joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c220
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa74
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x588], ebx
mov dword [ebp - 0x58c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040418c
mov eax, dword [ebp - 8]
call fcn.0040418c
mov eax, dword [ebp - 0xc]
call fcn.0040418c
xor eax, eax
push ebp
push 0x40c48b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x40c293
mov word [ebp - 0x28], 2
mov word [ebp - 0x26], 0
push 0
call sub.wsock32.dll_htonl
mov dword [ebp - 0x24], eax
push 0x10
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_bind
inc eax
jne 0x40c2aa
call fcn.00403cac
mov word [ebp - 0x38], 2
mov eax, dword [ebp - 0xc]
call fcn.00408420
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x36], ax
mov eax, dword [ebp - 8]
call fcn.0040419c
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x34], eax
push 0x10
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_connect
inc eax
xor edx, edx
push ebp
push 0x40c38f
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x584]
call fcn.00402b54
mov edx, 0x80
lea eax, [ebp - 0x584]
call fcn.00403204
call fcn.004025b8
xor edx, edx
push ebp
push 0x40c350
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x584]
call fcn.00402dfc
call fcn.004025b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c357
lea eax, [ebp - 0x584]
call fcn.00402cc4
call fcn.004025b8
ret
Function at 0x40c7c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff91c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x6e4], ebx
mov dword [ebp - 0x6dc], ebx
mov dword [ebp - 0x6e0], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040418c
mov eax, dword [ebp - 8]
call fcn.0040418c
mov eax, dword [ebp - 0xc]
call fcn.0040418c
xor eax, eax
push ebp
push 0x40cab2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6e0]
call fcn.00408b2c
mov eax, dword [ebp - 0x6e0]
call fcn.0040419c
mov edx, eax
lea eax, [ebp - 0x6dc]
call fcn.00403f48
mov edx, dword [ebp - 0x6dc]
lea eax, [ebp - 0x20]
mov ecx, 0x40cac8
call fcn.00403fe8
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x6d8]
call fcn.00402b54
mov edx, 1
lea eax, [ebp - 0x6d8]
call fcn.00403220
call fcn.004025b8
mov eax, dword [ebp - 4]
call fcn.00403f9c
mov ebx, eax
test ebx, ebx
jle 0x40c8b9
mov esi, 1
lea eax, [ebp - 0x6e4]
push eax
mov ecx, 1
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004041fc
mov eax, dword [ebp - 0x6e4]
call fcn.004081fc
mov byte [ebp - 0x19], al
lea edx, [ebp - 0x19]
lea eax, [ebp - 0x6d8]
call fcn.00403334
call fcn.004025b8
inc esi
dec ebx
jne 0x40c87e
lea eax, [ebp - 0x6d8]
call fcn.00402cc4
call fcn.004025b8
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x40c8f3
mov word [ebp - 0x30], 2
mov word [ebp - 0x2e], 0
push 0
call sub.wsock32.dll_htonl
mov dword [ebp - 0x2c], eax
push 0x10
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_bind
inc eax
jne 0x40c90a
call fcn.00403cac
mov word [ebp - 0x40], 2
mov eax, dword [ebp - 0xc]
call fcn.00408420
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x3e], ax
mov eax, dword [ebp - 8]
call fcn.0040419c
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x3c], eax
push 0x10
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_connect
inc eax
xor edx, edx
push ebp
push 0x40c9ef
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x58c]
call fcn.00402b54
mov edx, 0x80
lea eax, [ebp - 0x58c]
call fcn.00403204
call fcn.004025b8
xor edx, edx
push ebp
push 0x40c9b0
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x58c]
call fcn.00402dfc
call fcn.004025b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c9b7
lea eax, [ebp - 0x58c]
call fcn.00402cc4
call fcn.004025b8
ret
Function at 0x40cad8
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa74
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x588], ebx
mov dword [ebp - 0x58c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040418c
mov eax, dword [ebp - 8]
call fcn.0040418c
mov eax, dword [ebp - 0xc]
call fcn.0040418c
xor eax, eax
push ebp
push 0x40cd43
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x40cb4b
mov word [ebp - 0x28], 2
mov word [ebp - 0x26], 0
push 0
call sub.wsock32.dll_htonl
mov dword [ebp - 0x24], eax
push 0x10
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_bind
inc eax
jne 0x40cb62
call fcn.00403cac
mov word [ebp - 0x38], 2
mov eax, dword [ebp - 0xc]
call fcn.00408420
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x36], ax
mov eax, dword [ebp - 8]
call fcn.0040419c
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x34], eax
push 0x10
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.wsock32.dll_connect
inc eax
xor edx, edx
push ebp
push 0x40cc47
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x584]
call fcn.00402b54
mov edx, 0x80
lea eax, [ebp - 0x584]
call fcn.00403204
call fcn.004025b8
xor edx, edx
push ebp
push 0x40cc08
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x584]
call fcn.00402dfc
call fcn.004025b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cc0f
lea eax, [ebp - 0x584]
call fcn.00402cc4
call fcn.004025b8
ret
Function at 0x40cd7c
Capabilities:
Create tcp socket
Enumerate gui resources
Send data
Send data on socket
Start tcp server

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040418c
xor eax, eax
push ebp
push 0x40cf55
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x20], 2
push ebx
call sub.wsock32.dll_htons
mov word [ebp - 0x1e], ax
xor eax, eax
mov dword [ebp - 0x1c], eax
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0xc], eax
push 0x10
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_bind
inc eax
je 0x40cf3f
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_listen
inc eax
jne 0x40ce1d
xor eax, eax
push ebp
push 0x40ce0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40cf3f
mov dword [ebp - 8], 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_accept
mov edi, eax
xor eax, eax
push ebp
push 0x40ce7d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040419c
push eax
call fcn.00404cb0
mov esi, eax
push 0
push 0
push 0
push esi
call sub.user32.dll_DispatchMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40ce9a
push 0x96
call sub.user32.dll_EnumWindows
push 0
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x420]
push eax
push esi
call sub.user32.dll_GetKeyboardType
cmp eax, 1
sbb ebx, ebx
inc ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x420]
push eax
push edi
call sub.wsock32.dll_send
test bl, bl
je 0x40cea4
cmp dword [ebp - 0x10], 0
jne 0x40cea4
push esi
call fcn.00404ca0
xor eax, eax
push ebp
push 0x40cf03
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40cf0d
xor eax, eax
push ebp
push 0x40cf2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40cf38
mov byte [0x418210], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cf5c
lea eax, [ebp - 4]
call fcn.00403e18
ret
Function at 0x40cf64
Capabilities:
Create tcp socket
Enumerate gui resources
Send data
Send data on socket
Start tcp server

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x424], eax
xor eax, eax
push ebp
push 0x40d192
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x1c], 2
mov eax, dword [0x419760]
call fcn.00408420
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x1a], ax
xor eax, eax
mov dword [ebp - 0x18], eax
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 8], eax
push 0x10
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_bind
inc eax
je 0x40d174
push 1
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_listen
inc eax
jne 0x40d010
xor eax, eax
push ebp
push 0x40d001
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40d174
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_accept
mov edi, eax
xor eax, eax
push ebp
push 0x40d072
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [0x419754]
call fcn.0040419c
push eax
call fcn.00404cb0
mov esi, eax
push 0
push 0
push 0
push esi
call sub.user32.dll_DispatchMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40d08f
push 0x96
call sub.user32.dll_EnumWindows
push 0
lea eax, [ebp - 0xc]
push eax
push 0x400
lea eax, [ebp - 0x41c]
push eax
push esi
call sub.user32.dll_GetKeyboardType
cmp eax, 1
sbb ebx, ebx
inc ebx
push 0
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x41c]
push eax
push edi
call sub.wsock32.dll_send
test bl, bl
je 0x40d099
cmp dword [ebp - 0xc], 0
jne 0x40d099
push 0x40d1a8
lea edx, [ebp - 0x424]
mov eax, dword [0x419754]
call fcn.0040be8c
push dword [ebp - 0x424]
push 0x40d1c4
lea eax, [ebp - 0x420]
mov edx, 3
call fcn.0040405c
mov edx, dword [ebp - 0x420]
mov eax, dword [0x419728]
call fcn.0040bf24
push esi
call fcn.00404ca0
xor eax, eax
push ebp
push 0x40d138
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40d142
xor eax, eax
push ebp
push 0x40d163
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40d16d
mov byte [0x418210], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d199
lea eax, [ebp - 0x424]
mov edx, 2
call fcn.00403e3c
ret
Function at 0x40d1c8
Capabilities:
Create tcp socket
Receive data
Receive data on socket
Start tcp server

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x82c], eax
mov dword [ebp - 0x820], eax
mov dword [ebp - 0x824], eax
xor eax, eax
push ebp
push 0x40d403
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x1c], 2
mov eax, dword [0x419760]
call fcn.00408420
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x1a], ax
xor eax, eax
mov dword [ebp - 0x18], eax
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 8], eax
push 0x10
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_bind
inc eax
je 0x40d3e5
push 1
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_listen
inc eax
je 0x40d3e5
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_accept
mov esi, eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x40d2e7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [0x419758]
call fcn.0040419c
push eax
call fcn.00404cb0
mov edi, eax
push 0x40d41c
lea edx, [ebp - 0x824]
mov eax, dword [0x419758]
call fcn.0040be8c
push dword [ebp - 0x824]
push 0x40d438
lea eax, [ebp - 0x820]
mov edx, 3
call fcn.0040405c
mov eax, dword [ebp - 0x820]
call fcn.0040d4a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40d304
push 0
push 0x800
lea eax, [ebp - 0x81c]
push eax
push esi
call sub.wsock32.dll_recv
mov ebx, eax
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x81c]
push eax
push edi
call sub.user32.dll_FindWindowExA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x40d34a
cmp ebx, 0xffffffff
je 0x40d34a
test ebx, ebx
je 0x40d34a
cmp byte [0x418210], 0
je 0x40d304
push edi
call fcn.00404ca0
push 0x40d444
lea edx, [ebp - 0x82c]
mov eax, dword [0x419758]
call fcn.0040be8c
push dword [ebp - 0x82c]
push 0x40d438
lea eax, [ebp - 0x828]
mov edx, 3
call fcn.0040405c
mov eax, dword [ebp - 0x828]
call fcn.0040d4a8
xor eax, eax
push ebp
push 0x40d3a9
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40d3b3
xor eax, eax
push ebp
push 0x40d3d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40d3de
mov byte [0x418210], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d40a
lea eax, [ebp - 0x82c]
mov edx, 4
call fcn.00403e3c
ret
Function at 0x40d4f4
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [0x419720], eax
cmp dword [0x419720], 0xffffffff
je 0x40d534
mov word [0x41972c], 2
push esi
call sub.wsock32.dll_htons
mov word [0x41972e], ax
push 0
call sub.wsock32.dll_htonl
mov dword [0x419730], eax
push 0x10
push 0x41972c
mov eax, dword [0x419720]
push eax
call sub.wsock32.dll_bind
inc eax
jne 0x40d553
call sub.wsock32.dll_WSACleanup
call fcn.00403cac
push 3
mov eax, dword [0x419720]
push eax
call sub.wsock32.dll_listen
inc eax
jne 0x40d56d
call sub.wsock32.dll_WSACleanup
call fcn.00403cac
push 0x2b
push 0x1402
push ebx
mov eax, dword [0x419720]
push eax
call sub.wsock32.dll_WSAAsyncSelect
inc eax
jne 0x40d588
call fcn.00403cac
pop esi
pop ebx
ret
Function at 0x40dbfc
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x40dd02
push dword fs:[eax]
mov dword fs:[eax], esp
dec edx
je 0x40dc30
sub edx, 7
je 0x40dc92
sub edx, 0x18
je 0x40dcc4
jmp 0x40dcec
lea eax, [ebp - 4]
push eax
push 0x4004667f
push ebx
call sub.wsock32.dll_ioctlsocket
test eax, eax
jne 0x40dcec
mov eax, 0x419750
mov edx, dword [ebp - 4]
call fcn.004042cc
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x419750]
push eax
push ebx
call sub.wsock32.dll_recv
lea ecx, [ebp - 8]
mov dx, 0x89ef
mov eax, dword [0x419750]
call fcn.0040a1e0
mov edx, dword [ebp - 8]
mov eax, 0x419750
call fcn.00403e6c
mov edx, ebx
mov eax, dword [0x419750]
call fcn.0040d58c
jmp 0x40dcec
push 0
push 0
mov eax, dword [0x419720]
push eax
call sub.wsock32.dll_accept
mov dword [0x419724], eax
cmp dword [0x419724], 0xffffffff
jne 0x40dcec
push 0
push 0x40dd10
push 0x40dd10
push 0
call fcn.00404ec8
jmp 0x40dcec
xor eax, eax
push ebp
push 0x40dce2
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40dcec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40dd09
lea eax, [ebp - 8]
call fcn.00403e18
ret

Function at 0x41014c
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040418c
mov eax, dword [ebp - 8]
call fcn.0040418c
mov eax, dword [ebp - 0xc]
call fcn.0040418c
xor eax, eax
push ebp
push 0x41020e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
push 0
push 0
push 0
push 0x410220
call sub.wininet.dll_InternetOpenA
mov dword [0x4197bc], eax
cmp dword [0x4197bc], 0
je 0x4101f3
xor esi, esi
cmp byte [ebp + 8], 0
je 0x4101b3
or esi, 0x8000000
push 0
push esi
push 1
mov eax, dword [ebp - 0xc]
call fcn.0040419c
push eax
mov eax, dword [ebp - 8]
call fcn.0040419c
push eax
mov ax, word [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040419c
push eax
mov eax, dword [0x4197bc]
push eax
call sub.wininet.dll_InternetConnectA
mov dword [0x4197c0], eax
cmp dword [0x4197c0], 0
je 0x4101f3
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410215
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403e3c
ret
Function at 0x410264
Capabilities:
Send file using ftp

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040418c
mov eax, dword [ebp - 8]
call fcn.0040418c
xor eax, eax
push ebp
push 0x4102d1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040419c
push eax
mov eax, dword [ebp - 4]
call fcn.0040419c
push eax
mov eax, dword [0x4197c0]
push eax
call sub.wininet.dll_FtpPutFileA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4102d8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403e3c
ret

Function at 0x410c34
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, pe_nt_image_headers32
call fcn.00404f6c
ret
Function at 0x41130c
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1020], ebx
mov dword [ebp - 0x1024], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040418c
mov eax, dword [ebp - 8]
call fcn.0040418c
xor eax, eax
push ebp
push 0x4114be
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, dword [0x41a354]
call fcn.00403eb0
lea eax, [ebp - 0x10]
mov edx, dword [0x41a350]
call fcn.00403eb0
lea eax, [ebp - 0x1020]
push eax
mov edx, dword [ebp - 0x10]
mov eax, 0x4114d4
call fcn.00404284
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.004041fc
push dword [ebp - 0x1020]
push 0x4114e0
lea eax, [ebp - 0x1024]
push eax
mov edx, dword [ebp - 0x10]
mov eax, 0x4114d4
call fcn.00404284
mov edx, eax
inc edx
mov ecx, 0xde
mov eax, dword [ebp - 0x10]
call fcn.004041fc
push dword [ebp - 0x1024]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040405c
cmp dword [ebp - 8], 0
je 0x411406
push 0x4114ec
push dword [ebp - 0x10]
push 0x411550
push dword [ebp - 0x14]
push 0x411560
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov edx, 6
call fcn.0040405c
push 0x880300
push 0
push 0
push 0
push 0x411564
call sub.wininet.dll_InternetOpenA
mov ebx, eax
push 0
push 0x280000
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
call fcn.0040419c
push eax
mov eax, dword [ebp - 4]
call fcn.0040419c
push eax
push ebx
call sub.wininet.dll_InternetOpenUrlA
mov esi, eax
lea eax, [ebp - 0x101c]
xor ecx, ecx
mov edx, 0x1000
call fcn.00402e48
mov dword [ebp - 0x1c], 0x1000
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x101c]
push eax
push 0x16
push esi
call sub.wininet.dll_HttpQueryInfoA
mov eax, edi
lea edx, [ebp - 0x101c]
mov ecx, 0x1000
call fcn.00403f84
push esi
call sub.wininet.dll_InternetCloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4114c5
lea eax, [ebp - 0x1024]
mov edx, 2
call fcn.00403e3c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403e3c
ret

Function at 0x411834
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
mov eax, 0x4199a8
mov ecx, 0x432
mov edx, dword [0x41a358]
call fcn.004117f0
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [0x4199a8], eax
cmp dword [0x4199a8], 0xffffffff
je 0x411880
mov word [0x419a2c], 2
mov word [0x419a2e], 0
push 0
call sub.wsock32.dll_htonl
mov dword [0x419a30], eax
push 0x10
push 0x419a2c
mov eax, dword [0x4199a8]
push eax
call sub.wsock32.dll_bind
inc eax
push 0x33
push 0x432
mov eax, dword [0x41a358]
push eax
mov eax, dword [0x4199a8]
push eax
call sub.wsock32.dll_WSAAsyncSelect
inc eax
ret