joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4020f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x200
mov dword [ebp - 0x1ec], ecx
mov dword [ebp - 0x10c], 0x72646461
mov dword [ebp - 0x108], 0x65737365
mov dword [ebp - 0x104], 0x62772e73
mov dword [ebp - 0x100], 0x78
lea ebx, [ebp - 0xfc]
mov eax, 0
mov edx, 0x3d
mov edi, ebx
mov ecx, edx
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0x58
mov dword [esp + 4], 0
lea eax, [ebp - 0x1e4]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x1e4], 0x58
mov eax, dword [ebp - 0x1ec]
mov ecx, eax
call fcn.004142bc
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x1d8], str.WinBox_Loader_Addresses
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1cc], 1
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1c4], 0x104
mov dword [ebp - 0x1c0], 0
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x1b4], str.Import_Addresses_From
mov dword [ebp - 0x1b0], 0x1004
mov dword [ebp - 0x1a8], str..wbx
lea eax, [ebp - 0x1e4]
mov dword [esp], eax
call sub.COMDLG32.DLL_GetOpenFileNameA
sub esp, 4
test eax, eax
sete al
test al, al
je 0x402239
mov dword [esp], str.GetOpenFileName_failed
call sub.msvcrt.dll_puts
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call sub.msvcrt.dll_fflush
jmp 0x4022c7
mov eax, dword [ebp - 0x1ec]
mov dword [esp + 4], 1
lea edx, [ebp - 0x10c]
mov dword [esp], edx
mov ecx, eax
call fcn.00402a4c
sub esp, 8
xor eax, 1
test al, al
je 0x4022c7
movzx eax, word [ebp - 0x1ac]
movzx eax, ax
lea edx, [ebp - 0x10c]
add eax, edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Could_not_import_addresses_from__s___bad_file_
mov dword [esp + 4], pe_nt_image_headers32
lea eax, [ebp - 0x18c]
mov dword [esp], eax
call sub.msvcrt.dll__snprintf
mov eax, dword [ebp - 0x1ec]
mov ecx, eax
call fcn.004142bc
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Import_Error
lea edx, [ebp - 0x18c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x402852
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0x40], al
mov dword [esp + 4], 0x4161d5
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x402887
mov eax, 0
jmp 0x4029b5
mov dword [ebp - 0x14], 0xbec0100f
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 4
lea eax, [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, 1
setne al
test al, al
je 0x4028c6
mov dword [esp], str.ERROR:_could_not_write_magic
call sub.msvcrt.dll_puts
movzx eax, byte [ebp - 0x40]
xor eax, 1
test al, al
je 0x40290b
lea eax, [ebp - 0x20]
mov ecx, eax
call fcn.00414424
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x20]
mov dword [esp], edx
mov ecx, eax
call fcn.0040260c
sub esp, 4
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov dword [esp], edx
mov ecx, eax
call fcn.00405bf8
sub esp, 4
lea eax, [ebp - 0x20]
mov ecx, eax
call fcn.00405818
mov dword [ebp - 0xc], 0
jmp 0x40298a
lea eax, [ebp - 0x2c]
mov ecx, eax
call fcn.00414424
lea eax, [ebp - 0x2c]
mov dword [esp + 4], str.addr
mov dword [esp], str.type
mov ecx, eax
call fcn.00405a74
sub esp, 8
mov eax, dword [ebp - 0x3c]
lea edx, [eax + 0x28]
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov ecx, edx
call fcn.00414250
sub esp, 4
mov edx, dword [eax]
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], edx
lea edx, [ebp - 0x2c]
mov dword [esp], edx
mov ecx, eax
call fcn.004022da
sub esp, 8
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
mov dword [esp], edx
mov ecx, eax
call fcn.00405bf8
sub esp, 4
lea eax, [ebp - 0x2c]
mov ecx, eax
call fcn.00405818
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x3c]
add eax, 0x28
mov ecx, eax
call fcn.00414588
cmp eax, dword [ebp - 0xc]
seta al
test al, al
jne 0x402914
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, 1
leave
ret 8
Function at 0x402a4c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x54
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0x40], al
mov dword [esp + 4], 0x416208
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402bc8
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 4
lea eax, [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov eax, dword [ebp - 0x14]
cmp eax, 0xbec0100f
jne 0x402bc8
jmp 0x402b85
lea eax, [ebp - 0x20]
mov ecx, eax
call fcn.00414424
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov dword [esp], edx
mov ecx, eax
call fcn.00405dea
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x402ae8
mov ebx, 0
jmp 0x402b75
lea eax, [ebp - 0x20]
mov dword [esp + 8], 0x10
lea edx, [ebp - 0x30]
mov dword [esp + 4], edx
mov dword [esp], str.type
mov ecx, eax
call fcn.00405aaa
sub esp, 0xc
test al, al
je 0x402b70
mov dword [esp + 4], str.addr
lea eax, [ebp - 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x402b3b
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x20]
mov dword [esp], edx
mov ecx, eax
call fcn.004025ae
sub esp, 4
jmp 0x402b70
movzx eax, byte [ebp - 0x40]
xor eax, 1
test al, al
je 0x402b70
mov dword [esp + 4], str.window
lea eax, [ebp - 0x30]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x402b70
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x20]
mov dword [esp], edx
mov ecx, eax
call fcn.00402778
sub esp, 4
mov ebx, 1
lea eax, [ebp - 0x20]
mov ecx, eax
call fcn.00405818
cmp ebx, 1
jne 0x402bb7
nop
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00414600
test eax, eax
jne 0x402baa
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00414610
test eax, eax
jne 0x402baa
mov eax, 1
jmp 0x402baf
mov eax, 0
test al, al
jne 0x402ab8
mov eax, dword [ebp - 0x3c]
mov ecx, eax
call fcn.00402e16
mov eax, 1
jmp 0x402bcd
mov eax, 0
mov ebx, dword [ebp - 4]
leave
ret 8

Function at 0x40442c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
add eax, 0x20
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
cmp eax, 0xffffffff
sete al
test al, al
je 0x404457
mov eax, 0
jmp 0x404461
mov eax, dword [ebp - 0xc]
mov ecx, eax
call fcn.004042c0
leave
ret
Function at 0x404464
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x22c
mov dword [ebp - 0x21c], ecx
mov eax, dword [ebp - 0x21c]
movzx eax, byte [eax + 0x58]
xor eax, 1
test al, al
je 0x404647
mov eax, dword [ebp - 0x21c]
mov dword [esp + 4], 0x30
lea edx, [ebp - 0x218]
mov dword [esp], edx
mov ecx, eax
call fcn.004041c2
sub esp, 8
lea eax, [ebp - 0x218]
mov dword [esp], eax
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
mov eax, dword [ebp - 0x21c]
mov dword [esp + 4], eax
mov dword [esp], str.loading__s_n
call sub.msvcrt.dll_printf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call sub.msvcrt.dll_fflush
lea eax, [ebp - 0x1e8]
mov edx, dword [ebp + 0xc]
mov dword [esp], edx
mov ecx, eax
call fcn.004068bc
sub esp, 4
mov dword [ebp - 0x120], 0
lea ebx, [ebp - 0x11c]
mov eax, 0
mov edx, 0x40
mov edi, ebx
mov ecx, edx
rep stosd dword es:[edi], eax
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x1e8]
lea ecx, [ebp - 0x120]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov ecx, eax
call fcn.0040673c
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x21c]
mov eax, dword [eax + 0x50]
cmp eax, dword [ebp - 0x1c]
je 0x4045f6
cmp dword [ebp - 0x1c], 0xffffffff
je 0x4045a9
mov eax, dword [ebp - 0x21c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.pluging__s_is_damaged
mov dword [esp + 4], pe_nt_image_headers32
lea eax, [ebp - 0x1a0]
mov dword [esp], eax
call fcn.0040ec08
cmp dword [ebp + 0xc], 0
je 0x4045a9
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
add eax, 0xc
mov ebx, dword [eax]
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x1a0]
mov dword [esp], edx
mov ecx, eax
call ebx
sub esp, 4
mov eax, dword [ebp - 0x21c]
mov eax, dword [eax + 0x50]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], str.file_truncated__d__expected_d_n
call sub.msvcrt.dll_printf
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp], eax
call sub.msvcrt.dll_fflush
lea eax, [ebp - 0x120]
mov dword [esp], eax
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
mov ebx, 0
mov esi, 0
jmp 0x404634
mov eax, dword [ebp - 0x21c]
add eax, 0x20
mov dword [esp], eax
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
mov eax, dword [ebp - 0x21c]
add eax, 0x20
mov dword [esp + 4], eax
lea eax, [ebp - 0x120]
mov dword [esp], eax
call sub.KERNEL32.dll_MoveFileA
sub esp, 8
mov esi, 1
movzx ebx, byte [ebp - 0x21d]
lea eax, [ebp - 0x1e8]
mov ecx, eax
call fcn.004068f0
cmp esi, 1
jne 0x404659
nop
mov eax, dword [ebp - 0x21c]
mov ecx, eax
call fcn.00404256
mov ebx, 1
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x40491e
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x2014]
test eax, eax
je 0x404963
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x2014]
mov eax, dword [eax + 0x54]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x2014]
add edx, 0x40
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00409182
mov dword [esp], eax
call sub.KERNEL32.dll_SetCurrentDirectoryA
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x200c]
mov dword [ebp - 0xc], eax
jmp 0x40498a
mov eax, dword [ebp - 0xc]
mov ecx, eax
call fcn.0040442c
mov edx, dword [ebp - 0xc]
mov byte [edx + 0x58], al
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x404971
leave
ret

Function at 0x404992
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x2014]
test eax, eax
je 0x4049d7
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x2014]
mov eax, dword [eax + 0x54]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x2014]
add edx, 0x40
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00409182
mov dword [esp], eax
call sub.KERNEL32.dll_SetCurrentDirectoryA
sub esp, 4
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x200c]
mov dword [ebp - 0xc], eax
jmp 0x404a1d
mov eax, dword [ebp - 0x1c]
mov ecx, eax
call fcn.00414410
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov ecx, edx
call fcn.00404464
sub esp, 8
xor eax, 1
test al, al
je 0x404a14
mov eax, 0
jmp 0x404a28
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4049e5
mov eax, 1
leave
ret 4
Function at 0x404a2c
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0x6c], ecx
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax + 0x2014]
test eax, eax
je 0x404a74
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax + 0x2014]
mov eax, dword [eax + 0x54]
mov edx, dword [ebp - 0x6c]
mov edx, dword [edx + 0x2014]
add edx, 0x40
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00409182
mov dword [esp], eax
call sub.KERNEL32.dll_SetCurrentDirectoryA
sub esp, 4
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax + 0x200c]
mov dword [ebp - 0xc], eax
jmp 0x404b68
mov eax, dword [ebp - 0xc]
add eax, 0x20
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.._s
mov dword [esp + 4], 0x50
lea eax, [ebp - 0x64]
mov dword [esp], eax
call sub.msvcrt.dll__snprintf
lea eax, [ebp - 0x64]
mov dword [esp + 4], eax
mov dword [esp], str.linking__s_n
call sub.msvcrt.dll_printf
mov dword [esp + 8], 8
mov dword [esp + 4], 0
lea eax, [ebp - 0x64]
mov dword [esp], eax
call sub.KERNEL32.dll_LoadLibraryExA
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x404b43
lea eax, [ebp - 0x64]
mov dword [esp + 4], eax
mov dword [esp], str.lib__s_loaded_n
call sub.msvcrt.dll_printf
mov dword [esp + 4], str.runEx
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x404b2f
mov dword [esp + 4], 0x41632b
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x404b41
mov eax, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x2018], edx
jmp 0x404b5f
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 8], eax
lea eax, [ebp - 0x64]
mov dword [esp + 4], eax
mov dword [esp], str.lib__s_not_loaded_error_ld_n
call sub.msvcrt.dll_printf
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x404a85
leave
ret
Function at 0x405bf8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
jmp 0x405d9d
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
mov dword [esp], edx
mov ecx, eax
call fcn.00414564
sub esp, 4
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov byte [ebp - 0x17], al
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
mov dword [esp], edx
mov ecx, eax
call fcn.00414564
sub esp, 4
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
movzx eax, byte [ebp - 0x17]
movzx edx, al
mov eax, dword [ebp - 0x14]
add eax, edx
add eax, 1
mov word [ebp - 0x1a], ax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 2
lea eax, [ebp - 0x1a]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, 1
setne al
test al, al
je 0x405c99
mov dword [esp], 0x416440
call sub.msvcrt.dll_puts
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 1
lea eax, [ebp - 0x17]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, 1
setne al
test al, al
je 0x405cd1
mov dword [esp], str.ERROR:_could_not_write_keyLen
call sub.msvcrt.dll_puts
movzx eax, byte [ebp - 0x17]
test al, al
je 0x405d1c
movzx eax, byte [ebp - 0x17]
movzx ebx, al
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
mov dword [esp], edx
mov ecx, eax
call fcn.00414564
sub esp, 4
mov eax, dword [eax]
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, 1
je 0x405d1c
mov eax, 1
jmp 0x405d21
mov eax, 0
test al, al
je 0x405d31
mov dword [esp], str.ERROR:_could_not_write_msg_key
call sub.msvcrt.dll_puts
cmp dword [ebp - 0x14], 0
je 0x405d77
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x10]
mov dword [esp], edx
mov ecx, eax
call fcn.00414564
sub esp, 4
mov eax, dword [eax + 8]
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, 1
je 0x405d77
mov eax, 1
jmp 0x405d7c
mov eax, 0
test al, al
je 0x405d8c
mov dword [esp], str.ERROR:_could_not_write_msg_value
call sub.msvcrt.dll_puts
movzx eax, word [ebp - 0x1a]
movzx eax, ax
add eax, 2
add dword [ebp - 0xc], eax
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x2c]
mov ecx, eax
call fcn.00414554
cmp eax, dword [ebp - 0x10]
seta al
test al, al
jne 0x405c15
mov word [ebp - 0x16], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 2
lea eax, [ebp - 0x16]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0xc]
add eax, 2
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x4061f7
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_socket
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov dword [ebp - 0xc], 1
mov eax, 4
and eax, 0x7f
shl eax, 0x10
or eax, 0x8000667e
mov edx, eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
lea ecx, [ebp - 0xc]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_ioctlsocket
sub esp, 0xc
mov edx, dword [0x41b700]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x8001
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_WSAAsyncSelect
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov ecx, eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x18]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_connect
sub esp, 0xc
test eax, eax
setne al
test al, al
je 0x406329
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x8001
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.00408ee3
mov eax, dword [ebp - 0x24]
cmp eax, 0x8001
jne 0x406329
mov edx, dword [0x41b700]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_WSAAsyncSelect
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
shr eax, 0x10
test ax, ax
je 0x406329
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
sub esp, 4
mov eax, dword [ebp - 0x1c]
shr eax, 0x10
movzx eax, ax
jmp 0x406362
mov dword [ebp - 0xc], 0
mov eax, 4
and eax, 0x7f
shl eax, 0x10
or eax, 0x8000667e
mov edx, eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
lea ecx, [ebp - 0xc]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_ioctlsocket
sub esp, 0xc
mov eax, 0
leave
ret

Function at 0x4065ee
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40651a
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x401
lea eax, [ebp - 0x30]
mov dword [esp], eax
call fcn.00408ee3
mov eax, dword [ebp - 0xc]
leave
ret 8
Function at 0x40673c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xc], 0
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax]
test al, al
jne 0x406792
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4165fb
mov dword [esp], 0x4165ff
call sub.KERNEL32.dll_GetTempFileNameA
sub esp, 0x10
test eax, eax
sete al
test al, al
je 0x406792
mov eax, 0
jmp 0x406829
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov edx, dword [ebp - 0x1c]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
jne 0x4067e8
mov eax, 0
jmp 0x406829
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov ecx, eax
call fcn.0040665c
sub esp, 8
mov byte [ebp - 9], al
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
cmp byte [ebp - 9], 0
je 0x406824
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
jmp 0x406829
mov eax, 0xffffffff
leave
ret 0xc

Function at 0x4073e8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], 0
jmp 0x40743b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, edx
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jg 0x407435
jmp 0x407443
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jb 0x4073fa
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
sete al
leave
ret 8
Function at 0x407450
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x124]
mov dword [eax], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x64
mov dword [ebp - 0x10], 0
jmp 0x4074a9
lea eax, [ebp - 0x124]
mov edx, dword [ebp - 0x10]
mov edx, dword [eax + edx*4 + 4]
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 4]
cmp edx, eax
jne 0x4074a5
jmp 0x4074b6
add dword [ebp - 0x10], 1
lea eax, [ebp - 0x124]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x10]
ja 0x407489
lea eax, [ebp - 0x124]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x10]
jne 0x4074f3
lea eax, [ebp - 0x124]
mov eax, dword [eax]
cmp eax, 0x3f
ja 0x4074f3
lea eax, [ebp - 0x124]
mov edx, dword [ebp - 0x12c]
mov ecx, dword [edx + 4]
mov edx, dword [ebp - 0x10]
mov dword [eax + edx*4 + 4], ecx
lea eax, [ebp - 0x124]
mov edx, dword [eax]
add edx, 1
mov dword [eax], edx
call fcn.00408e4c
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 4]
add eax, 1
lea edx, [ebp - 0x20]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea edx, [ebp - 0x124]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_select
sub esp, 0x14
test eax, eax
setne al
test al, al
je 0x40757c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, edx
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x407581
jmp 0x407588
jmp 0x407472
mov eax, 0
jmp 0x4075c2
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jb 0x4075bd
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
movzx eax, al
add eax, 2
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
jne 0x4075bd
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 1]
movzx eax, al
cmp eax, dword [ebp + 0x10]
sete al
jmp 0x4075c2
jmp 0x407466
leave
ret 0xc

Function at 0x407baa
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], ecx
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov word [ebp - 0x18], 2
mov dword [ebp - 0x14], 0xffffffff
mov dword [esp], 0x5051
call sub.WS2_32.dll_htons
sub esp, 4
mov word [ebp - 0x16], ax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], 0x10
lea ecx, [ebp - 0x18]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_sendto
sub esp, 0x18
test eax, eax
setle al
test al, al
je 0x407c34
mov eax, 0
jmp 0x407c39
mov eax, 1
leave
ret 8