb08]
cmp byte [ecx + 0x38], 0
je 0x61f708
mov dword [ebp - 0x38], edi
cmp eax, 0xffffffff
jne 0x61f6fd
xor eax, eax
jmp 0x61f700
push eax
call ebx
mov eax, dword [eax + 0x34]
mov dword [ebp + edi*4 - 0x20], eax
inc edi
xor esi, esi
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp + 0x14]
and eax, dword [ebp + 0x18]
mov dword [ebp - 4], esi
cmp eax, 0xffffffff
je 0x61f7ba
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp + 0xc]
call fcn.0061f9c0
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x61f7ba
mov eax, 0xcccccccd
mov ebx, 0x20
mul dword [ebp - 0x2c]
lea eax, [ebp + 0xc]
shr edx, 4
cmp edx, ebx
push eax
cmova ebx, edx
call fcn.0061f280
mov ecx, dword [0x7a98a4]
add esp, 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
test ecx, ecx
jne 0x61f795
push str.SetWaitableTimerEx
push 0x6fd76c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov ecx, 0x61e690
cmovne ecx, eax
mov dword [0x7a98a4], ecx
push ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x30]
push eax
push esi
call ecx
test eax, eax
setne al
test al, al
je 0x61f7ba
mov ecx, edi
mov dword [ebp + edi*4 - 0x20], esi
mov dword [ebp - 0x28], ecx
inc edi
jmp 0x61f7bd
or ecx, 0xffffffff
mov byte [ebp - 0x21], 0
xor ebx, ebx
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
or edx, 0xffffffff
cmp ecx, edx
jne 0x61f7f3
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp + 0xc]
call fcn.0061f9c0
mov ecx, dword [eax]
mov dl, cl
mov ebx, dword [eax + 4]
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 0x21], dl
or edx, 0xffffffff
test edi, edi
je 0x61f835
push 0
cmp ecx, 0xffffffff
invalid
Function at 0x634e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x9c
mov eax, dword [0x79cac4]
xor eax, esp
mov dword [esp + 0x98], eax
mov edx, 0x361
mov dword [esp], 0x3610300
mov dword [esp + 4], 0x4860483
lea eax, [esp + 2]
mov dword [esp + 8], 0x9030903
mov dword [esp + 0xc], 0x940093e
mov dword [esp + 0x10], 0x94c0949
mov dword [esp + 0x14], 0x9830982
mov dword [esp + 0x18], 0x9c009be
mov dword [esp + 0x1c], 0x9cc09c7
mov dword [esp + 0x20], 0x9d709d7
mov dword [esp + 0x24], 0xa400a3e
mov dword [esp + 0x28], 0xa830a83
mov dword [esp + 0x2c], 0xac00abe
mov dword [esp + 0x30], 0xacc0ac9
mov dword [esp + 0x34], 0xb030b02
mov dword [esp + 0x38], 0xb3e0b3e
mov dword [esp + 0x3c], 0xb400b40
mov dword [esp + 0x40], 0xb4c0b47
mov dword [esp + 0x44], 0xb570b57
mov dword [esp + 0x48], 0xb830b83
mov dword [esp + 0x4c], 0xbbf0bbe
mov dword [esp + 0x50], 0xbcc0bc1
mov dword [esp + 0x54], 0xbd70bd7
mov dword [esp + 0x58], 0xc030c01
mov dword [esp + 0x5c], 0xc440c41
mov dword [esp + 0x60], 0xc830c82
mov dword [esp + 0x64], 0xcbe0cbe
mov dword [esp + 0x68], 0xcc40cc0
mov dword [esp + 0x6c], 0xccb0cc7
mov dword [esp + 0x70], 0xcd60cd5
mov dword [esp + 0x74], 0xd030d02
mov dword [esp + 0x78], 0xd400d3e
mov dword [esp + 0x7c], 0xd4c0d46
mov dword [esp + 0x80], 0xd570d57
mov dword [esp + 0x84], 0xf7f0f7f
mov dword [esp + 0x88], 0x20e120d0
mov dword [esp + 0x8c], 0x309a3099
mov dword [esp + 0x90], 0xfe23fe20
mov dword [esp + 0x94], 0xffffffff
cmp dx, cx
jae 0x634fbb
add eax, 4
cmp word [eax], cx
jb 0x634fb3
sub eax, 2
cmp cx, word [eax]
jb 0x634fe0
cmp cx, word [eax + 2]
ja 0x634fe0
mov al, 1
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00611399
add esp, 0x9c
ret
mov ecx, dword [esp + 0x98]
xor al, al
xor ecx, esp
call fcn.00611399
add esp, 0x9c
ret

Function at 0x637ddb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x65c825
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
jb 0x65c812
not esi
test ebp, esi
jbe 0x65c819
ror ebx, 0xe
mov esi, 0x862e4a4e
cmp edx, ebp
ja 0x65c828
add edx, dword [0x79fde9]
cmp dword [0x79ca75], 0x346f1663
ja 0x65c836
not esi
or eax, 0x7f95d478
ror esi, 0x10
dec esi
mov ecx, 0x33ba94bf
add esi, 0xb395b605
inc edi
and edx, dword [0x7a3066]
shl eax, 0xf
or eax, dword [0x7a195e]
call fcn.00592c09
or esi, 0xb20f7598
add edi, edi
shl eax, 0x16
or edi, dword [0x79d9a3]
ror edx, 0xa
inc edi
neg edi
shl edx, 0xf
rol edx, 0x13
dec ecx
jne 0x65c845
or edi, 0x599082b9
cmp dword [0x799dd6], ecx
jb 0x65c894
call fcn.00590ec6
add esi, 0xd88b79ce
mov ecx, 0x344bfad6
sub dword [0x7ab7d2], ebx
inc esi
dec edi
mov dword [0x7ab973], eax
sub ebx, eax
cmp dword [0x79a588], esi
jae 0x65c8b9
test edx, esp
je 0x65c8bd
not esi
add ebx, edx
shl edx, 0x16
sub edx, dword [0x79a567]
neg esi
inc ebx
mov ebx, esi
xchg edi, esi
not esi
dec ecx
jne 0x65c89f
xor edx, 0xcd434283
sub eax, ebp
add edx, esi
inc ebx
add eax, dword [0x79b335]
or dword [0x7ab946], eax
and eax, esp
add ecx, 0x25300975
mov ecx, 0x3a60f7e4
shl edx, 0x1e
or eax, edx
add edx, 0xb070aa3b
xchg ebx, eax
cmp dword [0x79ea7d], ecx
jo 0x65c90f
inc edx
not esi
shr edx, 0xc
inc edi
mov edx, ecx
and ebx, edi
shr ebx, 5
and esi, esi
shr esi, 0x1d
xchg esi, eax
shr esi, 0x17
ror eax, 0x1a
shl esi, 0x1a
inc eax
dec ecx
jne 0x65c8f9
shl edx, 0x1a
mov ecx, edx
xor edi, eax
dec edi
inc ebx
shl esi, 0xa
call fcn.005b9dd7
shr ebx, 0xc
inc eax
call fcn.005acebb
xor eax, 0x7d547ee4
call fcn.006115d3
test dword [0x7a0e43], eax
jne 0x65c960
add edi, ecx
not edx
neg esi
not esi
sub edi, 0xd96dda1c
rol eax, 0x1e
sub esi, edi
add eax, 0xe5a3dc80
call fcn.00592c09
mov ecx, 0xbe3c7a7e
ror eax, 0xf
sub esi, ebp
or ecx, dword [0x7abc98]
dec ecx
sub dword [0x7ab807], eax
add edi, 0x4eca33f0
neg esi
add esi, edx
rol ecx, 0x10
neg esi
xchg esi, eax
add ecx, dword [0x7abb66]
xchg esi, eax
neg esi
ror ecx, 0x10
sub esi, edx
Function at 0x67511b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00674a89

Function at 0x675126
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00674cc4
Function at 0x401110
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
mov dword [esi], 0
push eax
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x20], ecx
je 0x4011b6
cmp word [ecx + 8], 2
push ebp
push edi
jne 0x401189
cmp word [ecx + 0xa], 4
jne 0x401189
mov edi, dword [ecx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x401189
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
lea esp, [esp]
mov ecx, dword [eax]
mov edx, dword [esp + 0x20]
push ecx
push edx
push ebx
push ebp
call fcn.004010a0
test eax, eax
mov dword [esi], eax
je 0x4011aa
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x401160
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov eax, dword [ecx]
push 0x400
push eax
push ebx
call fcn.004037c0
add esp, 0xc
pop edi
pop ebp
pop esi
mov byte [ebx + 0x400], 0
xor eax, eax
pop ebx
ret 0x18
pop edi
pop ebp
pop esi
mov eax, 8
pop ebx
ret 0x18
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x4011c6.11001
jmp dword [eax*4 + 0x4011ec]
pop esi
mov eax, 0x2af9
pop ebx
ret 0x18
pop esi
mov eax, 0x2afa
pop ebx
ret 0x18
pop esi
mov eax, 0x2afb
pop ebx
ret 0x18
Function at 0x4019f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
mov eax, dword [0x40d080]
mov dword [esp + 0x22c], eax
mov eax, dword [0x40e920]
test eax, eax
mov dword [esp], str.getaddrinfo
mov dword [esp + 4], 0x401470
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x401760
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], fcn.00401420
jne 0x401b52
push 0x104
lea ecx, [esp + 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x401b48
xor eax, eax
jmp 0x401a60
mov cl, byte [esp + eax + 0x124]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x401a60
push edi
lea edi, [esp + 0x1c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401a76
mov edx, dword [str.ws2_32]
mov eax, dword [0x40a22c]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
lea ecx, [esp + 0x28]
mov dword [edi], edx
push ecx
mov dword [edi + 4], eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x401abd
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x401b0f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
nop
mov cl, byte [esp + eax + 0x134]
mov byte [esp + eax + 0x28], cl
inc eax
test cl, cl
jne 0x401ac0
lea edi, [esp + 0x28]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401ad5
mov edx, dword [str.wship6]
mov eax, dword [0x40a224]
lea ecx, [esp + 0x28]
mov dword [edi], edx
push ecx
mov dword [edi + 4], eax
call ebp
mov esi, eax
test esi, esi
je 0x401b44
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x401b0f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x401b44
xor edi, edi
mov edx, dword [esp + edi*8 + 0x10]
push edx
push esi
call ebx
test eax, eax
mov dword [esp + edi*8 + 0x14], eax
je 0x401b06
inc edi
cmp edi, 3
jl 0x401b11
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov dword [0x40d068], eax
mov dword [0x40d070], ecx
mov dword [fcn.00401420], edx
pop esi
pop ebp
pop ebx
pop edi
mov dword [0x40e920], 1
movzx eax, word [esp + 0x234]
mov ecx, dword [esp + 0x22c]
mov eax, dword [eax*8 + 0x40d068]
call fcn.00403915
add esp, 0x230
ret 4
Function at 0x402950
Capabilities:
Get socket status

Disassembly:
mov eax, dword [0x40e90c]
sub esp, 0x114
push esi
push edi
or edi, 0xffffffff
test eax, eax
je 0x402972
push eax
call sub.dnssd.dll_DNSServiceRefSockFD
mov esi, eax
mov dword [esp + 8], esi
jmp 0x402978
mov dword [esp + 8], edi
mov esi, edi
mov eax, dword [0x40e910]
test eax, eax
je 0x402989
push eax
call sub.dnssd.dll_DNSServiceRefSockFD
mov edi, eax
cmp edi, esi
lea eax, [esi + 1]
mov dword [esp + 0xc], eax
jle 0x40299b
lea ecx, [edi + 1]
mov dword [esp + 0xc], ecx
mov eax, dword [0x40e91c]
test eax, eax
jne 0x402ad7
push ebx
mov ebx, 1
jmp 0x4029b4
mov esi, dword [esp + 0xc]
mov eax, dword [0x40e90c]
xor ecx, ecx
test eax, eax
mov dword [esp + 0x1c], ecx
je 0x4029cd
mov ecx, ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], ecx
mov eax, dword [0x40e910]
test eax, eax
je 0x4029fc
xor eax, eax
test ecx, ecx
jbe 0x4029eb
lea esp, [esp]
cmp dword [esp + eax*4 + 0x20], edi
je 0x4029eb
inc eax
cmp eax, ecx
jb 0x4029e0
cmp eax, ecx
jne 0x4029fc
cmp ecx, 0x40
jae 0x4029fc
mov dword [esp + eax*4 + 0x20], edi
inc dword [esp + 0x1c]
mov edx, dword [0x40d060]
lea eax, [esp + 0x14]
push eax
push 0
push 0
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x2c], 0
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jle 0x402a8f
mov eax, dword [0x40e90c]
test eax, eax
je 0x402a52
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x1c]
push eax
push ecx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x402a52
mov edx, dword [0x40e90c]
push edx
jmp 0x402a71
mov eax, dword [0x40e910]
test eax, eax
je 0x402ac9
lea eax, [esp + 0x1c]
push eax
push edi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x402ac9
mov ecx, dword [0x40e910]
push ecx
call sub.dnssd.dll_DNSServiceProcessResult
test eax, eax
je 0x402ac9
push eax
push str.DNSServiceProcessResult_returned__d_n
push 0x40d0e8
call fcn.004040e6
add esp, 0xc
jmp 0x402ac3
jne 0x402a98
call fcn.00402540
jmp 0x402ac9
mov edx, dword [0x40e930]
push edx
call fcn.004042b3
push eax
mov eax, dword [0x40e930]
push eax
push esi
push str.select___returned__d_errno__d__s_n
call fcn.00403cb6
mov eax, dword [0x40e930]
add esp, 0x14
cmp eax, 4
je 0x402ac9
mov dword [0x40e91c], ebx
mov eax, dword [0x40e91c]
test eax, eax
je 0x4029b0
pop ebx
pop edi
pop esi
add esp, 0x114
ret
Function at 0x4041b2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x40e97c], esi
push edi
jne 0x4041d2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x40e978], esi
mov byte [0x40e974], al
jne 0x404238
mov ecx, dword [0x40efd0]
test ecx, ecx
je 0x404219
mov eax, dword [0x40efcc]
sub eax, 4
cmp eax, ecx
jmp 0x404212
mov eax, dword [eax]
test eax, eax
je 0x404204
call eax
mov eax, dword [0x40efcc]
sub eax, 4
cmp eax, dword [0x40efd0]
mov dword [0x40efcc], eax
jae 0x4041fc
mov eax, 0x40d020
mov esi, 0x40d028
cmp eax, esi
mov edi, eax
jae 0x404238
mov eax, dword [edi]
test eax, eax
je 0x404231
call eax
add edi, 4
cmp edi, esi
jb 0x404229
mov eax, 0x40d02c
mov esi, 0x40d030
cmp eax, esi
mov edi, eax
jae 0x404257
mov eax, dword [edi]
test eax, eax
je 0x404250
call eax
add edi, 4
cmp edi, esi
jb 0x404248
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x404271
push dword [ebp + 8]
mov dword [0x40e97c], 1
call fcn.00404118
pop ebp
ret
Function at 0x404342
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x18
push 0x40b2c8
call fcn.004052c8
mov edi, 0x94
mov eax, edi
call fcn.004076e0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x40e93c], ecx
mov eax, dword [esi + 4]
mov dword [0x40e948], eax
mov edx, dword [esi + 8]
mov dword [0x40e94c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x40e940], esi
cmp ecx, 2
je 0x4043a2
or esi, 0x8000
mov dword [0x40e940], esi
shl eax, 8
add eax, edx
mov dword [0x40e944], eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x4043db
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4043db
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4043f3
cmp eax, 0x20b
je 0x4043e0
mov dword [ebp - 0x1c], edi
jmp 0x404407
cmp dword [ecx + 0x84], 0xe
jbe 0x4043db
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x404401
cmp dword [ecx + 0x74], 0xe
jbe 0x4043db
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
push edi
call fcn.004045a5
pop ecx
test eax, eax
jne 0x404433
cmp dword [0x40e9b0], 2
je 0x404420
call fcn.0040713f
push 0x1c
call fcn.00406fc8
push 0xff
call fcn.00404118
pop ecx
pop ecx
call fcn.00406e48
mov dword [ebp - 4], edi
call fcn.00406b89
test eax, eax
jge 0x40444c
push 0x1b
call fcn.0040431d
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40efc4], eax
call fcn.004075be
mov dword [0x40e9a8], eax
call fcn.0040751c
test eax, eax
jge 0x404472
push 8
call fcn.0040431d
pop ecx
call fcn.004072e9
test eax, eax
jge 0x404483
push 9
call fcn.0040431d
pop ecx
push 1
call fcn.00404148
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x404499
push eax
call fcn.0040431d
pop ecx
mov eax, dword [0x40e95c]
mov dword [0x40e960], eax
push eax
push dword [0x40e954]
push dword [0x40e950]
call fcn.00402f80
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x1c], edi
jne 0x4044c8
push esi
call fcn.00404273
call fcn.00404295
jmp 0x4044fa
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.00405303
ret