joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415f40
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
push ebp
mov ebp, esp
sub esp, 0x258
mov edi, eax
call fcn.00415384
mov ebx, eax
lea edx, [ebp - 0x114]
push ebp
mov ebp, dword [ebp]
call fcn.0041e655
pop ebp
or eax, eax
je 0x416073
xor ecx, ecx
xchg dword [ebx + 0xc], ecx
jecxz 0x415f86
push eax
push edx
push ecx
mov edx, dword [sym.imp.KERNEL32.DLL_FindClose]
call fcn.0041f51b
pop edx
pop eax
mov esi, edx
add esi, eax
mov al, byte [esi - 1]
and edi, 0x9e
test edi, 0x80
je 0x415fa9
test edi, 0x16
jne 0x415fa9
xor edi, 0x80
mov dword [ebx + 0x10], edi
test edi, 8
jne 0x415fed
cmp al, 0x3a
je 0x415fbc
cmp al, 0x5c
jne 0x415fc7
mov word [esi], 0x2e2a
mov word [esi + 2], 0x2a
lea eax, [ebp - 0x258]
push eax
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
call fcn.0041f51b
cmp eax, 0xffffffff
stc
je 0x4160a4
mov dword [ebx + 0xc], eax
cmc
jmp 0x4160a4
push eax
cld
xor al, al
mov ecx, 0x140
lea edi, [ebp - 0x258]
rep stosb byte es:[edi], al
pop eax
cmp word [edx], 0x5c5c
jne 0x416011
cmp al, 0x5c
je 0x41601b
mov word [esi], 0x5c
jmp 0x41601b
mov byte [edx + 1], 0x3a
mov word [edx + 2], 0x5c
push 0
push 0
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x234]
push eax
push 0
push 0x104
lea eax, [ebp - 0x22c]
push eax
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
call fcn.0041f51b
xor ecx, ecx
xor esi, esi
test eax, eax
je 0x416170
lea esi, [ebp - 0x22c]
jmp 0x416143
xor ecx, ecx
test dword [ebx + 0xc], 0xffffffff
je 0x416170
test dword [ebx + 0x10], 8
jne 0x416170
lea edx, [ebp - 0x258]
push edx
push dword [ebx + 0xc]
mov edx, dword [sym.imp.KERNEL32.DLL_FindNextFileA]
call fcn.0041f51b
mov word [ebp - 0x90], 0
lea esi, [ebp - 0x22c]
jae 0x4160df
cld
xor al, al
mov ecx, 0x140
lea edi, [ebp - 0x258]
rep stosb byte es:[edi], al
xor ecx, ecx
mov byte [esi], cl
mov dword [ebx + 0x10], ecx
xchg dword [ebx + 0xc], ecx
jecxz 0x4160dd
push ecx
mov edx, dword [sym.imp.KERNEL32.DLL_FindClose]
call fcn.0041f51b
jmp 0x416143
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebx + 0x10]
test ecx, 8
je 0x4160f9
test eax, 8
je 0x41608f
jmp 0x416143
and eax, 0x16
je 0x416133
test eax, 2
je 0x41610d
test ecx, 2
je 0x41608f
test eax, 4
je 0x416120
test ecx, 4
je 0x41608f
test eax, 0x10
je 0x416133
test ecx, 0x10
je 0x41608f
test ecx, 0x80
je 0x416143
test ecx, eax
je 0x41608f
cld
xor al, al
mov ecx, 0x103
mov edi, esi
repne scasb al, byte es:[edi]
lea ecx, [edi - 1]
sub ecx, esi
mov ax, word [esi]
cmp ax, 0x2e
je 0x41608f
cmp ax, 0x2e2e
jne 0x416170
cmp ecx, 2
je 0x41608f
push ecx
push esi
cld
mov ecx, 0x140
lea esi, [ebp - 0x258]
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x416187
rep movsb byte es:[edi], byte [esi]
pop esi
pop ecx
push ebp
mov ebp, dword [ebp]
call fcn.0041f005
pop ebp
mov esp, ebp
pop ebp
pop edi
pop esi
pop ecx
pop ebx
jb 0x41619e
pop eax
ret
mov edx, eax
pop eax
jmp fcn.004152b1
Function at 0x416ac2
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041c043
or ecx, ecx
je 0x416b98
mov ebx, esi
mov edx, 3
mov al, byte [ebx]
cmp al, 0x22
jne 0x416af9
inc ebx
dec ecx
je 0x416b16
cmp byte [ebx], 0x22
jne 0x416aeb
inc ebx
loop 0x416ae5
jmp 0x416b16
cmp al, 0x5c
jne 0x416b06
inc ebx
dec ecx
je 0x416b16
inc ebx
loop 0x416ae5
jmp 0x416b16
cmp al, 0x3b
je 0x416b0f
inc ebx
loop 0x416ae5
jmp 0x416b16
push ebx
dec edx
je 0x416b1a
inc ebx
loop 0x416ae5
push ebx
dec edx
jne 0x416b16
pop edx
pop ecx
pop ebx
ftst
wait
fnstsw ax
sahf
jb 0x416b3a
jne 0x416b36
cmp ecx, edx
je 0x416b36
inc ecx
cmp ecx, edx
je 0x416b36
mov eax, edx
mov esi, ecx
jmp 0x416b49
mov eax, ebx
jmp 0x416b49
cmp ebx, ecx
je 0x416b36
inc ebx
cmp ebx, edx
je 0x416b36
mov eax, ecx
mov esi, ebx
fchs
cmp eax, esi
jbe 0x416b98
mov ecx, 0x10
sub esp, 0x1000
mov dword [esp], eax
loop 0x416b52
push esp
push esi
push esi
push eax
mov ecx, eax
sub ecx, esi
call fcn.00416bc0
call fcn.0041f502
pop ecx
mov esi, esp
push ecx
call fcn.0041f005
jb 0x416b86
add esp, 0x10000
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
mov edx, eax
add esp, 0x10000
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.004152b1
mov ecx, 0x10
sub esp, 0x1000
mov dword [esp], eax
loop 0x416b9d
mov esi, esp
call fcn.0041f1ee
call fcn.0041f502
dec edx
cmp byte [esi], 0x20
jne 0x416bbc
dec edx
inc esi
mov ecx, edx
jmp 0x416b73

Function at 0x41791b
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.0041c043
jecxz 0x41795d
call fcn.0041bfe7
jb 0x4179a9
cld
test eax, eax
je 0x417948
lodsb al, byte [esi]
call fcn.00417a74
stosb byte es:[edi], al
loop 0x41793b
mov esi, edx
jmp 0x417955
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharLowerBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.0041c01b
pop ebp
pop edi
pop esi
pop ecx
ret
mov edx, eax
pop ebp
pop edi
pop esi
pop ecx
jmp fcn.004152b1

Function at 0x417962
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.0041c043
jecxz 0x4179a4
call fcn.0041bfe7
jb 0x4179a9
cld
test eax, eax
je 0x41798f
lodsb al, byte [esi]
call fcn.00417ab0
stosb byte es:[edi], al
loop 0x417982
mov esi, edx
jmp 0x41799c
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharUpperBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.0041c01b
pop ebp
pop edi
pop esi
pop ecx
ret
Function at 0x417d8b
Capabilities:
Get socket status
Send data
Send data on socket
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x104
mov ax, word [ebp - 0x46]
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041c043
call fcn.0041c0f9
jb 0x417e37
test byte [edi + 0xc], 0x40
je 0x417e3b
add esp, 0x104
mov ebx, ecx
mov eax, dword [edi + 6]
mov ecx, 0x40
push eax
loop 0x417dcb
push 0x40
mov edx, esp
mov eax, dword [edi + 0x38]
mov ecx, eax
and eax, 0x3ff
shl eax, 0xa
shr ecx, 0xa
push eax
push ecx
push esp
push 0
push edx
push 0
push 0
call dword [sym.imp.WSOCK32.DLL_select]
pop edx
pop edx
cmp eax, 0xffffffff
je 0x417e28
test eax, eax
je 0x417e47
push 0
push ebx
push esi
push dword [edi + 6]
call dword [sym.imp.WSOCK32.DLL_send]
cmp eax, 0xffffffff
je 0x417e28
add esi, eax
sub ebx, eax
jg 0x417dd0
and word [edi + 0x2c], 0xfffd
call fcn.0041f502
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x417e3f
jmp 0x417e43
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
call fcn.0041f502
add esp, 0x104
pop edi
pop esi
jmp fcn.004152bc
Function at 0x417e5b
Capabilities:
Get socket status
Receive data
Receive data on socket
Terminate process

Disassembly:
push esi
push edi
mov dword [ebp - 0x6c], 0
sub esp, 0x104
mov ecx, eax
call fcn.0041bfe7
mov ebx, ecx
jb 0x417fcc
mov dword [ebp - 0x6c], edi
mov ax, word [ebp - 0x46]
call fcn.0041c0bb
jb 0x417fb2
test byte [esi + 0xc], 0x40
je 0x417fb6
and word [esi + 0x2c], 0xfff5
add esp, 0x104
mov eax, dword [esi + 6]
mov ecx, 0x40
push eax
loop 0x417ea8
push 0x40
mov ecx, dword [esi + 0x28]
jecxz 0x417f01
cmp ebx, ecx
ja 0x417eb8
mov ecx, ebx
sub dword [esi + 0x28], ecx
sub ebx, ecx
push esi
push dword [esi + 0x28]
cld
lea edx, [esi + 0x44]
mov esi, edx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop ecx
xchg edi, edx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
pop esi
test dword [esi + 0x28], 0xffffffff
jne 0x417f77
test word [esi + 0x2c], 8
je 0x417f01
or word [esi + 0x2c], 2
jmp 0x417f77
test ebx, ebx
je 0x417f8e
mov edx, esp
mov eax, dword [esi + 0x38]
mov ecx, eax
and eax, 0x3ff
shl eax, 0xa
shr ecx, 0xa
push eax
push ecx
push esp
push 0
push 0
push edx
push 0
call dword [sym.imp.WSOCK32.DLL_select]
pop edx
pop edx
cmp eax, 0xffffffff
je 0x417f9f
test eax, eax
jne 0x417f42
mov ecx, edi
sub ecx, dword [ebp - 0x6c]
jne 0x417f5b
jmp 0x417fc2
lea edx, [esi + 0x44]
push 0
push 0x10000
push edx
push dword [esi + 6]
call dword [sym.imp.WSOCK32.DLL_recv]
cmp eax, 0xffffffff
je 0x417f9f
mov dword [esi + 0x28], eax
cmp eax, 0x10000
je 0x417f6a
or word [esi + 0x2c], 8
test eax, eax
jne 0x417ead
or word [esi + 0x2c], 2
test ebx, ebx
je 0x417f8e
push esi
mov ecx, edi
mov esi, dword [ebp - 0x6c]
sub ecx, esi
call fcn.0041c069
pop esi
jb 0x417fd1
mov dword [ebp - 0x6c], edx
mov edx, dword [ebp - 0x6c]
call fcn.0041efbe
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x417fba
jmp 0x417fbe
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
mov esi, dword [ebp - 0x6c]
call fcn.0041c01b
call fcn.0041efbc
add esp, 0x104
pop edi
pop esi
jmp fcn.004152bc
Function at 0x417fee
Capabilities:
Get socket status
Receive data
Receive data on socket
Terminate process

Disassembly:
push esi
push edi
mov dword [ebp - 0x6c], 0
sub esp, 0x104
mov ecx, 0x10000
call fcn.0041bfe7
mov ebx, ecx
jb 0x41817b
mov dword [ebp - 0x6c], edi
mov ax, word [ebp - 0x46]
call fcn.0041c0bb
jb 0x418161
and word [esi + 0x2c], 0xfffd
test byte [esi + 0xc], 0x40
je 0x418165
add esp, 0x104
mov eax, dword [esi + 6]
mov ecx, 0x40
push eax
loop 0x41803e
push 0x40
mov ecx, dword [esi + 0x28]
jecxz 0x4180ae
cmp ebx, ecx
ja 0x41804e
mov ecx, ebx
sub ebx, ecx
sub dword [esi + 0x28], ecx
push esi
push dword [esi + 0x28]
cld
lea edx, [esi + 0x44]
mov esi, edx
lodsb al, byte [esi]
cmp al, 0xd
je 0x418067
cmp al, 0xa
je 0x41807d
stosb byte es:[edi], al
loop 0x41805d
pop ecx
xchg edi, edx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
pop esi
jmp 0x4180ae
lea eax, [ecx - 1]
pop ecx
add ebx, eax
add ecx, eax
xchg edi, edx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
pop esi
add dword [esi + 0x28], eax
jne 0x418126
test word [esi + 0x2c], 8
je 0x4180ae
or word [esi + 0x2c], 2
jmp 0x418126
test ebx, ebx
je 0x41813d
mov edx, esp
mov eax, dword [esi + 0x38]
mov ecx, eax
and eax, 0x3ff
shl eax, 0xa
shr ecx, 0xa
push eax
push ecx
push esp
push 0
push 0
push edx
push 0
call dword [sym.imp.WSOCK32.DLL_select]
pop edx
pop edx
cmp eax, 0xffffffff
je 0x41814e
test eax, eax
jne 0x4180ef
mov ecx, edi
sub ecx, dword [ebp - 0x6c]
jne 0x41810a
jmp 0x418171
je 0x41810a
lea edx, [esi + 0x44]
push 0
push 0x10000
push edx
push dword [esi + 6]
call dword [sym.imp.WSOCK32.DLL_recv]
cmp eax, 0xffffffff
je 0x41814e
mov dword [esi + 0x28], eax
cmp eax, 0x10000
je 0x418119
or word [esi + 0x2c], 8
test eax, eax
jne 0x418043
or word [esi + 0x2c], 2
test ebx, ebx
je 0x41813d
push esi
mov ecx, edi
mov esi, dword [ebp - 0x6c]
sub ecx, esi
call fcn.0041c069
pop esi
jb 0x418180
mov dword [ebp - 0x6c], edx
mov edx, dword [ebp - 0x6c]
call fcn.0041efbe
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x418169
jmp 0x41816d
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
mov esi, dword [ebp - 0x6c]
call fcn.0041c01b
call fcn.0041efbc
add esp, 0x104
pop edi
pop esi
jmp fcn.004152bc
Function at 0x418405
Capabilities:
Create udp socket
Get hostname
Initialize winsock library
Set socket configuration
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x228
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x64], 0
xchg ch, cl
mov ebx, ecx
sub esp, 0x190
push esp
push 2
call dword [sym.imp.WSOCK32.DLL_WSAStartup]
mov cl, byte [esp]
add esp, 0x190
test eax, eax
jne 0x418593
cmp cl, 2
jne 0x418593
mov ax, word [ebp - 0x46]
test ax, ax
js 0x41858f
call fcn.0041c0f9
jae 0x41858b
mov ecx, 0x10044
call fcn.0041bfe7
jb 0x418595
mov dword [ebp - 0x64], edx
call fcn.0041c137
jb 0x418595
cld
xor eax, eax
mov ecx, 0x20
push edi
add edi, 4
rep stosw word es:[edi], ax
pop edi
mov ax, word [ebp - 0x46]
mov ecx, dword [ebp - 0x6c]
mov word [edi + 4], ax
mov word [edi + 0xa], 2
mov word [edi + 0xc], pe_nt_image_headers32
mov word [edi + 0xe], 0xc0
mov dword [edi + 0x1c], 0x10000
mov dword [edi + 0x30], ebx
mov dword [edi + 0x38], ecx
push 0
push 2
push 2
call dword [sym.imp.WSOCK32.DLL_socket]
cmp eax, 0xffffffff
je 0x41856f
mov dword [edi + 6], eax
push 0x100
lea eax, [esp + 8]
push eax
call dword [sym.imp.WSOCK32.DLL_gethostname]
test eax, eax
jne 0x41856f
lea eax, [esp + 3]
lea edx, [eax + 1]
inc eax
test byte [eax], 0xff
jne 0x4184eb
sub eax, edx
cmp eax, 0x100
jb 0x4184ff
mov eax, 0x100
mov dword [esp], eax
cmp dword [edi + 0x30], 0xffffffff
je 0x41852a
push 0
push 0
push 0
push word [edi + 0x30]
push 2
mov eax, esp
push 0x10
push eax
push dword [edi + 6]
call dword [sym.imp.WSOCK32.DLL_bind]
add esp, 0x10
test eax, eax
jne 0x41856f
mov ebx, edi
mov ecx, dword [esp]
call fcn.0041bfe7
jb 0x418595
mov dword [ebx + 0x10], edx
cld
lea esi, [esp + 4]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 1
mov edx, esp
push 4
push edx
push 0x20
push 0xffff
push dword [ebx + 6]
call dword [sym.imp.WSOCK32.DLL_setsockopt]
pop edx
test eax, eax
jne 0x41856f
add esp, 0x228
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
jne 0x418580
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
push eax
call fcn.00417fde
pop eax
mov dx, 0x37b0
mov al, 0x37
mov dx, 0x34b0
mov al, 0x34
mov dx, 0x44b0
mov al, 0x44
mov edx, dword [ebp - 0x64]
test edx, edx
je 0x4185aa
push eax
mov esi, edx
call fcn.0041c182
call fcn.0041c01b
pop eax
add esp, 0x228
pop edi
pop esi
jmp fcn.004152bc
Function at 0x4185b7
Capabilities:
Get socket status
Receive data
Receive data on socket
Terminate process

Disassembly:
push esi
push edi
mov dword [ebp - 0x6c], 0
sub esp, 0x104
mov ax, word [ebp - 0x46]
call fcn.0041c0bb
jb 0x4186b0
test byte [esi + 0xc], 0x80
je 0x4186b4
and word [esi + 0x2c], 0xfffd
add esp, 0x104
mov eax, dword [esi + 6]
mov ecx, 0x40
push eax
loop 0x4185f2
push 0x40
mov edx, esp
mov eax, dword [esi + 0x38]
mov ecx, eax
and eax, 0x3ff
shl eax, 0xa
shr ecx, 0xa
push eax
push ecx
push esp
push 0
push 0
push edx
push 0
call dword [sym.imp.WSOCK32.DLL_select]
pop edx
pop edx
cmp eax, 0xffffffff
je 0x4186a1
test eax, eax
je 0x4186c0
lea ecx, [esi + 0x34]
lea edx, [esi + 0x44]
push 0
push 0
push dword [esi + 0x34]
push word [esi + 0x30]
push 2
mov ecx, esp
lea edx, [esi + 0x44]
push 0x10
push esp
push ecx
push 0
push 0x10000
push edx
push dword [esi + 6]
call dword [sym.imp.WSOCK32.DLL_recvfrom]
add esp, 4
mov ebx, dword [esp + 4]
movzx ecx, word [esp + 2]
add esp, 0x10
cmp eax, 0xffffffff
je 0x4186a1
test eax, eax
jne 0x418677
or word [esi + 0x2c], 2
xchg ecx, eax
call fcn.0041bfe7
jb 0x4186c2
add esi, 0x44
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041efbe
mov ecx, ebx
xchg ah, al
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x4186b8
jmp 0x4186bc
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
call fcn.0041efbc
add esp, 0x104
pop edi
pop esi
jmp fcn.004152bc

Function at 0x4186d4
Capabilities:
Get socket status
Send data
Send data on socket
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x104
mov ebx, ecx
push eax
mov ax, word [ebp - 0x46]
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041c043
call fcn.0041c0f9
pop eax
jb 0x41878d
test byte [edi + 0xc], 0x80
je 0x418791
xchg ah, al
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ebx
add esp, 0x104
mov ebx, ecx
mov eax, dword [edi + 6]
mov ecx, 0x40
push eax
loop 0x418720
push 0x40
mov edx, esp
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.WSOCK32.DLL_select]
cmp eax, 0xffffffff
je 0x41877e
test eax, eax
je 0x41879d
push 0
push 0
push dword [edi + 0x34]
push word [edi + 0x30]
push 2
mov ecx, esp
push 0x10
push ecx
push 0
push ebx
push esi
push dword [edi + 6]
call dword [sym.imp.WSOCK32.DLL_sendto]
add esp, 0x10
cmp eax, 0xffffffff
je 0x41877e
cmp eax, ebx
jb 0x418799
and word [edi + 0x2c], 0xfffd
call fcn.0041f502
add esp, 0x104
pop edi
pop esi
ret
call dword [sym.imp.WSOCK32.DLL_WSAGetLastError]
cmp eax, 0x2734
je 0x418795
jmp 0x418799
mov al, 0x34
mov dx, 0x36b0
mov al, 0x36
mov dx, 0x46b0
mov al, 0x46
mov dx, 0x39b0
mov al, 0x39
mov dx, 0x18b0
mov al, 0x18
call fcn.0041f502
add esp, 0x104
pop edi
pop esi
jmp fcn.004152bc
Function at 0x418b01
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edx, ecx
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041c043
test eax, eax
jns 0x418b1a
add eax, ecx
test edx, edx
je 0x418b5a
jns 0x418b25
add edx, ecx
js 0x418b5a
inc edx
dec edx
add esi, edx
sub ecx, edx
jae 0x418b2e
xor ecx, ecx
cmp ecx, eax
jb 0x418b34
mov ecx, eax
call fcn.0041bfe7
jb 0x418b5e
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041c81b
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
ret
xor edx, edx
jmp 0x418b48
pop edi
pop esi
jmp fcn.004152bc

Function at 0x418b65
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041c043
test eax, eax
jns 0x418b7d
add eax, ecx
cmp eax, ecx
jae 0x418ba9
xchg ecx, eax
call fcn.0041bfe7
jb 0x418bad
sub eax, ecx
add esi, eax
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041c81b
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
ret
pop edi
pop esi
pop ecx
jmp fcn.004152bc

Function at 0x41bc9d
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, eax
call fcn.0041bfe7
jb 0x41bcc0
mov eax, 0x20202020
cld
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
call fcn.0041efbe
pop edi
pop ecx
ret
pop edi
pop ecx
call fcn.0041efbc
jmp fcn.004152bc

Function at 0x41bccc
Capabilities:
Terminate process

Disassembly:
push ecx
push edi
mov ecx, 1
call fcn.0041bfe7
jb 0x41bcc0
mov byte [edi], 0x20
call fcn.0041efbe
pop edi
pop ecx
ret

Function at 0x41bcfe
Capabilities:
Terminate process

Disassembly:
push edi
xchg ecx, ebx
call fcn.0041bfe7
jb 0x41bd1e
call fcn.0041efbe
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
ret
call fcn.0041efbc
pop edi
jmp fcn.004152bc

Function at 0x41bd29
Capabilities:
Terminate process

Disassembly:
push eax
push esi
push edi
xchg ecx, ebx
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x6c]
call fcn.0041c056
mov al, 0
je 0x41bd43
mov al, byte [edi]
call fcn.0041c81b
call fcn.0041bfe7
jb 0x41bd66
mov dword [ebp + esi - 0x6c], edx
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
pop esi
pop eax
ret
mov dword [ebp + esi - 0x6c], 0
mov edx, eax
pop edi
pop esi
pop eax
jmp fcn.004152b1

Function at 0x41c901
Capabilities:
Terminate process

Disassembly:
call fcn.0041f0b0
jb 0x41c909
ret
jmp fcn.004152bc
Function at 0x41c968
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, dword [0x4213e0]
mov ecx, eax
jecxz 0x41c9c2
cld
lodsb al, byte [esi]
test al, al
je 0x41c9be
cmp al, 0x20
je 0x41c976
cmp al, 0x22
je 0x41c99e
lea edi, [esi - 1]
lodsb al, byte [esi]
test al, al
je 0x41c993
cmp al, 0x20
jne 0x41c986
loop 0x41c976
jmp 0x41c995
loop 0x41c9be
lea ecx, [esi - 1]
mov esi, edi
sub ecx, esi
jmp 0x41c9d1
mov edi, esi
lodsb al, byte [esi]
test al, al
je 0x41c9b3
cmp al, 0x22
jne 0x41c9a0
cmp byte [esi - 2], 0x22
je 0x41c976
loop 0x41c976
jmp 0x41c9b5
loop 0x41c9be
lea ecx, [esi - 1]
mov esi, edi
sub ecx, esi
jmp 0x41c9d1
xor ecx, ecx
jmp 0x41c9d1
push esi
mov ecx, 0xffffffff
dec esi
inc ecx
inc esi
test byte [esi], 0xff
jne 0x41c9c9
pop esi
call fcn.0041f005
pop edi
pop esi
pop ecx
jb 0x41c9dc
ret
jmp fcn.004152bc

Function at 0x41ca70
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0041c056
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041c043
jecxz 0x41ca90
jmp 0x41ca95
jmp 0x41cb2a
test eax, eax
je 0x41cab8
jns 0x41ca9e
add eax, edx
inc eax
dec eax
sub edx, eax
jbe 0x41cab8
push eax
add edi, eax
push edi
call fcn.0041d206
pop eax
pop edx
jae 0x41cab4
test edx, edx
je 0x41cb2a
mov ecx, edi
jmp 0x41caf9
xor edx, edx
jmp 0x41cb11
mov esi, eax
sub ecx, eax
call fcn.0041bfe7
jb 0x41cb31
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041f502
call fcn.0041c81b
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.0041f502
jmp 0x41cb25
call fcn.0041f502
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.004152b1

Function at 0x41cb41
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0041c056
je 0x41cb86
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041c043
je 0x41cb86
test eax, eax
je 0x41cb86
jns 0x41cb6a
add eax, edx
inc eax
dec eax
sub edx, eax
jbe 0x41cb86
add edi, eax
push ecx
call fcn.0041d206
pop ecx
jb 0x41cb86
mov esi, edi
sub edx, ecx
add esi, ecx
mov ecx, edx
jecxz 0x41cb86
jmp 0x41cbc4
xor edx, edx
jmp 0x41cbd8
call fcn.0041bfe7
jb 0x41cbf1
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041f502
call fcn.0041c81b
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.0041f502
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.004152b1
Function at 0x41cc22
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041c043
je 0x41cc69
mov al, 0x20
cmp byte [esi], al
je 0x41cc43
jmp 0x41cc69
cmp byte [esi], al
jne 0x41cc46
inc esi
loop 0x41cc3f
call fcn.0041bfe7
jb 0x41cc6e
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041c81b
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
pop eax
ret
mov edx, eax
pop edi
pop esi
pop ecx
pop eax
jmp fcn.004152b1

Function at 0x41cc79
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.0041c043
je 0x41cc69
lea edi, [esi - 1]
add edi, ecx
mov al, 0x20
cmp byte [edi], al
je 0x41cc9f
jmp 0x41cc69
cmp byte [edi], al
jne 0x41cc46
dec edi
loop 0x41cc9b
jmp 0x41cc46

Function at 0x41cca4
Capabilities:
Terminate process

Disassembly:
push eax
call fcn.0041cd86
jb 0x41ccfe
cmp ecx, edx
ja 0x41ccfe
mov eax, esi
mov ebx, ecx
mov ebp, edi
repe cmpsb byte [esi], byte es:[edi]
jne 0x41ccc6
mov eax, esi
sub edx, ebx
jl 0x41ccc6
mov ecx, ebx
mov edi, ebp
jmp 0x41ccb6
or edx, edx
jns 0x41cccc
xor edx, edx
mov esi, eax
mov ecx, edx
pop ebp
call fcn.0041bfe7
jb 0x41cd06
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041f502
call fcn.0041c81b
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
pop ebp
call fcn.0041f502
jmp 0x41ccf8
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.004152b1

Function at 0x41cd12
Capabilities:
Terminate process

Disassembly:
push eax
call fcn.0041cd86
jb 0x41ccfe
cmp ecx, edx
ja 0x41ccfe
mov eax, esi
add esi, edx
sub esi, ecx
mov ebx, ecx
mov ebp, edi
repe cmpsb byte [esi], byte es:[edi]
jne 0x41ccc6
sub esi, ebx
sub esi, ebx
sub edx, ebx
jl 0x41ccc6
mov ecx, ebx
mov edi, ebp
jmp 0x41cd28