joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50bd5c
Capabilities:
Check internet connectivity via wininet
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50bf38
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x50bee2
mov eax, dword [ebp - 4]
call fcn.0050b348
test al, al
jne 0x50bee2
xor ebx, ebx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x111], 0
je 0x50bdba
cmp byte [0x5516d0], 0
jne 0x50bdba
push 0
call sub.WinInet.dll_InternetInitializeAutoProxyDll
mov byte [0x5516d0], 1
push 0
push 0
push 0
push ebx
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0050b44c
mov eax, dword [ebp - 0xc]
call fcn.00404c68
push eax
call sub.wininet.dll_InternetOpenA
mov edx, dword [ebp - 4]
mov dword [edx + 0xe4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x110], 0
je 0x50be26
push 0
call sub.wininet.dll_InternetAttemptConnect
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0x11a], 0
je 0x50be1b
lea ecx, [ebp - 8]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x11c]
call dword [ebx + 0x118]
cmp dword [ebp - 8], 0
je 0x50be26
call fcn.0040d2e8
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0050b150
xor eax, eax
push ebp
push 0x50beb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
push 0
push 3
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0xf8]
mov eax, dword [ebx + 8]
call fcn.00404c68
push eax
mov eax, dword [ebx + 4]
call fcn.00404c68
push eax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0xf4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xec]
call fcn.00404c68
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xe4]
push eax
call sub.wininet.dll_InternetConnectA
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xe0], esi
test esi, esi
setne dl
xor dl, 1
mov eax, dword [ebp - 4]
call fcn.0050b150
mov eax, dword [ebp - 4]
call fcn.0050bd34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x50bf22
test bl, bl
jne 0x50bf22
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xe0]
test eax, eax
je 0x50bef9
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xe0], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xe4]
test eax, eax
je 0x50bf17
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xe4], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50bf3f
lea eax, [ebp - 0xc]
call fcn.004047a8
ret
Function at 0x50bf48
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x44], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x50c09b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0xd4]
mov edx, esi
call fcn.00404bb4
je 0x50c085
lea eax, [ebx + 0xd4]
mov edx, esi
call fcn.004047fc
cmp dword [ebx + 0xd4], 0
je 0x50c05f
lea eax, [ebp - 0x40]
xor ecx, ecx
mov edx, 0x3c
call fcn.004032b4
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x40]
push eax
push 0
push 0
mov eax, dword [ebx + 0xd4]
call fcn.00404c68
push eax
call sub.wininet.dll_InternetCrackUrlA
mov eax, dword [ebp - 0x34]
add eax, 0xfffffffd
sub eax, 2
jb 0x50c004
lea edx, [ebp - 0x44]
mov eax, 0x50b148
call fcn.00406a58
mov ecx, dword [ebp - 0x44]
mov dl, 1
mov eax, dword [0x502c24]
call fcn.0040d308
call fcn.004040fc
mov eax, dword [ebp - 0x34]
mov dword [ebx + 0xe8], eax
movzx eax, word [ebp - 0x28]
mov dword [ebx + 0xf4], eax
mov eax, dword [ebx + 0xd4]
call fcn.00404c68
mov dword [ebp - 4], eax
lea eax, [ebx + 0xec]
push eax
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 4]
inc edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebx + 0xd4]
call fcn.00404cc8
lea eax, [ebx + 0xf0]
push eax
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 4]
inc edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebx + 0xd4]
call fcn.00404cc8
jmp 0x50c085
xor eax, eax
mov dword [ebx + 0xf4], eax
lea eax, [ebx + 0xec]
call fcn.004047a8
lea eax, [ebx + 0xf0]
call fcn.004047a8
xor eax, eax
mov dword [ebx + 0xe8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50c0a2
lea eax, [ebp - 0x44]
call fcn.004047a8
ret
Function at 0x402510
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x4026ad
mov esi, dword [ebp + 8]
test esi, esi
je 0x4026ad
mov dword [esi + 0xf0], 0xa
mov ecx, dword [edi]
mov eax, ecx
rol ecx, 8
and ecx, 0xff00ff
ror eax, 8
and eax, 0xff00ff00
or eax, ecx
mov dword [esi], eax
lea eax, [esi + 4]
mov edx, dword [edi + 4]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [eax], ecx
mov edx, dword [edi + 8]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [esi + 8], ecx
mov ecx, dword [edi + 0xc]
mov edi, 0x5f9794
push ebx
mov ebx, ecx
rol ecx, 8
and ecx, 0xff00ff
ror ebx, 8
and ebx, 0xff00ff00
or ebx, ecx
mov ecx, ebx
mov dword [esi + 0xc], ebx
shr ecx, 0x10
and ecx, 0xff
mov edx, dword [ecx*4 + 0x5facc0]
mov ecx, ebx
shr ecx, 8
xor edx, 0x1000000
and ecx, 0xff
and edx, 0xff000000
mov ecx, dword [ecx*4 + 0x5fa8c0]
and ecx, 0xff0000
xor edx, ecx
mov ecx, ebx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x5fb0c0]
xor edx, ecx
movzx ecx, bl
mov ecx, dword [ecx*4 + 0x5fb4c0]
and ecx, 0xff00
xor edx, ecx
mov ecx, dword [eax]
xor edx, dword [esi]
xor ecx, edx
mov dword [esi + 0x10], edx
mov edx, dword [esi + 8]
xor edx, ecx
mov dword [esi + 0x14], ecx
mov ecx, ebx
mov dword [esi + 0x18], edx
xor ecx, edx
mov dword [esi + 0x1c], ecx
pop ebx
mov edi, edi
mov edx, dword [eax + 0x18]
lea eax, [eax + 0x10]
mov ecx, edx
shr ecx, 8
and ecx, 0xff
mov esi, dword [ecx*4 + 0x5fa8c0]
mov ecx, edx
shr ecx, 0x10
and esi, 0xff0000
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5facc0]
and ecx, 0xff000000
xor esi, ecx
mov ecx, edx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x5fb0c0]
xor esi, ecx
movzx ecx, dl
mov ecx, dword [ecx*4 + 0x5fb4c0]
and ecx, 0xff00
xor esi, ecx
xor esi, dword [eax - 4]
xor esi, dword [edi]
add edi, 4
mov dword [eax + 0xc], esi
mov ecx, dword [eax]
xor ecx, esi
mov dword [eax + 0x10], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
cmp edi, 0x5f97b8
jne 0x402620
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x4026c0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00402510
add esp, 4
test eax, eax
js 0x4028ac
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x402734
lea esi, [eax + 8]
add eax, 8
lea esi, [esi + edi*4]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x4026f4
mov ebx, dword [ebp + 8]
mov edi, 1
cmp dword [ebx + 0xf0], edi
jle 0x4028a7
lea esi, [ebx + 2]
jmp 0x402750
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + 0x5fb0c0]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x5fa4c0]
movzx eax, byte [eax*4 + 0x5fb0c0]
xor ecx, dword [eax*4 + 0x5f9cc0]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + 0x5fb0c0]
xor ecx, dword [eax*4 + 0x5f98c0]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + 0x5fb0c0]
xor ecx, dword [eax*4 + 0x5fa0c0]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + 0x5fb0c0]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x5fa4c0]
movzx eax, byte [eax*4 + 0x5fb0c0]
xor ecx, dword [eax*4 + 0x5f9cc0]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + 0x5fb0c0]
xor ecx, dword [eax*4 + 0x5fa0c0]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + 0x5fb0c0]
xor ecx, dword [eax*4 + 0x5f98c0]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + 0x5fb0c0]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x5fa4c0]
movzx eax, byte [eax*4 + 0x5fb0c0]
xor ecx, dword [eax*4 + 0x5f9cc0]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + 0x5fb0c0]
xor ecx, dword [eax*4 + 0x5fa0c0]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + 0x5fb0c0]
xor ecx, dword [eax*4 + 0x5f98c0]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + 0x5fb0c0]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x5fa4c0]
movzx eax, byte [eax*4 + 0x5fb0c0]
xor ecx, dword [eax*4 + 0x5f9cc0]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + 0x5fb0c0]
xor ecx, dword [eax*4 + 0x5fa0c0]
movzx eax, dl
movzx eax, byte [eax*4 + 0x5fb0c0]
xor ecx, dword [eax*4 + 0x5f98c0]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebx + 0xf0]
jl 0x402750
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x403970
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ac1fa
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x627490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.00591c86
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x403a16
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.005705f9
push 0x6222ac
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.00575935
push edi
push esi
call fcn.00591f1c
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570546
mov esp, ebp
pop ebp
ret 4

Function at 0x403fb0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ac288
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x627490]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.004047b0
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.00403ee0
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x404021
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.005705f9
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x40404a
push dword [esp + 0xc]
call fcn.00448661
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x406000
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5ac468
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x627490]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x627490]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea edx, [edi + 0x10]
lea ecx, [esp + 0x18]
call fcn.00420fb0
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x28]
add eax, 0xa
mov dword [edi], eax
add eax, 4
push eax
call fcn.00448658
mov esi, eax
mov dword [esp + 0x14], 0xe
mov eax, dword [edi]
sub esp, 0x14
mov ecx, esp
mov dword [esi], eax
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
movzx eax, byte [edi + 5]
mov byte [esi + 5], al
mov eax, dword [edi + 8]
mov dword [esi + 6], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xa], eax
lea eax, [esp + 0x30]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047b0
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.00405f60
mov ecx, dword [edi]
add esp, 0x1c
add ecx, 4
mov dword [ebx], esi
cmp dword [esp + 0x2c], 0x10
mov dword [ebx + 4], ecx
jb 0x4060da
push dword [esp + 0x18]
call fcn.00448661
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00570546
mov esp, ebp
pop ebp
ret 4

Function at 0x4071b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ac638
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x627490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.00592632
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x28]
mov dword [ebp - 4], 0
mov dword [edi], vtable.std::_LaunchPad_class_std::_Bind_1__void__void____cdecl__const__struct_AgentPack::CreateAgentAppLinkPack___struct_AgentPack::CreateAgentAppLinkPack__.0
push 0xffffffffffffffff
mov eax, dword [esi]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 4]
mov dword [edi + 0x14], eax
movzx eax, byte [esi + 8]
mov byte [edi + 0x18], al
movzx eax, byte [esi + 9]
mov byte [edi + 0x19], al
mov eax, dword [esi + 0xc]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 0x10]
mov byte [edi + 0x20], al
mov eax, dword [esi + 0x14]
mov dword [edi + 0x24], eax
lea eax, [esi + 0x18]
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.004047b0
mov ax, word [esi + 0x30]
mov word [edi + 0x40], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40b960
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5acd7b
mov eax, dword fs:[0]
push eax
sub esp, 0x1a8
mov eax, dword [0x627490]
xor eax, esp
mov dword [esp + 0x1a0], eax
push ebx
push esi
push edi
mov eax, dword [0x627490]
xor eax, esp
push eax
lea eax, [esp + 0x1b8]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.0045e3b9
push 0
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.00462d1b
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x40ba63
call fcn.0045f342
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40b9e2
push 0x80004005
call fcn.0040ccc0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x18], esi
push 0x65
mov dword [esp + 0x1c4], 0
call fcn.00462636
test eax, eax
je 0x40ba16
push 0x65
push eax
lea ecx, [esp + 0x20]
call fcn.0040c650
mov esi, dword [esp + 0x18]
cmp dword [esi - 0xc], 0
je 0x40ba3e
push 0
push 0
push 0x800
push dword [edi + 4]
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
call edi
mov eax, dword [esp + 0x14]
push esi
push 0x10
push 0
push dword [eax + 4]
call edi
add esi, 0xfffffff0
mov dword [esp + 0x1c0], 0xffffffff
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ba63
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0xbc]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0x80
push dword [ebx + 0x20]
call esi
push dword [ebx + 0xbc]
push 0
push 0x80
push dword [ebx + 0x20]
call esi
lea eax, [esp + 0x1c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, ebx
call fcn.0040b820
mov eax, 1
mov ecx, dword [esp + 0x1b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1a0]
xor ecx, esp
call fcn.00570546
mov esp, ebp
pop ebp
ret

Function at 0x40c2e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0045dcc8

Function at 0x40c520
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40c535
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40c574
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40c570
lea ebx, [ebx]
cmp esi, edx
jae 0x40c574
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x40c560
cmp esi, edx
jb 0x40c579
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40f3c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ad23b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x627490]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea edx, [edi + 0x30]
mov byte [edi + 0x1c], 0
mov dword [edx + 0x14], 0xf
mov dword [edx + 0x10], 0
mov byte [edx], 0
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp + 8], 0x2c
mov eax, dword [esi]
mov dword [edi], eax
movzx eax, byte [esi + 4]
mov byte [edi + 4], al
movzx eax, byte [esi + 5]
mov byte [edi + 5], al
movzx eax, word [esi + 6]
mov word [edi + 6], ax
movzx eax, word [esi + 8]
mov word [edi + 8], ax
movzx eax, word [esi + 0xa]
mov word [edi + 0xa], ax
movzx eax, word [esi + 0xc]
mov word [edi + 0xc], ax
movzx eax, word [esi + 0xe]
mov word [edi + 0xe], ax
movzx eax, word [esi + 0x10]
mov word [edi + 0x10], ax
movzx eax, word [esi + 0x12]
mov word [edi + 0x12], ax
movzx eax, word [esi + 0x14]
mov word [edi + 0x14], ax
movzx eax, word [esi + 0x16]
mov word [edi + 0x16], ax
movzx eax, word [esi + 0x18]
mov word [edi + 0x18], ax
movzx eax, word [esi + 0x1a]
mov word [edi + 0x1a], ax
movzx eax, byte [esi + 0x1c]
mov byte [edi + 0x1c], al
mov eax, dword [esi + 0x1d]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x21]
mov dword [edi + 0x24], eax
movzx eax, byte [esi + 0x25]
mov byte [edi + 0x28], al
movzx eax, byte [esi + 0x26]
mov byte [edi + 0x29], al
movzx eax, byte [esi + 0x27]
mov byte [edi + 0x2a], al
mov eax, dword [esi + 0x28]
push eax
mov dword [edi + 0x2c], eax
lea eax, [ebp + 8]
push edx
push eax
call fcn.00408270
mov ecx, dword [ebp + 8]
add esp, 0xc
mov eax, dword [ecx + esi]
mov dword [edi + 0x48], eax
movzx eax, word [ecx + esi + 4]
mov word [edi + 0x4c], ax
movzx eax, byte [ecx + esi + 6]
mov byte [edi + 0x4e], al
mov eax, dword [ecx + esi + 7]
mov dword [edi + 0x50], eax
mov eax, dword [ecx + esi + 0xb]
mov dword [edi + 0x54], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x418a40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5adf38
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x627490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x5c], 0
call fcn.0043df90
push 0x5fc124
lea edx, [ebp - 0x58]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.004098a0
add esp, 4
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x40]
call fcn.0042c510
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov edx, 0x5fb8f7
push 0
cmovae ecx, dword [ebp - 0x28]
call fcn.00405ec0
add esp, 4
test eax, eax
jne 0x418af2
cmp dword [ebp - 0x18], eax
setne al
test eax, eax
jne 0x418af2
push eax
mov dword [esi + 0x14], 0xf
mov ecx, esi
mov dword [esi + 0x10], eax
push 0x5fb905
mov byte [esi], al
call fcn.00404be0
jmp 0x418b26
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418b1a
test al, 0x10
je 0x418b1a
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
call fcn.004044d0
jmp 0x418b26
push 0x5fb906
mov ecx, esi
call fcn.00404470
cmp dword [ebp - 0x14], 0x10
jb 0x418b37
push dword [ebp - 0x28]
call fcn.00448661
add esp, 4
cmp dword [ebp - 0x2c], 0x10
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jb 0x418b5a
push dword [ebp - 0x40]
call fcn.00448661
add esp, 4
cmp dword [ebp - 0x44], 0x10
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
jb 0x418b7d
push dword [ebp - 0x58]
call fcn.00448661
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570546
mov esp, ebp
pop ebp
ret
Function at 0x41be70
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [ecx + 0x130]
sub eax, dword [ecx + 0x134]
cmp eax, 0x28
jge 0x41be96
cmp byte [ecx + 0x61], 0
jne 0x41be96
cmp byte [ecx + 0x60], 0
je 0x41be96
mov byte [ecx + 0x60], 0
jmp fcn.00443000
ret