joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa68ad6
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [esi + 8]
jmp 0xa689e0
mov word [esp + 1], cx
lea esp, [esp + 0x14]
xor edi, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
jmp 0xa68996
mov dword [esi + 4], edi
mov edi, 0x104b999
push ecx
jmp 0xa68da2
mov edi, edx
clc
shr edi, 0x18
call fcn.00a68a25
cmc
lea esp, [esp + 0x10]
xor edi, dword [ebx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
jmp 0xa68abf
movzx ebx, byte [esi + 0xa]
call fcn.00a68a8d
lea esp, [esp + 2]
and ebx, ecx
push ecx
push edx
call 0xa68ad6
pop edx
jmp 0xa68b15
movzx ebx, byte [esi + 0xd]
and edx, ecx
jmp 0xa68aff
mov edx, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
pushfd
jmp 0xa68b29
lea esp, [esp + 0x30]
xor edi, dword [ebx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
bswap ebx
xchg bh, bl
not bx
jmp 0xa68ad8
and edx, ecx
sub esp, 0xe
add esp, 4
push ebp
pop dword [esp]
jmp 0xa68b3b
lea esp, [esp + 2]
jmp 0xa68b8b
mov dword [esi + 8], edi
mov di, word [esp]
push ebx
dec edi
jmp 0xa68bd9
push sp
lea esp, [esp + 2]
jmp 0xa68b5e
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
mov edx, edi
mov edx, dword [esi + 0xc]
jmp 0xa68b74
sub esp, 5
lea esp, [esp + 1]
jmp 0xa68bc2
lea eax, reloc.PSAPI.DLL_GetMappedFileNameW
mov ebx, dword [eax]
pop eax
not edi
mov edi, edx
jmp 0xa68b9d
shr edi, 0x18
call fcn.00a68bfb
retf 0xd84a
push eax
mov eax, ebx
lea eax, [eax*4]
jmp 0xa68bb3
popal
lea ecx, [ecx*4]
lea ecx, reloc.PSAPI.DLL_GetMappedFileNameW
mov ebx, dword [ecx]
pop ecx
jmp 0xa68a74
pushal
mov dword [esp + 0x18], ebx
sub esp, 0xb
push word [esp + 2]
lea esp, [esp + 5]
lea esp, [esp + 8]
jmp 0xa68c14

Function at 0xa68af3
Capabilities:
Encrypt data using aes

Disassembly:
push esp
call 0xa68a7f
lea esp, [esp + 3]
lea esp, [esp + 1]
and ebx, ecx
jmp 0xa68aa3

Function at 0xa68bfb
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
jmp 0xa68d68
mov byte [esp + 1], ch
jmp 0xa68be5
pushal
rcl bh, cl
mov dl, dh
mov dword [esp + 0x10], edi
call fcn.00a68d0b
lea ebp, [ebp + 0xc]
mov dword [ebp], edi
pop ebp
jne 0xa3014b
je 0xa3019a

Function at 0xa68c2a
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0xa68c4e
and ebx, ecx
lea esp, [esp + 0x14]
xor edi, dword [ebx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
mov bx, 0xd417
jmp 0xa68c88
movzx ebx, byte [edi]
pop edi
pushfd
jmp 0xa68ca6
push edi
mov edi, esi
add edi, 0xe
jmp 0xa68c72
lea edi, reloc.PSAPI.DLL_GetMappedFileNameW
mov ebx, dword [edi]
pop edi
pushfd
jmp 0xa68cec
push edi
mov edi, ebx
lea edi, [edi*4]
jmp 0xa68c90
and ebx, ecx
sub esp, 9
lea esp, [esp + 1]
jmp 0xa68d27
and edx, ecx
sub esp, 9
lea esp, [esp + 1]
mov edx, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
jmp 0xa68cd6
lea esp, [esp + 4]
xor edi, dword [edx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
jmp 0xa68d4d
lea esp, [esp + 0x18]
xor edi, dword [ebx*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
pushfd
and edx, ecx
jmp 0xa68d11
lea ecx, [edx + edi]
mov cx, word [esp]
bswap ebx
mov dword [esp + 8], esi
popal
jmp 0xa68d76
dec dword [ebp - 4]
push ebp
pushal
jmp 0xa68d37
Function at 0xa68c40
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
and edi, ecx
mov edi, dword [edi*4 + reloc.PSAPI.DLL_GetMappedFileNameW]
call fcn.00a68c2a

Function at 0xa68d0b
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
clc
cmc
call fcn.00a68c40
popal
lea ebx, [ebx*4]
lea ebx, reloc.PSAPI.DLL_GetMappedFileNameW
mov edi, dword [ebx]
pop ebx
jmp 0xa68c6b
lea esp, [esp + 4]
jmp 0xa68cc3

Function at 0xb4eaf3
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
push dword [esp + 2]
mov dword [esp + 0x30], esp
call fcn.00b4eb3a
invalid
Function at 0x403870
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ecx
push ebx
push edi
lea eax, [esp + 8]
push eax
push 0x42da28
push 1
push 0
push 0x42daf8
mov edi, ecx
xor bl, bl
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x4038dc
push esi
push str.._rootcimv2
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push edi
push 0
push 0
push 0
push 0
push 0
mov esi, eax
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push 0
push esi
push eax
call edx
test eax, eax
jne 0x4038c2
mov bl, 1
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop esi
pop edi
mov al, bl
pop ebx
pop ecx
ret
pop edi
xor al, al
pop ebx
pop ecx
ret
Function at 0x403d70
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x1330
call fcn.0040ddd0
mov eax, dword [0x432d44]
xor eax, esp
mov dword [esp + 0x132c], eax
push ebx
push ebp
push esi
mov esi, ecx
cmp byte [esi + 4], 0
push edi
je 0x403ec3
cmp dword [esi + 8], 0
je 0x403e30
mov eax, dword [esi + 0xc]
test eax, eax
je 0x403e30
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.VDMEnumTaskWOWEx
push eax
call edi
mov eax, dword [esi + 8]
push str.EnumProcesses
push eax
call edi
mov ecx, dword [esi + 8]
push str.GetModuleFileNameExA
push ecx
call edi
mov edx, dword [esi + 8]
push str.GetModuleBaseNameA
push edx
mov ebp, eax
call edi
mov eax, dword [esi + 8]
push str.EnumProcessModules
push eax
call edi
mov edi, eax
test ebp, ebp
je 0x403e30
test edi, edi
je 0x403e30
mov ecx, dword [esp + 0x1344]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x403e30
lea edx, [esp + 0x10]
push edx
push 0x1000
lea eax, [esp + 0x1c]
push eax
push ebx
call edi
shr dword [esp + 0x10], 2
test eax, eax
jne 0x403e4d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x133c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040dd94
add esp, 0x1330
ret 4
xor edi, edi
cmp dword [esp + 0x10], edi
jbe 0x403eb2
jmp 0x403e60
mov edx, dword [esp + edi*4 + 0x14]
push 0x104
lea ecx, [esp + 0x123c]
push ecx
push edx
push ebx
call ebp
test eax, eax
je 0x403e29
lea eax, [esp + 0x1238]
push 0x5c
push eax
call fcn.0040eb5c
add esp, 8
test eax, eax
je 0x403e90
inc eax
mov ecx, dword [esp + edi*4 + 0x14]
mov edx, dword [esi]
mov edx, dword [edx + 0xc]
push eax
lea eax, [esp + 0x123c]
push eax
push ecx
mov ecx, esi
call edx
test eax, eax
je 0x403eb2
inc edi
cmp edi, dword [esp + 0x10]
jb 0x403e60
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x403e32
push 0x427fb0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.CreateToolhelp32Snapshot
push edi
call ebx
push str.Module32First
push edi
mov ebp, eax
call ebx
push str.Module32Next
push edi
mov dword [esp + 0x18], eax
call ebx
mov ebx, eax
test ebp, ebp
je 0x403e30
cmp dword [esp + 0x10], 0
je 0x403e30
test ebx, ebx
je 0x403e30
mov eax, dword [esp + 0x1344]
push eax
push 8
mov dword [esp + 0x101c], 0x224
call ebp
lea ecx, [esp + 0x1014]
mov edi, eax
push ecx
push edi
call dword [esp + 0x18]
mov edx, dword [esi]
mov edx, dword [edx + 0xc]
lea eax, [esp + 0x1034]
push eax
mov eax, dword [esp + 0x1034]
lea ecx, [esp + 0x1138]
push ecx
push eax
mov ecx, esi
call edx
test eax, eax
je 0x403fa4
lea eax, [esp + 0x1014]
push eax
push edi
call ebx
test eax, eax
je 0x403fa4
jmp 0x403f70
mov edx, dword [esi]
mov edx, dword [edx + 0xc]
lea eax, [esp + 0x1034]
push eax
mov eax, dword [esp + 0x1034]
lea ecx, [esp + 0x1138]
push ecx
push eax
mov ecx, esi
call edx
test eax, eax
je 0x403fa4
lea eax, [esp + 0x1014]
push eax
push edi
call ebx
test eax, eax
jne 0x403f70
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x403e32
Function at 0x4044b0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0x428078
xor esi, esi
push eax
mov dword [esp + 0x14], esi
call fcn.0040f4f8
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x4044d7
or edi, 0xffffffff
jmp 0x40454c
push ebx
mov ebx, dword [esp + 0x20]
lea esp, [esp]
mov ecx, dword [esp + 0x1c]
push ebp
push ebx
push 1
push ecx
xor edi, edi
call fcn.0040f417
mov esi, eax
add esp, 0x10
cmp esi, ebx
jae 0x40451b
push ebp
call fcn.0040f10f
add esp, 4
test eax, eax
jne 0x40451b
mov edx, dword [esp + 0x18]
push edx
push str.error_in_reading__s_n
call fcn.0040f04a
add esp, 8
or edi, 0xffffffff
test esi, esi
jbe 0x404536
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push esi
push eax
push ecx
call fcn.00404b50
add esp, 0xc
mov dword [esp + 0x10], eax
test edi, edi
jne 0x40453e
test esi, esi
ja 0x4044e0
push ebp
call fcn.0040efce
mov esi, dword [esp + 0x14]
add esp, 4
pop ebx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
push esi
push eax
push str.file__s_crc__x_n
mov dword [edx], esi
call fcn.0040f04a
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x404570
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor ebx, ebx
push 0x4000
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
call fcn.0040ee8d
mov edi, dword [esp + 0x44]
mov ebp, eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x20]
push ecx
push edi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
call fcn.00404410
add esp, 0x10
cmp dword [esi + 4], ebx
je 0x4045e3
lea edx, [esp + 0x10]
push edx
push 0x4000
push ebp
push edi
call fcn.004044b0
add esp, 0x10
mov eax, dword [esp + 0x44]
cmp eax, ebx
jne 0x4045ed
mov eax, edi
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 4]
push ecx
push edx
push ebx
push 8
mov edx, dword [esi]
push 0xfffffffffffffff1
push ebx
push 0xffffffffffffffff
push 8
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x4c]
push ecx
push eax
push edx
call fcn.00408c70
add esp, 0x40
test eax, eax
jne 0x404630
push 0x428078
push edi
call fcn.0040f4f8
add esp, 8
mov dword [esp + 0x44], eax
cmp eax, ebx
jne 0x404644
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x2c
ret 8
mov eax, dword [esp + 0x44]
push eax
push 0x4000
push 1
push ebp
xor esi, esi
call fcn.0040f417
mov edi, eax
add esp, 0x10
cmp edi, 0x4000
jge 0x404687
mov eax, dword [esp + 0x44]
push eax
call fcn.0040f10f
add esp, 4
test eax, eax
jne 0x404687
mov ecx, dword [esp + 0x40]
push ecx
push str.error_in_reading__s_n
call fcn.0040f04a
add esp, 8
or esi, 0xffffffff
cmp edi, ebx
jle 0x4046b4
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
push edi
push ebp
push eax
call fcn.00408770
mov esi, eax
add esp, 0xc
cmp esi, ebx
jge 0x4046b6
mov ecx, dword [esp + 0x40]
push ecx
push str.error_in_writing__s_in_the_zipfile_n
call fcn.0040f04a
add esp, 8
cmp esi, ebx
jne 0x4046bc
cmp edi, ebx
jg 0x404640
mov edx, dword [esp + 0x44]
push edx
call fcn.0040efce
add esp, 4
cmp esi, ebx
jl 0x4046f5
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push ecx
call fcn.00408a50
add esp, 4
test eax, eax
je 0x4046f5
push ebp
call fcn.0040edb0
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x2c
ret 8
push ebp
call fcn.0040edb0
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x2c
ret 8
Function at 0x404720
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x40473a
pop edi
lea eax, [esi + 1]
pop esi
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
jbe 0x40484a
push ebp
jmp 0x404750
mov eax, ebx
cmp ebx, 0x15b0
jb 0x40475f
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x40480b
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x404780
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x404780
test eax, eax
je 0x40481d
nop
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
sub eax, 1
jne 0x404810
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x404750
pop ebp
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
ret
Function at 0x407db0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi]
mov edx, ecx
xor edx, eax
shr ecx, 8
and edx, 0xff
mov edx, dword [edi + edx*4]
xor edx, ecx
movzx ecx, dl
add ecx, dword [esi + 4]
mov dword [esi], edx
mov edx, dword [esi + 8]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 4], ecx
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [edi + ecx*4]
mov dword [esi + 8], edx
ret

Function at 0x407e30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [0x432d44]
xor eax, esp
mov dword [esp + 0x18], eax
cmp dword [esp + 0x24], 0xc
mov eax, dword [esp + 0x20]
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov esi, edx
jge 0x407e70
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0040dd94
add esp, 0x1c
ret
mov eax, dword [0x4361bc]
inc eax
mov dword [0x4361bc], eax
cmp eax, 1
jne 0x407e95
push 0
call fcn.0040fc2b
xor eax, 0xbb40e64e
push eax
call fcn.0040dead
add esp, 8
push ebp
mov eax, edi
mov ecx, esi
mov edx, ebx
call fcn.00407df0
xor ebp, ebp
call fcn.0040debf
mov ebx, eax
sar ebx, 7
mov eax, esi
and ebx, 0xff
call fcn.00407d90
mov dword [esp + 0x10], eax
mov eax, ebx
call fcn.00407db0
xor bl, byte [esp + 0x10]
inc ebp
cmp ebp, 0xa
mov byte [esp + ebp + 0x1b], bl
jl 0x407ea3
mov edx, dword [esp + 0x18]
mov eax, edi
mov ecx, esi
call fcn.00407df0
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
xor ebp, ebp
sub eax, ecx
mov dword [esp + 0x18], eax
mov eax, esi
call fcn.00407d90
mov bl, byte [esp + ebp + 0x1c]
mov dword [esp + 0x10], eax
movzx eax, bl
call fcn.00407db0
mov edx, dword [esp + 0x18]
xor bl, byte [esp + 0x10]
add edx, ebp
inc ebp
cmp ebp, 0xa
mov byte [esp + edx + 0x1c], bl
jl 0x407ef0
mov eax, esi
call fcn.00407d90
mov ebx, dword [esp + 0x3c]
mov dword [esp + 0x10], eax
shr ebx, 0x10
mov eax, ebx
and eax, 0xff
call fcn.00407db0
xor bl, byte [esp + 0x10]
mov eax, dword [esp + 0x14]
mov byte [eax + ebp], bl
mov eax, esi
inc ebp
call fcn.00407d90
mov ebx, eax
mov eax, dword [esp + 0x3c]
shr eax, 0x18
call fcn.00407db0
mov ecx, dword [esp + 0x14]
xor al, bl
mov byte [ecx + ebp], al
mov ecx, dword [esp + 0x28]
lea eax, [ebp + 1]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040dd94
add esp, 0x1c
ret
Function at 0x4086d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
cmp dword [ebx + 0x4090], 0
je 0x408730
cmp dword [ebx + 0x6c], 0
jbe 0x408730
push ebp
mov eax, 0xffffff78
push esi
sub eax, ebx
push edi
lea esi, [ebx + 0x4094]
lea ebp, [ebx + 0x88]
mov dword [esp + 0x10], eax
lea esp, [esp]
mov eax, esi
call fcn.00407d90
mov edi, dword [ebx + 0x40a0]
mov dword [esp + 0xc], eax
movzx eax, byte [ebp]
call fcn.00407db0
mov al, byte [esp + 0xc]
xor byte [ebp], al
mov ecx, dword [esp + 0x10]
inc ebp
add ecx, ebp
cmp ecx, dword [ebx + 0x6c]
jb 0x408700
pop edi
pop esi
pop ebp
mov edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x20]
push edx
mov edx, dword [ebx + 0x1c]
lea eax, [ebx + 0x88]
push eax
mov eax, dword [ebx + 8]
push ecx
push edx
call eax
add esp, 0x10
cmp eax, dword [ebx + 0x6c]
mov dword [ebx + 0x6c], 0
je 0x40875e
or eax, 0xffffffff
add esp, 8
ret
xor eax, eax
add esp, 8
ret
Function at 0x408850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
xor edi, edi
cmp ebx, edi
jne 0x408864
pop edi
mov eax, 0xffffff9a
pop ebx
ret
cmp dword [ebx + 0x2c], edi
je 0x40885c
cmp dword [ebx + 0x80], 8
push ebp
push esi
mov dword [ebx + 0x34], edi
jne 0x4088c0
cmp dword [ebx + 0x84], edi
jne 0x4088c0
lea ebp, [ebx + 0x30]
cmp dword [ebx + 0x40], 0
jne 0x40889d
call fcn.004086d0
lea eax, [ebx + 0x88]
mov dword [ebx + 0x40], 0x4000
mov dword [ebx + 0x3c], eax
mov esi, dword [ebx + 0x44]
push 4
push ebp
call fcn.00404bf0
mov ecx, dword [ebx + 0x44]
sub ecx, esi
add dword [ebx + 0x6c], ecx
mov edi, eax
add esp, 8
test edi, edi
je 0x408882
cmp edi, 1
jne 0x4088c0
xor edi, edi
cmp dword [ebx + 0x6c], 0
jbe 0x4088d6
test edi, edi
jne 0x4088d6
call fcn.004086d0
cmp eax, 0xffffffff
jne 0x4088d6
or edi, eax
cmp dword [ebx + 0x80], 8
jne 0x4088fd
cmp dword [ebx + 0x84], 0
jne 0x408917
lea edx, [ebx + 0x30]
push edx
call fcn.00404ff0
add esp, 4
mov edi, eax
mov dword [ebx + 0x68], 0
cmp dword [ebx + 0x84], 0
jne 0x408917
mov eax, dword [ebx + 0x408c]
mov ecx, dword [ebx + 0x38]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov esi, dword [ebx + 0x74]
mov ebp, dword [ebx + 0x40a4]
mov ecx, dword [esp + 0x1c]
add ebp, dword [ebx + 0x44]
add esi, 0x10
mov edx, 4
call fcn.004080b0
mov esi, dword [ebx + 0x74]
add esi, 0x14
mov ecx, ebp
call fcn.004080b0
mov ecx, 1
cmp dword [ebx + 0x5c], ecx
jne 0x408959
mov esi, dword [ebx + 0x74]
add esi, 0x24
lea edx, [ecx + 1]
call fcn.004080b0
mov esi, dword [ebx + 0x74]
mov ecx, dword [esp + 0x18]
add esi, 0x18
mov edx, 4
call fcn.004080b0
test edi, edi
jne 0x408987
mov edx, dword [ebx + 0x78]
mov eax, dword [ebx + 0x74]
push edx
push eax
lea ecx, [ebx + 0x24]
push ecx
call fcn.00407fe0
add esp, 0xc
mov edi, eax
mov edx, dword [ebx + 0x74]
push edx
call fcn.0040edb0
add esp, 4
test edi, edi
jne 0x408a32
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx + 0xc]
push eax
push ecx
call edx
mov ecx, dword [ebx + 0x20]
mov edx, dword [ebx + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x70]
push edi
add eax, 0xe
push eax
mov eax, dword [ebx + 0x10]
push ecx
push edx
call eax
add esp, 0x18
test eax, eax
je 0x4089cd
or edi, 0xffffffff
jmp 0x408a14
mov ecx, dword [ebx + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
mov esi, 4
mov edx, ebx
call fcn.00408080
mov edi, eax
add esp, 4
test edi, edi
jne 0x408a14
mov edx, dword [ebx + 0x20]
push edx
mov ecx, ebp
mov edx, ebx
call fcn.00408080
mov edi, eax
add esp, 4
test edi, edi
jne 0x408a14
mov eax, dword [ebx + 0x20]
mov ecx, dword [esp + 0x18]
push eax
mov edx, ebx
call fcn.00408080
add esp, 4
mov edi, eax
mov ecx, dword [esp + 0x14]
mov edx, dword [ebx + 0x20]
mov eax, dword [ebx + 0x1c]
push 0
push ecx
mov ecx, dword [ebx + 0x10]
push edx
push eax
call ecx
add esp, 0x10
test eax, eax
je 0x408a32
or edi, 0xffffffff
inc dword [ebx + 0x40b0]
pop esi
pop ebp
mov eax, edi
pop edi
mov dword [ebx + 0x2c], 0
pop ebx
ret
Function at 0x409280
Capabilities:
Check for time delay via gettickcount
Create raw socket
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x814
mov eax, dword [0x432d44]
xor eax, esp
mov dword [esp + 0x810], eax
mov eax, dword [esp + 0x824]
mov ecx, dword [esp + 0x828]
push ebp
mov ebp, dword [esp + 0x81c]
push esi
push 1
push 0
push 0
push 1
push 3
push 2
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4092e5
pop esi
or eax, eax
pop ebp
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.0040dd94
add esp, 0x814
ret
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea edx, [esp + 0x830]
push edx
push 4
push 0
push esi
call edi
cmp eax, 0xffffffff
je 0x409362
push 4
lea eax, [esp + 0x10]
push eax
push 0x1006
push 0xffff
push esi
mov dword [esp + 0x20], 0x64
call edi
cmp eax, 0xffffffff
je 0x409362
push 4
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0xffff
push esi
mov dword [esp + 0x2c], 1
call edi
cmp eax, 0xffffffff
je 0x409362
push 4
lea edx, [esp + 0x10]
push edx
push 0x1005
push 0xffff
push esi
mov dword [esp + 0x20], 0x3e8
call edi
cmp eax, 0xffffffff
jne 0x40937d
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.0040dd94
add esp, 0x814
ret
push ebx
mov byte [esp + 0x20], 8
mov byte [esp + 0x21], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov word [esp + 0x24], ax
xor eax, eax
xor ecx, ecx
mov word [esp + 0x22], ax
mov word [esp + 0x26], cx
call edi
mov dword [esp + 0x28], eax
mov ax, word [0x4561c0]
mov word [esp + 0x26], ax
inc ax
mov word [0x4561c0], ax
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov eax, 0x2c
lea ecx, [esp + 0x20]
call fcn.00409210
mov word [esp + 0x22], ax
call edi
push 0x10
push ebp
push 0
push 0x2c
lea edx, [esp + 0x30]
push edx
push esi
mov ebx, eax
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x409436
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
push ecx
push 0
push 0x400
lea edx, [esp + 0x430]
push edx
push esi
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xffffffff
jne 0x40943b
or eax, 0xffffffff
jmp 0x40943f
call edi
sub eax, ebx
mov ecx, dword [esp + 0x820]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040dd94
add esp, 0x814
ret
Function at 0x409990
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x428
mov eax, dword [0x432d44]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [esp + 0x42c]
push ebp
push esi
push eax
mov ebp, 1
mov dword [0x4561c4], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x409b18
cmp word [esi + 8], 2
jne 0x409b18
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
movsx eax, word [esi + 0xa]
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx]
push edi
push eax
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.0040d500
mov cx, word [esi + 8]
mov word [esp + 0x1c], cx
add esp, 0xc
mov ecx, 0x4561cc
call fcn.00409860
push 0
push 0x427334
mov ecx, 0x4561cc
call fcn.00409770
push str.ip_time_host_n
mov ecx, 0x4561c8
call fcn.00409900
mov edi, dword [sym.imp.WS2_32.dll_gethostbyaddr]
lea esp, [esp]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x24]
push eax
push ebp
lea ecx, [esp + 0x1c]
push 0x10
push ecx
mov dword [esp + 0x20], 0x10
call fcn.00409280
mov esi, eax
add esp, 0x14
test esi, esi
jl 0x409ad7
mov edx, dword [0x4561c4]
cmp edx, 0xffffffff
je 0x409ad7
movzx eax, byte [esp + 0x27]
movzx ecx, byte [esp + 0x26]
push esi
push eax
mov eax, dword [esp + 0x2c]
push ecx
movzx edx, ah
push edx
movzx eax, al
push eax
lea ecx, [esp + 0x44]
push str._d._d._d._d__d_
push ecx
call fcn.0040ea23
add esp, 0x1c
push 2
push 4
lea edx, [esp + 0x2c]
push edx
call edi
test eax, eax
je 0x409ac2
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x34]
push 0x42bf7c
push ecx
call fcn.0040ea23
add esp, 0xc
lea edx, [esp + 0x30]
push edx
mov ecx, 0x4561c8
call fcn.00409900
inc dword [0x4561c4]
inc ebp
test esi, esi
jl 0x409af4
mov eax, dword [0x4561c4]
cmp eax, 0xffffffff
je 0x409af4
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x24]
jne 0x409a40
pop edi
pop esi
mov dword [0x4561c4], 0xffffffff
mov al, 1
pop ebp
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.0040dd94
add esp, 0x428
ret
mov ecx, dword [esp + 0x42c]
pop esi
pop ebp
xor ecx, esp
xor al, al
call fcn.0040dd94
add esp, 0x428
ret

Function at 0x409bb0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push eax
push 0
push 0x409b40
call fcn.0040e0b5
add esp, 0xc
ret 4