joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41097b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
or dword [ebp + 0xc], 0xffffffff
push edi
push 0
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push ecx
push eax
push dword [esi]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x4109fb
call edi
test eax, eax
je 0x4109fb
push 0x458574
push 0x80
push dword [0x467474]
call fcn.00429210
push dword [ebp - 4]
push dword [ebp - 8]
push str.LowPart:__d_HighPart:__d_n
push 8
push dword [0x467474]
call fcn.00429210
add esp, 0x20
call edi
mov ecx, dword [esi + 4]
mov dword [ecx + 0x8c], eax
mov eax, dword [esi + 4]
mov dword [eax + 0x90], 2
jmp 0x410a4c
push 0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x410a51
push dword [ebp + 0x14]
push dword [ebp - 8]
call edi
push eax
push 0x458548
push 0x80
push dword [0x467474]
call fcn.00429210
add esp, 0x18
call edi
mov ecx, dword [esi + 4]
mov dword [ecx + 0x8c], eax
mov eax, dword [esi + 4]
mov dword [eax + 0x90], 1
or eax, 0xffffffff
jmp 0x410a54
mov eax, dword [ebp + 0xc]
pop edi
leave
ret 0x10
Function at 0x411f95
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov esi, eax
push edi
lea edi, [esi + 0x158]
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x411fb7
push eax
call ebp
or dword [edi], 0xffffffff
cmp byte [esp + 0x30], 0
push 8
pop ebx
je 0x4120bb
cmp dword [esi + 0x58], ebx
jb 0x411fcf
mov eax, dword [esi + 0x44]
jmp 0x411fd2
lea eax, [esi + 0x44]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
cmp dword [esi + 0x3c], ebx
jb 0x411fe5
mov eax, dword [esi + 0x28]
jmp 0x411fe8
lea eax, [esi + 0x28]
push eax
call edi
mov eax, dword [esi + 0xbc]
test eax, eax
je 0x411ffb
push eax
call fcn.0041f79f
push 0x458738
push ebx
push dword [0x467474]
call fcn.00429210
add esp, 0xc
push dword [esi]
call ebp
push 0x45874c
push ebx
push dword [0x467474]
call fcn.00429210
or dword [esi], 0xffffffff
mov eax, dword [esi + 4]
add esp, 0xc
add esi, 8
cmp dword [eax + 0x1690], 3
jne 0x412051
push str.._p4p_
lea eax, [esp + 0x14]
push esi
push eax
call fcn.00414e0f
add esp, 0xc
jmp 0x412123
cmp dword [esi + 0x18], ebx
jb 0x41205b
mov eax, dword [esi + 4]
jmp 0x41205e
lea eax, [esi + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412084
cmp dword [esi + 0x18], ebx
jb 0x412073
mov eax, dword [esi + 4]
jmp 0x412076
lea eax, [esi + 4]
push eax
call edi
test eax, eax
jne 0x412084
xor al, al
jmp 0x412142
push str.._p4p_
lea eax, [esp + 0x14]
push esi
push eax
call fcn.00414e0f
add esp, 0xc
cmp dword [esi + 0x18], ebx
jb 0x4120a1
mov esi, dword [esi + 4]
jmp 0x4120a4
add esi, 4
cmp dword [eax + 0x18], ebx
jb 0x4120ae
mov eax, dword [eax + 4]
jmp 0x4120b1
add eax, 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x412133
cmp dword [esi + 0x58], ebx
jb 0x4120c5
mov eax, dword [esi + 0x44]
jmp 0x4120c8
lea eax, [esi + 0x44]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
cmp dword [esi + 0x3c], ebx
jb 0x4120db
mov eax, dword [esi + 0x28]
jmp 0x4120de
lea eax, [esi + 0x28]
push eax
call edi
push 0x458738
push ebx
push dword [0x467474]
call fcn.00429210
add esp, 0xc
push dword [esi]
call ebp
push 0x45874c
push ebx
push dword [0x467474]
call fcn.00429210
or dword [esi], 0xffffffff
push str.._p4p_
add esi, 8
lea eax, [esp + 0x20]
push esi
push eax
call fcn.00414e0f
add esp, 0x18
cmp dword [eax + 0x18], ebx
jb 0x41212d
mov eax, dword [eax + 4]
jmp 0x412130
add eax, 4
push eax
call edi
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.004018a8
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x41250b
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x451ca4
call fcn.0044c764
sub esp, 0x5c
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov ebx, ecx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebx + 0xbc]
push edi
cmp eax, esi
je 0x412535
push eax
call fcn.0041f79f
cmp dword [ebx + 0x154], esi
je 0x41256c
push 1
call fcn.00413eaf
mov esi, dword [ebx + 0x154]
lea eax, [ebp - 0x30]
push eax
call fcn.004273d0
pop ecx
push dword [ebx + 0x154]
call fcn.0043a14d
and dword [ebx + 0x154], 0
pop ecx
jmp 0x41266a
lea eax, [ebp - 0x48]
push eax
mov edi, 0x10000
call fcn.0041428f
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x3c]
jne 0x41258e
call fcn.0043ae46
mov eax, dword [ebp - 0x3c]
push 0x58
mov dword [ebp - 0x14], eax
call fcn.0043a173
pop ecx
mov dword [ebx + 0x154], eax
call fcn.00427300
push esi
push esi
push esi
push dword [ebx]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x41262b
cmp dword [ebp - 0x10], 0
je 0x41263b
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0xf4]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x412605
fild qword [ebp - 0x28]
fmul qword [0x45a208]
fild qword [ebx + 0xb0]
fdivp st(1)
call fcn.0044c980
push eax
mov eax, dword [ebx + 4]
push dword [eax + 0xf8]
push 0x2430
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x154]
call fcn.00427330
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x28], eax
pop ecx
push 0
adc dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp - 0x14]
push dword [ebx]
call esi
test eax, eax
jne 0x4125c1
mov esi, dword [ebx + 0x154]
lea eax, [ebp - 0x30]
push eax
call fcn.004273d0
pop ecx
push dword [ebx + 0x154]
call fcn.0043a14d
and dword [ebx + 0x154], 0
pop ecx
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.0041402b
mov ecx, dword [ebp + 8]
push 0x457422
call fcn.0040162e
xor edi, edi
xor ebx, ebx
inc edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], edi
xor esi, esi
movzx eax, byte [ebp + esi - 0x30]
push eax
lea eax, [ebp - 0x18]
push 0x458768
push eax
call fcn.0043bf32
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x64]
call fcn.0040162e
push 0xffffffffffffffff
push ebx
mov dword [ebp - 4], 2
mov ecx, dword [ebp + 8]
push eax
call fcn.00402eb3
push ebx
push edi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0
call fcn.004017a7
inc esi
cmp esi, 0x10
jl 0x412684
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x413eaf
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x451c71
call fcn.0044c764
sub esp, 0x28
or eax, 0xffffffff
push esi
push edi
cmp dword [ebx + 0x158], eax
je 0x413ff2
mov eax, dword [ebx + 0x150]
cmp eax, dword [ebx + 0xb8]
jge 0x413ff0
xor esi, esi
cmp dword [ebx + 0x154], esi
je 0x413ff0
mov eax, dword [ebx + 4]
mov edi, dword [eax + 0x16d8]
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x18], edi
call fcn.0041428f
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], esi
jne 0x413f15
call fcn.0043ae46
mov eax, dword [ebx + 0x150]
cmp eax, dword [ebx + 0xb8]
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x14], esi
jge 0x413fe8
lea esi, [ebx + 0x138]
mov eax, dword [ebx + 0x150]
shr eax, 3
push eax
call fcn.0040ea60
mov ecx, dword [ebx + 0x150]
movsx eax, byte [eax]
xor edx, edx
and ecx, 7
inc edx
shl edx, cl
test eax, edx
je 0x413fe8
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
push edi
push dword [ebx + 0x158]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x414011
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x154]
push edi
call fcn.00427330
mov eax, dword [ebx + 4]
cmp dword [eax + 0x1690], 3
pop ecx
jne 0x413fb0
mov ecx, dword [eax + 0x1850]
test ecx, ecx
je 0x413fb0
push dword [eax + 0x1870]
push dword [ebp - 0x10]
push edi
call ecx
add esp, 0xc
jmp 0x413fb2
xor eax, eax
test eax, eax
jl 0x414002
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebx + 0x150]
inc dword [ebp - 0x14]
cmp byte [ebp + 8], 0
jne 0x413fd6
cmp dword [ebp - 0x14], 0x2800
jge 0x413fe8
mov eax, dword [ebx + 0x150]
cmp eax, dword [ebx + 0xb8]
jl 0x413f33
lea esi, [ebp - 0x30]
call fcn.0041402b
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret 4
push 0xfffffffffffffffe
pop edi
lea esi, [ebp - 0x30]
call fcn.0041402b
mov eax, edi
jmp 0x413ff2
push 0xfffffffffffffffd
jmp 0x414004

Function at 0x4154c3
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x45146e
call fcn.0044c764
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push dword [ebp + 0x14]
mov dword [esi], eax
mov al, byte [ebp + 0x10]
lea ecx, [esi + 8]
mov byte [esi + 4], al
call fcn.00401650
push dword [ebp + 0x18]
xor eax, eax
mov dword [ebp - 4], eax
or dword [esi + 0x28], 0xffffffff
lea ecx, [esi + 0x54]
mov dword [esi + 0x24], 0x64
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
call fcn.00401650
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x14
Function at 0x418e4c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
cmp dword [esi + 0x1690], 3
push edi
je 0x418e82
mov eax, dword [esi + 0x16d8]
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebx + 4]
push dword [esi + 0x1698]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x418ebd
jmp 0x418eb9
mov edi, dword [esi + 0x1850]
test edi, edi
je 0x418edb
cmp dword [esi + 0x1694], 0
je 0x418ea0
push dword [ebx]
mov ecx, esi
call fcn.00407dd1
jmp 0x418ea6
mov eax, dword [esi + 0x16d8]
push dword [esi + 0x1870]
push eax
push dword [ebx + 4]
call edi
add esp, 0xc
test eax, eax
jge 0x418ebd
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 4], 0xffffffff
jne 0x418edb
push 0x28
push 0
push 0x1441
push dword [esi]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
xor eax, eax
jmp 0x418f90
lea eax, [esi + 0x1640]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edi, [esi + 0x16d8]
mov ecx, dword [edi]
lea eax, [esi + 0x628]
add dword [eax], ecx
adc dword [eax + 4], 0
lea eax, [esi + 0x1640]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [edi]
lea eax, [esi + 0xb8]
add dword [eax], ecx
adc dword [eax + 4], 0
mov eax, dword [esi + 0xf4]
test eax, eax
je 0x418f68
cmp byte [esi + 0xf0], 0
je 0x418f68
mov ecx, dword [ebx]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
and dword [ebp - 8], 0
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push dword [esi + 0xf8]
push 0x2411
push eax
call edi
mov eax, dword [ebx]
inc eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0xf8]
push 0x2410
push dword [esi + 0xf4]
call edi
cmp dword [esi + 0x1690], 3
jne 0x418f8d
mov eax, dword [esi + 0x1694]
test eax, eax
je 0x418f8d
mov eax, dword [eax + 0xb8]
dec eax
cmp dword [ebx], eax
jne 0x418f8d
push 0
jmp 0x418ec5
xor eax, eax
inc eax
pop edi
leave
ret
Function at 0x418f93
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [edi + 0xc], 0x1f3
push ebx
jne 0x41906e
mov ecx, dword [edi + 8]
xor ebx, ebx
cmp ecx, ebx
jbe 0x41903a
cmp dword [esi + 0x1690], 3
mov dword [ebp - 4], ebx
je 0x418fda
push ebx
lea eax, [ebp - 4]
push eax
push ecx
push dword [edi + 4]
push dword [esi + 0x1698]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x418ffb
jmp 0x418ff7
mov eax, dword [esi + 0x1850]
cmp eax, ebx
je 0x419006
push dword [esi + 0x1870]
push ecx
push dword [edi + 4]
call eax
add esp, 0xc
test eax, eax
jge 0x418ffb
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 4], 0xffffffff
jne 0x419006
push 0x28
push ebx
jmp 0x419072
lea ebx, [esi + 0x1640]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 8]
lea eax, [esi + 0x628]
add dword [eax], ecx
push ebx
adc dword [eax + 4], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [edi + 8]
lea eax, [esi + 0xb8]
add dword [eax], ecx
adc dword [eax + 4], 0
xor ebx, ebx
mov eax, dword [esi + 0xf4]
cmp eax, ebx
je 0x41906b
cmp byte [esi + 0xf0], 0
je 0x41906b
mov ecx, dword [edi]
mov dword [ebp - 8], ecx
lea ecx, [ebp - 8]
push ecx
push dword [esi + 0xf8]
mov dword [ebp - 4], ebx
push 0x2411
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
jmp 0x419003
push 0x33
push 0
push 0x1441
push dword [esi]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
xor eax, eax
pop ebx
leave
ret
Function at 0x4194eb
Capabilities:
Get file size

Disassembly:
mov eax, 0x451f18
call fcn.0044c764
sub esp, 0x28
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x419528
mov al, 1
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [ebp - 0x14], ebx
je 0x41953e
or eax, 0xffffffff
push esi
cmp dword [ebp + 0xc], eax
je 0x41954c
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x419518
lea eax, [ebp - 0x30]
push eax
call fcn.00419440
pop ecx
pop ecx
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x30]
call fcn.004030bb
test eax, eax
je 0x419584
mov byte [ebp - 0xd], 1
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.004017a7
mov al, byte [ebp - 0xd]
jmp 0x41951a
mov byte [ebp - 0xd], bl
jmp 0x419574
Function at 0x41b137
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x4515fd
call fcn.0044c764
mov eax, dword [edi]
sub esp, 0xc
push ebx
push esi
mov ecx, edi
call dword [eax + 0xc]
xor ebx, ebx
cmp dword [edi + 0x204], ebx
je 0x41b237
mov ecx, dword [edi + 0xe8]
cmp ecx, ebx
je 0x41b171
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 0xe8], ebx
push 0xc
call fcn.0043a173
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x41b18c
call fcn.004218a3
jmp 0x41b18e
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [edi + 0xe8], eax
mov byte [edi + 0xef], bl
cmp byte [edi + 0x1ec], bl
jne 0x41b1fe
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub esp, 0x1c
lea esi, [edi + 0x104]
mov ecx, esp
mov dword [ebp - 0x14], esp
push esi
call fcn.00401650
call fcn.0041d1ea
add esp, 0x1c
push dword [edi + 0x120]
mov ecx, esi
push dword [edi + 0xe8]
mov byte [ebp - 0xe], al
call fcn.0042194d
mov byte [ebp - 0xd], al
cmp byte [edi + 0xef], bl
jne 0x41b213
cmp byte [edi + 0xac], bl
je 0x41b213
cmp byte [ebp - 0xe], bl
je 0x41b213
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x41b213
push dword [edi + 0x194]
lea ecx, [edi + 0x178]
push eax
call fcn.0042194d
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], bl
je 0x41b237
cmp byte [edi + 0xef], bl
jne 0x41b237
mov byte [edi + 0xec], bl
mov byte [edi + 0xef], bl
mov byte [edi + 0x100], 1
xor eax, eax
jmp 0x41b23a
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x41dc34
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov eax, ebx
push edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41dc3b
sub eax, esi
mov edi, eax
xor esi, esi
test edi, edi
jle 0x41dc68
push 0
push edi
lea eax, [esi + ebx]
push eax
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x41dc6d
add esi, eax
cmp esi, edi
jl 0x41dc4c
mov eax, esi
pop edi
pop esi
ret
or eax, 0xffffffff
jmp 0x41dc6a

Function at 0x41dd39
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
or dword [esi], 0xffffffff
or dword [esi + 4], 0xffffffff
sub esp, 0x194
push edi
xor eax, eax
push 0x3c
push eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea eax, [esi + 0x10]
push eax
call fcn.0043ab70
mov edi, 0x1000
push edi
call fcn.0043a142
push edi
mov dword [esi + 0x20], eax
call fcn.0043a142
push edi
mov dword [esi + 0x2c], eax
call fcn.0043a142
push edi
mov dword [esi + 0x34], eax
call fcn.0043a142
add esp, 0x1c
mov dword [esi + 0x3c], eax
lea eax, [esp + 8]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x41ddb3
push str.An_error_occured_at_WSAStartup___function__n
push 8
push dword [0x467474]
call fcn.00429210
add esp, 0xc
mov eax, esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41e5d9
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Parse url
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.0043b0f0
push ebx
push esi
push 0xfff
xor esi, esi
lea eax, [ebp - 0x100f]
push esi
push eax
mov byte [ebp - 0x1010], 0
call fcn.0043ab70
mov ebx, dword [ebp + 8]
add esp, 0xc
mov eax, ebx
call fcn.0041e579
lea ecx, [ebx + 0x10]
push ecx
push esi
mov eax, 0x1000
push esi
push dword [ebp + 0xc]
mov dword [ecx], 0x3c
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x40], eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x41e642
or eax, 0xffffffff
jmp 0x41e781
push edi
cmp dword [ebx + 0x30], esi
jne 0x41e661
mov edi, dword [ebx + 0x2c]
mov esi, str.anonymous
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebx + 0x34]
mov esi, str.you_youraddr.com
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 6
push 1
push 2
pop esi
push esi
call dword [sym.imp.WS2_32.dll_socket]
or edi, 0xffffffff
mov dword [ebx], eax
cmp eax, edi
jne 0x41e67f
mov eax, edi
jmp 0x41e780
push dword [ebx + 0x20]
mov eax, esi
mov word [ebp - 0x10], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0xc], eax
cmp eax, edi
jne 0x41e6b0
push dword [ebx + 0x20]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x41e773
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
movzx eax, word [ebx + 0x28]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, edi
je 0x41e773
push dword [ebx]
lea edi, [ebp - 0x1010]
call fcn.0041dcea
pop ecx
cmp eax, 0xdc
jne 0x41e773
push dword [ebx + 0x2c]
mov eax, edi
push str.USER__s_r_n
push eax
call fcn.0043bf32
push dword [ebx]
mov ebx, edi
call fcn.0041dc34
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.0041dcea
add esp, 0x14
push 0x64
cdq
pop ecx
idiv ecx
cmp eax, esi
je 0x41e753
cmp eax, 3
jne 0x41e770
mov edi, dword [ebp + 8]
push dword [edi + 0x34]
mov eax, ebx
push str.PASS__s_r_n
push eax
call fcn.0043bf32
push dword [edi]
call fcn.0041dc34
push dword [edi]
mov edi, ebx
call fcn.0041dcea
add esp, 0x14
push 0x64
cdq
pop ecx
idiv ecx
cmp eax, esi
jne 0x41e770
mov eax, dword [ebp + 8]
push 0xfff
push dword [ebp + 0xc]
add eax, 0x104c
push eax
call fcn.0043c510
add esp, 0xc
xor eax, eax
jmp 0x41e780
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
mov dword [ebx], eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x421861
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
cmp dword [0x4674b4], 0
jne 0x42189b
lea eax, [ebp - 0x198]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x42189b
push 0x45dc18
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], str.Could_not_start_WSA
call fcn.0043b0a3
inc dword [0x4674b4]
leave
ret

Function at 0x4218a3
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ecx
and dword [esi + 4], 0
mov dword [esi], vtable.Socket.0
call fcn.00421861
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 4
mov dword [esi + 4], eax
call fcn.0043a173
pop ecx
test eax, eax
je 0x4218d6
mov dword [eax], 1
jmp 0x4218d8
xor eax, eax
mov dword [esi + 8], eax
mov eax, esi
pop ecx
ret

Function at 0x42194d
Capabilities:
Connect socket
Resolve dns

Disassembly:
mov eax, 0x45156d
call fcn.0044c764
sub esp, 0x30
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x24], 0xf
call fcn.004019d4
mov dword [ebp - 4], ebx
cmp dword [esi + 0x18], 0x10
jb 0x42197f
mov esi, dword [esi + 4]
jmp 0x421982
add esi, 4
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
cmp esi, ebx
jne 0x4219c6
call fcn.0043cac4
push dword [eax]
call fcn.0043ca16
pop ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.00401784
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.004017a7
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, bl
mov dword fs:[0], ecx
pop ebx
leave
ret 8
push 2
pop eax
push dword [ebp + 0xc]
mov word [ebp - 0x20], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e], ax
mov eax, dword [esi + 0xc]
cmp dword [eax], ebx
je 0x4219a5
xor ecx, ecx
mov eax, dword [eax + ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x421a0d
push 0x10
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x421a1e
mov eax, dword [esi + 0xc]
inc ebx
mov ecx, ebx
shl ecx, 2
cmp dword [eax + ecx], 0
jne 0x4219e3
jmp 0x4219a5
mov bl, 1
jmp 0x4219a7

Function at 0x421a22
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov ecx, dword [ebx + 4]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, 0x400
mov eax, edi
test ecx, ecx
je 0x421a70
test eax, eax
je 0x421a70
cmp eax, 0x2746
je 0x421a70
test esi, esi
je 0x421a70
push 0
cmp esi, edi
mov eax, esi
cmovge eax, edi
push eax
mov eax, dword [esp + 0x14]
sub eax, esi
add eax, dword [esp + 0x18]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x421a70
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x421a70
sub esi, eax
jmp 0x421a36
mov eax, dword [esp + 0x10]
pop edi
sub eax, esi
pop esi
ret 8