joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, eax
lea eax, [edi + 6]
cmp dword [ebp], eax
jb 0x40355a
cmp edi, 0xffff
ja 0x40355a
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4034b2
cmp byte [eax], 0
je 0x4034b2
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4034a3
sub eax, edx
mov dword [esp + 0x14], eax
jmp 0x4034c4
mov ecx, dword [0x653738]
mov dword [esp + 0x18], str.8437jhdf8834kmklsi7__kdf8lsdjf2__aksdjsd0__dkfk____sksldfjsa_sdasdkj23knfsmmjjd
mov dword [esp + 0x14], ecx
lea edx, [edi + 4]
push ebx
mov dword [ebp], edx
lea ebx, [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi]
xor ecx, eax
and ecx, 0x7ffff
xor ecx, dword [esi]
xor edx, edx
mov eax, ecx
and eax, 0x7ffff
div dword [esp + 0x18]
shl edx, 0x13
xor edx, ecx
and edx, 0x1f80000
xor edx, ecx
mov dword [esi], edx
and edx, 0x1ffffff
cmp edi, 0x7f
jbe 0x403515
mov dword [esi], edx
mov word [ebx], di
add ebx, 2
add dword [ebp], 2
jmp 0x40351e
mov eax, edi
shl eax, 0x19
or edx, eax
mov dword [esi], edx
mov edx, dword [esi]
shr edx, 0x13
and edx, 0x3f
test edi, edi
jbe 0x403550
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov ecx, ebx
sub esi, ebx
mov al, byte [esi + ecx]
mov ebx, dword [esp + 0x1c]
xor al, byte [edx + ebx]
inc ecx
mov byte [ecx - 1], al
lea eax, [edx + 3]
xor edx, edx
div ebp
sub edi, 1
jne 0x403536
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
pop edi
pop esi
mov dword [ebp], 0
xor eax, eax
pop ebp
ret

Function at 0x403570
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 4], 4
push ebx
push edi
mov ebx, eax
mov edi, edx
jae 0x403588
mov dword [edi], 0
pop edi
xor eax, eax
pop ebx
ret
push ebp
push esi
test ebx, ebx
je 0x4035a3
cmp byte [ebx], 0
je 0x4035a3
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x403596
sub eax, esi
mov ebp, eax
jmp 0x4035ae
mov ebp, dword [0x653738]
mov ebx, str.8437jhdf8834kmklsi7__kdf8lsdjf2__aksdjsd0__dkfk____sksldfjsa_sdasdkj23knfsmmjjd
mov edx, dword [ecx]
mov eax, edx
shr eax, 0x19
lea esi, [ecx + 4]
mov ecx, dword [esp + 0x14]
test eax, eax
jne 0x4035d8
cmp ecx, 4
je 0x4035d8
movzx eax, word [esi]
cmp dword [edi], eax
jb 0x403617
add ecx, 0xfffffffa
cmp eax, ecx
jne 0x403617
add esi, 2
jmp 0x4035e3
cmp dword [edi], eax
jb 0x403617
add ecx, 0xfffffffc
cmp eax, ecx
jne 0x403617
shr edx, 0x13
and edx, 0x3f
mov dword [edi], eax
test eax, eax
jbe 0x40360d
mov ecx, dword [esp + 0x18]
sub esi, ecx
mov edi, eax
mov al, byte [esi + ecx]
xor al, byte [edx + ebx]
inc ecx
mov byte [ecx - 1], al
lea eax, [edx + 3]
xor edx, edx
div ebp
sub edi, 1
jne 0x4035f7
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
ret
pop esi
xor eax, eax
pop ebp
mov dword [edi], eax
pop edi
pop ebx
ret
Function at 0x4038c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor ecx, ecx
xor ebp, ebp
push esi
mov esi, eax
cmp dword [esp + 0xc], ecx
jbe 0x4038f7
push ebx
nop
mov bl, byte [ecx + edi]
movsx eax, bl
add ebp, eax
xor edx, edx
mov eax, esi
div dword [0x653738]
inc ecx
inc esi
mov dl, byte [edx + str.8437jhdf8834kmklsi7__kdf8lsdjf2__aksdjsd0__dkfk____sksldfjsa_sdasdkj23knfsmmjjd]
xor dl, bl
mov byte [ecx + edi - 1], dl
cmp ecx, dword [esp + 0x10]
jb 0x4038d0
pop ebx
pop esi
mov eax, ebp
pop ebp
ret

Function at 0x403900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
xor ecx, ecx
test ebp, ebp
jbe 0x403948
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x20]
lea ebx, [ebx]
xor edx, edx
mov eax, edi
div dword [0x653738]
inc ecx
inc edi
mov al, byte [edx + str.8437jhdf8834kmklsi7__kdf8lsdjf2__aksdjsd0__dkfk____sksldfjsa_sdasdkj23knfsmmjjd]
xor byte [ecx + esi - 1], al
movsx edx, byte [ecx + esi - 1]
add ebx, edx
cmp ecx, ebp
jb 0x403920
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
mov eax, dword [esp + 0x10]
pop ebp
ret

Function at 0x403fa0
Capabilities:
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x5bc2db
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
mov eax, dword [0x64786c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, dword [esp + 0x34]
xor ebp, ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], esi
mov dword [esp + 0x2c], ebp
or eax, 0xffffffff
mov dword [esi + 0x14], eax
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x38]
mov dword [esi], vtable.TPinger::PING_ITEM.0
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], ebp
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebp
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
push ecx
mov ecx, dword [edi + 0x24]
call fcn.00403d30
mov byte [esp + 0x2c], 2
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x40401d
mov ebx, dword [eax]
cmp ebx, ebp
jne 0x404021
xor eax, eax
jmp 0x404049
push ebx
call sub.WS2_32.dll_inet_addr
mov dword [esp + 0x38], eax
cmp eax, 0xffffffff
jne 0x404045
push ebx
call sub.WS2_32.dll_gethostbyname
cmp eax, ebp
je 0x404045
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x14]
push ebp
push 1
push 2
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edx
call sub.WS2_32.dll_socket
mov dword [esi + 0x24], eax
cmp dword [edi + 0x28], ebp
je 0x404072
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0x2c]
call fcn.00404b60
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.00404240
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8
Function at 0x404160
Capabilities:
Check for time delay via gettickcount
Connect socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x64786c]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, ecx
mov dx, word [esi + 0x20]
mov eax, dword [esi + 0x1c]
rol dx, 8
cmp dword [esi + 0x24], 0xffffffff
mov ecx, 2
push edi
mov dword [esp + 0x10], eax
mov word [esp + 0xc], cx
mov word [esp + 0xe], dx
je 0x4041fb
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x18], eax
cmp dword [ecx + 0x28], 0
je 0x4041cc
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x4041bd
mov eax, dword [eax]
test eax, eax
jne 0x4041bf
xor eax, eax
push eax
mov eax, dword [esi + 0x24]
push eax
push ecx
call fcn.00404610
jmp 0x4041e1
mov edx, dword [esi + 0x24]
push 0x10
lea ecx, [esp + 0x10]
push ecx
push edx
call sub.WS2_32.dll_connect
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x4041fb
call edi
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x14], eax
cmp eax, ecx
jb 0x4041f5
sub eax, ecx
jmp 0x4041f8
sub eax, ecx
dec eax
mov dword [esi + 0x14], eax
push esi
mov esi, dword [esi + 0x10]
call fcn.004047a0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0059709c
mov esp, ebp
pop ebp
ret
Function at 0x404310
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5bc695
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x64786c]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x64786c]
xor eax, esp
push eax
lea eax, [esp + 0x11c]
mov dword fs:[0], eax
mov edi, ecx
xor ebp, ebp
mov dword [esp + 0x14], edi
mov dword [edi], vtable.TArray_class_TInI::TInISection___10__class_TArrayAllocator_.0
mov dword [edi + 4], ebp
mov dword [edi + 8], ebp
mov dword [edi + 0xc], ebp
mov dword [edi + 0x10], ebp
mov dword [edi + 0x14], ebp
mov dword [edi + 0x18], ebp
mov dword [edi + 0x1c], ebp
mov dword [edi + 0x20], ebp
mov eax, dword [esp + 0x12c]
mov dword [esp + 0x124], ebp
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], ebp
mov dword [edi + 0x2c], vtable.TArray_class_TPinger::PING_ITEM___10__class_TArrayAllocator_.0
mov dword [edi + 0x30], ebp
mov dword [edi + 0x34], ebp
mov dword [edi + 0x38], ebp
lea eax, [edi + 0x3c]
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
lea ecx, [edi + 0x54]
mov byte [esp + 0x124], 2
call fcn.00403b80
push str.proxy.ini
lea ecx, [esp + 0x1c]
push 0x100
mov byte [esp + 0x12c], 3
or ebx, 0xffffffff
push ecx
mov dword [edi + 0x460], ebx
call fcn.00403300
lea edx, [esp + 0x24]
push 0x62081c
push edx
call fcn.00599840
mov esi, eax
add esp, 0x14
cmp esi, ebp
jne 0x4043f6
mov dword [edi + 0x20], ebx
jmp 0x404407
push esi
mov eax, edi
call fcn.00402930
push esi
call fcn.0059951c
add esp, 4
push ebp
push str.proxy
mov ecx, edi
call fcn.00402750
mov esi, eax
cmp esi, ebp
je 0x404440
push str.type
mov ecx, esi
call fcn.00401da0
cmp eax, ebp
jl 0x404440
mov ecx, dword [esi + 4]
mov eax, dword [ecx + eax*8 + 4]
cmp eax, ebp
je 0x404440
push eax
call fcn.00404c00
add esp, 4
jmp 0x404442
xor eax, eax
mov dword [edi + 0x28], eax
cmp eax, ebp
je 0x4044af
push ebp
push str.proxy
mov ecx, edi
call fcn.00402750
mov esi, eax
cmp esi, ebp
je 0x4044af
push str.passc
mov ecx, esi
call fcn.00401da0
cmp eax, ebp
jl 0x4044af
mov edx, dword [esi + 4]
mov eax, dword [edx + eax*8 + 4]
cmp eax, ebp
je 0x4044af
push ebp
push 0x100
lea ecx, [esp + 0x20]
push ecx
push eax
call fcn.00403710
add esp, 0x10
test eax, eax
jbe 0x4044af
mov eax, str.proxy
mov ebx, edi
call fcn.004028a0
mov esi, eax
cmp esi, ebp
je 0x4044af
lea ebx, [esp + 0x18]
mov eax, str.pass
call fcn.00401fd0
mov eax, edi
mov ecx, dword [esp + 0x11c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0059709c
add esp, 0x114
ret 4
Function at 0x4048a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x5bc4a8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x64786c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x3c]
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov dword [esi + 0x5c], ebx
cmp ebp, ebx
je 0x40491a
xor edi, edi
cmp dword [ebp + 0xc], ebx
jbe 0x40491a
nop
mov eax, dword [ebp + 4]
mov eax, dword [eax + edi*4]
mov eax, dword [eax + 0x10]
cmp eax, ebx
je 0x404914
mov eax, dword [eax]
cmp eax, ebx
je 0x404909
mov eax, dword [eax]
cmp eax, ebx
jne 0x40490b
xor eax, eax
push edi
push eax
mov ecx, esi
call fcn.00404a30
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x4048f0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ecx, dword [esi + 0x5c]
mov edi, eax
cmp ecx, dword [esi + 0x38]
jae 0x404971
lea esp, [esp]
cmp eax, edi
jb 0x404938
sub eax, edi
jmp 0x40493b
sub eax, edi
dec eax
cmp eax, 0x2710
jae 0x404971
mov eax, dword [esi + 0x58]
push 0x3e8
test eax, eax
je 0x40495b
lea ecx, [esi + 0x3c]
push ecx
push eax
call dword [0x6569a4]
jmp 0x404967
mov ecx, dword [esi + 0x54]
lea eax, [esi + 0x3c]
push eax
call fcn.00401260
call ebx
mov edx, dword [esi + 0x5c]
cmp edx, dword [esi + 0x38]
jb 0x404930
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x14], ecx
cmp dword [esi + 0x38], eax
jbe 0x4049ac
mov edi, dword [esi + 0x30]
xor edx, edx
mov ebx, dword [edi + eax*4]
mov ebp, dword [edx + edi]
mov ebx, dword [ebx + 0x14]
lea ecx, [eax*4]
cmp ebx, dword [ebp + 0x14]
jae 0x40499e
mov dword [esp + 0x14], eax
mov edx, ecx
inc eax
cmp eax, dword [esi + 0x38]
jb 0x404983
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esi + 0x38]
jae 0x4049ff
mov eax, dword [esi + 0x30]
mov eax, dword [eax + ecx*4]
cmp dword [eax + 0x14], 0x2710
jae 0x4049ff
mov eax, dword [eax + 0x28]
cmp eax, dword [ebp + 0xc]
jae 0x4049ff
mov ecx, dword [ebp + 4]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + 0x10]
mov eax, dword [eax]
test eax, eax
je 0x4049ee
mov eax, dword [eax]
test eax, eax
je 0x4049ee
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x404a0e
mov eax, dword [esp + 0x18]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x404a0e
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x404a30
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x5bc47b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x64786c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
push 0x30
call fcn.005971c5
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 0
test eax, eax
je 0x404a83
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ecx
push eax
call fcn.00403fa0
mov ebx, eax
jmp 0x404a85
xor ebx, ebx
mov dword [esp + 0x1c], 0xffffffff
test ebx, ebx
je 0x404add
cmp dword [ebx + 4], 0
jne 0x404ad2
mov eax, dword [ebx + 0xc]
lea edx, [ebx + 8]
push edx
push 0x10000
push eax
push 0x401080
push 0xa004
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 4], eax
test eax, eax
je 0x404ac6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
cmp dword [ebx + 4], eax
setne al
test eax, eax
jne 0x404af4
mov edx, dword [ebx]
mov eax, dword [edx + 4]
push 1
mov ecx, ebx
call eax
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
lea esi, [edi + 0x2c]
call fcn.004062c0
test al, al
je 0x404b29
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
mov eax, 1
mov dword [edx + ecx*4], ebx
add dword [esi + 0xc], eax
movzx eax, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
xor al, al
movzx eax, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x406650
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5bbd01
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x64786c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, dword [esp + 0x38]
push 2
push 0
push edi
mov dword [esp + 0x24], 0
call fcn.0059a346
push edi
call fcn.0059a24e
push 0
mov ebx, eax
push 0
push edi
mov dword [esp + 0x38], ebx
call fcn.0059a346
add esp, 0x1c
cmp ebx, 0x4000000
jle 0x4066da
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4066bc
mov dword [eax], 0xfffffffe
mov eax, dword [esp + 0x34]
mov dword [eax], 0
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
lea eax, [ebx + 1]
push eax
lea ecx, [esp + 0x18]
call fcn.00402e40
mov dword [esp + 0x2c], 1
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x4066fe
mov esi, dword [ebp]
test esi, esi
jne 0x406700
xor esi, esi
push edi
push 0xc
push 1
push esi
call fcn.0059a094
mov edi, eax
add esp, 0x10
cmp edi, 0xc
jne 0x4067de
cmp byte [esi], 0x31
jne 0x4067de
cmp byte [esi + 1], 0x32
jne 0x4067de
cmp byte [esi + 2], 0x78
jne 0x4067de
cmp byte [esi + 3], 0
jne 0x4067de
mov edx, dword [esp + 0x38]
mov edi, dword [esp + 0x1c]
movsx ecx, byte [esi + 4]
mov ebx, dword [esi + 8]
push edx
push 1
add edi, 0xfffffff4
push edi
push esi
mov dword [esp + 0x30], ecx
call fcn.0059a094
push edi
push 0
push edi
push esi
call fcn.00403900
add esp, 0x20
cmp eax, ebx
je 0x4067c8
cmp dword [0x653730], 3
jg 0x406795
push ebx
push eax
push str.check_sum_err:__u__u
push 0x657
push str..._.._base_hTString.h
push 3
call fcn.00401320
add esp, 0x18
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4067a3
mov dword [eax], 0xfffffffd
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x14]
mov dword [esi], 0
mov dword [esp + 0x18], 1
mov byte [esp + 0x2c], 0
call fcn.00402ea0
jmp 0x406884
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x40680a
xor ecx, ecx
cmp dword [esp + 0x20], ecx
setne cl
inc ecx
mov dword [eax], ecx
jmp 0x40680a
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4067ec
mov dword [eax], 0
cmp ebx, edi
jbe 0x40680a
mov edx, dword [esp + 0x38]
push edx
mov eax, ebx
push 1
sub eax, edi
push eax
add esi, 0xc
push esi
call fcn.0059a094
add esp, 0x10
mov edi, ebx
test edi, edi
jbe 0x40682f
test ebp, ebp
je 0x406819
mov eax, dword [ebp]
test eax, eax
jne 0x40681b
xor eax, eax
add edi, 1
mov byte [eax + edi - 1], 0
js 0x406844
cmp edi, dword [ebp + 4]
jg 0x406844
mov dword [ebp + 8], edi
jmp 0x406844
test ebp, ebp
je 0x406844
mov eax, dword [ebp]
mov dword [ebp + 8], 0
test eax, eax
je 0x406844
mov byte [eax], 0
mov esi, dword [esp + 0x34]
mov dword [esi], ebp
test ebp, ebp
je 0x406851
inc dword [ebp + 0xc]
mov dword [esp + 0x18], 1
mov byte [esp + 0x2c], 0
test ebp, ebp
je 0x406884
dec dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0
jg 0x406884
mov eax, dword [ebp]
test eax, eax
je 0x40687b
push eax
call fcn.005975b8
add esp, 4
push ebp
call fcn.00596bdf
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4079a0
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x4079ad
xor eax, eax
pop esi
ret
push edi
push esi
call sub.WS2_32.dll_inet_addr
mov edi, eax
cmp edi, 0xffffffff
jne 0x4079cc
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x4079cc
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edi, dword [ecx]
mov eax, edi
pop edi
pop esi
ret

Function at 0x4079e0
Capabilities:
Connect socket
Get socket status
Resolve dns

Disassembly:
sub esp, 0x12c
mov eax, dword [0x64786c]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push ebp
mov ebp, dword [esp + 0x13c]
push esi
mov esi, edx
push edi
mov edi, ecx
test esi, esi
jne 0x407a0b
xor ebx, ebx
jmp 0x407a29
push esi
call sub.WS2_32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407a29
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x407a29
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov ebx, dword [ecx]
push ebp
mov dword [esp + 0x12c], ebx
call sub.WS2_32.dll_htons
mov word [esp + 0x126], ax
mov eax, dword [esp + 0x128]
mov edx, 2
mov word [esp + 0x124], dx
lea ebx, [edx - 1]
cmp eax, 0xffffffff
jne 0x407a7f
cmp dword [0x653730], ebx
jg 0x407a78
push esi
push str._s_cant_be_resolved.
push 0x24
push str....._base_srcwin32TSocket.c
push ebx
call fcn.00401320
add esp, 0x14
xor eax, eax
jmp 0x407b4b
cmp dword [0x653730], ebx
jg 0x407aa7
movzx ecx, bp
push ecx
push eax
call sub.WS2_32.dll_inet_ntoa
push eax
push str.Socket_connecting_to__s:_d_...
push 0x28
push str....._base_srcwin32TSocket.c
push ebx
call fcn.00401320
add esp, 0x18
mov esi, dword [esp + 0x140]
push 0x10
lea edx, [esp + 0x128]
push edx
push esi
call sub.WS2_32.dll_connect
test eax, eax
je 0x407b49
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x407b64
xor eax, eax
cmp edi, 0xffffffff
je 0x407b01
mov eax, 0x10624dd3
mul edi
shr edx, 6
mov dword [esp + 0x10], edx
imul edx, edx, 0x3e8
sub edi, edx
imul edi, edi, 0x3e8
mov dword [esp + 0x14], edi
lea eax, [esp + 0x10]
push eax
push 0
lea eax, [esp + 0x20]
push eax
push 0
push ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
call sub.WS2_32.dll_select
test eax, eax
jle 0x407b64
lea ecx, [esp + 0x18]
push ecx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x407b64
cmp dword [0x653730], ebx
jg 0x407b49
push str.Connected.
push 0x4b
push str....._base_srcwin32TSocket.c
push ebx
call fcn.00401320
add esp, 0x10
mov eax, ebx
mov ecx, dword [esp + 0x134]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0059709c
add esp, 0x12c
ret
cmp dword [0x653730], ebx
jg 0x407a78
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.Connect_failed__error_d
push 0x4f
jmp 0x407a6a
Function at 0x407b90
Capabilities:
Get socket status

Disassembly:
sub esp, 0x118
push esi
xor esi, esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 1
cmp ecx, 0xffffffff
je 0x407bce
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov dword [esp + 8], edx
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x3e8
lea esi, [esp + 8]
mov dword [esp + 0xc], ecx
push esi
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push 1
call sub.WS2_32.dll_select
mov esi, eax
cmp esi, 0xffffffff
je 0x407bea
test esi, esi
jne 0x407c0f
cmp dword [0x653730], 3
jg 0x407c0f
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.socket_error__u
push 0x6b
push str....._base_srcwin32TSocket.c
push 3
call fcn.00401320
add esp, 0x14
mov eax, esi
pop esi
add esp, 0x118
ret

Function at 0x407c20
Capabilities:
Get socket status

Disassembly:
sub esp, 0x118
push esi
xor esi, esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 1
cmp ecx, 0xffffffff
je 0x407c5e
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov dword [esp + 8], edx
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x3e8
lea esi, [esp + 8]
mov dword [esp + 0xc], ecx
push esi
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push 1
call sub.WS2_32.dll_select
mov esi, eax
cmp esi, 0xffffffff
je 0x407c7a
test esi, esi
jne 0x407ca2
cmp dword [0x653730], 3
jg 0x407ca2
call sub.WS2_32.dll_WSAGetLastError
push eax
push str.socket_error__u
push 0x85
push str....._base_srcwin32TSocket.c
push 3
call fcn.00401320
add esp, 0x14
mov eax, esi
pop esi
add esp, 0x118
ret
Function at 0x408120
Capabilities:
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x414
mov eax, dword [0x64786c]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
push edi
mov edi, dword [ebp + 0x14]
push eax
push ecx
mov ecx, dword [ebp + 0x24]
call fcn.004079e0
add esp, 8
test eax, eax
je 0x408262
test edi, edi
jne 0x40816a
mov edi, 0x612b02
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408170
sub eax, edx
mov dword [esp + 0x14], eax
test ebx, ebx
jne 0x408214
xor esi, esi
mov ecx, dword [ebp + 0x20]
mov ebx, 1
push ecx
mov byte [esp + 0x1c], 4
mov byte [esp + 0x1d], bl
call sub.WS2_32.dll_htons
lea edx, [esp + 0x20]
mov word [esp + 0x1a], ax
mov dword [esp + 0x1c], esi
mov eax, edi
sub edx, edi
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, ebx
test cl, cl
jne 0x4081b0
mov esi, dword [esp + 0x14]
mov edi, dword [ebp + 8]
push 0
add esi, 9
push esi
lea edx, [esp + 0x20]
push edx
push edi
call sub.WS2_32.dll_send
cmp eax, esi
je 0x408279
cmp dword [0x653730], 3
jg 0x4081fd
push str.Fail_to_send_SOCK4_request.
push 0x156
push str....._base_srcwin32TSocket.c
push 3
call fcn.00401320
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.0059709c
mov esp, ebp
pop ebp
ret
push ebx
call sub.WS2_32.dll_inet_addr
mov esi, eax
cmp esi, 0xffffffff
jne 0x408187
push ebx
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x408236
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov esi, dword [eax]
cmp esi, 0xffffffff
jne 0x408187
cmp dword [0x653730], 3
jg 0x408262
push ebx
push str.The_host__s_cant_be_resolved.
push 0x14a
push str....._base_srcwin32TSocket.c
push 3
call fcn.00401320
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.0059709c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x24]
mov eax, edi
call fcn.00407b90
test eax, eax
jle 0x408262
push 0
push 8
lea eax, [esp + 0x14]
push eax
push edi
call sub.WS2_32.dll_recv
cmp eax, 8
je 0x4082b7
cmp dword [0x653730], 3
jg 0x4081fd
push str.Fail_to_read_socks4_response.
push 0x160
jmp 0x4081ee
cmp dword [0x653730], ebx
jg 0x4082e3
movzx ecx, byte [esp + 0xd]
movzx edx, byte [esp + 0xc]
push ecx
push edx
push str.SOCKS4_response_read._ver_d_status_d
push 0x165
push str....._base_srcwin32TSocket.c
push ebx
call fcn.00401320
add esp, 0x18
mov ecx, dword [esp + 0x41c]
xor eax, eax
cmp byte [esp + 0xd], 0x5a
pop edi
pop esi
sete al
pop ebx
xor ecx, esp
call fcn.0059709c
mov esp, ebp
pop ebp
ret