joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d02a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46e3d8]
jne 0x43d034
repz ret
jmp fcn.00444f35

Function at 0x44fc6d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00447044
xor ebx, ebx
cmp dword [0x470ac0], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x44fd42
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x44fcad
xor eax, eax
jmp 0x44fe06
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x44fca6
push eax
call fcn.00446fe1
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x470ac0], eax
call esi
push eax
call fcn.00446fe1
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x470ac4], eax
call esi
push eax
call fcn.00446fe1
mov dword [0x470ac8], eax
lea eax, [ebp - 8]
push eax
call fcn.0043f005
test eax, eax
pop ecx
pop ecx
je 0x44fd10
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043e835
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x44fd42
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00446fe1
cmp eax, ebx
pop ecx
mov dword [0x470ad0], eax
je 0x44fd42
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00446fe1
pop ecx
mov dword [0x470acc], eax
mov eax, dword [0x470acc]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x44fdbb
cmp dword [0x470ad0], esi
je 0x44fdbb
push eax
call fcn.0044704d
pop ecx
call eax
cmp eax, ebx
je 0x44fd88
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x470ad0]
call fcn.0044704d
pop ecx
call eax
test eax, eax
je 0x44fd88
test byte [ebp - 0x18], 1
jne 0x44fdbb
lea eax, [ebp - 0xc]
push eax
call fcn.0043f03c
test eax, eax
pop ecx
je 0x44fda3
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043e835
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x44fdb2
or dword [ebp + 0x10], 0x200000
jmp 0x44fdec
or dword [ebp + 0x10], 0x40000
jmp 0x44fdec
mov eax, dword [0x470ac4]
cmp eax, esi
je 0x44fdec
push eax
call fcn.0044704d
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x44fdec
mov eax, dword [0x470ac8]
cmp eax, esi
je 0x44fdec
push dword [ebp - 4]
push eax
call fcn.0044704d
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x470ac0]
call fcn.0044704d
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10005bd8
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x100140e0]
je 0x10005bf3
inc edi
cmp edi, 0x17
jb 0x10005be4
cmp edi, 0x17
jae 0x10005d73
push ebp
push 3
call fcn.1000b9d9
cmp eax, 1
pop ecx
je 0x10005d3f
push 3
call fcn.1000b9d9
test eax, eax
pop ecx
jne 0x10005c27
cmp dword [0x10015208], 1
je 0x10005d3f
cmp ebx, 0xfc
je 0x10005d72
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10015228
push ebp
call fcn.1000b693
add esp, 0xc
test eax, eax
je 0x10005c5d
push esi
push esi
push esi
push esi
push esi
call fcn.10005f62
add esp, 0x14
push 0x104
mov esi, 0x10015241
push esi
push 0
mov byte [0x10015345], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10005ca1
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1000b693
add esp, 0xc
test eax, eax
je 0x10005ca1
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10005f62
add esp, 0x14
push esi
call fcn.10006db0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10005ce6
push esi
call fcn.10006db0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1001553c
push 0x10010954
sub ecx, eax
push ecx
push eax
call fcn.1000b926
add esp, 0x14
test eax, eax
je 0x10005ce6
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.10005f62
add esp, 0x14
jmp 0x10005ce8
xor esi, esi
push 0x10010950
push ebx
push ebp
call fcn.1000b8b5
add esp, 0xc
test eax, eax
je 0x10005d08
push esi
push esi
push esi
push esi
push esi
call fcn.10005f62
add esp, 0x14
push dword [edi*8 + 0x100140e4]
push ebx
push ebp
call fcn.1000b8b5
add esp, 0xc
test eax, eax
je 0x10005d2a
push esi
push esi
push esi
push esi
push esi
call fcn.10005f62
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.1000b6f8
add esp, 0xc
jmp 0x10005d72
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x10005d72
cmp ebp, 0xffffffff
je 0x10005d72
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x100140e4]
push dword [esi]
call fcn.10006db0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1000b6f8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10005138
xor ebx, ebx
cmp dword [0x10015b80], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x1000b7ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1000b8ae
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1000b8ae
push eax
call fcn.100050ca
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10015b80], eax
call esi
push eax
call fcn.100050ca
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10015b84], eax
call esi
push eax
call fcn.100050ca
mov dword [0x10015b88], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10004179
test eax, eax
pop ecx
pop ecx
je 0x1000b79c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10005f62
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x1000b7ce
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.100050ca
cmp eax, ebx
pop ecx
mov dword [0x10015b90], eax
je 0x1000b7ce
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100050ca
pop ecx
mov dword [0x10015b8c], eax
mov eax, dword [0x10015b8c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1000b853
cmp dword [0x10015b90], ecx
je 0x1000b853
push eax
call fcn.10005141
push dword [0x10015b90]
mov esi, eax
call fcn.10005141
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1000b853
cmp edi, ebx
je 0x1000b853
call esi
cmp eax, ebx
je 0x1000b820
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000b820
test byte [ebp - 0x18], 1
jne 0x1000b853
lea eax, [ebp - 0x10]
push eax
call fcn.100041b0
test eax, eax
pop ecx
je 0x1000b83b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10005f62
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x1000b84a
or dword [ebp + 0x10], 0x200000
jmp 0x1000b88e
or dword [ebp + 0x10], 0x40000
jmp 0x1000b88e
mov eax, dword [0x10015b84]
cmp eax, dword [ebp - 8]
je 0x1000b88e
push eax
call fcn.10005141
cmp eax, ebx
pop ecx
je 0x1000b88e
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1000b88e
mov eax, dword [0x10015b88]
cmp eax, dword [ebp - 8]
je 0x1000b88e
push eax
call fcn.10005141
cmp eax, ebx
pop ecx
je 0x1000b88e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10015b80]
call fcn.10005141
cmp eax, ebx
pop ecx
je 0x1000b8ae
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000b8b0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000cb97
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add al, 0
add byte [eax], al
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x43c64a18
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x5a862d0a
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x63e41a02
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x5ec14e44
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x100db473
Capabilities:
Get number of processors

Disassembly:
jmp 0x100cf794
call fcn.100cf77f
salc
arpl word [ebp - 0x79], cx
loop 0x100cf78a
adc eax, 0x24748b56
add al, 0x8d
mov dh, 0xd4
adc byte [edx], al
add byte [ecx + 0x5e042474], cl
push edx
mov dword [esp], ebp
push esp
pop ebp
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 0x80
xchg dword [esp], ebp
pop esp
sub esp, 4
mov dword [esp], ebx
push edi
mov dword [esp], esi
push 0x188b
mov dword [esp], edi
jmp 0x100f53b3
push ebx
mov ebx, 8
add ebx, ebp
mov eax, dword [ebx]
pop ebx
sub esp, 4
mov dword [esp], eax
jmp 0x100ee1dd
jmp 0x100da476
push 0
push 0x41797261
push 0x7262694c
push 0x64616f4c
lea ecx, [ebp - 0x2c]
sub esp, 4
mov dword [esp], ecx
jmp 0x100e9856
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x1983f]
mov dword [esp + 4], ecx
pop ecx
jmp 0x100f1e32
jmp 0x100e986d
call fcn.100e9858
adc byte [eax - 0x77], dl
loopne 0x100e987c
add al, 0
add byte [eax], al
add eax, 4
xchg dword [esp], eax
pop esp
rol byte [edi + eax*4], 4
and al, 0x5c
push eax
pop dword [ebp - 4]
push ecx
mov ecx, 0xc
add ecx, ebp
mov eax, dword [ecx]
pop ecx
push esi
mov dword [esp], eax
push dword [ebp - 4]
sub dword [esp], 0x3f8325ed
pop ecx
add ecx, 0x3f8325ed
push esi
mov dword [esp], ecx
push eax
mov eax, 8
add eax, ebp
mov edx, dword [eax]
pop eax
push eax
mov eax, 0x64
add edx, eax
pop eax
push ebx
mov dword [esp], edx
jmp 0x100cf77d
jmp 0x100ee1f4
call fcn.100ee1df
or eax, dword [ebp + 0x68]
mov byte [eax], 0
jmp 0x100cfbce
push esi
mov esi, 0x6114390f
xor esi, 0x61143917
mov eax, esi
pop esi
mov eax, dword fs:[eax]
push eax
pop dword [ebp - 4]
push dword [ebp - 4]
pop eax
push dword [eax + 0x30]
sub dword [esp], 0x63f80c4b
pop ecx
add ecx, 0x63f80c4b
push eax
mov eax, 0xfffffff8
add eax, ebp
mov dword [eax], ecx
pop eax
push dword [ebp - 8]
pop edx
push ecx
mov ecx, 8
add ecx, edx
mov eax, dword [ecx]
pop ecx
push edx
mov edx, 0xffffffec
add edx, ebp
mov dword [edx], eax
pop edx
push ebx
mov ebx, 0
mov dword [ebp - 0x10], ebx
pop ebx
cmp dword [ebp - 0x10], 0
je 0x100d0698
jmp 0x100d1265

Function at 0x100fa6f2
Capabilities:
Access peb ldr_data

Disassembly:
push eax
mov eax, dword [esp + 4]
lea eax, [eax - 0x4e23]
mov dword [esp + 4], eax
pop eax
jmp 0x100e9a70

Function at 0x1042a77c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], ecx
cmp eax, 0x1000
lea ecx, [esp + 8]
jb 0x1042a7da
jmp 0x1042a799
push ebx
mov ebx, 0x1000
sub ecx, ebx
pop ebx
push esi
mov esi, 0x42603735
add esi, 0x62b848ad
not esi
xor esi, 0xa3b2af6
xor esi, 0x5731f4a
shr esi, 4
xor esi, 0x55aeb5a
sub eax, esi
pop esi
test dword [ecx], eax
cmp eax, 0x1000
jae 0x1042a799
jmp 0x1042a7da
sub ecx, 0x42861a21
sub ecx, eax
add ecx, 0x42861a21
push esp
pop eax
test dword [ecx], eax
mov esp, ecx
push dword [eax]
pop ecx
push dword [eax + 4]
xor dword [esp], 0x1d9f7243
pop eax
xor eax, 0x1d9f7243
push ecx
mov dword [esp], eax
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44e004]
jne 0x40100a
repz ret
jmp fcn.0040135f

Function at 0x40549b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00401961
and dword [ebp - 4], 0
cmp dword [0x44fcd8], 0
mov ebx, eax
jne 0x40554c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4055fd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4055fd
push eax
call fcn.004018ef
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44fcd8], eax
call esi
push eax
call fcn.004018ef
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44fcdc], eax
call esi
push eax
call fcn.004018ef
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44fce0], eax
call esi
push eax
call fcn.004018ef
pop ecx
mov dword [0x44fce8], eax
test eax, eax
je 0x40554c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004018ef
pop ecx
mov dword [0x44fce4], eax
mov eax, dword [0x44fce4]
cmp eax, ebx
je 0x4055a4
cmp dword [0x44fce8], ebx
je 0x4055a4
push eax
call fcn.0040196a
push dword [0x44fce8]
mov esi, eax
call fcn.0040196a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4055a4
test edi, edi
je 0x4055a4
call esi
test eax, eax
je 0x40559b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40559b
test byte [ebp - 0xc], 1
jne 0x4055a4
or dword [ebp + 0x10], 0x200000
jmp 0x4055dd
mov eax, dword [0x44fcdc]
cmp eax, ebx
je 0x4055dd
push eax
call fcn.0040196a
pop ecx
test eax, eax
je 0x4055dd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4055dd
mov eax, dword [0x44fce0]
cmp eax, ebx
je 0x4055dd
push eax
call fcn.0040196a
pop ecx
test eax, eax
je 0x4055dd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44fcd8]
call fcn.0040196a
pop ecx
test eax, eax
je 0x4055fd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4055ff
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44aa00
Capabilities:
Get hostname

Disassembly:
sub esp, 0x42c
mov eax, dword [0x44e004]
xor eax, esp
mov dword [esp + 0x428], eax
push ebp
mov ebp, dword [esp + 0x434]
push edi
cmp ebx, 0x182
jne 0x44aa34
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
jmp 0x44aa6e
cmp ebx, 0x19f
jne 0x44aa6e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
push str.nekovikokozutawademehatabed
push str.gifudigezecona
push str.furawekutalari
push str.maduyupudotokisemiyexetalipiyuh
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
xor edi, edi
test ebx, ebx
jle 0x44aae3
push esi
jmp 0x44aa80
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 5
mov dword [esp + 0x10], 0
call fcn.0044a9f0
mov eax, dword [esp + 0x10]
add eax, 0x46
mov dword [esp + 0xc], eax
sub dword [esp + 0xc], 0x46
mov cl, byte [esp + 0xc]
xor byte [edi + ebp], cl
cmp ebx, 0xf
jne 0x44aadd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
inc edi
cmp edi, ebx
jl 0x44aa80
pop esi
pop edi
pop ebp
cmp ebx, 0x2d
jne 0x44aafe
mov dword [0x528500], 0xa62e7790
mov dword [0x528504], 0xffffffff
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00401000
add esp, 0x42c
ret
Function at 0x41be44
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41be4a
ret
Function at 0x401000
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push edi
push 6
push 1
push 2
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
cmp edi, 0xffffffff
jne 0x401090
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x402164
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040176f
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR100.dll_printf]
push 0x4021a4
call esi
add esp, 4
mov eax, 2
push 0x4025f4
mov word [ebp - 0x34], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x539
mov dword [ebp - 0x30], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea ecx, [ebp - 0x34]
push ecx
push edi
mov word [ebp - 0x32], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4010fc
push 0x4021d0
call esi
add esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040176f
mov esp, ebp
pop ebp
ret
push 0x402218
call esi
push 0x402244
call esi
add esp, 8
push 0
push 0x1f
lea edx, [ebp - 0x24]
push edx
push edi
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
je 0x401168
cmp edi, 0x2746
je 0x401168
test edi, edi
jle 0x401172
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
push 0x4022a4
movzx ebx, ax
call esi
push ebx
push 0x4022d0
call esi
push edi
push 0x402304
call esi
add esp, 0x18
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040176f
mov esp, ebp
pop ebp
ret
push 0x402274
call esi
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.0040176f
mov esp, ebp
pop ebp
ret
Function at 0x401190
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
mov dword [ebx], 0
cmp edi, 0xffffffff
jne 0x4011e8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x402338
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 8
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040176f
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCR100.dll_printf]
push 0x40236c
call esi
add esp, 4
mov eax, 2
push 0x4025f4
mov word [ebp - 0x18], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [ebp + 8]
push ecx
mov dword [ebp - 0x14], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [ebp - 0x18]
push edx
push edi
mov word [ebp - 0x16], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40125b
movzx eax, word [ebp + 8]
push eax
push 0x4025f4
push 0x402390
call esi
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040176f
mov esp, ebp
pop ebp
ret
push 0x4023d8
call esi
push 0x4023fc
call esi
add esp, 8
push 0
push 0x1a
push 0x40264c
push edi
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x401294
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 0x402424
call esi
add esp, 8
jmp 0x4012ab
push eax
push 0x402448
call esi
push 0x40264c
push 0x40247c
call esi
add esp, 0x10
push 0
push 0x1a
push ebx
push edi
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
je 0x4012f9
cmp edi, 0x2746
je 0x4012f9
test edi, edi
js 0x4011d6
push 0x4022a4
call esi
push ebx
push 0x4024ac
call esi
push edi
push 0x402304
call esi
add esp, 0x14
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040176f
mov esp, ebp
pop ebp
ret
push 0x402274
call esi
mov ecx, dword [ebp - 8]
add esp, 4
pop edi
xor ecx, ebp
pop esi
call fcn.0040176f
mov esp, ebp
pop ebp
ret

Function at 0x401320
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x44
lea eax, [ebp - 0x168]
push 0
push eax
call sub.MSVCR100.dll_memset
push esi
push 0x4024f8
xor eax, eax
push 0x402558
lea ecx, [ebp - 0x110]
push 0x104
push ecx
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
call dword [sym.imp.MSVCR100.dll__snprintf]
add esp, 0x20
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x168]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [ebp - 0x110]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040176f
mov esp, ebp
pop ebp
ret