joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406a60
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x1a8
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x22b8
mov byte [esp + 0x2c], 0x3e
mov byte [esp + 0x2d], 0xf2
mov word [esp + 0x1c], 2
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x1a], ax
mov eax, dword [edi + 4]
xor esi, esi
xor ebx, ebx
test eax, eax
jle 0x406aef
mov ebp, dword [sym.imp.WS2_32.dll_sendto]
mov eax, dword [edi + 8]
lea ecx, [eax + ebx*8]
mov eax, dword [eax + ebx*8]
cmp eax, 0x100007f
je 0x406adf
test eax, eax
je 0x406adf
mov esi, dword [ecx + 4]
lea ecx, [esp + 0x18]
not esi
push 0x10
push ecx
or esi, eax
mov eax, dword [edi]
push 0
lea edx, [esp + 0x34]
push 2
push edx
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], 0x10
call ebp
cmp eax, 0xffffffff
je 0x406b2f
mov eax, dword [edi + 4]
inc ebx
cmp ebx, eax
jl 0x406a9e
test esi, esi
jne 0x406b94
mov edx, dword [edi + 4]
lea eax, [esp + 0x8c]
push edx
push 0x448e04
push eax
call fcn.00411f9c
add esp, 0xc
lea ecx, [esp + 0x8c]
push 0
push str.test
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x1a8
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, dword [edi + 8]
mov edx, dword [edi + 4]
mov ebp, eax
push edx
mov edx, dword [ecx + ebx*8]
lea eax, [ecx + ebx*8]
mov ecx, dword [ecx + ebx*8 + 4]
lea eax, [esp + 0x90]
push ecx
push edx
push esi
push ebx
push ebp
push 0x448dd0
push eax
call fcn.00411f9c
add esp, 0x20
lea ecx, [esp + 0x8c]
push 0
push str.test
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
cmp ebp, 0x2738
pop edi
pop esi
setne al
pop ebp
add eax, 0xfffffffe
pop ebx
add esp, 0x1a8
ret 8
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, dword [sym.imp.WS2_32.dll_recvfrom]
xor ebx, ebx
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 0xa
jg 0x406be4
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
mov edx, dword [edi]
push eax
push ebx
lea ecx, [esp + 0x34]
push 0x64
push ecx
push edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x2c], 0x10
call esi
cmp eax, 0xffffffff
jne 0x406c12
call ebp
cmp eax, 0x274c
jne 0x406bf6
inc dword [esp + 0x10]
jmp 0x406ba6
pop edi
pop esi
pop ebp
mov eax, 0xfffffffb
pop ebx
add esp, 0x1a8
ret 8
xor ecx, ecx
cmp eax, 0x2738
setne cl
pop edi
add ecx, 0xfffffffc
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x1a8
ret 8
mov edx, dword [esp + 0x1f]
mov eax, dword [esp + 0x1e]
mov ecx, dword [esp + 0x1d]
and edx, 0xff
push edx
mov edx, dword [esp + 0x20]
and eax, 0xff
and ecx, 0xff
push eax
mov eax, dword [esp + 0x1c4]
and edx, 0xff
push ecx
push edx
push str._d._d._d._d
push eax
call fcn.00411f9c
mov ecx, dword [esp + 0x32]
add esp, 0x18
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esp + 0x1c0]
and eax, 0xffff
pop edi
pop esi
mov dword [edx], eax
pop ebp
xor eax, eax
pop ebx
add esp, 0x1a8
ret 8
Function at 0x406d40
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x465690]
sub esp, 0x12c
test eax, eax
push esi
je 0x406d5a
xor eax, eax
pop esi
add esp, 0x12c
ret
mov esi, dword [esp + 0x134]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [0x465690], eax
jne 0x406d91
push esi
lea eax, [esp + 8]
push 0x446fec
push eax
call fcn.00411f9c
add esp, 0xc
mov eax, 0xfffffffe
pop esi
add esp, 0x12c
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.UDLL_CreateCUSBDevice
push eax
call esi
mov ecx, dword [0x465690]
push str.UDLL_DestroyCUSBDevice
push ecx
mov dword [0x465668], eax
call esi
mov edx, dword [0x465690]
push str.UDLL_GetDriveLetter
push edx
mov dword [0x46566c], eax
call esi
mov dword [0x465670], eax
mov eax, dword [0x465690]
push str.UDLL_GetLUNDriveLetter
push eax
call esi
mov ecx, dword [0x465690]
push str.UDLL_DeviceExist
push ecx
mov dword [0x465674], eax
call esi
mov edx, dword [0x465690]
push str.UDLL_GetSerialNumber
push edx
mov dword [0x465678], eax
call esi
mov dword [0x46567c], eax
mov eax, dword [0x465690]
push str.UDLL_GetHiddenArea1Size
push eax
call esi
mov ecx, dword [0x465690]
push str.UDLL_IsPasswordRegistered
push ecx
mov dword [0x465680], eax
call esi
mov edx, dword [0x465690]
push str.UDLL_WriteHiddenArea1
push edx
mov dword [0x465684], eax
call esi
mov dword [0x465688], eax
mov eax, dword [0x465690]
push str.UDLL_ReadHiddenArea1
push eax
call esi
mov edx, dword [0x465668]
or ecx, 0xffffffff
test edx, edx
mov dword [0x46568c], eax
je 0x406eb9
mov edx, dword [0x46566c]
test edx, edx
je 0x406eb9
mov edx, dword [0x465670]
test edx, edx
je 0x406eb9
mov edx, dword [0x465674]
test edx, edx
je 0x406eb9
mov edx, dword [0x465678]
test edx, edx
je 0x406eb9
mov edx, dword [0x46567c]
test edx, edx
je 0x406eb9
mov edx, dword [0x465680]
test edx, edx
je 0x406eb9
mov edx, dword [0x465684]
test edx, edx
je 0x406eb9
mov edx, dword [0x465688]
test edx, edx
je 0x406eb9
test eax, eax
je 0x406eb9
xor ecx, ecx
pop esi
mov eax, ecx
add esp, 0x12c
ret
mov dword [0x465690], 0
mov eax, ecx
pop esi
add esp, 0x12c
ret
Function at 0x407c50
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x130
lea eax, [esp + 4]
push ebx
push esi
push 0x465708
push str._sloglzerror.txt
push eax
call fcn.00411f9c
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0xc]
push 0
push 0x10000080
push 4
push 0
push 3
push 0xc0000000
push ecx
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407cd0
push 0x449160
call fcn.00411fee
add esp, 4
lea edx, [esp + 0xc]
push 0
push 0x10000080
push 4
push 0
push 3
push 0xc0000000
push edx
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407cd0
pop esi
mov eax, 1
pop ebx
add esp, 0x130
ret
push ebp
push edi
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esp + 0x144]
lea eax, [esp + 0x10]
push 0
push eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebx
call ebp
mov edi, 0x447514
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
lea edi, [esp + 0x18]
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebx
call ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
add esp, 0x130
ret

Function at 0x407fe0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x25c
lea ecx, [esp + 4]
push esi
push edi
push eax
push str.real_
push str.g:_temp_sheetdest_
push 0x449178
push ecx
call fcn.00411f9c
add esp, 0x14
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0xc]
push 0
push 0x10000080
push 4
push 0
push 3
push 0xc0000000
push edx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40806a
lea eax, [esp + 0xc]
push eax
call fcn.00423070
add esp, 4
lea ecx, [esp + 0xc]
push 0
push 0x10000080
push 4
push 0
push 3
push 0xc0000000
push ecx
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40806a
pop edi
mov eax, 1
pop esi
add esp, 0x25c
ret
mov edi, dword [esp + 0x26c]
push 0
mov eax, dword [edi + 0x130]
lea edx, [edi + 0x12c]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [edi + 0x134]
mov eax, dword [edi + 0x150]
lea ecx, [esp + 8]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x25c
ret
Function at 0x408970
Capabilities:
Get disk size

Disassembly:
sub esp, 0x144
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x158]
mov ebp, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov bl, 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
je 0x408a28
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
call ebp
test eax, eax
jne 0x4089ef
lea eax, [esi - 1]
test eax, eax
jl 0x4089aa
cmp byte [esp + eax + 0x28], bl
je 0x4089e8
dec eax
jns 0x4089dd
jmp 0x4089aa
mov byte [esp + eax + 0x28], 0
jmp 0x4089aa
mov edx, dword [esp + 0x15c]
test edx, edx
je 0x408a1b
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x144
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x144
ret
Function at 0x408a40
Capabilities:
Get disk size

Disassembly:
sub esp, 0x270
lea eax, [esp + 0x18]
push esi
push str.g:_temp_sheetdest_
push 0x446f04
push eax
call fcn.00411f9c
mov esi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push ecx
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
call esi
test eax, eax
jne 0x408b04
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x408ac3
lea edx, [esp + 0x148]
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.00408970
add esp, 8
test eax, eax
jne 0x408ac3
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push ecx
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x150]
push eax
push ecx
call esi
test eax, eax
jne 0x408b04
lea edx, [esp + 0x1c]
lea eax, [esp + 0x1c]
push edx
push 0x465340
push eax
call fcn.00411f9c
mov edx, dword [esp + 0x284]
add esp, 0xc
lea ecx, [esp + 0x1c]
push 0x1000
push 0x448c90
push ecx
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
pop esi
add esp, 0x270
ret
push ebx
mov ebx, dword [esp + 8]
mov ecx, 0x448ff4
push edi
mov edi, dword [esp + 0x10]
or esi, 0xffffffff
sub ecx, 0x10
mov eax, dword [ecx + 0xc]
add ecx, 0x10
inc esi
test eax, eax
je 0x408b91
mov eax, dword [ecx]
cdq
cmp edi, edx
ja 0x408b19
jb 0x408b31
cmp ebx, eax
ja 0x408b19
mov eax, dword [ecx + 4]
cdq
cmp edi, edx
jb 0x408b19
ja 0x408b3f
cmp ebx, eax
jb 0x408b19
mov ecx, dword [esp + 0x18]
shl esi, 4
mov eax, dword [esi + 0x448ffc]
cdq
cmp ecx, edx
ja 0x408b91
jb 0x408b5b
mov edx, dword [esp + 0x14]
cmp edx, eax
jae 0x408b91
mov eax, dword [esi + 0x449000]
lea ecx, [esp + 0x24]
push eax
push 0x4653a4
push ecx
call fcn.00411f9c
mov eax, dword [esp + 0x28c]
add esp, 0xc
lea edx, [esp + 0x24]
push 0x1000
push 0x448c90
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0x270
ret

Function at 0x408ba0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x144
lea eax, [esp + 0x18]
push str.g:_temp_sheetdest_
push 0x446f04
push eax
call fcn.00411f9c
add esp, 0xc
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
lea eax, [esp]
push ecx
push edx
lea ecx, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x408bef
lea edx, [esp + 0x18]
push 0x4654d0
push edx
call fcn.00411f9c
add esp, 8
jmp 0x408c30
mov edx, dword [esp + 4]
mov eax, dword [esp + 0x150]
cmp edx, eax
mov eax, dword [esp]
ja 0x408c4d
jb 0x408c0d
cmp eax, dword [esp + 0x14c]
jae 0x408c4d
mov ecx, 0x14
call fcn.00412eb0
push edx
push eax
push 0x447030
lea edx, [esp + 0x24]
push 0x4491ec
push edx
call fcn.00411f9c
add esp, 0x14
mov ecx, dword [esp + 0x148]
push 0x1000
lea eax, [esp + 0x1c]
push 0x448c90
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
add esp, 0x144
ret
Function at 0x41201a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41203a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004146bd
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x41205d
test byte [esp + 8], 2
je 0x41205d
call fcn.00414730
mov dword [eax], 0xd
call fcn.00414739
mov dword [eax], 5
jmp 0x412036
xor eax, eax
ret

Function at 0x416d59
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x44a5b0
cmp edx, dword [eax]
je 0x416d7b
add eax, 8
inc ecx
cmp eax, 0x44a640
jl 0x416d6c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x44a5b0]
jne 0x416ea9
mov eax, dword [0x467978]
cmp eax, 1
je 0x416e83
test eax, eax
jne 0x416dac
cmp dword [0x44a174], 1
je 0x416e83
cmp edx, 0xfc
je 0x416ea9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x416de3
lea eax, [ebp - 0x1a4]
push 0x43e71c
push eax
call fcn.00415360
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00417b40
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x416e26
lea eax, [ebp - 0x1a4]
push eax
call fcn.00417b40
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x43e718
push edi
call fcn.00419ae0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x43e6fc
push eax
call fcn.00415360
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00415370
lea eax, [ebp - 0xa0]
push 0x43e6f8
push eax
call fcn.00415370
push dword [esi + 0x44a5b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00415370
push 0x12010
lea eax, [ebp - 0xa0]
push 0x43e6d0
push eax
call fcn.00419a4e
add esp, 0x2c
pop edi
jmp 0x416ea9
lea eax, [ebp + 8]
lea esi, [esi + 0x44a5b4]
push 0
push eax
push dword [esi]
call fcn.00417b40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x41e2b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
sub eax, 0
je 0x41e360
dec eax
je 0x41e339
dec eax
je 0x41e2e5
xor eax, eax
add esp, 0x94
ret
mov ecx, dword [esp + 4]
cmp ecx, 3
jne 0x41e2fa
mov eax, 4
add esp, 0x94
ret
cmp ecx, 4
jne 0x41e30b
mov eax, 5
add esp, 0x94
ret
cmp ecx, 5
mov eax, 6
jne 0x41e365
mov eax, dword [esp + 8]
sub eax, 0
je 0x41e321
dec eax
je 0x41e32d
mov eax, 6
add esp, 0x94
ret
mov eax, 8
add esp, 0x94
ret
mov eax, dword [esp + 8]
test eax, eax
jne 0x41e34d
mov eax, 2
add esp, 0x94
ret
sub eax, 0x5a
neg eax
sbb eax, eax
and al, 0xfc
add eax, 7
add esp, 0x94
ret
mov eax, 1
add esp, 0x94
ret
Function at 0x41ff00
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_send]
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x1c]
sub eax, esi
test eax, eax
jle 0x41ff59
mov ecx, dword [edi + 0xc]
push 0
push eax
lea eax, [esi + ebx]
push eax
push ecx
call ebp
cmp eax, 0xffffffff
je 0x41ff51
test eax, eax
je 0x41ff3b
add esi, eax
jmp 0x41ff17
push 0
push 0x44b654
push 0x44b64c
push 0
call fcn.0041f260
add esp, 0x10
mov dword [esp + 0x10], 0xffffd8ec
push 0
call fcn.0041298a
add esp, 4
mov dword [edi + 0x14c], eax
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x41ff80
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 4]
mov dword [esp + 4], 0x3e8
test eax, eax
jle 0x41ff94
mov dword [esp + 4], eax
mov ecx, dword [ecx + 0xc]
lea eax, [esp + 4]
push 4
push eax
push 0x1006
push 0xffff
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
inc eax
neg eax
sbb eax, eax
and eax, 3
add eax, 0xfffffffd
ret 4
Function at 0x4205f0
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x13c
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov edi, dword [ebx + 0x1c8]
lea eax, [ebx + 0x158]
xor esi, esi
push eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [edi + 0x4738], 1
cmp dword [ebx + 0x178], esi
je 0x420696
mov eax, dword [ebx + 0x174]
mov ebp, dword [eax]
mov eax, dword [ebx + 0x178]
dec eax
je 0x42065f
mov ecx, dword [ebx + 0x174]
lea edx, [eax*4]
push edx
lea eax, [ecx + 4]
push eax
push ecx
call fcn.00412280
add esp, 0xc
mov ecx, dword [ebx + 0x178]
dec ecx
cmp ebp, esi
mov dword [ebx + 0x178], ecx
je 0x42062b
cmp dword [ebp], esi
jne 0x4206a1
push ebp
call fcn.0042d40c
mov eax, dword [ebx + 0xc]
add esp, 4
cmp eax, 0xffffffff
je 0x42068d
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebx + 0xc], 0xffffffff
jmp 0x42062b
mov dword [edi + 0x4730], esi
jmp 0x4207ac
mov edx, edi
xor ecx, ecx
mov dword [edi + 0x4730], 1
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov eax, dword [ebp]
cmp eax, 0x4710
jle 0x4206f0
push eax
push 0x4710
lea eax, [esp + 0x28]
push str.Max:_d__clen:_d
push eax
call fcn.00411f9c
push esi
lea ecx, [esp + 0x34]
push str.too_big
push ecx
push esi
call fcn.0041f260
add esp, 0x20
mov ecx, dword [ebp]
mov edi, dword [edi + 0x18]
mov edx, ecx
lea esi, [ebp + 4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x20]
mov eax, dword [ebp]
lea edi, [esi + 0x14]
mov dword [edi], eax
call fcn.0042d40c
push 0
call fcn.0041298a
add esp, 8
mov dword [ebx + 0x14c], eax
push 0x467da8
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edx, dword [ebx + 0xc]
push 0
push esi
lea ecx, [esp + 0x1c]
push 0
mov ebp, 1
push ecx
push ebp
push edi
push edx
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x4207ac
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x4207ac
cmp eax, 0x2744
jle 0x42077b
cmp eax, 0x2746
jg 0x42077b
mov dword [esi + 0x4730], 0
jmp 0x4207a8
push eax
mov eax, dword [esi + 0x4740]
push eax
lea ecx, [esp + 0x28]
push str._d_send_err___d_n
push ecx
call fcn.00411f9c
push 0
lea edx, [esp + 0x34]
push str.kfskd
push edx
push 0
call fcn.0041f260
add esp, 0x20
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x13c
ret
Function at 0x421170
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x467dac]
mov edx, dword [0x467db0]
push esi
mov ecx, eax
xor esi, esi
sub ecx, edx
jne 0x4211f9
cmp eax, 0x14
jge 0x4211f9
mov eax, dword [0x467db8]
push esi
cmp eax, esi
jne 0x4211a6
call fcn.0041298a
add esp, 4
mov dword [0x467db8], eax
mov eax, esi
pop esi
pop ecx
ret
call fcn.0041298a
mov ecx, dword [0x467db8]
add esp, 4
sub eax, ecx
cmp eax, 2
jl 0x4211ff
cmp ecx, esi
je 0x4211ff
mov eax, dword [esp + 0xc]
lea edx, [esp + 4]
push edx
push esi
push eax
push 0x4214e0
push esi
push esi
mov dword [0x467db8], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4211f1
push 0x467dac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, esi
pop esi
pop ecx
ret
mov eax, 1
pop esi
pop ecx
ret
mov dword [0x467db8], esi
mov eax, esi
pop esi
pop ecx
ret

Function at 0x421770
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x134
push ebx
push esi
mov esi, dword [esp + 0x140]
push edi
mov edx, esi
xor ecx, ecx
mov edi, dword [esi + 0x4748]
lea eax, [esi + 0x14]
xor ebx, ebx
mov dword [eax], 0x4710
mov dword [edx], ecx
push ebx
push esi
mov dword [edx + 4], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push 1
push eax
mov eax, dword [esi + 0x4740]
push eax
call dword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x421853
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x421853
cmp eax, 0x2744
jle 0x421828
cmp eax, 0x2746
jg 0x421828
lea ecx, [edi + 8]
mov dword [esi + 0x4734], 1
push ecx
mov dword [esi + 0x4730], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp edi, ebx
je 0x421819
mov ecx, edi
call fcn.0041f700
push edi
call fcn.0042d40c
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x134
ret
mov edx, dword [esi + 0x4740]
push eax
push edx
lea eax, [esp + 0x1c]
push str._d_recv_err___d_n
push eax
call fcn.00411f9c
push ebx
lea ecx, [esp + 0x28]
push str.kfskd
push ecx
push ebx
call fcn.0041f260
add esp, 0x20
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x134
ret
Function at 0x422c40
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
sub eax, 0
je 0x422d2b
dec eax
je 0x422cfa
dec eax
je 0x422c7e
xor eax, eax
mov dword [0x467e28], eax
add esp, 0x94
ret
mov ecx, dword [esp + 4]
cmp ecx, 3
jne 0x422c98
mov eax, 4
mov dword [0x467e28], eax
add esp, 0x94
ret
cmp ecx, 4
jne 0x422cae
mov eax, 5
mov dword [0x467e28], eax
add esp, 0x94
ret
cmp ecx, 5
mov eax, 6
jne 0x422d30
mov eax, dword [esp + 8]
sub eax, 0
je 0x422cc7
dec eax
je 0x422ce9
dec eax
je 0x422cd8
mov eax, 6
mov dword [0x467e28], eax
add esp, 0x94
ret
mov eax, 9
mov dword [0x467e28], eax
add esp, 0x94
ret
mov eax, 8
mov dword [0x467e28], eax
add esp, 0x94
ret
mov eax, dword [esp + 8]
test eax, eax
jne 0x422d13
mov eax, 2
mov dword [0x467e28], eax
add esp, 0x94
ret
sub eax, 0x5a
neg eax
sbb eax, eax
and al, 0xfc
add eax, 7
mov dword [0x467e28], eax
add esp, 0x94
ret
mov eax, 1
mov dword [0x467e28], eax
add esp, 0x94
ret

Function at 0x4231e0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
test eax, eax
je 0x4231f9
push esi
call fcn.00412a66
add esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x90000080
push 3
push 0
push 3
push closesocket
push esi
call ebp
cmp eax, 0xffffffff
je 0x423227
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
call fcn.00435e4f
mov edi, dword [eax + 8]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x42324e
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x423262
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
mov dword [esp + 0x20], eax
jne 0x423279
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
push 0
push 0x90000080
push 2
push 0
push 3
push 0xc0000000
push esi
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x4232c7
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0
push 0
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push 0
push edx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret