joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409864
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4098a9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 6
push 0
lea eax, [ebp - 8]
push eax
call sub.wininet.dll_InternetGetConnectedState
test al, al
je 0x40989a
mov dword [ebp - 4], 1
jmp 0x40989f
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4098b3
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x409a1c
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00403428
xor eax, eax
push ebp
push 0x409b97
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x409b6a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
call fcn.00403438
mov ebx, eax
push ebx
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x409b60
xor edx, edx
push ebp
push 0x409b56
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x409aa1
pop dword fs:[0]
add esp, 8
pop dword fs:[0]
add esp, 8
jmp 0x409b74
xor edx, edx
push ebp
push 0x409b42
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dl, byte [eax]
mov byte [ebp - 4], dl
mov dl, byte [eax + 1]
mov byte [ebp - 3], dl
mov dl, byte [eax + 2]
mov byte [ebp - 2], dl
mov al, byte [eax + 3]
mov byte [ebp - 1], al
lea edx, [ebp - 0x14]
xor eax, eax
mov al, byte [ebp - 4]
call fcn.00404b48
push dword [ebp - 0x14]
push 0x409bb0
lea edx, [ebp - 0x18]
xor eax, eax
mov al, byte [ebp - 3]
call fcn.00404b48
push dword [ebp - 0x18]
push 0x409bb0
lea edx, [ebp - 0x1c]
xor eax, eax
mov al, byte [ebp - 2]
call fcn.00404b48
push dword [ebp - 0x1c]
push 0x409bb0
lea edx, [ebp - 0x20]
xor eax, eax
mov al, byte [ebp - 1]
call fcn.00404b48
push dword [ebp - 0x20]
lea eax, [ebp - 0x10]
mov edx, 7
call fcn.00403334
mov eax, dword [ebp - 0x10]
call fcn.00403438
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x409b4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x409b60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x409b74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409b9e
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.004030f8
lea eax, [ebp - 8]
call fcn.004030d4
ret
Function at 0x409bb4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe24
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x409c71
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1dc]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.004030d4
push pe_nt_image_headers32
lea eax, [ebp - 0x4c]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x4c]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x409c0e
pop dword fs:[0]
add esp, 8
jmp 0x409c7b
mov eax, dword [eax + 0xc]
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x409c55
xor eax, eax
push ebp
push 0x409c4b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
push dword [ebx]
call sub.wsock32.dll_inet_ntoa
mov edx, dword [ebp - 4]
call fcn.004088a0
inc dword [ebp - 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x409c55
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov ebx, dword [eax + edx*4]
test ebx, ebx
jne 0x409c1b
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x409c7b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a590
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x4119b0]
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
mov esi, eax
cmp byte [esi], 0
je 0x40a74c
lea eax, [ebp - 0x118]
mov edx, esi
call fcn.0040a759
mov eax, esi
call fcn.0040a781
shr eax, 1
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x40a5d5
mov byte [esi], 0
jmp 0x40a74c
lea eax, [ebp - 0x118]
mov dword [ebp - 0x14], eax
mov edi, dword [ebp - 8]
test edi, edi
jl 0x40a5fb
inc edi
xor ebx, ebx
mov eax, dword [ebp - 0x14]
call fcn.0040a4f0
mov byte [esi + ebx], al
add dword [ebp - 0x14], 2
inc ebx
dec edi
jne 0x40a5e8
mov eax, dword [ebp - 8]
mov al, byte [esi + eax - 3]
mov byte [ebp - 0xc], al
mov eax, dword [ebp - 8]
mov al, byte [esi + eax - 2]
mov byte [ebp - 0xb], al
mov eax, dword [ebp - 8]
mov al, byte [esi + eax - 1]
mov byte [ebp - 0xa], al
mov eax, dword [ebp - 8]
mov al, byte [esi + eax]
mov byte [ebp - 9], al
sub dword [ebp - 8], 4
mov eax, dword [ebp - 8]
mov byte [esi + eax + 1], 0
mov dword [0x4119ac], 0xcf671
mov edi, dword [ebp - 8]
jl 0x40a675
inc edi
xor ebx, ebx
xor eax, eax
mov al, byte [esi + ebx]
mov word [ebp - 4], ax
mov eax, 8
call fcn.0040a798
mov byte [ebp - 1], al
push ax
push cx
mov cl, byte [ebp - 1]
mov ax, word [ebp - 4]
rol al, cl
mov word [ebp - 4], ax
pop cx
pop ax
mov al, byte [ebp - 4]
mov byte [esi + ebx], al
inc ebx
dec edi
jne 0x40a640
mov dword [0x4119ac], 0x3039
mov ebx, 0x100
mov edi, dword [ebp - 8]
inc edi
mov eax, edi
call fcn.0040a798
lea eax, [esi + eax]
push eax
mov eax, edi
call fcn.0040a798
lea eax, [esi + eax]
pop edx
call fcn.0040a7ae
dec ebx
jne 0x40a684
mov dword [0x4119ac], 0xa564
mov edi, dword [ebp - 8]
test edi, edi
jl 0x40a6db
inc edi
xor ebx, ebx
xor eax, eax
mov al, byte [esi + ebx]
mov word [ebp - 4], ax
mov eax, 0x100
call fcn.0040a798
xor word [ebp - 4], ax
mov al, byte [ebp - 4]
mov byte [esi + ebx], al
inc ebx
dec edi
jne 0x40a6ba
mov dword [0x4119ac], 0xd431
mov edi, dword [ebp - 8]
test edi, edi
jl 0x40a72c
inc edi
xor ebx, ebx
xor eax, eax
mov al, byte [esi + ebx]
mov word [ebp - 4], ax
mov eax, 0x100
call fcn.0040a798
movzx edx, word [ebp - 4]
add edx, 0x100
sub edx, eax
and edx, 0x800000ff
jns 0x40a71e
dec edx
or edx, 0xffffff00
inc edx
mov word [ebp - 4], dx
mov al, byte [ebp - 4]
mov byte [esi + ebx], al
inc ebx
dec edi
jne 0x40a6ef
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 8]
inc edx
mov eax, esi
call fcn.0040a7b9
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
je 0x40a74c
mov byte [esi], 0
pop edi
mov dword [0x4119b4], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a798
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x4119ac], 0x8088405
inc edx
mov dword [0x4119ac], edx
mul edx
mov eax, edx
ret
Function at 0x40a7b9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
push edi
push esi
push ebx
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea esi, [0x410138]
mov ecx, dword [ebp - 0xc]
or ecx, ecx
je 0x40a7f3
xor ebx, ebx
mov bl, al
shr eax, 8
xor bl, byte [edi]
inc edi
shl ebx, 2
xor eax, dword [esi + ebx]
dec ecx
jne 0x40a7e0
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40b4d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00403428
xor eax, eax
push ebp
push 0x40b5d2
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.0040b318
pop ecx
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.0040316c
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 1]
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 2]
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 3]
mov byte [ebp - 0x11], al
xor dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0xc]
mov ecx, 4
mov edx, 1
call fcn.004034bc
lea eax, [ebp - 0x10]
call fcn.004030d4
mov eax, dword [ebp - 0xc]
call fcn.00403274
mov ebx, eax
cmp ebx, 1
jl 0x40b583
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
xor dl, 0x5a
call fcn.004031ec
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
call fcn.0040327c
dec ebx
test ebx, ebx
jne 0x40b561
mov eax, dword [ebp - 0x10]
call fcn.00403274
cmp eax, dword [ebp - 0x14]
je 0x40b59f
mov eax, dword [ebp - 4]
mov edx, 0x40b5e8
call fcn.00403128
jmp 0x40b5aa
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
call fcn.00403128
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b5d9
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004030f8
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004030f8
ret
Function at 0x401d40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [0x40fd78], 0
call fcn.004020e0
mov eax, 1
test eax, eax
je 0x401e93
mov dword [ebp - 0xc], 0
jmp 0x401d74
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [0x40d934]
jge 0x401db6
mov eax, dword [ebp - 0xc]
cmp dword [eax*4 + 0x40fd7c], 3
jne 0x401db4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx*4 + 0x40d938]
mov dword [0x40fd78], edx
mov eax, dword [ebp - 0xc]
mov dword [eax*4 + 0x40fd7c], 4
mov eax, 1
jmp 0x401e95
jmp 0x401d6b
mov dword [ebp - 0xc], 0
jmp 0x401dc8
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [0x40d934]
jge 0x401de4
mov eax, dword [ebp - 0xc]
cmp dword [eax*4 + 0x40fd7c], 2
je 0x401de2
jmp 0x401de4
jmp 0x401dbf
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [0x40d934]
jne 0x401df6
xor eax, eax
jmp 0x401e95
cmp dword [0x40d92c], 0x10
jge 0x401e86
mov dword [ebp - 0xc], 0
jmp 0x401e15
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x40d934]
jge 0x401e31
mov ecx, dword [ebp - 0xc]
cmp dword [ecx*4 + 0x40fd7c], 0
jne 0x401e2f
jmp 0x401e31
jmp 0x401e0c
mov edx, dword [ebp - 0xc]
cmp edx, dword [0x40d934]
je 0x401e7c
mov eax, dword [ebp - 0xc]
mov dword [eax*4 + 0x40fd7c], 1
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x401ea0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401e7a
mov eax, dword [ebp - 0xc]
mov dword [eax*4 + 0x40fd7c], 0
jmp 0x401e84
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x401e8e
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x401d55
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4020e0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
push edi
mov dword [0x40d930], 0
mov eax, dword [0x40d930]
mov dword [0x40fd78], eax
mov dword [ebp - 8], 0
jmp 0x40210e
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [0x411d7c]
jge 0x402263
lea eax, [ebp - 0x30]
push eax
push 3
push 0xa
push 0
mov ecx, dword [ebp - 8]
shl ecx, 6
add ecx, 0x40f938
push ecx
push str.yahoo.com
call fcn.004023a0
add esp, 0x18
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x40214f
jmp 0x40225e
mov edx, dword [ebp - 8]
shl edx, 6
add edx, 0x40f938
mov dword [0x40d930], edx
lea eax, [ebp - 0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
jne 0x402226
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x40219c
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx + 0xc]
cmp dword [edx], 0
jne 0x4021a1
jmp 0x40224a
mov eax, dword [ebp - 0x4c]
movsx ecx, word [eax + 0xa]
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 0xc]
mov esi, dword [eax]
lea edi, [ebp - 0x44]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call sub.MSVCRT.dll_malloc
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x4021f0
jmp 0x40224a
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x34], 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call fcn.00401c70
add esp, 4
cmp dword [ebp - 0x34], 0
je 0x40224a
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call sub.MSVCRT.dll_free
add esp, 4
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402167
jmp 0x402263
jmp 0x402105
cmp dword [0x40d930], 0
jne 0x402276
mov dword [0x40d930], 0x40f938
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov dword [ebp - 0x10], 0x80
mov dword [ebp - 4], 1
mov byte [0x40fcf8], 0
mov dword [ebp - 8], 1
jmp 0x4022b0
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xa
jge 0x402331
mov ecx, dword [ebp - 8]
push ecx
push str.SoftwareMicrosoftInternet_Account_ManagerAccounts0000000_d
lea edx, [ebp - 0x90]
push edx
call sub.MSVCRT.dll_sprintf
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x90]
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40232c
lea edx, [ebp - 0x10]
push edx
push 0x40fcf8
lea eax, [ebp - 4]
push eax
push 0
push str.SMTP_Server
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402322
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x402333
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4022a7
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x405750
Capabilities:
Delete file
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push edi
lea eax, [ebp - 0x190]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40577a
mov eax, 1
jmp 0x40587c
push 0
call sub.MSVCRT.dll_time
add esp, 4
push eax
call sub.MSVCRT.dll_srand
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push str.c:_a.hta
call sub.MSVCRT.dll_remove
add esp, 4
push str.c:_a.com
call sub.MSVCRT.dll_remove
add esp, 4
call fcn.00409bb0
mov dword [0x411ee4], eax
push 0
push 0
push 1
call fcn.00405d50
add esp, 0xc
call fcn.004058c0
push 0xffffffffffffffff
push 0
push 2
call fcn.00405d50
add esp, 0xc
call fcn.00405c70
push 0x1770
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0
push 3
call fcn.00405d50
add esp, 0xc
call fcn.00401a40
push 0
push 0
push 4
call fcn.00405d50
add esp, 0xc
mov ecx, 0x20
xor eax, eax
mov edi, 0x40fcf8
rep stosd dword es:[edi], eax
call fcn.00402280
call fcn.00401d40
test eax, eax
jne 0x405844
call fcn.00402280
test eax, eax
jne 0x40583a
push 0
call sub.MSVCRT.dll_exit
mov dword [0x4123f0], 0xa
push 0xea60
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0
push 5
call fcn.00405d50
add esp, 0xc
call fcn.00405890
push 0
mov ecx, dword [0x41727c]
push ecx
push 6
call fcn.00405d50
add esp, 0xc
call fcn.004058b0
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x405cf0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
push str.0x23273862
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov dword [0x411ee8], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x405d35
push 1
call sub.MSVCRT.dll_exit
cmp dword [0x411ee8], 0
jne 0x405d4b
push 0x1388
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x405d0b
mov esp, ebp
pop ebp
ret

Function at 0x405d50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov dword [ebp - 0x410], str.c:csrss.bin
cmp dword [0x411ddc], 0
je 0x405d76
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x405d63
mov dword [0x411ddc], 1
mov dword [ebp - 4], 0
push 0x40d1f0
mov eax, dword [ebp - 0x410]
push eax
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
je 0x405db7
cmp dword [ebp + 8], 1
jne 0x405db7
push 1
call sub.MSVCRT.dll_exit
cmp dword [ebp - 0x40c], 0
je 0x405e14
mov ecx, dword [ebp - 0x40c]
push ecx
push 0x3ff
push 1
lea edx, [ebp - 0x408]
push edx
call sub.MSVCRT.dll_fread
add esp, 0x10
mov byte [ebp - 9], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 8]
push eax
push str._d__d__d__d
lea ecx, [ebp - 0x408]
push ecx
call sub.MSVCRT.dll_sscanf
add esp, 0x18
mov edx, dword [ebp - 0x40c]
push edx
call sub.MSVCRT.dll_fclose
add esp, 4
cmp dword [ebp + 0x10], 0xffffffff
jne 0x405e23
mov dword [ebp - 4], 0
jmp 0x405e2c
mov eax, dword [ebp - 4]
add eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0x40d1e0
mov ecx, dword [ebp - 0x410]
push ecx
call sub.MSVCRT.dll_fopen
add esp, 8
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
je 0x405e8b
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [0x4123f0]
push ecx
mov edx, dword [0x411ee4]
push edx
push str._d__d__d__d
mov eax, dword [ebp - 0x40c]
push eax
call sub.MSVCRT.dll_fprintf
add esp, 0x18
mov ecx, dword [ebp - 0x40c]
push ecx
call sub.MSVCRT.dll_fclose
add esp, 4
mov dword [0x411ddc], 0
mov esp, ebp
pop ebp
ret
Function at 0x406bb0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
cmp dword [ebp + 0x18], 0
je 0x406bf0
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x18]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [edx]
push ecx
call fcn.00406b80
add esp, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
jmp 0x406bf7
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0x18], 0
je 0x406c3e
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00406670
add esp, 8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 0x20]
mov dword [edx], eax
mov ecx, dword [ebp - 0x1c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x40a640
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [0x4178cc], 0
call fcn.0040b210
call fcn.00402cc0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x4178d0]
jge 0x40a7d1
mov ecx, dword [0x4178cc]
cmp ecx, dword [0x4178d4]
jge 0x40a7c1
mov edx, dword [ebp - 0xc]
mov eax, dword [edx*4 + 0x41245c]
push eax
call fcn.0040ad60
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [0x4e66c0], 1
jmp 0x40a6b3
mov ecx, dword [0x4e66c0]
add ecx, 1
mov dword [0x4e66c0], ecx
mov edx, dword [0x4e66c0]
cmp edx, dword [0x417890]
jge 0x40a752
mov eax, dword [ebp - 0xc]
add eax, dword [0x4e66c0]
cmp eax, dword [0x4178d0]
jl 0x40a6d8
jmp 0x40a752
mov ecx, dword [ebp - 0xc]
add ecx, dword [0x4e66c0]
mov edx, dword [ecx*4 + 0x41245c]
push edx
call fcn.0040ad60
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dl, byte [ecx]
mov byte [ebp - 0x21], dl
mov eax, dword [ebp - 0x1c]
cmp dl, byte [eax]
jne 0x40a737
cmp byte [ebp - 0x21], 0
je 0x40a72e
mov ecx, dword [ebp - 0x20]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x22], dl
mov eax, dword [ebp - 0x1c]
cmp dl, byte [eax + 1]
jne 0x40a737
add dword [ebp - 0x20], 2
add dword [ebp - 0x1c], 2
cmp byte [ebp - 0x22], 0
jne 0x40a6fa
mov dword [ebp - 0x28], 0
jmp 0x40a73f
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x2c], 0
je 0x40a74d
jmp 0x40a752
jmp 0x40a6a4
mov eax, dword [ebp - 0xc]
shl eax, 0x10
add eax, dword [0x4e66c0]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x4178cc]
add ecx, 1
mov dword [0x4178cc], ecx
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
push 0x40a830
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40a7ab
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, dword [0x4178cc]
sub ecx, 1
mov dword [0x4178cc], ecx
jmp 0x40a7b7
mov edx, dword [ebp - 0xc]
add edx, dword [0x4e66c0]
mov dword [ebp - 0xc], edx
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40a7cc
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40a661
mov eax, 1
test eax, eax
je 0x40a822
mov dword [ebp - 0x18], 0
jmp 0x40a7ec
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
cmp edx, dword [0x4178d0]
jge 0x40a808
mov eax, dword [ebp - 0x18]
cmp dword [eax*4 + 0x47c8c0], 0
jne 0x40a806
jmp 0x40a808
jmp 0x40a7e3
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [0x4178d0]
jne 0x40a815
jmp 0x40a822
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40a7d1
mov esp, ebp
pop ebp
ret
Function at 0x40b380
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov ecx, 1
test ecx, ecx
je 0x40b3f7
mov edx, dword [ebp + 0x10]
sub edx, 1
cmp dword [ebp - 8], edx
jl 0x40b3a9
jmp 0x40b3f7
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
je 0x40b3c4
xor eax, eax
jmp 0x40b403
movsx edx, byte [ebp - 4]
cmp edx, 0xd
je 0x40b3ea
movsx eax, byte [ebp - 4]
cmp eax, 0xa
je 0x40b3ea
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
mov dl, byte [ebp - 4]
mov byte [ecx], dl
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
movsx ecx, byte [ebp - 4]
cmp ecx, 0xa
jne 0x40b3f5
jmp 0x40b3f7
jmp 0x40b393
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
mov byte [edx], 0
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x40b410
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
cmp dword [ebp - 4], ecx
je 0x40b450
xor eax, eax
jmp 0x40b453
mov eax, dword [ebp + 0xc]
pop edi
mov esp, ebp
pop ebp
ret