joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415640
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [edi]
push eax
call sub.WS2_32.dll_ntohl
mov ecx, dword [edi + 4]
mov esi, eax
push ecx
call sub.WS2_32.dll_ntohl
mov ebx, dword [esp + 0x20]
mov edi, eax
mov edx, dword [ebx]
push edx
call sub.WS2_32.dll_ntohl
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 4]
push eax
call sub.WS2_32.dll_ntohl
mov ecx, dword [ebx + 8]
mov dword [esp + 0x1c], eax
push ecx
call sub.WS2_32.dll_ntohl
mov edx, dword [ebx + 0xc]
mov dword [esp + 0x14], eax
push edx
call sub.WS2_32.dll_ntohl
mov dword [esp + 0x10], eax
xor ecx, ecx
mov edx, 0x10
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov eax, edi
sub ecx, 0x61c88647
shr eax, 5
add eax, ebx
mov ebx, edi
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x14]
xor eax, ebx
lea ebx, [ecx + edi]
xor eax, ebx
mov ebx, dword [esp + 0x10]
add esi, eax
mov eax, esi
shr eax, 5
add eax, ebx
mov ebx, esi
shl ebx, 4
add ebx, ebp
xor eax, ebx
lea ebx, [ecx + esi]
xor eax, ebx
add edi, eax
dec edx
jne 0x41569e
push esi
call sub.WS2_32.dll_htonl
mov esi, dword [esp + 0x24]
push edi
mov dword [esi], eax
call sub.WS2_32.dll_htonl
mov dword [esi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x415740
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
push esi
call fcn.00415710
add esi, 4
mov edi, eax
push esi
call fcn.00415710
mov ebx, dword [esp + 0x28]
add esp, 8
mov esi, eax
mov eax, dword [ebx]
push eax
call sub.WS2_32.dll_ntohl
mov ecx, dword [ebx + 4]
mov dword [esp + 0x14], eax
push ecx
call sub.WS2_32.dll_ntohl
mov edx, dword [ebx + 8]
mov dword [esp + 0x10], eax
push edx
call sub.WS2_32.dll_ntohl
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0xc]
push eax
call sub.WS2_32.dll_ntohl
mov dword [esp + 0x1c], eax
mov ecx, 0xe3779b90
mov edx, 0x10
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov eax, edi
shr eax, 5
add eax, ebx
mov ebx, edi
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x14]
xor eax, ebx
lea ebx, [ecx + edi]
xor eax, ebx
mov ebx, dword [esp + 0x10]
sub esi, eax
mov eax, esi
shr eax, 5
add eax, ebx
mov ebx, esi
shl ebx, 4
add ebx, ebp
xor eax, ebx
lea ebx, [ecx + esi]
xor eax, ebx
add ecx, 0x61c88647
sub edi, eax
dec edx
jne 0x4157a2
push edi
call sub.WS2_32.dll_htonl
mov edi, dword [esp + 0x24]
push esi
mov dword [edi], eax
call sub.WS2_32.dll_htonl
mov dword [edi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x415eb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0xc]
cmp esi, 1
jge 0x415ebf
or eax, 0xffffffff
pop esi
ret
xor eax, eax
xor ecx, ecx
test esi, esi
je 0x415ef3
push ebx
push edi
mov edi, dword [esp + 0x10]
mov dl, byte [ecx + edi]
mov ebx, eax
and edx, 0xff
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x45b920]
xor eax, edx
inc ecx
cmp ecx, esi
jne 0x415ecd
pop edi
pop ebx
not eax
pop esi
ret

Function at 0x415f00
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
mov eax, 0x1000
call fcn.00444850
mov eax, dword [esp + 0x1004]
push ebp
push esi
push 0x462258
push eax
xor esi, esi
call dword [sym.imp.MSVCRT.dll__wfopen]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x415ff5
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
push ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x1000
lea ecx, [esp + 0x14]
push 1
push ecx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
test eax, eax
je 0x415fea
push ebx
mov ebx, dword [esp + 0x1018]
test bl, bl
jne 0x415f97
xor ecx, ecx
test eax, eax
jle 0x415fcf
xor edx, edx
mov edi, esi
mov dl, byte [esp + ecx + 0x10]
and edi, 0xff
xor edx, edi
shr esi, 8
mov edx, dword [edx*4 + 0x45b920]
xor esi, edx
inc ecx
cmp ecx, eax
jl 0x415f74
jmp 0x415fcf
xor ecx, ecx
test eax, eax
jle 0x415fcf
mov edi, ebx
and edi, 0xff
xor edx, edx
mov ebx, esi
mov dl, byte [esp + ecx + 0x10]
and ebx, 0xff
xor edx, ebx
xor edx, edi
shr esi, 8
mov edx, dword [edx*4 + 0x45b920]
xor esi, edx
inc ecx
cmp ecx, eax
jl 0x415fa5
mov ebx, dword [esp + 0x1018]
push ebp
push 0x1000
lea eax, [esp + 0x18]
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
test eax, eax
jne 0x415f6a
pop ebx
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop edi
mov eax, esi
pop esi
not eax
pop ebp
add esp, 0x1000
ret
Function at 0x4175e0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x4182d0
Capabilities:
Encode data using xor
Hash data with md5
Read file on windows

Disassembly:
mov eax, 0x1058
call fcn.00444850
lea eax, [esp]
push esi
push eax
call fcn.004175e0
mov ecx, dword [esp + 0x1064]
push 0x462258
push ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x41840a
push ebx
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x65]
mov byte [esp + 0x64], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
push 0x1000
stosb byte es:[edi], al
mov edi, dword [sym.imp.MSVCRT.dll_fread]
lea edx, [esp + 0x6c]
push 1
push edx
call edi
add esp, 0x10
test eax, eax
je 0x4183ae
mov bl, byte [esp + 0x1070]
test bl, bl
je 0x418388
xor ecx, ecx
test eax, eax
jle 0x418388
mov dl, byte [esp + ecx + 0x64]
xor dl, bl
mov byte [esp + ecx + 0x64], dl
inc ecx
cmp ecx, eax
jl 0x418379
push eax
lea eax, [esp + 0x68]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00417610
push esi
push 0x1000
lea edx, [esp + 0x78]
push 1
push edx
call edi
add esp, 0x1c
test eax, eax
jne 0x41836f
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x64]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x64]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.00418060
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov edi, dword [esp + 0x1078]
mov ebx, dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
xor esi, esi
xor edx, edx
mov dl, byte [esp + esi + 0x64]
push edx
push str._02hhx
push edi
call ebx
add esp, 0xc
inc esi
add edi, 2
cmp esi, 0x10
jl 0x4183e3
pop edi
pop ebx
mov al, 1
pop esi
add esp, 0x1058
ret
xor al, al
pop esi
add esp, 0x1058
ret
Function at 0x418610
Capabilities:
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x458bc9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
mov ebx, dword [esp + 0x6c]
push esi
push edi
lea eax, [esp + 0x10]
xor esi, esi
push ebx
push eax
mov dword [esp + 0x14], esi
call fcn.004184a0
add esp, 8
mov eax, dword [esp + 0x18]
mov dword [esp + 0x68], esi
cmp eax, esi
je 0x4186c3
mov edi, dword [esp + 0x70]
mov cl, byte [esp + 0x10]
mov byte [edi], cl
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
mov edx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea ecx, [esp + 0x10]
mov eax, dword [edx]
push eax
push esi
push ecx
mov ecx, edi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
mov ecx, dword [esp + 0x14]
cmp ecx, esi
je 0x4186af
mov al, byte [ecx - 1]
test al, al
je 0x4186a5
cmp al, 0xff
je 0x4186a5
dec al
mov byte [ecx - 1], al
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
stosb byte es:[edi], al
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, esi
je 0x418705
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea edx, [esp + 0x24]
push 0x46441c
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov al, byte [esp + 0x70]
push ebp
mov ebp, dword [esp + 0x74]
lea edi, [esp + 0x24]
or ecx, 0xffffffff
push 1
mov byte [ebp], al
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp + 4], esi
mov ebx, ecx
mov ecx, ebp
push ebx
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x41875c
mov edi, dword [ebp + 4]
mov ecx, ebx
mov edx, ecx
lea esi, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 4]
mov dword [ebp + 8], ebx
xor esi, esi
mov byte [eax + ebx], 0
mov ecx, dword [esp + 0x18]
cmp ecx, esi
je 0x418780
mov al, byte [ecx - 1]
test al, al
je 0x418776
cmp al, 0xff
je 0x418776
dec al
mov byte [ecx - 1], al
jmp 0x418780
dec ecx
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x64]
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x60
ret
Function at 0x418c70
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x30
mov al, byte [0x4676a4]
push ebx
push esi
xor ebx, ebx
mov esi, 1
cmp al, 0xfb
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x10], ebx
mov byte [esp + 0x18], al
jne 0x418cac
push ebx
jmp 0x418cc1
cmp al, 0xfc
jne 0x418cb3
push esi
jmp 0x418cc1
cmp al, 0xfd
jne 0x418cbb
push 2
jmp 0x418cc1
cmp al, 0xfe
jne 0x418ccd
push 3
call fcn.004233a0
add esp, 4
mov byte [esp + 0x18], al
mov ax, word [0x46444c]
push eax
call fcn.004233d0
mov cx, word [0x467694]
mov dl, byte [0x46444e]
mov word [esp + 0x1a], ax
mov eax, dword [esp + 0x48]
mov word [esp + 0x18], cx
mov byte [esp + 0x1d], dl
push 0x464420
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x48]
push 2
lea edx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], ebx
mov dword [esp + 0x48], eax
mov dword [esp + 0x1c], ebx
call fcn.00423b10
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x418d3b
pop esi
xor al, al
pop ebx
add esp, 0x30
ret
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
mov al, byte [0x464455]
cmp al, bl
jne 0x418d59
lea ecx, [esp + 0xc]
push ecx
call fcn.00418860
add esp, 4
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_send]
push edi
mov edi, dword [esp + 0x44]
push ebx
lea edx, [esp + 0x18]
mov eax, dword [edi]
push 4
push edx
push eax
call ebp
mov ecx, dword [esp + 0x10]
mov edx, dword [edi]
push ebx
push ecx
push esi
push edx
call ebp
push esi
mov edi, eax
call sub.MFC42.DLL_operatordelete
mov eax, dword [esp + 0x14]
add esp, 4
cmp edi, eax
pop edi
pop ebp
pop esi
pop ebx
sete al
add esp, 0x30
ret
Function at 0x418e80
Capabilities:
Send data
Send data on socket

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x58
lea eax, [esp + 0x30]
lea ecx, [esp + 4]
push ebx
push ebp
push esi
push eax
push ecx
push edx
mov ecx, 0x4675e8
call fcn.004194f0
test al, al
jne 0x418ead
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x58
ret
mov al, byte [0x4676a4]
xor ebx, ebx
mov esi, 1
cmp al, 0xfb
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x1c], al
jne 0x418ee4
push ebx
jmp 0x418ef9
cmp al, 0xfc
jne 0x418eeb
push esi
jmp 0x418ef9
cmp al, 0xfd
jne 0x418ef3
push 2
jmp 0x418ef9
cmp al, 0xfe
jne 0x418f05
push 3
call fcn.004233a0
add esp, 4
mov byte [esp + 0x1c], al
mov ax, word [0x46444c]
push eax
call fcn.004233d0
mov cx, word [0x467694]
mov dl, byte [0x46444e]
mov ebp, dword [esp + 0x74]
mov word [esp + 0x1e], ax
mov eax, dword [esp + 0x70]
mov word [esp + 0x1c], cx
lea ecx, [esp + 0x40]
mov byte [esp + 0x21], dl
mov dword [esp + 0x3c], eax
push ecx
lea edx, [esp + 0x70]
push 3
lea eax, [esp + 0x20]
push edx
push eax
mov dword [esp + 0x48], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], ebx
mov dword [esp + 0x7c], ebx
call fcn.00423b10
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x418f74
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x58
ret
mov al, byte [0x464455]
mov ecx, dword [esp + 0x68]
cmp al, bl
mov dword [esp + 0xc], ecx
jne 0x418f92
lea edx, [esp + 0xc]
push edx
call fcn.00418860
add esp, 4
mov ecx, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.WS2_32.dll_send]
push ebx
lea eax, [esp + 0x14]
push 4
push eax
push ecx
call edi
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x14]
push ebx
push edx
push esi
push eax
call edi
push esi
mov edi, eax
call sub.MFC42.DLL_operatordelete
mov eax, dword [esp + 0x70]
add esp, 4
cmp edi, eax
jne 0x418fcb
mov edi, ebp
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
Function at 0x418fe0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov dword [esp + 0x10], 4
xor esi, esi
mov ecx, dword [ebp]
push 0
lea eax, [esp + esi + 0x1c]
push 1
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
jne 0x41909f
inc esi
cmp esi, 4
jb 0x418ff3
mov cl, byte [0x464455]
mov eax, dword [esp + 0x18]
test cl, cl
mov dword [esp + 0x10], eax
jne 0x419038
lea edx, [esp + 0x10]
push edx
call fcn.00418890
mov eax, dword [esp + 0x14]
add esp, 4
cmp eax, 0x6400000
jbe 0x419047
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
inc eax
push eax
call sub.MFC42.DLL_operatornew
mov edx, dword [esp + 0x14]
mov edi, eax
add esp, 4
xor esi, esi
mov byte [edi + edx], 0
mov ebx, dword [esp + 0x10]
test ebx, ebx
jbe 0x41908e
mov ecx, dword [ebp]
push 0
lea eax, [esi + edi]
push ebx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x419096
mov ecx, dword [esp + 0x10]
add esi, eax
cmp esi, ecx
jae 0x41908e
sub ebx, eax
jne 0x41906b
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push edi
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x419830
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x2c
mov al, byte [0x4676a4]
push esi
push edi
xor edi, edi
mov esi, 1
cmp al, 0xfb
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0xc], edi
mov byte [esp + 0x14], al
jne 0x41986c
push edi
jmp 0x419881
cmp al, 0xfc
jne 0x419873
push esi
jmp 0x419881
cmp al, 0xfd
jne 0x41987b
push 2
jmp 0x419881
cmp al, 0xfe
jne 0x41988d
push 3
call fcn.004233a0
add esp, 4
mov byte [esp + 0x14], al
mov ax, word [0x46444c]
push eax
call fcn.004233d0
mov cx, word [0x467694]
mov dl, byte [0x46444e]
mov word [esp + 0x16], ax
mov eax, dword [esp + 0x44]
mov word [esp + 0x14], cx
mov byte [esp + 0x19], dl
push eax
lea ecx, [esp + 0x10]
push edi
lea edx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x40], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x1c], edi
call fcn.00423b10
mov esi, eax
add esp, 0x14
cmp esi, edi
je 0x41992c
mov edi, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_sendto]
mov dword [esp + 0x48], 3
mov eax, dword [esp + 0x10]
mov ecx, dword [ebx]
push 0x10
push edi
push 0
push eax
push esi
push ecx
call ebp
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x48]
dec eax
mov dword [esp + 0x48], eax
jne 0x4198fe
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x2c
ret 0xc
Function at 0x419d30
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x438
mov al, byte [0x4676a4]
push ebx
push ebp
xor ebx, ebx
mov ecx, 1
push esi
cmp al, 0xfb
push edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x24], al
jne 0x419d71
push ebx
jmp 0x419d86
cmp al, 0xfc
jne 0x419d78
push ecx
jmp 0x419d86
cmp al, 0xfd
jne 0x419d80
push 2
jmp 0x419d86
cmp al, 0xfe
jne 0x419d92
push 3
call fcn.004233a0
add esp, 4
mov byte [esp + 0x24], al
mov ax, word [0x46444c]
push eax
call fcn.004233d0
mov cx, word [0x467694]
mov dl, byte [0x46444e]
mov esi, dword [esp + 0x454]
mov edi, dword [esp + 0x450]
mov ebp, dword [sym.imp.WS2_32.dll_recvfrom]
add esp, 4
mov word [esp + 0x22], ax
mov word [esp + 0x20], cx
mov byte [esp + 0x25], dl
mov byte [esp + 0x13], bl
mov dword [esp + 0x44], 0x10
mov dword [esp + 0x18], 5
mov edx, dword [edi]
lea eax, [esp + 0x44]
push eax
push esi
push ebx
lea ecx, [esp + 0x54]
push 0x400
push ecx
push edx
call ebp
cmp eax, ebx
jle 0x419e8a
mov ecx, dword [esp + 0x458]
lea edx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x4c]
push edx
push ecx
push eax
call fcn.00423a20
add esp, 0x10
test al, al
je 0x419e8a
mov eax, dword [esp + 0x454]
mov ecx, dword [esp + 0x2c]
cmp ecx, eax
jne 0x419e8a
cmp eax, 8
je 0x419e3a
cmp eax, 1
jne 0x419e8a
mov eax, dword [esp + 0x40]
mov byte [esp + 0x13], 1
cmp eax, ebx
je 0x419e8a
cmp dword [esp + 0x1c], 4
jb 0x419e81
mov dword [esp + 0x14], ebx
mov edx, dword [eax]
mov al, byte [0x464455]
mov dword [esp + 0x14], edx
cmp al, bl
jne 0x419e6e
lea eax, [esp + 0x14]
push eax
call fcn.00418890
add esp, 4
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, 0x467630
call fcn.00420930
mov eax, dword [esp + 0x40]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x18], eax
jne 0x419de4
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x438
ret
Function at 0x419eb0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x34
mov al, byte [0x4676a4]
push ebx
push ebp
push esi
xor bl, bl
xor ebp, ebp
mov esi, 1
cmp al, 0xfb
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x18], ebp
mov byte [esp + 0x20], al
jne 0x419eef
push ebp
jmp 0x419f04
cmp al, 0xfc
jne 0x419ef6
push esi
jmp 0x419f04
cmp al, 0xfd
jne 0x419efe
push 2
jmp 0x419f04
cmp al, 0xfe
jne 0x419f10
push 3
call fcn.004233a0
add esp, 4
mov byte [esp + 0x20], al
mov ax, word [0x46444c]
push eax
call fcn.004233d0
mov cx, word [0x467694]
mov dl, byte [0x46444e]
mov word [esp + 0x22], ax
mov eax, dword [esp + 0x50]
mov word [esp + 0x20], cx
mov byte [esp + 0x25], dl
push eax
lea ecx, [esp + 0x14]
push 7
lea edx, [esp + 0x24]
push ecx
push edx
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], ebp
mov dword [esp + 0x20], ebp
call fcn.00423b10
add esp, 0x14
cmp eax, ebp
mov dword [esp + 0x14], eax
jne 0x419f75
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x34
ret
mov esi, dword [esp + 0x48]
push edi
mov edi, dword [esp + 0x48]
mov dword [esp + 0x14], ebp
jmp 0x419f88
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [edi]
push 0x10
push esi
push ebp
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jl 0x419fce
mov eax, dword [esp + 0x50]
push eax
push 8
push esi
push edi
call fcn.00419d30
mov bl, al
add esp, 0x10
test bl, bl
jne 0x419fce
push 0x28
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0xc8
mov dword [esp + 0x14], eax
jbe 0x419f84
mov ecx, dword [esp + 0x18]
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x41a3b0
Capabilities:
Create thread

Disassembly:
push esi
push 0x10
call sub.MFC42.DLL_operatornew
mov esi, eax
mov edx, dword [esp + 0xc]
mov ecx, esi
xor eax, eax
push edx
push 0x464434
mov dword [ecx], eax
push esi
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0
push 0
push esi
push 0x423570
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret

Function at 0x41d0e0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x2c
mov al, byte [0x4676a4]
push ebx
push esi
push edi
xor edi, edi
mov esi, 1
cmp al, 0xfb
mov ebx, ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], edi
mov byte [esp + 0x18], al
jne 0x41d11f
push edi
jmp 0x41d134
cmp al, 0xfc
jne 0x41d126
push esi
jmp 0x41d134
cmp al, 0xfd
jne 0x41d12e
push 2
jmp 0x41d134
cmp al, 0xfe
jne 0x41d140
push 3
call fcn.004233a0
add esp, 4
mov byte [esp + 0x18], al
mov ax, word [0x46444c]
push eax
call fcn.004233d0
mov cx, word [0x467694]
mov dl, byte [0x46444e]
mov word [esp + 0x1a], ax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x48]
mov word [esp + 0x18], cx
mov ecx, dword [esp + 0x44]
mov byte [esp + 0x1d], dl
mov dword [esp + 0x34], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
lea edx, [ebx + 0x48]
mov dword [esp + 0x38], ecx
push edx
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], edi
mov dword [esp + 0x20], edi
call fcn.00423b10
mov esi, eax
add esp, 0x14
cmp esi, edi
je 0x41d1d0
mov ecx, dword [esp + 0xc]
mov edx, dword [ebx + 0x30]
lea eax, [ebx + 0x34]
push 0x10
push eax
push edi
push ecx
push esi
push edx
call dword [sym.imp.WS2_32.dll_sendto]
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x2c
ret 0x10
Function at 0x41d1e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x18
lea eax, [esp + 0x10]
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x41d27b
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [esp + 0x14]
push ecx
call edi
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push edx
push eax
push 0
push ecx
call fcn.00444950
push 0
push 0x3e8
push edx
push eax
call fcn.00444890
push 0
push 0x3e8
push edx
push eax
call fcn.00444890
mov ebx, eax
mov eax, dword [esp + 0x18]
mov esi, edx
mov edx, dword [esp + 0x14]
test esi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
jl 0x41d27b
jg 0x41d256
test ebx, ebx
jbe 0x41d27b
lea ecx, [esp + 0xc]
push ecx
call edi
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
sub ecx, eax
mov eax, dword [esp + 0x10]
sbb eax, edx
cmp eax, esi
jl 0x41d256
jg 0x41d27b
cmp ecx, ebx
jb 0x41d256
pop edi
pop esi
pop ebx
add esp, 0x18
ret